[SSSD] [PATCH] enable debugging of krb5_child

Stephen Gallagher sgallagh at redhat.com
Mon Oct 12 13:49:24 UTC 2009


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 10/12/2009 09:46 AM, Sumit Bose wrote:
> Hi,
> 
> Although there are lots of DEBUG calls in krb5_child it always runs with
> debug_level=0. This patch starts krb5_child with the debugging options
> of the backend.
> 
> There is a problem with --debug-to-files. krb5_child runs as the user
> requesting the ticket so the path to krb5_child.log needs to have
> matching permissions. A possible solution would be to create the file
> with 666 permissions during the setup of the kerberos backend. Any other
> ideas?

This is what the ELAPI is for. We'll take advantage of it when it's
ready. In the meantime, I think it's probably ok to ignore this option
in the child, for security reasons. We don't want other users being able
to read the authentication logs for a user!

> 
> bye,
> Sumit
> 
> 
> 
> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://fedorahosted.org/mailman/listinfo/sssd-devel


- -- 
Stephen Gallagher
RHCE 804006346421761

Looking to carve out IT costs?
www.redhat.com/carveoutcosts/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAkrTM90ACgkQeiVVYja6o6OHpwCfSUqB/REtB06083Wlt0Tlr7TV
a0IAn14JXBlNMZ6o1BRpKO3Nwt9ZujfL
=fkiI
-----END PGP SIGNATURE-----



More information about the sssd-devel mailing list