4 ms·
With this sort of authentication scheme what happens when the network connection goes down or the LDAP server crashes? Can you no longer login? Or can you only
by montecarl 12y ago
With this sort of authentication scheme what happens when the network connection goes down or the LDAP server crashes? Can you no longer login? Or can you only login to local accounts? Ideally I would like to have centralized authentication management, but if the central server goes down to still have a local read-only copy of the authentication data. Is something like this possible? Or would it be easier to just sync passwd files?
- doxcf434 12y agoFor OS level auth, you'd want to use sssd, which will handle most failure conditions: https://fedorahosted.org/sssd/ https://fedorahosted.org/sssd/ https://wiki.ubuntu.com/Enterprise/Authentication/sssd https://wiki.ubuntu.com/Enterprise/Authentication/sssd
- seanhandley 12y agoIt's not such a big problem on a Linux host - it's more of a problem on network hardware.
- jasonrojas 12y agoldap & tacacs+ solves that issue
- seanhandley 12y agoWe actually create local accounts where possible via Puppet i.e. on Linux hosts. That way we can draw from the same set of credentials in Hiera and ensure presence/absence on all systems.
- seanhandley 12y agoIt's true that it's a single point of failure. Sadly it's a trade-off for being able to easily manage access to hundreds of devices. We're keen on finding ways of handling failure but it largely depends on the device itself and what (if anything) it supports as a secondary authentication source.
- eldridgea 12y agoI'm not sure if this is exactly what you're looking for, but I think this will do that: https://code.google.com/p/nsscache/ https://code.google.com/p/nsscache/