You are viewing a plain text version of this content. The canonical link for it is here.
Posted to user@guacamole.apache.org by Zer0Cool <me...@gmail.com> on 2019/06/11 12:34:46 UTC
AD/LDAP Old/Disabled Users Still Listed?
Guac: 1.0.0
OS: CentOS 7.6
Using the LDAP extension to connect with a pretty simple AD and using a
mariaDB database for authentication/users (aka not changing the AD/LDAP
side) with LDAPS.
Using the following filter via "ldap-user-search-filter" in
guacamole.properties:
(&(objectCategory=person)(objectClass=user)(userAccountControl=512))
Essentially this should (and seems to initially) filter out any account that
is not an enabled/active standard user account with a password that expires.
So accounts with passwords that do not expire should not be listed and
disabled accounts should not be listed.
Periodically I disable accounts for users who are no longer active. However
these accounts appear to stay visible in the list of users in Guacamole. I
have not tried logging into an old account to see if it works yet but am
wondering why these do not get removed when they no longer meet the filter
criteria?
Is this expected behavior? Do I need to manually remove these accounts in
Guac? Do I need to some how manually apply the filter again?
Thanks
PS: The reverse of this issue works just fine. As soon as I add a new user
to AD, they show up in Guac as expected immediately.
--
Sent from: http://apache-guacamole-general-user-mailing-list.2363388.n4.nabble.com/
---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@guacamole.apache.org
For additional commands, e-mail: user-help@guacamole.apache.org
Re: AD/LDAP Old/Disabled Users Still Listed?
Posted by Mike Jumper <mj...@apache.org>.
On Fri, Jun 14, 2019, 14:35 sciUser <sh...@securitycentric.net> wrote:
> Yes, you are correct this is because Guacamole is Linux based, if you force
> non-case sensitive on the Linux system for LDAP, this will break the
> security of the box. I have found it best to have a parse interpreter
> taking upper case make them lower when talking to Linux.
I wouldn't say this breaks security, nor is this due to the Guacamole
server running on Linux. The auth system of Guacamole is completely
independent of the server's OS.
There is no current option for this in Guacamole specifically, but if the
administrator of the systems involved were to decide "usernames are case
insensitive in my domain", that's a perfectly valid means of defining
identity. All that matters is that the systems that deal with that identity
are consistent in their definition.
- Mike
Re: AD/LDAP Old/Disabled Users Still Listed?
Posted by sciUser <sh...@securitycentric.net>.
Yes, you are correct this is because Guacamole is Linux based, if you force
non-case sensitive on the Linux system for LDAP, this will break the
security of the box. I have found it best to have a parse interpreter
taking upper case make them lower when talking to Linux.
Thank You
-----
A Cybersecurity Enablement Company
We don't just run you through the motions, Our labs teach you how to think!
Known good Guacamole installations
--
Sent from: http://apache-guacamole-general-user-mailing-list.2363388.n4.nabble.com/
---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@guacamole.apache.org
For additional commands, e-mail: user-help@guacamole.apache.org
Re: AD/LDAP Old/Disabled Users Still Listed?
Posted by "Hankins, Jonathan" <jh...@homewood.k12.al.us>.
Yes, but my point was that when guacamole reads the username from the login
form and does the LDAP query against AD, the marching is done case
sensitively, and will fail if your AD sAMAccountName or cn is in mixed case.
For example: AD user JoeUser can login to their Windows workstation as
"joeuser", but must login to guacamole as "JoeUser" (and also must be in
the Guacamole DB as "JoeUser") when authenticating against LDAP, IIRC.
Just something I ran into in my environment.
-Jonathan Hankins
On Fri, Jun 14, 2019 at 3:43 PM sciUser <sh...@securitycentric.net>
wrote:
> Windows usernames by default are not case sensitive, Active directory is
> case
> aware, unless you enable it to be case sensitive.
