I think 1) is a good suggestion.
Can we open an RFE about it?
By the way ini interface supports reading HEX encoded binary data so if
you want to use INI format to store keys and passwords it is doable.
-------- Original Message --------
Subject: Re: [SSSD] #425: sssd.conf required to have permissions 0600
Date: Fri, 19 Mar 2010 18:41:16 -0000
From: SSSD <trac(a)fedorahosted.org>
Reply-To: nobody(a)fedoraproject.org
To: undisclosed-recipients:;
References: <047.ddab9a83284651abdee8770a05aab5bd(a)fedorahosted.org>
#425: sssd.conf required to have permissions 0600
------------------------+---------------------------------------------------
Reporter: amcnabb | Owner: somebody
Type: defect | Status: reopened
Priority: major | Milestone: NEEDS_TRIAGE
Component: SSSD | Version: 1.0.5
Resolution: | Keywords:
Fixedin: | Doc: 0
Tests: 0 | Docupdated: 0
Testsupdated: 0 |
------------------------+---------------------------------------------------
Comment (by amcnabb):
It will be a few days before I can get to it, but I'll open a separate bug
report about session hangs. I agree that this bug report should focus on
the symlink thing (which is just silly and doesn't actually protect from
anything) and the permissions thing. A few thoughts about permissions:
1) Postfix puts passwords in a separate file, as does Apache with SSL
keys. I'm sure there are many other examples of this general model.
These systems enforce permissions for the sensitive files but not for the
general configiguration. Not only does this make system administration
easier, it also means that people are less likely to accidentally post
sensitive information in bug reports.
2) Other systems, like libvirt, named, and cups set their configuration to
be unreadable by default, but they don't fail if the permissions are
changed by the administrator.
3) It's not pretty, but maybe there could be a new command-line option:
--i-swear-i-dont-have-any-passwords-in-the-config-please-just-treat-me-
like-an-adult-and-start.
Okay, so (3) isn't a serious suggestion, but I think (1) would be a really
good idea. If anything, I think it actually improves security.
--
Ticket URL: <
https://fedorahosted.org/sssd/ticket/425#comment:13>
SSSD <
http://fedorahosted.org/sssd>
System Security Services Daemon
--
Thank you,
Dmitri Pal
Engineering Manager IPA project,
Red Hat Inc.
-------------------------------
Looking to carve out IT costs?
www.redhat.com/carveoutcosts/