From 648a67f81ac84dc0585e58b4c5664f4b9cecab86 Mon Sep 17 00:00:00 2001 From: Edgar Aguilar Date: Thu, 18 Jan 2024 17:02:59 -0600 Subject: [PATCH 1/3] Update OL8 sssd rules Update rules sssd_enable_smartcards & sssd_offline_cred_expiration to also look into files inside /etc/sssd/conf.d/ Signed-off-by: Edgar Aguilar --- .../sssd/sssd_enable_smartcards/ansible/shared.yml | 13 +++++++++++++ .../sssd/sssd_enable_smartcards/bash/shared.sh | 2 +- .../sssd/sssd_enable_smartcards/oval/shared.xml | 11 ++++++++--- .../sssd_offline_cred_expiration/ansible/shared.yml | 13 +++++++++++++ .../sssd_offline_cred_expiration/bash/shared.sh | 2 +- .../sssd_offline_cred_expiration/oval/shared.xml | 5 +++++ .../sssd/sssd_offline_cred_expiration/rule.yml | 2 +- 7 files changed, 42 insertions(+), 6 deletions(-) diff --git a/linux_os/guide/services/sssd/sssd_enable_smartcards/ansible/shared.yml b/linux_os/guide/services/sssd/sssd_enable_smartcards/ansible/shared.yml index f82c9e3862b..80f17d83c51 100644 --- a/linux_os/guide/services/sssd/sssd_enable_smartcards/ansible/shared.yml +++ b/linux_os/guide/services/sssd/sssd_enable_smartcards/ansible/shared.yml @@ -34,6 +34,19 @@ create: yes mode: 0600 +- name: Find all the conf files inside /etc/sssd/conf.d/ + find: + paths: "/etc/sssd/conf.d/" + patterns: "*.conf" + register: sssd_conf_d_files + +- name: Fix pam_cert_auth configuration in /etc/sssd/conf.d/ + ansible.builtin.replace: + path: "{{ item.path }}" + regexp: '[^#]*pam_cert_auth.*' + replace: 'pam_cert_auth = True' + with_items: "{{ sssd_conf_d_files.files }}" + {{% if product in ["fedora", "ol8", "ol9", "rhel8", "rhel9"] %}} - name: '{{{ rule_title }}} - Check if system relies on authselect' ansible.builtin.stat: diff --git a/linux_os/guide/services/sssd/sssd_enable_smartcards/bash/shared.sh b/linux_os/guide/services/sssd/sssd_enable_smartcards/bash/shared.sh index 4e2e00554e8..b896f4f7d9b 100644 --- a/linux_os/guide/services/sssd/sssd_enable_smartcards/bash/shared.sh +++ b/linux_os/guide/services/sssd/sssd_enable_smartcards/bash/shared.sh @@ -9,7 +9,7 @@ OLD_UMASK=$(umask) umask u=rw,go= -{{{ bash_ensure_ini_config("/etc/sssd/sssd.conf", "pam", "pam_cert_auth", "True") }}} +{{{ bash_ensure_ini_config("/etc/sssd/sssd.conf /etc/sssd/conf.d/*.conf", "pam", "pam_cert_auth", "True") }}} umask $OLD_UMASK diff --git a/linux_os/guide/services/sssd/sssd_enable_smartcards/oval/shared.xml b/linux_os/guide/services/sssd/sssd_enable_smartcards/oval/shared.xml index c2ae4d39a47..1cadee2e4a1 100644 --- a/linux_os/guide/services/sssd/sssd_enable_smartcards/oval/shared.xml +++ b/linux_os/guide/services/sssd/sssd_enable_smartcards/oval/shared.xml @@ -17,14 +17,19 @@ comment="tests the value of pam_cert_auth setting in the /etc/sssd/sssd.conf file" id="test_sssd_enable_smartcards" version="1"> + - - /etc/sssd/sssd.conf - ^[\s]*\[pam](?:[^\n\[]*\n+)+?