Bug 179009

Summary:	KRB5 auth should include minimum_uid?
Product:	[Fedora] Fedora	Reporter:	Brian Wheeler <bdwheele>
Component:	authconfig	Assignee:	Tomas Mraz <tmraz>
Status:	CLOSED RAWHIDE	QA Contact:	Brian Brock <bbrock>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	rawhide	Keywords:	Security
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	authconfig-5.2.0-1	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2006-02-06 17:31:19 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	150221

Description Brian Wheeler 2006-01-26 14:38:08 UTC

From Bugzilla Helper:
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.12) Gecko/20050922 Fedora/1.0.7-1.1.fc4 Firefox/1.0.7

Description of problem:
System accounts shouldn't be authenticating against a kerberos server by default.  I run in a university setting and I'd like to authenticate my users against the campus kerberos server.  Since I have no control over the kerberos server itself, I cannot know whether or not there are entries for root, apache, squid, etc. on the kerberos server which may be used to authenticate against my system.

It seems that putting the "minimum_uid=500" argument to pam_krb5.so when writing the pam authorization files would be a good thing to limit any bad surprises.  It would still be possible to try to log in via 'nobody', but since that's a limited access account anyway, the damage would be minimal.

Version-Release number of selected component (if applicable):
authconfig-5.1.2-1

How reproducible:
Always

Steps to Reproduce:
1. run ethereal and watch for krb5 packets
2. su -

  

Actual Results:  pam_krb5 tries to auth root against krb server.

Expected Results:  only local authentication for system accounts, unless overridden by administrator.

Additional info:

Comment 1 Tomas Mraz 2006-02-06 17:31:19 UTC

Fixed in a slightly different and more universal way.

authconfig now adds:

auth        requisite     pam_succeed_if.so uid >= 500 quiet

line to /etc/pam.d/system-auth-ac by default. Also there is a new option which
reverts to the old behaviour of allowing that.