[SSSD] Trying to ssh with sssd/pam configuration

Jakub Hrozek jhrozek at redhat.com
Wed Aug 6 17:42:28 UTC 2014


On Wed, Aug 06, 2014 at 05:36:34PM +0000, Sterling Sahaydak wrote:
> Thanks again Jakub!
> 
> Understood about creating then a generic service account and use that to
> authenticate with.
> 
> Hmm, okay, I thought I was somehow using gssapi as I was getting those type
> of error messages earlier.
> 
> 
> So, is there a way of setting up sssd then without using a password?
> 
> My concern here is once a password changes, having to go around and make
> updates to all the sssd.conf files out there.

Using GSSAPI would be the best choice, then, if you want to avoid bind
DN and passwords.

But frankly I don't think anonymous reads are all that bad if you limit what
is readable anonymously with the use of ACIs on the server properly. Then
the anonymous binds would be only able to read information that is not
considered critical and for any other attributes you'd need to authenticate.



More information about the sssd-devel mailing list