[SSSD] [Fwd: Re: #425: sssd.conf required to have permissions 0600]

Dmitri Pal dpal at redhat.com
Fri Mar 19 19:41:13 UTC 2010


I think 1) is a good suggestion.
Can we open an RFE about it?

By the way ini interface supports reading HEX encoded binary data so if
you want to use INI format to store keys and passwords it is doable.

-------- Original Message --------
Subject: 	Re: [SSSD] #425: sssd.conf required to have permissions 0600
Date: 	Fri, 19 Mar 2010 18:41:16 -0000
From: 	SSSD <trac at fedorahosted.org>
Reply-To: 	nobody at fedoraproject.org
To: 	undisclosed-recipients:;
References: 	<047.ddab9a83284651abdee8770a05aab5bd at fedorahosted.org>



#425: sssd.conf required to have permissions 0600
------------------------+---------------------------------------------------
    Reporter:  amcnabb  |        Owner:  somebody    
        Type:  defect   |       Status:  reopened    
    Priority:  major    |    Milestone:  NEEDS_TRIAGE
   Component:  SSSD     |      Version:  1.0.5       
  Resolution:           |     Keywords:              
     Fixedin:           |          Doc:  0           
       Tests:  0        |   Docupdated:  0           
Testsupdated:  0        |  
------------------------+---------------------------------------------------
Comment (by amcnabb):

 It will be a few days before I can get to it, but I'll open a separate bug
 report about session hangs.  I agree that this bug report should focus on
 the symlink thing (which is just silly and doesn't actually protect from
 anything) and the permissions thing.  A few thoughts about permissions:

 1) Postfix puts passwords in a separate file, as does Apache with SSL
 keys.  I'm sure there are many other examples of this general model.
 These systems enforce permissions for the sensitive files but not for the
 general configiguration.  Not only does this make system administration
 easier, it also means that people are less likely to accidentally post
 sensitive information in bug reports.

 2) Other systems, like libvirt, named, and cups set their configuration to
 be unreadable by default, but they don't fail if the permissions are
 changed by the administrator.

 3) It's not pretty, but maybe there could be a new command-line option:
 --i-swear-i-dont-have-any-passwords-in-the-config-please-just-treat-me-
 like-an-adult-and-start.

 Okay, so (3) isn't a serious suggestion, but I think (1) would be a really
 good idea.  If anything, I think it actually improves security.

-- 
Ticket URL: <https://fedorahosted.org/sssd/ticket/425#comment:13>
SSSD <http://fedorahosted.org/sssd>
System Security Services Daemon


-- 
Thank you,
Dmitri Pal

Engineering Manager IPA project,
Red Hat Inc.


-------------------------------
Looking to carve out IT costs?
www.redhat.com/carveoutcosts/




More information about the sssd-devel mailing list