Re: [Freeipa-devel] [PATCH] 609 Reduce the number of attributes a host is allowed to write.

2010-11-30 Thread Rob Crittenden
Simo Sorce wrote: On Wed, 17 Nov 2010 15:07:03 -0500 Rob Crittendenrcrit...@redhat.com wrote: +aci: (targetattr != userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || krbMKey || krbPrincipalName || krbCanonicalName || krbUPEnabled || krbMKey ||

Re: [Freeipa-devel] [PATCH] 609 Reduce the number of attributes a host is allowed to write.

2010-11-30 Thread Simo Sorce
On Tue, 30 Nov 2010 10:28:41 -0500 Rob Crittenden rcrit...@redhat.com wrote: Simo Sorce wrote: On Wed, 17 Nov 2010 15:07:03 -0500 Rob Crittendenrcrit...@redhat.com wrote: +aci: (targetattr != userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory ||

Re: [Freeipa-devel] [PATCH] 609 Reduce the number of attributes a host is allowed to write.

2010-11-24 Thread Rob Crittenden
Simo Sorce wrote: On Wed, 17 Nov 2010 15:07:03 -0500 Rob Crittendenrcrit...@redhat.com wrote: aci: (targetattr != userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || krbMKey)(version 3.0; acl Enable Anonymous access; allow (read, search, compare)

Re: [Freeipa-devel] [PATCH] 609 Reduce the number of attributes a host is allowed to write.

2010-11-24 Thread Simo Sorce
On Wed, 17 Nov 2010 15:07:03 -0500 Rob Crittenden rcrit...@redhat.com wrote: +aci: (targetattr != userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || krbMKey || krbPrincipalName || krbCanonicalName || krbUPEnabled || krbMKey || krbTicketPolicyReference

Re: [Freeipa-devel] [PATCH] 609 Reduce the number of attributes a host is allowed to write.

2010-11-24 Thread Rob Crittenden
Simo Sorce wrote: On Wed, 17 Nov 2010 15:07:03 -0500 Rob Crittendenrcrit...@redhat.com wrote: +aci: (targetattr != userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || krbMKey || krbPrincipalName || krbCanonicalName || krbUPEnabled || krbMKey ||

Re: [Freeipa-devel] [PATCH] 609 Reduce the number of attributes a host is allowed to write.

2010-11-15 Thread Jakub Hrozek
On Wed, Nov 10, 2010 at 04:25:18PM -0500, Rob Crittenden wrote: The list of attributes that a host bound as itself could write was overly broad. A host can now only update its description, information about itself such as OS release, etc, its certificate, password and keytab.

Re: [Freeipa-devel] [PATCH] 609 Reduce the number of attributes a host is allowed to write.

2010-11-15 Thread Rob Crittenden
Jakub Hrozek wrote: On Wed, Nov 10, 2010 at 04:25:18PM -0500, Rob Crittenden wrote: The list of attributes that a host bound as itself could write was overly broad. A host can now only update its description, information about itself such as OS release, etc, its certificate, password and