gss-proxy.git/proxy/man, branch ntlmssp

Add configuration options to support ntlmssp

2014-01-07T02:27:55+00:00

Add support for dropping privileges

2013-12-26T21:08:58+00:00

If the 'proxy user' configuation option is set in the [gssproxy] section then
GSS Proxy will drop privileges to the specified after setting up all the
sockets.

Care must be taken to make sure all the resources the daemon need access to
(keytabs, ccache directories, etc..) are accessible as the proxy user.

Implements: https://fedorahosted.org/gss-proxy/ticket/102

Signed-off-by: Simo Sorce

man: Describe new flag filtering/enforcing options

2013-11-20T14:26:13+00:00

Resolves: https://fedorahosted.org/gss-proxy/ticket/109

Reviewed-by: Günther Deschner

Add impersonation support

2013-10-23T17:52:13+00:00

By setting the impersonate flag to true, the acquisition of credentials will
be done using constrained delegation (s4uself + s4u2proxy).

To work this needs MIT Kereberos 1.11.4 or later.
Previous versions have a bug in the import_cred function that prevents the
library from properly importing previously exported delegated credentials.

Resolves: https://fedorahosted.org/gss-proxy/ticket/95

Reviewed-by: Günther Deschner

Add man page entry for cred_usage

2013-10-23T13:05:44+00:00

Reviewed-by: Günther Deschner

Add man page entry for allow_any_uid

2013-10-23T13:05:36+00:00

Reviewed-by: Günther Deschner

docs: Fill in GSSPROXY_BEHAVIOR default setting from configure option.

2013-10-18T13:17:52+00:00

Signed-off-by: Günther Deschner 
Reviewed-by: Simo Sorce

docs: autogenerate proxymech manpage.

2013-10-18T13:17:47+00:00

Signed-off-by: Günther Deschner 
Reviewed-by: Simo Sorce

Fix documentation to match reality

2013-10-18T12:34:54+00:00

LOCAL_FIRST is our default

Reviewed-by: Günther Deschner

Add service match using SeLinux Context

2013-07-02T14:17:23+00:00

Using getpeercon we can know the elinux context of the process talking to
gssproxy. Use this information as an optional additional filter to match
processes to service definitions.
If a selinux_context option with a full user;role;type context is specified
into a service section, then the connecting process must also be running under
the specified selinux context in order to be allowed to connect.

Signed-off-by: Simo Sorce 
Reviewed-by: Günther Deschner