Ron,
I am sorry. Yes, the question was directed to you. Thanks for
sharing
these details. May I ask how large your AD is (approx. number of users)?
No need to apologize!
I just asked one of our AD administrators and he said there are close
to 800,000 users.
HTH,
John DeSantis
Il giorno gio 9 dic 2021 alle ore 09:37 Ronald Wimmer via
FreeIPA-users <freeipa-users(a)lists.fedorahosted.org> ha scritto:
>
> On 09.12.21 14:44, John Desantis via FreeIPA-users wrote:
> > Ronald,
> >
> >> What is your experience regarding SSH logins or lookups (getent)? How
> >> long do they take in your setup? Uncached SSH logins with AD users do
> >> take up to 30 seconds or more at our site.
> >
> > I wasn't sure if this question was directed at me or not, but for our
> > site please see the following figures from an empty client cache:
> >
> > # systemctl stop sssd.service; rm -rf /var/lib/sss/{db,mc}/*;
> > systemctl start sssd.service; time getent passwd admin(a)IPA.DOMAIN;
> > time getent passwd ADUSER
> > admin:*:UID:GID:Administrator:/home/admin:/bin/bash
> >
> > real 0m2.049s
> > user 0m0.000s
> > sys 0m0.002s
> > ADUSER:*:UID:GID:AD USER [ADUSER]:/home/a/ADUSER:/bin/bash
> >
> > real 0m4.673s
> > user 0m0.001s
> > sys 0m0.000s
> >
> > $ time ssh ADUSER@COMPUTE-HOST uptime
> > ADUSER@COMPUTE-HOST's password:
> > 08:37:12 up 135 days, 23:08, 1 user, load average: 0.18, 0.08, 0.06
> >
> > real 0m8.899s
> > user 0m0.011s
> > sys 0m0.005s
>
I am sorry. Yes, the question was directed to you. Thanks for
sharing
these details. May I ask how large your AD is (approx. number of users)?
>
> Cheers,
> Ron
> _______________________________________________
> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
> Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
> Do not reply to spam on the list, report it:
https://pagure.io/fedora-infrastructure