Am Sun, Oct 10, 2021 at 06:25:08PM -0400 schrieb James Ralston:
For our on-site Linux machines, we use the sssd-ad provider to both
map users/groups from Active Directory, and to authenticate users via
Kerberos. It works fantastically well, to the point where we have
absolutely no desire to go back to maintaining local users/groups in
/etc/passwd and /etc/group (respectively).
We are contemplating offering remote Linux laptops to our users. But
our InfoSec team is adamant that our AD DCs must not be reachable from
the Internet at large. So unless the owner of the laptop logs in to
the laptop locally and then connects to our VPN, the laptop will have
no access to Active Directory, and therefore sssd will be in offline
We are wondering whether it would be feasible to set the various sssd
caches to have long values (e.g. 180 days) so that as long as the user
fires up the laptop and connects to the VPN once every 180 days, they
will still be able to login (using their cached password) and
getpwnam/getpwuid/getgrnam/getgrgid will still work for their
uids/gids (because sssd will return the values it cached from the last
time it was able to reach the AD DCs).
It’s not clear to us how we would implement this. We could adjust
various timeouts; e.g., from:
entry_cache_timeout = 5400
cache_credentials = FALSE
entry_cache_timeout = 7776000
cache_credentials = TRUE
…but I don’t think this is going to do what we want. We only want
sssd to keep entries in the cache for 90 days when it is offline. If
sssd comes back online (because the user connected to the VPN and thus
AD is reachable again), we want AD to refresh any cached entries that
are older than 90 minutes.
So, what we really want is an option for sssd that essentially says,
“You are frequently going to be operating in offline mode, so only
kick things out of the cache when you are in online mode, because
SSSD does not "kick things out of the cache" when in offline mode. So
with the default setting you can run in offline mode as long as you
want. Cached entries can expire and then SSSD will try to refresh them.
Since they cannot be refreshed when offline SSSD will keep using them.
Cached entries are only removed if they cannot be found on the server
anymore which of course only works when online.
The only item you can configure here is how long the cached password
hash should be used with the 'offline_credentials_expiration' option. By
default there is no limit.
otherwise there’s a good chance that the user won’t be able to login
to fire up the VPN so that you can switch to online mode.”
Has anyone attempted running sssd in a mostly-offline environment like
this? If so, how well does it work, and what settings are you using?
sssd-users mailing list -- sssd-users(a)lists.fedorahosted.org
To unsubscribe send an email to sssd-users-leave(a)lists.fedorahosted.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure