(Publish proposal) |
(FESCo has dropped this Change. It may be resubmitted when the owner is ready to move forward. https://meetbot.fedoraproject.org/fedora-meeting/2023-02-21/fesco.2023-02-21-17.00.log.html) |
||
| (7 intermediate revisions by the same user not shown) | |||
| Line 9: | Line 9: | ||
== Owner == | == Owner == | ||
* Name: [[User:besser82 | Björn Esser]] | * Name: [[User:besser82 | Björn Esser]], [[User:ipedrosa | Iker Pedrosa]] | ||
* Email: besser82@fedoraproject.org, ipedrosa@redhat.com | |||
* Email: ipedrosa@redhat.com | |||
== Current status == | == Current status == | ||
* Targeted release: [[Releases/ | * Targeted release: [[Releases/38 | Fedora Linux 38 ]] | ||
* Last updated: {{REVISIONYEAR}}-{{REVISIONMONTH}}-{{REVISIONDAY2}} | * Last updated: {{REVISIONYEAR}}-{{REVISIONMONTH}}-{{REVISIONDAY2}} | ||
* FESCo issue: | * FESCo issue: [https://pagure.io/fesco/issue/2684 #2684] | ||
* Tracker bug: | * Tracker bug: [https://bugzilla.redhat.com/show_bug.cgi?id=2021660 #2021660] | ||
* Release notes tracker: | * Release notes tracker: [https://pagure.io/fedora-docs/release-notes/issue/762 #762] | ||
[[Category:SystemWideChange]] | [[Category:SystemWideChange]] | ||
[[Category: | [[Category:ChangePageIncomplete]] | ||
== Detailed Description == | == Detailed Description == | ||
| Line 87: | Line 82: | ||
* Contingency mechanism: Revert the changes made to the affected packages and rebuild them. | * Contingency mechanism: Revert the changes made to the affected packages and rebuild them. | ||
* Contingency deadline: At beta freeze. | * Contingency deadline: At beta freeze. Documentation and/or migration tools must be prominently available, per FESCo. | ||
* Blocks release? Yes. | * Blocks release? Yes. | ||
== Documentation == | == Documentation == | ||
Latest revision as of 19:28, 22 February 2023
Drop NIS(+) support from PAM
Summary
This change is about dropping user-authentication using NIS(+) from PAM.
Owner
- Name: Björn Esser, Iker Pedrosa
- Email: besser82@fedoraproject.org, ipedrosa@redhat.com
Current status
- Targeted release: Fedora Linux 38
- Last updated: 2023-02-22
- FESCo issue: #2684
- Tracker bug: #2021660
- Release notes tracker: #762
Detailed Description
NIS(+) was introduced by Sun/Oracle to easily share files and system users between UNIX-alike systems within the same network, and has been around for some decades. Its simplicity though opens a variety of possible security issues, like not being able the verify whether the shared information is actually correct and/or trustworthy. That said, and with several more secure options (LDAP, Kerberos, Samba, etc.) to achieve the same goal, we should at least remove support for NIS for user authentication.
Feedback
There was some discussion on the fedora-devel mailing-list. Some people are reluctant about the removal of NIS(+) support from PAM, while most are okay with it as there are more secure alternatives (LDAP, FreeIPA, etc.) available.
Benefit to Fedora
With this change we start directing our users and developers to move away from NIS(+) to secure alternatives like LDAP and/or FreeIPA.
Scope
- Proposal owners:
- Adapt the pam spec file to build without support for NIS(+).
- Communicate the removal of the PAM configuration for user-authentication using NIS with the authselect maintainers; also offer assistance to implement the needed changes.
- Other developers:
- Apply the pull-request to the authselect package.
- Test this change.
- Release engineering: #10351
- Policies and guidelines: N/A (not needed for this Change)
- Trademark approval: N/A (not needed for this Change)
- Alignment with Objectives: N/A
Upgrade/compatibility impact
Users that were relying on support for NIS(+) will need to move to secure alternatives like LDAP and/or FreeIPA.
How To Test
There is no need to test, as when configure switch is removed, support is dropped.
User Experience
For some users this change may be a bit disruptive and it may require some learning curve for switching to alternative solutions.
Dependencies
- The authselect package needs to be updated to drop its PAM configuration for user-authentication using NIS.
- Apart from that there are actually no rpms, that directly depend on the change of the functionality of the affected PAM module.
Contingency Plan
- Contingency mechanism: Revert the changes made to the affected packages and rebuild them.
- Contingency deadline: At beta freeze. Documentation and/or migration tools must be prominently available, per FESCo.
- Blocks release? Yes.
Documentation
The documentation about sharing system users and files over NIS should be dropped, if there even is any.
Release Notes
Support for NIS(+) has been dropped from PAM. Users, who are currently using NIS(+) to share UNIX users / groups within a network, should migrate their setups to use LDAP or some other secure service providing comparable functionalities before updating to Fedora 36.