Bug 1915564
| Summary: | sssd does not enforce smartcard auth for kde screen locker | ||||||
|---|---|---|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 9 | Reporter: | Orion Poplawski <orion> | ||||
| Component: | sssd | Assignee: | Sumit Bose <sbose> | ||||
| Status: | CLOSED ERRATA | QA Contact: | Scott Poore <spoore> | ||||
| Severity: | unspecified | Docs Contact: | |||||
| Priority: | unspecified | ||||||
| Version: | 9.0 | CC: | aboscatt, atikhono, grajaiya, jhrozek, lslebodn, mzidek, pbrezina, sbose, sgadekar, spoore, thalman, tscherf | ||||
| Target Milestone: | rc | Keywords: | Triaged | ||||
| Target Release: | --- | ||||||
| Hardware: | Unspecified | ||||||
| OS: | Unspecified | ||||||
| Whiteboard: | sync-to-jira | ||||||
| Fixed In Version: | sssd-2.7.0-1.el9 | Doc Type: | If docs needed, set a value | ||||
| Doc Text: | Story Points: | --- | |||||
| Clone Of: | Environment: | ||||||
| Last Closed: | 2022-11-15 11:17:20 UTC | Type: | Bug | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Attachments: |
|
||||||
Hi, I'd like to try an reproduce the issue locally, which KDE packages are you using or do you build them on your own? bye, Sumit Thanks, I'm using the packages from Fedora EPEL. Any progress here or anything else I can provide to help? Thanks. Created attachment 1771951 [details]
test build
Hi,
thank you for you patience, please find attached a tar ball with a SSSD test build which should reject the login with the user password if you require Smartcard authentication.
In my test kscreenlocker displays the message asking to insert the proper Smartcard only for a very short time. I haven't found an option to make kscreenlocker to display it longer.
bye,
Sumit
That indeed appears to work, thanks! I'll take up the issue the message display with the KDE folks. Any chance this might make it into Stream soon? Upstream PR: https://github.com/SSSD/sssd/pull/6024 Pushed PR: https://github.com/SSSD/sssd/pull/6024 * `master` * 4d2277f8c3065771a8c3bbc7938309a4905640f0 - pam: better SC fallback message * 731b3e668c6a659922466aee7fa8093412707325 - pam: add more checks for require_cert_auth Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (sssd bug fix and enhancement update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2022:8325 |
Description of problem: I'm attempting to require the use of smartcards everywhere. authselect profile: Profile ID: sssd Enabled features: - with-smartcard - with-smartcard-required - with-smartcard-lock-on-removal - with-sudo - with-custom-automount - with-mkhomedir - with-faillock I had to modify /etc/pam.d/system-auth to add "kde" (use by plasma screen locker) to the list of services below: auth required pam_env.so auth required pam_faildelay.so delay=2000000 auth required pam_faillock.so preauth silent auth [success=1 default=ignore] pam_succeed_if.so service notin login:gdm:xdm:kdm:xscreensaver:gnome-screensaver:kde:kscreensaver quiet use_uid auth [success=done ignore=ignore default=die] pam_sss.so require_cert_auth ignore_authinfo_unavail auth [default=1 ignore=ignore success=ok] pam_usertype.so isregular auth [default=2 ignore=ignore success=ok] pam_localuser.so auth [success=done authinfo_unavail=ignore ignore=ignore default=die] pam_sss.so try_cert_auth auth sufficient pam_unix.so nullok try_first_pass auth [default=1 ignore=ignore success=ok] pam_usertype.so isregular auth sufficient pam_sss.so forward_pass auth required pam_faillock.so authfail auth required pam_deny.so When I lock the screen and unlock with my password, the message: Please insert smart card labeled Orion Poplawski is displayed, but then the screen unlocks. pam log messgges: kcheckpass[7557]: pam_sss(kde:auth): User info message: Please insert smart card labeled Orion Poplawski kcheckpass[7557]: pam_sss(kde:auth): authentication success; logname=orion uid=22603 euid=22603 tty=:0 ruser= rhost= user=orion sssd.conf has: [pam] pam_cert_auth = True # kscreensaver for EL7, kde for Fedora pam_p11_allowed_services = +kscreensaver, +kde Version-Release number of selected component (if applicable): sssd-2.3.0-9.el8.x86_64 FWIW - authselect issue - https://github.com/authselect/authselect/issues/234