Join Log in
Score:0
avatar Server

SSSD alternative for pam_authz_search option in nslcd

ca flag
Aleksandr Makhov

I have servers based on RHEL 7 and 8. RHEL 7 serevers use nslcd to work with a LDAP server, RHEL 8 use SSSD.

For RHEL 7 I can provide access for users to allowed hosts only. This functions is covered by the option in the nslcd.conf:

pam_authz_search        (&(objectClass=posixAccount)(uid=$uid)(|(host=$hostname.\*)(host=\\*)))

I use the option "host=$hostname.\* " for regular users who have list of allowed servers, "host=\\*" is used for admins who have * for the ldap host attribute.

SSSD has the option ldap_access_filter and with next sttings:

ldap_access_filter = (objectClass=posixAccount)

All users can log in to all RHEL 8 machine, what I want to avoid.

Is it possible to add host options to the ldap_access_filter as I have in the nslcd.conf on the old servers?

Thank you in advance.

UPD:

ldap_access_filter = (&(objectClass=posixAccount)(host=\*))

works for admins with * in the ldapsearch host attributes:

~$ ldapsearch -LLL -Q -Z uid=admin-user host
dn: uid=admin-user,ou=People,dc=my,dc=domain,dc=net
host: *

Also I can specify the server name directly:

ldap_access_filter = (&(objectClass=posixAccount)(host=servername.example.lan))

and it also works for users which have this server in the list:

~$ ldapsearch -LLL -Q -Z uid=a-testuser host
dn: uid=a-testuser,ou=People,dc=my,dc=domain,dc=net
host: servername.example.lan

But how can I use variables or special characters like * or \*?

40
0 + 0
pam
cn flag
natxo asenjo
I think the problem is that '*' is a presence filter, i.e., it checks if there is something in the attribute 'host'. This MS doc shows some info on escaping special characthers "https://social.technet.microsoft.com/wiki/contents/articles/5392.active-directory-ldap-syntax-filters.aspx#Special_Characters"
0
Reply
cn flag
natxo asenjo
using something like freeipa with its advanced rbac rules would make this trivial, by the way. I know, not the answer to your question, but maybe something you may be interested in using in the future for exactly this kind of things.
0
Reply
ธงชาติไทย
Elon Musk
I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.