[SSSD-users] caching question? (switching servers)
Michael Ströder
michael at stroeder.com
Wed Jun 24 09:32:35 UTC 2015
Jakub Hrozek wrote:
> We've had one user who was unhappy about this default behaviour and they
> solved the problem with SRV queries as well -- they set a low TTL on SRV
> queries, which forced SSSD to re-discover servers on each login past the
> TTL interval. Then SSSD would select a server on the same priority level
> based on the weight field.
I repeat my security concerns: Without effective DNSSEC validation there's no
cryptographically signed binding between a name and a server cert then.
Why not just use DNS round-robin with A RRs? Then TLS hostname check works as
expected (provided you have proper subjectAltName values in the server certs).
It seems the load-balancing works reasonably well with sssd 1.9.x in a
installation with 8000+ systems and many OpenLDAP replicas. I could see in
the monitoring that replicas being down for a while get new connections after
restart.
Ciao, Michael.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 4272 bytes
Desc: S/MIME Cryptographic Signature
URL: <https://lists.fedorahosted.org/pipermail/sssd-users/attachments/20150624/0d0aff32/attachment.p7s>
More information about the sssd-users
mailing list