Linux SSSD Certification

Source: Internet
Author: User
Tags ldap

SSSD is a software that replaces LDAP and AD, and is simple to configure.

This article describes how to deploy SSSD in an LDAP client to enable LDAP authentication.


-Installation SSSD

Yum Install SSSD
Yum Remove Pam_ldap samba*

Install SSSD, and uninstall Pam_ldap and Samba-related packages

-Configuration /etc/sssd/sssd.conf

[SSSD] 
Config_file_version = 2
Services = NSS, pam
domains = LDAP
[NSS]
Filter_users = backup, bin, daemon, games, gnats, IRC, landscape, Libuui D, list, LP, Mail, Man, Messagebus, news, NTP, proxy, Root, Smmsp, Smmta, sshd, Sync, sys, syslog, UUCP, Whoopsie, Www-dat A, Dw_adm
[Pam]
[domain/ldap] 
Id_provider = LDAP
Auth_ Provider = LDAP
Cache_credentials = TRUE
Debug_level = 1
Ldap_uri = ldaps://ldap.vip
#ldap_uri = ldaps:// 10.8.8.8, ldaps://10.8.8.9
Ldap_search_base = dc=example,dc=com
#ldap_schema = Rfc2307bis
Ldap_default_ BIND_DN = uid=proxyagent,ou=special_users,dc=example,dc=com
Ldap_default_authtok_type = password
Ldap_ Default_authtok = gafn01n0w
Ldap_tls_reqcert = never
Ldap_id_use_start_tls = True
Ldap_netgroup_search_base = Ou=netgroup,ou=example.com,ou=services,dc=example,dc=com?one?
Ldap_user_search_base = ou=people,dc=example,dc=com?sub?organizationalstatus=active
Ldap_group_search_ Base = Ou=group,dc=example,dc=com?sub?
Cache_credentials = True
Enumerate = False
Entry_cache_timeout = 5400


Ldap_uri point to your LDAP server, where the domain name, or IP address, Domani can also configure multiple domains, generally only need to configure one on it.

-Configuration /etc/nsswitch.conf

Configure the sssd.conf after configuring the /etc/nsswitch.conf to tell name Service switch to find those places to service the logged-in user.

Passwd:files SSS
Shadow:files SSS
Group:files SSS
Netgroup:files SSS


Files SSS says to find/etc/passwd,/etc/group, and so on, and then find the SSS module without the words.

-Modify/etc/nscd.conf

As a final step, if the NSCD service is turned on, disable the passwd and group cache features.

Enable-cache passwd No
Enable-cache Group No
Enable-cache Netgroup No

-Finally open the SSSD service

/ETC/INIT.D/SSSD start


I'll talk about how to build an LDAP server in other articles, please follow my blog. Thank you!



This article from the "Linux and Network" blog, reproduced please contact the author!

Linux SSSD Certification

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.