HBAC Rule Testing

HBAC rules control who can access what services on what hosts. You can use HBAC to control which users or groups can access a service, or group of services, on a target host.

Since applying HBAC rules implies use of a production environment, this plugin aims to provide simulation of HBAC rules evaluation without having access to the production environment.

Test user coming to a service on a named host against

existing enabled rules.

ipa hbactest —user= —host= —service=

[--rules=rules-list] [--nodetail] [--enabled] [--disabled]
[--sizelimit= ]

—user, —host, and —service are mandatory, others are optional.

If —rules is specified simulate enabling of the specified rules and test

the login of the user using only these rules.

If —enabled is specified, all enabled HBAC rules will be added to simulation

If —disabled is specified, all disabled HBAC rules will be added to simulation

If —nodetail is specified, do not return information about rules matched/not matched.

If both —rules and —enabled are specified, apply simulation to —rules [and]{#and}_

all IPA enabled rules.

If no —rules specified, simulation is run against all IPA enabled rules.

By default there is a IPA-wide limit to number of entries fetched, you can change it

with —sizelimit option.

EXAMPLES

1. Use all enabled HBAC rules in IPA database to simulate: $ ipa hbactest —user=a1a —host=bar —service=sshd

Access granted: True

Not matched rules: my-second-rule
Not matched rules: my-third-rule
Not matched rules: myrule
Matched rules: allow_all

2. Disable detailed summary of how rules were applied:
$ ipa hbactest --user=a1a --host=bar --service=sshd --nodetail
--------------------
Access granted: True
--------------------

3. Test explicitly specified HBAC rules:
$ ipa hbactest --user=a1a --host=bar --service=sshd \$
    --rules=myrule --rules=my-second-rule
---------------------
Access granted: False
---------------------
Not matched rules: my-second-rule
Not matched rules: myrule

4. Use all enabled HBAC rules in IPA database + explicitly specified rules:
$ ipa hbactest --user=a1a --host=bar --service=sshd \$
    --rules=myrule --rules=my-second-rule --enabled
--------------------
Access granted: True
--------------------
Not matched rules: my-second-rule
Not matched rules: my-third-rule
Not matched rules: myrule
Matched rules: allow_all

5. Test all disabled HBAC rules in IPA database:
$ ipa hbactest --user=a1a --host=bar --service=sshd --disabled
---------------------
Access granted: False
---------------------
Not matched rules: new-rule

6. Test all disabled HBAC rules in IPA database + explicitly specified rules:
$ ipa hbactest --user=a1a --host=bar --service=sshd \$
    --rules=myrule --rules=my-second-rule --disabled
---------------------
Access granted: False
---------------------
Not matched rules: my-second-rule
Not matched rules: my-third-rule
Not matched rules: myrule

7. Test all (enabled and disabled) HBAC rules in IPA database:
$ ipa hbactest --user=a1a --host=bar --service=sshd \$
    --enabled --disabled
--------------------
Access granted: True
--------------------
Not matched rules: my-second-rule
Not matched rules: my-third-rule
Not matched rules: myrule
Not matched rules: new-rule
Matched rules: allow_all

HBACTEST AND TRUSTED DOMAINS

When an external trusted domain is configured in IPA, HBAC rules are also applied on users accessing IPA resources from the trusted domain. Trusted domain users and groups (and their SIDs) can be then assigned to external groups which can be members of POSIX groups in IPA which can be used in HBAC rules and thus allowing access to resources protected by the HBAC system.

hbactest plugin is capable of testing access for both local IPA users and users from the trusted domains, either by a fully qualified user name or by user SID. Such user names need to have a trusted domain specified as a short name (DOMAINAdministrator) or with a user principal name (UPN), Administrator@ad.test.

Please note that hbactest executed with a trusted domain user as —user parameter can be only run by members of “trust admins” group.

EXAMPLES

1. Test if a user from a trusted domain specified by its shortname matches any rule:

$ ipa hbactest --user 'DOMAIN\Administrator' --host `hostname` --service sshd
--------------------
Access granted: True
--------------------
  Matched rules: allow_all
  Matched rules: can_login

2. Test if a user from a trusted domain specified by its domain name matches
   any rule:

$ ipa hbactest --user 'Administrator@domain.com' --host `hostname` --service sshd
--------------------
Access granted: True
--------------------
  Matched rules: allow_all
  Matched rules: can_login

3. Test if a user from a trusted domain specified by its SID matches any rule:

$ ipa hbactest --user S-1-5-21-3035198329-144811719-1378114514-500 \$
        --host `hostname` --service sshd
--------------------
Access granted: True
--------------------
  Matched rules: allow_all
  Matched rules: can_login

4. Test if other user from a trusted domain specified by its SID matches any rule:

$ ipa hbactest --user S-1-5-21-3035198329-144811719-1378114514-1203 \$
        --host `hostname` --service sshd
--------------------
Access granted: True
--------------------
  Matched rules: allow_all
  Not matched rules: can_login

5. Test if other user from a trusted domain specified by its shortname matches
   any rule:

$ ipa hbactest --user 'DOMAIN\Otheruser' --host `hostname` --service sshd
--------------------
Access granted: True
--------------------
  Matched rules: allow_all
  Not matched rules: can_login

Commands

---

Command Description

---

hbactest Simulate use of Host-based access controls

---

---

hbactest

Usage: ipa [global-options] hbactest [options]

Simulate use of Host-based access controls

Options

---

Option Description

---

--user USER User name

--host HOST Target host

--service SERVICE Service

--rules RULES Rules to test. If not specified, —enabled is assumed

--nodetail Hide details which rules are matched, not matched, or invalid

--enabled Include all enabled IPA rules into test [default]

--disabled Include all disabled IPA rules into test

--sizelimit SIZELIMIT Maximum number of rules to process when no —rules is specified