[SSSD] [PATCH] 0001-Copy-edit-and-format-review-sssd.conf.patch

Stephen Gallagher sgallagh at redhat.com
Wed May 19 12:59:50 UTC 2010


On 05/19/2010 08:30 AM, David O'Brien wrote:
> Stephen Gallagher wrote:
>> On May 19, 2010, at 3:46 AM, Jakub Hrozek<jhrozek at redhat.com>  wrote:
>>
>>> -----BEGIN PGP SIGNED MESSAGE-----
>>> Hash: SHA1
>>>
>>> On 05/19/2010 09:27 AM, David O'Brien wrote:
>>>> Now that this file is taking on the nature of a help file, I've
>>>> attempted to improve its readability, with:
>>>>
>>>> 1. Minor layout changes (whitespace between sections)
>>>> 2. Spell check, inc. s/backend/back end (standardization)
>>>> 3. General copy-edit
>>>>
>>>> Pretty trivial stuff.
>>>>
>>> Nack, one of the comments still mentions EntryCacheTimeout and
>>> EntryCacheNoWaitRefreshTimeout - these are remains of the v1 config
>>> format, we should also change them to entry_cache_timeout and
>>> entry_cache_nowait_timeout (the example below the comment is correct).
>>>
>>> I'm also windering whether we should advertise enumerate=True in the
>>> examples for remote domains?
>>>
>>
>> We should certainly mention it, but surround it with comments that it
>> will impact performance and may impact security in the form of an
>> information leak.
>>
> This seems to be contrary to what's mentioned in trac ticket #330, where
> it says that enumerate=true is usually (surprisingly) more efficient and
> should be set as the default. No mention of any security issues there...
>
> Have things changed? I'm not in a position to vote one way or the other.
>

Yeah, that's way out of date now. We finally found the bug that was 
causing enumerate=false to run really really slowly (and eat 100% CPU). 
Once we knocked that out, we reset the default to be enumerate=false.

As far as security issues, it's not a serious one. It's just the 
difference between a user being able to do 'getent passwd' and 
immediately having a list of every user that could have access to the 
system vs. requiring them to know the username in advance.

-- 
Stephen Gallagher
RHCE 804006346421761

Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/



More information about the sssd-devel mailing list