[SSSD] [PATCHES] SSH: Expire hosts in known_hosts

Jan Cholasta jcholast at redhat.com
Mon Oct 1 08:23:33 UTC 2012


Hi,

Dne 24.9.2012 15:56, Jan Cholasta napsal(a):
> Dne 24.9.2012 15:03, Pavel Březina napsal(a):
>> On 09/19/2012 12:09 PM, Jan Cholasta wrote:
>>> Hi,
>>>
>>> this patch set changes the way the known_hosts file is updated so that
>>> only entries for hosts that were requested recently (in the last 5
>>> minutes) are written to the file. There is no need to keep older entries
>>> in the file, as host keys are needed only before the connection to the
>>> host is established (which usually takes just a few seconds).
>>>
>>> The individual patches are:
>>>
>>> [PATCH 1/3] DB: Add function for deleting values from sysdb_attrs
>>
>> Nack.
>> Can you make new copy of attrs without the deleted attributes instead of
>> touching the original attrs?
>
> Sure.

It turns out I don't need this function anymore, so this patch is removed.

>
>>
>>> [PATCH 2/3] SSH: Refactor sysdb code
>>
>> Nack.
>>
>> sysdb_update_ssh_host(), sysdb_store_ssh_host():
>> Is there any advantage to allow the input attrs parameter to be NULL?
>> Currently there is no code flow how this could happened (except sysdb
>> test) so I would simply prohibit it and make the code simpler.
>
> I believe that was a copy & paste from some other sysdb function, you
> are probably right that it can be safely removed.

Done.

>
>>
>> sysdb_update_ssh_host():
>> What is the purpose of deleting OC and NAME attributes and then adding
>> them again?
>
> ldb complains when the same value is present more than once in a single
> attribute (such as name) and refuses to store the entry.

I have taken a slightly different approach here: instead of deleting 
unwanted attributed in sysdb functions, I copy only host keys from the 
LDAP result in hostid provider (the rest of attributes is not 
interesting from SSH perspective anyway).

>
>>
>>> [PATCH 3/3] SSH: Expire hosts in known_hosts
>>
>> Ack.

Added a new configuration option ssh_known_hosts_timeout, which can be 
used to specify the timeout of known_hosts entries in seconds. Also 
added a sysdb upgrade routine so that this patch works for existing 
installs as well.

>
> Honza
>

Honza

-- 
Jan Cholasta
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001.1-SSH-Refactor-sysdb-and-related-code.patch
Type: text/x-patch
Size: 23471 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20121001/bc001ace/attachment.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0002.1-SSH-Expire-hosts-in-known_hosts.patch
Type: text/x-patch
Size: 13536 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20121001/bc001ace/attachment-0001.bin>


More information about the sssd-devel mailing list