Bug 1170300 - Access is not rejected for disabled domain
Summary: Access is not rejected for disabled domain
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: sssd
Version: 7.1
Hardware: Unspecified
OS: Unspecified
high
unspecified
Target Milestone: rc
: ---
Assignee: Sumit Bose
QA Contact: Kaushik Banerjee
URL:
Whiteboard:
Depends On:
Blocks: 1172598
TreeView+ depends on / blocked
 
Reported: 2014-12-03 17:53 UTC by Steeve Goveas
Modified: 2020-05-02 17:54 UTC (History)
13 users (show)

Fixed In Version: sssd-1.12.2-38.el7
Doc Type: Bug Fix
Doc Text:
Clone Of:
: 1172598 (view as bug list)
Environment:
Last Closed: 2015-03-05 10:34:50 UTC
Target Upstream Version:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Github SSSD sssd issues 3577 0 None None None 2020-05-02 17:54:14 UTC
Red Hat Product Errata RHBA-2015:0441 0 normal SHIPPED_LIVE sssd bug fix and enhancement update 2015-03-05 15:05:27 UTC

Description Steeve Goveas 2014-12-03 17:53:07 UTC
Description of problem:
This is a regression of bz1070924

Version-Release number of selected component (if applicable):
ipa-server-4.1.0-10.el7.x86_64

How reproducible:


Steps to Reproduce:
1. Setup trust with AD having a child domain
2. Disable child domain trust
3. ssh as user from child AD domain

Actual results:

[root@vm-idm-032 ~]# ssh -l "aduser1@pune.adtest.qe" $(hostname) "echo 'login successful'"
aduser1@pune.adtest.qe@vm-idm-032.steeve0312.test's password: 
login successful

[root@vm-idm-032 ~]# ipa trustdomain-disable adtest.qe pune.adtest.qe
--------------------------------------
Disabled trust domain "pune.adtest.qe"
--------------------------------------

[root@vm-idm-032 ~]# ipa trustdomain-find  adtest.qe
  Domain name: adtest.qe
  Domain NetBIOS name: ADTEST
  Domain Security Identifier: S-1-5-21-1910160501-511572375-3625658879
  Domain enabled: True

  Domain name: pune.adtest.qe
  Domain NetBIOS name: PUNE
  Domain Security Identifier: S-1-5-21-91314187-2404433721-1858927112
  Domain enabled: False
----------------------------
Number of entries returned 2
----------------------------

[root@vm-idm-032 ~]#  ipa trust-show adtest.qe --all | grep S-1-5-21-91314187-2404433721-1858927112
  SID blacklist incoming: S-1-5-20, S-1-5-3, S-1-5-2, S-1-5-1, S-1-5-7, S-1-5-6, S-1-5-5, S-1-5-4, S-1-5-9, S-1-5-8, S-1-5-21-91314187-2404433721-1858927112, S-1-5-17, S-1-5-16, S-1-5-15, S-1-5-14, S-1-5-13, S-1-5-12, S-1-5-11, S-1-5-10, S-1-3, S-1-2, S-1-1, S-1-0, S-1-5-19, S-1-5-18

[root@vm-idm-032 ~]# sleep 90 ; ssh -l "aduser1@pune.adtest.qe" $(hostname) "echo 'login successful'"
aduser1@pune.adtest.qe@vm-idm-032.steeve0312.test's password: 
login successful

[root@vm-idm-032 ~]# sleep 30 ; ssh -l "aduser1@pune.adtest.qe" $(hostname) "echo 'login successful'"
aduser1@pune.adtest.qe@vm-idm-032.steeve0312.test's password: 
login successful

Expected results:
Access should be rejected for AD user from disabled domain

Additional info:

Comment 3 Petr Vobornik 2014-12-04 08:51:42 UTC
Upstream ticket:
https://fedorahosted.org/freeipa/ticket/4788

Comment 5 Alexander Bokovoy 2014-12-08 12:43:55 UTC
Switching to SSSD as this is a bug in SSSD.

Comment 6 Jakub Hrozek 2014-12-11 09:03:46 UTC
Sumit has been looking into this bug.

