[9064] in athena10
[Mail review request] nonlocal functionality
daemon@ATHENA.MIT.EDU (Edward Z. Yang)
Tue May 22 21:39:19 2012
Content-Type: text/plain; charset=UTF-8
To: scripts-team@MIT.EDU, debathena@MIT.EDU
From: "Edward Z. Yang" <ezyang@MIT.EDU>
Date: Tue, 22 May 2012 21:39:13 -0400
Message-Id: <1337736184-sup-3646@ezyang>
Content-Transfer-Encoding: 8bit
I'd like to send this mail to sssd-devel@lists.fedorahosted.org
Please let me know if I messed up anything.
Relevant tickets:
- https://athena10.mit.edu/trac/ticket/486
- http://scripts.mit.edu/trac/ticket/278
Edward
----
Hello all,
We're interested in using SSSD to replace our current use of
NSS/PAM/NSCD/NSLCD. However, we were curious whether or not
SSSD had implemented some critical security checks to protect
against malicious remote domains.
- What are the semantics of the local domain: that is,
do I have a guarantee that entries in local will never
be affected by the network?
- If the answer to the above is true, how does SSSD resolve
conflicts between two domains which have entries that claim
the same UID? I understand that the max_id/min_id functionality
is intended to address this partially, but does SSSD do any
further sanity checks, such as refusing information from
remote domains that exist in local domains?
- Additionally, users may come with groups, and it is bad if
remote domains can spoof ownership in local groups. Is there
anyway to lock this down?
- It is frequently useful for applications running on the system
to be able to identify nonlocal users as opposed to local users;
we had a nsswitch module which identified nonlocal users and
added them to their own group. Does this functionality exist
in SSSD? (It's also convenient to have another group which contains
local users.)
- A nice to have feature (though not strictly necessary), is the
ability to globally add nonlocal users to some local group.
Is this supported?
The MIT Debathena and Scripts projects would be very interested
in seeing this functionality exist, and if it doesn't, we'd be
interested in contributing this functionality.
Thanks,
Edward
