On Mon, Aug 26, 2013 at 03:35:09PM -0400, Simo Sorce wrote:
The point of checking initgroups at login is to assure the right
memberships are in place, both for security reasons and to allow a user
to logoff and login back again and make sure eh gets new group
memberships if he has been granted any new ones.
Loggin off then back on is the only way to gain system-wide the new
memberships so that's what an administrator will tell a user to do if
the user complains he can't access something.
This means that caching can't last long as the side effects are severe.
So anything more than a few seconds would probably be bad. A few seconds
make total sense for load issues when someone is abusing pam atuh (for
example someon eusing basic auth wired to pam auth for a a web server
that will receive potentially many tens of authentications for the same
user within a fraction of a second as each image and file is loaded in a
new connection).
In this case you really want to completely cache the whole operation and
not touch the network for any reason, otherwise latency will make things
unbearable. But that's the extent to which you want to go, a few seconds
for auth bursts, nothing more.
Just for completeness, we do have code in the PAM responder to cache
login-time initgroups (as opposed to running id -G for instance) for 5
seconds to account for login bursts.