Red Hat Security: Linux in Physical, Virtual, and Cloud

Before modifying your PAM configuration, open an extra root shell on serverc to recover from errors. Back up the PAM files.

1. Open a new terminal on workstation and log in to serverc as student. No password is required.

   [student@workstation ~]$ ssh student@serverc
   [student@serverc ~]$ 

2. Use the sudo -i command to switch identity to the root user. Use student as the password.

   [student@serverc ~]$ sudo -i
   [sudo] password for student: student
   [root@serverc ~]# 

   Leave this terminal open at all times to recover from potential errors.

3. From another terminal, log in to serverc as student. No password is required.

   [student@workstation ~]$ ssh student@serverc
   [student@serverc ~]$ 

4. Use the sudo -i command to switch identity to the root user. Use student as the password.

   [student@serverc ~]$ sudo -i
   [sudo] password for student: student
   [root@serverc ~]# 

5. Use the authconfig --savebackup=/root/authconfigbackup command to back up the PAM configuration into the /root/authconfigbackup/ directory.

   [root@serverc ~]# authconfig --savebackup=/root/authconfigbackup
   [root@serverc ~]# 

Configure the pam_time module so that users can only log in using SSH or the console between 6 p.m. and 11 p.m. on any given day. This restriction does not apply to root and student; they must be able to log in at any time.

The authconfig command cannot configure the pam_time module. Therefore you need to manually perform this configuration.

1. You need to add the rule for the pam_time module in the /etc/pam.d/system-auth and /etc/pam.d/password-auth files, because most of the PAM-enabled applications include those files, specifically sshd and login (for the console access). If you directly modify these files, however, a subsequent call to authconfig may overwrite them.

   Confirm that /etc/pam.d/system-auth and /etc/pam.d/password-auth are links to the /etc/pam.d/system-auth-ac and /etc/pam.d/password-auth-ac files.

   [root@serverc ~]# ls -l /etc/pam.d/system-auth
   lrwxrwxrwx. 1 root root 14 Mar 22 15:11 /etc/pam.d/system-auth -> system-auth-ac
   [root@serverc ~]# ls -l /etc/pam.d/password-auth
   lrwxrwxrwx. 1 root root 16 Mar 22 15:11 /etc/pam.d/password-auth -> password-auth-ac

   These two *-ac files (ac for AuthConfig) are in fact the ones updated by the authconfig command.

2. Copy system-auth-ac and password-auth-ac files to system-auth-local and password-auth-local. This two local files will contain your modifications.

   [root@serverc ~]# cd /etc/pam.d
   [root@serverc pam.d]# cp system-auth-ac system-auth-local
   [root@serverc pam.d]# cp password-auth-ac password-auth-local

3. Recreate the links to point to your new local files.

   [root@serverc pam.d]# rm system-auth password-auth
   rm: remove symbolic link ‘system-auth’? y
   rm: remove symbolic link ‘password-auth’? y
   [root@serverc pam.d]# ln -s system-auth-local system-auth
   [root@serverc pam.d]# ln -s password-auth-local password-auth
   [root@serverc pam.d]# ls -l system-auth password-auth
   lrwxrwxrwx. 1 root root 19 Jul 12 10:25 password-auth -> password-auth-local
   lrwxrwxrwx. 1 root root 17 Jul 12 10:25 system-auth -> system-auth-local

   You are now ready to add a new rule for the pam_time module.

4. Review the manual page for the pam_time module.

   [root@serverc pam.d]# man pam_time
   ...output omitted...

   This module is only valid for the account management group.

5. Edit your system-auth-local and password-auth-local files and add the new rule before the other account rules.

   [root@serverc pam.d]# vim system-auth-local
   ...output omitted...
   auth        requisite     pam_succeed_if.so uid >= 1000 quiet_success
   auth        required      pam_deny.so
   
   account     required      pam_time.so
   account     required      pam_unix.so
   account     sufficient    pam_localuser.so
   ...output omitted...
   [root@serverc pam.d]# vim password-auth-local
   ...output omitted...
   auth        requisite     pam_succeed_if.so uid >= 1000 quiet_success
   auth        required      pam_deny.so
   
   account     required      pam_time.so
   account     required      pam_unix.so
   account     sufficient    pam_localuser.so
   ...output omitted...

