On pe, 16 helmi 2018, Rob Brown via FreeIPA-users wrote: > Hi, > We recently moved from an "old school" setup where we would push different > pubkeys for the same user out to specific hosts in different environments > using configuration management. Likewise, the matching private keys would > only exist in their requisite environment. > This presents a new problem with freeIPA (which serves both environments), > in that pubkeys are now attached to the user, and if we put both the > "prod" > and "preprod" pubkeys in the user object, either key will work for that > user on any server. > I know the "right answer" probably lies in HBAC rules, but trying to look > for a simple solution that would restrict which key can be used on which > server. I read about the "fromhost" option, but that is the opposite of > what I am looking for. I would like to be able to say "this key can only > be > used to authenticate user foo to xyz host". > Can someone help steer me in the right direction? I'm not seeing it. > FreeIPA supports ID views which can be assigned to specific hosts or host groups. You can have ID overrides for users in those views that contain specific public SSH keys. These public SSH keys will only be noticed by SSSD running on the hosts that have this ID view assigned. ID Overrides, as their name suggests, override existing attribute values. Thus, a public SSH key K1 assigned to a userA globally and overridden in an ID Override in an ID view viewB by a public SSH key K2 would not be visible on the hosts where viewB is applied. Instead, these hosts will only see K2. This may be your solution. https://access.redhat.com/documentation/en-us/red_hat_enterp rise_linux/7/html/linux_domain_identity_authentication_and_ policy_guide/id-views -- / Alexander Bokovoy

On pe, 16 helmi 2018, Rob Brown wrote: > Thanks, that looks like potentially a great solution. (It pays to RTFM!) > I couldn't get it to work on my first try in my test env, but will keep at > it. > The pubkey works fine when attached to the "real" user, so I know the > keypair is good. > But if I remove the key from the user, and try moving it to the idview > override, it doesn't work. > You need to assign the view to a host and then you should restart SSSD on the host. ID View assignments are only taken by hosts on restart. On Fri, Feb 16, 2018 at 11:01 AM, Alexander Bokovoy <abokovoy(a)redhat.com&gt; > wrote: > > On pe, 16 helmi 2018, Rob Brown via FreeIPA-users wrote: >> >> Hi, >>> We recently moved from an "old school" setup where we would push >>> different >>> pubkeys for the same user out to specific hosts in different >>> environments >>> using configuration management. Likewise, the matching private keys >>> would >>> only exist in their requisite environment. >>> This presents a new problem with freeIPA (which serves both >>> environments), >>> in that pubkeys are now attached to the user, and if we put both the >>> "prod" >>> and "preprod" pubkeys in the user object, either key will work for that >>> user on any server. >>> I know the "right answer" probably lies in HBAC rules, but trying to >>> look >>> for a simple solution that would restrict which key can be used on which >>> server. I read about the "fromhost" option, but that is the opposite of >>> what I am looking for. I would like to be able to say "this key can only >>> be >>> used to authenticate user foo to xyz host". >>> Can someone help steer me in the right direction? I'm not seeing it. >>> >>> FreeIPA supports ID views which can be assigned to specific hosts or >> host groups. You can have ID overrides for users in those views that >> contain >> specific public SSH keys. These public SSH keys will only be noticed by >> SSSD running on the hosts that have this ID view assigned. >> >> ID Overrides, as their name suggests, override existing attribute >> values. Thus, a public SSH key K1 assigned to a userA globally and >> overridden in an ID Override in an ID view viewB by a public SSH key K2 >> would not be visible on the hosts where viewB is applied. Instead, these >> hosts will only see K2. >> >> This may be your solution. >> >> https://access.redhat.com/documentation/en-us/red_hat_enterp >> rise_linux/7/html/linux_domain_identity_authentication_and_ >> policy_guide/id-views >> >> -- >> / Alexander Bokovoy >> >> -- / Alexander Bokovoy