From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (qmail 23287 invoked by alias); 13 Feb 2014 16:05:36 -0000 Mailing-List: contact cygwin-help@cygwin.com; run by ezmlm Precedence: bulk List-Id: List-Subscribe: List-Archive: List-Post: List-Help: , Sender: cygwin-owner@cygwin.com Mail-Followup-To: cygwin@cygwin.com Received: (qmail 23271 invoked by uid 89); 13 Feb 2014 16:05:35 -0000 Authentication-Results: sourceware.org; auth=none X-Virus-Found: No X-Spam-SWARE-Status: No, score=-6.0 required=5.0 tests=AWL,BAYES_00 autolearn=ham version=3.3.2 X-HELO: calimero.vinschen.de Received: from aquarius.hirmke.de (HELO calimero.vinschen.de) (217.91.18.234) by sourceware.org (qpsmtpd/0.93/v0.84-503-g423c35a) with ESMTP; Thu, 13 Feb 2014 16:05:33 +0000 Received: by calimero.vinschen.de (Postfix, from userid 500) id BD0EC5208C5; Thu, 13 Feb 2014 17:05:30 +0100 (CET) Date: Thu, 13 Feb 2014 16:09:00 -0000 From: Corinna Vinschen To: cygwin@cygwin.com Subject: Re: get rid of getpwent? (Was: cygwin-1.7.28 getpwent header declaration changes ?) Message-ID: <20140213160530.GK2246@calimero.vinschen.de> Reply-To: cygwin@cygwin.com Mail-Followup-To: cygwin@cygwin.com References: <52FABAF5.2060701@etr-usa.com> <52FAD730.9090507@redhat.com> <20140212090804.GM2821@calimero.vinschen.de> <52FB9E51.7030607@cornell.edu> <20140212195931.GA2246@calimero.vinschen.de> <20140212213729.GA5589@ednor.casa.cgf.cx> <20140213100025.GB24159@calimero.vinschen.de> <20140213143541.GC6750@ednor.casa.cgf.cx> <20140213144419.GI2246@calimero.vinschen.de> <20140213154333.GA6304@ednor.casa.cgf.cx> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="3MHXEHrrXKLGx71o" Content-Disposition: inline In-Reply-To: <20140213154333.GA6304@ednor.casa.cgf.cx> User-Agent: Mutt/1.5.21 (2010-09-15) X-SW-Source: 2014-02/txt/msg00312.txt.bz2 --3MHXEHrrXKLGx71o Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable Content-length: 2090 On Feb 13 10:43, Christopher Faylor wrote: > On Thu, Feb 13, 2014 at 03:44:19PM +0100, Corinna Vinschen wrote: > >Yes, I think so too. I have some preliminary code (actually, just > >empty function shells right now) which are supposed to implement > >full enumerating. > > > >However, system admins might not exactly approve. I discussed this > >with our Linux folks, and I learned that NSS backends like SSSD or > >winbind default to NOT allowing enumerating, but giving the admin a > >choice to enable it. > > > >So I think for our case a configuration option in /etc/nsswitch.conf > >to limit the scope of the enumeration might be feasible. >=20 > Or, nscd.conf which has stuff like: >=20 > enable-cache passwd yes > positive-time-to-live passwd 600 > negative-time-to-live passwd 20 > suggested-size passwd 211 > check-files passwd yes > persistent passwd yes > shared passwd yes > max-db-size passwd 33554432 > auto-propagate passwd yes I know that nsswitch.conf is not quite the right place for the configuration variables, but I was reluctant to introduce YA file to read at startup. If nobody cares, we can also go with a limited nscd.conf approach for the configuration variables. > I understand why a sysadmin might not want you to be able to enumerate > user names but that really isn't, IMO, a reason not to implement the > functionality (not that you are proposing this). You obviously can't > assume that people won't exercise the capability if it is available. >=20 > Security through obscurity...? Nah. Nah. But restricting the capability for pure networking reasons is on order, IMHO. Assuming that Cygwin has been setup by an admin and the /etc files are not writable by the ordinary user, of course. Corinna --=20 Corinna Vinschen Please, send mails regarding Cygwin to Cygwin Maintainer cygwin AT cygwin DOT com Red Hat --3MHXEHrrXKLGx71o Content-Type: application/pgp-signature Content-length: 819 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBAgAGBQJS/O1KAAoJEPU2Bp2uRE+giTgP/0D5AzDC3ux7yGgm2iM0qpcv B4s3jc79KvqLuJG3AfDkYxukOyaik1A0KvPx8p+b9OvzpdqwrQSeKQ9i8GiTvM3p zcV6j12M2es01jthMJJI5tgW/SyhLO7fpCSwutt0f9r1h1oIbTcesPGYLK5NtGWr 2HD9Tkfn1fcbkg7pWVtkXdLo3F3EEtSqcV+p4Yj3Mbgxs/aN2NtfXTEwdHUbPjdB gqtsVwTqi/YSnuwRL3Ve6fRl0h46+AiOAMC8y5uhhrdnlLu/tfn59oxfDuGzvkfq hoaW625RAgJ8+Z7Fq7uJOH+/dh68nPX04jUCQ/TydSbhYuLdtiEmkNNSel3Pbhr7 MYeZIzQYW+HN1cRF4lq1lgyDbQLrM6PDsohoyQMwcGbJuhMGKAzsWNOvpQW+SMhm H5A8xpkffw4Ef/x2+xFVcU5SzaZNqwogQMItFdZ8n86Msu0zhKY4zT9xUsAjM8V9 +Szo3c8YTCcJGa01pC/bFMToWg5yf99yNHGE0KfSSpt6vle0kiC7CuNPyJAnxvQB qeUk+0l3sBCvi+ra+cKveaqyKSSfv9YBDzmHZyH6TvKccWh+fR/N6NDyLT78GknP ZMSwcMtFBjORO7lQyBAU199KV7eT2tyUYTZE6HuDFPUjorU+q9PjxtTs8cSm1HOX +hugZsOmbBLa4gDB1n+u =Vw3s -----END PGP SIGNATURE----- --3MHXEHrrXKLGx71o--