[SSSD] [PATCH] enable debugging of krb5_child
Stephen Gallagher
sgallagh at redhat.com
Mon Oct 12 13:49:24 UTC 2009
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 10/12/2009 09:46 AM, Sumit Bose wrote:
> Hi,
>
> Although there are lots of DEBUG calls in krb5_child it always runs with
> debug_level=0. This patch starts krb5_child with the debugging options
> of the backend.
>
> There is a problem with --debug-to-files. krb5_child runs as the user
> requesting the ticket so the path to krb5_child.log needs to have
> matching permissions. A possible solution would be to create the file
> with 666 permissions during the setup of the kerberos backend. Any other
> ideas?
This is what the ELAPI is for. We'll take advantage of it when it's
ready. In the meantime, I think it's probably ok to ignore this option
in the child, for security reasons. We don't want other users being able
to read the authentication logs for a user!
>
> bye,
> Sumit
>
>
>
> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://fedorahosted.org/mailman/listinfo/sssd-devel
- --
Stephen Gallagher
RHCE 804006346421761
Looking to carve out IT costs?
www.redhat.com/carveoutcosts/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
iEYEARECAAYFAkrTM90ACgkQeiVVYja6o6OHpwCfSUqB/REtB06083Wlt0Tlr7TV
a0IAn14JXBlNMZ6o1BRpKO3Nwt9ZujfL
=fkiI
-----END PGP SIGNATURE-----
More information about the sssd-devel
mailing list