6. Edit the /etc/security/time.conf configuration file to set the time restriction. Add the following line at the end to allow the access between 6 p.m. and 11 p.m. This restriction does not apply to root and student. The configuration requires 24-hour format.

   [root@serverc pam.d]# vim /etc/security/time.conf
   ...output omitted...
   sshd|login;*;!root&student;Al1800-2300

   Consult the time.conf(5) manual page if you need more details.

7. Try to log in to localhost as operator1 using redhat as the password. This should fail.

   [root@serverc pam.d]# ssh operator1@localhost
   The authenticity of host 'localhost (::1)' can't be established.
   ECDSA key fingerprint is SHA256:BMdnasLF5CBGg42Dx77nuXodXdI9dKoEBQGFK5O0HRI.
   ECDSA key fingerprint is MD5:9e:a8:ec:0c:86:d2:70:34:ef:5a:94:15:6d:48:73:db.
   Are you sure you want to continue connecting (yes/no)? yes
   operator1@localhost's password: redhat
   Authentication failed.
   [root@serverc pam.d]# 

   If you are able to log in as operator1, use the date command to verify the system time and review the /etc/security/time.conf file. You might need to adjust the time range in that file to trigger the rule.

   Try to log in to localhost as student using student as the password. This should succeed. Log out when done.

   [root@serverc pam.d]# ssh student@localhost
   student@localhost's password: student
   [student@serverc ~]$ logout
   [root@serverc pam.d]# 

8. Comment out or remove the added line to the /etc/security/time.conf file. The remainder of this exercise may not work as expected otherwise.

   [root@serverc pam.d]# vim /etc/security/time.conf
   ...output omitted...
   # sshd|login;*;!root&student;Al1800-2300

Switch your PAM configuration from the legacy authentication methods to SSSD.

1. Install SSSD and use the authconfig --enablesssdauth --update command to enable SSSD for authentication.

   [root@serverc pam.d]# yum install sssd
   ...output omitted...
   Is this ok [y/d/N]: y
   ...output omitted...
   Complete!
   [root@serverc pam.d]# authconfig  --enablesssdauth --update
   [root@serverc pam.d]# 

2. Because you have redirected the system-auth and password-auth links to your custom files, system-auth-local and password-auth-local, instead of the default system-auth-ac and password-auth-ac files, the update you have just made is not taken into account. Remember that authconfig only modifies the *-ac files.

   Confirm that authconfig has added the rules for pam_sss to the system-auth-ac and password-auth-ac files but not to your custom system-auth-local and password-auth-local files.

   [root@serverc pam.d]# grep pam_sss.so system-auth-ac password-auth-ac
   system-auth-ac:auth        sufficient    pam_sss.so forward_pass
   system-auth-ac:account     [default=bad success=ok user_unknown=ignore] pam_sss.so
   system-auth-ac:password    sufficient    pam_sss.so use_authtok
   system-auth-ac:session     optional      pam_sss.so
   password-auth-ac:auth        sufficient    pam_sss.so forward_pass
   password-auth-ac:account     [default=bad success=ok user_unknown=ignore] pam_sss.so
   password-auth-ac:password    sufficient    pam_sss.so use_authtok
   password-auth-ac:session     optional      pam_sss.so
   [root@serverc pam.d]# grep pam_sss.so \
   > system-auth-local password-auth-local
   [root@serverc pam.d]# 

3. In this exercise, because you want to manually modify the PAM configuration but also keep using the authconfig command, you need to include the *-ac files in your *-local files.

