All of lore.kernel.org
 help / color / mirror / Atom feed
From: Patrick Williams <patrick@stwcx.xyz>
To: Joseph Reynolds <jrey@linux.ibm.com>
Cc: openbmc <openbmc@lists.ozlabs.org>
Subject: Re: Request new repo for IBM-specific code
Date: Fri, 5 Mar 2021 13:15:47 -0600	[thread overview]
Message-ID: <YEKDY6+zfW5Uuqkl@heinlein> (raw)
In-Reply-To: <b8af3438-f85a-cb82-c88c-9c4e120399e9@linux.ibm.com>

[-- Attachment #1: Type: text/plain, Size: 1907 bytes --]

On Thu, Mar 04, 2021 at 09:14:47PM -0600, Joseph Reynolds wrote:
> What is the right repository for a new Linux-PAM module to implement an 
> IBM-specific ACF authentication?
> 
> The access control file (ACF) design was introduced to the OpenBMC 
> security working group and is described in [IBM issue 1737][] and 
> further explained in [IBM issue 2562][].

I'm not really seeing much documentation on this in either issue.  Do
you have a document describing your requirements and how you're planning
to accomplish it?

My first reading of what is there, I'm not sure why typical certificate
based authentication couldn't solve your needs (but I'm just guessing
what your needs are).  It seems like you have a root-authority (IBM), a
a daily expiring certificate, and some fields in the certificate you
want to confirm (ex. serial number).  I've seen other production-level
systems doing similar for SSH/HTTPS without additional PAM modules.

> Note the [pam-ipmi modules][] are scoped to the OpenBMC project because 
> the IPMI implementation is shared by all of OpenBMC.  By comparison, the 
> proposed ibm-pam-acf module is intended only for IBM Enterprise 
> systems.  The intended implementation is based on standard cryptography 
> techniques and could be developed into a general authentication 
> solution, but the ACF is specific to IBM in terms of its exact format 
> and content, and I expect it will only be used by IBM and its partners.

Are you planning to open up the tools necessary to create these ACFs?

> Can we create a new OpenBMC repo for this?  Perhaps ibm-pam-acf?  Or 
> should this go into some other repo?
> 
> - Joseph
> 
> [IBM issue 1737]: https://github.com/ibm-openbmc/dev/issues/1737
> [IBM issue 2562]: https://github.com/ibm-openbmc/dev/issues/2562
> [pam-ipmi modules]: https://github.com/openbmc/pam-ipmi

-- 
Patrick Williams

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

  reply	other threads:[~2021-03-05 19:21 UTC|newest]

Thread overview: 18+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-03-05  3:14 Request new repo for IBM-specific code Joseph Reynolds
2021-03-05 19:15 ` Patrick Williams [this message]
2021-03-05 22:05   ` Patrick Williams
2021-03-07  4:09   ` Joseph Reynolds
2021-03-08 18:45     ` Patrick Williams
2021-03-08 20:30       ` Request new repo for IBM-specific code - pam_2fa discussion Joseph Reynolds
2021-03-08 22:41         ` Patrick Williams
2021-03-09 17:43           ` Joseph Reynolds
2021-04-29 21:09       ` Request new repo for IBM-specific code Joseph Reynolds
2021-04-29 21:24         ` Ed Tanous
2021-04-30  0:47           ` Joseph Reynolds
2021-04-30 13:29         ` Patrick Williams
2021-05-01  5:30           ` Request new repo for IBM-specific code: ibm-acf Joseph Reynolds
2021-05-02 23:46             ` Andrew Jeffery
2021-05-03  1:37               ` Andrew Jeffery
2021-05-03 16:21         ` Request new repo for IBM-specific code Ed Tanous
2021-03-08 16:03 ` Ed Tanous
2021-03-08 17:30   ` Joseph Reynolds

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=YEKDY6+zfW5Uuqkl@heinlein \
    --to=patrick@stwcx.xyz \
    --cc=jrey@linux.ibm.com \
    --cc=openbmc@lists.ozlabs.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.