[SSSD-users] netgroups alternative?
Stephen Gallagher
sgallagh at redhat.com
Fri Nov 9 13:11:30 UTC 2012
On Fri 09 Nov 2012 05:10:10 AM EST, Sumit Bose wrote:
> On Fri, Nov 09, 2012 at 10:56:21AM +0100, Ondrej Valousek wrote:
>> I would like to get a similar functionality as for netgroups - i.e. who can login where and from where using which mechanism.
>> HBAC only offers possibility to control who can login where, I suppose, right?
>>
>> If I wanted to also control the from where and which mechanism (i.e. ssh/telnet/nfs) then only netgroups will help me right?
>
> HBAC also covers the mechanism (in HBAC it is called service). To alos
> get the 'from where' you have to set ipa_hbac_support_srchost in
> sssd.conf. Please note that determine the source host is not reliable
> and depends on the PAM clients (sshd, telnetd, nfsd...).
>
I just want to note that source-host rules with netgroups are
unreliable as well for the same reasons. PAM has no secure way of
verifying that the rhost field is populated with accurate data and
there is also no universal standard for what form the contents must
take (DNS hostname vs IP address, etc.). Thus, it's never safe to rely
on origin. That's the reason we stopped supporting this by default in
SSSD.
More information about the sssd-users
mailing list