[SSSD] Trying to ssh with sssd/pam configuration
Sterling Sahaydak
sterling.sahaydak at pi-coral.com
Wed Aug 6 17:36:34 UTC 2014
Thanks again Jakub!
Understood about creating then a generic service account and use that to
authenticate with.
Hmm, okay, I thought I was somehow using gssapi as I was getting those
type of error messages earlier.
So, is there a way of setting up sssd then without using a password?
My concern here is once a password changes, having to go around and make
updates to all the sssd.conf files out there.
Thanks!
------ Original Message ------
From: "Jakub Hrozek" <jhrozek at redhat.com>
To: sssd-devel at lists.fedorahosted.org
Sent: 8/6/2014 1:27:39 PM
Subject: Re: [SSSD] Trying to ssh with sssd/pam configuration
>On Tue, Aug 05, 2014 at 02:07:16PM +0000, Sterling Sahaydak wrote:
>> Jakub!
>>
>> That worked!!!!! Many many many thanks!!!!!
>>
>> I did go back and re-enabled - disallow_bind_anon
>>
>> What I need to look at next is 'hardening' the setup I have.
>>
>> Is there a web page explaining 'best practices' or things you want to
>>do for
>> a production setup?
>
>Use SSL/TLS, mainly, to avoid sending clear text password over the
>wire.
>SSSD even doesn't authenticate users w/o encryption in place.
>
>>
>> You recommended of not using cn=Manager - understand, is there a
>>recommended
>> account schema to use?
>> non posix account since I'm using it as part of my search filter?
>
>If you're fine using a ldap bind + password, then you can just create a
>'service' user you bind as. It can be any entry, no special schema is
>necessary, it just has to have a DN and a password. The bind user is
>not
>part of any filter.
>
>>
>> Seems like I'm using SASL now and was wondering is there a way also
>>to get
>> around of having a password
>
>Umm are you sure you're using SASL? We only support GSSAPI as a SASL
>mech now..
>
>_______________________________________________
>sssd-devel mailing list
>sssd-devel at lists.fedorahosted.org
>https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
More information about the sssd-devel
mailing list