Add a skeleton kdcpolicy plugin #2147

frozencemetery · 2018-07-12T15:29:56Z

Signed-off-by: Robbie Harwood rharwood@redhat.com

Back in krb5-1.16 (and in RHEL-7.5), I added the kdcpolicy plugin to krb5. This interface allows a module to hook all AS and TGS requests, potentially reject them, and manipulate ticket lifetimes. This PR is a basic implementation of the interface, with all the plumbing IPA needs to get it loaded and installed.

There are ~~two~~ three use cases I had in mind, though of course many more are possible (this is a very powerful place to have a hook into the KDC):

Reduced ticket lifetimes based on auth indicator
Adding (well, subtracting) random jitter from certain principal lifetimes to reduce contention from groups of tickets all needing renewal simultaneously
Time-based access control to hosts/services

Since presumably we don't want any of that to be hardcoded behavior, the difficult part is now making it all configurable. (As well as figuring out any behavior we want to control at the moment). Per IRC conversation, I'm opening this PR so that we have something to look at while we discuss that.

BACKPORT NOTE: there's a spec file change in this PR.

frozencemetery · 2018-07-12T16:19:39Z

(I don't think the CI failures are caused by this change, but please correct me if that's wrong.)

tiran · 2018-07-16T07:28:02Z

CI is failing because named and a DNS helpe are having issues with GSSAPI:

