3 ms·
I haven't read this article closely yet, but based on other similar protocols, I _think_ the key element is, can you still log in to your servers when all your
by skywhopper 10y ago
I haven't read this article closely yet, but based on other similar protocols, I _think_ the key element is, can you still log in to your servers when all your LDAP is catastrophically down for some reason. Sure, it's unlikely, but for someone like Facebook that's an unacceptable risk. This also means you don't have to actually _worry_ about maintaining an HA LDAP infrastructure that can support all the SSH auth you need.
- hug 10y agoThat exact scenario is covered by the concept of "cached credentials" in the case of SSSD. If your authentication services or down (or the box you're attempting to log into is offline) there's a period in which you can log in using the last used password for your account. Granted you only have the configurable cache time out in which to solve your problem, but that's usually on the matter of days. If your authentication infrastructure is down for longer than that you have bigger fish to fry.
- subway 10y agoCached credentials only save the day if the cache has been populated. Engineers should be logging in infrequently enough that cache is rarely populated.
- deathanatos 10y agoIs it not possible to force the cache to have a particular set of users (say, critical devops folks) always populated?