From: Thomas Lamprecht <t.lamprecht@proxmox.com>
To: Proxmox VE development discussion <pve-devel@lists.proxmox.com>,
Dominik Csapak <d.csapak@proxmox.com>
Subject: Re: [pve-devel] [RFC PATCH access-control] loosen locking restriction for users without tfa configured
Date: Thu, 15 Sep 2022 12:43:46 +0200 [thread overview]
Message-ID: <28056eb0-7712-00a6-b342-b2bbb4fa2279@proxmox.com> (raw)
In-Reply-To: <20220914134235.3707811-1-d.csapak@proxmox.com>
Am 14/09/2022 um 15:42 schrieb Dominik Csapak:
> The downside is that we cannot authenticate users anymore without quorum
> (since locking requires write access to pmxcfs), even for users without
> tfa configured (and also for clusters without any tfa configured at all)
question is more if we should disallow login on unquorate clusters for all
but root@pam, as for all others you cannot be sure if they still got the
permissions and for the pve realm the credentials are still correct, or
if the non-existing TFA entry is still up-to-date (the quorate partition
could have TFA configured for that user since cluster split).
root@pam is a hard-coded super admin and verified via PAM, which normally
should be pmxcfs, and thus quorum, independent, at least if nobody was crazy
enough to link /etc/shadow to a file in pmxcfs or wrote a PAM that works
on pmxcfs info in other ways.
next prev parent reply other threads:[~2022-09-15 10:44 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-09-14 13:42 Dominik Csapak
2022-09-15 7:01 ` Fabian Grünbichler
2022-09-15 10:43 ` Thomas Lamprecht [this message]
2022-09-15 12:40 ` Dominik Csapak
2022-09-15 12:53 ` Thomas Lamprecht
2022-09-15 13:12 ` Dominik Csapak
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=28056eb0-7712-00a6-b342-b2bbb4fa2279@proxmox.com \
--to=t.lamprecht@proxmox.com \
--cc=d.csapak@proxmox.com \
--cc=pve-devel@lists.proxmox.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.