[PATCH] Add option to disable TLS for LDAP auth

[Stephen Gallagher]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

This is going to be a controversial patch. It adds support for an option
called "ldap_auth_disable_tls_never_use_in_production" which allows SSSD
to perform LDAP simple-bind authentication without a corresponding TLS
tunnel.

Multiple users have requested (arguably demanded) this feature for
"debugging" purposes. We've resisted it for a long time, but after a
certain point, once people yell often enough, it's probably worth it to
listen.

The option added by this patch is intentionally left out of the manpage
and the SSSDConfig API, as a means to strongly discourage its use.

- -- 
Stephen Gallagher
RHCE 804006346421761

Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.11 (GNU/Linux)
> Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
>
> iEYEARECAAYFAk0+8u4ACgkQeiVVYja6o6M1rwCdH9Gzi66lBzItaKFtGiLZFyIN
> I3cAmgKzw1fUPUR8ckZfRl8+svO8NR3F
> =d0sd
> -----END PGP SIGNATURE-----

[Jeff Schroeder]

On Tue, Jan 25, 2011 at 7:57 AM, Stephen Gallagher <sgallagh(a)redhat.com&gt; wrote:
>  -----BEGIN PGP SIGNED MESSAGE-----
>  Hash: SHA1
>
>  This is going to be a controversial patch. It adds support for an option
>  called "ldap_auth_disable_tls_never_use_in_production" which allows SSSD
>  to perform LDAP simple-bind authentication without a corresponding TLS
>  tunnel.
>
>  Multiple users have requested (arguably demanded) this feature for
>  "debugging" purposes. We've resisted it for a long time, but after a
>  certain point, once people yell often enough, it's probably worth it to
>  listen. 
Why don't you make sssd also complain on startup about this option?

-- 
Jeff Schroeder

Don't drink and derive, alcohol and analysis don't mix.
http://www.digitalprognosis.com

[Stephen Gallagher]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 01/25/2011 10:59 AM, Jeff Schroeder wrote:
>  On Tue, Jan 25, 2011 at 7:57 AM, Stephen Gallagher
> <sgallagh(a)redhat.com&gt; wrote:
> > -----BEGIN PGP SIGNED MESSAGE-----
> > Hash: SHA1
> >
> > This is going to be a controversial patch. It adds support for an option
> > called "ldap_auth_disable_tls_never_use_in_production" which allows SSSD
> > to perform LDAP simple-bind authentication without a corresponding TLS
> > tunnel.
> >
> > Multiple users have requested (arguably demanded) this feature for
> > "debugging" purposes. We've resisted it for a long time, but after a
> > certain point, once people yell often enough, it's probably worth it to
> > listen.
>  
>  Why don't you make sssd also complain on startup about this option?
>   
I'm trying not to be TOO obnoxious about it. I figured that not having
it mentioned in the documentation and not visible to the SSSDConfig API
would be sufficient.

But if you feel strongly about it, it's not too hard to add.

- -- 
Stephen Gallagher
RHCE 804006346421761

Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.11 (GNU/Linux)
> Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
>
> iEYEARECAAYFAk0+9aUACgkQeiVVYja6o6OooQCfQKiHlOqEuSU7/G2BSvi1Wo2g
> qe8An1iEDffqtPZM44As/JEQdkiP0UeE
> =NVjA
> -----END PGP SIGNATURE-----

[Sumit Bose]

On Tue, Jan 25, 2011 at 11:09:09AM -0500, Stephen Gallagher wrote:
>  -----BEGIN PGP SIGNED MESSAGE-----
>  Hash: SHA1
>  
>  On 01/25/2011 10:59 AM, Jeff Schroeder wrote:
>  > On Tue, Jan 25, 2011 at 7:57 AM, Stephen Gallagher <sgallagh(a)redhat.com&gt;
> wrote:
>  >> -----BEGIN PGP SIGNED MESSAGE-----
>  >> Hash: SHA1
>  >>
>  >> This is going to be a controversial patch. It adds support for an option
>  >> called "ldap_auth_disable_tls_never_use_in_production" which allows
> SSSD
>  >> to perform LDAP simple-bind authentication without a corresponding TLS
>  >> tunnel.
>  >>
>  >> Multiple users have requested (arguably demanded) this feature for
>  >> "debugging" purposes. We've resisted it for a long time, but after
> a
>  >> certain point, once people yell often enough, it's probably worth it to
>  >> listen.
>  > 
>  > Why don't you make sssd also complain on startup about this option?
>  > 
>  
>  I'm trying not to be TOO obnoxious about it. I figured that not having
>  it mentioned in the documentation and not visible to the SSSDConfig API
>  would be sufficient.
>  
>  But if you feel strongly about it, it's not too hard to add.
>   
I would also support the idea of some kind of warning message to prevent
that someone accidentally use the "debugging" configuration in
production. But instead of a message at startup I would prefer a syslog
message every time a password is sent unencrypted.

