Hi Rob, thank you for your reply which recalls something I read (I hoped it was only my mistake...) I've tried to modify my auth chain in: Postfix (1) -> saslauth (2) -> PAM (pam_krb5) 1) Postfix: smtpd_sasl_type = cyrus 2) saslauth: pwcheck_method: saslauthd mech_list: PLAIN LOGIN Il 2022-02-16 14:47 Rob Crittenden ha scritto: > stefano.antonelli@cnaf via FreeIPA-users wrote: >> Dear FreeIPA users >> >> I have a three nodes installation (version 4.6.8, CentOS 7.9.2009) and >> I'm trying to manage users and hosts in order to allow them to send >> emails; I've retrieved host keytab from ipa servers and configured >> host >> krb5.conf to ipa servers; >> >> I've a test user on FreeIPA (or, in future, User groups) and an smtp >> server (postfix; or in future Host groups) and a smtp service >> smtp/hostname@REALM >> >> I'd like to configure an HBAC rule in order to: >> >> 1) allow the group of user to send email via the smtp server >> 2) ban the user to send email removing him/her from the user group >> >> but there is something that's not working, I've made two tests (user >> in >> User group and deleted from User group) and in both cases the user is >> able to send email from his client (I attach the output of some ipa >> commands) >> >> Beside, I've tried to add a HBAC service "smtp" (even if I do not >> understand its real use, if its a "only" a tag) and a HBAC Service >> group but nothing has changed. At the moment I don't realize where I'm >> wrong even looking at some log files, >> >> thank you >> cheers >> Stefano >> >> >> >> ### 1 user-test in User Group >> ipa hbacrule-show smtp >> Rule name: smtp >> Service category: all >> Description: Regola di accesso ai server smtp >> Enabled: TRUE >> User Groups: smtp >> Host Groups: smtp >> >> ipa user-show user-test >> Member of groups: smtp >> Indirect Member of HBAC rule: smtp >> >> ipa hbactest --user=user-test --host=host.domain --service=all >> -------------------- >> Access granted: True >> -------------------- >> Matched rules: smtp-cnaf >> >> ### 2 user-test deleted from User Group >> >> ipa hbactest --user=user-test --host=host.domain --service=all >> --------------------- >> Access granted: False >> --------------------- >> Not matched rules: smtp-cnaf > > > rob

Hi Rob, PAM. thank you for your reply which recalls something I read about HBAC/PAM and makes me discover a new chain of authentication (and I hoped I was wrong and it was only my mistake in the configuration but...) I've tried to modify my auth chain in: Postfix (1) -> saslauth (2) -> PAM (pam_krb5) 1) Postfix: smtpd_sasl_type = cyrus 2) saslauth: pwcheck_method: saslauthd mech_list: PLAIN LOGIN 3) pam_krb5 (just to start, it's the first time I configure pam_krb5) auth required /usr/lib64/security/pam_krb5.so session optional /usr/lib64/security/pam_krb5.so account sufficient /usr/lib64/security/pam_krb5.so password sufficient /usr/lib64/security/pam_krb5.so 4) krb5.conf [logging] default = FILE:/var/log/krb5libs.log kdc = FILE:/var/log/krb5kdc.log admin_server = FILE:/var/log/kadmind.log [libdefaults] default_realm = MY.REALM dns_lookup_realm = false ticket_lifetime = 24h renew_lifetime = 7d forwardable = true rdns = false pkinit_anchors = /etc/pki/tls/certs/ca-bundle.crt default_realm = MY.REALM default_ccache_name = KEYRING:persistent:%{uid} [realms] MY.REALM = { kdc = myipa.realm kdc = myipa-01.realm kdc = myipa-02.realm admin_server = myipa.realm } [domain_realm] .MYREALM = MYREALM MYREALM = MYREALM It works for authentication via FreeIPA but, at the moment, HBAC roles are still not working. Is this type of "Postfix, SASL, PAM" authentication that you meant? thank you cheers Stefano Il 2022-02-16 14:47 Rob Crittenden ha scritto:

