[PATCH] allowed_shells: using wildcard for any shell
by Denis Kutin
Dear friends,
Using sssd, for a long time, I have come across with a problem recently,
which I would like to solve with your help.
I provide centralized authentication and authorization service for a huge
heterogeneous network. And in my case it would be "nice and easy" if sssd
used only shells(5). I believe this mechanism is sufficient for
identification of an allowed shell.
I take a liberty to offer you this tiny patch, which will let use wildcard
(*) in param allowed_shells in sssd.conf
What do you think about it?
--
Denis Kutin
9 years, 6 months
[PATCHES] LDAP: SID-Mapping - Store non-POSIX users in cache if they have a SID
by Pavel Reichl
Hello,
please see attached patches.
I have briefly discussed with Jakub how to handle saving users with uid
0 whether to resurrect sysdb_add_fake_user or modify existing fuctions
for storing users. I decided to add wrapper function around existing
ones to minimize changes in code which calls them.
Thanks,
Pavel Reichl
9 years, 6 months
[PATCH] PAM: Add domains= option to pam_sss
by Daniel Gollub
Fixes:
https://fedorahosted.org/sssd/ticket/1021
Signed-off-by: Daniel Gollub <dgollub(a)brocade.com>
Reviewed-by: Sven-Thorsten Dietrich <sven(a)brocade.com>
---
src/providers/data_provider.h | 1 +
src/responder/pam/pamsrv_cmd.c | 44 +++++++++++++++++++++++++++++++++++++++++-
src/sss_client/pam_sss.c | 29 ++++++++++++++++++++++++++--
src/sss_client/sss_cli.h | 1 +
4 files changed, 72 insertions(+), 3 deletions(-)
diff --git a/src/providers/data_provider.h b/src/providers/data_provider.h
index ebb4fad..0abfd0f 100644
--- a/src/providers/data_provider.h
+++ b/src/providers/data_provider.h
@@ -170,6 +170,7 @@ struct pam_data {
char *tty;
char *ruser;
char *rhost;
+ char **requested_domains;
struct sss_auth_token *authtok;
struct sss_auth_token *newauthtok;
uint32_t cli_pid;
diff --git a/src/responder/pam/pamsrv_cmd.c b/src/responder/pam/pamsrv_cmd.c
index 140d541..c6539e5 100644
--- a/src/responder/pam/pamsrv_cmd.c
+++ b/src/responder/pam/pamsrv_cmd.c
@@ -44,6 +44,26 @@ enum pam_verbosity {
static void pam_reply(struct pam_auth_req *preq);
+static bool is_domain_requested(struct pam_data *pd, const char *domain_name)
+{
+ int i;
+
+ /* If none specific domains got requested via pam, all domains are allowed.
+ * Which mimics the default/original behaviour.
+ */
+ if (!pd->requested_domains)
+ return true;
+
+ for (i = 0; pd->requested_domains[i]; i++) {
+ if (strcmp(domain_name, pd->requested_domains[i]))
+ continue;
+
+ return true;
+ }
+
+ return false;
+}
+
static int extract_authtok_v2(struct sss_auth_token *tok,
size_t data_size, uint8_t *body, size_t blen,
size_t *c)
@@ -146,6 +166,7 @@ static int pam_parse_in_data_v2(struct sss_domain_info *domains,
int ret;
uint32_t start;
uint32_t terminator;
+ char *requested_domains;
if (blen < 4*sizeof(uint32_t)+2) {
