[SSSD-users] Fetching Hosts Entries from OpenLDAP Database

Stephen Gallagher sgallagh at redhat.com
Thu Aug 20 14:09:51 UTC 2015


On Thu, 2015-08-20 at 00:54 +0200, Michael Ströder wrote:
> Dmitri Pal wrote:
> > On 08/19/2015 03:53 PM, Jakub Hrozek wrote:
> > > On Wed, Aug 19, 2015 at 09:49:22PM +0530, Rajnesh Kumar Siwal
> > > wrote:
> > > > Any suggested workaround .
> > > You can use nss-pam-ldapd just for the hosts database and sssd
> > > for the
> > > rest, you can use different views or different servers altogether
> > > for
> > > public/private views.
> > > 
> > > btw this is the first time I've heard a request for hosts support
> > > in
> > > sssd, so I don't think it's something that can be expected,
> > > unless
> > > someone steps in and implements the maps.
> > 
> > People usually use DNS for that and it is the recommended way of
> > doing
> > things.
> > BTW if you want LDAP managed host entries you can use FreeIPA and
> > it
> > comes with DNS to solve this issue.
> 
> But DNS is not subject to access control. Yes, I also already thought
> about
> making host entries visible only to specific hosts.
> 


Hmm, access-control is the first good argument I've heard for
supporting hosts in LDAP as opposed to DNS[SEC]. Historically, we've
ignored the hosts map in SSSD because we reasoned that dnsmasq was a
better caching solution for hosts than LDAP. However, being able to
restrict what machines have access to the hosts is actually an
interesting use-case.

If you have a RHEL subscription, I'd encourage you to contact your
support representative to make a formal request for inclusion of the
hosts map in SSSD. If you do not, please file an RFE at 
https://fedorahosted.org/sssd with this justification and upstream will
consider it for inclusion in a future release.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 181 bytes
Desc: This is a digitally signed message part
URL: <https://lists.fedorahosted.org/pipermail/sssd-users/attachments/20150820/6abbcbad/attachment.sig>


More information about the sssd-users mailing list