   Edit the system-auth-local file, only keep your custom rules, and include the system-auth-ac file. Your file should look similar to the following:

   [root@serverc pam.d]# vim system-auth-local
   auth     include   system-auth-ac
   
   account  required  pam_time.so
   account  include   system-auth-ac
   
   password include   system-auth-ac
   
   session  include   system-auth-ac

   In the same way, edit your password-auth-local file. It should look similar to the following:

   [root@serverc pam.d]# vim password-auth-local
   auth     include   password-auth-ac
   
   account  required  pam_time.so
   account  include   password-auth-ac
   
   password include   password-auth-ac
   
   session  include   password-auth-ac

   Use the *-local files for your manual modifications. authconfig uses the *-ac files for its own modifications.

Restrict access to your system as follows:

Use the authconfig command to enable the pam_access module and configure the /etc/security/access.conf file.

1. Locate the authconfig option that enables pam_access.

   [root@serverc pam.d]# authconfig --help | grep access
       --enablepamaccess       check access.conf during account authorization
       --disablepamaccess      do not check access.conf during account authorization

2. Enable the pam_access module and verify your work.

   [root@serverc pam.d]# authconfig --enablepamaccess --update
   [root@serverc pam.d]# grep pam_access.so \
   > system-auth-ac password-auth-ac
   system-auth-ac:account     required      pam_access.so
   password-auth-ac:account     required      pam_access.so

3. Edit the /etc/security/access.conf configuration file to apply the restrictions.

   [root@serverc pam.d]# vim /etc/security/access.conf
   ...output omitted...
   +:root student: ALL
   +:(operators):172.25.250.254
   -:ALL:ALL

4. Verify your configuration by trying to log in from workstation to serverc as developer1 using redhat as the password. This should fail because the developer1 user does not belong to the operators group.

   [root@serverc pam.d]# logout
   [student@serverc ~]$ logout
   [student@workstation ~]$ ssh developer1@serverc
   Authentication failed.
   [student@workstation ~]$ 

   Try to log in as operator1. If prompted, use redhat as the password. The connection succeeds because operator1 is a member of the operators group and the connection is originating from workstation. Log out and log in again as student when done.

   [student@workstation ~]$ ssh operator1@serverc
   Last failed login: Wed Jul 18 07:08:29 EDT 2018 from localhost on ssh:notty
   There was 1 failed login attempt since the last successful login.
   [operator1@serverc ~]$ logout
   [student@workstation ~]$ ssh student@serverc
   Last login: Wed Jul 18 07:08:48 2018 from localhost
   [student@serverc ~]$ 

5. Review the log of the sshd daemon and locate the denied access.

   [student@serverc ~]$ journalctl -u sshd
   ...output omitted...
   Jul 12 13:15:25 serverc.lab.example.com sshd[4136]: pam_access(sshd:account): access denied for user 'developer1' from 'workstation.lab.example.com'
   Jul 12 13:15:25 serverc.lab.example.com sshd[4136]: fatal: Access denied for user developer1 by PAM account configuration [preauth]
   ...output omitted...

Use the authconfig command to restore your PAM configuration.

1. Use the sudo -i command to switch identity to the root user. Use student as the password.

   [student@serverc ~]$ sudo -i
   [sudo] password for student: student
   [root@serverc ~]# 

2. Restore the PAM configuration from the /root/authconfigbackup/ directory.

   [root@serverc ~]# authconfig --restorebackup=/root/authconfigbackup
   [root@serverc ~]# 

3. Review the contents of the /etc/pam.d/ directory.

   [root@serverc ~]# ls -l /etc/pam.d/
   ...output omitted...
   lrwxrwxrwx. 1 root root   19 Jul 12 11:26 password-auth -> password-auth-local
   -rw-r--r--. 1 root root 1033 Jul 12 13:30 password-auth-ac
   -rw-r--r--. 1 root root  178 Jul 12 13:14 password-auth-local
   ...output omitted...
   lrwxrwxrwx. 1 root root   17 Jul 12 11:26 system-auth -> system-auth-local
   -rw-r--r--. 1 root root 1031 Jul 12 13:30 system-auth-ac
   -rw-r--r--. 1 root root  170 Jul 12 12:23 system-auth-local
   ...output omitted...

   Notice that the restore process did not remove the links to your *-local files. It only restored the *-ac files and preserved your custom modifications.