Tune when sssd goes into offline mode

optimizationsssd

I have a linux server with sssd using an ldap server for the auth backend. The connection to the ldap server is flakey, so I get authentications which are fine and then suddenly one will take forever and timeout, only to be fine the next time it tries.

I'm trying to tune sssd to use the cache more often and quicker. I understand that sssd uses caching in both offline and online modes, but I suspect it's trying to use online mode more than is optimal for my situation.

How does sssd decide when to go offline and come back online?
How can I tune how quickly it transitions?

Thanks!

Best Answer

reconnection_retries (integer) Number of times services should attempt to reconnect in the event of a Data Provider crash or restart before they give up Default: 3

Reduce to 1 and look at the behavior of the

Related Solutions

Linux / AD integration with SSSD: how to choose what systems a user can log into

I would recommend against using the filter based access control filters for most deployments for two reasons:

they are hard to get right
the filters are applied on the user entry that is logging in. This might have interesting consequences especially if the filter contains a memberof attribute while the user is a member of nested groups - since the user entry only contains memberofs to direct parents, the nested groups would never match.

For very simple use cases, such as allowing a user or a group of users, I would recommend to use the simple access provider

For complex use-cases, SSSD supports AD GPOs starting with the 1.12.x series, search the sssd-ad man page for details.

Linux – SSSD process won’t die

I have run into issues with pam_ldap and sssd running on the same system. If you want to stop using sssd with pam you should make sure that you run:

pam-config -a --ldap

which will add LDAP to pam and then run:

pam-config -d --sss

which will delete the sssd setting in pam related config files in /etc/pam.d/

To make sure that sss is not used you may also want to check that nsswitch.conf has ldap in the correct places (or at the very least does not have sss). Here is an /etc/nsswitch.conf with sss enabled:

#
# /etc/nsswitch.conf
#
# An example Name Service Switch config file. This file should be
# sorted with the most-used services at the beginning.
#
# The entry '[NOTFOUND=return]' means that the search for an
# entry should stop if the search in the previous entry turned
# up nothing. Note that if the search failed due to some other reason
# (like no NIS server responding) then the search continues with the
# next entry. 
#  
# Legal entries are:
#
#       compat                  Use compatibility setup
#       nisplus                 Use NIS+ (NIS version 3)
#       nis                     Use NIS (NIS version 2), also called YP
#       dns                     Use DNS (Domain Name Service)
#       files                   Use the local files
#       [NOTFOUND=return]       Stop searching if not found so far  
#
# For more information, please read the nsswitch.conf.5 manual page.
#

passwd: compat sss
group:  compat sss

hosts:  files mdns_minimal [NOTFOUND=return] dns
networks:   files dns

services:   files
protocols:  files
rpc:    files
ethers: files
netmasks:   files
netgroup:   files
publickey:  files

bootparams: files
automount:  files
aliases:    files
passwd_compat:  files
group_compat:   files

This file has sss disabled and ldap enabled:

passwd: compat ldap
group:  compat ldap

hosts:  files mdns_minimal [NOTFOUND=return] dns
networks:   files dns

services:   files
protocols:  files
rpc:    files
ethers: files
netmasks:   files
netgroup:   files
publickey:  files

bootparams: files
automount:  files
aliases:    files
passwd_compat:  files
group_compat:   files

Best Answer

Related Solutions

Linux / AD integration with SSSD: how to choose what systems a user can log into

Linux – SSSD process won’t die

Related Topic