isa/sudo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add support for OpenLDAP's TLS_REQCERT setting in ldap.conf.

Browse Source
This commit is contained in:
Todd C. Miller
2018-09-27 09:58:10 -06:00
parent 2121693879
commit c0e8bde104
5 changed files with 133 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
doc/sudoers.ldap.cat
View File

@@ -660,6 +660,32 @@ DDEESSCCRRIIPPTTIIOONN
key database and create a _s_t_a_s_h _f_i_l_e. This option is only
supported by the Tivoli LDAP libraries.
TTLLSS__RREEQQCCEERRTT _l_e_v_e_l
The TTLLSS__RREEQQCCEERRTT parameter controls how the LDAP server's TLS
certificated will be verified (if at all). If the server's TLS
certificate cannot be verified (usually because it is signed by an
unknown certificate authority), ssuuddoo will be unable to connect to
it. The following _l_e_v_e_l values are supported:
never The server certificate will not be requested or
checked.
allow The server certificate will be requested. A missing
or invalid certificate is ignored and not considered
an error.
try The server certificate will be requested. A missing
certificate is ignored but an invalid certificate
will result in a connection error.
demand | _h_a_r_d
The server certificate will be requested. A missing
or invalid certificate will result in a connection
error. This is the default behavior.
This option is only supported by the OpenLDAP libraries. Other
LDAP libraries only support the TTLLSS__CCHHEECCKKPPEEEERR parameter.
TTLLSS__RRAANNDDFFIILLEE _f_i_l_e _n_a_m_e
The TTLLSS__RRAANNDDFFIILLEE parameter specifies the path to an entropy source
for systems that lack a random device. It is generally used in
@@ -985,4 +1011,4 @@ DDIISSCCLLAAIIMMEERR
file distributed with ssuuddoo or https://www.sudo.ws/license.html for
complete details.
Sudo 1.8.25 June 25, 2018 Sudo 1.8.25
Sudo 1.8.26 September 27, 2018 Sudo 1.8.26

41
doc/sudoers.ldap.man.in
View File

@@ -15,7 +15,7 @@
.\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
.\" ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
.\"
.TH "SUDOERS.LDAP" "5" "June 25, 2018" "Sudo @PACKAGE_VERSION@" "File Formats Manual"
.TH "SUDOERS.LDAP" "5" "September 27, 2018" "Sudo @PACKAGE_VERSION@" "File Formats Manual"
.nh
.if n .ad l
.SH "NAME"
@@ -1165,6 +1165,45 @@ utility can be used to manage the key database and create a
This option is only supported by the Tivoli LDAP libraries.
.RE
.TP 6n
\fBTLS_REQCERT\fR \fIlevel\fR
The
\fBTLS_REQCERT\fR
parameter controls how the LDAP server's TLS certificated will be
verified (if at all).
If the server's TLS certificate cannot be verified (usually because it
is signed by an unknown certificate authority),
\fBsudo\fR
will be unable to connect to it.
The following
\fIlevel\fR
values are supported:
.RS 10n
.TP 10n
never
The server certificate will not be requested or checked.
.TP 10n
allow
The server certificate will be requested.
A missing or invalid certificate is ignored and not considered an error.
.TP 10n
try
The server certificate will be requested.
A missing certificate is ignored but an invalid certificate will
result in a connection error.
.TP 10n
demand | \fIhard\fR
The server certificate will be requested.
A missing or invalid certificate will result in a connection error.
This is the default behavior.
.RE
.RS 6n
.sp
This option is only supported by the OpenLDAP libraries.
Other LDAP libraries only support the
\fBTLS_CHECKPEER\fR
parameter.
.RE
.TP 6n
\fBTLS_RANDFILE\fR \fIfile name\fR
The
\fBTLS_RANDFILE\fR

