[SSSD] better handling of DNS timeouts

Dmitri Pal dpal at redhat.com
Fri Aug 19 18:39:51 UTC 2011


On 08/19/2011 02:17 PM, Stephen Gallagher wrote:
> On Fri, 2011-08-19 at 14:07 -0400, Dmitri Pal wrote:
>> I think you are wrong and there use cases when the timeout should be
>> different. But I will stop insisting.
>> And IMO if the auth can't go without the internal ID lookup is also
>> wrong. It should be an option to trust the auth server to do the right
>> thing and use id from cache.
>>
> This is absolutely wrong. The reason for the forced ID lookup is because
> you need to be sure that access-control rules are up-to-date. Those
> access-control rules are not available to the auth server in many cases
> (one such example is HBAC; consider a firewall issue or DS crash). It's
> a security vulnerability to rely on online authentication and cached
> access-control rules at the same time.
>
> Other common examples would be classic LDAP/kerberos authentication
> using either the simple access provider or pam_access. If the user's
> group list has changed since the cache was updated, we could potentially
> be granting access where it should now have been removed.
>
> If the identity server is offline, we MUST work only with what we have
> in the cache. This means using cached auth instead of online auth. (The
> advantage here with Kerberos is that it means they aren't being granted
> a TGT either).
You are correct about the implications and by default we should what we
do now.
But IMO it should be a choice with the current behavior as default.
The admin would need to assess the threat and implication of allowing
access control checks against offline data.
Do not forget that this is how it has been done for years with local
access.conf.

It is good to direct people to the better choices and best practices but
not to take the choices from them. In this case we try to "force" best
practices which is good but we eventually need to be more flexible.

Not a priority but is worth a "deferred" ticket...


>
> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://fedorahosted.org/mailman/listinfo/sssd-devel


-- 
Thank you,
Dmitri Pal

Sr. Engineering Manager IPA project,
Red Hat Inc.


-------------------------------
Looking to carve out IT costs?
www.redhat.com/carveoutcosts/



-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20110819/f92a7e5e/attachment.html>


More information about the sssd-devel mailing list