Skip to content

Fix #307: pin sshd LoginGraceTime to cover the 2FA push window #392

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Om-singhaI wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Fix #307: pin sshd LoginGraceTime to cover the 2FA push window #392

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 7 additions & 0 deletions images/base/50-login-grace-time.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@
# Give SSH logins enough time to answer the push-notification 2FA prompt.
# Authentication flows through sssd -> the LDAP gateway, which allows up to
# 60s for a push to be responded to (see ldap_opt_timeout in sssd.conf.template).
# sshd's default LoginGraceTime can cut the connection before that window
# closes, so pin it above the 60s 2FA timeout, leaving headroom for the TCP
# and key-exchange handshake that precedes the LDAP bind. See issue #307.
LoginGraceTime 75
1 change: 1 addition & 0 deletions images/base/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,6 +28,7 @@ RUN apt-get update && \
COPY --chmod=0440 sssd.conf.template /etc/sssd/sssd.conf.template
COPY --chmod=0440 50-sssd-conf-template.conf /etc/systemd/system/sssd.service.d/50-sssd-conf-template.conf
COPY --chmod=0644 50-sss-ssh-authorizedkeys.conf /etc/ssh/sshd_config.d/50-sss-ssh-authorizedkeys.conf
COPY --chmod=0644 50-login-grace-time.conf /etc/ssh/sshd_config.d/50-login-grace-time.conf
COPY --chmod=0440 ldapusers /etc/sudoers.d/ldapusers
COPY --chmod=0644 ldap.conf /etc/ldap/ldap.conf
COPY --chmod=0755 git-identity.sh /etc/profile.d/git-identity.sh
Expand Down