Hello all. We encountered a situation where ID views broke authentication... or at least we think so. The situation was as follows: Customer insisted that they have to have a "hardened" SSH config like this: AllowGroups staff. This staff (GID 500) group was/is a local group in 100+ machines. They did this "to control who can login" despite me and a couple of my colleagues trying to tell them (sometimes with strong words attached) that FreeIPA's HBAC rules will handle this very thing but to no avail. Of course this resulted into situation where the IPA users could not login because sshd prevented it. We came up with a solution where we would create this ID-view: Anchor to override: res_staff Group name: staff GID: 500 and apply that to those 100+ clients. We didn't like the idea to abuse ID-views like this especially after the client insisted that the res_staff group should be a nested group like this: dev-team -> res_staff + <insert a bunch of other groups> ops-team -> res_staff + <insert a bunch of other groups> . . . (I have to admit that after seeing and hearing about this, I considered telling my bosses to outright fire this customer) For a while everything worked but then logins started to fail. Upon examining, it turned out that id command would no longer return the full list of groups of a user and the "hardened" sshd config killed the login. After we cleared the SSSD caches and restarted SSSD, the logins would work for a while and id command would return all the groups where user belonged to. It is also worth mentioning that this client has a fetish for nested groups so it is not uncommon to see groups 4-5 "deep" and it is a general mess.
Also: No AD trust here. Just ye olde IPA domain. The good thing is that the environment is extremely homogeneous. All the IPA servers CentOS 7.6 and the clients CentOS 7.x. We have the logs with debug level 6 but before I'll send them for examination, I would like to ask that is there a limitation/bug in the ID-views functionality where it fails when the anchor group is nested? Thank you. PS. Alexander, you are awesome. _______________________________________________ FreeIPA-users mailing list -- [email protected] To unsubscribe send an email to [email protected] Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/[email protected]
