[SSSD-users] timeout and offline mode behaviour

Simo Sorce simo at redhat.com
Mon Jun 2 15:39:04 UTC 2014

On Mon, 2014-06-02 at 10:34 +0200, Joschi Brauchle wrote:
> Hello everone,
> we have an issue/problem that seems highly related to the current 
> "timeout and offline mode behaviour".
> We have several SSSD 1.9.5 systems with "cache_credentials = true", 
> which experience periodic blocking/pausing of the complete X session for 
> several seconds (~5-10) when these machines are not connected to their 
> home network. The user is not able to use the machine at all during 
> these lockups, which is very annoying...
> These are some of the details:
> 1) The LDAP server has a local 192.168.x.x IP, which is resolvable globally.

IPs in the 129.168 are not resolvable globally, they are private
addresses and routing is not allowed outside private networks.

> 2) The LDAP server is behind a firewall, dropping packets from outside 
> networks.

Tell your firewall admins to return a ICMP Reject, not just drop packets
on the floor.
There is only so much we can do with badly configured firewalls (this
will help only on your own network) or networks.

> 3) The lockups seem to occur if the clients are not connected to this 
> "home" network but to a different network with similar configuration 
> (192.168.x.x, which is pretty common).

On other networks there isn't much you can do, except to avoid returning
DNS replies at all, this way the client does not even attempt to contact
a random 'private' IP address on a different network.

Of course if you have host names in /etc/hosts or use directly ip
addresses in sssd.conf configuration there isn't much you can do, again.

At most you can play with timeouts to reduce the issues.


Simo Sorce * Red Hat, Inc * New York

More information about the sssd-users mailing list