[\s]*pam_cert_auth[\s]*=[\s]*(?i)true\s*$ + + /etc/sssd/(sssd\.conf|conf.d/[^/]+\.conf) + ^[\s]*\[pam](?:[^\n\[]*\n+)+?[\s]*pam_cert_auth[\s]*=[\s]*(\w+)\s*$ 1 + + (?i)true + + {{% if product in ["fedora", "ol8", "ol9", "rhel8", "rhel9"] %}} + ^\/etc\/sssd\/(sssd.conf|conf\.d\/.+\.conf)$ ^[\s]*\[pam](?:[^\n\[]*\n+)+?[\s]*offline_credentials_expiration[\s]*=[\s]*1\s*(?:#.*)?$ 1 + + + 1 + {{% if product in ["ol8", "rhel8"] %}} {{% endif %}} To verify that SSSD expires offline credentials, run the following command: - 
$ sudo grep offline_credentials_expiration /etc/sssd/sssd.conf
+ 
$ sudo grep offline_credentials_expiration /etc/sssd/sssd.conf /etc/sssd/conf.d/*.conf
If configured properly, output should be 
offline_credentials_expiration = 1
From 8a7bcc05b42bcecd4490499a892ed07f15e916df Mon Sep 17 00:00:00 2001 From: Edgar Aguilar Date: Thu, 18 Jan 2024 17:04:12 -0600 Subject: [PATCH 2/3] Add tests to OL8 sssd rules These test are to take int account files inside /etc/sssd/conf.d/ Signed-off-by: Edgar Aguilar --- .../tests/authselect_smartcard_enabled_conf_d.pass.sh | 11 +++++++++++ .../authselect_sssd_parameter_false_conf_d.fail.sh | 11 +++++++++++ .../tests/correct_value_conf_d.pass.sh | 9 +++++++++ .../tests/wrong_value_conf_d.fail.sh | 9 +++++++++ 4 files changed, 40 insertions(+) create mode 100644 linux_os/guide/services/sssd/sssd_enable_smartcards/tests/authselect_smartcard_enabled_conf_d.pass.sh create mode 100644 linux_os/guide/services/sssd/sssd_enable_smartcards/tests/authselect_sssd_parameter_false_conf_d.fail.sh create mode 100644 linux_os/guide/services/sssd/sssd_offline_cred_expiration/tests/correct_value_conf_d.pass.sh create mode 100644 linux_os/guide/services/sssd/sssd_offline_cred_expiration/tests/wrong_value_conf_d.fail.sh diff --git a/linux_os/guide/services/sssd/sssd_enable_smartcards/tests/authselect_smartcard_enabled_conf_d.pass.sh b/linux_os/guide/services/sssd/sssd_enable_smartcards/tests/authselect_smartcard_enabled_conf_d.pass.sh new file mode 100644 index 00000000000..7e2019cff1f --- /dev/null +++ b/linux_os/guide/services/sssd/sssd_enable_smartcards/tests/authselect_smartcard_enabled_conf_d.pass.sh @@ -0,0 +1,11 @@ +#!/bin/bash +# packages = authselect,sssd +# platform = multi_platform_fedora,Oracle Linux 8,Oracle Linux 9,Red Hat Enterprise Linux 8,Red Hat Enterprise Linux 9 + +SSSD_FILE="/etc/sssd/conf.d/unused.conf" +echo "[pam]" > $SSSD_FILE +echo "pam_cert_auth = True" >> $SSSD_FILE + +authselect select sssd --force +authselect enable-feature with-smartcard +authselect apply-changes diff --git a/linux_os/guide/services/sssd/sssd_enable_smartcards/tests/authselect_sssd_parameter_false_conf_d.fail.sh b/linux_os/guide/services/sssd/sssd_enable_smartcards/tests/authselect_sssd_parameter_false_conf_d.fail.sh new file mode 100644 index 00000000000..b1ed28f3943 --- /dev/null +++ b/linux_os/guide/services/sssd/sssd_enable_smartcards/tests/authselect_sssd_parameter_false_conf_d.fail.sh @@ -0,0 +1,11 @@ +#!