Feature #8698
closed
LDAP authenticated users should be able to log in via ssh
100%
Description
We integrate pfsense against our Active Directory systems for authentication and authorization. Works well for the most part but we've discovered that LDAP authenticated users are unable to access the cli via ssh. This is unfortunate as we have security scanners, etc., that need this functionality in order to work properly.
Updated by Jim Pingle over 5 years ago
- Category set to User Manager / Privileges
- Assignee set to Jim Pingle
After #9399 this is one step closer.
Updated by Jim Pingle over 5 years ago
- Category changed from User Manager / Privileges to Authentication
Updated by Viktor Gurov about 4 years ago
Updated by Jim Pingle about 4 years ago
- Status changed from New to Pull Request Review
- Target version set to 2.5.0
Updated by Renato Botelho about 4 years ago
- Status changed from Pull Request Review to Feedback
PR has been merged. Thanks!
Updated by Viktor Gurov about 4 years ago
- % Done changed from 0 to 100
Applied in changeset ca8459cdafafd225fbc07edbc32679b8301298fc.
Updated by Max Leighton about 4 years ago
Testing this with Active Directory, I'm able to successfully log into the webGUI with LDAP credentials, but attempting to log in via SSH hangs entering the username and the pfSense web interface becomes unresponsive. The system logs show repeated entries of:
Nov 11 09:58:46 su 34885 nss_ldap: failed to bind to LDAP server ldap://127.0.0.1: Can't contact LDAP server
Nov 11 09:58:46 su 34885 nss_ldap: could not search LDAP server - Server is unavailable
The LDAP server is selected as the Authentication Server with Shell Authentication checked, and the Shell Authentication Group is set to the same as my extended query which is working to allow login to the GUI:
CN=Users,CN=Builtin,DC=lab,DC=local
Tested in:
2.5.0-DEVELOPMENT (amd64)
built on Tue Nov 10 01:00:03 EST 2020
FreeBSD 12.2-STABLE
Updated by Viktor Gurov about 4 years ago
pfSense 2.5.0.a.20201111.1850 test with FreeIPA server 4.8.4:
Authentication server configuration:
<authserver>
<refid>5f81b3e5799d3</refid>
<type>ldap</type>
<name>FreeIPA</name>
<ldap_caref>global</ldap_caref>
<host>192.168.88.91</host>
<ldap_port>389</ldap_port>
<ldap_urltype>Standard TCP</ldap_urltype>
<ldap_protver>3</ldap_protver>
<ldap_scope>subtree</ldap_scope>
<ldap_basedn><![CDATA[DC=pand,DC=int]]></ldap_basedn>
<ldap_authcn><![CDATA[cn=accounts,dc=pand,dc=int]]></ldap_authcn>
<ldap_extended_enabled></ldap_extended_enabled>
<ldap_extended_query><![CDATA[&(objectClass=ipausergroup)(cn=vpnipa)(member=*)))]]></ldap_extended_query>
<ldap_attr_user><![CDATA[uid]]></ldap_attr_user>
<ldap_attr_group><![CDATA[cn]]></ldap_attr_group>
<ldap_attr_member><![CDATA[member]]></ldap_attr_member>
<ldap_attr_groupobj><![CDATA[posixGroup]]></ldap_attr_groupobj>
<ldap_allow_unauthenticated></ldap_allow_unauthenticated>
<ldap_timeout>25</ldap_timeout>
<ldap_pam_groupdn><![CDATA[cn=vpnipa,cn=groups,cn=accounts,dc=pand,dc=int]]></ldap_pam_groupdn>
<ldap_binddn><![CDATA[uid=admin,cn=users,cn=compat,dc=pand,dc=int]]></ldap_binddn>
<ldap_bindpw><![CDATA[123]]></ldap_bindpw>
<ldap_rfc2307></ldap_rfc2307>
<ldap_rfc2307_userdn></ldap_rfc2307_userdn>
</authserver>
ipatest LDIF data:
# ipatest, users, accounts, pand.int dn: uid=ipatest,cn=users,cn=accounts,dc=pand,dc=int givenName: first sn: last uid: ipatest cn: first last displayName: first last initials: fl gecos: first last krbPrincipalName: ipatest@PAND.INT objectClass: top objectClass: person objectClass: organizationalperson objectClass: inetorgperson objectClass: inetuser objectClass: posixaccount objectClass: krbprincipalaux objectClass: krbticketpolicyaux objectClass: ipaobject objectClass: ipasshuser objectClass: ipaSshGroupOfPubKeys objectClass: mepOriginEntry loginShell: /bin/sh homeDirectory: /home/ipatest mail: ipatest@pand.int krbCanonicalName: ipatest@PAND.INT