[SSSD] Trying to ssh with sssd/pam configuration

Sterling Sahaydak sterling.sahaydak at pi-coral.com
Wed Aug 6 17:36:34 UTC 2014


Thanks again Jakub!

Understood about creating then a generic service account and use that to 
authenticate with.

Hmm, okay, I thought I was somehow using gssapi as I was getting those 
type of error messages earlier.


So, is there a way of setting up sssd then without using a password?

My concern here is once a password changes, having to go around and make 
updates to all the sssd.conf files out there.



Thanks!

------ Original Message ------
From: "Jakub Hrozek" <jhrozek at redhat.com>
To: sssd-devel at lists.fedorahosted.org
Sent: 8/6/2014 1:27:39 PM
Subject: Re: [SSSD] Trying to ssh with sssd/pam configuration

>On Tue, Aug 05, 2014 at 02:07:16PM +0000, Sterling Sahaydak wrote:
>>  Jakub!
>>
>>  That worked!!!!! Many many many thanks!!!!!
>>
>>  I did go back and re-enabled - disallow_bind_anon
>>
>>  What I need to look at next is 'hardening' the setup I have.
>>
>>  Is there a web page explaining 'best practices' or things you want to 
>>do for
>>  a production setup?
>
>Use SSL/TLS, mainly, to avoid sending clear text password over the 
>wire.
>SSSD even doesn't authenticate users w/o encryption in place.
>
>>
>>  You recommended of not using cn=Manager - understand, is there a 
>>recommended
>>  account schema to use?
>>  non posix account since I'm using it as part of my search filter?
>
>If you're fine using a ldap bind + password, then you can just create a
>'service' user you bind as. It can be any entry, no special schema is
>necessary, it just has to have a DN and a password. The bind user is 
>not
>part of any filter.
>
>>
>>  Seems like I'm using SASL now and was wondering is there a way also 
>>to get
>>  around of having a password
>
>Umm are you sure you're using SASL? We only support GSSAPI as a SASL
>mech now..
>
>_______________________________________________
>sssd-devel mailing list
>sssd-devel at lists.fedorahosted.org
>https://lists.fedorahosted.org/mailman/listinfo/sssd-devel




More information about the sssd-devel mailing list