DEBUG(SSSDBG_CRIT_FAILURE, "Received data is invalid.\n");
@@ -202,6 +223,16 @@ static int pam_parse_in_data_v2(struct sss_domain_info *domains,
ret = extract_string(&pd->rhost, size, body, blen, &c);
if (ret != EOK) return ret;
break;
+ case SSS_PAM_ITEM_REQUESTED_DOMAINS:
+ ret = extract_string(&requested_domains, size, body, blen, &c);
+ if (ret != EOK) return ret;
+ ret = split_on_separator(pd, requested_domains, ',', true, true,
+ &pd->requested_domains, NULL);
+ if (ret != EOK) {
+ DEBUG(1, ("Failed to parse requested_domains list!\n"));
+ return ret;
+ }
+ break;
case SSS_PAM_ITEM_CLI_PID:
ret = extract_uint32_t(&pd->cli_pid, size,
body, blen, &c);
@@ -836,12 +867,22 @@ static int pam_forwarder(struct cli_ctx *cctx, int pam_cmd)
ret = ENOENT;
goto done;
}
+
+ /* skip this domain if not requested */
+ if (!is_domain_requested(pd, dom->name)) {
+ ret = ENOENT;
+ goto done;
+ }
} else {
for (dom = preq->cctx->rctx->domains;
dom;
dom = get_next_domain(dom, false)) {
if (dom->fqnames) continue;
+ /* skip this domain if not requested */
+ if (!is_domain_requested(pd, dom->name))
+ continue;
+
ncret = sss_ncache_check_user(pctx->ncache, pctx->neg_timeout,
dom, pd->user);
if (ncret == ENOENT) {
@@ -856,7 +897,8 @@ static int pam_forwarder(struct cli_ctx *cctx, int pam_cmd)
"User [%s@%s] filtered out (negative cache). "
"Trying next domain.\n", pd->user, dom->name);
}
- if (!dom) {
+
+ if (!dom || !is_domain_requested(pd, dom->name)) {
ret = ENOENT;
goto done;
}
diff --git a/src/sss_client/pam_sss.c b/src/sss_client/pam_sss.c
index d2502d1..4d76bd2 100644
--- a/src/sss_client/pam_sss.c
+++ b/src/sss_client/pam_sss.c
@@ -58,6 +58,7 @@
#define PW_RESET_MSG_MAX_SIZE 4096
#define OPT_RETRY_KEY "retry="
+#define OPT_DOMAINS_KEY "domains="
struct pam_items {
const char* pam_service;
@@ -81,6 +82,8 @@ struct pam_items {
pid_t cli_pid;
const char *login_name;
char *domain_name;
+ const char *requested_domains;
+ size_t requested_domains_size;
};
#define DEBUG_MGS_LEN 1024
@@ -246,6 +249,9 @@ static int pack_message_v3(struct pam_items *pi, size_t *size,
len += pi->pam_newauthtok != NULL ?
3*sizeof(uint32_t) + pi->pam_newauthtok_size : 0;
len += 3*sizeof(uint32_t); /* cli_pid */
+ len += *pi->requested_domains != '\0' ?
+ 2*sizeof(uint32_t) + pi->requested_domains_size : 0;
+
buf = malloc(len);
if (buf == NULL) {
@@ -271,6 +277,9 @@ static int pack_message_v3(struct pam_items *pi, size_t *size,
rp += add_string_item(SSS_PAM_ITEM_RHOST, pi->pam_rhost, pi->pam_rhost_size,
&buf[rp]);
+ rp += add_string_item(SSS_PAM_ITEM_REQUESTED_DOMAINS, pi->requested_domains, pi->requested_domains_size,
+ &buf[rp]);
+
rp += add_uint32_t_item(SSS_PAM_ITEM_CLI_PID, (uint32_t) pi->cli_pid,
&buf[rp]);
@@ -1061,6 +1070,9 @@ static int get_pam_items(pam_handle_t *pamh, struct pam_items *pi)
pi->domain_name = NULL;
+ if (pi->requested_domains == NULL) pi->requested_domains="";
+ pi->requested_domains_size=strlen(pi->requested_domains)+1;
+
