sssd has the following config to set the interval for the sudo rules refresh:
ldap_sudo_full_refresh_interval
What is the configuration to set the interval for the netgroup definition retrieval from LDAP?
On (28/11/16 19:07), docbook.xml@gmail.com wrote:
sssd has the following config to set the interval for the sudo rules refresh:
ldap_sudo_full_refresh_interval
What is the configuration to set the interval for the netgroup definition retrieval from LDAP?
netgroups are not refreshed by default.
They are retutned from sssd cache if entry is valid. This time is confugurable with the option entry_cache_netgroup_timeout which has by defualt the same alue as the option entry_cache_timeout (5400)
May I know why do you need to periodically refresh netgroups from LDAP?
LS
Lukas,
We are using the Netrgroups in the Sudoer Rules Host. When a host is added to the correct netgroup, the admin should be able to execute the appropriate sudoers commands immediately or in a small time frame. Right now sss_cache -E needs to executed to get the new netgroups down the host. Which is cumbersome.
Thanks, Saqib
On Mon, Nov 28, 2016 at 07:32:20PM -0000, docbook.xml@gmail.com wrote:
Lukas,
We are using the Netrgroups in the Sudoer Rules Host. When a host is added to the correct netgroup, the admin should be able to execute the appropriate sudoers commands immediately or in a small time frame. Right now sss_cache -E needs to executed to get the new netgroups down the host. Which is cumbersome.
Thanks, Saqib
You can also decrease the general cache validity timeout of netgroups: entry_cache_netgroup_timeout but of course that would cause /all/ netgroup requests to hit the server more often.
On (28/11/16 22:02), Jakub Hrozek wrote:
On Mon, Nov 28, 2016 at 07:32:20PM -0000, docbook.xml@gmail.com wrote:
Lukas,
We are using the Netrgroups in the Sudoer Rules Host. When a host is added to the correct netgroup, the admin should be able to execute the appropriate sudoers commands immediately or in a small time frame. Right now sss_cache -E needs to executed to get the new netgroups down the host. Which is cumbersome.
"sss_cache -N" should be enough.
Thanks, Saqib
You can also decrease the general cache validity timeout of netgroups: entry_cache_netgroup_timeout but of course that would cause /all/ netgroup requests to hit the server more often.
As I wrote in that might help if 1.5 hour is not enough for your use-case. I do not know how often do you change netgroups in LDAP and how many netgroups do you have in LDAP and how many clients do you have connected to directory server. Because too small value (5 minutes) could create hight load on LDAP server if you have many clients.
LS
Lukas Slebodnik wrote:
As I wrote in that might help if 1.5 hour is not enough for your use-case. I do not know how often do you change netgroups in LDAP and how many netgroups do you have in LDAP and how many clients do you have connected to directory server. Because too small value (5 minutes) could create hight load on LDAP server if you have many clients.
Enough reasoning why one should consider abandoning netgroups completely and replace them by something better.
Ciao, Michael.
sssd-users@lists.fedorahosted.org
-
Ali, Saqib -
Jakub Hrozek -
Lukas Slebodnik -
Michael Ströder