Improving GNOME's ldap resiliency
by Jeff Schroeder
As we move to evolve the GNOME infrastructure, it has came to my attention that:
1.) Our ldap services sometimes go haywire and services we provide
go with it.
2.) Our ldap master, label.gnome.org, does not have an ldap client
configured due to the chicken/egg problem.
3.) The ldap slave in our backup (Canonical) datacenter is flaky
causing issues with services hosted there such as damned lies[1].
The sssd[2] is this nifty project written by mostly redhatters which
does the job of pam_ldap plus a lot more. Most important to us, it
does offline ldap information caching. Since we don't enable
password-based logins to our servers, it won't cache shadow attributes
but it will store group/passwd info. The package is already in EPEL
and will be the default ldap client in RHEL6. It has been in Fedora
since Fedora 11[3] and is going to be shipping with RHEL5.6.
Integrating this should be a piece of cake.
Setting up sssd on our servers fixes several existing issues:
1.) When label goes down, users can no longer commit to gnome git.
This would have been a much bigger issue in the svn days. Yay for
dvcs!
2.) Other services on the ldap master won't have problems if their
init script runs before ldap comes up. Example:
Starting httpd: httpd: bad group name bugzilla [FAILED]
3.) Home directories are mounted over NFS on all servers in our
primary (redhat) datacenter. NFS with downed ldap can get ugly unless
that info was cached locally.
4.) ldap will no longer be perceived as a hindrance towards
rebooting label for a new kernel or some major update.
Speaking as someone who has deployed ldap + sssd in an environment
many order of magnitudes bigger than GNOME's, I highly recommend it.
In the future, sssd will support caching ssh keys (from ldap) locally
in it's own ldb cache. Do we want to explore this avenue or do we want
to continue using the the create-auth scripts? If we want to entertain
this, we should work together with upstream to integrate with our
custom ssh key ldap schema. The developers expressed they will work by
default with the openssh-lpk schema which we sadly do not use.
This email is an introduction of us to the sssd team and vice versa.
If no one voices a strong opinion against, I'm going to work on
deploying sssd over the next week or so.
[1] http://l10n.gnome.org/
[2] https://fedorahosted.org/sssd/
[3] http://fedoraproject.org/wiki/Features/SSSD
[4] http://git.gnome.org/browse/sysadmin-bin/tree/create-auth
--
Jeff Schroeder
Don't drink and derive, alcohol and analysis don't mix.
http://www.digitalprognosis.com
13 years, 7 months
[PATCH] Use new MIT krb5 API for better password expiration warnings
by Sumit Bose
Hi,
currently we can only present a warning message which in generated
inside the MIT Kerberos library to the user if the password is about to
expire. But the developers of MIT Kerberos were so nice to add a new API
to retrieve the original timestamps
(http://k5wiki.kerberos.org/wiki/Projects/Password_expiration_API). It
is currently available in the daily development snapshots of MIT
Kerberos and should find its way into the 1.9 release.
The attached patch checks if the new API is available and adds a
callback to read the password expiration timestamp. As mentioned on the
web page there is a small chance that this patch will not display the
time when the password expires, but the time when the account expires. I
think we can neglect this case.
bye,
Sumit
13 years, 7 months
[PATCH] Save all data to sysdb in one transaction
by Sumit Bose
Hi,
this patch for master saves all IPA HBAC data in one transaction and
proceeds if the sysdb transaction fails. It addresses a review comment
from the "Use new schema for HBAC service checks" patch.
The first patch changes the handling of the host data to be compatible
with the other data. The second removes the individual transactions and
introduces a common sysdb transaction.