>
> Thank You
>
>
>
> -----
> A Cybersecurity Enablement Company
> We don't just run you through the motions, Our labs teach you how to
> think!
> Known good Guacamole installations
>
> --
> Sent from:
> http://apache-guacamole-general-user-mailing-list.2363388.n4.nabble.com/
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: user-unsubscribe@guacamole.apache.org
> For additional commands, e-mail: user-help@guacamole.apache.org
>
>
--
------------------------------------------------------------------------
Jonathan Hankins Homewood City Schools
jhankins@homewood.k12.al.us
------------------------------------------------------------------------
--
This e-mail is intended only for the recipient and may contain confidential
or proprietary information. If you are not the intended recipient, the
review, distribution, duplication or retention of this message and its
attachments is prohibited. Please notify the sender of this error
immediately by reply e-mail, and permanently delete this message and its
attachments in any form in which they may have been preserved.
Re: AD/LDAP Old/Disabled Users Still Listed?
Posted by sciUser <sh...@securitycentric.net>.
Windows usernames by default are not case sensitive, Active directory is case
aware, unless you enable it to be case sensitive.
Thank You
-----
A Cybersecurity Enablement Company
We don't just run you through the motions, Our labs teach you how to think!
Known good Guacamole installations
--
Sent from: http://apache-guacamole-general-user-mailing-list.2363388.n4.nabble.com/
---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@guacamole.apache.org
For additional commands, e-mail: user-help@guacamole.apache.org
Re: AD/LDAP Old/Disabled Users Still Listed?
Posted by "Hankins, Jonathan" <jh...@homewood.k12.al.us>.
Since I see that the OP is authenticating against AD via LDAP, I just want
to throw this out there: AD stores the cn or sAMAccountName attribute
case-sensitively. Guacamole doesn't do a case-insensitive match (whereas
Windows login does), so I had to make sure that my sAMAccountName / cn
attributes were all lower case (which is what my users are expecting to
type in the Guacamole login box) for authentication to work. Mass-changing
sAMAccountName to lowercase is non-trivial, since many tools to do so work
case-insensitively. I can look up how I managed to script it if anyone gets
stuck like I did.
-Jonathan Hankins
On Fri, Jun 14, 2019 at 10:31 AM Mike Jumper <mj...@apache.org> wrote:
> On Fri, Jun 14, 2019, 07:06 Zer0Cool <me...@gmail.com> wrote:
>
>> Pardon my ignorance, but let me make sure I follow.
>>
>> So you are saying that the ldap filter (and thus results) are likely
>> up-to-date but that the database side of the account does not get
>> deleted/removed from the database when there is no longer a matching LDAP
>> account to go with it?
>>
>
> Nor would a database account be automatically created for LDAP. The two
> are independent. Guacamole unifies things for accounts having the same
> username, and that common username is the sole association between them.
>
> So I would assume that while the account still exists in the database,
>> authentication of the account would fail as the underlying AD/LDAP account
>> is no longer active/pulled in by the filter?
>>
>
> If you set a password for the database account, authentication using the
> database-specific password will succeed.
>
>
>> I presume that means it would be a manual task to go in and delete
>> disbaled
>> AD accounts from the database within Guacamole?
>>
>
> Yes.
>
>
>> For what its worth, this makes sense to me as you wouldn't want the
>> database
>> to delete users/settings in the event it cannot connect to AD temporarily
>> for example.
>>
>
> Indeed.
>
> Also, the two systems really are not interconnected in that way. Except
> for having the same username, there is no direct association between
> accounts in the database and within LDAP.
>
> Both the database and LDAP expose separate and independent sets of data,
> while the web interface unifies that data for presentation to user. With
> the exception of one (the database) trusting the authentication result of
> the other (LDAP), the two function completely independently.
