[SSSD] sss_cache flush ssh hosts list.

Jan Cholasta jcholast at redhat.com
Tue Jun 24 08:21:16 UTC 2014


Hi,

I'm terribly sorry for the late reply.

On 18.6.2014 17:53, Jakub Hrozek wrote:
> On Thu, May 29, 2014 at 10:30:26AM +0930, William wrote:
>> On Mon, 2014-05-26 at 09:19 +0200, Jan Cholasta wrote:
>>> On 26.5.2014 03:41, William wrote:
>>>>
>>>>> I'm afraid there is no right thing to call ATM, as there is no support
>>>>> for cache invalidation in SSH host code. I guess you'll have to
>>>>> implement it yourself.
>>>>>
>>>>> Off the top of my head, you need to properly set SYSDB_CACHE_EXPIRE in
>>>>> sysdb_store_ssh_host, return only unexpired hosts in
>>>>> sysdb_get_ssh_known_hosts, make sysdb_search_ssh_hosts public and create
>>>>> sysdb_set_ssh_host_attr (sysdb_update_ssh_hosts does the same, so you
>>>>> can modify and rename it instead of writing a completely new function).
>>>>
>>>> Please find attached a patch that adds the functionality. Note that
>>>> ssh_hosts don't use the dataExpire attribute, they use a different
>>>> attribute, which is why I opted to call ssh_known_host_expire.
>>>>
>>>
>>> I'm sorry, but that's completely wrong. The ssh_known_host_expire
>>> attribute does *not* denote cache entry expiration, it denotes
>>> known_hosts entry expiration, hence my request to add support for
>>> SYSDB_CACHE_EXPIRE. Unless you do that, I can't ACK.
>>>
>>
>> Here is the fixed patch as per your advice. I am now adding the
>> SYSDB_CACHE_EXPIRE attribute to ssh_hosts on add, the update attr
>> function is now exposed, and I added some helpers to keep inline with
>> some of the other sysdb functions.

Could you add a sssd.conf option for the cache timeout?

>>
>> I noticed in my testing that when a host had been expired, it wasn't put
>> into known_hosts (Which is correct), but that the sss_ssh_knownproxy or
>> other process wasn't updating the actual sysdb entries with the new key.
>> Where is the refresh of an expired host taking place, or rather, where
>> should it be taking place? I suspect it is in the freeipa provider code
>> somewhere ...

That's right, it's in src/providers/ipa/ipa_hostid.c. All it does is 
call sysdb_store_ssh_host, which is where the refresh should take place.

>>
>
> Honza, does this patch version look any better to you?
>

Besides the above, there are some whitespace errors:

0001-Allow-sss_cache-to-expire-sshKnownHosts.patch:60: trailing whitespace.
errno_t
0001-Allow-sss_cache-to-expire-sshKnownHosts.patch:121: trailing whitespace.
int
0001-Allow-sss_cache-to-expire-sshKnownHosts.patch:220: trailing whitespace.

0001-Allow-sss_cache-to-expire-sshKnownHosts.patch:296: trailing whitespace.

warning: 4 lines add whitespace errors.

Honza

-- 
Jan Cholasta



More information about the sssd-devel mailing list