[Gelöst] Probleme nach Sicherheitslücke

[Cdn]

Hallo zusammen, nach Veröffentlichung der Sicherheitslücke haben wir unserer Server geupdatet und nun keinen Zugriff mehr via configuration editor:

Code: Alles auswählen

Jan 18  16:41:50.572  2017 -- Opsi service error:  [BackendPermissionDeniedError] Backend permission denied error: Access to method 'group_getObjects' denied for user 'adminuser'
Jan 18  16:41:50.771  2017 -- Opsi service error:  [BackendPermissionDeniedError] Backend permission denied error: Access to method 'objectToGroup_getObjects' denied for user 'adminuser'
Jan 18  16:41:50.852  2017 -- Opsi service error:  [BackendPermissionDeniedError] Backend permission denied error: Access to method 'config_updateObjects' denied for user 'adminuser': Backend permission denied error: Access denied
Jan 18  16:41:51.069  2017 -- Opsi service error:  [BackendPermissionDeniedError] Backend permission denied error: Access to method 'configState_getObjects' denied for user 'adminuser'
Jan 18  16:41:51.069  2017 -- JSONReMapper: Exception on reproducing  null, java.lang.NullPointerException
Jan 18  16:41:51.688  2017 -- Opsi service error:  [BackendPermissionDeniedError] Backend permission denied error: Access to method 'product_getObjects' denied for user 'adminuser'
Jan 18  16:41:51.688  2017 -- JSONReMapper: Exception on reproducing  null, java.lang.NullPointerException
Jan 18  16:41:51.757  2017 -- Opsi service error:  [BackendPermissionDeniedError] Backend permission denied error: Access to method 'productOnDepot_getObjects' denied for user 'adminuser'
Jan 18  16:41:51.758  2017 -- JSONReMapper: Exception on reproducing  null, java.lang.NullPointerException
Jan 18  16:41:51.828  2017 -- Opsi service error:  [BackendPermissionDeniedError] Backend permission denied error: Access to method 'config_getObjects' denied for user 'adminuser'
Jan 18  16:41:51.904  2017 -- Opsi service error:  [BackendPermissionDeniedError] Backend permission denied error: Access to method 'productProperty_getObjects' denied for user 'adminuser'
Jan 18  16:41:51.904  2017 -- JSONReMapper: Exception on reproducing  null, java.lang.NullPointerException
Jan 18  16:41:52.277  2017 -- Opsi service error:  [BackendPermissionDeniedError] Backend permission denied error: Access to method 'config_getObjects' denied for user 'adminuser'
Jan 18  16:41:52.419  2017 -- Opsi service error:  [BackendPermissionDeniedError] Backend permission denied error: Access to method 'group_getObjects' denied for user 'adminuser'
Jan 18  16:41:52.490  2017 -- Opsi service error:  [BackendPermissionDeniedError] Backend permission denied error: Access to method 'objectToGroup_getObjects' denied for user 'adminuser'
Jan 18  16:41:52.559  2017 -- Opsi service error:  [BackendPermissionDeniedError] Backend permission denied error: Access to method 'auditHardware_getConfig' denied for user 'adminuser'
Jan 18  16:41:52.625  2017 -- Opsi service error:  [BackendPermissionDeniedError] Backend permission denied error: Access to method 'productDependency_getObjects' denied for user 'adminuser'
Jan 18  16:41:52.625  2017 -- JSONReMapper: Exception on reproducing  null, java.lang.NullPointerException
Jan 18  16:41:52.695  2017 -- Opsi service error:  [BackendPermissionDeniedError] Backend permission denied error: Access to method 'auditSoftware_getHashes' denied for user 'adminuser'
Jan 18  16:41:52.695  2017 -- JSONReMapper: Exception on reproducing  null, java.lang.NullPointerException

acl.conf sieht so aus:

Code: Alles auswählen

# -*- coding: utf-8 -*-
# = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =
# =      backend acl configuration                                                                              =
# = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =
#
# This file configures access control to protected backend methods.
# Entries has to follow the form:
# <regular expression to match method name(s)> : <semicolon separated list of acl entries>
#
# acl enrties are specified like:
# <entry type>[(<comma separated list of names/ids>[,attributes(<comma separated list of allowed/denied attributes>)])]
#
# For every method the first entry which allows (partial) access is decisive.
#
# Possible types of entries are:
#    all                : everyone
#    sys_user           : a system user
#    sys_group          : a system group
#    opsi_depotserver   : an opsi depot server
#    opsi_client        : an opsi client
#    self               : the object to be read or written
#
# Examples:
#    host_getObjects : self
#       allow clients to read their own host objects
#    host_deleteObjects : sys_user(admin,opsiadmin),sys_group(opsiadmins)
#       allow system users "admin", "opsiadmin" and members of system group "opsiadmins" to delete hosts
#    product_.* : opsi_client(client1.uib.local),opsi_depotserver
#       allow access to product objects to opsi client "client1.uib.local" and all opsi depot servers
#    host_getObjects : sys_user(user1,attributes(id,description,notes))
#       allow partial access to host objects to system user "user1". "user1" is allowed to read object attributes "id", "description", "notes"
#    host_getObjects : sys_group(group1,attributes(!opsiHostKey))
#       allow partial access to host objects to members of system group "group1". Members are allowed to read all object attributes except "opsiHostKey"

