Bug 2231061

Summary:	`realm join` Not Fully Compatible With `authselect`
Product:	Red Hat Enterprise Linux 8	Reporter:	Thomas Jones <redhat>
Component:	realmd	Assignee:	Sumit Bose <sbose>
Status:	CLOSED MIGRATED	QA Contact:	shridhar <sgadekar>
Severity:	medium	Docs Contact:
Priority:	unspecified
Version:	8.8	CC:	aboscatt, baljevicdu, long.lam, loren.gordon, redhat, sbose, sgadekar
Target Milestone:	rc	Keywords:	MigratedToJIRA
Target Release:	---	Flags:	pm-rhel: mirror+
Hardware:	x86_64
OS:	Linux
Whiteboard:	sync-to-jira
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2023-09-19 14:03:00 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Thomas Jones 2023-08-10 12:18:47 UTC

Description of problem:

Current hardening guidelines specify the presence of several PAM-related hardenings. Use of `realm join` to bind to an external, kerberized directory-service (in our case, Active Directory) requires the use of `authselect`. We're able to convert hardening guidance to using `authselect` within the default sssd profile except for the setting of the pam_lastlog.so's "session" definition with /etc/pam.d/postlogin to `required`. While we CAN configure the necessary change from `optional` to `required` by using a custom `authselect` profile, as soon as a `realm join` is performed, the custom-profile is de-selected in favor of the default `sssd` profile. 



Version-Release number of selected component (if applicable):


How reproducible:


Steps to Reproduce:
1. Spin up new system
2. Create a new authselect profile
3. Apply the custom authselect profile
4. Apply required hardenings to custom profile's files
5. Perform a `realm join` 

Actual results:

Find that some hardenings – particularly the customized pam_lastlog.so's session entry in the postlogin file – have been reverted because the in-use authselect profile has been changed to the vendor-shipped `sssd` profile

Expected results:

All hardenings remain as specified and that custom `authselect` profile is still in use.


Additional info:

Comment 1 DB 2023-08-14 02:14:34 UTC

Hi,

I would like to support Thomas for this bug report.

In the past, I experienced similar kind of issues.

Regards,

Dusan Baljevic | Solution Delivery Specialist, Banking Systems
RESERVE BANK OF AUSTRALIA | 65 Martin Place, Sydney NSW 2000

Comment 2 DB 2023-08-24 02:35:59 UTC

Bug is still valid.

Comment 3 Sumit Bose 2023-09-04 05:44:50 UTC

Hi,

thanks for the report, I will work with the authselect developers to see what would be the best solution here.

Btw, you can see the authselect commands realmd is calling in the `sssd-enable-logins` and `sssd-disable-logins` options in [commands] section of /usr/lib/realmd/realmd-distro.conf. Additionally you can overwrite them by setting alternative values in /etc/realmd.conf.

bye,
Sumit

Comment 4 RHEL Program Management 2023-09-19 14:02:00 UTC

Issue migration from Bugzilla to Jira is in process at this time. This will be the last message in Jira copied from the Bugzilla bug.

Comment 5 RHEL Program Management 2023-09-19 14:03:00 UTC

This BZ has been automatically migrated to the issues.redhat.com Red Hat Issue Tracker. All future work related to this report will be managed there.

Due to differences in account names between systems, some fields were not replicated.  Be sure to add yourself to Jira issue's "Watchers" field to continue receiving updates and add others to the "Need Info From" field to continue requesting information.

To find the migrated issue, look in the "Links" section for a direct link to the new issue location. The issue key will have an icon of 2 footprints next to it, and begin with "RHEL-" followed by an integer.  You can also find this issue by visiting https://issues.redhat.com/issues/?jql= and searching the "Bugzilla Bug" field for this BZ's number, e.g. a search like:

"Bugzilla Bug" = 1234567

In the event you have trouble locating or viewing this issue, you can file an issue by sending mail to rh-issues. You can also visit https://access.redhat.com/articles/7032570 for general account information.