34
doc/sudoers.ldap.mdoc.in
View File

@@ -14,7 +14,7 @@
.\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
.\" ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
.\"
.Dd June 25, 2018
.Dd September 27, 2018
.Dt SUDOERS.LDAP @mansectform@
.Os Sudo @PACKAGE_VERSION@
.Sh NAME
@@ -1063,6 +1063,38 @@ The
utility can be used to manage the key database and create a
.Em stash file .
This option is only supported by the Tivoli LDAP libraries.
.It Sy TLS_REQCERT Ar level
The
.Sy TLS_REQCERT
parameter controls how the LDAP server's TLS certificated will be
verified (if at all).
If the server's TLS certificate cannot be verified (usually because it
is signed by an unknown certificate authority),
.Nm sudo
will be unable to connect to it.
The following
.Ar level
values are supported:
.Bl -tag -width 8n -offset 4n
.It never
The server certificate will not be requested or checked.
.It allow
The server certificate will be requested.
A missing or invalid certificate is ignored and not considered an error.
.It try
The server certificate will be requested.
A missing certificate is ignored but an invalid certificate will
result in a connection error.
.It demand No | Ar hard
The server certificate will be requested.
A missing or invalid certificate will result in a connection error.
This is the default behavior.
.El
.Pp
This option is only supported by the OpenLDAP libraries.
Other LDAP libraries only support the
.Sy TLS_CHECKPEER
parameter.
.It Sy TLS_RANDFILE Ar file name
The
.Sy TLS_RANDFILE

26
plugins/sudoers/ldap_conf.c
View File

@@ -87,6 +87,8 @@ static struct ldap_config_table ldap_conf_global[] = {
#ifdef LDAP_OPT_X_TLS_REQUIRE_CERT
{ "tls_checkpeer", CONF_BOOL, LDAP_OPT_X_TLS_REQUIRE_CERT,
&ldap_conf.tls_checkpeer },
{ "tls_reqcert", CONF_REQCERT_VAL, LDAP_OPT_X_TLS_REQUIRE_CERT,
&ldap_conf.tls_reqcert },
#else
{ "tls_checkpeer", CONF_BOOL, -1, &ldap_conf.tls_checkpeer },
#endif
@@ -403,6 +405,20 @@ sudo_ldap_parse_keyword(const char *keyword, const char *value,
else
*(int *)(cur->valp) = LDAP_DEREF_NEVER;
break;
case CONF_REQCERT_VAL:
#ifdef LDAP_OPT_X_TLS_REQUIRE_CERT
if (strcasecmp(value, "never") == 0)
*(int *)(cur->valp) = LDAP_OPT_X_TLS_NEVER;
else if (strcasecmp(value, "allow") == 0)
*(int *)(cur->valp) = LDAP_OPT_X_TLS_ALLOW;
else if (strcasecmp(value, "try") == 0)
*(int *)(cur->valp) = LDAP_OPT_X_TLS_TRY;
else if (strcasecmp(value, "hard") == 0)
*(int *)(cur->valp) = LDAP_OPT_X_TLS_HARD;
else if (strcasecmp(value, "demand") == 0)
*(int *)(cur->valp) = LDAP_OPT_X_TLS_DEMAND;
#endif
break;
case CONF_BOOL:
*(int *)(cur->valp) = sudo_strtobool(value) == true;
break;
@@ -517,6 +533,7 @@ sudo_ldap_read_config(void)
ldap_conf.version = 3;
ldap_conf.port = -1;
ldap_conf.tls_checkpeer = -1;
ldap_conf.tls_reqcert = -1;
ldap_conf.timelimit = -1;
ldap_conf.timeout = -1;
ldap_conf.bind_timelimit = -1;
@@ -619,6 +636,15 @@ sudo_ldap_read_config(void)
DPRINTF1("tls_checkpeer %s",
ldap_conf.tls_checkpeer ? "(yes)" : "(no)");
}
if (ldap_conf.tls_reqcert != -1) {
DPRINTF1("tls_reqcert %s",
ldap_conf.tls_reqcert == LDAP_OPT_X_TLS_NEVER ? "hard" :
ldap_conf.tls_reqcert == LDAP_OPT_X_TLS_ALLOW ? "allow" :
ldap_conf.tls_reqcert == LDAP_OPT_X_TLS_TRY ? "try" :
ldap_conf.tls_reqcert == LDAP_OPT_X_TLS_HARD ? "hard" :
ldap_conf.tls_reqcert == LDAP_OPT_X_TLS_DEMAND ? "demand" :
"unknown");
}
if (ldap_conf.tls_cacertfile != NULL) {
DPRINTF1("tls_cacertfile %s", ldap_conf.tls_cacertfile);
}

2
plugins/sudoers/sudo_ldap_conf.h
View File

@@ -60,6 +60,7 @@
#define CONF_STR 2
#define CONF_LIST_STR 4
#define CONF_DEREF_VAL 5
#define CONF_REQCERT_VAL 6
#define SUDO_LDAP_CLEAR 0
#define SUDO_LDAP_SSL 1
@@ -85,6 +86,7 @@ struct ldap_config {
int debug;
int ldap_debug;
int tls_checkpeer;
int tls_reqcert;
int timelimit;
int timeout;
int bind_timelimit;