Hi,
as i just got informed, libnss-maria does support TLS/SSL connections to DB servers and is a replacement for the normal libnss-mysql, which does not support encrypted connections. The libnss-mysql package is unchanged for years now and is based on age old code from early 200x
As libnss-mysql is used in PAM authentication an encrypted connection is vital for enterprise setups.
Normally, people use LDAP for remote auth on desktops, but been there, a mysql setup is so much easier to maintain and setup IMHO.
I suggest to test the new version and exchange it asap, if it's stable, has equal functionality and passed a code audit.
Projectlink:
On 29/11/2020 13:29, Marius Schwarz wrote:
as i just got informed, libnss-maria does support TLS/SSL connections to DB servers and is a replacement for the normal libnss-mysql, which does not support encrypted connections. The libnss-mysql package is unchanged for years now and is based on age old code from early 200x
I don't know if it makes a difference but the Fedora libnss-mysql is actually built against the mariadb client library.
Tom
Am 29.11.20 um 15:29 schrieb Tom Hughes via devel:
On 29/11/2020 13:29, Marius Schwarz wrote:
as i just got informed, libnss-maria does support TLS/SSL connections to DB servers and is a replacement for the normal libnss-mysql, which does not support encrypted connections. The libnss-mysql package is unchanged for years now and is based on age old code from early 200x
I don't know if it makes a difference but the Fedora libnss-mysql is actually built against the mariadb client library.
You need options to set SSL key/certfiles for authentication against the db, but libnss-mysql does not offer such options.
best regards, Marius
On 29/11/2020 15:08, Marius Schwarz wrote:
Am 29.11.20 um 15:29 schrieb Tom Hughes via devel:
On 29/11/2020 13:29, Marius Schwarz wrote:
as i just got informed, libnss-maria does support TLS/SSL connections to DB servers and is a replacement for the normal libnss-mysql, which does not support encrypted connections. The libnss-mysql package is unchanged for years now and is based on age old code from early 200x
I don't know if it makes a difference but the Fedora libnss-mysql is actually built against the mariadb client library.
You need options to set SSL key/certfiles for authentication against the db, but libnss-mysql does not offer such options.
Well if you want to do certificate authentication of the client then you would need those but there's nothing to stop it doing the same level of SSL as a typical https connection without any of that - it would just validate the server certificate against the system root certificate store.
I don't know offhand if the mysql/mariadb client libraries will do that without prompting but it's certainly possible.
Tom