openssh unix dev - Feb 2019 - sshd and pam_winbind (Samba)

Hello openssh developers,

long time no see :-)

there is a bug in sshd with *nix machines joined to Active Directory using 
Samba's winbind daemon.

The problem is that with cold caches, a user logging in via ssh gets possibly 
the wrong primary gid assigned. Let me try to explain in detail:

In Active Directory (AD) you only get a correct access token (group 
memberships of a user) during authentication. Only a Domain Controller (DC) is 
able to calculate the access token as it as the required permission to collect 
the information in the forest.

When Samba authenticates a user using winbindd. We either authenticate the 
user using Kerberos or NTLM. We get the access token sent back upon successful 
authentication and store it in a cache. All system calls like getent are 
answered looking up the information from that cache.

On a new connection the openssh server checks if the connecting username 
exists using getpwnam() it then stores the 'struct passwd' in the
session
structure.

If the gets authenticated using PAM through pam_winbind we authencticate the 
user against our DC, get correct access token and cache it. However the 
openssh server doesn't update the passwd structure after a successful PAM 
authentication, it sets up the user context (setuid, setgid, initgroups) using 
the outdated information stored in the session structure.

The openssh server should update the passwd structure using getpwuid() before 
it sets up the users context (setuid, setgid, initgroups)!

This is probably easy to fix, the question is when you want to call getpwuid() 
directly after a successful PAM conversation or before dropping privileges?


Best regards,


	Andreas



-- 
Andreas Schneider                 asn at cryptomilk.org
GPG-ID:     8DFF53E18F2ABC8D8F3C92237EE0FC4DCC014E3D

On Mon, 11 Feb 2019, Andreas Schneider wrote:
> Hello openssh developers,
> 
> long time no see :-)
> 
> there is a bug in sshd with *nix machines joined to Active Directory using 
> Samba's winbind daemon.
> 
> The problem is that with cold caches, a user logging in via ssh gets
possibly
> the wrong primary gid assigned. Let me try to explain in detail:
> 
> In Active Directory (AD) you only get a correct access token (group 
> memberships of a user) during authentication. Only a Domain Controller (DC)
is
> able to calculate the access token as it as the required permission to
collect
> the information in the forest.
> 
> When Samba authenticates a user using winbindd. We either authenticate the 
> user using Kerberos or NTLM. We get the access token sent back upon
successful
> authentication and store it in a cache. All system calls like getent are 
> answered looking up the information from that cache.
> 
> On a new connection the openssh server checks if the connecting username 
> exists using getpwnam() it then stores the 'struct passwd' in the
session
> structure.
> 
> If the gets authenticated using PAM through pam_winbind we authencticate
the
> user against our DC, get correct access token and cache it. However the 
> openssh server doesn't update the passwd structure after a successful
PAM
> authentication, it sets up the user context (setuid, setgid, initgroups)
using
> the outdated information stored in the session structure.
> 
> The openssh server should update the passwd structure using getpwuid()
before
> it sets up the users context (setuid, setgid, initgroups)!
> 
> This is probably easy to fix, the question is when you want to call
getpwuid()
> directly after a successful PAM conversation or before dropping privileges?
I don't want to support struct passwd fiddling via PAM - it makes the
server considerably more difficult to reason about. I'm pretty sure
the other developers feel the same way.

IMO a nis/nsswitch module is the right way to implement this sort of
functionality.

-d

On Tuesday, February 12, 2019 12:06:06 AM CET Damien Miller
wrote:
> On Mon, 11 Feb 2019, Andreas Schneider wrote:
> > Hello openssh developers,
> > 
> > long time no see :-)
> > 
> > there is a bug in sshd with *nix machines joined to Active Directory
using
> > Samba's winbind daemon.
> > 
> > The problem is that with cold caches, a user logging in via ssh gets
> > possibly the wrong primary gid assigned. Let me try to explain in
detail:
> > 
> > In Active Directory (AD) you only get a correct access token (group
> > memberships of a user) during authentication. Only a Domain Controller
> > (DC) is able to calculate the access token as it as the required
> > permission to collect the information in the forest.
> > 
> > When Samba authenticates a user using winbindd. We either authenticate
the
> > user using Kerberos or NTLM. We get the access token sent back upon
> > successful authentication and store it in a cache. All system calls
like
> > getent are answered looking up the information from that cache.
> > 
> > On a new connection the openssh server checks if the connecting
username
> > exists using getpwnam() it then stores the 'struct passwd' in
the session
> > structure.
> > 
> > If the gets authenticated using PAM through pam_winbind we
authencticate
> > the user against our DC, get correct access token and cache it.
However
> > the openssh server doesn't update the passwd structure after a
successful
> > PAM authentication, it sets up the user context (setuid, setgid,
> > initgroups) using the outdated information stored in the session
> > structure.
> > 
> > The openssh server should update the passwd structure using getpwuid()
> > before it sets up the users context (setuid, setgid, initgroups)!
> > 
> > This is probably easy to fix, the question is when you want to call
> > getpwuid() directly after a successful PAM conversation or before
> > dropping privileges?
> I don't want to support struct passwd fiddling via PAM - it makes the
> server considerably more difficult to reason about. I'm pretty sure
> the other developers feel the same way.
I don't really see why a getpwuid() would make it more complex. As it seems 
not clear what I mean, see attached patch.
 
> IMO a nis/nsswitch module is the right way to implement this sort of
> functionality.
We have a nss_winbind modules and it will provide correct user information 
after the user has been successfully authenticated. For that you need to read 
the user information after successful login.

I hope the patch makes it clear.


Best regards,


	Andreas

-- 
Andreas Schneider                 asn at cryptomilk.org
GPG-ID:     8DFF53E18F2ABC8D8F3C92237EE0FC4DCC014E3D
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-session-Update-the-passwd-structure-after-successful.patch
Type: text/x-patch
Size: 1362 bytes
Desc: not available
URL:
<http://lists.mindrot.org/pipermail/openssh-unix-dev/attachments/20190212/12856a01/attachment.bin>