ipaUniqueID: 03a2a360-c7ed-11ea-9b26-860d7bafc7f2 uidNumber: 1000000001 gidNumber: 1000000001 krbPasswordExpiration: 20200720094800Z krbLastPwdChange: 20200720094800Z krbExtraData:: AAJQaBVfcm9vdC9hZG1pbkBQQU5ELklOVAA= mepManagedEntry: cn=ipatest,cn=groups,cn=accounts,dc=pand,dc=int memberOf: cn=ipausers,cn=groups,cn=accounts,dc=pand,dc=int memberOf: cn=vpnipa,cn=groups,cn=accounts,dc=pand,dc=int memberOf: cn=othertestgroup,cn=groups,cn=accounts,dc=pand,dc=int krbLoginFailedCount: 0 krbLastFailedAuth: 20201021102340Z # vpnipa, groups, accounts, pand.int dn: cn=vpnipa,cn=groups,cn=accounts,dc=pand,dc=int cn: vpnipa objectClass: top objectClass: groupofnames objectClass: nestedgroup objectClass: ipausergroup objectClass: ipaobject objectClass: posixgroup ipaUniqueID: 925d9524-c7ed-11ea-9001-860d7bafc7f2 gidNumber: 1000000004 member: uid=ipatest,cn=users,cn=accounts,dc=pand,dc=int
part of LDAP traffic dump:
Internet Protocol Version 4, Src: 192.168.88.41, Dst: 192.168.88.91
Transmission Control Protocol, Src Port: 25859, Dst Port: 389, Seq: 1077, Ack: 2947, Len: 250
Lightweight Directory Access Protocol
LDAPMessage searchRequest(6) "DC=pand,DC=int" wholeSubtree
messageID: 6
protocolOp: searchRequest (3)
searchRequest
baseObject: DC=pand,DC=int
scope: wholeSubtree (2)
derefAliases: neverDerefAliases (0)
sizeLimit: 1
timeLimit: 25
typesOnly: False
Filter: (&(objectClass=posixAccount)(uid=ipatest))
filter: and (0)
and: (&(objectClass=posixAccount)(uid=ipatest))
and: 2 items
Filter: (objectClass=posixAccount)
and item: equalityMatch (3)
equalityMatch
attributeDesc: objectClass
assertionValue: posixAccount
Filter: (uid=ipatest)
and item: equalityMatch (3)
equalityMatch
attributeDesc: uid
assertionValue: ipatest
attributes: 14 items
AttributeDescription: uid
AttributeDescription: userPassword
AttributeDescription: uidNumber
AttributeDescription: gidNumber
AttributeDescription: cn
AttributeDescription: homeDirectory
AttributeDescription: loginShell
AttributeDescription: gecos
AttributeDescription: description
AttributeDescription: objectClass
AttributeDescription: shadowLastChange
AttributeDescription: shadowMax
AttributeDescription: shadowExpire
AttributeDescription: loginClass
[Response In: 84]
Internet Protocol Version 4, Src: 192.168.88.91, Dst: 192.168.88.41
Transmission Control Protocol, Src Port: 389, Dst Port: 25859, Seq: 2947, Ack: 1327, Len: 733
Lightweight Directory Access Protocol
LDAPMessage searchResEntry(6) "uid=ipatest,cn=users,cn=compat,dc=pand,dc=int" [10 results]
messageID: 6
protocolOp: searchResEntry (4)
searchResEntry
objectName: uid=ipatest,cn=users,cn=compat,dc=pand,dc=int
attributes: 8 items
PartialAttributeList item uid
type: uid
vals: 1 item
AttributeValue: ipatest
PartialAttributeList item uidNumber
type: uidNumber
vals: 1 item
AttributeValue: 1000000001
PartialAttributeList item gidNumber
type: gidNumber
vals: 1 item
AttributeValue: 1000000001
PartialAttributeList item cn
type: cn
vals: 1 item
AttributeValue: first last
PartialAttributeList item homeDirectory
type: homeDirectory
vals: 1 item
AttributeValue: /home/ipatest
PartialAttributeList item loginShell
type: loginShell
vals: 1 item
AttributeValue: /bin/sh
PartialAttributeList item gecos
type: gecos
vals: 1 item
AttributeValue: first last
PartialAttributeList item objectClass
type: objectClass
vals: 3 items
AttributeValue: posixAccount
AttributeValue: ipaOverrideTarget
AttributeValue: top
[Response To: 83]
[Time: 0.003821000 seconds]
Lightweight Directory Access Protocol
LDAPMessage searchResEntry(6) "uid=ipatest,cn=users,cn=accounts,dc=pand,dc=int" [10 results]
messageID: 6
protocolOp: searchResEntry (4)
searchResEntry
objectName: uid=ipatest,cn=users,cn=accounts,dc=pand,dc=int
attributes: 8 items
PartialAttributeList item uid
type: uid
vals: 1 item
AttributeValue: ipatest
PartialAttributeList item uidNumber
type: uidNumber
vals: 1 item
AttributeValue: 1000000001
PartialAttributeList item gidNumber
