Re: [Freeipa-users] sudo runs despite being denied by HBAC rules
I wrote... > Can anyone help me to understand these logs... is there maybe a bug here? > The basic situation is that there is no HBAC rule that would allow > sudo. When people try it, sss accepts their password but then denies > them access to the sudo command. But despite this, our logs still > contain some entries indicating that sudo was actually run. Of course > the sudoers file then denied them access and sent the sysadmin an > email. It turns out I am misinterpreting the logs. And because the sudoers file would normally allow me access, testing it with my own account didn't yield the same results. Essentially, if sudoers would deny access then it seems that sudo will log and email the sysadmin even if the user failed to supply a correct password. So there isn't a problem here after all. The user is being told their password was incorrect and sudo goes no further. But the email that the sysadmin receives is the same regardless of whether sudo accepted their password. If I try with my account, sudo tells me my password is incorrect but doesn't email the sysadmin, and it writes "3 incorrect password attempts" into the log instead of "user NOT in sudoers". Anyway, now I've added an HBAC rule that allows the system staff (but not general users) to run sudo, and this is working too. Sorry for the false alarm. Ian Collier. -- Manage your subscription for the Freeipa-users mailing list: https://www.redhat.com/mailman/listinfo/freeipa-users Go to http://freeipa.org for more info on the project
[Freeipa-users] sudo runs despite being denied by HBAC rules
Feb 02 10:31:26 hostname2 audit[24468]: pid=24468 uid=12106 auid=12106 ses=39 msg='op=PAM:authentication grantors=pam_succeed_if,pam_sss acct="xyyx" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=success' Feb 02 10:31:26 hostname2 sudo[24468]: pam_sss(sudo:account): Access denied for user xyyx: 6 (Permission denied) Feb 02 10:31:26 hostname2 audit[24468]: pid=24468 uid=12106 auid=12106 ses=39 msg='op=PAM:accounting grantors=? acct="xyyx" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=failed' Feb 02 10:31:46 hostname2 sudo[24468]: pam_sss(sudo:auth): authentication success; logname=xyyx uid=12106 euid=0 tty=/dev/pts/1 ruser=xyyx rhost= user=xyyx Feb 02 10:31:46 hostname2 audit[24468]: pid=24468 uid=12106 auid=12106 ses=39 msg='op=PAM:authentication grantors=pam_succeed_if,pam_sss acct="xyyx" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=success' Feb 02 10:31:46 hostname2 sudo[24468]: pam_sss(sudo:account): Access denied for user xyyx: 6 (Permission denied) Feb 02 10:31:46 hostname2 audit[24468]: pid=24468 uid=12106 auid=12106 ses=39 msg='op=PAM:accounting grantors=? acct="xyyx" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=failed' Feb 02 10:31:46 hostname2 audit[24468]: pid=24468 uid=12106 auid=12106 ses=39 msg='cwd="/" cmd=6E616Exxx terminal=pts/1 res=failed' Feb 02 10:31:46 hostname2 audit[24468]: pid=24468 uid=12106 auid=12106 ses=39 msg='cwd="/" cmd=6E616Exxx terminal=pts/1 res=failed' Feb 02 10:31:46 hostname2 sudo[24468]: xyyx : user NOT in sudoers ; TTY=pts/1 ; PWD=/xx ; USER=root ; COMMAND=xx Feb 02 10:31:47 hostname2 sSMTP[24489]: Sent mail for r...@cs.ox.ac.uk (221 mail.cs.ox.ac.uk closing connection) uid=0 username=root outbytes=589 Now since sudoers denies access, this isn't necessarily a security problem for us. But it's rather puzzling and it does mean a trickle of incoming emails to the sysadmin. The clients here are Fedora 22 with pam 1.1.8, sssd 1.13.3 and sudo 1.8.15. The IPA servers are RHEL 6 with ipa-server 3.0.0. Ian Collier. -- Manage your subscription for the Freeipa-users mailing list: https://www.redhat.com/mailman/listinfo/freeipa-users Go to http://freeipa.org for more info on the project
