Stephen Gallagher wrote:
On 05/19/2010 08:30 AM, David O'Brien wrote:
> Stephen Gallagher wrote:
>> On May 19, 2010, at 3:46 AM, Jakub Hrozek<jhrozek(a)redhat.com> wrote:
>>
>>> -----BEGIN PGP SIGNED MESSAGE-----
>>> Hash: SHA1
>>>
>>> On 05/19/2010 09:27 AM, David O'Brien wrote:
>>>> Now that this file is taking on the nature of a help file, I've
>>>> attempted to improve its readability, with:
>>>>
>>>> 1. Minor layout changes (whitespace between sections)
>>>> 2. Spell check, inc. s/backend/back end (standardization)
>>>> 3. General copy-edit
>>>>
>>>> Pretty trivial stuff.
>>>>
>>> Nack, one of the comments still mentions EntryCacheTimeout and
>>> EntryCacheNoWaitRefreshTimeout - these are remains of the v1 config
>>> format, we should also change them to entry_cache_timeout and
>>> entry_cache_nowait_timeout (the example below the comment is correct).
>>>
>>> I'm also windering whether we should advertise enumerate=True in the
>>> examples for remote domains?
>>>
>>
>> We should certainly mention it, but surround it with comments that it
>> will impact performance and may impact security in the form of an
>> information leak.
>>
> This seems to be contrary to what's mentioned in trac ticket #330, where
> it says that enumerate=true is usually (surprisingly) more efficient and
> should be set as the default. No mention of any security issues there...
>
> Have things changed? I'm not in a position to vote one way or the other.
>
Yeah, that's way out of date now. We finally found the bug that was
causing enumerate=false to run really really slowly (and eat 100% CPU).
Once we knocked that out, we reset the default to be enumerate=false.
As far as security issues, it's not a serious one. It's just the
difference between a user being able to do 'getent passwd' and
immediately having a list of every user that could have access to the
system vs. requiring them to know the username in advance.
I added a summary of sgallagh's work Re performance hit with
enumeration=TRUE from the man page to the top of the section on example
domain configurations.
Hopefully I've done the patch-fixing/amending properly. Feel free to
offer "Do this next" instructions while I get my head around git,
creating and submitting patches, and working in a collaborative environment.
Revision attached.
Thanks sgallagh for all the instruction so far.
/davido the sole doc writer for SSSD ;-)
--
David O'Brien
Senior Technical Writer, Engineering Content Services
Red Hat Asia Pacific Pty Ltd
193 North Quay, Brisbane
"We couldn't care less about comfort. We make you feel good."
Federico Minoli CEO Ducati Motor S.p.A.