[SSSD] [PATCH] 0001-Copy-edit-and-format-review-sssd.conf.patch

David O'Brien davido at redhat.com
Fri May 21 02:19:56 UTC 2010


Stephen Gallagher wrote:
> On 05/19/2010 08:30 AM, David O'Brien wrote:
>> Stephen Gallagher wrote:
>>> On May 19, 2010, at 3:46 AM, Jakub Hrozek<jhrozek at redhat.com>  wrote:
>>>
>>>> -----BEGIN PGP SIGNED MESSAGE-----
>>>> Hash: SHA1
>>>>
>>>> On 05/19/2010 09:27 AM, David O'Brien wrote:
>>>>> Now that this file is taking on the nature of a help file, I've
>>>>> attempted to improve its readability, with:
>>>>>
>>>>> 1. Minor layout changes (whitespace between sections)
>>>>> 2. Spell check, inc. s/backend/back end (standardization)
>>>>> 3. General copy-edit
>>>>>
>>>>> Pretty trivial stuff.
>>>>>
>>>> Nack, one of the comments still mentions EntryCacheTimeout and
>>>> EntryCacheNoWaitRefreshTimeout - these are remains of the v1 config
>>>> format, we should also change them to entry_cache_timeout and
>>>> entry_cache_nowait_timeout (the example below the comment is correct).
>>>>
>>>> I'm also windering whether we should advertise enumerate=True in the
>>>> examples for remote domains?
>>>>
>>>
>>> We should certainly mention it, but surround it with comments that it
>>> will impact performance and may impact security in the form of an
>>> information leak.
>>>
>> This seems to be contrary to what's mentioned in trac ticket #330, where
>> it says that enumerate=true is usually (surprisingly) more efficient and
>> should be set as the default. No mention of any security issues there...
>>
>> Have things changed? I'm not in a position to vote one way or the other.
>>
> 
> Yeah, that's way out of date now. We finally found the bug that was 
> causing enumerate=false to run really really slowly (and eat 100% CPU). 
> Once we knocked that out, we reset the default to be enumerate=false.
> 
> As far as security issues, it's not a serious one. It's just the 
> difference between a user being able to do 'getent passwd' and 
> immediately having a list of every user that could have access to the 
> system vs. requiring them to know the username in advance.
> 
I added a summary of sgallagh's work Re performance hit with 
enumeration=TRUE from the man page to the top of the section on example 
domain configurations.

Hopefully I've done the patch-fixing/amending properly. Feel free to 
offer "Do this next" instructions while I get my head around git, 
creating and submitting patches, and working in a collaborative environment.

Revision attached.
Thanks sgallagh for all the instruction so far.

/davido the sole doc writer for SSSD  ;-)
-- 

David O'Brien
Senior Technical Writer, Engineering Content Services
Red Hat Asia Pacific Pty Ltd
193 North Quay, Brisbane

"We couldn't care less about comfort. We make you feel good."
Federico Minoli CEO Ducati Motor S.p.A.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-Copy-edit-and-format-review-sssd.conf.patch
Type: text/x-patch
Size: 4376 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20100521/a3900f72/attachment.bin>


More information about the sssd-devel mailing list