Branch: refs/heads/main
Home: https://github.com/gssapi/gssproxy
Commit: c66e429f41db98f8d02ea9844f0b02f0fa4b5c28
https://github.com/gssapi/gssproxy/commit/c66e429f41db98f8d02ea9844f0b02f0f…
Author: Julien Rische <jrische(a)redhat.com>
Date: 2025-03-26 (Wed, 26 Mar 2025)
Changed paths:
M man/gssproxy.conf.5.xml
Log Message:
-----------
Fix gssproxy.conf manpage about comments
The manpage was implying it was possible to have comments at the end of
configuration lines, while SSSD's ini parsing library used by gssproxy
supports full line comments only.
Signed-off-by: Julien Rische <jrische(a)redhat.com>
To unsubscribe from these emails, change your notification settings at https://github.com/gssapi/gssproxy/settings/notifications
Hi
In my environment using gssproxy, on our NFS client systems,
facilitates the reliable operation of Kerberos secured
NFS I/O by non-interactive processes.
Prior to learning about gssproxy, we used a somewhat
"kludgy" scheme, to obtain Kerberos credentials for
non-interactive processes, involving cron jobs to
kinit at regular intervals. Problems with
gss kernel contexts ( requiring client reboots )
were much more common before gssproxy.
I noticed that in newer versions of Linux
( for example: Red Hat Enterprise v9 ), the
paramter use-gss-proxy
(in the [gssd] section of /etc/nfs.conf file )
no longer exists.
I have also read that some security specialists
determined that gssproxy increases security risk.
And they are recommending that use of gssproxy be discontinued.
( SEE: https://www.stigviewer.com/stig/red_hat_enterprise_linux_9/2023-12-01/findi… )
Questions:
1) Why did the use-gss-proxy configuration parameter
disappear ?
2) What is the nature and severity of the security risk/s
associated with gssproxy ( on NFS clients ) ?
3) Is there a way for users to mitigate the security risk without
discontinuing the use of gssproxy ?
4) Will the gssproxy code be modified to eliminate the security risk ?
5) What is the expected 5 - 10 year plan for active gssproxy development ?
6) If the plan is to discontinue active development, are there other active
living projects that will provide the same functionality ?
Thanks
Andy Romero
Fermilab / ITD
Branch: refs/heads/main
Home: https://github.com/gssapi/gssproxy
Commit: b8e3364ea95968e6a2eeb7a63735c89c9108c24b
https://github.com/gssapi/gssproxy/commit/b8e3364ea95968e6a2eeb7a63735c89c9…
Author: yixiangzhike <yixiangzhike007(a)163.com>
Date: 2025-03-06 (Thu, 06 Mar 2025)
Changed paths:
M systemd/gssproxy.service.in
Log Message:
-----------
Revert "Remove the NoNewPrivileges because it breaks the ability to open socket"
Selinux-policy has allowed init_t nnp domain transition to gssproxy_t in the commit 95d5f5e.
Now it is ok to enable NoNewPrivileges for gssproxy.service.
Signed-off-by: yixiangzhike <yixiangzhike007(a)163.com>
To unsubscribe from these emails, change your notification settings at https://github.com/gssapi/gssproxy/settings/notifications