Reject new users form logging in

[Ondrej Valousek]

Hi List,

We I know I am probably crying at the wrong grave - but I'll give it a try anyway :):

Does anyone know if I can somehow prevent new users from logging in to a certain machine?
We have a logon server here with SSSD which needs a maintenance.
I know there is pam_nologin, but I still need to allow users with disconnected NX sessions
there to connect and properly terminate those.

Thanks,
Ondrej

-----

The information contained in this e-mail and in any attachments is confidential and is
designated solely for the attention of the intended recipient(s). If you are not an
intended recipient, you must not use, disclose, copy, distribute or retain this e-mail or
any part thereof. If you have received this e-mail in error, please notify the sender by
return e-mail and delete all copies of this e-mail from your computer system(s). Please
direct any additional queries to: communications(a)s3group.com. Thank You. Silicon and
Software Systems Limited (S3 Group). Registered in Ireland no. 378073. Registered Office:
South County Business Park, Leopardstown, Dublin 18.

[mathias dufresne]

Hi,

You could have a look into /etc/security/access.conf. Perhaps that's what
you are looking for...

Cheers,

mathias

2015-07-16 12:07 GMT+02:00 Ondrej Valousek <Ondrej.Valousek(a)s3group.com&gt;:

>   Hi List,
>
>
>
>  We I know I am probably crying at the wrong grave – but I’ll give it a try
>  anyway J:
>
>
>
>  Does anyone know if I can somehow prevent new users from logging in to a
>  certain machine? We have a logon server here with SSSD which needs a
>  maintenance.
>
>  I know there is pam_nologin, but I still need to allow users with
>  disconnected NX sessions there to connect and properly terminate those.
>
>
>
>  Thanks,
>
>  Ondrej
>
>  -----
>
>  The information contained in this e-mail and in any attachments is confidential and is
> designated solely for the attention of the intended recipient(s). If you are not an
> intended recipient, you must not use, disclose, copy, distribute or retain this e-mail or
> any part thereof. If you have received this e-mail in error, please notify the sender by
> return e-mail and delete all copies of this e-mail from your computer system(s). Please
> direct any additional queries to: communications(a)s3group.com. Thank You. Silicon and
> Software Systems Limited (S3 Group). Registered in Ireland no. 378073. Registered Office:
> South County Business Park, Leopardstown, Dublin 18.
>
>
>  _______________________________________________
>  sssd-users mailing list
>  sssd-users(a)lists.fedorahosted.org
>  https://lists.fedorahosted.org/mailman/listinfo/sssd-users
>
>

[Dmitri Pal]

On 07/16/2015 06:07 AM, Ondrej Valousek wrote:
>  Hi List,
>
>  We I know I am probably crying at the wrong grave – but I’ll give it a 
>  try anyway J:
>
>  Does anyone know if I can somehow prevent new users from logging in to 
>  a certain machine? We have a logon server here with SSSD which needs a 
>  maintenance.
>
>  I know there is pam_nologin, but I still need to allow users with 
>  disconnected NX sessions there to connect and properly terminate those.
>  
What kind of central access control you use?
You can set something in your LDAP if you use LDAP based access control 
or change HBAC rules if you use IPA.

>  Thanks,
>
>  Ondrej
>
>  -----
>
>  The information contained in this e-mail and in any attachments is confidential and is
> designated solely for the attention of the intended recipient(s). If you are not an
> intended recipient, you must not use, disclose, copy, distribute or retain this e-mail or
> any part thereof. If you have received this e-mail in error, please notify the sender by
> return e-mail and delete all copies of this e-mail from your computer system(s). Please
> direct any additional queries to: communications(a)s3group.com. Thank You. Silicon and
> Software Systems Limited (S3 Group). Registered in Ireland no. 378073. Registered Office:
> South County Business Park, Leopardstown, Dublin 18.
>
>
>
>  _______________________________________________
>  sssd-users mailing list
>  sssd-users(a)lists.fedorahosted.org
>  https://lists.fedorahosted.org/mailman/listinfo/sssd-users 

-- 
Thank you,
Dmitri Pal

Director of Engineering for IdM portfolio
Red Hat, Inc.

