[SSSD] [PATCH] AD: Add initial gpo-smb implementation.

Sumit Bose sbose at redhat.com
Wed Jun 18 12:07:00 UTC 2014


On Sat, Jun 14, 2014 at 09:01:53PM -0400, Yassir Elley wrote:
> 
> 
> ----- Original Message -----
> > On Thu, Jun 12, 2014 at 04:37:25PM -0400, Yassir Elley wrote:
> > > 
> > > 
> > > 

...

> > > > 
> > > > Second, you are only checking SeInteractiveLogonRight and
> > > > SeDenyInteractiveLogonRight. What about
> > > > Se[Deny][Network|Batch|Service|RemoteInteractive]LogonRight? Are you
> > > > planning to integrate them as well and relate them to different PAM
> > > > services?
> > > 
> > > The plan for the initial deployment is to only support
> > > SeInteractiveLogonRight and SeDenyInteractiveLogonRight.
> > 
> > ok, but please keep in mind that it would be hard to add support for
> > different login types, e.g. network vs. console, later on without
> > breaking backward compatibility.
> 
> We are initially supporting console login as a feature. If we later decide to support network login as a feature (in a subsequent release), what is the concern regarding backward compatibility?

currently the patches add access control to all services not only
console login. This means that currently SeInteractiveLogonRight
SeDenyInteractiveLogonRight catches all services. If later on you want
to add support for Se[Deny]NetworkLogonRight you either have to restrict
the scope of Sei[Deny]InteractiveLogonRight which is not backward
compatible. Or admins have to explicitly list all users and groups which
should only be allowed to log in over the network in
SeDenyInteractiveLogonRight which afaik is not needed for Windows
clients.

bye,
Sumit
> 
> > 



More information about the sssd-devel mailing list