[SSSD] [Fwd: Re: #425: sssd.conf required to have permissions 0600]

Dmitri Pal dpal at redhat.com
Fri Mar 19 21:00:38 UTC 2010


Simo Sorce wrote:
> On Fri, 19 Mar 2010 15:41:13 -0400
> Dmitri Pal <dpal at redhat.com> wrote:
>
>   
>> I think 1) is a good suggestion.
>> Can we open an RFE about it?
>>     
>
> We actually briefly discussed this option privately this morning.
>
> An idea was to store passwords in sssd.ldb, needs more thinking though,
> especially in how to keep compatibility with the current file format.
>
>   
I am not sure you want to have an LDB. I think you want a human editable
file for the same resons we moved out from the config.db in the past.
To deal with sssd.ldb admins would have to use the utilities while with
flat INI file they can just edit.
Also for us it will be more code to maintain.

How to migrate?
Well I think a simple conversion utility would be helpful.
Wen installed it will read the INI file get the passwords from it, stick
into a different file set right permissions on both.
Effectively we are splitting configuration into two files: sssd.conf &
sssd_pwd.conf

Alternative is not to do it automatically but still provide such utility
and to support a new reference key that will point to a section and key
in a ssss_pwd.conf file .
All this functionality will come for free if we escalate some of the INI
decklog enhancements that we already plan to do some day.

Not insisting though. Just making an argument...




> Simo.
>
>   


-- 
Thank you,
Dmitri Pal

Engineering Manager IPA project,
Red Hat Inc.


-------------------------------
Looking to carve out IT costs?
www.redhat.com/carveoutcosts/




More information about the sssd-devel mailing list