LDAP-Based Access Control

Hello! Can you help me? …
My question according to your
> Make the following changes to the /etc/ldap.conf file:
> pam_groupdn cn=GroupName,ou=OUName,dc=example,dc=net
> pam_member_attribute member

my authz from CentOS against Win2003 AD works fine. But I want to give access only to users which included into the group from pam_groupdn line … but it doesn’t works.
My /etc/ldap.conf
———————-
base DC=domain,DC=com
uri ldap://ads1.domain.com
uri ldap://ads2.domain.com
binddn “cn=ldapproxy,ou=unix groups,dc=domain,dc=com”
bindpw Passw1
scope sub
timelimit 30
ssl no
ldap_version 3
nss_base_passwd dc=domain,dc=com?sub
nss_base_shadow dc=domain,dc=com?sub
nss_base_group ou=unix ou,dc=domain,dc=com?sub
nss_map_objectclass posixAccount User
nss_map_objectclass shadowAccount User
nss_map_objectclass posixGroup Group
nss_map_attribute uid sAMAccountName
nss_map_attribute uidNumber msSFU30UidNumber
nss_map_attribute gidNumber msSFU30GidNumber
nss_map_attribute loginShell msSFU30LoginShell
nss_map_attribute uniqueMember msSFU30Membecomid
nss_map_attribute userPassword msSFU30Password
nss_map_attribute homeDirectory msSFU30HomeDirectory
nss_map_attribute membecomid msSFU30Membecomid
nss_map_attribute gecos msSFU30Gecos
pam_filter objectclass=user
pam_member_attribute member
pam_groupdn cn=SRV1,ou=SRV1,ou=unix ou,dc=domain,dc=com
pam_password ad

Thank you, but its not working.
I’ve tried different ways and yours suggested too, but all users with Unix Attributes from dc=domain,dc=com can gain access to my CentOS-server, not only from pam_groupdn.
–from /etc/ldap.conf (for example) –
………………..
pam_filter objectclass=user
pam_member_attribute member
pam_groupdn OU=Unix Users,DC=mydomain,DC=ru
………………..
–My current /etc/pam.d/sys-auth looks as standart for such tasks–
#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth required /lib/security/$ISA/pam_env.so
auth sufficient /lib/security/$ISA/pam_unix.so likeauth nullok
auth sufficient /lib/security/$ISA/pam_krb5.so use_first_pass debug
auth sufficient /lib/security/$ISA/pam_ldap.so use_first_pass debug
#auth sufficient /lib/security/$ISA/pam_smb_auth.so use_first_pass nolocal
auth required /lib/security/$ISA/pam_deny.so

account required /lib/security/$ISA/pam_unix.so broken_shadow
account sufficient /lib/security/$ISA/pam_localuser.so
account sufficient /lib/security/$ISA/pam_succeed_if.so uid
account sufficient /lib/security/$ISA/pam_ldap.so debug
account sufficient /lib/security/$ISA/pam_krb5.so debug
account required /lib/security/$ISA/pam_permit.so

I did it, but not aid. After moving pam_ldap.so nothing changed - all users not only from pam_groupdn line group can gain access.

After changing pam_permit to pam_deny all users and root lost access with messages:

Sep 21 09:56:44 centest sshd: pam_krb5[26960]: authentication succeeds for ‘pinbol’ (pinbol@MYDOMAIN.RU)
Sep 21 09:57:01 centest sshd: pam_krb5[26962]: authentication fails for ‘root’ (root@MYDOMAIN.RU): User not known to the underlying authentication

Thanks for the page. I’ve been trying to figure out centralized authentication for a few days now and I’m running into a bit of a roadblock. I’ve got LDAP set up and populated, and I’ve made the changes to ldap.conf and system-auth, but sshd still isn’t using the LDAP objects for authentication. getent passwd only shows the entries in /etc/passwd, but sudo getent passwd shows the LDAP users as well. This seems to indicate that PAM is doing its thing, but only when root asks. Any ideas?

Does your nsswitch.conf seems so?

