[SSSD-users] Public ssh key in AD

Lukas Slebodnik lslebodn at redhat.com
Tue Aug 25 09:51:24 UTC 2015


On (22/08/15 15:32), Davor Vusir wrote:
>Jakub Hrozek skrev den 2015-08-20 22:23:
>>quick top-post
>>
>>I'll be on vacacation starting tomorrow and the whole next week. I hope
>>some of the other sssd developers can help you out.
>>
>>tl;dr the public key should be set in ldap_user_ssh_public_key
>>
>
>It is.
>
>>See
>>https://jhrozek.wordpress.com/2015/08/19/performance-tuning-sssd-for-large-ipa-ad-trust-deployments/
>>for some performance tips.
>>
>
>Thank you. The tips did make difference.
>
>>Sorry for being terse.
>>
>
>Not at all.
>
>But I'm really curious about the reasons behind SSSD failing to retrieve the
>public key when deactivating subdomains_provider. In our case, as we don't
>have subdomains but forest trusts which SSSD doesn't support, we've got no
>reason having subdomains_provider activated to enumerate them (the trusted
>forests). It would be interesting to know why forest trusts are enumerated in
>the first place.
>
In previous mail, you provided log files from ssh responder, which just tried
to look up cached ssh key in sssd cache
But we would need to see a different log file to confirm whether public ssh key
was retrieved from LDAP/AD.

Please:
* clear old log files and sssd cache
* increase debug_level in domain section to 9
* restart sssd
* call "getent passwd user_with_ssh_key_in_ad"
* provide log files from domain section.

>>>[sssd]
>>>    debug_level = 0 # Levels = 0-9

BTW in this case it's not a big problem;
but in other options it can cause headaches while troubleshooting.

The part after character "#" is not considered as a comment.
The comment have to start this character "#" at the begining of line.

LS


More information about the sssd-users mailing list