UNSOLVED
SSH pubkey auth breaks ISI_PRIV_IFS_BACKUP?
Hi!
The idea is to rsync+ssh a specific set of /ifs subdirectories. Transferring the files works fine as long as we use keyboard-interactive / password logins with SSH. SSH+pubkey logins work fine, and the privileges seem fine, but permission to access the files is denied.
I have set up a custom role with the ISI_PRIV_LOGIN_SSH and ISI_PRIV_IFS_BACKUP privileges. I've created a local user which gets granted that role in the "lsa-local-provider:System" provider.
Below is a minimum log that repeats the problem. First, I try accessing the files with a SSH+pubkey login, and get a "Permission denied" accessing /ifs/rmd/Reference. Directly afterwards, I disable the file ~/.ssh/authorized_keys and relogin with a password, and can access the directory contents.
In both cases, 'isi auth id' prints exactly the same privileges + groups.
The only clue so far is from /var/log/auth.log, in which PAM is mentioned for the keyboard-interactive login, but not for the publickey one. There's a few entries below.
Thanks in advance,
- Mikko
$ sudo ssh -i id_ecdsa rsync@isilonsc
Last login: Fri Jul 28 09:43:32 2017 from
Copyright (c) 2001-2016 EMC Corporation. All Rights Reserved.
Copyright (c) 1992-2016 The FreeBSD Project.
Copyright (c) 1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994
The Regents of the University of California. All rights reserved.
Isilon OneFS v8.0.0.4
isilon-1% isi auth id
Ids
-------------------------------------------------------------------
ID Type ID
-------------------------------------------------------------------
UID UID:2001
User SID SID:S-1-5-21-1244593714-4047859767-1368347272-1001
GID GID:1800
Group SID SID:S-1-5-21-1244593714-4047859767-1368347272-800
On Disk User ID UID:2001
On Disk Group ID GID:1800
Additional ID SID:S-1-5-11
-------------------------------------------------------------------
Total: 7
Privileges
------------------------------------
ID Name Access
------------------------------------
ISI_PRIV_LOGIN_SSH SSH Read only
ISI_PRIV_IFS_BACKUP Backup Read only
------------------------------------
Total: 1
Zone Information
----------------------------------------------------------------------
Zone ID ZID Protocol Local Address Remote Address Ifs Restricted
----------------------------------------------------------------------
System 1 17 False
----------------------------------------------------------------------
Total: 1
isilon-1% cat ~/.ssh/authorized_keys
ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBG6UMKzkNtOeMZv2Me6SBhpAp122f6cKUGJm2Uva2/awLezNSoph1v8OoedcUVuO8moXqcOwPxYhMagN5agDCDo= root@zfs03
isilon-1% ls /ifs/rmd/
Reference capture home speedtest
isilon-1% ls /ifs/rmd/Reference
ls: /ifs/rmd/Reference: Permission denied
isilon-1% mv ~/.ssh/authorized_keys ~/.ssh/authorized_keys.disabled
isilon-1% exit
Connection to isilonsc closed.
# Repeating the 100% same command, though it will fall back to keyboard-interactive due to above
$ sudo ssh -i id_ecdsa rsync@isilonsc
Password:
Last login: Fri Jul 28 09:44:36 2017 from
Copyright (c) 2001-2016 EMC Corporation. All Rights Reserved.
Copyright (c) 1992-2016 The FreeBSD Project.
Copyright (c) 1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994
The Regents of the University of California. All rights reserved.
Isilon OneFS v8.0.0.4
isilon-1% isi auth id
Ids
-------------------------------------------------------------------
ID Type ID
-------------------------------------------------------------------
UID UID:2001
User SID SID:S-1-5-21-1244593714-4047859767-1368347272-1001
GID GID:1800
Group SID SID:S-1-5-21-1244593714-4047859767-1368347272-800
On Disk User ID UID:2001
On Disk Group ID GID:1800
Additional ID SID:S-1-5-11
-------------------------------------------------------------------
Total: 7
Privileges
------------------------------------
ID Name Access
------------------------------------
ISI_PRIV_LOGIN_SSH SSH Read only
ISI_PRIV_IFS_BACKUP Backup Read only
------------------------------------
Total: 1
Zone Information
----------------------------------------------------------------------
Zone ID ZID Protocol Local Address Remote Address Ifs Restricted
----------------------------------------------------------------------
System 1 17 False
----------------------------------------------------------------------
Total: 1
isilon-1% ls /ifs/rmd
Reference capture home speedtest
isilon-1% ls /ifs/rmd/Reference
Audio GFX Learning
/var/log/auth.log:
2017-07-28T09:40:34+03:00 <4.6> isilon-1 sshd[41613]: Accepted keyboard-interactive/pam for rsync from port 45368 ssh2
2017-07-28T09:41:23+03:00 <4.6> isilon-1 sshd[41616]: Received disconnect from : 11: disconnected by user
2017-07-28T09:41:23+03:00 <4.6> isilon-1 sshd[41616]: Disconnected from
2017-07-28T09:41:24+03:00 <4.6> isilon-1 sshd[41643]: Accepted publickey for rsync from port 45378 ssh2: ECDSA SHA256:IkOP9DnRpuls4PT4mn1xiX7vQet1BbQ7cUUXDXQPsuI
2017-07-28T09:41:45+03:00 <4.6> isilon-1 sshd[41645]: Received disconnect from : 11: disconnected by user
sjones51
252 Posts
723
0
Posted August 1st, 2017 13:00
Hi pervil,
I ran this by one of the Isilon Support seniors. He agreed that everything looks to be correct, and that you should not be getting permission denied errors. He recommended opening a service request so they can try to reproduce the issue in house. If it is a bug causing this, they will want to get it escalated.
https://onlinesupport.emc.com/SRCreate