Re: Authorization without Netgroups

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



sudoers has an ldap extension that allows you to read sudo rules from ldap.

Alternately, standard sudo rules and groups will work with ldap presented users and groups.



> On 15 Feb 2022, at 02:16, Dudas Tibor ABRAXAS <Tibor.Dudas@xxxxxxxxxx> wrote:
> 
> Hi
> 
> Thanks.
> 
> Access Control works with ldap access filter, but how do we authorize without netgroups? I did not find anything like SUDOers for 389ds.
> 
> Best regards,
> Tibor
> 
> 
> -----Ursprüngliche Nachricht-----
> Von: William Brown <william.brown@xxxxxxxx> 
> Gesendet: Donnerstag, 27. Januar 2022 01:27
> An: 389-users@xxxxxxxxxxxxxxxxxxxxxxx
> Betreff: [389-users] Re: ssh does not see my access.conf
> 
> 
> 
>> On 25 Jan 2022, at 18:15, Dudas Tibor ABRAXAS <Tibor.Dudas@xxxxxxxxxx> wrote:
>> 
>> Thanks, you are right: It works with the memberof-Plugin and ldap access filter.
>> 
>> Is there a way to make it work with netgroups? We have it set up like that in our OpenLDAP and would have to migrate everything, otherwise.
>> 
>> According to the documentation it should work:
>> https://directory.fedoraproject.org/docs/389ds/howto/howto-netgroups.h
>> tml
> 
> I've honestly not touched netgroups in a long long time. I think SSSD might have a way to emulate them? But honestly you may want to consider this as a good time to start to migrate away from them ... 
> 
> But on the ldap side, there is no reason that the data in ldap will be any different between openldap and 389, it's just ldap. 
> 
> 
>> 
>> 
>> Thanks for your answer,
>> Tibor
>> 
>> 
>> -----Ursprüngliche Nachricht-----
>> Von: William Brown <william.brown@xxxxxxxx>
>> Gesendet: Dienstag, 25. Januar 2022 00:24
>> An: 389-users@xxxxxxxxxxxxxxxxxxxxxxx
>> Betreff: [389-users] Re: ssh does not see my access.conf
>> 
>> 
>> 
>>> On 25 Jan 2022, at 02:36, Dudas Tibor ABRAXAS <Tibor.Dudas@xxxxxxxxxx> wrote:
>>> 
>>> Hi,
>>> 
>>> I can resolve my netgroup user via getent and can login with her on my 389ds client via ssh.
>>> 
>>> What does not work, yet, is to exclude all other users.
>>> 
>>> The Config is:
>>> getent netgroup sysadmin
>>> sysadmin              ( ,eve,)
>>> 
>>> cat /etc/security/access.conf
>>> +:root:LOCAL
>>> +:root:ALL
>>> +:@sysadmin:ALL
>>> -:ALL:ALL EXCEPT LOCAL
>>> 
>>> Cat /etc/pam.d/system-auth
>>> …
>>> account required pam_access.so
>>> accessfile=/etc/security/access.netgroup.conf
>>> 
>>> cat =/etc/security/access.netgroup.conf
>>> +:root:LOCAL
>>> +:root:ALL
>>> +:@sysadmin:ALL
>>> -:ALL:ALL EXCEPT LOCAL
>>> 
>>> The client logs say, when I try to login with user alice from my 389ds, not belonging to my netgroup sysadmin:
>>> (Mon Jan 24 17:19:31 2022) [sssd[be[LDAP]]] 
>>> [sdap_get_groups_next_base] (0x0400): Searching for groups with base [ou=groups,dc=example,dc=com] (Mon Jan 24 17:19:31 2022) [sssd[be[LDAP]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(&(gidNumber=1002)(objectClass=posixGroup)(cn=*)(&(gidNumber=*)(!(gidNumber=0))))][ou=groups, dc=example,dc=com].
>>> (Mon Jan 24 17:19:31 2022) [sssd[be[LDAP]]] 
>>> [sdap_get_generic_op_finished] (0x0400): Search result: Success(0), no errmsg set (Mon Jan 24 17:19:31 2022) [sssd[be[LDAP]]] [sdap_get_groups_process] (0x0400): Search for groups, returned 0 results.
>>> (Mon Jan 24 17:19:31 2022) [sssd[be[LDAP]]] 
>>> [sysdb_search_group_by_gid] (0x0400): No such entry (Mon Jan 24
>>> 17:19:31 2022) [sssd[be[LDAP]]] [sysdb_delete_group] (0x0400): Error: 
>>> 2 (No such file or directory) (Mon Jan 24 17:19:31 2022) [sssd[be[LDAP]]] [dp_req_done] (0x0400): DP Request [Account #48]: Request handler finished [0]: Success (Mon Jan 24 17:19:31 2022) [sssd[be[LDAP]]] [_dp_req_recv] (0x0400): DP Request [Account #48]: Receiving request data.
>>> (Mon Jan 24 17:19:31 2022) [sssd[be[LDAP]]] [dp_req_reply_list_success] (0x0400): DP Request [Account #48]: Finished. Success.
>>> 
>>> The client does not even look for netgroups, but lets everyone pass. What did I miss?
>> 
>> You probably don't want pam_access here, since netgroups are not an LDAP thing. 
>> 
>> You can have the same effect with ldap access filter in sssd.conf, and then using pam_sss in the account line of pam. 
>> 
>>> 
>>> Any help is appreciated.
>>> 
>>> Kind regards, Tibor
>>> 
>>> 
>>> _______________________________________________
>>> 389-users mailing list -- 389-users@xxxxxxxxxxxxxxxxxxxxxxx To 
>>> unsubscribe send an email to 389-users-leave@xxxxxxxxxxxxxxxxxxxxxxx
>>> Fedora Code of Conduct: 
>>> https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>>> List Guidelines: 
>>> https://fedoraproject.org/wiki/Mailing_list_guidelines
>>> List Archives: 
>>> https://lists.fedoraproject.org/archives/list/389-users@lists.fedorap
>>> r oject.org Do not reply to spam on the list, report it:
>>> https://pagure.io/fedora-infrastructure
>> 
>> --
>> Sincerely,
>> 
>> William Brown
>> 
>> Senior Software Engineer, Identity and Access Management SUSE Labs, 
>> Australia
>> 
>> _______________________________________________
>> 389-users mailing list -- 389-users@xxxxxxxxxxxxxxxxxxxxxxx To 
>> unsubscribe send an email to 389-users-leave@xxxxxxxxxxxxxxxxxxxxxxx
>> Fedora Code of Conduct: 
>> https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>> List Guidelines: 
>> https://fedoraproject.org/wiki/Mailing_list_guidelines
>> List Archives: 
>> https://lists.fedoraproject.org/archives/list/389-users@lists.fedorapr
>> oject.org Do not reply to spam on the list, report it: 
>> https://pagure.io/fedora-infrastructure
>> _______________________________________________
>> 389-users mailing list -- 389-users@xxxxxxxxxxxxxxxxxxxxxxx To 
>> unsubscribe send an email to 389-users-leave@xxxxxxxxxxxxxxxxxxxxxxx
>> Fedora Code of Conduct: 
>> https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>> List Guidelines: 
>> https://fedoraproject.org/wiki/Mailing_list_guidelines
>> List Archives: 
>> https://lists.fedoraproject.org/archives/list/389-users@lists.fedorapr
>> oject.org Do not reply to spam on the list, report it: 
>> https://pagure.io/fedora-infrastructure
> 
> --
> Sincerely,
> 
> William Brown
> 
> Senior Software Engineer, Identity and Access Management SUSE Labs, Australia
> 
> _______________________________________________
> 389-users mailing list -- 389-users@xxxxxxxxxxxxxxxxxxxxxxx To unsubscribe send an email to 389-users-leave@xxxxxxxxxxxxxxxxxxxxxxx
> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives: https://lists.fedoraproject.org/archives/list/389-users@xxxxxxxxxxxxxxxxxxxxxxx
> Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure
> _______________________________________________
> 389-users mailing list -- 389-users@xxxxxxxxxxxxxxxxxxxxxxx
> To unsubscribe send an email to 389-users-leave@xxxxxxxxxxxxxxxxxxxxxxx
> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives: https://lists.fedoraproject.org/archives/list/389-users@xxxxxxxxxxxxxxxxxxxxxxx
> Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure

--
Sincerely,

William Brown

Sesion Software Engineer,
Identity and Access Management
SUSE Labs, Australia

_______________________________________________
389-users mailing list -- 389-users@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to 389-users-leave@xxxxxxxxxxxxxxxxxxxxxxx
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/389-users@xxxxxxxxxxxxxxxxxxxxxxx
Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure




[Index of Archives]     [Fedora User Discussion]     [Older Fedora Users]     [Fedora Announce]     [Fedora Package Announce]     [EPEL Announce]     [Fedora News]     [Fedora Cloud]     [Fedora Advisory Board]     [Fedora Education]     [Fedora Security]     [Fedora Scitech]     [Fedora Robotics]     [Fedora Maintainers]     [Fedora Infrastructure]     [Fedora Websites]     [Anaconda Devel]     [Fedora Devel Java]     [Fedora Legacy]     [Fedora Desktop]     [Fedora Fonts]     [ATA RAID]     [Fedora Marketing]     [Fedora Management Tools]     [Fedora Mentors]     [Fedora Package Review]     [Fedora R Devel]     [Fedora PHP Devel]     [Kickstart]     [Fedora Music]     [Fedora Packaging]     [Centos]     [Fedora SELinux]     [Fedora Legal]     [Fedora Kernel]     [Fedora QA]     [Fedora Triage]     [Fedora OCaml]     [Coolkey]     [Virtualization Tools]     [ET Management Tools]     [Yum Users]     [Tux]     [Yosemite News]     [Yosemite Photos]     [Linux Apps]     [Maemo Users]     [Gnome Users]     [KDE Users]     [Fedora Tools]     [Fedora Art]     [Fedora Docs]     [Maemo Users]     [Asterisk PBX]     [Fedora Sparc]     [Fedora Universal Network Connector]     [Fedora ARM]

  Powered by Linux