[Fwd: Re: #425: sssd.conf required to have permissions 0600]
by Dmitri Pal
I think 1) is a good suggestion.
Can we open an RFE about it?
By the way ini interface supports reading HEX encoded binary data so if
you want to use INI format to store keys and passwords it is doable.
-------- Original Message --------
Subject: Re: [SSSD] #425: sssd.conf required to have permissions 0600
Date: Fri, 19 Mar 2010 18:41:16 -0000
From: SSSD <trac(a)fedorahosted.org>
Reply-To: nobody(a)fedoraproject.org
To: undisclosed-recipients:;
References: <047.ddab9a83284651abdee8770a05aab5bd(a)fedorahosted.org>
#425: sssd.conf required to have permissions 0600
------------------------+---------------------------------------------------
Reporter: amcnabb | Owner: somebody
Type: defect | Status: reopened
Priority: major | Milestone: NEEDS_TRIAGE
Component: SSSD | Version: 1.0.5
Resolution: | Keywords:
Fixedin: | Doc: 0
Tests: 0 | Docupdated: 0
Testsupdated: 0 |
------------------------+---------------------------------------------------
Comment (by amcnabb):
It will be a few days before I can get to it, but I'll open a separate bug
report about session hangs. I agree that this bug report should focus on
the symlink thing (which is just silly and doesn't actually protect from
anything) and the permissions thing. A few thoughts about permissions:
1) Postfix puts passwords in a separate file, as does Apache with SSL
keys. I'm sure there are many other examples of this general model.
These systems enforce permissions for the sensitive files but not for the
general configiguration. Not only does this make system administration
easier, it also means that people are less likely to accidentally post
sensitive information in bug reports.
2) Other systems, like libvirt, named, and cups set their configuration to
be unreadable by default, but they don't fail if the permissions are
changed by the administrator.
3) It's not pretty, but maybe there could be a new command-line option:
--i-swear-i-dont-have-any-passwords-in-the-config-please-just-treat-me-
like-an-adult-and-start.
Okay, so (3) isn't a serious suggestion, but I think (1) would be a really
good idea. If anything, I think it actually improves security.
--
Ticket URL: <https://fedorahosted.org/sssd/ticket/425#comment:13>
SSSD <http://fedorahosted.org/sssd>
System Security Services Daemon
--
Thank you,
Dmitri Pal
Engineering Manager IPA project,
Red Hat Inc.
-------------------------------
Looking to carve out IT costs?
www.redhat.com/carveoutcosts/
14 years, 1 month
[PATCH] Fix bad memory interaction at process exit
by Simo Sorce
These bugs were never much important as they tend to happen only when
the monitor exits. Yet analyzing them I found some problems that might
happen also on a normally running daemon. It is also bad to have the
monitor potentially crash on exit, as that may also be caught by abrt
and cause false positives in bugzilla later on.
Comments in the patches should be clear.
Simo.
--
Simo Sorce * Red Hat, Inc * New York
14 years, 1 month
[PATCHES] Add missing option ldap_tls_cacertdir to SSSDConfig API
by Stephen Gallagher
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Patch 0001: Add the missing option to the API. Pushed to master and
1-1-0 under the one-liner rule. This is needed by authconfig.
Patch 0002: Add the translated help text to the API. Pushed to master.
Not pushed to 1-1-0 because of string freeze.
- --
Stephen Gallagher
RHCE 804006346421761
Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
iEYEARECAAYFAkuiiXwACgkQeiVVYja6o6NepACgnEPfHkJpXgMFcZRmdOtwCrfe
G2sAnRrwHLNfEAriFh7SpzWJcBhQ3flP
=GgvV
-----END PGP SIGNATURE-----
14 years, 1 month
[PATCH] Fix error message for ldap_start_tls
by Stephen Gallagher
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Patch is obvious.
- --
Stephen Gallagher
RHCE 804006346421761
Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
iEYEARECAAYFAkuic0oACgkQeiVVYja6o6NpjgCfVA95FltfPVySorsCcL37cxKp
DTcAoJcGFP1vY+qMDWvhRB51iAsK1B+L
=6Ek5
-----END PGP SIGNATURE-----
14 years, 1 month
[PATCH] Fix memory leaks in SBUS
by Stephen Gallagher
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
I introduced some memory leaks with my patch for handling disconnected
DBUS sends. This patch fixes it.
- --
Stephen Gallagher
RHCE 804006346421761
Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
iEYEARECAAYFAkuhKe0ACgkQeiVVYja6o6NaugCeLZztH0hwwIRKfkuXccTx9r2/
04QAnRaG4NB5572AaJr+zZGPcwYqvNpe
=0Djp
-----END PGP SIGNATURE-----
14 years, 1 month
[PATCH] Fixes for client communication
by Sumit Bose
Hi,
this patch fixes some issues in the client communication code of the
responders.
The man pages of send() and recv() tell to following:
EAGAIN or EWOULDBLOCK
The socket is marked non-blocking and the requested operation would
block. POSIX.1-2001 allows either error to be returned for this case,
and does not require these constants to have the same value, so a
portable application should check for both possibilities.
So I added a check for EWOULDBLOCK after the calls to send() and recv()
and return EAGAIN to the caller.
The other issues are mentioned in the commit message.
bye,
Sumit
14 years, 1 month
[PATCHES] Different patches for COLLECTION and INI
by Dmitri Pal
Hi,
Patch 1 - one-liner, turn off man page generation
Patch 2 - cleaning INI unit test to comply with formatting guidelines
and to turn off endless output in case of "make check".
Patch 3 - addressing ticket #170
Patch 4 - continuation of the work related on patch 3 regarding INI
interface that uses collection interface internally.
--
Thank you,
Dmitri Pal
Engineering Manager IPA project,
Red Hat Inc.
-------------------------------
Looking to carve out IT costs?
www.redhat.com/carveoutcosts/
14 years, 1 month