Bug 1669407 - MAN: Document that PAM stack contains the systemd-user service in the account phase in RHEL-8
Summary: MAN: Document that PAM stack contains the systemd-user service in the account...
Keywords:
Status: ON_QA
Alias: None
Product: Red Hat Enterprise Linux 8
Classification: Red Hat
Component: sssd
Version: 8.0
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: rc
: 8.0
Assignee: SSSD Maintainers
QA Contact: sssd-qe
Vendula Ferschmannova
URL:
Whiteboard:
Depends On: 1682305
Blocks:
TreeView+ depends on / blocked
 
Reported: 2019-01-25 07:17 UTC by Madhuri
Modified: 2019-08-21 10:08 UTC (History)
15 users (show)

Fixed In Version: sssd-2.2.0-13.el8
Doc Type: Known Issue
Doc Text:
.Default PAM settings for `systemd-user` have changed in RHEL 8 which may influence SSSD behavior The Pluggable authentication modules (PAM) stack has changed in Red Hat Enterprise Linux 8. For example, the `systemd` user session now starts a PAM conversation using the `systemd-user` PAM service. This service now recursively includes the `system-auth` PAM service, which may include the `pam_sss.so` interface. This means that the SSSD access control is always called. Be aware of the change when designing access control rules for RHEL 8 systems. For example, you can add the `systemd-user` service to the allowed services list. Please note that for some access control mechanisms, such as IPA HBAC or AD GPOs, the `systemd-user` service is has been added to the allowed services list by default and you do not need to take any action.
Clone Of:
Environment:
Last Closed:
Type: Bug


Attachments (Terms of Use)

Description Madhuri 2019-01-25 07:17:35 UTC
Description of problem: User authentication fails when ldap_access_order is set to authorized_service


Version-Release number of selected component (if applicable):
sssd-2.0.0-38.el8.x86_64

How reproducible:
Always

Steps to Reproduce:
1.Add a LDAP testuser with objectclass authorizedServiceObject and attribute authorizedService: sshd 
# testuser1, People, example.com
dn: uid=testuser1,ou=People,dc=example,dc=com
objectClass: posixAccount
objectClass: account
objectClass: authorizedServiceObject
objectClass: top
authorizedService: sshd
cn: testuser1
uid: testuser1
uidNumber: 10001
gidNumber: 10001
homeDirectory: /home/testuser1
loginShell: /bin/bash

2. Configure sssd.conf with ldap_access_order = authorized_service
[sssd]
config_file_version = 2
domains = LDAP
services = nss, pam
sbus_timeout = 30

[nss]
filter_groups = root
filter_users = root

[pam]
debug_level = 0xFFF0


[domain/LDAP]
ldap_search_base = dc=example,dc=com
debug_level = 9
id_provider = ldap
ldap_uri = ldaps://host-8-243-42.host.centralci.eng.rdu2.redhat.com:636
ldap_tls_cacert = /etc/openldap/certs/cacert.pem
access_provider = ldap
ldap_access_order = authorized_service
ldap_user_authorized_service = authorized_service

3. Clear the sssd cache.

4. Check the authetication of user,
[root@host-8-246-254 ~]# ssh -l testuser1 localhost
testuser1@localhost's password: 
Connection closed by ::1 port 22

Authentication failed.

5. From log,
Jan 25 01:41:10 client-4704 sshd[21932]: pam_sss(sshd:auth): authentication success; logname= uid=0 euid=0 tty=ssh ruser= rhost=::1 user=testuser1
Jan 25 01:41:10 client-4704 sshd[21932]: pam_sss(sshd:account): system info: [Authorized service attribute missing, access denied]
Jan 25 01:41:10 client-4704 sshd[21932]: pam_sss(sshd:account): Access denied for user testuser1: 6 (Permission denied)
Jan 25 01:41:10 client-4704 sshd[21932]: Failed password for testuser1 from ::1 port 40688 ssh2
Jan 25 01:41:10 client-4704 sshd[21932]: fatal: Access denied for user testuser1 by PAM account configuration [preauth]

From log also first getting authentication success and
later getting access denied for user

5. After commenting 'ldap_access_order = authorized_service and ldap_user_authorized_service = authorized_service' and
adding ldap_access_filter = (authorizedService=sshd) in sssd.conf, user authetication is successful.
[sssd]
config_file_version = 2
domains = LDAP
services = nss, pam
sbus_timeout = 30

[nss]
filter_groups = root
filter_users = root

[pam]
debug_level = 0xFFF0


[domain/LDAP]
ldap_search_base = dc=example,dc=com
debug_level = 9
id_provider = ldap
ldap_uri = ldaps://host-8-243-42.host.centralci.eng.rdu2.redhat.com:636
ldap_tls_cacert = /etc/openldap/certs/cacert.pem
access_provider = ldap
#ldap_access_order = authorized_service
#ldap_user_authorized_service = authorized_service
ldap_access_filter = (authorizedService=sshd)

[root@host-8-246-254 ~]# ssh -l testuser1 localhost
testuser1@localhost's password: 
Activate the web console with: systemctl enable --now cockpit.socket

Last failed login: Fri Jan 25 01:41:10 EST 2019 from ::1 on ssh:notty
There were 3 failed login attempts since the last successful login.
Last login: Fri Jan 25 01:07:37 2019 from ::1
Could not chdir to home directory /home/testuser1: No such file or directory
id: cannot find name for group ID 10001
[testuser1@host-8-246-254 /]$ exit
logout
Connection to localhost closed.


