Bug 1669407
| Summary: | MAN: Document that PAM stack contains the systemd-user service in the account phase in RHEL-8 | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 8 | Reporter: | Madhuri <mupadhye> |
| Component: | sssd | Assignee: | SSSD Maintainers <sssd-maint> |
| Status: | CLOSED ERRATA | QA Contact: | sssd-qe <sssd-qe> |
| Severity: | unspecified | Docs Contact: | lmcgarry |
| Priority: | unspecified | ||
| Version: | 8.0 | CC: | apeetham, dbula, fhanzelk, grajaiya, igkioka, jhrozek, lmanasko, lmcgarry, lslebodn, mzidek, pasik, pbrezina, sbose, sgoveas, thalman, tscherf, vferschm |
| Target Milestone: | rc | ||
| Target Release: | 8.0 | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | sssd-2.2.0-13.el8 | Doc Type: | Bug Fix |
| Doc Text: |
.The `ldap_user_authorized_service` description has been updated in the `sssd-ldap` man page
The Pluggable authentication modules (PAM) stack has been changed in RHEL 8. For example, the `systemd` user session now starts a PAM conversation using the `systemd-user` PAM service. This service now recursively includes the `system-auth` PAM service, which may include the `pam_sss.so` interface. This means that the SSSD access control is always called.
You should be aware of this change when designing access control rules for RHEL 8 systems. For example, you can add the `systemd-user` service to the allowed services list.
Please note for some access control mechanisms, such as IPA HBAC or AD GPOs, the `systemd-user` service has been added to the allowed services list by default and you do not need to take any action.
The `sssd-ldap` man page has been updated to include this information.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2019-11-05 22:34:01 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1682305 | ||
| Bug Blocks: | |||
|
Description
Madhuri
2019-01-25 07:17:35 UTC
(In reply to Madhuri from comment #0) ... > > 5. After commenting 'ldap_access_order = authorized_service and > ldap_user_authorized_service = authorized_service' and > adding ldap_access_filter = (authorizedService=sshd) in sssd.conf, user > authetication is successful. Since according to the working filter rule the LDAP attribute is called 'authorizedService' I'd like to suggest to try with ldap_access_order = authorized_service ldap_user_authorized_service = authorizedService HTH bye, Sumit I tried with the above changes, still, authentications failing, for log, Jan 25 03:40:09 client-4704 sshd[22169]: pam_sss(sshd:auth): authentication success; logname= uid=0 euid=0 tty=ssh ruser= rhost=::1 user=testuser1 Jan 25 03:40:09 client-4704 sshd[22169]: Accepted password for testuser1 from ::1 port 40724 ssh2 Jan 25 03:40:09 client-4704 systemd[22172]: pam_sss(systemd-user:account): system info: [Authorized service attribute has no matching rule, access denied] Jan 25 03:40:09 client-4704 systemd[22172]: pam_sss(systemd-user:account): Access denied for user testuser1: 6 (Permission denied) Jan 25 03:40:09 client-4704 sshd[22169]: pam_systemd(sshd:session): Failed to create session: Start job for unit user failed with 'failed' Jan 25 03:40:09 client-4704 sshd[22169]: pam_unix(sshd:session): session opened for user testuser1 by (uid=0) Jan 25 03:40:09 client-4704 sshd[22169]: error: PAM: pam_open_session(): System error Jan 25 03:40:09 client-4704 sshd[22177]: Received disconnect from ::1 port 40724:11: disconnected by user Jan 25 03:40:09 client-4704 sshd[22177]: Disconnected from user testuser1 ::1 port 40724 Hi, can you try to add another value 'systemd-user' to the authorizedService attribute. HTH bye, Sumit Added new user, # testuser2, People, example.com dn: uid=testuser2,ou=People,dc=example,dc=com objectClass: posixAccount objectClass: account objectClass: authorizedServiceObject objectClass: top authorizedService: systemd-user cn: testuser2 uid: testuser2 uidNumber: 100012 gidNumber: 100012 homeDirectory: /home/testuser2 loginShell: /bin/bash Tried to authenticate with that user after clearing sssd cache, but authentication failed, from log, Jan 25 04:11:07 client-4704 sshd[22323]: pam_sss(sshd:auth): authentication success; logname= uid=0 euid=0 tty=ssh ruser= rhost=::1 user=testuser2 Jan 25 04:11:07 client-4704 sshd[22323]: pam_sss(sshd:account): system info: [Authorized service attribute has no matching rule, access denied] Jan 25 04:11:07 client-4704 sshd[22323]: pam_sss(sshd:account): Access denied for user testuser2: 6 (Permission denied) Jan 25 04:11:07 client-4704 sshd[22323]: Failed password for testuser2 from ::1 port 40752 ssh2 Jan 25 04:11:07 client-4704 sshd[22323]: fatal: Access denied for user testuser2 by PAM account configuration [preauth] (In reply to Madhuri from comment #5) > Added new user, > # testuser2, People, example.com > dn: uid=testuser2,ou=People,dc=example,dc=com > objectClass: posixAccount > objectClass: account > objectClass: authorizedServiceObject > objectClass: top > authorizedService: systemd-user I meant to add another value not replace it, it should look like: authorizedService: systemd-user authorizedService: sshd HTH bye, Sumit > cn: testuser2 > uid: testuser2 > uidNumber: 100012 > gidNumber: 100012 > homeDirectory: /home/testuser2 > loginShell: /bin/bash > > Tried to authenticate with that user after clearing sssd cache, > but authentication failed, > > from log, > Jan 25 04:11:07 client-4704 