/bin/bash +# packages = authselect,sssd +# platform = multi_platform_fedora,Oracle Linux 8,Oracle Linux 9,Red Hat Enterprise Linux 8,Red Hat Enterprise Linux 9 + +SSSD_FILE="/etc/sssd/conf.d/unused.conf" +echo "[pam]" > $SSSD_FILE +echo "pam_cert_auth = False" >> $SSSD_FILE + +authselect select sssd --force +authselect enable-feature with-smartcard +authselect apply-changes diff --git a/linux_os/guide/services/sssd/sssd_offline_cred_expiration/tests/correct_value_conf_d.pass.sh b/linux_os/guide/services/sssd/sssd_offline_cred_expiration/tests/correct_value_conf_d.pass.sh new file mode 100644 index 00000000000..c8927040f19 --- /dev/null +++ b/linux_os/guide/services/sssd/sssd_offline_cred_expiration/tests/correct_value_conf_d.pass.sh @@ -0,0 +1,9 @@ +#!/bin/bash + +source common.sh + +SSSD_CONF_D_FILE="/etc/sssd/conf.d/unused.conf" + +echo -e "[pam]\noffline_credentials_expiration = 1" >> $SSSD_CONF_D_FILE + +echo -e "[domain/EXAMPLE]\ncache_credentials = true" >> $SSSD_CONF diff --git a/linux_os/guide/services/sssd/sssd_offline_cred_expiration/tests/wrong_value_conf_d.fail.sh b/linux_os/guide/services/sssd/sssd_offline_cred_expiration/tests/wrong_value_conf_d.fail.sh new file mode 100644 index 00000000000..f3185b6cd68 --- /dev/null +++ b/linux_os/guide/services/sssd/sssd_offline_cred_expiration/tests/wrong_value_conf_d.fail.sh @@ -0,0 +1,9 @@ +#!/bin/bash + +source common.sh + +SSSD_CONF_D_FILE="/etc/sssd/conf.d/unused.conf" + +echo -e "[pam]\noffline_credentials_expiration = 0" >> $SSSD_CONF_D_FILE + +echo -e "[domain/EXAMPLE]\ncache_credentials = true" >> $SSSD_CONF From 028b55316587a14b777a64c8b17203c90c3468a1 Mon Sep 17 00:00:00 2001 From: Edgar Aguilar Date: Mon, 12 Feb 2024 16:17:31 -0600 Subject: [PATCH 3/3] Fix regex in sssd_offline_cred_expiration Update it to include a capturing group to use a state to compare the captured subexpression Signed-off-by: Edgar Aguilar --- .../services/sssd/sssd_offline_cred_expiration/oval/shared.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/linux_os/guide/services/sssd/sssd_offline_cred_expiration/oval/shared.xml b/linux_os/guide/services/sssd/sssd_offline_cred_expiration/oval/shared.xml index a9e9a20b72c..2ecac5d70ee 100644 --- a/linux_os/guide/services/sssd/sssd_offline_cred_expiration/oval/shared.xml +++ b/linux_os/guide/services/sssd/sssd_offline_cred_expiration/oval/shared.xml @@ -18,7 +18,7 @@ ^\/etc\/sssd\/(sssd.conf|conf\.d\/.+\.conf)$ - ^[\s]*\[pam](?:[^\n\[]*\n+)+?[\s]*offline_credentials_expiration[\s]*=[\s]*1\s*(?:#.*)?$ + ^[\s]*\[pam](?:[^\n\[]*\n+)+?[\s]*offline_credentials_expiration[\s]*=[\s]*(\d+)\s*(?:#.*)?$ 1