bye,
Sumit

>  - -- 
>  Stephen Gallagher
>  RHCE 804006346421761
>  
>  Delivering value year after year.
>  Red Hat ranks #1 in value among software vendors.
>  http://www.redhat.com/promo/vendor/
> >  -----BEGIN PGP SIGNATURE-----
> >  Version: GnuPG v1.4.11 (GNU/Linux)
> >  Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
> >  
> >  iEYEARECAAYFAk0+9aUACgkQeiVVYja6o6OooQCfQKiHlOqEuSU7/G2BSvi1Wo2g
> >  qe8An1iEDffqtPZM44As/JEQdkiP0UeE
> >  =NVjA
> >  -----END PGP SIGNATURE----- 
>  _______________________________________________
>  sssd-devel mailing list
>  sssd-devel(a)lists.fedorahosted.org
>  https://fedorahosted.org/mailman/listinfo/sssd-devel

[Stephen Gallagher]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 01/25/2011 11:17 AM, Sumit Bose wrote:
>  On Tue, Jan 25, 2011 at 11:09:09AM -0500, Stephen Gallagher wrote:
>  On 01/25/2011 10:59 AM, Jeff Schroeder wrote:
> >>> Why don't you make sssd also complain on startup about this option?
> >>>
>  
>  I'm trying not to be TOO obnoxious about it. I figured that not having
>  it mentioned in the documentation and not visible to the SSSDConfig API
>  would be sufficient.
>  
>  But if you feel strongly about it, it's not too hard to add.
>  
>  
> > I would also support the idea of some kind of warning message to prevent
> > that someone accidentally use the "debugging" configuration in
> > production. But instead of a message at startup I would prefer a syslog
> > message every time a password is sent unencrypted. 

New patch with annoying syslog message attached.


- -- 
Stephen Gallagher
RHCE 804006346421761

Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.11 (GNU/Linux)
> Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
>
> iEYEARECAAYFAk0/KpkACgkQeiVVYja6o6OsUQCfUASv3Xl4TmAe2Hg4ahO0NkrG
> vSsAnRkS32L5QrsqXAb0YSRRNtY2QXwH
> =i5b6
> -----END PGP SIGNATURE-----

[Sumit Bose]

On Tue, Jan 25, 2011 at 02:55:05PM -0500, Stephen Gallagher wrote:
>  -----BEGIN PGP SIGNED MESSAGE-----
>  Hash: SHA1
>  
>  On 01/25/2011 11:17 AM, Sumit Bose wrote:
>  > On Tue, Jan 25, 2011 at 11:09:09AM -0500, Stephen Gallagher wrote:
>  > On 01/25/2011 10:59 AM, Jeff Schroeder wrote:
>  >>>> Why don't you make sssd also complain on startup about this option?
>  >>>>
>  > 
>  > I'm trying not to be TOO obnoxious about it. I figured that not having
>  > it mentioned in the documentation and not visible to the SSSDConfig API
>  > would be sufficient.
>  > 
>  > But if you feel strongly about it, it's not too hard to add.
>  > 
>  > 
>  >> I would also support the idea of some kind of warning message to prevent
>  >> that someone accidentally use the "debugging" configuration in
>  >> production. But instead of a message at startup I would prefer a syslog
>  >> message every time a password is sent unencrypted.
>  
>  
>  New patch with annoying syslog message attached.
>   
I have to admit this patch is working as expected, I can clearly see my
password on the wire.

ACK

bye,
Sumit

>  
>  - -- 
>  Stephen Gallagher
>  RHCE 804006346421761
>  
>  Delivering value year after year.
>  Red Hat ranks #1 in value among software vendors.
>  http://www.redhat.com/promo/vendor/
>  -----BEGIN PGP SIGNATURE-----
>  Version: GnuPG v1.4.11 (GNU/Linux)
>  Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
>  
>  iEYEARECAAYFAk0/KpkACgkQeiVVYja6o6OsUQCfUASv3Xl4TmAe2Hg4ahO0NkrG
>  vSsAnRkS32L5QrsqXAb0YSRRNtY2QXwH
>  =i5b6
>  -----END PGP SIGNATURE-----

