sssd-devel February 2010

sssd-devel@lists.fedorahosted.org

13 participants
85 discussions

On FAST support in SSSD
by Stephen Gallagher 02 Feb '10

02 Feb '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I think this discussion deserves wider exposure, so I'm forwarding it to the sssd-devel list. This pertains to https://fedorahosted.org/sssd/ticket/237 - Kerberos client functionality should be able to use FAST if available - -------- Original Message -------- Subject: On FAST support in SSSD Date: Thu, 28 Jan 2010 17:19:09 -0500 From: Nalin Dahyabhai <nalin(a)redhat.com> Organization: Red Hat, Inc. To: Stephen Gallagher <sgallagh(a)redhat.com> Stephen, I took a closer look at it, and here's what I can tell you: FAST uses a previously-obtained ticket, and an authenticator that's built using it, to encrypt AS requests and replies traded between the client and the KDC. This yields a few useful benefits: * The entire AS exchange is encrypted: eavesdroppers have to crack the armor ticket's key to even figure out who the client of the AS request is. Additionally, as the ticket's key is usually random rather than password-based, so dictionary attacks should be harder. * If the armor ticket was issued by a KDC whose identity was verified, then the AS reply is also verified (for example, the armor ticket could have been obtained using PKINIT, in which the client can verify the KDC's identity using the KDC's certificate). * The client and KDC can jointly select a key which is not based on the client's long-term password. * The authentication can be performed with a mechanism that doesn't yield a key, for example with an OTP token (in the current draft, the key used for encrypting the TGT is based on the armor key, possibly in combination with the OTP token). In the implementation we use, when the client software calls krb5_get_init_creds_opt_set_fast_ccache_name() to set the location of a ccache containing a suitable ticket, before calling krb5_get_init_creds_password(), the client uses FAST. If the client tries to use FAST and the server doesn't support it, then the client will treat that as an error and fail to obtain a TGT. If SSSD already has a credential cache when it goes to obtain a TGT for a user, this is probably a trivial addition, but I'd suggest it not be turned on by default. Hopefully it'd be available as an option for situations where it's already known that the KDC supports FAST (either beforehand or out-of-band, most likely). HTH, Nalin -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAktnHTkACgkQeiVVYja6o6MNUgCeKWkk2Oh5m0DIMmxa21qPHcMJ yqAAnixWTbRG2sMxb3wI4hOtoWWZir6j =FMRt -----END PGP SIGNATURE-----

3 2

[PATCH] Force offline operation with SIGUSR1
by Stephen Gallagher 01 Feb '10

01 Feb '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 If the monitor receives SIGUSR1, it will instruct all providers to enter offline operation. If any individual provider receives SIGUSR1, it alone will enter offline operation. - -- Stephen Gallagher RHCE 804006346421761 Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkte/2wACgkQeiVVYja6o6PDgwCcCxuD8wots8zmop4zJLTsuq9k pqYAn30Am/r2UXkmHxw1BDEgITEI7hEp =Hf4R -----END PGP SIGNATURE-----

2 3

[PATCH] Updated collection patch
by Dmitri Pal 01 Feb '10

01 Feb '10

Hi, I removed semicolons. For the env var I opened a new issue. https://fedorahosted.org/sssd/ticket/394 I want to handle it separately and in one patch across all unit tests in "common". BTW I do not think we have any for path_utils, right? -- Thank you, Dmitri Pal Engineering Manager IPA project, Red Hat Inc. ------------------------------- Looking to carve out IT costs? www.redhat.com/carveoutcosts/

3 3

[PATCH] Rename PAM_USER_INFO to PAM_SYSTEM_INFO
by Sumit Bose 01 Feb '10

01 Feb '10

Hi, this patch just renames PAM_USER_INFO to PAM_SYSTEM_INFO. Currently PAM_USER_INFO is only used to send messages which are written to syslog by the PAM client. It is planned to add new messages which will be displayed to the user, e.g. if offline authentication was used. To avoid confusion I think this name change makes sense. bye, Sumit

3 7

[PATCH] Improve logging of pam_sss
by Sumit Bose 01 Feb '10

01 Feb '10

Hi, this patch makes the logging of pam_sss a bit clearer and less verbose. This should fix bz556534. This patch might affect testing, because some log messages are changed. bye, Sumit

2 2

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

sssd-devel February 2010