<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
On 07/10/2013 08:34 PM, KodaK wrote:
<blockquote
cite="mid:CAA9J0ZF32PgS9Sob1Q3EpWQExOOyj6KrbQcTxvgTG5SvW7xuJg@mail.gmail.com"
type="cite"><br>
<br>
<div class="gmail_quote">On Wed, Jul 10, 2013 at 5:00 PM, natxo
asenjo <span dir="ltr"><<a moz-do-not-send="true"
href="mailto:natxo.asenjo@gmail.com" target="_blank">natxo.asenjo@gmail.com</a>></span>
wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0
.8ex;border-left:1px #ccc solid;padding-left:1ex">
<div class="im">On 07/08/2013 07:44 PM, KodaK wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0
.8ex;border-left:1px #ccc solid;padding-left:1ex">
We've just discovered that AIX does not honor HBAC rules
with telnet.<br>
ssh is fine.<br>
</blockquote>
<br>
</div>
no AIX expericence, but I once overheard someone that did
something like<br>
this using pam and apparently you could use the pam_permission
module:<br>
<br>
<a moz-do-not-send="true"
href="http://pic.dhe.ibm.com/infocenter/aix/v6r1/index.jsp?topic=%2Fcom.ibm.aix.files%2Fdoc%2Faixfiles%2Fpam_permission.htm"
target="_blank">http://pic.dhe.ibm.com/infocenter/aix/v6r1/index.jsp?topic=%2Fcom.ibm.aix.files%2Fdoc%2Faixfiles%2Fpam_permission.htm</a><br>
<br>
so you could add this to /etc/pam.conf<br>
<br>
telnet auth requisite /usr/lib/security/pam_permission
file=/etc/pam.groups.telnet found=allow<br>
<br>
and create the file /etc/pam.groups.telnet with info like
this:<br>
<br>
+@mygroup1<br>
+@mygroup2<br>
-@mygroup3<br>
<br>
in this case mygroup1 and mygroup2 may telnet, whereas
mygroup3 is<br>
denied access.<br>
<br>
You could even harden it even more with good old tcp_wrappers<br>
(hosts.allow, hosts.deny).<br>
<br>
If you have a config tool (cfengine, puppet, whatever), this
could be<br>
quite easy to distribute once properly tested.<br>
<br>
Totally untested :-) but maybe worth a shot.<br>
</blockquote>
<div><br>
</div>
<div>Thanks. I'm stuck though.</div>
<div><br>
</div>
<div>IBMs insistence on doing everything Not Unix in AIX is
frustrating my efforts.</div>
<div><br>
</div>
<div>1) they don't use straight up PAM. They have some older
version they include with the OS.</div>
<div>2) their version has very few modules that come with it.
It does, however, have pam_permissions,</div>
<div> but does not include pam_krb5.</div>
<div><br>
</div>
<div>Here's the list:</div>
<div><br>
</div>
<div>
<div>pam_aix pam_allowroot pam_mkuserhome
pam_prohibit</div>
<div>pam_allow pam_ckfile pam_permission
pam_rhosts_auth</div>
</div>
<div><br>
</div>
<div>That's a far cry from the 69 or so pam modules I see on
Linux boxes.</div>
<div><br>
</div>
<div>Before I can move on I have to get pam_krb5 to build for
AIX and that's proving to be very difficult.</div>
<div><br>
</div>
<div>I'm hoping the pam_hbac thing will pan out.</div>
<div><br>
</div>
<div>I'm about ready to just yank Kerberos from the AIX machines
and fall back to local authentication.</div>
<div>The actual AIX admins seem to have no interest in helping
me, so they can reap what they</div>
<div>sow with their inaction and have to manage individual users
on individual boxes.</div>
</div>
</blockquote>
<br>
How complex are your HBAC rules? Are they very dynamic or pretty
static? We might be able to tackle it from that side and come with
something custom that would work for your case but not in general. <br>
I think PWT mail for the real data would be appropriate. <br>
<br>
<blockquote
cite="mid:CAA9J0ZF32PgS9Sob1Q3EpWQExOOyj6KrbQcTxvgTG5SvW7xuJg@mail.gmail.com"
type="cite">
<div class="gmail_quote">
<div><br>
</div>
</div>
-- <br>
The government is going to read our mail anyway, might as well
make it tough for them. GPG Public key ID: B6A1A7C6
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
Freeipa-users mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Freeipa-users@redhat.com">Freeipa-users@redhat.com</a>
<a class="moz-txt-link-freetext" href="https://www.redhat.com/mailman/listinfo/freeipa-users">https://www.redhat.com/mailman/listinfo/freeipa-users</a></pre>
</blockquote>
<br>
<br>
<pre class="moz-signature" cols="72">--
Thank you,
Dmitri Pal
Sr. Engineering Manager for IdM portfolio
Red Hat Inc.
-------------------------------
Looking to carve out IT costs?
<a class="moz-txt-link-abbreviated" href="http://www.redhat.com/carveoutcosts/">www.redhat.com/carveoutcosts/</a>
</pre>
</body>
</html>