[pinbol@test->cat /etc/nsswitch.conf
passwd: files ldap
group: files ldap
hosts: dns files

nsswitch.conf:
————————
passwd: files ldap
shadow: files ldap
group: files ldap
————————

system-auth:
————————
auth required /lib/security/$ISA/pam_env.so
auth sufficient /lib/security/$ISA/pam_unix.so likeauth nullok
auth sufficient /lib/security/$ISA/pam_ldap.so use_first_pass
auth required /lib/security/$ISA/pam_deny.so

account required /lib/security/$ISA/pam_unix.so broken_shadow
account sufficient /lib/security/$ISA/pam_localuser.so
account sufficient /lib/security/$ISA/pam_succeed_if.so uid
account [default=bad success=ok user_unknown=ignore] /lib/security/$ISA/pam_ldap.so
account required /lib/security/$ISA/pam_permit.so

I’ve tried Vintela VAS - very good solution. It’s much better then native and openldap. Although it’s not free.

Hi!
I followed your guides and I installed some Red Hat ES 4.0 with Kerberos/LDAP Authentication.

The users can login, change password, the policies password work fine, but I can’t limit the users taht connect to a host via the

pam_member_attribute member
pam_groupdn cn=GroupName,dc=domain,dc=com,dc=ar

My domain is a 2003 with SFU 3.5

I try to used an invalid group or a valid group and appears to be ignored

Any idea?

Hi

I have this message when a user trie to login in a Linux box with AD Integration

You must be a member of cn=AdministracionLinux,cn=users,DC=banco,DC=com,DC=ar?sub to login.

But the user still login.

The user is member of this group in the AD.

The group name not contain any special character and when a doa getent group a see the group and the members off.

Why i have this message if the user is member of the group?
Why i still login if the pam module said that the user is not member of the group?

Thanks in advance for your time!!!!

Fabian Tome

Hi,
I followed the above steps. But still i am getting local user list for getent passwd. Can any body
tell me the other than ldap.conf, pam.d/system-auth -what else i have to change. And also tell me how to verify LDAP authentication.

Waiting for reply
-Animesh

Hi Scott,

Firstly, as per everyone else’s comments, thanks for the great work and detailed setup for this, it has helped immensely! I have managed to get this running successfully for one machine, including access control through pam_groupdn but with one problem.

if the user is a member of more than one “Unix” group in AD, then authentication will stop working reliably. (by “Unix” group I mean an AD group which has Unix credentials, GID etc in AD).

When the user connects with ssh (or another service) the login process will hang, sometimes before the login prompt, and sometimes after they have entered their password. The associated sshd (or vsftpd) process goes to 100% usage. On the very rare occasion when the user can get in, the group memberships return from “id” are correct.

If you remove the user from the multiple Unix groups then everything works reliably everytime.

The environment is:

CentOS 5
Win 2003 (pre R2) with SFU 3.5

Any thoughts or suggestions would be appreciated.

Cheers
J

Curioser and curioser.

If I use that extended string, it does allow me to logon but, I get the following error when I logon:

“id: cannot find name for group ID 10005″

and I am only listed as a member of my primary group in ‘id` (and no group names are shown, only gid). This behaviour occurs on both a CentOS 5 and a CentOS 4 machine.

If I use the original string of “nss_base_group dc=pcs,dc=local?sub” then the CentOS 4 machine works fine (but I swear it wasn’t yesterday, your honour), but the CentOS 5 machine exhibits the behaviour I described in the first post. The ldap and krb5 configs are the same, the pam system-auth file is slightly different, but I have tried commenting out/adjusting the non-matching lines without success.

For now I will try a few more machines with different OSes and see if this is just CentOS 5 related.

FYI

CentOS 4 (working)
openldap - 2.2.13-7.4E
nss_ldap - 226-18
krb5 - 1.3.4-47
pam - 0.77-66.21
pam_krb5 - 2.1.8-1

CentOS 5 (not working)
openldap - 2.3.27-5
nss_ldap - 253-3
krb5 - 1.5-23
pam - 0.99.6.2-3.14.el5
pam_krb5 - 2.2.11-1

I will test some other linux boxen around the place and let you know.

Cheers
J

Haven’t managed to test any other boxes fully yet, but I think we have narrowed this down to the DC we were pointing at. The one I had been using is a PDC but not a Global Catalog Server. I pointed LDAP at the GC server and it worked much more reliably, so far anyway.

