[SSSD-users] timeout and offline mode behaviour

Thomas Rücker thomas.ruecker at tieto.com
Tue Jun 3 06:36:02 UTC 2014


On 3 June 2014 06:25, Joschi Brauchle <joschi.brauchle at tum.de> wrote:

> On 06/02/2014 05:39 PM, Simo Sorce wrote:
>
>> On Mon, 2014-06-02 at 10:34 +0200, Joschi Brauchle wrote:
>>
>>> These are some of the details:
>>> 1) The LDAP server has a local 192.168.x.x IP, which is resolvable
>>> globally.
>>>
>>
>> IPs in the 129.168 are not resolvable globally, they are private
>> addresses and routing is not allowed outside private networks.
>>
>
> What I meant is that the DNS hostname of the LDAP server '
> gemini.lnt.ei.tum.de' is globally resolvable to its private
> '192.168.109.3' IP address. Unfortunately, this DNS setup cannot be
> changed..
>

And neither can corporate firewalls be easily changed to return failures
instead of dropping packets. (our IPs are non-rfc1918) I know it's well
meant advice from Simo, but reality disagrees with the implementation. Also
if I read Joschi's further part of the mail correctly it might even happen
if the IP stack thinks it's unroutable.

I agree it would be nice and preferable to just adjust the environment to
fit this, but many users might not be at liberty to do so.
I have a script that adds blackholes to the routing table just to work
around this brokenness if it detects a non-corporate network. I'd rather
not roll that to the corporate landscape.

Cheers

Thomas
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/sssd-users/attachments/20140603/4e855df7/attachment.html>


More information about the sssd-users mailing list