Hi Alexander thank you, On Thu, 2022-02-17 at 16:36 +0200, Alexander Bokovoy wrote: ok, but I do see a module like pam_sss; do you mean using the config /etc/pam.d/sssd_shadowutils from sssd-common rpm? the default one for postfix /etc/pam.d/smtp thank you cheers Stefano

Hi Alexander, Rob thank you for your hints because it seems that something is working: I've configured my test enviroment like this: smtp Postfix server: - /etc/pam.d/smtp (a symlink to /etc/alternatives/mta-pam) account required pam_sss.so auth required pam_sss.so - I start a saslauthd daemon: saslauthd -d -a pam -O smtp - I test my test account with CLI (and with Thunderbird) testsaslauthd -u test -p "test-pwd" -r MY.REALM -s smtp FreeIPA: I add a hbac rule "smtp", a service "smtp", a host Group "smtp" (at the moment there's one server), a User group "smtp". The hbac rule "smtp" grants UserGroup "smtp" access to HostGroup "smtp" via service "smtp" From CLI (testsaslauthd) I get 0: NO "authentication failed" 0: OK "Success." and from thunderbird I manage to sent or not the email depending on whether or not I add the hbac rule to the test user but it doesn't work if I try to add the user to the group "smtp". I see that the user inherits or looses some attributes (ldapsearch, ipa user-show) but it doesn't work with the group. After I've added the user to the UserGroup he manages to send email even if I remove him from the group. Tho only way to reset this (I've tried to remove cache sss_cache both on client and server) is that I add and remove the hbac rule from the single user After this even if I try to remove the user from the group he manages to send email apart from the rule like if there were some caching (I've tried to remove cache sss_cache -E on the client). When I add the user to the UserGroup I see that he is a "indirect member" of the hbac rule while is a direct member when I add the rule to him; is there anything different working with groups or may be it a problem of sssd caching? thank you cheers Stefano On 2/17/22 15:59, Alexander Bokovoy wrote: > On to, 17 helmi 2022, stefano.antonelli@cnaf wrote: >> Hi Alexander >> >> thank you, >> >> On Thu, 2022-02-17 at 16:36 +0200, Alexander Bokovoy wrote: >>> HBAC rules checks are done by SSSD. You have to use pam_sss, not >>> pam_krb5. PAM module pam_krb5 is irrelevant here, no wonder it does >>> not >>> work for you. >>> >> >> ok, but I do see a module like pam_sss; do you mean using the config >> /etc/pam.d/sssd_shadowutils from sssd-common rpm? > > >> >>> >>> What pam config file name is used? /etc/pam.d/postfix? >>> I think it should just be a symlink to /etc/pam.d/system-auth. >>> >> >> the default one for postfix /etc/pam.d/smtp > > Your /etc/pam.d/smtp should ideally be a symlink to system-auth, unless > it adds something different on top of it. If so, it should be including > system-auth instead. But I think a symlink should be just fine. > >> >> thank you >> cheers >> Stefano >> >>> >>> > 4) krb5.conf >>> > [logging] >>> > default = FILE:/var/log/krb5libs.log >>> > kdc = FILE:/var/log/krb5kdc.log >>> > admin_server = FILE:/var/log/kadmind.log >>> > >>> > [libdefaults] >>> > default_realm = MY.REALM >>> > dns_lookup_realm = false >>> > ticket_lifetime = 24h >>> > renew_lifetime = 7d >>> > forwardable = true >>> > rdns = false >>> > pkinit_anchors = /etc/pki/tls/certs/ca-bundle.crt >>> > default_realm = MY.REALM >>> > default_ccache_name = KEYRING:persistent:%{uid} >>> > >>> > [realms] >>> > MY.REALM = { >>> >  kdc = myipa.realm >>> >  kdc = myipa-01.realm >>> >  kdc = myipa-02.realm >>> >  admin_server = myipa.realm >>> > } >>> > >>> > [domain_realm] >>> > .MYREALM = MYREALM >>> >  MYREALM = MYREALM >>> > >>> > It works for authentication via FreeIPA but, at the moment, HBAC >>> > roles >>> > are still not working. >>> > >>> > Is this type of "Postfix, SASL, PAM" authentication that you meant? >>> > >>> > thank you >>> > cheers >>> > Stefano >>> > >>> > Il 2022-02-16 14:47 Rob Crittenden ha scritto: >>> > > stefano.antonelli@cnaf via FreeIPA-users wrote: >>> > > > Dear FreeIPA users >>> > > > >>> > > > I have a three nodes installation (version 4.6.8, CentOS >>> > > > 7.9.2009) >>> > > > and >>> > > > I'm trying to manage users and hosts in order to allow them to >>> > > > send >>> > > > emails; I've retrieved host keytab from ipa servers and >>> > > > configured >>> > > > host >>> > > > krb5.conf to ipa servers; >>> > > > >>> > > > I've a test user on FreeIPA (or, in future, User groups) and an >>> > > > smtp >>> > > > server (postfix; or in future Host groups) and a smtp service >>> > > > smtp/hostname@REALM >>> > > > >>> > > > I'd like to configure an HBAC rule in order to: >>> > > > >>> > > > 1) allow the group of user to send email via the smtp server >>> > > > 2) ban the user to send email removing him/her from the user >>> > > > group >>> > > > >>> > > > but there is something that's not working, I've made two tests >>> > > > (user >>> > > > in >>> > > > User group and deleted from User group) and in both cases the >>> > > > user >>> > > > is >>> > > > able to send email from his client (I attach the output of some >>> > > > ipa >>> > > > commands) >>> > > > >>> > > > Beside, I've tried to add a HBAC service "smtp" (even if I do >>> > > > not >>> > > > understand its real use, if its a "only" a tag) and a  HBAC >>> > > > Service >>> > > > group but nothing has changed. At the moment I don't realize >>> > > > where >>> > > > I'm >>> > > > wrong even looking at some log files, >>> > > > >>> > > > thank you >>> > > > cheers >>> > > > Stefano >>> > > > >>> > > > >>> > > > >>> > > > ### 1 user-test in User Group >>> > > > ipa hbacrule-show smtp >>> > > >  Rule name: smtp >>> > > >  Service category: all >>> > > >  Description: Regola di accesso ai server smtp >>> > > >  Enabled: TRUE >>> > > >  User Groups: smtp >>> > > >  Host Groups: smtp >>> > > > >>> > > > ipa user-show user-test >>> > > >  Member of groups: smtp >>> > > >  Indirect Member of HBAC rule: smtp >>> > > > >>> > > > ipa hbactest --user=user-test --host=host.domain --service=all >>> > > > -------------------- >>> > > > Access granted: True >>> > > > -------------------- >>> > > >   Matched rules: smtp-cnaf >>> > > > >>> > > > ### 2 user-test deleted from User Group >>> > > > >>> > > > ipa hbactest --user=user-test --host=host.domain --service=all >>> > > > --------------------- >>> > > > Access granted: False >>> > > > --------------------- >>> > > >   Not matched rules: smtp-cnaf >>> > > >>> > > HBAC services are PAM services. If the >>> > > authentication/authorization/session is going through PAM then >>> > > this >>> > > can >>> > > work. I have some vague memory of saslauthd and postfix using >>> > > PAM. >>> > > >>> > > rob >>> > >>> > _______________________________________________ >>> > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org >>> > To unsubscribe send an email to >>> > freeipa-users-leave(a)lists.fedorahosted.org >>> > Fedora Code of Conduct: >>> > https://docs.fedoraproject.org/en-US/project/code-of-conduct/ >>> > List Guidelines: >>> > https://fedoraproject.org/wiki/Mailing_list_guidelines >>> > List Archives: >>> > >>> https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho... >>> >>> > Do not reply to spam on the list, report it: >>> > https://pagure.io/fedora-infrastructure >>> >>> >>> >> >> > > >