[SSSD-users] LDAP access provider - list of groups in directory?

Michael Ströder michael at stroeder.com
Fri Jul 11 09:20:25 UTC 2014


On Fri, 11 Jul 2014 10:45:10 +0200 Jakub Hrozek <jhrozek at redhat.com> wrote

> On Fri, Jul 11, 2014 at 08:58:10AM +0200, Michael Ströder wrote:
> > > HBAC is very similar to this but already done for you.
> > >
> > >
http://www.freeipa.org/docs/master/html-desktop/index.html#configuring-host-a
> > > ccess > 
> > Does it also disallow LDAP read access to users/groups/sudoers which are
> > not allowed to login or to be used on a host?
> 
> No, it's pure access control evaluated during the PAM access phase.

This means: If a server gets hacked the attacker can find out more about the
rest of the server infrastructure by queyring FreeIPA's LDAP backend.

Ciao, Michael.




More information about the sssd-users mailing list