Using freeipa from RHEL8.1, we need to set up the ipa-clients in a way that login is only possible if the ipa-server can be contacted. Local logi from the cache must be impossible. Is there a way to achieve this?
Ciao
Dominik ^_^ ^_^
--
Dominik Vogt
Am Tue, May 18, 2021 at 11:44:57AM +0100 schrieb Dominik Vogt via FreeIPA-users:
Using freeipa from RHEL8.1, we need to set up the ipa-clients in a way that login is only possible if the ipa-server can be contacted. Local logi from the cache must be impossible. Is there a way to achieve this?
Hi,
as long as it is only about password authentication you can set 'cache_credentials = False', see man sssd.conf for details.
Other methods, e.g. ssh public-key authentication, will still work and currently I do not have an idea how to disable them reliable in this case.
bye, Sumit
Ciao
Dominik ^_^ ^_^
--
Dominik Vogt _______________________________________________ FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahoste... Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure
On Tue, May 18, 2021 at 03:06:39PM +0200, Sumit Bose via FreeIPA-users wrote:
Am Tue, May 18, 2021 at 11:44:57AM +0100 schrieb Dominik Vogt via FreeIPA-users:
Using freeipa from RHEL8.1, we need to set up the ipa-clients in a way that login is only possible if the ipa-server can be contacted. Local logi from the cache must be impossible. Is there a way to achieve this?
Hi,
as long as it is only about password authentication you can set 'cache_credentials = False', see man sssd.conf for details.
Thanks; I'll check with the customer if that is good enough.
Ciao
Dominik ^_^ ^_^
--
Dominik Vogt
freeipa-users@lists.fedorahosted.org