On Wed, Jan 05, 2011 at 08:31:57AM -0500, Stephen Gallagher wrote:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 01/05/2011 06:12 AM, Sumit Bose wrote:
> Hi,
>
> Shanks found an issue with obfuscated password which led to
>
https://fedorahosted.org/sssd/ticket/762
>
> This patch fixes the issue but might introduce some memory leaks. It
> does not remove nspr_nss_cleanup() at any other places, because for me
> the usage looks safe there. But we really should push
>
https://fedorahosted.org/sssd/ticket/752 to get a code audit for our NSS
> usage.
Nack.
I think this solution is insufficient. We're not sure whether this will
introduce a memory leak because we're not terminating our use of NSS. I
think what we want to do is move the decryption to the initialization
routine of the LDAP provider and store the decrypted password with the
same mechanism we use to store deferred krb5 passwords.
This will also solve
https://fedorahosted.org/sssd/ticket/761 at the
same time.
There's no reason whatsoever that we need to be decrypting the
obfuscated password every time we perform an authentication.
While we're in that code, it would probably be a good idea to make the
non-obfuscated bind password use this mechanism as well.
This new patch converts the obfuscated password at startup and replaces
it with the cleartext version in the option array. This should fix
https://fedorahosted.org/sssd/ticket/761 and
https://fedorahosted.org/sssd/ticket/762
Would you mind filing a new ticket to create some common routines to
handle the Linux kernel keyring which can be used here and for deferred
authentication? (I have to admit that I think it doesn't make much sense
to use the kernel keyring here. Because I think the default LDAP
password is more a config option than a password which should kept
secret.)
bye,
Sumit
- --
Stephen Gallagher
RHCE 804006346421761
Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Fedora -
http://enigmail.mozdev.org/
iEYEARECAAYFAk0kcs0ACgkQeiVVYja6o6PsVgCeLk1PCJfCepRSFRgfQqZVNTM1
a3MAnji3Gz4zhpBmaR/W92WoMcdqM3Jm
=b67T
-----END PGP SIGNATURE-----
_______________________________________________
sssd-devel mailing list
sssd-devel(a)lists.fedorahosted.org
https://fedorahosted.org/mailman/listinfo/sssd-devel