<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head> <meta content="text/html; charset=UTF-8" http-equiv="Content-Type"> </head> <body bgcolor="#ffffff" text="#000000"> On 01/05/2012 05:07 PM, Erinn Looney-Triggs wrote: <blockquote cite="mid:4F061F3F.90008@gmail.com" type="cite"> <pre wrap="">On 01/05/2012 11:54 AM, Stephen Gallagher wrote: </pre> <blockquote type="cite"> <pre wrap="">On Thu, 2012-01-05 at 11:48 -0900, Erinn Looney-Triggs wrote: </pre> <blockquote type="cite"> <pre wrap="">Yes that look about right, not able to confirm 100%, but that is probably the issue. </pre> </blockquote> <pre wrap=""> We're looking into it. However, I should point out that using srchost is a very unreliable means of restricting access. There are numerous problems with it, most notably because we have to rely on what PAM sends us in the srchost field, which is not defined in the spec, so different applications such as 'login' and 'sshd' sometimes put different values in those fields. In SSSD upstream, we're defaulting to ignoring srchost rules because they're 1) unreliable and 2) cause significant performance impact on networks with lots of host entries. Our general recommendation is that if you want to restrict access from specific hosts, it's usually a better idea to do this at the firewall level, rather than the HBAC level. </pre> </blockquote> <pre wrap=""> Well that kind of puts that whole HBAC thing on the skids doesn't it? </pre> </blockquote> It still has value as you can define who can authenticate via which services and allow only ssh or physical access but not ftp to one set of users while enable ftp to others. <blockquote cite="mid:4F061F3F.90008@gmail.com" type="cite"> <pre wrap="">Unfortunate that it works that way, </pre> </blockquote> We tried our best but realized that there is no good way to get source host information reliably and also the performance was awful due to complexity of the searches that need to be conducted in this case. <blockquote cite="mid:4F061F3F.90008@gmail.com" type="cite"> <pre wrap="">and yes firewalling is always a good option. Thanks for the info, -Erinn </pre> <pre wrap=""> <fieldset class="mimeAttachmentHeader"></fieldset> _______________________________________________ Freeipa-users mailing list <a class="moz-txt-link-abbreviated" href="mailto:Freeipa-users@redhat.com">Freeipa-users@redhat.com</a> <a class="moz-txt-link-freetext" href="https://www.redhat.com/mailman/listinfo/freeipa-users">https://www.redhat.com/mailman/listinfo/freeipa-users</a></pre> </blockquote> <pre class="moz-signature" cols="72">-- Thank you, Dmitri Pal Sr. Engineering Manager IPA project, Red Hat Inc. ------------------------------- Looking to carve out IT costs? <a class="moz-txt-link-abbreviated" href="http://www.redhat.com/carveoutcosts/">www.redhat.com/carveoutcosts/</a> </pre> </body> </html>