On to, 02 joulu 2021, Ronald Wimmer via FreeIPA-users wrote:
We do have several hundred IPA clients at the moment. People are
advised to use their AD users when connecting to an IPA client via
SSH. Colleagues are reporting constantly that uncached logins are
taking way to long. I did even see colleagues returning to creating
local user accounts...
I am aware of the tuning guide
https://jhrozek.wordpress.com/2015/08/19/performance-tuning-sssd-for-larg...
. We have implemented all tunables described there on the server side.
We have tens of thousands of users in our AD. Maybe the whole AD<->IPA
setup should be implemented in a completely different way?
Please help me to further analyze and tune our IPA installation in
order to minimize SSH login times.
My recommendations typically would go this way:
- enable logging in SSSD configuration on both IPA clients and IPA
servers
- take a set of logs for non-cached login, turn logging off back to
normal state
- analyze the logs from timing perspective for each step:
- DC discovery (takes several steps in itself)
- ID resolution on both IPA server and client
- Authentication on IPA client
- group recollection on IPA server and client
- authorization (HBAC rules, etc)
- if there are timeouts seen, adjust corresponding timeouts
- if there are too wide DC discovery steps, make sure the pin AD sites
on both IPA server and client sides
- if there are too long authentication attempts, see what delays access
to AD DCs, remedy that
Sometimes, there are issues with AD configuration:
- some attributes don't get replicated to Global Catalog
- some DCs which advertize GC service, get firewalled access to them
from IPA side, leading to re-discovery to a different DC
- firewalls should never be underestimated
- missing DNS records cause re-discovery attempts
If you have those details handy, come and talk to your operating system
support organization.
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland