[SSSD] [PATCH] 0001-Copy-edit-and-format-review-sssd.conf.patch

Stephen Gallagher sgallagh at redhat.com
Fri May 21 11:00:24 UTC 2010


On 05/20/2010 10:19 PM, David O'Brien wrote:
> Stephen Gallagher wrote:
>> On 05/19/2010 08:30 AM, David O'Brien wrote:
>>> Stephen Gallagher wrote:
>>>> On May 19, 2010, at 3:46 AM, Jakub Hrozek<jhrozek at redhat.com> wrote:
>>>>
>>>>> -----BEGIN PGP SIGNED MESSAGE-----
>>>>> Hash: SHA1
>>>>>
>>>>> On 05/19/2010 09:27 AM, David O'Brien wrote:
>>>>>> Now that this file is taking on the nature of a help file, I've
>>>>>> attempted to improve its readability, with:
>>>>>>
>>>>>> 1. Minor layout changes (whitespace between sections)
>>>>>> 2. Spell check, inc. s/backend/back end (standardization)
>>>>>> 3. General copy-edit
>>>>>>
>>>>>> Pretty trivial stuff.
>>>>>>
>>>>> Nack, one of the comments still mentions EntryCacheTimeout and
>>>>> EntryCacheNoWaitRefreshTimeout - these are remains of the v1 config
>>>>> format, we should also change them to entry_cache_timeout and
>>>>> entry_cache_nowait_timeout (the example below the comment is correct).
>>>>>
>>>>> I'm also windering whether we should advertise enumerate=True in the
>>>>> examples for remote domains?
>>>>>
>>>>
>>>> We should certainly mention it, but surround it with comments that it
>>>> will impact performance and may impact security in the form of an
>>>> information leak.
>>>>
>>> This seems to be contrary to what's mentioned in trac ticket #330, where
>>> it says that enumerate=true is usually (surprisingly) more efficient and
>>> should be set as the default. No mention of any security issues there...
>>>
>>> Have things changed? I'm not in a position to vote one way or the other.
>>>
>>
>> Yeah, that's way out of date now. We finally found the bug that was
>> causing enumerate=false to run really really slowly (and eat 100%
>> CPU). Once we knocked that out, we reset the default to be
>> enumerate=false.
>>
>> As far as security issues, it's not a serious one. It's just the
>> difference between a user being able to do 'getent passwd' and
>> immediately having a list of every user that could have access to the
>> system vs. requiring them to know the username in advance.
>>
> I added a summary of sgallagh's work Re performance hit with
> enumeration=TRUE from the man page to the top of the section on example
> domain configurations.
>
> Hopefully I've done the patch-fixing/amending properly. Feel free to
> offer "Do this next" instructions while I get my head around git,
> creating and submitting patches, and working in a collaborative
> environment.
>
> Revision attached.
> Thanks sgallagh for all the instruction so far.
>
> /davido the sole doc writer for SSSD ;-)
>

Ack. Will fix a minor typo s/visibile/visible/ when I push.

-- 
Stephen Gallagher
RHCE 804006346421761

Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/



More information about the sssd-devel mailing list