[SSSD] Please review: https://fedorahosted.org/sssd/wiki/SecuritySensitiveOptions

Jakub Hrozek jhrozek at redhat.com
Wed Sep 30 09:24:01 UTC 2015


On Wed, Sep 30, 2015 at 10:37:30AM +0200, Lukas Slebodnik wrote:
> On (30/09/15 09:38), Jakub Hrozek wrote:
> >Hi,
> >
> >to help the OpenSCAP integration, I prepared a wiki page that contains
> >options which have a security impact -- either positive (drop root) or
> >negative (ignore certificate validation issues).
> >
> >I also tried to explain the effect of the options along with the
> >description. There are some more items that can be included, but I
> >wasn't sure about them myself, like:
> >    * should obfuscated passwords be mentioned? I wasn't sure because on
> >      one hand it really doesn't provide any benefit, on the other hand,
> >      the option can be used to check a compliance box that requires no
> >      passwords be stored in files..
> >    * should the page warn against the
> >      auth-option-that-shall-not-be-mentioned or politely deny its
> >      existence? :-)
> >    * What about fd_limit ? Should resource consumption be considered
> >      a security property, especially if we already honor system default? I
> >      think here the default is enough, so I didn't document that option.
> >
> >Please provide your comments or edit the wiki directly. Thanks!
> 
> What about:
> 
>        simple_deny_users (string)
>            Comma separated list of users who are explicitly denied access.
> 
>        simple_deny_groups (string)
>            Comma separated list of groups that are explicitly denied access. This applies only to
>            groups within this SSSD domain. Local groups are not evaluated.
> 
> Whitelisting is much secure than blacklisting.

Good idea, added:
    https://fedorahosted.org/sssd/wiki/SecuritySensitiveOptions?action=diff&version=6&old_version=5


More information about the sssd-devel mailing list