[Stephen Gallagher]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 01/26/2011 05:51 AM, Sumit Bose wrote:
>  On Tue, Jan 25, 2011 at 02:55:05PM -0500, Stephen Gallagher wrote:
>  On 01/25/2011 11:17 AM, Sumit Bose wrote:
> >>> On Tue, Jan 25, 2011 at 11:09:09AM -0500, Stephen Gallagher wrote:
> >>> On 01/25/2011 10:59 AM, Jeff Schroeder wrote:
> >>>>>> Why don't you make sssd also complain on startup about this
> option?
> >>>>>>
> >>>
> >>> I'm trying not to be TOO obnoxious about it. I figured that not having
> >>> it mentioned in the documentation and not visible to the SSSDConfig API
> >>> would be sufficient.
> >>>
> >>> But if you feel strongly about it, it's not too hard to add.
> >>>
> >>>
> >>>> I would also support the idea of some kind of warning message to prevent
> >>>> that someone accidentally use the "debugging" configuration in
> >>>> production. But instead of a message at startup I would prefer a syslog
> >>>> message every time a password is sent unencrypted.
>  
>  
>  New patch with annoying syslog message attached.
>  
>  
> > I have to admit this patch is working as expected, I can clearly see my
> > password on the wire.
>  
> > ACK
>   

Ok, so now that we know we have a patch to accomplish this... we have to
ask ourselves this question: are we willing to push this upstream, or
should we stick to the principles we've maintained up to this point?

- -- 
Stephen Gallagher
RHCE 804006346421761

Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.11 (GNU/Linux)
> Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
>
> iEYEARECAAYFAk1AC3YACgkQeiVVYja6o6PGfACgoJDU1DR62ur3615le+1KY1I3
> 7NwAn1JEqn2aMWPkleeupSYFxD2Ub7th
> =12H8
> -----END PGP SIGNATURE-----

[JR Aquino]

On 1/26/11 3:54 AM, "Stephen Gallagher" <sgallagh(a)redhat.com&gt; wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> On 01/26/2011 05:51 AM, Sumit Bose wrote:
> > On Tue, Jan 25, 2011 at 02:55:05PM -0500, Stephen Gallagher wrote:
> > On 01/25/2011 11:17 AM, Sumit Bose wrote:
> >>>> On Tue, Jan 25, 2011 at 11:09:09AM -0500, Stephen Gallagher wrote:
> >>>> On 01/25/2011 10:59 AM, Jeff Schroeder wrote:
> >>>>>>> Why don't you make sssd also complain on startup about
> this
> >>>>>>>option?
> >>>>>>>
> >>>>
> >>>> I'm trying not to be TOO obnoxious about it. I figured that not
> >>>>having
> >>>> it mentioned in the documentation and not visible to the SSSDConfig
> >>>>API
> >>>> would be sufficient.
> >>>>
> >>>> But if you feel strongly about it, it's not too hard to add.
> >>>>
> >>>>
> >>>>> I would also support the idea of some kind of warning message to
> >>>>>prevent
> >>>>> that someone accidentally use the "debugging" configuration
> in
> >>>>> production. But instead of a message at startup I would prefer a
> >>>>>syslog
> >>>>> message every time a password is sent unencrypted.
> > 
> > 
> > New patch with annoying syslog message attached.
> > 
> > 
> >> I have to admit this patch is working as expected, I can clearly see my
> >> password on the wire.
> > 
> >> ACK
> > 
>
>
> Ok, so now that we know we have a patch to accomplish this... we have to
> ask ourselves this question: are we willing to push this upstream, or
> should we stick to the principles we've maintained up to this point? 
I feel strongly that we should NACK this patch.

If an administrator wishes to troubleshoot ldaps traffic, there are ways
to do so without compromising the FreeIPA Code:

Wireshark can be made to sniff SSL traffic if the user has the SSL Cert
http://wiki.wireshark.org/SSL

[Jeff Schroeder]

On Wed, Jan 26, 2011 at 3:54 AM, Stephen Gallagher <sgallagh(a)redhat.com&gt; wrote:
...snip...
>  Ok, so now that we know we have a patch to accomplish this... we have
> to
>  ask ourselves this question: are we willing to push this upstream, or
>  should we stick to the principles we've maintained up to this point?
>
>  - --
>  Stephen Gallagher 
I actually agree with JR here. If a user is too lazy to setup ldap
certs for a specific server, they can simply set:
ldap_tls_reqcert = never

If they are too lazy to make their ldap servers support ldaps, they
shouldn't be running an ldap server. This seems most appropriate to
put the patch on bugzilla and then CLOSEDWONTFIX.

