[SSSD-users] Using sssd on HPC cluster without direct ldap access

Jean-Baptiste Denis jbdenis at pasteur.fr
Thu Jul 17 09:36:32 UTC 2014


Dimitry,

> Right now, no.
> And we do not have something like this in plans.
> The simplest solution is to put one of the LDAP servers into the cluster.
> If you can't do that then you are stuck with what you have now.

OK.

> Potentially what you want is to be able to generate SSSD cache db on one system
> and copy it around.
> There is no such functionality and the problem with building one is creating
> password hashes in such database in bulk (requires passwords in clear which is a
> nonstarter). When users log in one by one passwords can be captured and hashed
> for further use. It is hard to do in bulk.

I've thought of that, but although I will be using SSSD, it looks quite tricky
and less robust than simply copying /etc files around.

Jakub,

> Would a readonly replica mitigate your security concern?

Not entirely. And it would take time to validate this kind of setup in my
situation.

I think I've got all the elements now to make an educated choice, that's all I
wanted. Thank you everybody for your answers.

Jean-Baptiste



More information about the sssd-users mailing list