https://pagure.io/SSSD/sssd/issue/1555 [validate the shell coming from the directory or the cache] Close or not?
by Amit
Hello,
Issue was opened 5 years back with following description: It is possible
to put junk into the shell attribute of an user entry. We should reuse
the existing code that is in use when allowed_shells/vetoed_shells are
present, check if the shell exists and at least give a warning.
More on ticket: The ticket was about checking the LDAP attribute that
contains the user's shell against either /etc/shells or more preferably
also against the logic that is in sss_resp_get_shell_override and issue
a warning.
But There is a lot of code that is responder-specific and moving all
this to providers only in order to provide a warning seems like busywork.
Can this ticket be closed?
--
Thanks
Amit Kumar
!!If you stumble, get back up.
What happened yesterday, no longer matters.
Today is another day to move closer to your GOAL!!
5 years, 10 months
getaddrinfo() may fail with AI_ADDRCONFIG
by Amit
Hello,
AI_ADDRCONFIG was added in order to optimise DNS query traffic, so that
only useful addresses are queried for.
In other words, an IPv4-only node should not query its upstream resolver
for IN AAAA resource records,
while an IPv6-only node should not query for IN A resource records.
The proper function of AI_ADDRCONFIG requires that:
1. The usual processing of all node-local and link-local names and
addresses is preserved as long as the respective addresses are present.
2. The global name resolution is not affected by the existence or
non-existence of node-local and link-local addresses.
3. IN AAAA DNS queries should not be transmitted from a node with no
global IPv6 address, and vice versa: IN A queries should not to be
transmitted from a node with no global IPv4 address.
Unfortunately, the current implementation of getaddrinfo() mostly
follows the informational RFC 3493, which fails in both #1, #2, and
partially in #3.
https://fedoraproject.org/wiki/QA/Networking/NameResolution/ADDRCONFIG?rd...
https://pagure.io/SSSD/sssd/issue/1665
I believe sssd as of now doesn't keeps strong hold of pre-conditions of
using AI_ADDRCONFIG.
--
Thanks
Amit Kumar
!!If you stumble, get back up.
What happened yesterday, no longer matters.
Today is another day to move closer to your GOAL!!
5 years, 10 months
[sssd PR#553][opened] Use p11_child to verify certificates for the ssh responder
by sumit-bose
URL: https://github.com/SSSD/sssd/pull/553
Author: sumit-bose
Title: #553: Use p11_child to verify certificates for the ssh responder
Action: opened
PR body:
"""
This patch set is another step to solve https://pagure.io/SSSD/sssd/issue/3489,
i.e to remove the NSS dependency and allow all Smartcard and certificate
related features to be build with OpenSSL as well.
To have all the code related to certificate verification in one place the
verification code is removed from the ssh responder and the ssh responder will
now call p11_child to verify a certificate before extracting the public key as
ssh key. Another benefit is that the ssh responder is not blocked anymore
during OCSP check since they now run in p11_child and the ssh responder can
process other requests in parallel.
In this context I also added a patch which improves the documentation of the
feature in the sss_ssh_authorizedkeys man page as requested in
https://pagure.io/SSSD/sssd/issue/3688.
Besides adding unit tests for the new calls I added an unit test for the ssh
responder, similar to the ones for the nss and pam responder.
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/553/head:pr553
git checkout pr553
5 years, 10 months