[SSSD] Legacy Systems Gateway Scenario
George McCollister
george.mccollister at gmail.com
Thu Jul 26 19:47:07 UTC 2012
I'd appreciate any feedback/ideas anyone might have on a possible
solution for a scenario I'm finding quite frequently when FreeIPA is
proposed for centralized security.
In this scenario legacy systems which don't support centralized access
control (or are hopelessly incompatible) co-exist with modern Linux
systems. One possible solution is to place the legacy systems behind a
gateway server to meet increased security requirements until they can be
phased out. For each legacy system the gateway would have an Apache
vhost front-end which would be exposed on the enterprise network. The
intent is to control access to individual front-ends using FreeIPA HBAC
rules as if they were real hosts. When a user attempts to login to the
front end the front end would use a currently non-existent sss client
library to perform authentication and check if the user has access to
the service on the vhost. In order to do this, the sss client library
must be able to pass the hostname of the vhost to SSSD. SSSD must then
use the passed hostname instead of the machine's actual hostname when
performing access checks. Currently SSSD's struct pam_data doesn't
include a field for destination host so even if a custom client library
and responder where created that were capable of passing on the hostname
the responder would have no way of passing the hostname to the data
provider (ipa).
The front-end application running under the Apache vhost forwards client
requests to the legacy host over an isolated vlan or other link and then
forwards responses from the legacy host back to the client.
Does anyone oppose the idea of changing struct pam_data to include a
field for the destination host and modifying the ipa provider (and other
if appropriate) to fill such requests?
A similar approach could be used to provide remote terminal access to
legacy hosts.
Has anyone else seen a need to do something like this?
Alternative Solutions (may not be feasible in some or all situations):
Use a hypervisor to run separate OS instances for each legacy system
front-end.
A custom solution could be created to retrieve and cache the necessary
information from FreeIPA and perform the checks instead of using SSSD
but this is undesirable for many reasons.
Thanks,
George McCollister
-------------- next part --------------
A non-text attachment was scrubbed...
Name: legacygateway.png
Type: image/png
Size: 55041 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20120726/f3813636/attachment.png>
More information about the sssd-devel
mailing list