Jul 13 12:23:25 master.ipa.test named-pkcs11[20556]: set up managed keys zone for view _default, file '/var/named/dynamic/managed-keys.bind'
Jul 13 12:23:25 master.ipa.test named-pkcs11[20556]: loading DynDB instance 'ipa' driver '/usr/lib64/bind/ldap.so'
Jul 13 12:23:25 master.ipa.test named-pkcs11[20556]: bind-dyndb-ldap version 11.1 compiled at 08:40:39 Mar  2 2018, compiler 8.0.1 20180222 (Red Hat 8.0.1-0.16)
Jul 13 12:23:25 master.ipa.test named-pkcs11[20556]: GSSAPI client step 1
Jul 13 12:23:25 master.ipa.test named-pkcs11[20556]: GSSAPI client step 1
Jul 13 12:23:25 master.ipa.test named-pkcs11[20556]: GSSAPI Error: Unspecified GSS failure.  Minor code may provide more information (Ticket expired)
Jul 13 12:23:25 master.ipa.test named-pkcs11[20556]: LDAP error: Local error: SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure.  Minor code may provide more information (Ticket expired): bind to LDAP server failed
Jul 13 12:23:25 master.ipa.test named-pkcs11[20556]: couldn't establish connection in LDAP connection pool: failure
Jul 13 12:23:25 master.ipa.test named-pkcs11[20556]: dynamic database 'ipa' configuration failed: failure
Jul 13 12:23:25 master.ipa.test named-pkcs11[20556]: loading configuration: failure
Jul 13 12:23:25 master.ipa.test named-pkcs11[20556]: exiting (due to fatal error)
Jul 13 12:23:25 master.ipa.test systemd[1]: named-pkcs11.service: Control process exited, code=exited status=1
Jul 13 12:23:25 master.ipa.test systemd[1]: named-pkcs11.service: Failed with result 'exit-code'.
Jul 13 12:23:25 master.ipa.test systemd[1]: Failed to start Berkeley Internet Name Domain (DNS) with native PKCS#11.
Jul 13 12:23:25 master.ipa.test audit[1]: SERVICE_START pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=named-pkcs11 comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=failed'
Jul 13 12:23:26 master.ipa.test ldappasswd[20562]: DIGEST-MD5 common mech free
Jul 13 12:23:27 master.ipa.test audit[20546]: AVC avc:  denied  { getattr } for  pid=20546 comm="ipa-dnskeysyncd" path="/usr/lib/systemd/system/fedora-domainname.service" dev="vda1" ino=400526 scontext=system_u:system_r:ipa_dnskey_t:s0 tcontext=system_u:object_r:systemd_unit_file_t:s0 tclass=file permissive=1
Jul 13 12:23:30 master.ipa.test audit[20301]: AVC avc:  denied  { getattr } for  pid=20301 comm="httpd" path="/usr/lib/systemd/system/fedora-domainname.service" dev="vda1" ino=400526 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:systemd_unit_file_t:s0 tclass=file permissive=1
Jul 13 12:23:31 master.ipa.test ipa-dnskeysyncd[20546]: ipa-dnskeysyncd: INFO     LDAP bind...
Jul 13 12:23:31 master.ipa.test python3[20546]: GSSAPI client step 1
Jul 13 12:23:31 master.ipa.test python3[20546]: GSSAPI client step 1
Jul 13 12:23:31 master.ipa.test python3[20546]: GSSAPI Error: Unspecified GSS failure.  Minor code may provide more information (Ticket expired)
Jul 13 12:23:31 master.ipa.test ipa-dnskeysyncd[20546]: Traceback (most recent call last):
Jul 13 12:23:31 master.ipa.test ipa-dnskeysyncd[20546]:   File "/usr/libexec/ipa/ipa-dnskeysyncd", line 96, in <module>
Jul 13 12:23:31 master.ipa.test ipa-dnskeysyncd[20546]:     ldap_connection.sasl_interactive_bind_s("", ipaldap.SASL_GSSAPI)
Jul 13 12:23:31 master.ipa.test ipa-dnskeysyncd[20546]:   File "/usr/lib64/python3.6/site-packages/ldap/ldapobject.py", line 1228, in sasl_interactive_bind_s
Jul 13 12:23:31 master.ipa.test ipa-dnskeysyncd[20546]:     res = self._apply_method_s(SimpleLDAPObject.sasl_interactive_bind_s,*args,**kwargs)
Jul 13 12:23:31 master.ipa.test ipa-dnskeysyncd[20546]:   File "/usr/lib64/python3.6/site-packages/ldap/ldapobject.py", line 1197, in _apply_method_s
Jul 13 12:23:31 master.ipa.test ipa-dnskeysyncd[20546]:     return func(self,*args,**kwargs)
Jul 13 12:23:31 master.ipa.test ipa-dnskeysyncd[20546]:   File "/usr/lib64/python3.6/site-packages/ldap/ldapobject.py", line 465, in sasl_interactive_bind_s
Jul 13 12:23:31 master.ipa.test ipa-dnskeysyncd[20546]:     return self._ldap_call(self._l.sasl_interactive_bind_s,who,auth,RequestControlTuples(serverctrls),RequestControlTuples(clientctrls),sasl_flags)
Jul 13 12:23:31 master.ipa.test ipa-dnskeysyncd[20546]:   File "/usr/lib64/python3.6/site-packages/ldap/ldapobject.py", line 329, in _ldap_call
Jul 13 12:23:31 master.ipa.test ipa-dnskeysyncd[20546]:     reraise(exc_type, exc_value, exc_traceback)
Jul 13 12:23:31 master.ipa.test ipa-dnskeysyncd[20546]:   File "/usr/lib64/python3.6/site-packages/ldap/compat.py", line 44, in reraise
Jul 13 12:23:31 master.ipa.test ipa-dnskeysyncd[20546]:     raise exc_value
Jul 13 12:23:31 master.ipa.test ipa-dnskeysyncd[20546]:   File "/usr/lib64/python3.6/site-packages/ldap/ldapobject.py", line 313, in _ldap_call
Jul 13 12:23:31 master.ipa.test ipa-dnskeysyncd[20546]:     result = func(*args,**kwargs)
Jul 13 12:23:31 master.ipa.test ipa-dnskeysyncd[20546]: ldap.LOCAL_ERROR: {'desc': 'Local error', 'info': 'SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure.  Minor code may provide more information (Ticket expired)'}
Jul 13 12:23:31 master.ipa.test systemd[1]: ipa-dnskeysyncd.service: Main process exited, code=exited, status=1/FAILURE
Jul 13 12:23:31 master.ipa.test systemd[1]: ipa-dnskeysyncd.service: Failed with result 'exit-code'.
``

frozencemetery · 2018-07-17T15:05:09Z

Fixed CI. Thanks for pointing me at the failure.

tiran · 2018-07-17T15:13:51Z

You are using augeas to modify krb5 configuration. AFAIK we decided against augeas because augeas cannot handle all edge cases of krb5.conf.

frozencemetery · 2018-07-17T20:36:56Z

This is how the certauth plugin gets set up. I'm happy to move that as well, if you like. It makes sense to me to put this in a snippet in krb5.conf.d.

Problem is, there's no hook that I can see right now that upgrades clients. Conceptually, these plugins are "server stuff" (though that lives in krb5.conf because not all plugins are server plugins). While I can work around this for the server plugins, it means that the /etc/krb5.conf.d/freeipa file doesn't get updated (which means SPAKE doesn't get enabled on IPA client upgrade).