Actual results:
Authentication failing with ldap_access_order and successful with ldap_access_filter.

Expected results:
Authentication should successful with ldap_access_order also.

Comment 2 Sumit Bose 2019-01-25 07:24:24 UTC
(In reply to Madhuri from comment #0)
...
> 
> 5. After commenting 'ldap_access_order = authorized_service and
> ldap_user_authorized_service = authorized_service' and
> adding ldap_access_filter = (authorizedService=sshd) in sssd.conf, user
> authetication is successful.

Since according to the working filter rule the LDAP attribute is called 'authorizedService' I'd like to suggest to try with

    ldap_access_order = authorized_service
    ldap_user_authorized_service = authorizedService

HTH

bye,
Sumit

Comment 3 Madhuri 2019-01-25 08:42:43 UTC
I tried with the above changes,
still, authentications failing,

for log, 
Jan 25 03:40:09 client-4704 sshd[22169]: pam_sss(sshd:auth): authentication success; logname= uid=0 euid=0 tty=ssh ruser= rhost=::1 user=testuser1
Jan 25 03:40:09 client-4704 sshd[22169]: Accepted password for testuser1 from ::1 port 40724 ssh2
Jan 25 03:40:09 client-4704 systemd[22172]: pam_sss(systemd-user:account): system info: [Authorized service attribute has no matching rule, access denied]
Jan 25 03:40:09 client-4704 systemd[22172]: pam_sss(systemd-user:account): Access denied for user testuser1: 6 (Permission denied)
Jan 25 03:40:09 client-4704 sshd[22169]: pam_systemd(sshd:session): Failed to create session: Start job for unit user@10001.service failed with 'failed'
Jan 25 03:40:09 client-4704 sshd[22169]: pam_unix(sshd:session): session opened for user testuser1 by (uid=0)
Jan 25 03:40:09 client-4704 sshd[22169]: error: PAM: pam_open_session(): System error
Jan 25 03:40:09 client-4704 sshd[22177]: Received disconnect from ::1 port 40724:11: disconnected by user
Jan 25 03:40:09 client-4704 sshd[22177]: Disconnected from user testuser1 ::1 port 40724

Comment 4 Sumit Bose 2019-01-25 08:56:18 UTC
Hi,

can you try to add another value 'systemd-user' to the authorizedService attribute.

HTH

bye,
Sumit

Comment 5 Madhuri 2019-01-25 09:13:16 UTC
Added new user,
# testuser2, People, example.com
dn: uid=testuser2,ou=People,dc=example,dc=com
objectClass: posixAccount
objectClass: account
objectClass: authorizedServiceObject
objectClass: top
authorizedService: systemd-user
cn: testuser2
uid: testuser2
uidNumber: 100012
gidNumber: 100012
homeDirectory: /home/testuser2
loginShell: /bin/bash

Tried to authenticate with that user after clearing sssd cache,
but authentication failed,

from log,
Jan 25 04:11:07 client-4704 sshd[22323]: pam_sss(sshd:auth): authentication success; logname= uid=0 euid=0 tty=ssh ruser= rhost=::1 user=testuser2
Jan 25 04:11:07 client-4704 sshd[22323]: pam_sss(sshd:account): system info: [Authorized service attribute has no matching rule, access denied]
Jan 25 04:11:07 client-4704 sshd[22323]: pam_sss(sshd:account): Access denied for user testuser2: 6 (Permission denied)
Jan 25 04:11:07 client-4704 sshd[22323]: Failed password for testuser2 from ::1 port 40752 ssh2
Jan 25 04:11:07 client-4704 sshd[22323]: fatal: Access denied for user testuser2 by PAM account configuration [preauth]

Comment 7 Sumit Bose 2019-01-25 09:51:18 UTC
(In reply to Madhuri from comment #5)
> Added new user,
> # testuser2, People, example.com
> dn: uid=testuser2,ou=People,dc=example,dc=com
> objectClass: posixAccount
> objectClass: account
> objectClass: authorizedServiceObject
> objectClass: top
> authorizedService: systemd-user

