<html><body><div style="color:#000; background-color:#fff; font-family:bookman old style, new york, times, serif;font-size:13px"><div style="color: rgb(0, 0, 0); font-family: bookman old style, new york, times, serif; font-size: 13px; background-color: rgb(255, 255, 255);"><span></span></div><div id="yui_3_16_0_1_1440014690352_2464" style="color: rgb(0, 0, 0); font-family: bookman old style, new york, times, serif; font-size: 13px; background-color: rgb(255, 255, 255);" dir="ltr">Thanks Bob, I have tried to implement this and cannot seem to get it to work for me even though it seems straightforward. I tried both with using a user.allow file and adding the netgroup to /etc/passwd as well as moving lines around in the pam.conf and many different versions of pam.conf but it results in either everyone being able to login or no one being able to login. Do you mind sharing your pam.conf with me?</div><div style="color: rgb(0, 0, 0); font-family: bookman old style, new york, times, serif; font-size: 13px; background-color: rgb(255, 255, 255);" dir="ltr"><br></div><div id="yui_3_16_0_1_1440014690352_2734" style="color: rgb(0, 0, 0); font-family: bookman old style, new york, times, serif; font-size: 13px; background-color: rgb(255, 255, 255);" dir="ltr">I have the following relevant entries in nsswitch.conf</div><div id="yui_3_16_0_1_1440014690352_2695" style="color: rgb(0, 0, 0); font-family: bookman old style, new york, times, serif; font-size: 13px; background-color: rgb(255, 255, 255);" dir="ltr"><br></div><div id="yui_3_16_0_1_1440014690352_2735" style="color: rgb(0, 0, 0); font-family: bookman old style, new york, times, serif; font-size: 13px; background-color: rgb(255, 255, 255);" dir="ltr">passwd: files ldap</div><div id="yui_3_16_0_1_1440014690352_2736" style="color: rgb(0, 0, 0); font-family: bookman old style, new york, times, serif; font-size: 13px; background-color: rgb(255, 255, 255);" dir="ltr">group: files ldap</div><div id="yui_3_16_0_1_1440014690352_2737" style="color: rgb(0, 0, 0); font-family: bookman old style, new york, times, serif; font-size: 13px; background-color: rgb(255, 255, 255);" dir="ltr">shadow: files ldap</div><div id="yui_3_16_0_1_1440014690352_2738" style="color: rgb(0, 0, 0); font-family: bookman old style, new york, times, serif; font-size: 13px; background-color: rgb(255, 255, 255);" dir="ltr">netgroup: ldap</div><div class="qtdSeparateBR"><br><br></div><div class="yiv5987593581yqt4800238898" id="yiv5987593581yqt63622" style="color: rgb(0, 0, 0); font-family: bookman old style, new york, times, serif; font-size: 13px; background-color: rgb(255, 255, 255);"><div id="yui_3_16_0_1_1440014690352_2474" style="font-family: bookman old style, new york, times, serif; font-size: 13px;"> <div id="yui_3_16_0_1_1440014690352_2473" style="font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif; font-size: 16px;"> <div id="yui_3_16_0_1_1440014690352_2475" dir="ltr"> <hr size="1" id="yui_3_16_0_1_1440014690352_2557"> <font id="yui_3_16_0_1_1440014690352_2518" face="Arial" size="2"> <b><span style="font-weight: bold;">From:</span></b> Bob <harvero@gmail.com><br clear="none"> <b><span style="font-weight: bold;">To:</span></b> Natxo Asenjo <natxo.asenjo@gmail.com> <br clear="none"><b><span style="font-weight: bold;">Cc:</span></b> Freeipa-users <freeipa-users@redhat.com> <br clear="none"> <b><span style="font-weight: bold;">Sent:</span></b> Saturday, August 15, 2015 10:46 AM<br clear="none"> <b><span style="font-weight: bold;">Subject:</span></b> Re: [Freeipa-users] HBAC rules not applying to Solaris clients<br clear="none"> </font> </div> <div class="yiv5987593581y_msg_container" id="yui_3_16_0_1_1440014690352_2472"><br clear="none"><div id="yiv5987593581"><div id="yui_3_16_0_1_1440014690352_2471"><div id="yui_3_16_0_1_1440014690352_2517" dir="ltr"><div id="yui_3_16_0_1_1440014690352_2516"><br clear="none"></div>For Solaris we are using the pam_list module to control which LDAP users can have system access. The pam_list module allow netgroups to be listed in a user.allow file. <br clear="none"></div><div class="yiv5987593581gmail_extra" id="yui_3_16_0_1_1440014690352_2470"><br clear="none"><div class="yiv5987593581gmail_quote" id="yui_3_16_0_1_1440014690352_2469">On Sat, Aug 15, 2015 at 1:05 PM, Natxo Asenjo <span dir="ltr"><<a