Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.
Bug 1178116 - Default selinux policy prevents ssh-ldap-helper from connecting to LDAP server
Default selinux policy prevents ssh-ldap-helper from connecting to LDAP server
Status: CLOSED ERRATA
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: openssh (Show other bugs)
7.0
Unspecified Linux
unspecified Severity unspecified
: rc
: ---
Assigned To: Jakub Jelen
Stanislav Zidek
: Documentation, Reopened
Depends On:
Blocks: 1191021
  Show dependency treegraph
 
Reported: 2015-01-02 07:00 EST by Justin Lambert
Modified: 2016-02-09 03:29 EST (History)
4 users (show)

See Also:
Fixed In Version: openssh-6.6.1p1-13.el7
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2015-11-19 03:02:29 EST
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2015:2088 normal SHIPPED_LIVE Moderate: openssh security, bug fix, and enhancement update 2015-11-19 03:38:51 EST

  None (edit)
Description Justin Lambert 2015-01-02 07:00:16 EST
Description of problem:
When using openssh-ldap the default selinux policy prevents connections to the LDAP server.


Version-Release number of selected component (if applicable):
openssh-6.4p1-8.el7.x86_64
openssh-ldap-6.4p1-8.el7.x86_64

How reproducible:
Install and configure openssh-ldap, attempt to SSH to the host.

Steps to Reproduce:
1.
2.
3.

Actual results:
Error in the audit log:
type=AVC msg=audit(1420058593.479:6643): avc:  denied  { name_connect } for  pid=26849 comm="ssh-ldap-helper" dest=389 scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:ldap_port_t:s0 tclass=tcp_socket

and LDAP not queried for the public key.

Expected results:
LDAP queried for the public key and result returned

Additional info:
From the setroubleshoot script:

If you believe that ssh-ldap-helper should be allowed name_connect access on the  tcp_socket by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# grep ssh-ldap-helper /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp
Comment 1 Justin Lambert 2015-01-02 07:05:45 EST
It looks like this can also be resolved with:
setsebool -P authlogin_nsswitch_use_ldap 1

This is not mentioned in the HOWTO.ldap-keys file, it should be added there.
Comment 3 Milos Malik 2015-01-04 07:51:26 EST
# rpm -qa selinux-policy\*
selinux-policy-mls-3.12.1-153.el7_0.13.noarch
selinux-policy-minimum-3.12.1-153.el7_0.13.noarch
selinux-policy-3.12.1-153.el7_0.13.noarch
selinux-policy-doc-3.12.1-153.el7_0.13.noarch
selinux-policy-sandbox-3.12.1-153.el7_0.13.noarch
selinux-policy-devel-3.12.1-153.el7_0.13.noarch
selinux-policy-targeted-3.12.1-153.el7_0.13.noarch
# sesearch -s sshd_t -t ldap_port_t -c tcp_socket -p name_connect -A -C
Found 3 semantic av rules:
DT allow nsswitch_domain ldap_port_t : tcp_socket { recv_msg send_msg name_connect } ; [ authlogin_nsswitch_use_ldap ]
ET allow sshd_t reserved_port_type : tcp_socket name_connect ; [ nis_enabled ]
ET allow nsswitch_domain reserved_port_type : tcp_socket name_connect ; [ nis_enabled ]

# 

Usage of authlogin_nsswitch_use_ldap boolean is the right way to go.
Comment 4 Petr Lautrbach 2015-02-17 08:18:36 EST
$ audit2allow 
type=AVC msg=audit(1420058593.479:6643): avc:  denied  { name_connect } for  pid=26849 comm="ssh-ldap-helper" dest=389 scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:ldap_port_t:s0 tclass=tcp_socket


#============= sshd_t ==============

#!!!! This avc can be allowed using one of the these booleans:
#     nis_enabled, authlogin_nsswitch_use_ldap
allow sshd_t ldap_port_t:tcp_socket name_connect;


As it's suggested in comment 3, setting authlogin_nsswitch_use_ldap variable to yes should fix the issue, eg:

# setsebool -P authlogin_nsswitch_use_ldap on

or

# semanage boolean --modify --on authlogin_nsswitch_use_ldap
Comment 5 Justin Lambert 2015-02-17 08:35:17 EST
Closed without adding anything to the README?  If I had this issue, it seems that someone else will as well.
Comment 6 Petr Lautrbach 2015-02-17 08:37:09 EST
I missed that, sorry. We'll provide a note in HOWTO.ldap-keys
Comment 8 Jakub Jelen 2015-04-17 10:53:07 EDT
I would be for such addition to HOWTO.ldap-keys:

===============
@@ -51,6 +51,9 @@
   * There are some debug options
   * Example
       /usr/libexec/openssh -s -f /etc/ldap.conf -w -d >> /tmp/ldapdebuglog.txt
+7) Configure SELinux boolean which allows ldap-helper to bind ldap server
+  Run this command
+  # setsebool -P authlogin_nsswitch_use_ldap on
 
 HOW TO MIGRATE FROM LPK
 
===============
Comment 13 errata-xmlrpc 2015-11-19 03:02:29 EST
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHSA-2015-2088.html

Note You need to log in before you can comment on or make changes to this bug.