sshd[22323]: pam_sss(sshd:auth): authentication > success; logname= uid=0 euid=0 tty=ssh ruser= rhost=::1 user=testuser2 > Jan 25 04:11:07 client-4704 sshd[22323]: pam_sss(sshd:account): system info: > [Authorized service attribute has no matching rule, access denied] > Jan 25 04:11:07 client-4704 sshd[22323]: pam_sss(sshd:account): Access > denied for user testuser2: 6 (Permission denied) > Jan 25 04:11:07 client-4704 sshd[22323]: Failed password for testuser2 from > ::1 port 40752 ssh2 > Jan 25 04:11:07 client-4704 sshd[22323]: fatal: Access denied for user > testuser2 by PAM account configuration [preauth] I thought we've been over this on IRC. This is a sort of a systematic change in RHEL-8 as requested in https://bugzilla.redhat.com/show_bug.cgi?id=1643928. IPA added the systemd-user PAM service to the HBAC list by default in https://pagure.io/freeipa/issue/7831 (Sorry, I hit save changes too soon) I'm not sure we should do anything on the deamon side. Permitting the service or adding it to the filter unconditionally might work, but seems like a hack, because unlike with HBAC (or GPOs) we can't presume much about the structure of the server-side rules. At least for the time being, we could ask our docs writers to add a note about this for the RHEL-8 documentation and maybe add a note to the man page? Also maybe some leapp content for the sake of the upgrades might be nice.. (In reply to Sumit Bose from comment #7) > (In reply to Madhuri from comment #5) > > Added new user, > > # testuser2, People, example.com > > dn: uid=testuser2,ou=People,dc=example,dc=com > > objectClass: posixAccount > > objectClass: account > > objectClass: authorizedServiceObject > > objectClass: top > > authorizedService: systemd-user > > I meant to add another value not replace it, it should look like: > > authorizedService: systemd-user > authorizedService: sshd > > HTH > > bye, > Sumit > > > cn: testuser2 > > uid: testuser2 > > uidNumber: 100012 > > gidNumber: 100012 > > homeDirectory: /home/testuser2 > > loginShell: /bin/bash > > > > Tried to authenticate with that user after clearing sssd cache, > > but authentication failed, > > > > from log, > > Jan 25 04:11:07 client-4704 sshd[22323]: pam_sss(sshd:auth): authentication > > success; logname= uid=0 euid=0 tty=ssh ruser= rhost=::1 user=testuser2 > > Jan 25 04:11:07 client-4704 sshd[22323]: pam_sss(sshd:account): system info: > > [Authorized service attribute has no matching rule, access denied] > > Jan 25 04:11:07 client-4704 sshd[22323]: pam_sss(sshd:account): Access > > denied for user testuser2: 6 (Permission denied) > > Jan 25 04:11:07 client-4704 sshd[22323]: Failed password for testuser2 from > > ::1 port 40752 ssh2 > > Jan 25 04:11:07 client-4704 sshd[22323]: fatal: Access denied for user > > testuser2 by PAM account configuration [preauth] With this change authentication is successful. (In reply to Jakub Hrozek from comment #8) sorry for not reading carefully, After getting the successful run with beaker, will update the bug and close it. (In reply to Madhuri from comment #12) > (In reply to Jakub Hrozek from comment #8) > > sorry for not reading carefully, > After getting the successful run with beaker, > will update the bug and close it. Thank you for the test run, do you think it would made sense to open a documentation request and/or a ticket about amending the man page? (In reply to Jakub Hrozek from comment #13) > (In reply to Madhuri from comment #12) > > (In reply to Jakub Hrozek from comment #8) > > > > sorry for not reading carefully, > > After getting the successful run with beaker, > > will update the bug and close it. > > Thank you for the test run, do you think it would made sense to open a > documentation request and/or a ticket about amending the man page? Yes.. it makes perfect sense. Upstream ticket: https://pagure.io/SSSD/sssd/issue/3932 master: 820151f3813f08c704cb87a99988fe39f9f48a8d Verified with
[root@ci-vm-10-0-146-233 ~]# rpm -qa sssd
sssd-2.2.0-16.el8.x86_64
From man page of sssd-ldap
ldap_user_authorized_service (string)
If access_provider=ldap and ldap_access_order=authorized_service, SSSD will use the presence of the
authorizedService attribute in the user's LDAP entry to determine access privilege.
An explicit deny (!svc) is resolved first. Second, SSSD searches for explicit allow (svc) and finally for
allow_all (*).
Please note that the ldap_access_order configuration option must include “authorized_service” in order for the
ldap_user_authorized_service option to work.
Some distributions (such as Fedora-29+ or RHEL-8) always include the “systemd-user” PAM service as part of the
login process. Therefore when using service-based access control, the “systemd-user” service might need to be
added to the list of allowed services.
Default: authorizedService
from above, marking this bug as Verified.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHSA-2019:3651 Hi Tomas, I have changed the text to a bug fix and indicated what was changed. Can you confirm this is ok? Thanks Louise (In reply to lmcgarry from comment #33) > Hi Tomas, > > I have changed the text to a bug fix and indicated what was changed. > > Can you confirm this is ok? > > Thanks > Louise The text looks good to me. I just fixed one small typo (The doc text started with "." so I moved it to the end of the sentence). Thank you. Tom |