return PAM_SUCCESS;
}
@@ -1080,6 +1092,7 @@ static void print_pam_items(struct pam_items *pi)
D(("Authtok: %s", CHECK_AND_RETURN_PI_STRING(pi->pam_authtok)));
D(("Newauthtok: %s", CHECK_AND_RETURN_PI_STRING(pi->pam_newauthtok)));
D(("Cli_PID: %d", pi->cli_pid));
+ D(("Requested domains: %s", pi->requested_domains));
}
static int send_and_receive(pam_handle_t *pamh, struct pam_items *pi,
@@ -1271,7 +1284,8 @@ static int prompt_new_password(pam_handle_t *pamh, struct pam_items *pi)
}
static void eval_argv(pam_handle_t *pamh, int argc, const char **argv,
- uint32_t *flags, int *retries, bool *quiet_mode)
+ uint32_t *flags, int *retries, bool *quiet_mode,
+ const char **domains)
{
char *ep;
@@ -1284,6 +1298,14 @@ static void eval_argv(pam_handle_t *pamh, int argc, const char **argv,
*flags |= FLAGS_USE_FIRST_PASS;
} else if (strcmp(*argv, "use_authtok") == 0) {
*flags |= FLAGS_USE_AUTHTOK;
+ } else if (strncmp(*argv, OPT_DOMAINS_KEY, strlen(OPT_DOMAINS_KEY)) == 0) {
+ if (*(*argv+strlen(OPT_DOMAINS_KEY)) == '\0') {
+ logger(pamh, LOG_ERR, "Missing argument to option domains.");
+ *domains = '\0';
+ } else {
+ *domains = *argv+strlen(OPT_DOMAINS_KEY);
+ }
+
} else if (strncmp(*argv, OPT_RETRY_KEY, strlen(OPT_RETRY_KEY)) == 0) {
if (*(*argv+6) == '\0') {
logger(pamh, LOG_ERR, "Missing argument to option retry.");
@@ -1443,12 +1465,15 @@ static int pam_sss(enum sss_cli_command task, pam_handle_t *pamh,
bool retry = false;
bool quiet_mode = false;
int retries = 0;
+ const char *domains = NULL;
bindtextdomain(PACKAGE, LOCALEDIR);
D(("Hello pam_sssd: %d", task));
- eval_argv(pamh, argc, argv, &flags, &retries, &quiet_mode);
+ eval_argv(pamh, argc, argv, &flags, &retries, &quiet_mode, &domains);
+
+ pi.requested_domains = domains;
ret = get_pam_items(pamh, &pi);
if (ret != PAM_SUCCESS) {
diff --git a/src/sss_client/sss_cli.h b/src/sss_client/sss_cli.h
index 16a08e1..15f8322 100644
--- a/src/sss_client/sss_cli.h
+++ b/src/sss_client/sss_cli.h
@@ -314,6 +314,7 @@ enum pam_item_type {
SSS_PAM_ITEM_NEWAUTHTOK,
SSS_PAM_ITEM_CLI_LOCALE,
SSS_PAM_ITEM_CLI_PID,
+ SSS_PAM_ITEM_REQUESTED_DOMAINS,
};
#define SSS_NSS_MAX_ENTRIES 256
--
1.9.1
9 years, 7 months
[PATCH] IFP: Suppress 'git diff' noise
by Michal Židek
Hi,
this is not very important patch, but suppresses
behaviour that is bothering some of us for quite
some time.
See patch description for details.
Michal
9 years, 7 months
[PATCH] AD: add config and processing support gpo_map_* options
by Yassir Elley
Hi,
The attached patches add configuring support (patch 1) and processing support (patch 2) for the gpo_map_* set of options. These options are used to map Linux PAM service names to GPO Logon Rights, which in turn map to specific key/value pairs (one for allow, one for deny) in the GptTmpl.inf file. I'm including my write-up (below) from the Design Page (https://fedorahosted.org/sssd/wiki/DesignDocs/ActiveDirectoryGPOIntegration)
Thanks,
Yassir.