Suggestions?

frozencemetery · 2018-07-20T20:29:28Z

Answering my own question. First commit makes it so that the snippet is re-written on update. Second commit is the kdcpolicy plugin, now using the snippet. Third commit moves the certauth plugin into the snippet by analogy. @tiran, ready for review (assuming it passes CI).

frozencemetery · 2018-07-23T19:16:53Z

test_forced_client_enrolment appears to be a DNF failure? I guess you already know I have a lot of trouble figuring out what went wrong in the CI. I can't see any logs for test_advise or replica_promotion.

rcritten · 2018-08-16T18:29:00Z

client/share/freeipa.template

+    certauth = {
+        module = ipakdb:kdb/ipadb.so
+        enable_only = ipakdb
+    }


Isn't ipadb.so only shipped in servers now?

Yes, ipadb.so is only available in ipa-server package. Please move the snippet to a server specific template.

daemons/ipa-kdb/ipa_kdb_kdcpolicy.c

rcritten · 2018-08-16T18:33:20Z

freeipa.spec.in

@@ -1241,10 +1241,12 @@ if [ $1 -gt 1 ] ; then
            cp /etc/ipa/ca.crt /var/lib/ipa-client/pki/kdc-ca-bundle.pem
            cp /etc/ipa/ca.crt /var/lib/ipa-client/pki/ca-bundle.pem
        fi
+
+        %{python} -c 'from ipaclient.install.client import configure_krb5_snippet; configure_krb5_snippet()' >>/var/log/ipaupgrade.log 2>&1
    fi


We might want/need an ipa-client-upgrade script to do this instead, if at least for other distros (perhaps outside the scope of this PR).

That was my thought as well. We'd probably want to include the cert stuff above it if we ever make such a tool.

rcritten · 2018-08-16T18:34:10Z

How/where would policy eventually be defined, or is that out-of-scope of this PR?

frozencemetery · 2018-08-20T15:28:09Z

That's sort of the question I was hoping having code in hand would answer.

I assume configuration of this kind has to live in LDAP? I don't know where though. We also will need an interface to modify it.

rcritten · 2018-08-20T15:47:39Z

Right, it's sort of a chicken-and-egg problem I guess but there seems to be lack of context around this. It should probably be included as part of some initiative to actually include policy in the server.

This PR would add a bunch of configuration, running code, etc to a new install that effectively is a no-op (hopefully). I just don't know where/how to land this as-is.

tiran

Please address the comment and rebase the PR.

tiran · 2019-04-02T11:58:59Z

client/share/freeipa.template

+    certauth = {
+        module = ipakdb:kdb/ipadb.so
+        enable_only = ipakdb
+    }


Yes, ipadb.so is only available in ipa-server package. Please move the snippet to a server specific template.

Signed-off-by: Robbie Harwood <rharwood@redhat.com>

frozencemetery · 2019-04-11T22:14:30Z

Updated and rebased. (Note that it's not technically an issue to have such configuration on the client, but you're right it's cleaner this way.)

tiran · 2019-04-12T06:37:57Z

Installation is failing with

2019-04-11T22:37:29Z DEBUG Traceback (most recent call last):
  File "/usr/lib/python3.7/site-packages/ipaserver/install/service.py", line 603, in start_creation
    run_step(full_msg, method)
  File "/usr/lib/python3.7/site-packages/ipaserver/install/service.py", line 589, in run_step
    method()
  File "/usr/lib/python3.7/site-packages/ipaserver/install/krbinstance.py", line 351, in __configure_instance
    self.__template_file(paths.KRB5_FREEIPA_SERVER)
  File "/usr/lib/python3.7/site-packages/ipaserver/install/krbinstance.py", line 321, in __template_file
    conf = ipautil.template_file(template, self.sub_dict)
  File "/usr/lib/python3.7/site-packages/ipapython/ipautil.py", line 318, in template_file
    with open(infilename) as f:
FileNotFoundError: [Errno 2] No such file or directory: '/usr/share/ipa/freeipa-server.template'

tiran · 2019-04-12T06:39:46Z

install/share/freeipa-server.template

@@ -0,0 +1,9 @@
+[plugins]


The build system doesn't pick up new files automatically. You have to add this file to Makefile.am and maybe freeipa.spec.in

Signed-off-by: Robbie Harwood <rharwood@redhat.com>

frozencemetery · 2019-08-19T18:08:18Z

Closing this to avoid confusion since it's been subsumed by #3358.

