You are not logged in.
I'm attempting to use an openldap implementation to authenticate for sudo.
Many of these instructions (which aren't exactly correct -- which I intend to edit and fix once I have a working setup) are taken from here:
https://wiki.archlinux.org/index.php/LD … ble_sudo_2
I'm working with an openldap implementation with
a base domain, ou=groups (containing posixGroup), ou=SUDOers (containing sudoRoles) and ou=users (containing posixAccount)
I'm additionally using a nsswitch/nslcd/pam implementation.
Please note that for my nsswitch.conf file if I use a sudoers: ldap files, the process will complete, however I'm only trying to use ldap for sudoers authentication:
My nsswitch.conf file is :
passwd: files ldap mymachines systemd
group: files ldap mymachines systemd
shadow: files ldap
sudoers: ldap
publickey: files
hosts: files mymachines myhostname mdns_minimal resolve [!UNAVAIL=return] dns wins
networks: files
protocols: files
services: files
ethers: files
rpc: files
netgroup: filesMy nslcd.conf file is the following:
uid nslcd
gid nslcd
uri ldap://openldap.domain.com:389/
base dc=ldap,dc=domain,dc=com
binddn cn=admin,dc=ldap,dc=domain,dc=com
bindpw ***PASS**
rootpwmoddn cn=admin,dc=ldap,dc=domain,dc=com
scope sub
base group ou=groups,dc=ldap,dc=domain,dc=com
base passwd ou=users,dc=ldap,dc=domain,dc=com
base shadow ou=users,dc=ldap,dc=domain,dc=com
bind_timelimit 30
timelimit 30
idle_timelimit 3600
tls_reqcert allow
tls_cacertfile /etc/ssl/self-signed-certs/ldap.domain.com/client/ca.pem
tls_cert /etc/ssl/self-signed-certs/ldap.domain.com/client/cert.pem
tls_key /etc/ssl/self-signed-certs/ldap.domain.com/client/key.pem
filter passwd (objectClass=posixAccount)
filter passwd uid uid
filter passwd userPassword userPassword
filter passwd homeDirectory homeDirectory
filter passwd gidNumber gidNumber
filter shadow (objectClass=posixAccount)
map shadow userPassword userPassword
filter group (objectClass=posixGroup)
map group member memberUid
map group cn groupName
map group gidNumber gidMy /etc/openldap/ldap.conf is as follows:
BASE dc=ldap,dc=domain,dc=com
URI ldap://openldap.domain.com/
PORT 389
LDAP_VERSION 3
tls_cacertfile /etc/ssl/self-signed-certs/ldap.domain.com/client/ca.pem
tls_reqcert demand
SUDOERS_BASE ou=SUDOers,dc=ldap,dc=domain,dc=com
SUDOERS_TIMED no
SUDOERS_DEBUG 0
SUDOERS_SEARCH_FILTER ($(objectClass=sudoRole)(sudoUser=*))
TIMELIMIT 10
TIMEOUT 10
BIND_TIMELIMIT 10In terms of running a query for the sudoUsers:
# ldapsearch -D "cn=admin,dc=ldap,dc=domain,dc=com" -w **PASS** -b 'ou=SUDOers,dc=ldap,dc=domain,dc=com' -H ldap://openldap.domain.com
