[SSSD-users] [RFE] Session Tracking Control

Jan Pazdziora jpazdziora at redhat.com
Mon Jun 22 15:40:29 UTC 2015


On Mon, Jun 22, 2015 at 02:03:59PM +0200, Michael Ströder wrote:
> 
> I'd be glad if this RFE could make it into 1.13.x:
> 
> https://fedorahosted.org/sssd/ticket/2411

By no means would I like to question the benefit of the RFE. However,
in your comment there, you say

	To add an important use-case for this: If a machine got hacked
	and the login logs are manipulated you would still see in the
	LDAP server's log from IP address a password check was
	initiated.

That is really an argument for remote logging in general, not for
session tracking. If the system is compromised, the attacker can feed
whatever information it wants to the LDAP server. Yes, they will also
be able to change existing (old) login logs in /var/log on the client
but the solution is really not to rely on those but have them
transferred to secure location as soon as reasonably possible.

-- 
Jan Pazdziora
Senior Principal Software Engineer, Identity Management Engineering, Red Hat


More information about the sssd-users mailing list