Red Hat Bugzilla – Bug 1170300
Access is not rejected for disabled domain
Last modified: 2015-09-23 11:27:10 EDT
Description of problem: This is a regression of bz1070924 Version-Release number of selected component (if applicable): ipa-server-4.1.0-10.el7.x86_64 How reproducible: Steps to Reproduce: 1. Setup trust with AD having a child domain 2. Disable child domain trust 3. ssh as user from child AD domain Actual results: [root@vm-idm-032 ~]# ssh -l "aduser1@pune.adtest.qe" $(hostname) "echo 'login successful'" aduser1@pune.adtest.qe@vm-idm-032.steeve0312.test's password: login successful [root@vm-idm-032 ~]# ipa trustdomain-disable adtest.qe pune.adtest.qe -------------------------------------- Disabled trust domain "pune.adtest.qe" -------------------------------------- [root@vm-idm-032 ~]# ipa trustdomain-find adtest.qe Domain name: adtest.qe Domain NetBIOS name: ADTEST Domain Security Identifier: S-1-5-21-1910160501-511572375-3625658879 Domain enabled: True Domain name: pune.adtest.qe Domain NetBIOS name: PUNE Domain Security Identifier: S-1-5-21-91314187-2404433721-1858927112 Domain enabled: False ---------------------------- Number of entries returned 2 ---------------------------- [root@vm-idm-032 ~]# ipa trust-show adtest.qe --all | grep S-1-5-21-91314187-2404433721-1858927112 SID blacklist incoming: S-1-5-20, S-1-5-3, S-1-5-2, S-1-5-1, S-1-5-7, S-1-5-6, S-1-5-5, S-1-5-4, S-1-5-9, S-1-5-8, S-1-5-21-91314187-2404433721-1858927112, S-1-5-17, S-1-5-16, S-1-5-15, S-1-5-14, S-1-5-13, S-1-5-12, S-1-5-11, S-1-5-10, S-1-3, S-1-2, S-1-1, S-1-0, S-1-5-19, S-1-5-18 [root@vm-idm-032 ~]# sleep 90 ; ssh -l "aduser1@pune.adtest.qe" $(hostname) "echo 'login successful'" aduser1@pune.adtest.qe@vm-idm-032.steeve0312.test's password: login successful [root@vm-idm-032 ~]# sleep 30 ; ssh -l "aduser1@pune.adtest.qe" $(hostname) "echo 'login successful'" aduser1@pune.adtest.qe@vm-idm-032.steeve0312.test's password: login successful Expected results: Access should be rejected for AD user from disabled domain Additional info:
Upstream ticket: https://fedorahosted.org/freeipa/ticket/4788
Switching to SSSD as this is a bug in SSSD.
Sumit has been looking into this bug.
Upstream ticket: https://fedorahosted.org/sssd/ticket/2535
Verified in version ipa-server-4.1.0-13.el7.x86_64 sssd-ipa-1.12.2-39.el7.x86_64 :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: :: [ LOG ] :: trustdomain_cli_bz1070924: Access is not rejected for disabled domain bz1070924 :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: :: [ 14:00:49 ] :: https://bugzilla.redhat.com/show_bug.cgi?id=1070924 :: [ BEGIN ] :: Running 'ipa trustdomain-disable adtest.qe pune.adtest.qe > /tmp/tmp.b02bxEJFbU/tmpout.trustdomain_cli_bz1070924.out 2>&1' :: [ PASS ] :: Command 'ipa trustdomain-disable adtest.qe pune.adtest.qe > /tmp/tmp.b02bxEJFbU/tmpout.trustdomain_cli_bz1070924.out 2>&1' (Expected 0, got 0) -------------------------------------- Disabled trust domain "pune.adtest.qe" -------------------------------------- :: [ BEGIN ] :: Running 'ipa trustdomain-find adtest.qe pune.adtest.qe | tee /tmp/tmp.b02bxEJFbU/tmpout.trustdomain_cli_bz1070924.out' Domain name: pune.adtest.qe Domain NetBIOS name: PUNE Domain Security Identifier: S-1-5-21-91314187-2404433721-1858927112 Domain enabled: False ---------------------------- Number of entries returned 1 ---------------------------- :: [ PASS ] :: Command 'ipa trustdomain-find adtest.qe pune.adtest.qe | tee /tmp/tmp.b02bxEJFbU/tmpout.trustdomain_cli_bz1070924.out' (Expected 0, got 0) :: [ PASS ] :: File '/tmp/tmp.b02bxEJFbU/tmpout.trustdomain_cli_bz1070924.out' should contain 'Domain name: pune.adtest.qe' :: [ PASS ] :: File '/tmp/tmp.b02bxEJFbU/tmpout.trustdomain_cli_bz1070924.out' should contain 'Domain enabled: False' :: [ BEGIN ] :: Running 'sleep 90' :: [ PASS ] :: Command 'sleep 90' (Expected 0, got 0) :: [ BEGIN ] :: Running 'ssh_with_password testu1@pune.adtest.qe vm-idm-033.steeve2411.test Secret123' :: [ 14:02:23 ] :: Running: ssh -l "testu1@pune.adtest.qe" vm-idm-033.steeve2411.test "echo 'login successful' :: [ 14:02:54 ] :: ssh login failed :: [ BEGIN ] :: Running 'cat /tmp/tmpout.ssh_with_password' spawn ssh -o StrictHostKeyChecking=no -l testu1@pune.adtest.qe vm-idm-033.steeve2411.test echo 'login successful' testu1@pune.adtest.qe@vm-idm-033.steeve2411.test's password: Permission denied, please try again. testu1@pune.adtest.qe@vm-idm-033.steeve2411.test's password: :: [ PASS ] :: Command 'cat /tmp/tmpout.ssh_with_password' (Expected 0, got 0) :: [ PASS ] :: Command 'ssh_with_password testu1@pune.adtest.qe vm-idm-033.steeve2411.test Secret123' (Expected 1, got 1) :: [ BEGIN ] :: Running 'ipa trustdomain-enable adtest.qe pune.adtest.qe > /tmp/tmp.b02bxEJFbU/tmpout.trustdomain_cli_bz1070924.out 2>&1' :: [ PASS ] :: Command 'ipa trustdomain-enable adtest.qe pune.adtest.qe > /tmp/tmp.b02bxEJFbU/tmpout.trustdomain_cli_bz1070924.out 2>&1' (Expected 0, got 0) ------------------------------------- Enabled trust domain "pune.adtest.qe" -------------------------------------
Fixed upstream master: https://fedorahosted.org/freeipa/changeset/373a04870d6ecc99145a6267c008702ed3e24171 ipa-4-1: https://fedorahosted.org/freeipa/changeset/6d6e924b1fe154812d66277f55c485f210e9c32d
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHBA-2015-0441.html