Comments (4)
Hi,
I am not sure if I made it clear enough how severe the issue#1 is in my previous post the other day, I will let the code speak for itself. I use login_duo as example, pam_duo is applicable for the same issue, because it follow the same logic.
- In do_auth() of login_duo.c, duo_config_default() initialize the default conf as follows. Plz notice that failmode = DUO_FAIL_SAFE is hard-coded.
duo_config_default(struct duo_config *cfg)
{
memset(cfg, 0, sizeof(struct duo_config));
cfg->failmode = DUO_FAIL_SAFE;
cfg->prompts = MAX_PROMPTS;
cfg->local_ip_fallback = 0;
cfg->https_timeout = -1;
cfg->fips_mode = 0;
cfg->gecos_username_pos = -1;
cfg->gecos_delim = ',';
}
- If conf file don't exist, duo_parse_config() return -1
duo_parse_config(const char *filename,
int (*callback)(void *arg, const char *section,
const char *name, const char *val), void *arg)
{
FILE *fp;
struct stat st;
int fd, ret;
if ((fd = open(filename, O_RDONLY)) < 0) {
return (-1);
}
- An error message(through stderr) is generated in the switch-case statement and eventually return EXIT_SUCCESS
if ((i = duo_parse_config(config, __ini_handler, &cfg)) != 0 ||
...
case -1:
fprintf(stderr, "Couldn't open %s: %s\n",
config, strerror(errno));
break;
...
/* Implicit "safe" failmode for local configuration errors */
if (cfg.failmode == DUO_FAIL_SAFE) {
return (EXIT_SUCCESS);
}
- login_duo pass through w/o even an error record on syslog about the issue.
I don't actually know how widely duo_unix is used in production. As a system admin I accept, I don't like, but I accept that I make mistake. Accidentally removing a conf file from the production system do happen, just like what happened to Notam the other day.
I don't know if this issue deserve a security advisory, but, honestly speaking, Duo's current design is against my better instincts and it don't make me feel secure.
About my point#2 on pam_duo's behavior for those not a member of the group, can you plz review you proposal.
By X/Open's spec on PAM, every implementation of PAM shall be capable to handle return code PAM_IGNORE along with PAM_SUCCESS from pam_sm_authenticate().
https://pubs.opengroup.org/onlinepubs/8329799/toc.pdf
What I am looking for is to add another directive and give sysadmin discretion to make the call on return code of duo_check_groups() either PAM_SUCCESS or PAM_IGNORE. Code snippet is attached as follows.
} else if (matched == 0) {
duo_syslog(LOG_INFO, "User %s bypassed Duo 2FA due to user's UNIX group", user);
close_config(&cfg);
return (PAM_SUCCESS);
}
from duo_unix.
@haoshu Regarding item 1:
FYI, Duo Unix is used pretty widely in production, though use of a custom configuration file is very rare. Most people use the default config files.
My concern with your suggestion is that if
A) pam_duo fails closed in the case of a missing or invalid config
and
B) The config file gets deleted or otherwise made unusable
now you are locked out of your system because PAM will fail.
This could be especially bad during initial setup and configuration of duo unix, when the chance of making a mistake is fairly high and could lead to a lot of lock outs, especially for less experienced administrators.
from duo_unix.
Regarding item 2, we'll review your idea and get back to you with questions.
from duo_unix.
@AaronAtDuo
Got your point on item 1. I agree, fail-secure come with price, and as what you pointed out, first-time user experience for sysadmin can be terrible to make Duo fail-secure by nature. Can I suggest a tiny change: login_duo shall at least generate an error syslog(instead of stderr) about this issue, just like what pam_duo do(non-debug mode) in the same circumstance.
Appreciate your consideration on item 2. Though I have no visibility on the other Unix variants, Linux-PAM handle PAM_IGNORE pretty well.
https://github.com/linux-pam/linux-pam/blob/master/libpam/pam_handlers.c
from duo_unix.
Related Issues (20)
- Are there any tips as to how to get NetDrive or SSHFS to work with pam_duo? HOT 2
- Autopush should be configurable by device, not globally HOT 2
- login_duo: no selection output and automatically pushes to first phone in list with eternal terminal HOT 2
- duo_unix-1.12.1-4.el8 and setuid HOT 3
- Duo Unix 2.x RPM Digests on RHEL 8 with FIPS enabled HOT 7
- Bbbb
- More of a feature request, would like to have ,push# implemented like the Fortinet VPN module has HOT 2
- PAM_SUCCESS returned for non-duo users instead of PAM_IGNORE HOT 8
- /usr/sbin/login_duo returning no such file or directory after fresh install of duo HOT 1
- Manpages (login_duo/login_duo.8, pam_duo/pam_duo.8) hardcodes /etc instead of adjusting path according to --prefix
- Choice of the second factor should have a default value
- 8.8.8.8 DNS Server is hardcoded HOT 1
- duo_unix not working with openssl 3.0.8 HOT 4
- Order of DUO Devices Displayed Incorrectly for Users with 10 or More Devices HOT 3
- Duo UNIX PAM module failing on AIX
- Wrong path for duo configuration file in duo_unix-2.0.3 HOT 4
- Autopush with password pushes prompt twice HOT 5
- https_init: result from `RAND_load_file` is unchecked
- Setting https_timeout does not invoke failsafe mode as documented
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from duo_unix.