Can anybody tell the equivalent for solaris LDAP client

for below things…

1. /etc/pam.d/system-auth
2. pam_groupdn cn=GroupName,ou=OUName,dc=example,dc=net
pam_member_attribute member

Here is the way just allow only user which defined in ldapclient

add these search scriptors in ldapclient command.

-a “serviceSearchDescriptor=passwd:CN=Users,DC=eng,DC=int,DC=rci,DC=com?sub?(|(uid=testunix)(uid=ldapbala)(uid=ldapuser2))” \
-a “serviceSearchDescriptor=shadow:CN=Users,DC=eng,DC=int,DC=rci,DC=com?sub?(|(uid=testunix)(uid=ldapbala)(uid=ldapuser2))” \
-a “serviceSearchDescriptor=group:dc=CN=Users,eng,DC=int,DC=rci,DC=com?sub?(|(uid=testunix)(uid=ldapbala)(uid=ldapuser2))” \

John,

Possible to share the nsswitch.conf,ldap.conf and system-auth file?

Access for my RHEL server against Win2003 AD works fine. But I want to give access only to users which included into the group from pam_groupdn line … but it doesn’t works.

Thanks.

regards,
David

I have tried many methods to restrict users from being able to login into my solaris10 system.

1. Netgroup +@ syntax doesn’t work, but ldaplist netgroup works fine.
2. Modifying the search descriptor failed, because I need to restrict it to groups.

Does anyone know of an equivalent pam_groupdn for Solaris10?

Oh BTW getent netgroup fails.

Problem solved. See MS KB 886683

Scott: if I read this correctly, any PAM-aware service will be restricted to the users in the specific group, correct? Because you modify /etc/pam.d/system-auth, and on Red Hat 5 most PAM services require this, only members of the group can authenticate. Right?

I’d like to make sure that my domain users cannot ssh into my file server(s) while still making sure that they can use NFS and CIFS. I _think_ your instructions will work to this effect, but I’d appreciate knowing in advance if your tests have revealed anything about this.

Thanks!

Scott: thanks for that! I just recently re-read the sshd_config man page for a different issue, and glossed right past those options. Cheers!

Scott,

Could really use some help here. I have auth working but it’s not constrained to users in my windows global security group - “jeffg1″. All users (in the right ou) work.

I have attached my system-auth and ldap.conf file, any help you could provide would be greatly appreciated.

ldap.conf…
base dc=lab,dc=example,dc=com
uri ldap://10.0.0.152/
binddn jeffproxyuser@lab.example.com
bindpw s3cr3t
scope sub
timelimit 30
idle_timelimit 3600
pam_groupdn cn=jeffg1,ou=unix,dc=lab,dc=example,dc=com?sub
pam_member_attribute member
nss_base_passwd ou=unix,dc=lab,dc=example,dc=com?sub
nss_base_shadow ou=unix,dc=lab,dc=example,dc=com?sub
nss_base_group ou=unix,dc=lab,dc=example,dc=com?sub
nss_map_objectclass posixAccount User
nss_map_objectclass shadowAccount User
nss_map_attribute uid sAMAccountName
nss_map_attribute uniqueMember msSFU30PosixMember
nss_map_attribute uidNumber msSFU30UidNumber
nss_map_attribute gidNumber msSFU30GidNumber
nss_map_attribute loginShell msSFU30LoginShell
nss_map_attribute homeDirectory msSFU30HomeDirectory
nss_map_objectclass posixGroup Group
nss_map_attribute memberUid msSFU30MemberUid
ssl no
tls_cacertdir /etc/openldap/cacerts
pam_password md5

system-auth…
auth required /lib/security/$ISA/pam_env.so
auth sufficient /lib/security/$ISA/pam_unix.so likeauth nullok
auth sufficient /lib/security/$ISA/pam_krb5.so debug
auth required /lib/security/$ISA/pam_deny.so debug

account sufficient /lib/security/$ISA/pam_ldap.so debug
account sufficient /lib/security/$ISA/pam_krb5.so debug
account required /lib/security/$ISA/pam_unix.so
account sufficient /lib/security/$ISA/pam_succeed_if.so uid

the member attribute does have my user

here are the log results when a user who was not supposed to be able to, successfully logged in via ssh…

