[PATCH] Adding -std=gnu99 flag.
by Michal Židek
GCC defaults to gnu89 if no explicit standard was set by -std flag.
I think there is no reason to stick to this old standard. It was
discussed earlier off-list and if nobody has anything against it,
please apply this patch to use gnu99 instead of 89 (for gcc).
The patch is attached.
Thanks
Michal
11 years, 7 months
SSSD developer package for 3rd party application integration with IPA
by Michael Mercier
Hello,
I was wondering if there are any plans to create a sssd-devel package that would expose some of the functionality for third party applications?
I am specifically interested in accessing the HBAC rules processing functions with the ability to be able to pass arbitrary username/hostnames.
Thanks,
Mike
11 years, 7 months
[PATCH] RPM: Always include the patch file
by Jakub Hrozek
I broke our nightly builds earlier today. The reason was that including
the Patch file was conditional as well, but that doesn't work because
our SRPMs are built on RHEL6 but rebuilt into binary RPMs in mock.
The attached patch always includes the patch file. I've tested it by
running make srpm on RHEL6 and rebuilding the SRPM on Fedora 17.
11 years, 7 months
daemon using sss (PAM) for auth / account
by Michael Mercier
Hello,
I am in the process of doing a proof-of-concept to use FreeIPA as a
backend for the tac_plus (tacacs+) daemon.
PAM authentication was already built in to the application and works
with FreeIPA. I have added some code to tac_plus to also use the
account section of the pam file and I have a question regarding (maybe
this is PAM specific?) how pam_sss works with HBAC.
I have done the following in FreeIPA:
1. Created a DNS entry for my device: pix.beta.local <-> 192.168.0.1
2. Disabled the 'allow_all' HBAC rule
3. Created an HBAC rule tacacs with the following:
a) who: user group: ciscoadmin - user mike is part of ciscoadmin
b) Accessing: hosts: pix.beta.local
c) via service: tac_plus
d) from: any host
I can successfully login (auth) to a Cisco ASA via the tac_plus daemon
using PAM, but accounting is giving permission denied.
Aug 28 16:13:34 ipaserver tac_plus[2217]: pam_sss(tac_plus:auth):
authentication success; logname=root uid=0 euid=0 tty= ruser=
rhost=192.168.0.1 user=mike
Aug 28 16:13:34 ipaserver tac_plus[2217]: pam_sss(tac_plus:account):
Access denied for user mike: 6 (Permission denied)
NOTE: I have hardcoded the rhost setting with pam_set_item(pam_handle,
PAM_RHOST, "192.168.0.1")
I see the following in my audit.log
type=USER_AUTH msg=audit(1346184814.834:168): user pid=2217 uid=0
auid=0 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0-
s0:c0.c1023 msg='op=PAM:authentication acct="mike" exe="/home/tacacs/
tacacs+-F4.0.4.26/.libs/lt-tac_plus" hostname=192.168.0.1
addr=192.168.0.1 terminal=pts/0 res=success'
type=USER_ACCT msg=audit(1346184814.845:169): user pid=2217 uid=0
auid=0 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0-
s0:c0.c1023 msg='op=PAM:accounting acct="mike" exe="/home/tacacs/tacacs
+-F4.0.4.26/.libs/lt-tac_plus" hostname=192.168.0.1 addr=192.168.0.1
terminal=pts/0 res=failed'
It seems that the machine the daemon is running on
(ipaserver.beta.local) is being used for the HBAC rule (at least that
is what is looks like from the dirsrv access log)
[28/Aug/2012:16:13:33 -0400] conn=29 op=45 SRCH
base="cn=hbac,dc=beta,dc=local" scope=2
filter="(&(objectClass=ipaHBACRule)(ipaEnabledFlag=TRUE)(|
(hostCategory=all)
(memberHost
=
fqdn
=ipaserver.beta.local,cn=computers,cn=accounts,dc=beta,dc=local)))"
attrs="objectClass cn ipaUniqueID ipaEnabledFlag accessRuleType
memberUser userCategory memberService serviceCategory sourceHost
sourceHostCategory externalHost memberHost hostCategory"
If I add the host (ipaserver.beta.local) the daemon is running on to
the 'Accessing' list or enable the 'allow_all' rule, I am able to login.
NOTE: ipaserver.beta.local is also the IPA server (running all ipa
services)
My questions:
How is 'hostname' & 'addr' in the audit.log being generated? Is PAM
sending these messages to the log (or is this something auditd
specific)? Does one or both of them come via the rhost variable from
pam_set_item?
Is it possible to pass 'hostname' or 'addr' as the variable for
checking the HBAC rule?
Thanks,
Mike
11 years, 8 months
[PATCH] Fix fallback in validate_tgt()
by Sumit Bose
Hi,
this patch should fix the trusted domain use case by fixing an error
which prevented the intended behaviour in validate_tgt(). Details about
TGT validation should be also explained in the man page, but since there
is already the string freeze for 1.9 I opened
https://fedorahosted.org/sssd/ticket/1499 to track this.
The second patch just replace the remaining old debug levels with the
new ones.
bye,
Sumit
11 years, 8 months
