<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
On 07/09/2013 03:57 PM, KodaK wrote:
<blockquote
cite="mid:CAA9J0ZESA5J+qcpoiRV=ykDSdszNOAbpLzhMFTExKOCa3y_SrQ@mail.gmail.com"
type="cite"><br>
<br>
<div class="gmail_quote">On Mon, Jul 8, 2013 at 12:50 PM, Rob
Crittenden <span dir="ltr"><<a moz-do-not-send="true"
href="mailto:rcritten@redhat.com" target="_blank">rcritten@redhat.com</a>></span>
wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0
.8ex;border-left:1px #ccc solid;padding-left:1ex">
<br>
HBAC is enforced by sssd, so no sssd, no HBAC.<br>
<br>
I think you need to use pam_access to limit users in AIX.<span><font
color="#888888"><br>
<br>
</font></span></blockquote>
<div><br>
</div>
<div>I have some work-arounds now, but I'd like to find a way to
automate them. What</div>
<div>I need is a way to ask IPA "who is allowed to access this
particular server?"</div>
<div><br>
</div>
<div>The goal is go just get a list of allowed users, then there
are various mechanisms</div>
<div>I can employ to allow access to only the listed users. I
plan to do this from the</div>
<div>puppet master so I can push the configs from there. I have
ipa-admintools and</div>
<div>openldap-clients installed on the puppet master.</div>
<div><br>
</div>
<div>Right now I'm iterating through all the hbacrules and
grepping for the server in </div>
<div>question, then getting the details of that rule. This is a
lot of requests.</div>
</div>
</blockquote>
<br>
<br>
A valid RFE I would say...<br>
May be it should be an enhancement for the hbac-test tool?<br>
However getting a list of the users verbatim is probably costly too.<br>
May be it would make sense for you to create a group of AIX users in
IPA and then fetch it from the puppet master traverse its memberOf
attribute for list of members?<br>
It will not use HBAC but still would provide some access control
optimization.<br>
Will that solve the problem for you?<br>
<br>
<br>
<blockquote
cite="mid:CAA9J0ZESA5J+qcpoiRV=ykDSdszNOAbpLzhMFTExKOCa3y_SrQ@mail.gmail.com"
type="cite">
<div class="gmail_quote">
</div>
<br clear="all">
<div><br>
</div>
-- <br>
The government is going to read our mail anyway, might as well
make it tough for them. GPG Public key ID: B6A1A7C6
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
Freeipa-users mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Freeipa-users@redhat.com">Freeipa-users@redhat.com</a>
<a class="moz-txt-link-freetext" href="https://www.redhat.com/mailman/listinfo/freeipa-users">https://www.redhat.com/mailman/listinfo/freeipa-users</a></pre>
</blockquote>
<br>
<br>
<pre class="moz-signature" cols="72">--
Thank you,
Dmitri Pal
Sr. Engineering Manager for IdM portfolio
Red Hat Inc.
-------------------------------
Looking to carve out IT costs?
<a class="moz-txt-link-abbreviated" href="http://www.redhat.com/carveoutcosts/">www.redhat.com/carveoutcosts/</a>
</pre>
</body>
</html>