tiran added the re-run Trigger a new run of PR-CI label Jul 13, 2018

freeipa-pr-ci removed the re-run Trigger a new run of PR-CI label Jul 13, 2018

frozencemetery force-pushed the kdcpolicy branch from 2255363 to 6c43ae4 Compare July 16, 2018 16:50

frozencemetery force-pushed the kdcpolicy branch 2 times, most recently from fb34a1b to 04ddf96 Compare July 20, 2018 20:27

frozencemetery force-pushed the kdcpolicy branch from 04ddf96 to 1cf0bca Compare July 23, 2018 17:08

netoarmando added the re-run Trigger a new run of PR-CI label Aug 6, 2018

freeipa-pr-ci removed the re-run Trigger a new run of PR-CI label Aug 6, 2018

rcritten added the re-run Trigger a new run of PR-CI label Aug 16, 2018

freeipa-pr-ci removed the re-run Trigger a new run of PR-CI label Aug 16, 2018

rcritten reviewed Aug 16, 2018

View reviewed changes

daemons/ipa-kdb/ipa_kdb_kdcpolicy.c Show resolved Hide resolved

rcritten reviewed Aug 16, 2018

View reviewed changes

daemons/ipa-kdb/ipa_kdb_kdcpolicy.c Show resolved Hide resolved

rcritten reviewed Aug 16, 2018

View reviewed changes

frozencemetery force-pushed the kdcpolicy branch from 1cf0bca to fe12c7a Compare August 17, 2018 16:34

freeipa-pr-ci added needs rebase Pull Request cannot be automatically merged - needs to be rebased labels Sep 6, 2018

tiran requested changes Apr 2, 2019

View reviewed changes

Enable krb5 snippet updates on client update

f037392

Signed-off-by: Robbie Harwood <rharwood@redhat.com>

frozencemetery force-pushed the kdcpolicy branch from fe12c7a to 25d6c8e Compare April 11, 2019 22:13

tiran requested changes Apr 12, 2019

View reviewed changes

tiran added ipa-next Mark as master (4.13) only needs review Pull Request is waiting for a review and removed needs rebase Pull Request cannot be automatically merged - needs to be rebased labels Apr 12, 2019

frozencemetery added 2 commits April 12, 2019 15:48

Move certauth configuration into a server krb5.conf template

fbcb90c

Signed-off-by: Robbie Harwood <rharwood@redhat.com>

Add a skeleton kdcpolicy plugin

cdb8521

Signed-off-by: Robbie Harwood <rharwood@redhat.com>

frozencemetery force-pushed the kdcpolicy branch from 25d6c8e to cdb8521 Compare April 12, 2019 19:48

simo5 mentioned this pull request Jul 31, 2019

Added new authentication indicators #3358

Closed

frozencemetery closed this Aug 19, 2019

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add a skeleton kdcpolicy plugin #2147

Add a skeleton kdcpolicy plugin #2147

frozencemetery commented Jul 12, 2018 •

edited

Loading

frozencemetery commented Jul 12, 2018

tiran commented Jul 16, 2018

frozencemetery commented Jul 17, 2018

tiran commented Jul 17, 2018

frozencemetery commented Jul 17, 2018

frozencemetery commented Jul 20, 2018

frozencemetery commented Jul 23, 2018

rcritten Aug 16, 2018

tiran Apr 2, 2019

rcritten Aug 16, 2018

frozencemetery Aug 17, 2018

rcritten commented Aug 16, 2018

frozencemetery commented Aug 20, 2018

rcritten commented Aug 20, 2018

tiran left a comment

tiran Apr 2, 2019

frozencemetery commented Apr 11, 2019

tiran commented Apr 12, 2019

tiran Apr 12, 2019

frozencemetery commented Aug 19, 2019

Add a skeleton kdcpolicy plugin #2147

Add a skeleton kdcpolicy plugin #2147

Conversation

frozencemetery commented Jul 12, 2018 • edited Loading

frozencemetery commented Jul 12, 2018

tiran commented Jul 16, 2018

frozencemetery commented Jul 17, 2018

tiran commented Jul 17, 2018

frozencemetery commented Jul 17, 2018

frozencemetery commented Jul 20, 2018

frozencemetery commented Jul 23, 2018

rcritten Aug 16, 2018

Choose a reason for hiding this comment

tiran Apr 2, 2019

Choose a reason for hiding this comment

rcritten Aug 16, 2018

Choose a reason for hiding this comment

frozencemetery Aug 17, 2018

Choose a reason for hiding this comment

rcritten commented Aug 16, 2018

frozencemetery commented Aug 20, 2018

rcritten commented Aug 20, 2018

tiran left a comment

Choose a reason for hiding this comment

tiran Apr 2, 2019

Choose a reason for hiding this comment

frozencemetery commented Apr 11, 2019

tiran commented Apr 12, 2019

tiran Apr 12, 2019

Choose a reason for hiding this comment

frozencemetery commented Aug 19, 2019

frozencemetery commented Jul 12, 2018 •

edited

Loading