[SSSD] sssd vs winbind

steve steve at steve-ss.com
Wed Feb 12 09:11:38 UTC 2014


On Mon, 2014-01-27 at 12:50 -0500, Chris Hartman wrote:
> I don't have any documentation on my winbind setup, meaning that I've
> only adjusted configs for SSSD (1.9.2) and Samba (configs for these
> included below).
> 
> 
> Before SSSD implemented ID mapping in a manner consistent with
> winbind, I had to use Identity Management for Unix on the domain
> controller to manually assign each user's UID (using an LDAP
> attribute) to the same value as the UID that windbind would generate.
> Later, after SSSD implemented the same ID mapping as Winbind, I
> removed IMU and let SSSD do its thing.
> 
> 
> On this fileserver, PAM isn't even aware of winbind; all auth is
> handled by SSSD. Winbind is only used by Samba when sharing files.
> 
> 
> [root at tic windows_pc_backups]# cat /etc/samba/smb.conf
> 
> 
>         # This file automatically generated and maintained by Puppet.
>         # Manual editing of this file is NOT recommended as your
>         changes
>         # will be overwritten.
>         ### Begin minimal global configuration ###
>         [global]
>         # These settings will be overwritten by puppet.
>         # Please make local changes to the include file
>         log level = 5
>         client ldap sasl wrapping = seal
>         disable netbios = yes
>         security = ads
>         server signing = mandatory
>         realm = DOMAIN.LOCAL
>         workgroup = DOMAIN
>         winbind separator = +
>         winbind enum users = Yes
>         winbind enum groups = Yes
>         winbind nested groups = Yes
>         winbind use default domain = yes
>         kerberos method = system keytab
>         load printers = yes
>         printing = bsd
>         include = /etc/samba/extra-settings.conf
> 
> 
> extra-settings.conf just sets up some file shares:
>         # Settings for backup servers
>         printcap name = /dev/null
>         disable spoolss = yes
>         server string = Tic - Half Fresh
>         idmap backend = tdb
>         idmap uid = 1000000-1999999
>         idmap gid = 1000000-1999999
>         idmap config DOMAIN : backend  = ad
>         idmap config DOMAIN : range = 10000-50000
>         [backups]
>         path = /mnt/storage2/windows_pc_backups
>         read only = yes
>         printable = no
>         guest ok = no
>         valid users = "@DOMAIN+Domain Users"
>         create mask = 0775
>         writeable = no
> 
> 
> And my sssd.conf:
>         # This file is autogenerated by Puppet.
>         # # Manually editing this file is NOT recommended
>         # # as your changes will be overwritten.
>         #
>         [sssd]
>         config_file_version = 2
>         debug_level = 0
>         reconnection_retries = 3
>         sbus_timeout = 30
>         services = nss, pam
>         domains = DOMAIN
>          
>         [pam]
>         debug_level = 0
>         [nss]
>         debug_level = 0
>         filter_users = ...
>         filter_groups = ...
>         reconnection_retries = 3
>         default_shell = /bin/bash
>         shell_fallback = /bin/bash
>         [domain/DOMAIN]
>         debug_level = 0
>         ad_domain = DOMAIN.local
>         id_provider = ad
>         auth_provider = ad
>         chpass_provider = ad
>         access_provider = ad
>         enumerate = true
>         cache_credentials = true
>         # Will check unixHomeDirectory LDAP attribute for a value
>         first
>         fallback_homedir = /home/%u
>         # This is necessary for IPv4 and IPv6 dynamic DNS updates
>         dyndns_iface = eth0
>         ldap_user_home_directory = unixHomeDirectory
>         dyndns_update = true
>         dyndns_update_ptr = true
>         ldap_schema = ad
>         ldap_id_mapping = true
> 
> 
> -Chris
> 
> 
> On Mon, Jan 27, 2014 at 12:26 PM, Rowland Penny
> <repenny241155 at gmail.com> wrote:
>         On 27/01/14 17:21, Chris Hartman wrote:
>                 For what it's worth, I use winbind + sssd as a windows
>                 fileserver and have no problems with the setup. It's
>                 true that winbind is necessary to share files but
>                 certainly SSSD can co-exist with winbind.
>                 
>                 
>                 -Chris
>                 
>                 
>         Do you have to set winbind up? and if so how?
>         
>         
>         Rowland

Hi
This post (Summary: if winbind is not running then smbd has to perform
50 lookups to AD rather than 2):
https://lists.samba.org/archive/samba/2014-January/178374.html

suggests that for better performance with smbd, winbind has to be
running alongside sssd. Given that smbd will always be running on an AD
file server, would it would be possible to include similar code which
performs this optimisation within sssd?
Thanks,
Steve






More information about the sssd-devel mailing list