I meant to add another value not replace it, it should look like:

    authorizedService: systemd-user
    authorizedService: sshd

HTH

bye,
Sumit

> cn: testuser2
> uid: testuser2
> uidNumber: 100012
> gidNumber: 100012
> homeDirectory: /home/testuser2
> loginShell: /bin/bash
> 
> Tried to authenticate with that user after clearing sssd cache,
> but authentication failed,
> 
> from log,
> Jan 25 04:11:07 client-4704 sshd[22323]: pam_sss(sshd:auth): authentication
> success; logname= uid=0 euid=0 tty=ssh ruser= rhost=::1 user=testuser2
> Jan 25 04:11:07 client-4704 sshd[22323]: pam_sss(sshd:account): system info:
> [Authorized service attribute has no matching rule, access denied]
> Jan 25 04:11:07 client-4704 sshd[22323]: pam_sss(sshd:account): Access
> denied for user testuser2: 6 (Permission denied)
> Jan 25 04:11:07 client-4704 sshd[22323]: Failed password for testuser2 from
> ::1 port 40752 ssh2
> Jan 25 04:11:07 client-4704 sshd[22323]: fatal: Access denied for user
> testuser2 by PAM account configuration [preauth]

Comment 8 Jakub Hrozek 2019-01-25 10:12:15 UTC
I thought we've been over this on IRC. This is a sort of a systematic change in RHEL-8 as requested in https://bugzilla.redhat.com/show_bug.cgi?id=1643928. IPA added the systemd-user PAM service to the HBAC list by default in https://pagure.io/freeipa/issue/7831

Comment 9 Jakub Hrozek 2019-01-25 10:15:38 UTC
(Sorry, I hit save changes too soon)

I'm not sure we should do anything on the deamon side. Permitting the service or adding it to the filter unconditionally might work, but seems like a hack, because unlike with HBAC (or GPOs) we can't presume much about the structure of the server-side rules.

At least for the time being, we could ask our docs writers to add a note about this for the RHEL-8 documentation and maybe add a note to the man page?

Comment 10 Jakub Hrozek 2019-01-25 10:20:47 UTC
Also maybe some leapp content for the sake of the upgrades might be nice..

Comment 11 Madhuri 2019-01-25 13:00:41 UTC
(In reply to Sumit Bose from comment #7)
> (In reply to Madhuri from comment #5)
> > Added new user,
> > # testuser2, People, example.com
> > dn: uid=testuser2,ou=People,dc=example,dc=com
> > objectClass: posixAccount
> > objectClass: account
> > objectClass: authorizedServiceObject
> > objectClass: top
> > authorizedService: systemd-user
> 
> I meant to add another value not replace it, it should look like:
> 
>     authorizedService: systemd-user
>     authorizedService: sshd
> 
> HTH
> 
> bye,
> Sumit
> 
> > cn: testuser2
> > uid: testuser2
> > uidNumber: 100012
> > gidNumber: 100012
> > homeDirectory: /home/testuser2
> > loginShell: /bin/bash
> > 
> > Tried to authenticate with that user after clearing sssd cache,
> > but authentication failed,
> > 
> > from log,
> > Jan 25 04:11:07 client-4704 sshd[22323]: pam_sss(sshd:auth): authentication
> > success; logname= uid=0 euid=0 tty=ssh ruser= rhost=::1 user=testuser2
> > Jan 25 04:11:07 client-4704 sshd[22323]: pam_sss(sshd:account): system info:
> > [Authorized service attribute has no matching rule, access denied]
> > Jan 25 04:11:07 client-4704 sshd[22323]: pam_sss(sshd:account): Access
> > denied for user testuser2: 6 (Permission denied)
> > Jan 25 04:11:07 client-4704 sshd[22323]: Failed password for testuser2 from
> > ::1 port 40752 ssh2
> > Jan 25 04:11:07 client-4704 sshd[22323]: fatal: Access denied for user
> > testuser2 by PAM account configuration [preauth]

With this change authentication is successful.

Comment 12 Madhuri 2019-01-25 13:03:39 UTC
(In reply to Jakub Hrozek from comment #8)

sorry for not reading carefully,
After getting the successful run with beaker,
will update the bug and close it.

Comment 13 Jakub Hrozek 2019-01-28 08:15:50 UTC
(In reply to Madhuri from comment #12)
> (In reply to Jakub Hrozek from comment #8)
> 
> sorry for not reading carefully,
> After getting the successful run with beaker,
> will update the bug and close it.

Thank you for the test run, do you think it would made sense to open a documentation request and/or a ticket about amending the man page?

Comment 14 Amith 2019-01-28 08:59:56 UTC
(In reply to Jakub Hrozek from comment #13)
> (In reply to Madhuri from comment #12)
> > (In reply to Jakub Hrozek from comment #8)
> > 
> > sorry for not reading carefully,
> > After getting the successful run with beaker,
> > will update the bug and close it.
> 
> Thank you for the test run, do you think it would made sense to open a
> documentation request and/or a ticket about amending the man page?

Yes.. it makes perfect sense.

Comment 18 Jakub Hrozek 2019-01-28 20:20:14 UTC
Upstream ticket:
https://pagure.io/SSSD/sssd/issue/3932

Comment 26 Michal Zidek 2019-08-18 21:20:27 UTC
master: 820151f3813f08c704cb87a99988fe39f9f48a8d


Note You need to log in before you can comment on or make changes to this bug.