[Ondrej Valousek]

Well, can we use HBAC with AD backend?
Don’t think so….
O.

From: sssd-users-bounces(a)lists.fedorahosted.org
[mailto:[e-mail]] On Behalf Of Dmitri Pal
Sent: 16 July 2015 16:05
To: sssd-users(a)lists.fedorahosted.org
Subject: Re: [SSSD-users] Reject new users form logging in

On 07/16/2015 06:07 AM, Ondrej Valousek wrote:
Hi List,

We I know I am probably crying at the wrong grave – but I’ll give it a try anyway ☺:

Does anyone know if I can somehow prevent new users from logging in to a certain machine?
We have a logon server here with SSSD which needs a maintenance.
I know there is pam_nologin, but I still need to allow users with disconnected NX sessions
there to connect and properly terminate those.

What kind of central access control you use?
You can set something in your LDAP if you use LDAP based access control or change HBAC
rules if you use IPA.



Thanks,
Ondrej

-----



The information contained in this e-mail and in any attachments is confidential and is
designated solely for the attention of the intended recipient(s). If you are not an
intended recipient, you must not use, disclose, copy, distribute or retain this e-mail or
any part thereof. If you have received this e-mail in error, please notify the sender by
return e-mail and delete all copies of this e-mail from your computer system(s). Please
direct any additional queries to:
[e-mail]<mailto:[e-mail]>. Thank You. Silicon
and Software Systems Limited (S3 Group). Registered in Ireland no. 378073. Registered
Office: South County Business Park, Leopardstown, Dublin 18.





_______________________________________________

sssd-users mailing list

[e-mail]<mailto:[e-mail]>

https://lists.fedorahosted.org/mailman/listinfo/sssd-users




--

Thank you,

Dmitri Pal



Director of Engineering for IdM portfolio

Red Hat, Inc.

-----

The information contained in this e-mail and in any attachments is confidential and is
designated solely for the attention of the intended recipient(s). If you are not an
intended recipient, you must not use, disclose, copy, distribute or retain this e-mail or
any part thereof. If you have received this e-mail in error, please notify the sender by
return e-mail and delete all copies of this e-mail from your computer system(s). Please
direct any additional queries to: communications(a)s3group.com. Thank You. Silicon and
Software Systems Limited (S3 Group). Registered in Ireland no. 378073. Registered Office:
South County Business Park, Leopardstown, Dublin 18.

[Lukas Slebodnik]

On (16/07/15 14:07), Ondrej Valousek wrote:
> Well, can we use HBAC with AD backend?
> Don’t think so…. 
You can use GPO with recent version of sssd.

LS

[Dmitri Pal]

On 07/16/2015 10:24 AM, Lukas Slebodnik wrote:
>  On (16/07/15 14:07), Ondrej Valousek wrote:
> > Well, can we use HBAC with AD backend?
> > Don’t think so….
>  You can use GPO with recent version of sssd.
>
>  LS 
But you can also use the basic LDAP based access control that relies on 
a filter.
See sssd-ldap. Search for "filter". There are some restrictions though.

-- 
Thank you,
Dmitri Pal

Director of Engineering for IdM portfolio
Red Hat, Inc.

[Ondrej Valousek]

Ok, I could do this, but it involves changing sssd configuration.
The GPO is much nicer solution - is it now working? It is not clear from the documentation
whether it is still a "wish list" or not...
O.

-----Original Message-----
From: sssd-users-bounces(a)lists.fedorahosted.org
[mailto:[e-mail]] On Behalf Of Dmitri Pal
Sent: 16 July 2015 16:42
To: End-user discussions about the System Security Services Daemon
<sssd-users(a)lists.fedorahosted.org&gt;
Subject: Re: [SSSD-users] Reject new users form logging in

On 07/16/2015 10:24 AM, Lukas Slebodnik wrote:
>  On (16/07/15 14:07), Ondrej Valousek wrote:
> > Well, can we use HBAC with AD backend?
> > Don’t think so….
>  You can use GPO with recent version of sssd.
>
>  LS
>  
But you can also use the basic LDAP based access control that relies on a filter.
See sssd-ldap. Search for "filter". There are some restrictions though.

