On 09.12.21 14:44, John Desantis via FreeIPA-users wrote:
Ronald,
> What is your experience regarding SSH logins or lookups (getent)? How
> long do they take in your setup? Uncached SSH logins with AD users do
> take up to 30 seconds or more at our site.
I wasn't sure if this question was directed at me or not, but for our
site please see the following figures from an empty client cache:
# systemctl stop sssd.service; rm -rf /var/lib/sss/{db,mc}/*;
systemctl start sssd.service; time getent passwd admin(a)IPA.DOMAIN;
time getent passwd ADUSER
admin:*:UID:GID:Administrator:/home/admin:/bin/bash
real 0m2.049s
user 0m0.000s
sys 0m0.002s
ADUSER:*:UID:GID:AD USER [ADUSER]:/home/a/ADUSER:/bin/bash
real 0m4.673s
user 0m0.001s
sys 0m0.000s
$ time ssh ADUSER@COMPUTE-HOST uptime
ADUSER@COMPUTE-HOST's password:
08:37:12 up 135 days, 23:08, 1 user, load average: 0.18, 0.08, 0.06
real 0m8.899s
user 0m0.011s
sys 0m0.005s
I am sorry. Yes, the question was directed to you. Thanks for sharing
these details. May I ask how large your AD is (approx. number of users)?
Cheers,
Ron