Overview

Part 5 of the Identity series tests FreeIPA Host-Based Access Control in practice. The goal is not just a nice rule in the Web UI, but proven client behavior: who can SSH to which host, who is denied and what happens when user groups, host groups and rules change?

CLI output is rendered as text and code blocks. Screenshots show the FreeIPA Web UI and come only from the C3 HBAC lab.

https://ipa01.example.test/ipa/ui/

FreeIPA Web UI after authenticated login. Screenshot from the isolated FreeIPA C3 HBAC lab.

Lab Setup

bash
Server:        ipa01.example.test
Clients:       client01.example.test, client02.example.test
Domain:        example.test
Realm:         EXAMPLE.TEST
FreeIPA:       4.13.3
SSSD IPA:      2.13.1
SELinux:       Enforcing

Why allow_all Is Not the Target State

FreeIPA ships with an allow_all rule. For targeted access control, that rule must be disabled or deliberately accounted for. The lab disabled allow_all and replaced it with a specific SSH rule.

https://ipa01.example.test/ipa/ui/

FreeIPA HBAC rule overview with disabled allow_all and custom SSH rule. Screenshot from the isolated FreeIPA C3 HBAC lab.

https://ipa01.example.test/ipa/ui/

FreeIPA HBAC allow_all rule is disabled. Screenshot from the isolated FreeIPA C3 HBAC lab.

Building an SSH HBAC Rule

The rule connects three things: a user group, a host group and the sshd service. Only when all three match is SSH access allowed.

bash
ipa hbacrule-disable allow_all
ipa group-add linux-ssh-users --desc='Users allowed to access Linux servers over SSH'
ipa hostgroup-add linux-servers --desc='Linux servers targeted by HBAC SSH rule'
ipa hostgroup-add-member linux-servers --hosts=client01.example.test
ipa hbacrule-add linux-ssh-users-to-linux-servers-sshd \
  --desc='Allow linux-ssh-users to use sshd on linux-servers'
ipa hbacrule-add-user linux-ssh-users-to-linux-servers-sshd --groups=linux-ssh-users
ipa hbacrule-add-host linux-ssh-users-to-linux-servers-sshd --hostgroups=linux-servers
ipa hbacrule-add-service linux-ssh-users-to-linux-servers-sshd --hbacsvcs=sshd
bash
Rule name: linux-ssh-users-to-linux-servers-sshd
Enabled: True
User Groups: linux-ssh-users
Host Groups: linux-servers
HBAC Services: sshd
https://ipa01.example.test/ipa/ui/

FreeIPA HBAC rule for linux-ssh-users, linux-servers and sshd. Screenshot from the isolated FreeIPA C3 HBAC lab.

User Group and Users

The hbac-allowed user is a member of linux-ssh-users. The hbac-denied user also exists and resolves through SSSD, but initially has no allowing group membership.

https://ipa01.example.test/ipa/ui/

FreeIPA user group linux-ssh-users. Screenshot from the isolated FreeIPA C3 HBAC lab.

https://ipa01.example.test/ipa/ui/

FreeIPA user hbac-allowed as allowed SSH user. Screenshot from the isolated FreeIPA C3 HBAC lab.

https://ipa01.example.test/ipa/ui/

FreeIPA user hbac-denied without allowing group membership. Screenshot from the isolated FreeIPA C3 HBAC lab.

Host Group and SSH Service

The linux-servers host group initially contains client01.example.test. client02.example.test is added later to verify that changing the host group changes real SSH access.

https://ipa01.example.test/ipa/ui/

FreeIPA host group linux-servers with client hosts. Screenshot from the isolated FreeIPA C3 HBAC lab.

https://ipa01.example.test/ipa/ui/

FreeIPA host client01.example.test. Screenshot from the isolated FreeIPA C3 HBAC lab.

https://ipa01.example.test/ipa/ui/

FreeIPA host client02.example.test. Screenshot from the isolated FreeIPA C3 HBAC lab.

https://ipa01.example.test/ipa/ui/

FreeIPA HBAC service sshd. Screenshot from the isolated FreeIPA C3 HBAC lab.

