mirror of
https://salsa.debian.org/freeipa-team/freeipa.git
synced 2025-02-25 18:55:28 -06:00
dd296eec13
HBAC rules control who can access what services on what hosts and from where.
You can use HBAC to control which users or groups on a source host can
access a service, or group of services, on a target host.
Since applying HBAC rules implies use of a production environment,
this plugin aims to provide simulation of HBAC rules evaluation without
having access to the production environment.
Test user coming from source host to a service on a named host against
existing enabled rules.
ipa hbactest --user= --srchost= --host= --service=
[--rules=rules-list] [--nodetail] [--enabled] [--disabled]
--user, --srchost, --host, and --service are mandatory, others are optional.
If --rules is specified simulate enabling of the specified rules and test
the login of the user using only these rules.
If --enabled is specified, all enabled HBAC rules will be added to simulation
If --disabled is specified, all disabled HBAC rules will be added to simulation
If --nodetail is specified, do not return information about rules matched/not matched.
If both --rules and --enabled are specified, apply simulation to --rules _and_
all IPA enabled rules.
If no --rules specified, simulation is run against all IPA enabled rules.
EXAMPLES:
1. Use all enabled HBAC rules in IPA database to simulate:
$ ipa hbactest --user=a1a --srchost=foo --host=bar --service=ssh
--------------------
Access granted: True
--------------------
notmatched: my-second-rule
notmatched: my-third-rule
notmatched: myrule
matched: allow_all
2. Disable detailed summary of how rules were applied:
$ ipa hbactest --user=a1a --srchost=foo --host=bar --service=ssh --nodetail
--------------------
Access granted: True
--------------------
3. Test explicitly specified HBAC rules:
$ ipa hbactest --user=a1a --srchost=foo --host=bar --service=ssh --rules=my-second-rule,myrule
---------------------
Access granted: False
---------------------
notmatched: my-second-rule
notmatched: myrule
4. Use all enabled HBAC rules in IPA database + explicitly specified rules:
$ ipa hbactest --user=a1a --srchost=foo --host=bar --service=ssh --rules=my-second-rule,myrule --enabled
--------------------
Access granted: True
--------------------
notmatched: my-second-rule
notmatched: my-third-rule
notmatched: myrule
matched: allow_all
5. Test all disabled HBAC rules in IPA database:
$ ipa hbactest --user=a1a --srchost=foo --host=bar --service=ssh --disabled
---------------------
Access granted: False
---------------------
notmatched: new-rule
6. Test all disabled HBAC rules in IPA database + explicitly specified rules:
$ ipa hbactest --user=a1a --srchost=foo --host=bar --service=ssh --rules=my-second-rule,myrule --disabled
---------------------
Access granted: False
---------------------
notmatched: my-second-rule
notmatched: my-third-rule
notmatched: myrule
7. Test all (enabled and disabled) HBAC rules in IPA database:
$ ipa hbactest --user=a1a --srchost=foo --host=bar --service=ssh --enabled --disabled
--------------------
Access granted: True
--------------------
notmatched: my-second-rule
notmatched: my-third-rule
notmatched: myrule
notmatched: new-rule
matched: allow_all
Only rules existing in IPA database are tested. They may be in enabled or
disabled disabled state.
Specifying them through --rules option explicitly enables them only in
simulation run.
Specifying non-existing rules will not grant access and report non-existing
rules in output.
83 lines
4.0 KiB
Plaintext
83 lines
4.0 KiB
Plaintext
########################################################
|
|
# freeIPA Version #
|
|
# #
|
|
# freeIPA versions are as follows #
|
|
# 1.0.x New production series #
|
|
# 1.0.x{pre,rc}y Preview/Testing & RC #
|
|
# 1.0.0GITabcdefg Build from GIT #
|
|
# #
|
|
########################################################
|
|
|
|
########################################################
|
|
# This are the main version numbers #
|
|
# #
|
|
# <MAJOR>.<MINOR>.<RELEASE> #
|
|
# #
|
|
# e.g. IPA_VERSION_MAJOR=1 #
|
|
# IPA_VERSION_MINOR=0 #
|
|
# IPA_VERSION_RELEASE=0 #
|
|
# -> "1.0.0" #
|
|
########################################################
|
|
IPA_VERSION_MAJOR=2
|
|
IPA_VERSION_MINOR=0
|
|
IPA_VERSION_RELEASE=90
|
|
|
|
########################################################
|
|
# For 'pre' releases the version will be #
|
|
# #
|
|
# <MAJOR>.<MINOR>.<RELEASE>pre<PRE_RELEASE> #
|
|
# #
|
|
# e.g. IPA_VERSION_PRE_RELEASE=1 #
|
|
# -> "1.0.0pre1" #
|
|
########################################################
|
|
IPA_VERSION_PRE_RELEASE=
|
|
|
|
########################################################
|
|
# For 'rc' releases the version will be #
|
|
# #
|
|
# <MAJOR>.<MINOR>.<RELEASE>rc<RC_RELEASE> #
|
|
# #
|
|
# e.g. IPA_VERSION_RC_RELEASE=1 #
|
|
# -> "1.0.0rc1" #
|
|
########################################################
|
|
IPA_VERSION_RC_RELEASE=
|
|
|
|
########################################################
|
|
# To mark GIT snapshots this should be set to 'yes' #
|
|
# in the development BRANCH, and set to 'no' only in #
|
|
# the IPA_X_X_RELEASE BRANCH #
|
|
# #
|
|
# <MAJOR>.<MINOR>.<RELEASE>GITxxx #
|
|
# #
|
|
# e.g. IPA_VERSION_IS_SVN_SNAPSHOT=yes #
|
|
# -> "1.0.0GITabcdefg" #
|
|
########################################################
|
|
IPA_VERSION_IS_GIT_SNAPSHOT="yes"
|
|
|
|
########################################################
|
|
# The version of IPA data. This is used to identify #
|
|
# incompatibilities in data that could cause issues #
|
|
# with replication. If the built-in versions don't #
|
|
# match exactly then replication will fail. #
|
|
# #
|
|
# The format is %Y%m%d%H%M%S #
|
|
# #
|
|
# e.g. IPA_DATA_VERSION=`date +%Y%m%d%H%M%S` #
|
|
# -> "20100614120000" #
|
|
########################################################
|
|
IPA_DATA_VERSION=20100614120000
|
|
|
|
########################################################
|
|
# The version of the IPA API. This controls which #
|
|
# client versions can use the XML-RPC and json APIs #
|
|
# #
|
|
# A change to existing API requires a MAJOR version #
|
|
# update. The addition of new API bumps the MINOR #
|
|
# version. #
|
|
# #
|
|
# The format is a whole number #
|
|
# #
|
|
########################################################
|
|
IPA_API_VERSION_MAJOR=2
|
|
IPA_API_VERSION_MINOR=11
|