URL:
https://github.com/SSSD/sssd/pull/854
Title: #854: LDAP: Do not require START_TLS for loopback connections
scabrero commented:
"""
@simo5, as you said the idea is to avoid having to set up certificates (or undocumented
options) when sssd and ldap run in the same machine. I understand the potential security
issues you pointed out, so would it be acceptable after adding these additional
restrictions to sdap_is_loopback_address?
+ Restrict to INADDR_LOOPBACK instead the whole IN_LOOPBACKNET
+ Restrict to ports below 1024
IMHO it is less secure to rely on that hidden option that allows everything than the
proposed changes after we agree the full list of "restrictions".
I will write a more extensive commit message if you are OK with the changes :)
"""
See the full comment at
https://github.com/SSSD/sssd/pull/854#issuecomment-515010382