Prediction with ipa hbactest

ipa hbactest is useful, but it is not the final acceptance gate. The lab used it as a prediction and then validated the result with real SSH connections.

bash
ipa hbactest --user=hbac-allowed --host=client01.example.test --service=sshd
ipa hbactest --user=hbac-denied --host=client01.example.test --service=sshd
ipa hbactest --user=hbac-allowed --host=client02.example.test --service=sshd
bash
Access granted: True
Matched rules: linux-ssh-users-to-linux-servers-sshd


Access granted: False
Not matched rules: linux-ssh-users-to-linux-servers-sshd

Real SSH Allow Test

The allowed user could SSH to client01.example.test. This proves that FreeIPA, SSSD, PAM and OpenSSH work together.

bash
hbac-allowed
uid=1847600003(hbac-allowed) gid=1847600003(hbac-allowed) groups=1847600003(hbac-allowed),1847600006(linux-ssh-users)
client01.example.test
/home/hbac-allowed

Real SSH Deny Test

The unauthorized user was visible through getent and id, but SSH access was denied. This distinction matters: identity lookup is not the same as permitted login.

bash
hbac-denied:*:1847600004:1847600004:HBAC Denied:/home/hbac-denied:/bin/bash
uid=1847600004(hbac-denied) gid=1847600004(hbac-denied) groups=1847600004(hbac-denied)

User Group Changes Affect SSH

After adding hbac-denied to linux-ssh-users, SSH access worked. After removing the membership, access was denied again.

bash
ipa group-add-member linux-ssh-users --users=hbac-denied
ipa group-remove-member linux-ssh-users --users=hbac-denied
bash
hbac-denied
uid=1847600004(hbac-denied) gid=1847600004(hbac-denied) groups=1847600004(hbac-denied),1847600006(linux-ssh-users)
client01.example.test
/home/hbac-denied

Host Group Changes Affect SSH

client02.example.test was initially outside linux-servers and denied. After adding the host to the group, access worked.

bash
ipa hostgroup-add-member linux-servers --hosts=client02.example.test
bash
hbac-allowed
uid=1847600003(hbac-allowed) gid=1847600003(hbac-allowed) groups=1847600003(hbac-allowed),1847600006(linux-ssh-users)
client02.example.test
/home/hbac-allowed

Disable and Re-enable the Rule

Disabling the custom HBAC rule denied access. After re-enabling it and refreshing SSSD, access was restored.

bash
ipa hbacrule-disable linux-ssh-users-to-linux-servers-sshd
ipa hbacrule-enable linux-ssh-users-to-linux-servers-sshd
sss_cache -E
bash
user: hbac-allowed
action: acct
service: sshd


testing pam_acct_mgmt
pam_acct_mgmt: Success


hbac-allowed
client01.example.test
/home/hbac-allowed

Result Check

HBAC

Check
disable allow_all
Expected result
Blanket access is off
Status
PASS

HBAC

Check
custom SSH rule
Expected result
User group, host group and sshd are linked
Status
PASS

Prediction

Check
ipa hbactest
Expected result
Allow and deny cases match
Status
PASS

SSH

Check
allowed user
Expected result
Login to allowed host works
Status
PASS

SSH

Check
unauthorized user
Expected result
Identity lookup yes, SSH no
Status
PASS

SSH

Check
host outside host group
Expected result
Login is denied
Status
PASS

Changes

Check
change user group
Expected result
SSH access follows group membership
Status
PASS

Changes

Check
change host group
Expected result
SSH access follows host group membership
Status
PASS

Recovery

Check
disable/enable rule
Expected result
Deny and recovery work
Status
PASS

Web UI

Check
authenticated screenshots
Expected result
HBAC objects visible
Status
PASS

Limits of This Lab

  • The lab tests HBAC for SSH and the sshd service. Other services require separate validation.

  • Production environments need a role model, break-glass access and documented recovery processes.

  • The Web UI screenshots used a local CONNECT proxy so the browser could use the canonical FreeIPA hostname without binding a privileged port.