URL:
https://github.com/SSSD/sssd/pull/390
Title: #390: NSS: Add option to disable memcache
jhrozek commented:
"""
There is a *really* big difference between an option that leaks user's credentials to
anyone sniffing the network and an option that lets you decrease NSS lookups performance.
Especially since IIRC at the moment, fully qualified names are not stored in the memory
cache at all.
It's really about the damage you can do with the option. If you disable the memory
cache and the system performance is slow, well, too bad, worst that could have happened is
that your users file a helpdesk ticket. If you let your credentials leak over the network,
it's a security problem.
So, let's document this option along with its disadvantages. No sensible person will
set this option and if they do, well too bad, their SSSD instance will behave poorly.
"""
See the full comment at
https://github.com/SSSD/sssd/pull/390#issuecomment-332616726