type: gidNumber
vals: 1 item
AttributeValue: 1000000001
PartialAttributeList item cn
type: cn
vals: 1 item
AttributeValue: first last
PartialAttributeList item homeDirectory
type: homeDirectory
vals: 1 item
AttributeValue: /home/ipatest
PartialAttributeList item loginShell
type: loginShell
vals: 1 item
AttributeValue: /bin/sh
PartialAttributeList item gecos
type: gecos
vals: 1 item
AttributeValue: first last
PartialAttributeList item objectClass
type: objectClass
vals: 12 items
AttributeValue: top
AttributeValue: person
AttributeValue: organizationalperson
AttributeValue: inetorgperson
AttributeValue: inetuser
AttributeValue: posixaccount
AttributeValue: krbprincipalaux
AttributeValue: krbticketpolicyaux
AttributeValue: ipaobject
AttributeValue: ipasshuser
AttributeValue: ipaSshGroupOfPubKeys
AttributeValue: mepOriginEntry
[Response To: 83]
[Time: 0.003821000 seconds]
Lightweight Directory Access Protocol
LDAPMessage searchResDone(6) success [10 results]
messageID: 6
protocolOp: searchResDone (5)
searchResDone
resultCode: success (0)
matchedDN:
errorMessage:
[Response To: 83]
[Time: 0.003821000 seconds]
SSH and WebGUI auth successful
Updated by Jim Pingle about 4 years ago
Looks like the errors some are seeing (including myself) are from /usr/local/etc/nss_ldap.conf not being setup as a symlink to /var/etc/pam_ldap.conf. On systems that work that file must have been removed manually or edited in some way. I added a line which removes that file before setting up the symlink and now it works for me.
Updated by Max Leighton almost 4 years ago
Tested in
2.5.0-DEVELOPMENT (amd64)
built on Fri Nov 27 07:03:36 EST 2020
FreeBSD 12.2-STABLE
Appears to be working well now. The nss_ldap errors are no longer present. I can successfully authenticate to AD with SSH, and after authentication I'm immediately in a shell, and have to start /etc/rc.initial manually to get the SSH menu.
Updated by Jim Pingle almost 4 years ago
- Status changed from Feedback to Resolved
Updated by Tai Join 10 months ago
I'm having the same issue that Max Leighton had previously about 3 years ago
I'm also able to login via webGUI with LDAP credentials, but attempting to log in via SSH fails with Access Denied.
Just like Max Leighton's case, the LDAP server is also selected as the Authentication Server with Shell Authentication checked, and the Shell Authentication Group is set to the same as my extended query which was also working to allow LDAP login to the GUI.
The only difference is I'm using stunnel with Google LDAP instead of Microsoft AD.
Tested in:
2.7.2-RELEASE (amd64)
built on Fri Dec 8 12:55:00 PST 2023
FreeBSD 14.0-CURRENT
Jan 30 15:20:06 sshd 80256 nss_ldap: could not search LDAP server - Server is unavailable
Jan 30 15:20:06 sshd 80256 nss_ldap: failed to bind to LDAP server ldap://127.0.0.1/: Can't contact LDAP server
Jan 30 15:20:06 sshd 80256 pam_ldap: ldap_simple_bind Can't contact LDAP server
Jan 30 15:20:06 sshd 80256 pam_ldap: reconnecting to LDAP server...
Jan 30 15:20:06 sshd 80256 pam_ldap: ldap_simple_bind Can't contact LDAP server
Jan 30 15:20:05 sshd 57323 Postponed keyboard-interactive for invalid user first.last@domainame.com from 192.168.110.102 port 52767 ssh2 [preauth]
Jan 30 15:20:05 sshd 57323 Failed keyboard-interactive/pam for invalid user first.last@domainame.com from 192.168.110.102 port 52767 ssh2
Jan 30 15:20:05 sshd 57323 error: PAM: Authentication error for illegal user first.last@domainame.com from 192.168.110.102
Jan 30 15:20:05 sshd 80205 nss_ldap: could not search LDAP server - Server is unavailable
Jan 30 15:20:05 sshd 80205 nss_ldap: failed to bind to LDAP server ldap://127.0.0.1/: Can't contact LDAP server
Jan 30 15:20:05 sshd 80205 pam_ldap: ldap_simple_bind Can't contact LDAP server
Jan 30 15:20:05 sshd 80205 pam_ldap: reconnecting to LDAP server...
Jan 30 15:20:05 sshd 80205 pam_ldap: ldap_simple_bind Can't contact LDAP server