Jun 23 15:31:39 rhel4test sshd[15560]: pam_krb5[15560]: flag: no krb4_convert
Jun 23 15:31:39 rhel4test sshd[15560]: pam_krb5[15560]: flag: no external
Jun 23 15:31:39 rhel4test sshd[15560]: pam_krb5[15560]: flag: validate
Jun 23 15:31:39 rhel4test sshd[15560]: pam_krb5[15560]: flag: warn
Jun 23 15:31:39 rhel4test sshd[15560]: pam_krb5[15560]: ticket lifetime: 36000
Jun 23 15:31:39 rhel4test sshd[15560]: pam_krb5[15560]: renewable lifetime: 36000
Jun 23 15:31:39 rhel4test sshd[15560]: pam_krb5[15560]: banner: Kerberos 5
Jun 23 15:31:39 rhel4test sshd[15560]: pam_krb5[15560]: ccache dir: /tmp
Jun 23 15:31:39 rhel4test sshd[15560]: pam_krb5[15560]: keytab: /etc/krb5.keytab
Jun 23 15:31:39 rhel4test sshd[15560]: pam_krb5[15560]: account manaEXAMPLEment succeeds for ‘jeffu2′
Jun 23 15:31:39 rhel4test sshd[15560]: pam_krb5[15560]: pam_acct_mgmt returning 0 (Success)
Jun 23 15:31:40 rhel4test sshd(pam_unix)[15560]: session opened for user jeffu2 by (uid=0)
Jun 23 15:31:40 rhel4test sshd[15564]: pam_krb5[15564]: configured realm ‘LAB.EXAMPLE.COM’
Jun 23 15:31:40 rhel4test sshd[15564]: pam_krb5[15564]: flags: forwardable
Jun 23 15:31:40 rhel4test sshd[15564]: pam_krb5[15564]: flag: no ignore_afs
Jun 23 15:31:40 rhel4test sshd[15564]: pam_krb5[15564]: flag: user_check
Jun 23 15:31:40 rhel4test sshd[15564]: pam_krb5[15564]: flag: no krb4_convert
Jun 23 15:31:40 rhel4test sshd[15564]: pam_krb5[15564]: flag: no external
Jun 23 15:31:40 rhel4test sshd[15564]: pam_krb5[15564]: flag: validate
Jun 23 15:31:40 rhel4test sshd[15564]: pam_krb5[15564]: flag: warn
Jun 23 15:31:40 rhel4test sshd[15564]: pam_krb5[15564]: ticket lifetime: 36000
Jun 23 15:31:40 rhel4test sshd[15564]: pam_krb5[15564]: renewable lifetime: 36000
Jun 23 15:31:40 rhel4test sshd[15564]: pam_krb5[15564]: banner: Kerberos 5
Jun 23 15:31:40 rhel4test sshd[15564]: pam_krb5[15564]: ccache dir: /tmp
Jun 23 15:31:40 rhel4test sshd[15564]: pam_krb5[15564]: keytab: /etc/krb5.keytab
Jun 23 15:31:40 rhel4test sshd[15564]: pam_krb5[15564]: called to update credentials for ‘jeffu2′
Jun 23 15:31:40 rhel4test sshd[15564]: pam_krb5[15564]: _pam_krb5_sly_refresh returning 0 (Success)
Jun 23 15:31:40 rhel4test sshd[15560]: nss_ldap: reconnecting to LDAP server…
Jun 23 15:31:40 rhel4test sshd[15560]: nss_ldap: reconnected to LDAP server ldap://10.0.0.52/ after 1 attempt(s)

Tried, it prevented any user from logging in.

It logged that the authentication piece worked fine and that’s it, nothing for account management (which usually reports as successful when there is a pam_kerb5.so entry in the account section of system-auth).

Scott that did the job, thanks a million. My remote root access was killed but I should be able to fix it.

It doesn’t look like nested groups work so I’m going to look into that and getting this done on solaris 10 next. If I find anything interesting, I’ll be sure to post. Thanks again and great blog.

Scott,
Great post! Refer to it all the time! Very interested in finding an answer to the Solaris question of access control when integrated with R2 AD. Can this be done? Can I restrict by using a single access group (such as solaris1) per Solaris server, or even migrate all Solaris groups to AD? Need to have some access control in place. Any ideas? Pointers?

Thanks!