SSSD is the default authentication daemon in Ubuntu it and supports various identity managers. Configuring them (such as FreeIPA, LDAP, Kerberos and others) is out the scope of this guide, but you can refer to man sssd.conf and SSSD official documentation for further reference on the topic.
For the purpose of this guide, we’re going to show how SSSD should be configured for local user access, that is still something useful to enhance the security of a desktop computer, so that the user login is protected by a stronger authentication mechanism.
In the next steps we’ll mention to change sssd.conf file by that we intend that the file in /etc/sssd/sssd.conf must be changed, note that these are just examples and this can be done using:
$ sudoedit /etc/sssd/sssd.conf
sssd.conf file must be owned by root and have permissions set to 600
If this is not the case, the file won’t be loaded by SSSD.
SSSD must be restarted after each configuration change
This can be done with systemctl restart sssd
It’s possible to check if configuration is correct, temporary launching the daemon with sudo sssd -d9 -i
Since SSSD using openssl under the hood, we need to add the certificate to the SSSD well known certificate path (if not changed via sssd.certificate_verification option) as PEM format, so copying the CA certificates (can be a chain of certificates) to /etc/sssd/pki/sssd_auth_ca_db.pem should be enough:
sudo mkdir -p /etc/sssd/pki -m 600
sudo cat Ca-Auth-root-CERT.pem Ca-Auth-leaf-CERT.pem >> /etc/sssd/pki/sssd_auth_ca_db.pem
CA Certificate verification options
The smart card certificate verification against its Certificate Authority certificate can be tuned using various sssd.conf options.
For example:
[sssd]
# To validate a certificate against an incomplete CA chain
certificate_verification = partial_chain
[pam]
# To define a custom ca-certificates path
pam_cert_db_path = /etc/ssl/certs/ca-certificates.crt
Troubleshooting
Card certificate verification can be simulated using SSSD tools directly, by using the command SSSD’s p11_child:
# In ubuntu 20.04
$ sudo /usr/libexec/sssd/p11_child --pre -d 10 --debug-fd=2 --nssdb=/etc/sssd/pki/sssd_auth_ca_db.pem
# In ubuntu 22.04 and later versions
$ sudo /usr/libexec/sssd/p11_child --pre -d 10 --debug-fd=2 --ca_db=/etc/sssd/pki/sssd_auth_ca_db.pem
If the certificate verification succeeds, the tool should output the card certificate name, its ID and the certificate itself in base64 format (other than debug data):
(Mon Sep 11 16:33:32:129558 2023) [p11_child[1965]] [do_card] (0x4000): Found certificate has key id [02].
MARCO TREVISAN (PIN CNS1)
/usr/lib/x86_64-linux-gnu/pkcs11/opensc-pkcs11.so
02
CNS1
MIIHXDCCBUSgAwIBAgIQA1ex7....
For checking if the smartcard works, without doing any verification check (and so for debugging purposes the option) --verify=no_ocsp can also be used, while --verify=partial_chain can be used to do incomplete CA verification.
SSSD is a coordintor of various services, in order to support PAM we need to expcitly enable it in sssd.conf:
[sssd]
services = pam # This line can contain a list of other services
[pam]
pam_cert_auth = True
As explained, in order to make an user safely access to the system via a smart card, we need to associate one of the X.509 certificates that is present in the card to a system user.
The way of doing this changes slightly depending on the authentication provider in use, but as said, we’re going to show the case for local users, that should not differ much from what can be done in more complex setups.
Mapping for more complex configurations can be done following the official SSSD documentation depending on providers.
For local users
This is just an example
Configuration shown here must be adapted to match specific cases
When using only local users, SSSD can be configured to define an implicit_domain that maps all the local users.
Certificates can be associated to users using the card certificate subject, so in our example:
openssl x509 -noout -subject -in card-cert.pem | sed "s/, /,/g;s/ = /=/g"
subject=C=IT,O=Actalis S.p.A.,OU=REGIONE TOSCANA,SN=TREVISAN,GN=MARCO,CN=TRVMRC[...data-removed...]/6090033068507002.UyMnHxfF3gkAeBYHhxa6V1Edazs=
the sssd.conf configuration for the user foo would be:
[sssd]
enable_files_domain = True
services = pam
[certmap/implicit_files/foo]
matchrule = <SUBJECT>.*CN=TRVMRC[A-Z0-9]+/6090033068507002\.UyMnHxfF3gkAeBYHhxa6V1Edazs=.*
[pam]
pam_cert_auth = True
Note that the section where the matchrule regex is, should be in the form [certmap/$PROVIDER/$USER_ID].
Troubleshooting
User mapping can be tested working in versions newer than Ubuntu 20.04 with:
$ sudo dbus-send --system --print-reply \
--dest=org.freedesktop.sssd.infopipe \
/org/freedesktop/sssd/infopipe/Users \
org.freedesktop.sssd.infopipe.Users.ListByCertificate \
string:"$(cat card-cert.pem)" uint32:10
That should return the object path containing the expected user ID:
method return time=1605127192.698667 sender=:1.1628 -> destination=:1.1629 serial=6 reply_serial=2
array [
object path "/org/freedesktop/sssd/infopipe/Users/implicit_5ffiles/1000"
]
Example of SSSD configuration
The SSSD configuration for accessing to the system is out of the scope of this document, however for smart card login it should contain at least such values:
[sssd]
# Comma separated list of domains
;domains = your-domain1, your-domain2
# comma-separated list of SSSD services
# pam might be implicitly loaded already, so the line is optional
services = pam
# You can enable debug of the SSSD daemon
# Logs will be in /var/log/sssd/sssd.log
;debug_level = 10
# A mapping between the Smart Card certificate and users
;[certmap/your-domain1/<username1>]
;matchrule = <SUBJECT>.*CN=<REGEX MATCHING CARD1 CN>.*
;[certmap/your-domain2/<username2>]
;matchrule = <SUBJECT>.*CN=<REGEX MATCHING CARD2 CN>.*
[pam]
pam_cert_auth = True
# The Certificate DB to be used:
# - Needs to be an openSSL CA certificates list
;pam_cert_db_path = /etc/ssl/certs/ca-certificates.crt
# You can enable debug infos for the PAM module
# Logs will be in /var/log/sssd/sssd_pam.log
# p11 child logs are in /var/log/sssd/p11_child.log
# standard auth logs are in /var/log/auth.log
;pam_verbosity = 10
;debug_level = 10
In general what’s in the configuration file will affect the way SSSD will call the p11_child tool (that is the one in charge for the actual authentication).
Check man sssd.conf for details.
Every time the configuration is changed SSSD should be restarted (systemctl restart sssd).