>
> - Mike
>
>
--
------------------------------------------------------------------------
Jonathan Hankins Homewood City Schools
jhankins@homewood.k12.al.us
------------------------------------------------------------------------
--
This e-mail is intended only for the recipient and may contain confidential
or proprietary information. If you are not the intended recipient, the
review, distribution, duplication or retention of this message and its
attachments is prohibited. Please notify the sender of this error
immediately by reply e-mail, and permanently delete this message and its
attachments in any form in which they may have been preserved.
Re: AD/LDAP Old/Disabled Users Still Listed?
Posted by Mike Jumper <mj...@apache.org>.
On Fri, Jun 14, 2019, 07:06 Zer0Cool <me...@gmail.com> wrote:
> Pardon my ignorance, but let me make sure I follow.
>
> So you are saying that the ldap filter (and thus results) are likely
> up-to-date but that the database side of the account does not get
> deleted/removed from the database when there is no longer a matching LDAP
> account to go with it?
>
Nor would a database account be automatically created for LDAP. The two are
independent. Guacamole unifies things for accounts having the same
username, and that common username is the sole association between them.
So I would assume that while the account still exists in the database,
> authentication of the account would fail as the underlying AD/LDAP account
> is no longer active/pulled in by the filter?
>
If you set a password for the database account, authentication using the
database-specific password will succeed.
> I presume that means it would be a manual task to go in and delete disbaled
> AD accounts from the database within Guacamole?
>
Yes.
> For what its worth, this makes sense to me as you wouldn't want the
> database
> to delete users/settings in the event it cannot connect to AD temporarily
> for example.
>
Indeed.
Also, the two systems really are not interconnected in that way. Except for
having the same username, there is no direct association between accounts
in the database and within LDAP.
Both the database and LDAP expose separate and independent sets of data,
while the web interface unifies that data for presentation to user. With
the exception of one (the database) trusting the authentication result of
the other (LDAP), the two function completely independently.
- Mike
Re: AD/LDAP Old/Disabled Users Still Listed?
Posted by Zer0Cool <me...@gmail.com>.
Pardon my ignorance, but let me make sure I follow.
So you are saying that the ldap filter (and thus results) are likely
up-to-date but that the database side of the account does not get
deleted/removed from the database when there is no longer a matching LDAP
account to go with it?
So I would assume that while the account still exists in the database,
authentication of the account would fail as the underlying AD/LDAP account
is no longer active/pulled in by the filter?
I presume that means it would be a manual task to go in and delete disbaled
AD accounts from the database within Guacamole?
For what its worth, this makes sense to me as you wouldn't want the database
to delete users/settings in the event it cannot connect to AD temporarily
for example.
Thanks
--
Sent from: http://apache-guacamole-general-user-mailing-list.2363388.n4.nabble.com/
---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@guacamole.apache.org
For additional commands, e-mail: user-help@guacamole.apache.org
Re: AD/LDAP Old/Disabled Users Still Listed?
Posted by Mike Jumper <mj...@apache.org>.
On Tue, Jun 11, 2019 at 5:34 AM Zer0Cool <me...@gmail.com> wrote:
> Guac: 1.0.0
> OS: CentOS 7.6
>
> Using the LDAP extension to connect with a pretty simple AD and using a
> mariaDB database for authentication/users (aka not changing the AD/LDAP
> side) with LDAPS.
>
> Using the following filter via "ldap-user-search-filter" in
> guacamole.properties:
>
> (&(objectCategory=person)(objectClass=user)(userAccountControl=512))
>
> Essentially this should (and seems to initially) filter out any account
> that
> is not an enabled/active standard user account with a password that
> expires.
> So accounts with passwords that do not expire should not be listed and
> disabled accounts should not be listed.
>
> Periodically I disable accounts for users who are no longer active. However
> these accounts appear to stay visible in the list of users in Guacamole. I
> have not tried logging into an old account to see if it works yet but am
> wondering why these do not get removed when they no longer meet the filter
> criteria?
>
My guess would be that database accounts still exist for those users.
- Mike