backend_deleteBase     : sys_group(opsiadmin)
backend_.*             : all
hostControl.*          : sys_group(opsiadmin); opsi_depotserver
host_get.*             : sys_group(opsiadmin); opsi_depotserver; self; opsi_client(attributes(!opsiHostKey,!description,!lastSeen,!notes,!hardwareAddress,!inventoryNumber))
auditSoftware_delete.* : sys_group(opsiadmin); opsi_depotserver
auditSoftware_.*       : sys_group(opsiadmin); opsi_depotserver; opsi_client
auditHardware_delete.* : sys_group(opsiadmin); opsi_depotserver
auditHardware_.*       : sys_group(opsiadmin); opsi_depotserver; opsi_client
.*_get.*               : sys_group(opsiadmin); opsi_depotserver; opsi_client
.*                     : sys_group(opsiadmin); opsi_depotserver; self

Code: Alles auswählen

 groups adminuser
adminuser : adminuser pcpatch opsiadmin

Jemand eine Idee?

[n.wenselowski]

Hi,

wenn ich mir die folgende Zeile anschaue:

Jan 18 16:41:50.572 2017 -- Opsi service error: [BackendPermissionDeniedError] Backend permission denied error: Access to method 'group_getObjects' denied for user 'adminuser'

Dann ist die zuständige Regel folgende:

Code: Alles auswählen

.*_get.*               : sys_group(opsiadmin); opsi_depotserver; opsi_client

Denke also nicht, dass es an der ACL liegt, für wahrscheinlicher halte ich ein Problem bei der Abfrage der Gruppenmitgliedschaft.
Sind auf dem Server in den Logs weitere Meldungen zu finden, die auf ein Problem hindeuten?

Wir könnten es mit Selbstheilungskräften versuchen:

Code: Alles auswählen

opsi-set-rights
opsi-setup --init-current-config
service opsiconfd restart
service opsipxeconfd restart

Bringt das was?


Gruß

Niko

[n.wenselowski]

Außerdem: funktioniert es denn mit der alten acl.conf?


Gruß

Niko

[Cdn]

Also die Selbstheilungskräft helfen leider nicht. Dabei ist mir aber folgendes aufgefallen: Wir benutzen auf dem Server eine 2 Faktor Authentifizierung für den Nutzer root. Damit komm opsipxeconfd wohl nicht gut klar:

Code: Alles auswählen

root@opsi:/etc/opsi/backendManager# journalctl -xn
-- Logs begin at Mi 2017-01-18 17:33:05 CET, end at Mi 2017-01-18 17:07:18 CET. --
Jan 18 17:07:08 opsi su(pam_google_authenticator)[5117]: Invalid verification code
Jan 18 17:07:08 opsi su[5117]: pam_unix(su:auth): auth could not identify password for [root]
Jan 18 17:07:08 opsi su[5117]: pam_authenticate: Cannot make/remove an entry for the specified session

Das zu deaktivieren bringt allerdings auch keine Abhilfe.

In den logs finde ich nur folgendes:

