[SSSD] Design Discussion: Restricting domains per PAM service

Jakub Hrozek jhrozek at redhat.com
Tue Sep 23 15:14:05 UTC 2014


On Tue, Sep 23, 2014 at 11:01:22AM -0400, Simo Sorce wrote:
> > > > Normally, the list of allowed domains for untrusted users should
> > > > be 'all', which is the current behavirour. However, if the
> > > > trusted user list is set, we should default to 'none' and require
> > > > that access to untrusted domains is set explicitly.
> > > 
> > > Why ? I do not think we really need to have this, having defaults
> > > change based on other parameters may confuse people.
> > > I would rather just document that you should change the other value
> > > in the man page and documentation.
> > 
> > I'm afraid administrators will not read the docs in full. If the
> > default is 'allow all' they might just append the domains=foo
> > parameter to the pam_sss.so line and think that the pam module can
> > only contact a certain domain. In reality, all untrusted processes
> > would still be able to access all domains.
> > 
> > Forcing the admin to change the list of domains accessible to
> > untrusted users would make sure they explicitly spell out the
> > domains..
> 
> Ok what about we change how things work then.
> We set pam_allowed_auth_domains to always be none by default, but
> we make the default for pam_trusted_users to be ALL (or * whatever
> looks better).

I think we have a similar problem here b/c we need to document that merely
adding domains= to the pam_sss.so module doesn't restrict the domains sssd
talks to, you still need to edit sssd.conf. But we only have one set of
defaults and they don't change, so I'm OK with this proposal.

> 
> This way in current configs all keeps working as users are all trusted.

Previous configs would work also in the previous schema, but I agree
the configuration is simpler now.



More information about the sssd-devel mailing list