-- 
Jeff Schroeder

Don't drink and derive, alcohol and analysis don't mix.
http://www.digitalprognosis.com

[Simo Sorce]

On Wed, 2011-01-26 at 05:11 -0800, Jeff Schroeder wrote:
>  On Wed, Jan 26, 2011 at 3:54 AM, Stephen Gallagher
> <sgallagh(a)redhat.com&gt; wrote:
>  ...snip...
>  > Ok, so now that we know we have a patch to accomplish this... we have to
>  > ask ourselves this question: are we willing to push this upstream, or
>  > should we stick to the principles we've maintained up to this point?
>  >
>  > - --
>  > Stephen Gallagher
>  
>  I actually agree with JR here. If a user is too lazy to setup ldap
>  certs for a specific server, they can simply set:
>  ldap_tls_reqcert = never
>  
>  If they are too lazy to make their ldap servers support ldaps, they
>  shouldn't be running an ldap server. This seems most appropriate to
>  put the patch on bugzilla and then CLOSEDWONTFIX. 
I am sorry, but I have to disagree.
We are not going to help anyone to use this option. In fact it will not
be documented and it is obnoxious as it causes a lot of syslog messages.

But I do not see any problem in allowing someone that really, really
need it to use it. I am all for providing tools to avoid shooting at one
owns feet, but defaults, and strong recommendations are all we need to
provide IMO.

After all if someone really want to send passwords in the clear they can
always use a different client that allows them to do so and we will have
gained nothing by forcing someone out.

Simo.

-- 
Simo Sorce * Red Hat, Inc * New York

[Jeff Schroeder]

On Wed, Jan 26, 2011 at 10:20 AM, Simo Sorce <ssorce(a)redhat.com&gt; wrote:
>  On Wed, 2011-01-26 at 05:11 -0800, Jeff Schroeder wrote:
> > On Wed, Jan 26, 2011 at 3:54 AM, Stephen Gallagher <sgallagh(a)redhat.com&gt;
> wrote:
> > ...snip...
> > > Ok, so now that we know we have a patch to accomplish this... we have to
> > > ask ourselves this question: are we willing to push this upstream, or
> > > should we stick to the principles we've maintained up to this point?
> > >
> > > - --
> > > Stephen Gallagher
> >
> > I actually agree with JR here. If a user is too lazy to setup ldap
> > certs for a specific server, they can simply set:
> > ldap_tls_reqcert = never
> >
> > If they are too lazy to make their ldap servers support ldaps, they
> > shouldn't be running an ldap server. This seems most appropriate to
> > put the patch on bugzilla and then CLOSEDWONTFIX.
>
>  I am sorry, but I have to disagree.
>  We are not going to help anyone to use this option. In fact it will not
>  be documented and it is obnoxious as it causes a lot of syslog messages.
>
>  But I do not see any problem in allowing someone that really, really
>  need it to use it. I am all for providing tools to avoid shooting at one
>  owns feet, but defaults, and strong recommendations are all we need to
>  provide IMO.
>
>  After all if someone really want to send passwords in the clear they can
>  always use a different client that allows them to do so and we will have
>  gained nothing by forcing someone out. 
Good point.

-- 
Jeff Schroeder

Don't drink and derive, alcohol and analysis don't mix.
http://www.digitalprognosis.com

[Stephen Gallagher]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 01/26/2011 05:51 AM, Sumit Bose wrote:
>  On Tue, Jan 25, 2011 at 02:55:05PM -0500, Stephen Gallagher wrote:
>  On 01/25/2011 11:17 AM, Sumit Bose wrote:
> >>> On Tue, Jan 25, 2011 at 11:09:09AM -0500, Stephen Gallagher wrote:
> >>> On 01/25/2011 10:59 AM, Jeff Schroeder wrote:
> >>>>>> Why don't you make sssd also complain on startup about this
> option?
> >>>>>>
> >>>
> >>> I'm trying not to be TOO obnoxious about it. I figured that not having
> >>> it mentioned in the documentation and not visible to the SSSDConfig API
> >>> would be sufficient.
> >>>
> >>> But if you feel strongly about it, it's not too hard to add.
> >>>
> >>>
> >>>> I would also support the idea of some kind of warning message to prevent
> >>>> that someone accidentally use the "debugging" configuration in
> >>>> production. But instead of a message at startup I would prefer a syslog
> >>>> message every time a password is sent unencrypted.
>  
>  
>  New patch with annoying syslog message attached.
>  
>  
> > I have to admit this patch is working as expected, I can clearly see my
> > password on the wire.
>  
> > ACK 

After weighing the pros and cons, I decided to push this patch as-is.
The option is present and undocumented in 1.5.1.

- -- 
Stephen Gallagher
RHCE 804006346421761

Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.11 (GNU/Linux)
> Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
>
> iEYEARECAAYFAk1CuuQACgkQeiVVYja6o6MgcACbBSoSWwCJbPUuptLktc8Elqes
> C8EAoJVnNlNDIY/WcaJGtr/kWZh8xgQP
> =cANW
> -----END PGP SIGNATURE-----