[Freeipa-devel] [DESIGN][UPDATE] Time-Based HBAC Policies

[Jan Cholasta]

On 26.8.2016 16:39, Simo Sorce wrote:
> On Fri, 2016-08-26 at 12:39 +0200, Martin Basti wrote:
>>> I miss "why" part of "To be able to handle backward compatibility
>> with
>>> ease, a new object called ipaHBACRulev2 is introduced. " in the
>> design
>>> page. If the reason is the above - old client's should ignore time
>> rules
>>> then it has to be mentioned there. Otherwise I don't see a reason to
>>> introduce a new object type instead of extending the current.
>>
>> How do you want to enforce HBAC rule that have set time from 10 to 14
>> everyday? With the same objectclass old clients will allow this HBAC
>> for
>> all day. Isn't this CVE?
>
> This is a discussion worth having.
>
> In general it is a CVE only if an authorization mechanism fails to work
> as advertised.
>
> If you make it clear that old clients *DO NOT* respect time rules then
> there is no CVE material, it is working as "described".
>
> The admins already have a way to not set those rules for older clients
> by simply grouping newer clients in a different host group and applying
> time rules only there.
>
> So the question really is: should we allow admins to apply an HBAC Rule
> potentially to older clients that do not understand it and will
> therefore allow access at any time of the day, or should we prevent it ?
>
> This is a hard question to answer and can go both ways.
>
> A time rule may be something that admins want to enforce at all cost or
> deny access. In this case a client that fails to handle it would be a
> problem.
>
> But it may be something that is just used for defense in depth and not a
> strictly hard requirement. In this case allowing older clients would
> make it an easy transition as you just set up the rule and the client
> will start enforcing the time when it is upgraded but work otherwise
> with the same rules.

That does not make a lot of sense to me. If the admin does not really 
care about enforcing the access time, why would they bother setting it 
in the first place?

>
> I am a bit conflicted on trying to decide what scenario we should
> target, but the second one appeals to me because host groups do already
> give admins a good way to apply rules to a specific set of hosts and
> exclude old clients w/o us making it a hard rule.
> OTOH if an admin does not understand this difference, they may be
> surprised to find out there are clients that do not honor it.

The second one does not appeal to me, because it is inviting to the kind 
of mistakes which would allow access when it should not be allowed and 
IMHO it's better to be safe than sorry.

>
> Perhaps we could find a way to set a flag on the rule such that when set
> (and only when set) older clients get excluded by way of changing the
> objectlass or something else to similar effect.
>
> Open to discussion.
>
> Simo.
>


-- 
Jan Cholasta