href="mailto:natxo.asenjo@gmail.com" target="_blank" rel="nofollow" shape="rect" ymailto="mailto:natxo.asenjo@gmail.com">natxo.asenjo@gmail.com</a>></span> wrote:<br clear="none"><blockquote class="yiv5987593581gmail_quote" id="yui_3_16_0_1_1440014690352_2468" style="margin: 0px 0px 0px 0.8ex; padding-left: 1ex; border-left-color: rgb(204, 204, 204); border-left-width: 1px; border-left-style: solid;"><div class="yiv5987593581qtdSeparateBR" id="yui_3_16_0_1_1440014690352_2467"><br clear="none"><br clear="none"></div><div class="yiv5987593581yqt9246187485" id="yiv5987593581yqt55468"><div id="yui_3_16_0_1_1440014690352_2825" dir="ltr"><br clear="none"><div class="yiv5987593581gmail_extra" id="yui_3_16_0_1_1440014690352_2826"><br clear="none"><div class="yiv5987593581gmail_quote" id="yui_3_16_0_1_1440014690352_2827">On Sat, Aug 15, 2015 at 5:24 PM, Rob Crittenden <span dir="ltr"><<a href="mailto:rcritten@redhat.com" target="_blank" rel="nofollow" shape="rect" ymailto="mailto:rcritten@redhat.com">rcritten@redhat.com</a>></span> wrote:<br clear="none"><blockquote class="yiv5987593581gmail_quote" id="yui_3_16_0_1_1440014690352_2828" style="margin: 0px 0px 0px 0.8ex; padding-left: 1ex; border-left-color: rgb(204, 204, 204); border-left-width: 1px; border-left-style: solid;">sipazzo wrote:<br clear="none">
<blockquote class="yiv5987593581gmail_quote" id="yui_3_16_0_1_1440014690352_2829" style="margin: 0px 0px 0px 0.8ex; padding-left: 1ex; border-left-color: rgb(204, 204, 204); border-left-width: 1px; border-left-style: solid;">
<br clear="none">
and my users are able to authenticate to the directory but the hbac<br clear="none">
rules are not being applied. Any user whether given access or not can<br clear="none">
login to the Solaris systems. The "allow-all" rule has been disabled, my<br clear="none">
nsswitch.conf file looks good and I have tried different configs of<br clear="none">
pam.d, including the provided example to try to resolve the issue. Am I<br clear="none">
missing some steps?<br clear="none">
</blockquote>
<br clear="none">
HBAC enforcement is provided by sssd so doesn't work in Solaris.<span><font color="#888888"></font></span><br clear="all"></blockquote></div><br clear="none"></div><div class="yiv5987593581gmail_extra">one might try using solaris' RBAC system:<br clear="none"><br clear="none"><a href="http://www.oracle.com/technetwork/systems/security/custom-roles-rbac-jsp-140865.html" target="_blank" rel="nofollow" shape="rect">http://www.oracle.com/technetwork/systems/security/custom-roles-rbac-jsp-140865.html</a><br clear="none"><br clear="none"></div><div class="yiv5987593581gmail_extra">You would have to distribute your changes to all solaris systems.<br clear="none"><br clear="none"></div><div class="yiv5987593581gmail_extra">There is a RBAC ldap schema <a href="http://docs.oracle.com/cd/E19455-01/806-5580/6jej518q5/index.html" target="_blank" rel="nofollow" shape="rect">http://docs.oracle.com/cd/E19455-01/806-5580/6jej518q5/index.html</a> for solaris, but I have never tried using it with freeipa. <br clear="none"></div><div class="yiv5987593581gmail_extra"><br clear="none"><div>--<br clear="none">Groeten,<br clear="none">natxo</div>
</div></div></div>
<br clear="none">--<br clear="none">
Manage your subscription for the Freeipa-users mailing list:<br clear="none">
<a href="https://www.redhat.com/mailman/listinfo/freeipa-users" target="_blank" rel="nofollow" shape="rect">https://www.redhat.com/mailman/listinfo/freeipa-users</a><br clear="none">
Go to <a href="http://freeipa.org/" target="_blank" rel="nofollow" shape="rect">http://freeipa.org</a> for more info on the project<br clear="none"></blockquote></div><br clear="none"></div></div></div><br clear="none"><div class="yiv5987593581yqt9246187485" id="yiv5987593581yqt02446">-- <br clear="none">Manage your subscription for the Freeipa-users mailing list:<br clear="none"><a href="https://www.redhat.com/mailman/listinfo/freeipa-users" target="_blank" rel="nofollow" shape="rect">https://www.redhat.com/mailman/listinfo/freeipa-users</a><br clear="none">Go to <a href="http://freeipa.org/" target="_blank" rel="nofollow" shape="rect">http://freeipa.org </a>for more info on the project</div><br clear="none"><br clear="none"></div> </div> </div></div><div style="color: rgb(0, 0, 0); font-family: bookman old style, new york, times, serif; font-size: 13px; background-color: rgb(255, 255, 255);"> </div></div></body></html>