[SSSD-users] root login with domain passwd
Joakim Tjernlund
joakim.tjernlund at transmode.se
Thu Sep 25 13:13:31 UTC 2014
>Joakim Tjernlund wrote:
>> How is local root pw any different than domain pw? In your view remote
>> root access is a big nono so sssd should also enforce no remote root
login in
>> that case.
>
>Yes, remote root password is a big no-no. Because it would be effective
on all
>systems at once circumventing most security mechanisms.
You missed the point. You claim remote root is a nono yet you suggest to
login
remotely with local root pw.
>
>I really appreciate sssd denying root completely. Most people concerned
about
>security surely agree.
But it don't. sssd does not deny remote local root pw logins.
>
>If you personally don't like this important aspect of sssd just use
something
>else.
>
>> You just said it: "best practice", not a law. In this context, sssd
>> dictates policy
>> and that is not sssd's call to make IMHO. You should encourage best
>> practice though.
>> One day we will get there but not today :)
>
>It seems you don't have proper operational processes on your side to
handle
>incidents and lock out your users from doing something bad. Then you ask
for a
>significant security relevant change in a widely used component. That
sucks.
But I don't. I just ask for the possibility choose. Let the default be as
is.
PS.
Please keep me on CC
Jocke
>
>Ciao, Michael.
More information about the sssd-users
mailing list