Do we want/need a similar patch for master, too?
bye,
Sumit
13 years, 7 months
[PATCH] Request all group attributes during initgroups processing (sssd-1-2)
by Stephen Gallagher
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
We tried to be too clever and only requested the name of the group,
but we require the objectClass to validate the results.
https://fedorahosted.org/sssd/ticket/622
This is rebased from the patches in the thread "Fix two serious issues
with initgroups". The other two patches are unnecessary in sssd-1-2 (bug
620 does not exist there)
- --
Stephen Gallagher
RHCE 804006346421761
Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
iEYEARECAAYFAkyPkKQACgkQeiVVYja6o6Oz7QCdGqpJk4DdXhY98yQG+yyUDbeG
/+QAnijrjOrBOHoBJra/ETAg2nhdjxPN
=QCGD
-----END PGP SIGNATURE-----
13 years, 7 months
[PATCH] Assorted patches for initgroups processing (sssd-1.2)
by Jakub Hrozek
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
This is just a rebased version of the same patches that went into master.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
iEYEARECAAYFAkyaG1oACgkQHsardTLnvCW74gCgpgoE8SqGV74eLwbffRAYAv6R
16kAoILN6C0rnXfrVrdBRUkYvjW989MA
=uSnr
-----END PGP SIGNATURE-----
13 years, 7 months
[PATCH] Fix version handling of the libraries
by Sumit Bose
Hi,
patch 0002 mainly fixes the version numbers in the *.pc files. The first
patch removes the unneeded --disable-rpath configure option from the
spec file example.
bye,
Sumit
13 years, 7 months
[PATCHES] Sysdb interface for netgroups
by Stephen Gallagher
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
This is a first pass at the cache storage and retrieval for netgroups
information. Part of these patches were written by Jakub, part by me.
I'd prefer it if Jan, Simo or Sumit did the review for this.
I'm going to try to submit patches for review on a rolling basis for the
netgroups code, in order to avoid a too-large review when the work is
complete.
Patch 0001: New sysdb interfaces for netgroups. Add and delete support
for netgroups entries, tuples and nested netgroups.
Patch 0002: Unit tests for the above interfaces.
- --
Stephen Gallagher
RHCE 804006346421761
Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
iEYEARECAAYFAkyQ5KoACgkQeiVVYja6o6OM3gCgkv7AwjDGN6A97uM7URMDPAn0
tr8AnidKAUkbpjr2F9lhdH3gbIx/or3G
=ndx4
-----END PGP SIGNATURE-----
13 years, 7 months
[PATCH][ding-libs] Build all of the ding-libs from the root
by Stephen Gallagher
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
We rethought how we're going to build the ding-libs.
They will now all be built from a single tarball (and a single SRPM, by
extension) and produce independent shared libraries (which will produce
an assortment of binary subpackages in RPM)
The attached (large) patch makes this change by moving all of the
ding-libs into a common Makefile.am/configure.ac pair at the root of the
source tree.
Dmitri, I have rebased my FedoraPeople repo branch with these changes,
so developing from that as a base should work for you.
http://fedorapeople.org/gitweb?p=sgallagh/public_git/ding-libs.git;a=shor...
Let me know if you have trouble.
- --
Stephen Gallagher
RHCE 804006346421761
Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
iEYEARECAAYFAkyZKFkACgkQeiVVYja6o6P74QCfYFcDT5V61rMN9WHCsBOim3O0
hAMAn1i620mra4wzGNGl6EGmFa/BFLNB
=C+OV
-----END PGP SIGNATURE-----
13 years, 7 months
[PATCH] Assorted patches for initgroups processing
by Jakub Hrozek
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Hi,
I found these issues while testing Stephen's initgroup patches:
[PATCH 1/3] Fix sysdb_group_dn_name
We copied the RDN attribute name, not its value. Also includes a unit test.
[PATCH 2/3] Fix sysdb_attrs_to_list
We didn't cycle through all the attributes.
[PATCH 3/3] Request the correct attribute name
The attributes we got from sdap_get_generic_recv() are already mapped to
sysdb attributes, so when we asked for "cn", it was not found as the
attributes already included "name".
They apply to master only, I can resend the 1.2 version when/if these
are deemed OK.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
iEYEARECAAYFAkySO9YACgkQHsardTLnvCUjWwCeJvPq/UU09wmPY80o6vbrSxAH
61QAoNrAaIh/ZixsVcImODbdegLKjPMW
=xQ4R
-----END PGP SIGNATURE-----
13 years, 7 months