Hi all,
Seems like a usefull feature; oscp and I rather keep it enabled. On all
other IPA-clients, even a Raspberry Pi 3, it is much much more fast. On
the IPA-server is suffering here :(
What could be causing this slowness....
Winfried
Op 10-02-2020 om 08:13 schreef Sumit Bose via FreeIPA-users:
> On Sun, Feb 09, 2020 at 11:06:46PM +0200, Alexander Bokovoy via FreeIPA-users wrote:
>> On su, 09 helmi 2020, Winfried de Heiden via FreeIPA-users wrote:
>>> Hi all,
>>> For some reason, for a particular user, sss_ssh_authorizedkeys is extremely
slow on the IPA-server:
>>> time /usr/bin/sss_ssh_authorizedkeys
<username>~real 0m9.520suser 0m0.022ssys 0m0.018s
>>> It will return all the public keys, but is is slow, causing SSH-login delays
using a ssh-keys.
>>> On another CentOS Stream (8.1) IPA-client, using the same IPA-server:
>>> time /usr/bin/sss_ssh_authorizedkeys
<username>~real 0m0.020suser 0m0.005ssys 0m0.003s
>>> Some difference...Adding "certificate_verification = no_ocsp" to
sssd.conf on the IPA-server will bring back performance, but sound like a poor
workaround.
>>> Any idea what is happening here?
>> SSSD picks up certificates associated with the user entry for use as SSH
>> keys as well. I guess verification of those certificates via OCSP takes
>> time and that's why switching off the verification helps.
> Hi,
>
> if you are not interested in this feature at all you can disable it
> completely in recent versions of SSSD by setting
> 'ssh_use_certificate_keys = False' in the [ssh] section of sssd.conf.
> Please check if 'man sssd.conf' shows this option for your version of
> SSSD.
>
> HTH
>
> bye,
> Sumit
>
>>
>> --
>> / Alexander Bokovoy
>> Sr. Principal Software Engineer
>> Security / Identity Management Engineering
>> Red Hat Limited, Finland
>> _______________________________________________
>> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>> To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
>> Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>> List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
>> List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
> _______________________________________________
> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
> Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...