# extended LDIF
#
# LDAPv3
# base <ou=SUDOers,dc=ldap,dc=domain,dc=com> with scope subtree
# filter: (objectclass=*)
# requesting: ALL
#
# SUDOers, ldap.domain.com
dn: ou=SUDOers,dc=ldap,dc=domain,dc=com
ou: SUDOers
associatedDomain: openldap.domain.com
objectClass: organizationalUnit
objectClass: top
objectClass: domainRelatedObject
# %sudo, SUDOers, ldap.domain.com
dn: cn=%sudo,ou=SUDOers,dc=ldap,dc=domain,dc=com
cn: %sudo
objectClass: sudoRole
objectClass: top
sudoCommand: ALL
sudoHost: ALL
sudoUser: %sudo
# kevdog, SUDOers, ldap.domain.com
dn: cn=kevdog,ou=SUDOers,dc=ldap,dc=domain,dc=com
cn: kevdog
objectClass: sudoRole
objectClass: top
sudoCommand: ALL
sudoHost: ALL
sudoUser: kevdog
# search result
search: 2
result: 0 Success
# numResponses: 4
# numEntries: 3In terms of pam stuff -- a little over the map but I've made modifications to system-auth and sudo
# cat /etc/pam.d/system-auth
#%PAM-1.0
auth required pam_faillock.so preauth
# Optionally use requisite above if you do not want to prompt for the password
# on locked accounts.
auth sufficient pam_ldap.so try_first_pass
auth [success=2 default=ignore] pam_unix.so try_first_pass nullok
-auth [success=1 default=ignore] pam_systemd_home.so
auth [default=die] pam_faillock.so authfail
auth optional pam_permit.so
auth required pam_env.so
auth required pam_faillock.so authsucc
# If you drop the above call to pam_faillock.so the lock will be done also
# on non-consecutive authentication failures.
-account [success=1 default=ignore] pam_systemd_home.so
account sufficient pam_ldap.so
account required pam_unix.so
account optional pam_permit.so
account required pam_time.so
-password [success=1 default=ignore] pam_systemd_home.so
password sufficient pam_ldap.so try_first_pass
password required pam_unix.so try_first_pass nullok shadow
password optional pam_permit.so
session required pam_limits.so
session required pam_unix.so
session optional pam_ldap.so
session optional pam_permit.so# cat /etc/pam.d/sudo
#%PAM-1.0
auth sufficient pam_ldap.so
auth required pam_unix.so try_first_pass
auth required pam_nologin.so
auth include system-auth
account include system-auth
session include system-authI'll try to login as sudo user but get denied:
sudo su
[sudo] password for kevdog:
kevdog is not allowed to run sudo on arch-TM. This incident will be reported.I setup logging for sudo and all I see is this: (/var/log/sudo_debug)
Dec 18 00:40:46 sudo[604742] <- sudo_new_key_val_v1 @ ./key_val.c:55 := network_addrs=10.0.1.107/255.255.255.0 fe80::c781:fe7a:e66b:608/ffff:ffff:ffff:ffff::
Dec 18 00:40:46 sudo[604742] settings: plugin_dir=/usr/lib/sudo/
Dec 18 00:40:46 sudo[604742] -> sudo_new_key_val_v1 @ ./key_val.c:43
Dec 18 00:40:46 sudo[604742] <- sudo_new_key_val_v1 @ ./key_val.c:55 := plugin_dir=/usr/lib/sudo/
Dec 18 00:40:46 sudo[604742] <- format_plugin_settings @ ./sudo.c:1052 := 0x55c01f14e3d0