--
Thank you,
Dmitri Pal

Director of Engineering for IdM portfolio Red Hat, Inc.

_______________________________________________
sssd-users mailing list
sssd-users(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/sssd-users

-----

The information contained in this e-mail and in any attachments is confidential and is
designated solely for the attention of the intended recipient(s). If you are not an
intended recipient, you must not use, disclose, copy, distribute or retain this e-mail or
any part thereof. If you have received this e-mail in error, please notify the sender by
return e-mail and delete all copies of this e-mail from your computer system(s). Please
direct any additional queries to: communications(a)s3group.com. Thank You. Silicon and
Software Systems Limited (S3 Group). Registered in Ireland no. 378073. Registered Office:
South County Business Park, Leopardstown, Dublin 18.

[Dmitri Pal]

On 07/16/2015 10:46 AM, Ondrej Valousek wrote:
>  Ok, I could do this, but it involves changing sssd configuration.
>  The GPO is much nicer solution - is it now working? It is not clear from the
> documentation whether it is still a "wish list" or not... 
It is in sssd 1.12.
But it is disabled by default you need to configure it anyways.

>  O.
>
>  -----Original Message-----
>  From: sssd-users-bounces(a)lists.fedorahosted.org
> [mailto:[e-mail]] On Behalf Of Dmitri Pal
>  Sent: 16 July 2015 16:42
>  To: End-user discussions about the System Security Services Daemon
> <sssd-users(a)lists.fedorahosted.org&gt;
>  Subject: Re: [SSSD-users] Reject new users form logging in
>
>  On 07/16/2015 10:24 AM, Lukas Slebodnik wrote:
> > On (16/07/15 14:07), Ondrej Valousek wrote:
> >> Well, can we use HBAC with AD backend?
> >> Don’t think so….
> > You can use GPO with recent version of sssd.
> >
> > LS
>  But you can also use the basic LDAP based access control that relies on a filter.
>  See sssd-ldap. Search for "filter". There are some restrictions though.
>
>  --
>  Thank you,
>  Dmitri Pal
>
>  Director of Engineering for IdM portfolio Red Hat, Inc.
>
>  _______________________________________________
>  sssd-users mailing list
>  sssd-users(a)lists.fedorahosted.org
>  https://lists.fedorahosted.org/mailman/listinfo/sssd-users
>
>  -----
>
>  The information contained in this e-mail and in any attachments is confidential and is
> designated solely for the attention of the intended recipient(s). If you are not an
> intended recipient, you must not use, disclose, copy, distribute or retain this e-mail or
> any part thereof. If you have received this e-mail in error, please notify the sender by
> return e-mail and delete all copies of this e-mail from your computer system(s). Please
> direct any additional queries to: communications(a)s3group.com. Thank You. Silicon and
> Software Systems Limited (S3 Group). Registered in Ireland no. 378073. Registered Office:
> South County Business Park, Leopardstown, Dublin 18. 

-- 
Thank you,
Dmitri Pal

Director of Engineering for IdM portfolio
Red Hat, Inc.

[Jakub Hrozek]

On Thu, Jul 16, 2015 at 10:48:41AM -0400, Dmitri Pal wrote:
>  On 07/16/2015 10:46 AM, Ondrej Valousek wrote:
>  >Ok, I could do this, but it involves changing sssd configuration.
>  >The GPO is much nicer solution - is it now working? It is not clear from the
> documentation whether it is still a "wish list" or not...
>  
>  It is in sssd 1.12.
>  But it is disabled by default you need to configure it anyways. 
It's "permissive" by default in 1.12 and "enforcing" by default in
1.13.
Permissive means similar thing as with SELinux -- the engine runs and
reports results, but the results are not enforced.

Please note that Lukas recently ran SSSD through tests with enforcing
mode and found a couple of bugs, see the 1.13.1 bucket for bugs with GPO
in the title.