[SSSD-users] netgroups alternative?

Stephen Gallagher sgallagh at redhat.com
Fri Nov 9 13:11:30 UTC 2012


On Fri 09 Nov 2012 05:10:10 AM EST, Sumit Bose wrote:
> On Fri, Nov 09, 2012 at 10:56:21AM +0100, Ondrej Valousek wrote:
>> I would like to get a similar functionality as for netgroups - i.e. who can login where and from where using which mechanism.
>> HBAC only offers possibility to control who can login where, I suppose, right?
>>
>> If I wanted to also control the from where and which mechanism (i.e. ssh/telnet/nfs) then only netgroups will help me right?
>
> HBAC also covers the mechanism (in HBAC it is called service). To alos
> get the 'from where' you have to set ipa_hbac_support_srchost in
> sssd.conf. Please note that determine the source host is not reliable
> and depends on the PAM clients (sshd, telnetd, nfsd...).
>


I just want to note that source-host rules with netgroups are 
unreliable as well for the same reasons. PAM has no secure way of 
verifying that the rhost field is populated with accurate data and 
there is also no universal standard for what form the contents must 
take (DNS hostname vs IP address, etc.). Thus, it's never safe to rely 
on origin. That's the reason we stopped supporting this by default in 
SSSD.


More information about the sssd-users mailing list