diff options
| author | Alexander Bokovoy <abokovoy@redhat.com> | 2015-08-13 17:18:57 +0300 |
|---|---|---|
| committer | Martin Basti <mbasti@redhat.com> | 2015-08-18 18:48:12 +0200 |
| commit | 3692a1c57f5d404a61a01623ef732234ccbbdffd (patch) | |
| tree | d1c011cda58db5711e73fb1aa41c3654e792ca61 /install/updates | |
| parent | ff1e66375c8fd7ac036220b0f6d5cf206fa36a6a (diff) | |
| download | freeipa-3692a1c57f5d404a61a01623ef732234ccbbdffd.tar.gz freeipa-3692a1c57f5d404a61a01623ef732234ccbbdffd.tar.xz freeipa-3692a1c57f5d404a61a01623ef732234ccbbdffd.zip | |
trusts: harden trust-fetch-domains oddjobd-based script
When ipa-getkeytab is used to fetch trusted domain object credentials,
the fetched entry has always kvno 1. ipa-getkeytab always adds a key to
keytab which means older key versions will be in the SSSD keytab and
will confuse libkrb5 ccache initialization code as all kvno values are
equal to 1. Wrong key is picked up then and kinit fails.
To solve this problem, always remove existing
/var/lib/sss/keytabs/forest.keytab before retrieving a new one.
To make sure script's input cannot be used to define what should be
removed (by passing a relative path), make sure we retrieve trusted
forest name from LDAP. If it is not possible to retrieve, the script
will issue an exception and quit. If abrtd is running, this will be
recorded as a 'crash' and an attempt to use script by malicious user
would be recorded as well in the abrtd journal.
Additionally, as com.redhat.idm.trust-fetch-domains will create
ID ranges for the domains of the trusted forest if they don't exist,
it needs permissions to do so. The permission should be granted only
to cifs/ipa.master@IPA.REALM services which means they must have
krbprincipalname=cifs/*@IPA.REALM,cn=services,... DN and be members of
cn=adtrust agents,cn=sysaccounts,... group.
Solves https://bugzilla.redhat.com/show_bug.cgi?id=1250190
Ticket https://fedorahosted.org/freeipa/ticket/5182
Reviewed-By: Tomas Babej <tbabej@redhat.com>
Diffstat (limited to 'install/updates')
| -rw-r--r-- | install/updates/20-aci.update | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/install/updates/20-aci.update b/install/updates/20-aci.update index 0bdeeb6ac..cba1897e1 100644 --- a/install/updates/20-aci.update +++ b/install/updates/20-aci.update @@ -87,3 +87,7 @@ add:aci:(targetattr = "usercertificate")(version 3.0;acl "selfservice:Users can # Hosts can add their own services dn: cn=services,cn=accounts,$SUFFIX add:aci: (target = "ldap:///krbprincipalname=*/($$dn)@$REALM,cn=services,cn=accounts,$SUFFIX")(targetfilter = "(objectClass=ipaKrbPrincipal)")(version 3.0;acl "Hosts can add own services"; allow(add) userdn="ldap:///fqdn=($$dn),cn=computers,cn=accounts,$SUFFIX";) + +# CIFS service on the master can manage ID ranges +dn: cn=ranges,cn=etc,$SUFFIX +add:aci: (target = "ldap:///cn=*,cn=ranges,cn=etc,$SUFFIX")(targetfilter = "(objectClass=ipaIDrange)")(version 3.0;acl "CIFS service can manage ID ranges for trust"; allow(all) userdn="ldap:///krbprincipalname=cifs/*@$REALM,cn=services,cn=accounts,$SUFFIX" and groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,$SUFFIX";) |