Code: Alles auswählen

[5] [Jan 18 17:08:50] -----> Executing: group_createHostGroup(u'clientdirectory', u'root of directory', u'', None) (JsonRpc.py|134)
[4] [Jan 18 17:08:50] Failed to read opsi modules file '/etc/opsi/modules': [Errno 2] No such file or directory: u'/etc/opsi/modules' (Backend.py|421)
[5] [Jan 18 17:08:50] -----> Executing: objectToGroup_getObjects() (JsonRpc.py|134)
[3] [Jan 18 17:08:50] Execution error: Backend permission denied error: Access to method 'objectToGroup_getObjects' denied for user 'adminuser' (JsonRpc.py|146)
[4] [Jan 18 17:08:50] Failed RPC on u'objectToGroup_getObjects' with params []: <BackendPermissionDeniedError(u"Access to method 'objectToGroup_getObjects' denied for user 'adminuser'")> (statistics.py|418)
[4] [Jan 18 17:08:50] Failed to read opsi modules file '/etc/opsi/modules': [Errno 2] No such file or directory: u'/etc/opsi/modules' (Backend.py|421)
[5] [Jan 18 17:08:50] -----> Executing: config_updateObjects(<UnicodeConfig(id=u'configed.host_displayfields', description=u'', possibleValues=[u'clientConnected', u'clientCreated', u'clientDescription', u'clientHardwareAddress', u'clientIPAddress', u'clientInv...) (JsonRpc.py|134)
[4] [Jan 18 17:08:50] 1 objects removed by acl, 0 objects left (BackendManager.py|1042)
[3] [Jan 18 17:08:50] Execution error: Backend permission denied error: Access to method 'config_updateObjects' denied for user 'adminuser': Backend permission denied error: Access denied (JsonRpc.py|146)
[4] [Jan 18 17:08:50] Failed to read opsi modules file '/etc/opsi/modules': [Errno 2] No such file or directory: u'/etc/opsi/modules' (Backend.py|421)
[5] [Jan 18 17:08:50] -----> Executing: configState_getObjects([]) (JsonRpc.py|134)
[3] [Jan 18 17:08:50] Execution error: Backend permission denied error: Access to method 'configState_getObjects' denied for user 'adminuser' (JsonRpc.py|146)
[4] [Jan 18 17:08:51] Failed to read opsi modules file '/etc/opsi/modules': [Errno 2] No such file or directory: u'/etc/opsi/modules' (Backend.py|421)
[5] [Jan 18 17:08:51] -----> Executing: product_getObjects([u'productVersion', u'packageVersion', u'id', u'setupScript', u'updateScript', u'uninstallScript', u'alwaysScript', u'onceScript', u'customScript', u'userLoginScript', u'priority', u'advice', u'name',...) (JsonRpc.py|134)
[3] [Jan 18 17:08:51] Execution error: Backend permission denied error: Access to method 'product_getObjects' denied for user 'adminuser' (JsonRpc.py|146)
[4] [Jan 18 17:08:51] Failed to read opsi modules file '/etc/opsi/modules': [Errno 2] No such file or directory: u'/etc/opsi/modules' (Backend.py|421)
[5] [Jan 18 17:08:51] -----> Executing: productOnDepot_getObjects([]) (JsonRpc.py|134)
[3] [Jan 18 17:08:51] Execution error: Backend permission denied error: Access to method 'productOnDepot_getObjects' denied for user 'adminuser' (JsonRpc.py|146)
[4] [Jan 18 17:08:51] Failed to read opsi modules file '/etc/opsi/modules': [Errno 2] No such file or directory: u'/etc/opsi/modules' (Backend.py|421)
[5] [Jan 18 17:08:51] -----> Executing: getProductOrdering(u'') (JsonRpc.py|134)
[3] [Jan 18 17:08:51] Execution error: Backend permission denied error: Access to method 'config_getObjects' denied for user 'adminuser' (JsonRpc.py|146)
[4] [Jan 18 17:08:51] Failed RPC on u'getProductOrdering' with params [u'']: <BackendPermissionDeniedError(u"Access to method 'config_getObjects' denied for user 'adminuser'")> (statistics.py|418)
[4] [Jan 18 17:08:51] Failed to read opsi modules file '/etc/opsi/modules': [Errno 2] No such file or directory: u'/etc/opsi/modules' (Backend.py|421)
[5] [Jan 18 17:08:51] -----> Executing: productProperty_getObjects([]) (JsonRpc.py|134)
[3] [Jan 18 17:08:51] Execution error: Backend permission denied error: Access to method 'productProperty_getObjects' denied for user 'adminuser' (JsonRpc.py|146)
[4] [Jan 18 17:08:52] Failed to read opsi modules file '/etc/opsi/modules': [Errno 2] No such file or directory: u'/etc/opsi/modules' (Backend.py|421)
[5] [Jan 18 17:08:52] -----> Executing: getProductOrdering(None) (JsonRpc.py|134)
[3] [Jan 18 17:08:52] Execution error: Backend permission denied error: Access to method 'config_getObjects' denied for user 'adminuser' (JsonRpc.py|146)
[4] [Jan 18 17:08:52] Failed RPC on u'getProductOrdering' with params [None]: <BackendPermissionDeniedError(u"Access to method 'config_getObjects' denied for user 'adminuser'")> (statistics.py|418)
[4] [Jan 18 17:08:52] Failed to read opsi modules file '/etc/opsi/modules': [Errno 2] No such file or directory: u'/etc/opsi/modules' (Backend.py|421)
[5] [Jan 18 17:08:52] -----> Executing: getDomain() (JsonRpc.py|134)
[4] [Jan 18 17:08:52] Failed to read opsi modules file '/etc/opsi/modules': [Errno 2] No such file or directory: u'/etc/opsi/modules' (Backend.py|421)
[3] [Jan 18 17:08:52] Execution error: Backend permission denied error: Access to method 'group_getObjects' denied for user 'adminuser' (JsonRpc.py|146)
[4] [Jan 18 17:08:52] Failed to read opsi modules file '/etc/opsi/modules': [Errno 2] No such file or directory: u'/etc/opsi/modules' (Backend.py|421)
[3] [Jan 18 17:08:52] Execution error: Backend permission denied error: Access to method 'objectToGroup_getObjects' denied for user 'adminuser' (JsonRpc.py|146)
[4] [Jan 18 17:08:52] Failed to read opsi modules file '/etc/opsi/modules': [Errno 2] No such file or directory: u'/etc/opsi/modules' (Backend.py|421)
[5] [Jan 18 17:08:52] -----> Executing: getOpsiHWAuditConf(u'de_DE') (JsonRpc.py|134)
[3] [Jan 18 17:08:52] Execution error: Backend permission denied error: Access to method 'auditHardware_getConfig' denied for user 'adminuser' (JsonRpc.py|146)
[4] [Jan 18 17:08:52] Failed RPC on u'getOpsiHWAuditConf' with params [u'de_DE']: <BackendPermissionDeniedError(u"Access to method 'auditHardware_getConfig' denied for user 'adminuser'")> (statistics.py|418)
[4] [Jan 18 17:08:52] Failed to read opsi modules file '/etc/opsi/modules': [Errno 2] No such file or directory: u'/etc/opsi/modules' (Backend.py|421)
[5] [Jan 18 17:08:52] -----> Executing: productDependency_getObjects([]) (JsonRpc.py|134)
[3] [Jan 18 17:08:52] Execution error: Backend permission denied error: Access to method 'productDependency_getObjects' denied for user 'adminuser' (JsonRpc.py|146)
[4] [Jan 18 17:08:52] Failed to read opsi modules file '/etc/opsi/modules': [Errno 2] No such file or directory: u'/etc/opsi/modules' (Backend.py|421)
[5] [Jan 18 17:08:52] -----> Executing: auditSoftware_getHashes([u'name', u'version', u'subVersion', u'language', u'architecture', u'windowsSoftwareId']) (JsonRpc.py|134)
[3] [Jan 18 17:08:52] Execution error: Backend permission denied error: Access to method 'auditSoftware_getHashes' denied for user 'adminuser' (JsonRpc.py|146)

