[Announce] gssproxy v0.3.0 available
by Günther Deschner
====================
Release Announcement
====================
Yesterday, gssproxy 0.3.0 has been released.
Major enhancements in gssproxy 0.3.0 include:
o Add support for impersonation
(depends on s4u2self/s4u2proxy on the KDC)
o Add support for new rpc.gssd mode of operation that
forks and changes uid
o Add 2 new options allow_any_uid and cred_usage
Changes since 0.2.3:
--------------------
o Günther Deschner (5):
* Further improve debugging, mention servicename, socket and euid.
* Use right signedness for creds buffer.
* Fix resource leak in gpm_accept_sec_context().
* docs: autogenerate proxymech manpage.
* docs: Fill in GSSPROXY_BEHAVIOR default setting from configure
option.
o Simo Sorce (14):
* Split nfs server and client services
* Properly check socket for connection matching.
* Coverity fixes.
* Add service match using SeLinux? Context
* Fix selinux option check
* Fix LOCAL_FIRST behavior
* Fix documentation to match reality
* Allow arbitrary users to connect to a service
* Add option to specify allowed usage.
* Add man page entry for allow_any_uid
* Add man page entry for cred_usage
* Move uid to name resolution in its own function.
* Add impersonation support
* Change version to 0.3.0
=======================================
Reporting bugs & Development Discussion
=======================================
Please discuss this release on the gssproxy mailing list or by
joining the #gssproxy IRC channel on irc.freenode.net.
All bugs should be reported in the gssproxy trac instance:
https://fedorahosted.org/gss-proxy/report
================
Download Details
================
The source code can be downloaded from:
https://fedorahosted.org/gss-proxy/wiki/Releases
The release notes are available online at:
https://fedorahosted.org/gss-proxy/wiki/Releases/v0.3.0
--
Günther Deschner GPG-ID: 8EE11688
Red Hat gdeschner(a)redhat.com
Samba Team gd(a)samba.org
10 years, 6 months
[PATCH] man page updates
by Simo Sorce
Forgot to add entries to man pages.
These patches add allow_any_uid and cred_usage entries.
Simo.
--
Simo Sorce * Red Hat, Inc * New York
10 years, 6 months
[PATCH] Implement multiuse access to gssproxy services
by Simo Sorce
These 2 patches add support for serving arbitrary UIDs from the
GSS-Proxy.
This is needed to support a change in rpc.gssd, which will start
changing uid to impersonate users before performing GSSAPI operations.
Patch 1 propagates the actual ui connecting and restrict that
trustworthiness of the client if it is not the configured uid.
Adds a new option called 'allow_any_uid' that needs to be enabled to
allow matching of a service to an otherwise not matching service.
This also means that sections with allow_any_uid = yes should be defined
last otherwise they may match early (unless selinux_context is also
defined and it prevents matching). In case of conflicts different
sockets may be used.
This implements #103
Patch 2 implements an additional restriction to what a client can do.
Because untrusted clients can connect we can now restrict what a client
can do with the defined credentials. This way an untrusted client can
for example only use credentials for initiation but not for accepting
contexts. This is useful in the NFS case where we do define as default
the host keytab but we do not want a random process to be allowed to
trick a remote client to connect to it claiming it is the host/ service.
This implements #104
Simo.
--
Simo Sorce * Red Hat, Inc * New York
10 years, 6 months
[PATCH] Fix LOCAL_FIRST behavior
by Simo Sorce
LOCAL_FIRST (our upstream default) was busted.
This patches fix the behavior (ticket #105) and fix the manpage which
was erroneously reporting LOCAL_ONLY as the default.
Simo.
--
Simo Sorce * Red Hat, Inc * New York
10 years, 6 months
[PATCH] Implement ability to impersonate users
by Simo Sorce
In some cases a NFS client (a web server, an HPC node, a cluster, ..)
may need long term access to a secure NFS share. However user may not
want to have to keep logging into the server regularly just to make sure
their cron jobs don't fail.
If the machine is trusted by admins then they can give the machine
permission to perform s4u2self and then s4u2proxy operations to
impersonate users.
The new impersonate = yes options does exactly that. It uses whatever
keytab is provided the cred_store to perform a s4u2self operation to get
a ticket to itself on behalf of he user connecting (either specified by
a trusted client or derived from the uid for allow_any_uid enabled
services), then it turns around and asks for a ticket for the target
service.
Both operations will need to be allowed by the KDC (normally neither is)
so they require the KDC admins collaboration to allow impersonation.
These patches have been tested using manual configuration of a FreeIPA
domain to allow constrained delegation operations, however they work
only if the patch for this [1] bug is applied to the kerberos libraries.
The patch is scheduled to be released in MIT 1.11.4 and 1.12
This resolves ticket #95
Simo.
[1] http://krbdev.mit.edu/rt/Ticket/Display.html?id=7706
--
Simo Sorce * Red Hat, Inc * New York
10 years, 6 months