[SSSD] Trying to ssh with sssd/pam configuration

Sterling Sahaydak sterling.sahaydak at pi-coral.com
Wed Aug 6 18:01:43 UTC 2014


Actually, let me correct myself.  I believe I'm not using gssapi since 
I'm not using kerberos, which i believe is required?

We are trying to avoid anonymous strictly for the fact that we don't 
want to give the ability to others to discover what user accounts exist, 
essentially half the userid password combination.

So, any other way then of not using a binddn/password and not using 
kerberos?


------ Original Message ------
From: "Jakub Hrozek" <jhrozek at redhat.com>
To: sssd-devel at lists.fedorahosted.org
Sent: 8/6/2014 1:42:28 PM
Subject: Re: [SSSD] Trying to ssh with sssd/pam configuration

>On Wed, Aug 06, 2014 at 05:36:34PM +0000, Sterling Sahaydak wrote:
>>  Thanks again Jakub!
>>
>>  Understood about creating then a generic service account and use that 
>>to
>>  authenticate with.
>>
>>  Hmm, okay, I thought I was somehow using gssapi as I was getting 
>>those type
>>  of error messages earlier.
>>
>>
>>  So, is there a way of setting up sssd then without using a password?
>>
>>  My concern here is once a password changes, having to go around and 
>>make
>>  updates to all the sssd.conf files out there.
>
>Using GSSAPI would be the best choice, then, if you want to avoid bind
>DN and passwords.
>
>But frankly I don't think anonymous reads are all that bad if you limit 
>what
>is readable anonymously with the use of ACIs on the server properly. 
>Then
>the anonymous binds would be only able to read information that is not
>considered critical and for any other attributes you'd need to 
>authenticate.
>_______________________________________________
>sssd-devel mailing list
>sssd-devel at lists.fedorahosted.org
>https://lists.fedorahosted.org/mailman/listinfo/sssd-devel




More information about the sssd-devel mailing list