Dec 18 00:40:46 sudo[604742] <- policy_open @ ./sudo.c:1104
Dec 18 00:40:46 sudo[604742] -> policy_check @ ./sudo.c:1160
Dec 18 00:40:46 sudo[604742] -> tgetpass @ ./tgetpass.c:122
Dec 18 00:40:46 sudo[604742] -> sudo_term_noecho_v1 @ ./term.c:163
Dec 18 00:40:46 sudo[604742] <- sudo_term_noecho_v1 @ ./term.c:174 := true
Dec 18 00:40:46 sudo[604742] -> getln @ ./tgetpass.c:375
Dec 18 00:40:49 sudo[604742] <- getln @ ./tgetpass.c:442 := ******
Dec 18 00:40:49 sudo[604742] -> tgetpass_display_error @ ./tgetpass.c:89
Dec 18 00:40:49 sudo[604742] <- tgetpass_display_error @ ./tgetpass.c:104
Dec 18 00:40:49 sudo[604742] -> sudo_term_restore_v1 @ ./term.c:144
Dec 18 00:40:49 sudo[604742] <- sudo_term_restore_v1 @ ./term.c:152 := true
Dec 18 00:40:49 sudo[604742] <- tgetpass @ ./tgetpass.c:282 := ******
Dec 18 00:40:49 sudo[604742] policy plugin returns -1 (authentication failure)
Dec 18 00:40:49 sudo[604742] -> audit_error @ ./sudo.c:1703
Dec 18 00:40:49 sudo[604742] <- audit_error @ ./sudo.c:1721
Dec 18 00:40:49 sudo[604742] -> policy_close @ ./sudo.c:1110
Dec 18 00:40:49 sudo[604742] sudoers_policy: calling policy close with wait status 0
Dec 18 00:40:49 sudo[604742] <- policy_close @ ./sudo.c:1132
Dec 18 00:40:49 sudo[604742] -> audit_close @ ./sudo.c:1594
Dec 18 00:40:49 sudo[604742] <- audit_close @ ./sudo.c:1604On the openldap end I don't see a lot in the logs:
5fdcd2b2 conn=2715 fd=13 ACCEPT from IP=10.0.1.107:37548 (IP=0.0.0.0:389)
5fdcd2b2 conn=2715 op=0 BIND dn="cn=admin,dc=ldap,dc=domain,dc=com" method=128
5fdcd2b2 conn=2715 op=0 BIND dn="cn=admin,dc=ldap,dc=domain,dc=com" mech=SIMPLE ssf=0
5fdcd2b2 conn=2715 op=0 RESULT tag=97 err=0 text=
5fdcd2b2 conn=2715 op=1 UNBIND
5fdcd2b2 conn=2715 fd=13 closedIs there something else I should be trying???
Last edited by kevdog (2020-12-18 16:06:31)
Offline
Ok I made some adjustments but still not getting want I need --- I had screwed up my configuration with /etc/openldap/ldap.conf. I made a replacement for the filter:
#SUDOERS_SEARCH_FILTER (&(objectClass=sudoRole)(sudoUser=*))
SUDOERS_SEARCH_FILTER objectClass=sudoRoleNow at the openldap logs I get the following:
5fdcd802 conn=2741 fd=13 ACCEPT from IP=10.0.1.107:37600 (IP=0.0.0.0:389)
5fdcd802 conn=2741 op=0 BIND dn="" method=128
5fdcd802 conn=2741 op=0 RESULT tag=97 err=0 text=
5fdcd802 conn=2741 op=1 SRCH base="ou=SUDOers,dc=ldap,dc=domain,dc=com" scope=2 deref=0 filter="(&(objectClass=sudoRole)(cn=defaults))"
5fdcd802 conn=2741 op=1 SEARCH RESULT tag=101 err=32 nentries=0 text=
5fdcd802 conn=2742 fd=14 ACCEPT from IP=10.0.1.107:37602 (IP=0.0.0.0:389)
5fdcd802 conn=2742 op=0 BIND dn="cn=admin,dc=ldap,dc=domain,dc=com" method=128
5fdcd802 conn=2742 op=0 BIND dn="cn=admin,dc=ldap,dc=domain,dc=com" mech=SIMPLE ssf=0
5fdcd802 conn=2742 op=0 RESULT tag=97 err=0 text=
5fdcd802 conn=2742 op=1 UNBIND
