Re: [Freeipa-users] RFE: default hbac is too open

2013-03-06 Thread Martin Kosek
On 03/05/2013 10:13 PM, Matthew Barr wrote: On Mar 5, 2013, at 9:15 AM, Rob Crittenden rcrit...@redhat.com wrote: Артур Файзуллин wrote: What rule must be present for replica to work? :) (in order to remove allow-all rule) I mean may be there is somewhere a guide to write rules for strict

Re: [Freeipa-users] RFE: default hbac is too open

2013-03-05 Thread Matthew Barr
On Mar 5, 2013, at 9:15 AM, Rob Crittenden rcrit...@redhat.com wrote: Артур Файзуллин wrote: What rule must be present for replica to work? :) (in order to remove allow-all rule) I mean may be there is somewhere a guide to write rules for strict allows? During the installation we check

Re: [Freeipa-users] RFE: default hbac is too open

2013-03-04 Thread Артур Файзуллин
What rule must be present for replica to work? :) (in order to remove allow-all rule) I mean may be there is somewhere a guide to write rules for strict allows? В Пт., 30/11/2012 в 13:24 -0500, Rob Crittenden пишет: Natxo Asenjo wrote: hi, the default hbac rule 'allow_all' is nice for

[Freeipa-users] RFE: default hbac is too open

2012-11-30 Thread Natxo Asenjo
hi, the default hbac rule 'allow_all' is nice for testing, but for a production environment I am not so sure ;-) We do not want our users getting a shell in our kdc servers or in the database servers for instance. We want them to use the postgresql service, but not login the database server with

Re: [Freeipa-users] RFE: default hbac is too open

2012-11-30 Thread Rob Crittenden
Natxo Asenjo wrote: hi, the default hbac rule 'allow_all' is nice for testing, but for a production environment I am not so sure ;-) We do not want our users getting a shell in our kdc servers or in the database servers for instance. We want them to use the postgresql service, but not login