[SSSD] [RFE] Ability of sssd to override shell per group and per user

Pavel Reichl preichl at redhat.com
Mon Oct 6 11:57:49 UTC 2014


Hello,

we have an RFE: Ability of sssd to override shell per group and per user

(described in ticket - https://fedorahosted.org/sssd/ticket/2135 and BZ 
- https://bugzilla.redhat.com/show_bug.cgi?id=986394)

Is it generally a good idea to override shell per group and user or are 
there any hidden security threats?

IIRC we can override shell based on primary group only because in time 
when shell overrides are processed no secondary groups are known, is it OK?

Would introducing new configuration options 
'override_shell_per_{user,group}' in NSS section be the right way to 
implement this RFC?

override_shell_per_user = user1 at domain1:sh1, user2:sh2, uid1:sh3
override_shell_per_group = group1 at domain1:sh1, group2:sh2, gid1:sh3

Thanks for opinions!



More information about the sssd-devel mailing list