Comment 7 Martin Kosek 2014-12-17 08:52:04 UTC
Upstream ticket:

https://fedorahosted.org/sssd/ticket/2535

Comment 9 Steeve Goveas 2015-01-07 09:40:28 UTC
Verified in version
ipa-server-4.1.0-13.el7.x86_64
sssd-ipa-1.12.2-39.el7.x86_64

::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:: [   LOG    ] :: trustdomain_cli_bz1070924: Access is not rejected for disabled domain bz1070924
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

:: [ 14:00:49 ] :: https://bugzilla.redhat.com/show_bug.cgi?id=1070924
:: [  BEGIN   ] :: Running 'ipa trustdomain-disable adtest.qe pune.adtest.qe > /tmp/tmp.b02bxEJFbU/tmpout.trustdomain_cli_bz1070924.out 2>&1'
:: [   PASS   ] :: Command 'ipa trustdomain-disable adtest.qe pune.adtest.qe > /tmp/tmp.b02bxEJFbU/tmpout.trustdomain_cli_bz1070924.out 2>&1' (Expected 0, got 0)
--------------------------------------
Disabled trust domain "pune.adtest.qe"
--------------------------------------
:: [  BEGIN   ] :: Running 'ipa trustdomain-find adtest.qe pune.adtest.qe | tee /tmp/tmp.b02bxEJFbU/tmpout.trustdomain_cli_bz1070924.out'
  Domain name: pune.adtest.qe
  Domain NetBIOS name: PUNE
  Domain Security Identifier: S-1-5-21-91314187-2404433721-1858927112
  Domain enabled: False
----------------------------
Number of entries returned 1
----------------------------
:: [   PASS   ] :: Command 'ipa trustdomain-find adtest.qe pune.adtest.qe | tee /tmp/tmp.b02bxEJFbU/tmpout.trustdomain_cli_bz1070924.out' (Expected 0, got 0)
:: [   PASS   ] :: File '/tmp/tmp.b02bxEJFbU/tmpout.trustdomain_cli_bz1070924.out' should contain 'Domain name: pune.adtest.qe' 
:: [   PASS   ] :: File '/tmp/tmp.b02bxEJFbU/tmpout.trustdomain_cli_bz1070924.out' should contain 'Domain enabled: False' 
:: [  BEGIN   ] :: Running 'sleep 90'
:: [   PASS   ] :: Command 'sleep 90' (Expected 0, got 0)
:: [  BEGIN   ] :: Running 'ssh_with_password testu1@pune.adtest.qe vm-idm-033.steeve2411.test Secret123'
:: [ 14:02:23 ] :: Running: ssh -l "testu1@pune.adtest.qe" vm-idm-033.steeve2411.test "echo 'login successful'
:: [ 14:02:54 ] :: ssh login failed
:: [  BEGIN   ] :: Running 'cat /tmp/tmpout.ssh_with_password'
spawn ssh -o StrictHostKeyChecking=no -l testu1@pune.adtest.qe vm-idm-033.steeve2411.test echo 'login successful'
testu1@pune.adtest.qe@vm-idm-033.steeve2411.test's password: 
Permission denied, please try again.

testu1@pune.adtest.qe@vm-idm-033.steeve2411.test's password: :: [   PASS   ] :: Command 'cat /tmp/tmpout.ssh_with_password' (Expected 0, got 0)
:: [   PASS   ] :: Command 'ssh_with_password testu1@pune.adtest.qe vm-idm-033.steeve2411.test Secret123' (Expected 1, got 1)
:: [  BEGIN   ] :: Running 'ipa trustdomain-enable adtest.qe pune.adtest.qe > /tmp/tmp.b02bxEJFbU/tmpout.trustdomain_cli_bz1070924.out 2>&1'
:: [   PASS   ] :: Command 'ipa trustdomain-enable adtest.qe pune.adtest.qe > /tmp/tmp.b02bxEJFbU/tmpout.trustdomain_cli_bz1070924.out 2>&1' (Expected 0, got 0)
-------------------------------------
Enabled trust domain "pune.adtest.qe"
-------------------------------------

Comment 12 errata-xmlrpc 2015-03-05 10:34:50 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2015-0441.html


Note You need to log in before you can comment on or make changes to this bug.