[SSSD] Please review: https://fedorahosted.org/sssd/wiki/SecuritySensitiveOptions

Pavel Reichl preichl at redhat.com
Wed Sep 30 08:07:48 UTC 2015


On 09/30/2015 09:38 AM, Jakub Hrozek wrote:
> Hi,
>
> to help the OpenSCAP integration, I prepared a wiki page that contains
> options which have a security impact -- either positive (drop root) or
> negative (ignore certificate validation issues).
>
> I also tried to explain the effect of the options along with the
> description. There are some more items that can be included, but I
> wasn't sure about them myself, like:
>      * should obfuscated passwords be mentioned? I wasn't sure because on
>        one hand it really doesn't provide any benefit, on the other hand,
>        the option can be used to check a compliance box that requires no
>        passwords be stored in files..
>      * should the page warn against the
>        auth-option-that-shall-not-be-mentioned or politely deny its
>        existence? :-)
>      * What about fd_limit ? Should resource consumption be considered
>        a security property, especially if we already honor system default? I
>        think here the default is enough, so I didn't document that option.
>
> Please provide your comments or edit the wiki directly. Thanks!
> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
>

Should not we also mention dreadful option ldap_auth_disable_tls_never_use_in_production ?

I know it's undocumented, but I suppose OpenSCAP should report its presence anyway.


More information about the sssd-devel mailing list