* Nico Kadel-Garcia:
On Thu, Nov 5, 2020 at 6:39 AM Petr Menšík
<pemensik(a)redhat.com> wrote:
>
> No, no, NO again.
>
> nscd has no important active bugs in Fedora. I am not sure what bugs are
> mentioned, but just a few active bugs are on glibc component in Fedora.
> Therefore it seems just fine no commits are good.
>
> Just unlike systemd-resolved, which actively breaks some use cases. It
> changes resolution order of search directive in resolv.conf, breaks
> DNSSEC, breaks one label names resolution. It is famous among DNS
> community [1].
sssd also breaks other LDAP setups, It's extremely broken with larger
LDAP setups because it insists on caching *ALL* of the LDAP, barring
being able to filter to only a smaller set of the LDAP.
Have you filed a bug report? I have seen similar reports, but I think
they were unexpected interactions with certain LDAP servers and
schemata.
(I personally do not work on sssd, though.)
nscd is a lightweight and *far* more stable tool, and should be used
in preference to sssd wherever possible. An indepent LDAP and Kerberos
toolkit is *far* more stable than sssd.
Just because it works for you doesn't mean that it's bug-free. We know
from reviewing the source code that nscd has several problem areas that
are difficult to fix. It may work fine under low-load situations.
I think it is more useful to focus on improving SSSD (which is already
more or less required for Windows domain integration) than maintain two
different caching solutions.
Thanks,
Florian
--
Red Hat GmbH,
https://de.redhat.com/ , Registered seat: Grasbrunn,
Commercial register: Amtsgericht Muenchen, HRB 153243,
Managing Directors: Charles Cachera, Brian Klemm, Laurie Krebs, Michael O'Neill