<html> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <meta name="Title" content=""> <meta name="Keywords" content=""> <meta name="ProgId" content="Word.Document"> <meta name="Generator" content="Microsoft Word 14"> <meta name="Originator" content="Microsoft Word 14"> <link rel="File-List" href="file://localhost/Users/jstormsh/Library/Caches/TemporaryItems/msoclip/0/clip_filelist.xml"><link rel="themeData" href="file://localhost/Users/jstormsh/Library/Caches/TemporaryItems/msoclip/0/clip_themedata.xml"><style>  </style> </head> <body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"> <div> <div style="color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif;"> Jakub/Rob -</div> <div style="color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif;"> Thanks for the feedback. I was finally able to ditch the ‘binddn’ and was able to get SSL working upon upgrading the OpenSSL from the 5.5 base to the one supplied in 5.7 base. The SSL is fully authenticating and with sudo access. However, I’m riddled by the following item below. I’m hoping that someone/somewhere encountered this issue and was able to resolve it using this legacy 5.5. See details provided below. All thoughts/suggestions are truly appreciated !!</div> <div> <div> <p class="MsoNormal" style="color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); font-size: 11pt; font-family: Calibri, sans-serif; margin: 0in 0in 0.0001pt;"> <b><span style="font-size: 10pt; font-family: 'Palatino Linotype', serif; color: rgb(31, 73, 125);"><br> </span></b></p> <p class="MsoNormal" style="color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); text-indent: 48.25pt;"> <font face="Calibri" size="3">$ id -a<o:p></o:p></font></p> <p class="MsoNormal" style="color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); text-indent: 48.25pt;"> <font face="Calibri" size="3">uid=1403200001(pmoss) gid=7000(sysadmin) groups=7000(sysadmin)<o:p></o:p></font></p> <p class="MsoNormal" style="color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); text-indent: 48.25pt;"> <o:p><font face="Calibri" size="3"> </font></o:p></p> <p class="MsoNormal" style="color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); text-indent: 48.25pt;"> <font face="Calibri" size="3">$ passwd<o:p></o:p></font></p> <p class="MsoNormal" style="color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); text-indent: 48.25pt;"> <font face="Calibri" size="3">Changing password for user pmoss.<o:p></o:p></font></p> <p class="MsoNormal" style="color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); text-indent: 48.25pt;"> <font face="Calibri" size="3">Enter login(LDAP) password:<o:p></o:p></font></p> <p class="MsoNormal" style="color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); text-indent: 48.25pt;"> <span style="font-family: Calibri; font-size: medium; text-indent: 48.25pt;">New UNIX password:</span></p> <p class="MsoNormal" style="color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); text-indent: 48.25pt;"> <font face="Calibri" size="3">Retype new UNIX password:<o:p></o:p></font></p> <p class="MsoNormal" style="color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); text-indent: 48.25pt;"> <o:p><font face="Calibri" size="3"> </font></o:p></p> <p class="MsoNormal" style="color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); text-indent: 48.25pt;"> <font face="Calibri" size="3">LDAP password information update failed: Insufficient access<o:p></o:p></font></p> <p class="MsoNormal" style="color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); text-indent: 48.25pt;"> <font face="Calibri" size="3">Insufficient 'write' privilege to the 'userPassword' attribute of entry 'uid=pmoss,cn=users,cn=compat,dc=linuxcccis,dc=com'.<o:p></o:p></font></p> <p class="MsoNormal" style="color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); text-indent: 48.25pt;"> <font face="Calibri" size="3"> <o:p></o:p></font></p> <p class="MsoNormal" style="color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); margin: 0in 0in 0.0001pt;"> </p> <p class="MsoNormal" style="color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); text-indent: 48.25pt;"> <font face="Calibri" size="3">passwd: Permission denied</font><font face="Helvetica Neue" style="font-size: 13px;"><o:p></o:p></font></p> <p class="MsoNormal" style="color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); font-size: 11pt; font-family: Calibri, sans-serif; margin: 0in 0in 0.0001pt;"> <b><span style="font-size: 10pt; font-family: 'Palatino Linotype', serif; color: rgb(31, 73, 125);"><br> </span></b></p> <p class="MsoNormal" style="color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); text-indent: 48.25pt;"> <font face="Calibri" size="3"># ipa user-show pmoss --all --rights | grep -i userpass -></font><span style="font-family: Calibri; font-size: medium; text-indent: 48.25pt;"> attributelevelrights: {u'userpassword': u'swo’, …</span></p> <p class="MsoNormal" style="color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); text-indent: 48.25pt;"> <span style="font-family: Calibri; font-size: medium; text-indent: 48.25pt;"><br> </span></p> <p class="MsoNormal" style="color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);"> <font face="Calibri" size="3">pmoss shows <b><span style="color:#0B5AB2">u'userpassword': u'swo'</span></b> <o:p></o:p></font></p> <p class="MsoNormal" style="color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); text-indent: 48.25pt;"> </p> <p class="MsoNormal" style="color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);"> <font face="Calibri" size="3">‘swo’ translates to ‘search,write,delete’</font><span style="font-size:14.0pt"><o:p></o:p></span></p> <p class="MsoNormal" style="color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);"> <font face="Calibri" size="3"><br> </font></p> <p class="MsoNormal"><font face="Calibri" size="3" style="background-color: rgb(255, 254, 254);">Why wouldn’t the above be enough rights to be able to change ‘pmoss’ personal password? Thoughts ?</font></p> <p class="MsoNormal" style="color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);"> <span style="font-size:14.0pt;font-family:Calibri; mso-bidi-font-family:Calibri"><br> </span></p> <p class="MsoNormal" style="color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); font-size: 11pt; font-family: Calibri, sans-serif; margin: 0in 0in 0.0001pt;"> <b><span style="font-size: 10pt; font-family: 'Palatino Linotype', serif; color: rgb(31, 73, 125);">Jeffrey Stormshak, RHCSA | Sr. Linux Engineer</span></b></p> <p class="MsoNormal" style="color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); font-size: 11pt; font-family: Calibri, sans-serif; margin: 0in 0in 0.0001pt;"> <span style="font-family: 'Palatino Linotype', serif; font-size: 10pt;">Platform Systems | IT Operations Infrastructure</span></p> <p class="MsoNormal" style="color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); font-size: 11pt; font-family: Calibri, sans-serif; margin: 0in 0in 0.0001pt;"> <span style="font-family: 'Palatino Linotype', serif; font-size: 10pt;">CCC Information Services, Inc.</span></p> <p class="MsoNormal" style="color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); font-size: 11pt; font-family: Calibri, sans-serif; margin: 0in 0in 0.0001pt;"> <span style="font-family: 'Palatino Linotype', serif; font-size: 10pt;">Phone: (312) 229-2552</span></p> </div> </div> </div> <div style="color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif;"> <br> </div> <span id="OLK_SRC_BODY_SECTION" style="color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif;"> <div style="font-family:Calibri; font-size:11pt; text-align:left; color:black; BORDER-BOTTOM: medium none; BORDER-LEFT: medium none; PADDING-BOTTOM: 0in; PADDING-LEFT: 0in; PADDING-RIGHT: 0in; BORDER-TOP: #b5c4df 1pt solid; BORDER-RIGHT: medium none; PADDING-TOP: 3pt"> <span style="font-weight:bold">From: </span>Jakub Hrozek <<a href="mailto:jhrozek@redhat.com">jhrozek@redhat.com</a>><br> <span style="font-weight:bold">Date: </span>Monday, November 23, 2015 at 1:58 AM<br> <span style="font-weight:bold">To: </span>Jeffrey Stormshak <<a href="mailto:jstormshak@cccis.com">jstormshak@cccis.com</a>><br> <span style="font-weight:bold">Cc: </span>Rob