Plase add pam_sss config

[joakim-tjernlund]

sssd, https://github.com/SSSD/sssd, has a pam_sss.so module needed for login when using sssd as login service

[Zlogene]

@joakim-tjernlund do you have something working in your local stack to include? I have no sssd anymore, so can not test the module

[joakim-tjernlund]

We use this

auth		required	pam_env.so
auth		sufficient	pam_unix.so try_first_pass likeauth nullok
auth		required	pam_sss.so forward_pass use_first_pass
#auth		required	pam_winbind.so use_first_pass

account		sufficient	pam_unix.so
account		required	pam_sss.so forward_pass
#account	required	pam_winbind.so use_first_pass

password	sufficient	pam_unix.so sha512 shadow
password	required	pam_krb5.so minimun_uid=1000

session		required	pam_limits.so
session		required	pam_mkhomedir.so umask=0077
session		required	pam_env.so
session		required	pam_unix.so
session		optional	pam_sss.so forward_pass
-session        optional        pam_elogind.so
#session	optional	pam_winbind.so

[Dessa]

@joakim-tjernlund you have a typo in password section: "minimun"

i can't get it to work with faillock. closest i got was getting a failure in pam_unix and a success in pam_sss (in the same login)

for now i ended up using fedoras system-auth which also has password sufficient pam_sss.so use_authtok

i need to dive a little bit deeper with this then what i have done so far...

[joakim-tjernlund]

sure, the passwd I haven't played much with so I am not sure what to have there

[razamatan]

actually.. i just realized i had to tweak what was in the wiki. what i have currently is (sssd-2.4.0, pambase-20201103):

auth            required        pam_env.so
auth            sufficient      pam_ssh.so try_first_pass
auth            requisite       pam_faillock.so preauth
auth            sufficient      pam_sss.so try_first_pass
auth            [success=1 default=ignore]      pam_unix.so nullok  try_first_pass
auth            [default=die]   pam_faillock.so authfail
auth            optional        pam_permit.so
-auth           optional        pam_cap.so

account         required        pam_unix.so 
account         [default=bad success=ok user_unknown=ignore]    pam_sss.so
account         required        pam_faillock.so
account         optional        pam_permit.so

password        required        pam_passwdqc.so config=/etc/security/passwdqc.conf
password        required        pam_unix.so try_first_pass use_authtok nullok sha512 shadow
password        sufficient      pam_sss.so use_authtok
password        optional        pam_permit.so

session         optional        pam_ssh.so
session         required        pam_limits.so
session         required        pam_env.so
session         required        pam_unix.so
session         optional        pam_sss.so
session         optional        pam_permit.so
-session        optional        pam_elogind.so

[Zlogene]

@razamatan looks better than previous ones, but:
1.) auth sufficient pam_ssh.so try_first_pass does stack really hands over pass from some other module?
2.) auth sufficient pam_sss.so try_first_pass no password processing happens here in auth

[Dessa]

pam_ssh should probably also not be part of this, it probably works together, sure, but its its own thing.

[razamatan]

yep. the ssh stuff comes in via the template if the ssh use flag is set. mine is, so that's why my config has it.

…

________________________________ From: Dessa <notifications@github.com> Sent: Saturday, November 14, 2020 7:08 AM To: gentoo/pambase <pambase@noreply.github.com> Cc: razamatan <razamatan@hotmail.com>; Mention <mention@noreply.github.com> Subject: Re: [gentoo/pambase] Plase add pam_sss config (#1) pam_ssh should probably also not be part of this, it probably works together, sure, but its its own thing. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub<#1 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/AAD53TYG77AEQWW7ZNJZEHTSP2MP7ANCNFSM4PZFLVIQ>.

[alexxy]

I use this

auth            required        pam_env.so 
auth            sufficient      pam_unix.so try_first_pass likeauth nullok
auth            sufficient      pam_sss.so use_first_pass
auth            required        pam_deny.so

account         required        pam_unix.so
account         sufficient      pam_localuser.so
account         [default=bad success=ok user_unknown=ignore] pam_sss.so
account         required        pam_permit.so

password        required        pam_cracklib.so difok=2 minlen=8 dcredit=2 ocredit=2 retry=3 
password        sufficient      pam_unix.so try_first_pass use_authtok nullok sha512 shadow 
password        sufficient      pam_sss.so use_authtok
password        required        pam_deny.so

session         required        pam_mkhomedir.so skel=/etc/skel/ umask=0077
session         optional        pam_keyinit.so revoke
session         required        pam_limits.so
session         required        pam_env.so
session         [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session         required        pam_unix.so
session         optional        pam_sss.so
session         optional        pam_permit.so
-session        optional        pam_elogind.so

[razamatan]

@razamatan looks better than previous ones, but:
1.) auth sufficient pam_ssh.so try_first_pass does stack really hands over pass from some other module?
2.) auth sufficient pam_sss.so try_first_pass no password processing happens here in auth

1. yep. i removed try_first_pass and things continued to work
2. can you explain where i should put pam_sss.so then? i'm not an expert in pam. i thought sss needed to live before pam_unix to have an effect.

[razamatan]

ok.. answered my own question by playing around. this is my current config that seems to be working fully:

auth            required        pam_env.so
auth            sufficient      pam_sss.so
auth            requisite       pam_faillock.so preauth
auth            [success=1 default=ignore]      pam_unix.so nullok try_first_pass
auth            [default=die]   pam_faillock.so authfail
auth            optional        pam_permit.so
-auth           optional        pam_cap.so

account         required        pam_unix.so 
account         [default=bad success=ok user_unknown=ignore]    pam_sss.so
account         required        pam_faillock.so
account         optional        pam_permit.so

password        required        pam_passwdqc.so config=/etc/security/passwdqc.conf
password        required        pam_unix.so try_first_pass use_authtok nullok sha512 shadow
password        sufficient      pam_sss.so use_authtok
password        optional        pam_permit.so

session         required        pam_limits.so
session         required        pam_env.so
session         required        pam_unix.so
session         optional        pam_sss.so
session         optional        pam_permit.so
-session        optional        pam_elogind.so