Linux SSSD Certification

SSSD is a software that replaces LDAP and AD, and is simple to configure.

This article describes how to deploy SSSD in an LDAP client to enable LDAP authentication.

-Installation SSSD

Yum Install SSSD
Yum Remove Pam_ldap samba*

Install SSSD, and uninstall Pam_ldap and Samba-related packages

-Configuration /etc/sssd/sssd.conf

[SSSD] 
 Config_file_version = 2 
 Services = NSS, pam 
 domains = LDAP 
 [NSS] 
 Filter_users = backup, bin, daemon, games, gnats, IRC, landscape, Libuui D, list, LP, Mail, Man, Messagebus, news, NTP, proxy, Root, Smmsp, Smmta, sshd, Sync, sys, syslog, UUCP, Whoopsie, Www-dat A, Dw_adm 
 [Pam]  

[domain/ldap] 
 Id_provider = LDAP 
 Auth_ Provider = LDAP 
 Cache_credentials = TRUE 
 Debug_level = 1 
 Ldap_uri = ldaps://ldap.vip 
 #ldap_uri = ldaps:// 10.8.8.8, ldaps://10.8.8.9 
 Ldap_search_base = dc=example,dc=com 
 #ldap_schema = Rfc2307bis 
 Ldap_default_ BIND_DN = uid=proxyagent,ou=special_users,dc=example,dc=com 
 Ldap_default_authtok_type = password 
 Ldap_ Default_authtok = gafn01n0w 
 Ldap_tls_reqcert = never 
 Ldap_id_use_start_tls = True 
 Ldap_netgroup_search_base = Ou=netgroup,ou=example.com,ou=services,dc=example,dc=com?one? 
 Ldap_user_search_base = ou=people,dc=example,dc=com?sub?organizationalstatus=active 
 Ldap_group_search_ Base = Ou=group,dc=example,dc=com?sub? 
 Cache_credentials = True 
 Enumerate = False 
 Entry_cache_timeout = 5400  

Ldap_uri point to your LDAP server, where the domain name, or IP address, Domani can also configure multiple domains, generally only need to configure one on it.

-Configuration /etc/nsswitch.conf

Configure the sssd.conf after configuring the /etc/nsswitch.conf to tell name Service switch to find those places to service the logged-in user.

Passwd:files SSS
Shadow:files SSS
Group:files SSS
Netgroup:files SSS

Files SSS says to find/etc/passwd,/etc/group, and so on, and then find the SSS module without the words.

-Modify/etc/nscd.conf

As a final step, if the NSCD service is turned on, disable the passwd and group cache features.

Enable-cache passwd No
Enable-cache Group No
Enable-cache Netgroup No

-Finally open the SSSD service

/ETC/INIT.D/SSSD start

I'll talk about how to build an LDAP server in other articles, please follow my blog. Thank you!

This article from the "Linux and Network" blog, reproduced please contact the author!

Linux SSSD Certification