diff options
| author | Stephen Gallagher <sgallagh@redhat.com> | 2015-04-20 10:51:04 -0400 |
|---|---|---|
| committer | Jakub Hrozek <jhrozek@redhat.com> | 2015-05-28 11:13:20 +0200 |
| commit | 772464c842968d6e544118ae1aa7c49a7cda2ad6 (patch) | |
| tree | 3aa8f4c12f6053d51029c561f0c66a1b11778f70 /src/man | |
| parent | 31bafc0d6384a30859aa18f3bd22275aec6ee2ed (diff) | |
| download | sssd-772464c842968d6e544118ae1aa7c49a7cda2ad6.tar.gz sssd-772464c842968d6e544118ae1aa7c49a7cda2ad6.tar.xz sssd-772464c842968d6e544118ae1aa7c49a7cda2ad6.zip | |
AD GPO: Change default to "enforcing"
When a user enrolls a system against Active Directory, the expectation
is that the client will honor the centrally-managed settings. In the
past, we avoided changing the default (and left it in permissive mode,
to warn admins that the security policy wasn't being honored) in order
to avoid breaking existing Active Directory enrollments.
However, sufficient time has likely passed for users to become
accustomed to using GPOs to manage access-control for their systems.
This patch changes the default to enforcing and adds a configure flag
for distributions to use if they wish to provide a different default
value.
Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
Diffstat (limited to 'src/man')
| -rw-r--r-- | src/man/Makefile.am | 7 | ||||
| -rw-r--r-- | src/man/sssd-ad.5.xml | 5 |
2 files changed, 10 insertions, 2 deletions
diff --git a/src/man/Makefile.am b/src/man/Makefile.am index 6a1cf7dce..1ef1da48c 100644 --- a/src/man/Makefile.am +++ b/src/man/Makefile.am @@ -24,7 +24,12 @@ endif if BUILD_IFP IFP_CONDS = ;with_ifp endif -CONDS = with_false$(SUDO_CONDS)$(AUTOFS_CONDS)$(SSH_CONDS)$(PAC_RESPONDER_CONDS)$(IFP_CONDS) +if GPO_DEFAULT_ENFORCING +GPO_CONDS = ;gpo_default_enforcing +else +GPO_CONDS = ;gpo_default_permissive +endif +CONDS = with_false$(SUDO_CONDS)$(AUTOFS_CONDS)$(SSH_CONDS)$(PAC_RESPONDER_CONDS)$(IFP_CONDS)$(GPO_CONDS) #Special Rules: diff --git a/src/man/sssd-ad.5.xml b/src/man/sssd-ad.5.xml index 55c7a4045..938a443e0 100644 --- a/src/man/sssd-ad.5.xml +++ b/src/man/sssd-ad.5.xml @@ -324,9 +324,12 @@ FOREST:EXAMPLE.COM:(memberOf=cn=admins,ou=groups,dc=example,dc=com) </listitem> </itemizedlist> </para> - <para> + <para condition="gpo_default_permissive"> Default: permissive </para> + <para condition="gpo_default_enforcing"> + Default: enforcing + </para> </listitem> </varlistentry> |