[Cdn]

Außerdem: funktioniert es denn mit der alten acl.conf?


Gruß

Niko

Wir haben die Konfig nicht angepasst. OPSI wurde die Nacht mit cron-apt aktualisiert und so sieht unsere acl.conf seitdem aus. Genau wie die acl.conf.default

[n.wenselowski]

Hi,

die beiden Files sind idR gelinkt und wer eine eigene Variante einspielen mag, der löst diesen Link dann auf.

Radikler Versuch, aber vielleicht einfach zielführend: schon mal einen Restart des Servers versucht?

EDIT: ich habe hier auf einem Testsytem mit alter stable-config ein Update auf die neue Version gemacht und das mit dem Login läuft wie heiße Butter. Der Server fährt alles Standard.


Gruß

Niko

[Cdn]

Ja server wurde bereits restartet hilft leider auch nicht. Adminuser scheint ja auch in der opsiadmingruppe zu sein...Hat opsiconfd irgendwie keinen Zugriff auf die Gruppe?

EDIT: Ich habe jetzt auch mal die beiden Zeilen auskommentiert
backend_deleteBase : sys_group(opsiadmin)
hostControl.* : sys_group(opsiadmin); opsi_depotserver

Fehler tritt trotzdem auf. Ist nur komisch, dass das Problem gerade genau dann auftritt, wenn OPSI aktualisiert wird.

[n.wenselowski]

Hi,

Ursache würde mich auch interessieren.

Kannst du temporär das Loglevel des opsiconfd auf 7 stellen und dann das Log für die IP, von der du dich anmeldest aufmachen und schauen, was gemeldet wird, wenn du versuchst dich anzumelden?

Siehst du Trying to authenticate by operating system... und kurz darauf Operating system authentication successful for user mit Angabe von User und seinen Gruppen? Sind da die passenden Gruppen für deinen User gelistet?


Gruß

Niko

[n.wenselowski]

Hi,

was mir noch einfällt: läuft auf dem Server vllt ein Security-Framework wie SELinux / AppArmor / ...?


Gruß

Niko

[Cdn]

Oh mahn. Gut, dass du vom Loglevel gesprochen hast. Habe mir daraufhin mal die opsiconfd.conf genauer angeschaut. Da hat wohl jemand an den admin networks rumgespielt und mich in meinem Subnetzbereich ausgeschlossen

Sorry für die Aufregung! Habs geändert jetzt läuft alles wieder.