From 93d90528cb77f1ab14755151352f0b556b324322 Mon Sep 17 00:00:00 2001 From: John Dennis Date: Dec 01 2015 20:09:53 +0000 Subject: Use Ipsilon specific PAM service file Ipsilon was using the 'remote' PAM service file but that was causing conflicts so instead instead install a 'ipsilon' PAM service file whose initial contents exactly matches the contents of the 'remote' service file. All references to the 'remote' service file were replaced with 'ipsilon'. Because the pam service file is shared between both the form and pam login managers it's not possible to have just one of the login managers install the pam service file. The co-dependance problem is solved by always installing the pam service file irrespecitve of whether the form or pam login managers are used. The presence of an unreferenced pam service file is considered begin. The ipsilon pam service file is located in the source disttribution as a template file, templates/install/pam/ipsilon.pamd. All files under templates/install are installed under /usr/share/ipsilon. The RPM will copies templates/install/pam/ipsilon.pamd into /etc/pam.d/ipsilon when the base package is installed. Ticket: 176 Signed-off-by: John Dennis --- diff --git a/README b/README index 9bde0cc..67edd3e 100644 --- a/README +++ b/README @@ -31,7 +31,7 @@ Prerequisites: Currently there are only two available authentication modules, GSSAPI and PAM. The Kerberos module uses mod_auth_gssapi (which it will configure for you at install time), the Pam module simply uses the PAM stack with a default service -name set to 'remote'. +name set to 'ipsilon'. NOTE: The PAM module is invoked as an unprivileged user so if you are using the pam_unix plugin to authenticate users you'll find out that authentication does diff --git a/contrib/fedora/ipsilon.spec b/contrib/fedora/ipsilon.spec index 8ab4c4e..ecaffc2 100644 --- a/contrib/fedora/ipsilon.spec +++ b/contrib/fedora/ipsilon.spec @@ -42,6 +42,7 @@ Requires: python-jinja2 Requires: python-lxml Requires: python-sqlalchemy Requires: open-sans-fonts +Requires: pam Requires(pre): shadow-utils Requires(post): %_sbindir/semanage, %_sbindir/restorecon Requires(postun): %_sbindir/semanage @@ -245,6 +246,9 @@ mv %{buildroot}%{_defaultdocdir}/%{name} %{buildroot}%{_defaultdocdir}/%{name}-% rm -fr %{buildroot}%{python2_sitelib}/tests ln -s %{_datadir}/fonts %{buildroot}%{_datadir}/ipsilon/ui/fonts +mkdir -p %{buildroot}%{_sysconfdir}/pam.d +cp %{buildroot}%{_datadir}/ipsilon/templates/install/pam/ipsilon.pamd %{buildroot}%{_sysconfdir}/pam.d/ipsilon + #%check # The test suite is not being run because: # 1. The last step of %%install removes the entire test suite @@ -326,6 +330,9 @@ fi %dir %attr(0751,root,root) %{_sharedstatedir}/ipsilon %dir %attr(0751,root,root) %{_sysconfdir}/ipsilon %dir %attr(0750,ipsilon,apache) %{_localstatedir}/cache/ipsilon +%dir %{_datadir}/ipsilon/templates/install/pam +%{_sysconfdir}/pam.d/ipsilon +%{_datadir}/ipsilon/templates/install/pam/*.pamd %files client %{_bindir}/ipsilon-client-install diff --git a/ipsilon/login/authform.py b/ipsilon/login/authform.py index b61d4c9..aac531a 100644 --- a/ipsilon/login/authform.py +++ b/ipsilon/login/authform.py @@ -106,7 +106,7 @@ class Installer(LoginManagerInstaller): def install_args(self, group): group.add_argument('--form', choices=['yes', 'no'], default='no', help='Configure External Form authentication') - group.add_argument('--form-service', action='store', default='remote', + group.add_argument('--form-service', action='store', default='ipsilon', help='PAM service name to use for authentication') def configure(self, opts, changes): diff --git a/ipsilon/login/authpam.py b/ipsilon/login/authpam.py index ed2e72b..59a1436 100644 --- a/ipsilon/login/authpam.py +++ b/ipsilon/login/authpam.py @@ -65,7 +65,7 @@ for authentication. """ pconfig.String( 'service name', 'The name of the PAM service used to authenticate.', - 'remote', + 'ipsilon', readonly=True, ), pconfig.String( @@ -113,7 +113,7 @@ class Installer(LoginManagerInstaller): def install_args(self, group): group.add_argument('--pam', choices=['yes', 'no'], default='no', help='Configure PAM authentication') - group.add_argument('--pam-service', action='store', default='remote', + group.add_argument('--pam-service', action='store', default='ipsilon', help='PAM service name to use for authentication') def configure(self, opts, changes): diff --git a/setup.py b/setup.py index c30aa3b..073ad4f 100755 --- a/setup.py +++ b/setup.py @@ -42,6 +42,8 @@ setup( (DATA+'templates/openid', glob('templates/openid/*')), (DATA+'templates/persona', glob('templates/persona/*.html')), (DATA+'templates/install', glob('templates/install/*.conf')), + (DATA+'templates/install/pam', + glob('templates/install/pam/*.pamd')), (DATA+'templates/install/saml2', glob('templates/install/saml2/*.conf')), (DATA+'templates/admin/providers', diff --git a/templates/install/pam/ipsilon.pamd b/templates/install/pam/ipsilon.pamd new file mode 100644 index 0000000..100ec98 --- /dev/null +++ b/templates/install/pam/ipsilon.pamd @@ -0,0 +1,15 @@ +#%PAM-1.0 +auth substack password-auth +auth include postlogin +account required pam_nologin.so +account include password-auth +password include password-auth +# pam_selinux.so close should be the first session rule +session required pam_selinux.so close +session required pam_loginuid.so +# pam_selinux.so open should only be followed by sessions to be executed in the user context +session required pam_selinux.so open +session required pam_namespace.so +session optional pam_keyinit.so force revoke +session include password-auth +session include postlogin