5fdcd802 conn=2742 fd=14 closed
5fdcd802 conn=2741 op=2 SRCH base="ou=SUDOers,dc=ldap,dc=domain,dc=com" scope=2 deref=0 filter="(&(objectClass=sudoRole)(|(sudoUser=kevdog)(sudoUser=#1000)(sudoUser=%kevdog)(sudoUser=%#1000)(sudoUser=%wheel)(sudoUser=%sudo)(sudoUser=%timemachine)(sudoUser=%#998)(sudoUser=%#1001)(sudoUser=%#1002)(sudoUser=ALL)))"
5fdcd802 conn=2741 op=2 SEARCH RESULT tag=101 err=32 nentries=0 text=
5fdcd802 conn=2741 op=3 SRCH base="ou=SUDOers,dc=ldap,dc=domain,dc=com" scope=2 deref=0 filter="(&(objectClass=sudoRole)(sudoUser=*)(sudoUser=+*))"
5fdcd802 conn=2741 op=3 SEARCH RESULT tag=101 err=32 nentries=0 text=
5fdcd805 conn=2741 fd=13 closed (connection lost)The funny part is is that if I walk through these searches by hand:
ldapsearch -D "cn=admin,dc=ldap,dc=domain,dc=com" -w **PASS** -b 'ou=SUDOers,dc=ldap,dc=domain,dc=com' -H ldap://openldap.domain.com "(&(objectClass=sudoRole)(cn=defaults))"
# extended LDIF
#
# LDAPv3
# base <ou=SUDOers,dc=ldap,dc=domain,dc=com> with scope subtree
# filter: (&(objectClass=sudoRole)(cn=defaults))
# requesting: ALL
#
# search result
search: 2
result: 0 Success
# numResponses: 1The above makes sense since I don't have any defaults defined
Next search:
#ldapsearch -D "cn=admin,dc=ldap,dc=domain,dc=com" -w **PASS** -b 'ou=SUDOers,dc=ldap,dc=domain,dc=com' -H ldap://openldap.domain.com "(&(objectClass=sudoRole)(|(sudoUser=kevdog)(sudoUser=#1000)(sudoUser=%kevdog)(sudoUser=%#1000)(sudoUser=%wheel)(sudoUser=%sudo)(sudoUser=%timemachine)(sudoUser=%#998)(sudoUser=%#1001)(sudoUser=%#1002)(sudoUser=ALL)))"
"
# extended LDIF
#
# LDAPv3
# base <ou=SUDOers,dc=ldap,dc=domain,dc=com> with scope subtree
# filter: (&(objectClass=sudoRole)(|(sudoUser=kevdog)(sudoUser=#1000)(sudoUser=%kevdog)(sudoUser=%#1000)(sudoUser=%wheel)(sudoUser=%sudo)(sudoUser=%timemachine)(sudoUser=%#998)(sudoUser=%#1001)(sudoUser=%#1002)(sudoUser=ALL)))
# requesting: ALL
#
# kevdog, SUDOers, ldap.domain.com
dn: cn=kevdog,ou=SUDOers,dc=ldap,dc=domain,dc=com
cn: kevdog
objectClass: sudoRole
objectClass: top
sudoCommand: ALL
sudoHost: ALL
sudoUser: kevdog
# %sudo, SUDOers, ldap.domain.com
dn: cn=%sudo,ou=SUDOers,dc=ldap,dc=domain,dc=com
cn: %sudo
objectClass: sudoRole
objectClass: top
sudoCommand: ALL
sudoHost: ALL
sudoUser: %sudo
# search result
search: 2
result: 0 Success
# numResponses: 3
# numEntries: 2And finally:
ldapsearch -D "cn=admin,dc=ldap,dc=domain,dc=com" -w **PASS* -b 'ou=SUDOers,dc=ldap,dc=domain,dc=com' -H ldap://openldap.domain.com "(&(objectClass=sudoRole)(sudoUser=*)(sudoUser=+*))"
# extended LDIF
#
# LDAPv3
# base <ou=SUDOers,dc=ldap,dc=domain,dc=com> with scope subtree
# filter: (&(objectClass=sudoRole)(sudoUser=*)(sudoUser=+*))
# requesting: ALL
#
# search result
search: 2
result: 0 Success
# numResponses: 1Which returns nothing...
Confused why things are not working -- I'm rather stumped!!!
Offline