On 04/29/2013 09:30 AM, steve wrote:
On 04/29/2013 12:55 PM, John Hodrien wrote:
> On Mon, 29 Apr 2013, Ondrej Kos wrote:
>
>> Hi,
>>
>> I'm not sure if I understand your situation correctly, but it seems
>> to me that this could be solvable by creating a symlink pointing
>> from /tmp/krb5_cc to /var/lib/sss/db/ccache. We just tried it with
>> Lukas, and it works as i expected.
Nope, I'm afraid not. The symlink doesn't work. It has to be a real file.
>
> Would SELinux throw a spanner in the works? I've not needed this for
> cifs, as
> sec=krb5,multiuser seems to remove the need for the machine credential.
John, that's not what we find. The whole reason we have this problem
is that for us, nothing gets mounted unless there's a root cache at
/tmp multiuser or not. Th only reason we use multiuser is to make cifs
behave like nfs in that the uid:gid who creates the file is that of
the user who is logged in and not the guy who mounted the share.
It looks like the cron to keep the ticket alive is the way to go and I
take your point. Hourly seems fine. The idea is that cifs on the
client stays alive for as long as the box is booted, not until the
ticket expires. There's aother utility called k5start which may be
another solution. It's designed to maintain long running processes.
I've used it with nslcd.
Have you looked at GSS proxy?
It goal is to provide the separation of duties and automatic ticket
renewal. It is in F19 now.
https://fedoraproject.org/wiki/Features/gss-proxy
This is the direction we are going to solve the problem of the ticket
renewal.
Cheers,
Steve
I think the ony solution
_______________________________________________
sssd-devel mailing list
sssd-devel(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
--
Thank you,
Dmitri Pal
Sr. Engineering Manager for IdM portfolio
Red Hat Inc.
-------------------------------
Looking to carve out IT costs?
www.redhat.com/carveoutcosts/