<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<font face="Carlito">Hi all,<br>
<br>
I created some hbac rule on freeipa-server 4.1.4 on Fedora 22<br>
<br>
# ipa hbacrule-show testuser<br>
Rule name: testuser<br>
Enabled: TRUE<br>
Users: testuser<br>
Hosts: fedora23-server.blabla.bla<br>
Services: sshd<br>
<br>
Hence, " testuser" is only allowed using sshd on
"fedora23-server". No surprise, this user is not allowed to use
"su":<br>
<br>
# ipa hbactest --user testuser --host fedora23-server.blabla.bla
--service su<br>
---------------------<br>
Access granted: False<br>
<br>
(and yeah sshd is allowed)<br>
<br>
However, doing a "su" on the </font><font face="Carlito"><font
face="Carlito">fedora23-server.blabla.bla, and giving the
correct password, access is granted. This user is not a member
of any other groups.<br>
HBAC Services like cron or console access are denied correctly
since they are not in the HBAC service list.<br>
<br>
I noticed this behaviour also on IPA 4.1 (The Red Hat one) and
several other ipa-clients (RHEL/CentoOS 6.x, 7.x)<br>
<br>
Shouldn't su or su -l be denied when not listed?<br>
<br>
Kind regards,<br>
<br>
Winny<br>
<br>
</font> </font>
</body>
</html>