Crittenden <<a href="mailto:rcritten@redhat.com">rcritten@redhat.com</a>>, "<a href="mailto:freeipa-users@redhat.com">freeipa-users@redhat.com</a>" <<a href="mailto:freeipa-users@redhat.com">freeipa-users@redhat.com</a>><br> <span style="font-weight:bold">Subject: </span>Re: [Freeipa-users] Oracle Linux 5.5 - Legacy Question<br> </div> <div><br> </div> <div> <div> <div>On Sat, Nov 21, 2015 at 02:21:52AM +0000, Jeffrey Stormshak wrote:</div> <blockquote id="MAC_OUTLOOK_ATTRIBUTION_BLOCKQUOTE" style="BORDER-LEFT: #b5c4df 5 solid; PADDING:0 0 0 5; MARGIN:0 0 0 5;"> <div>Rob -</div> <div>Here’s the test configurations/data when I manipulate the BINDDN/BINDPW fields to get get both AUTH and SUDO to work in Linux 5.5. I have three questions below that I would like to get your comments on or see what you may recommend on this. I’m seriously perplexed on this as to why its working this way … Please advise. Thanks!</div> <div></div> <div>**************************************************************</div> <div>AUTH successful on login; SUDO fails with the message listed</div> <div>below !!</div> <div>**************************************************************</div> <div>[mjsmith@chi-infra-idm-client2 ~]$ sudo -l</div> <div>sudo: ldap_sasl_bind_s(): Server is unwilling to perform</div> </blockquote> <div><br> </div> <div>Looks like the bind didn't finish successfully, can you look into</div> <div>debugging sudo itself? The debugging changed a bit between releases, but</div> <div>The sudo documentation would tell you..</div> <div><br> </div> <blockquote id="MAC_OUTLOOK_ATTRIBUTION_BLOCKQUOTE" style="BORDER-LEFT: #b5c4df 5 solid; PADDING:0 0 0 5; MARGIN:0 0 0 5;"> <div>[sudo] password for mjsmith:</div> <div>Sorry, user mjsmith may not run sudo on chi-infra-idm-client2.</div> <div>*****************************************************</div> <div></div> <div>*****************************************************</div> <div># grep -iv ‘#’ /etc/ldap.conf</div> <div>*****************************************************</div> <div>base dc=linuxcccis,dc=com</div> <div>uri ldap://chi-infra-idm-p1.linuxcccis.com/</div> <div>binddn uid=admin,cn=users,cn=compat,dc=linuxcccis,dc=com</div> <div>bindpw secret_pass</div> <div>timelimit 15</div> <div>bind_timelimit 5</div> <div>idle_timelimit 3600</div> <div>nss_initgroups_ignoreusers root,ldap,named,avahi,haldaemon,dbus,radvd,tomcat,radiusd,news,mailman,nscd,gdm</div> <div>pam_password md5</div> <div>sudoers_base ou=SUDOers,dc=linuxcccis,dc=com</div> <div></div> <div>*************************************************</div> <div>User Account AUTH and SUDO works when</div> <div>commenting both the binddn and bindpw fields !!</div> <div>*************************************************</div> <div>vi /etc/ldap.conf … Comment these two fields …</div> <div>#binddn uid=admin,cn=users,cn=compat,dc=linuxcccis,dc=com</div> <div>#bindpw secret_pass</div> <div></div> <div>************************************************</div> <div>This file unchanged during the above testing !!</div> <div>************************************************</div> <div>/etc/sudo-ldap.conf:</div> <div>binddn uid=sudo,cn=sysaccounts,cn=etc,dc=linuxcccis,dc=com</div> <div>bindpw secret_pass</div> <div>ssl start_tls</div> <div>tls_cacertfile /etc/ipa/ca.crt</div> <div>tls_checkpeer yes</div> <div>bind_timelimit 5</div> <div>timelimit 15</div> <div>uri ldap://chi-infra-idm-p1.linuxcccis.com</div> <div>sudoers_base ou=SUDOers,dc=linuxcccis,dc=com</div> <div></div> <div>QUESTIONS:</div> <div>1) What BINDN account needs to be specified to allow the BINDDN/BINDPW to work for SUDO?</div> <div>2) Why does the AUTH work when setting values in the BINDDN/BINDPW, but SUDO then fails?</div> <div>3) If I leave BINDDN/BINDPW blank, what security risks are being introduced by leaving it that way?</div> </blockquote> <div><br> </div> <div>Anyone on the network can read sudo rules. I guess in theory, the</div> <div>attacker might target accounts who are allowed to run sudo rules as a</div> <div>gateway for getting elevated privileges on the machine..</div> <div><br> </div> </div> </div> </span> </body> </html>