<<
GPO policy settings can be used to centrally configure several sets of Windows Logon Rights, with each set classified by its logon method (e.g. interactive, remote interactive) and consisting of a whitelist [and blacklist] of users and groups that are allowed [or denied] access to the computer using the set's logon method. In order to integrate Windows Logon Rights into a Linux environment, we allow pam service names to be mapped to a specific Logon Right. We provide default mappings for all of the commonly used pam service names, but we also allow the admin to add/remove mappings as needed (to support custom pam service names, for example). The latter is done by using a new set of config options of the form "gpo_map_<logon_right>" (i.e. gpo_map_interactive, gpo_map_network, etc), each of which consists of a comma-separated list of entries beginning either with a '+' (for adding to default set) or a '-' (for removing from default set). For example, since the RemoteInteractive logon right maps to a single pam service name ("sshd") by default, an admin could map their own pam service name ("my_pam_service") and remove the "sshd" mapping with the following sssd.conf line:
"gpo_map_remote_interactive = +my_pam_service, -sshd"
For this project, the following options can be used to configure the corresponding Logon Right (default values are also given):
* ad_gpo_map_interactive (default: login, su, su-l, gdm-fingerprint, gdm-password, gdm-smartcard, kdm)
* ad_gpo_map_remote_interactive (default: sshd)
* ad_gpo_map_network (default: ftp, samba)
* ad_gpo_map_batch (default: crond)
* ad_gpo_map_service (default: <not set>)
* ad_gpo_map_permit (default: sudo, sudo-i)
* ad_gpo_map_deny (default: <not set>)
* ad_gpo_default_right (default: deny)
The first five options are used to associate specific pam service names with each logon right. The ad_gpo_map_permit [and ad_gpo_map_deny] is used to specify pam service names for which GPO-based access is always [or never] granted. Unlike the other options, the ad_gpo_map_default_right does not specify pam service names. Rather, it allows the admin to specify a default logon right (or the special permit/deny values)for pam service names that are not explicitly mapped to any of the logon rights. Note that, in many cases, we do not expect the admin will need to specify any of these config options, b/c the defaults have been chosen carefully to cover the most commonly used pam service names (with deny as the default for unmapped service names).
The semantics of each whitelist and blacklist are as follows:
* whitelist ("allow"): When this policy setting is not defined, any user can logon to the computer. When it is defined, only the users and groups specified in the whitelist are allowed to logon to the computer. In other words, by defining this setting, the semantics go from "everyone allowed access to this computer" to "no one allowed access to this computer, except principals on the whitelist".
* blacklist ("deny"): When this policy setting is not defined, it has no effect. When it is defined, the users and groups specified in the blacklist are blocked from performing logons. For a particular Logon Right (e.g. Interactive), if a user/group is specified in both the whitelist and the blacklist, then the blacklist takes precedence.
In summary, if a user is trying to login to a computer (e.g. pam_service_name = "login"), we first find which Logon Right the "login" service maps to (i.e. Interactive, by default), and then process only the corresponding policy settings found in GptTmpl.inf (which contains policy settings for the "Security Settings" extension, of which Logon Rights are a part). In the case of Interactive Logon Right, those policy settings are named SeInteractiveLogonRight and SeDenyInteractiveLogonRight in the GptTmpl.inf file.
>>
9 years, 7 months
sss_cache flush ssh hosts list.
by William
Hi,
I have been working on sssd being able to flush hosts from it's cache.
Here is an initial patch to add the options to the cli of sss_cache.
I have noticed that there are some methods already in src/db/sysdb_ssh.c
like sysdb_update_ssh_known_host_expire: Does that seem like the right
function to call to expire a host?
Advice is appreciated.
--
William Brown <william(a)firstyear.id.au>
9 years, 7 months
[sssd][patch] SYSDB: sysdb_getnetgr returns ENOENT
by Pavel Reichl
Hello,
attached patch is the first of many to solve
https://fedorahosted.org/sssd/ticket/1991
"The return codes of various sysdb operations differ. Some search
operations would return ENOENT if they don't find a matching object some
would return EOK but an empty result list."
I think it would be best if in case that no results were found both
ENOENT value and 'properly' empty list were returned.
Thank for opinions or/and review.
Pavel Reichl
9 years, 7 months
