[SSSD] Re: Session Recording control options
On Mon, Jun 06, 2016 at 04:24:35PM +0300, Nikolai Kondrashov wrote:
Hi everyone,
After a little discussion with Dmitri and Sumit we decided that we'll need
options for controlling session recording in sssd.conf, after all.
The options should be something like this:
record_sessions - string, one of: none/some/all, default is "none"
record_sessions_users - string, space-separated list of users to record
record_sessions_groups - string, space-separated list of groups to record
I'm not sure where we should put them. They can't be put into "nss" or
"pam"
sections alone, as they concern both (nss fakes the shell, pam adds enviroment
variables). I would rather put them into the global "sssd" section and have
fully-qualified usernames listed there, but I see that there is very little
options there otherwise, so I suspect they wouldn't be welcome. Otherwise, we
can put them into domain sections, but that would mean duplicating the
"record_sessions" option in every one of them, which is inconvenient.
I would suggest to put them into [nss] and let the pam responder read
them form there as well. My reasoning is that the faked shell returned
e.g. by 'getent passwd user_name' is the most user visible change. And
if anyone is irritated by this it would be good if the options
responsible for this can be found in the configuration of the related
responder.
bye,
Sumit
>
> What do you think about any of the above?
>
> Thanks!
>
> Nick