0

SSSD configured for optimal security Kerberos only no need for LDAPS?

I want to ensure I have configured our SSSD for optimal security. Any insight would be appreciated.

Should I add any values?
Should I modify any values?
Should I delete anything to simplify?

If I understand correctly if I have kerberos properly configured I do not need to worry about LDAPS?

I opened a ticket with redhat but I am not getting anywhere fast with them.

Thanks in advance!

############################
/etc/krb5.conf = 

[libdefaults]
default_realm = DOMAINXYZ
dns_lookup_realm = true
dns_lookup_kdc = true
ticket_lifetime = 10h
renew_lifetime = 7d
forwardable = yes
default_tkt_enctypes = aes256-cts
default_tgs_enctypes = aes256-cts
udp_preference_limit = 0

[realms]
DOMAINXYZ = {
default_domain = domainxyz
}

[domain_realm]
.domainxyz = DOMAINXYZ
domainxyz = DOMAINXYZ

############################
/etc/sssd/sssd.conf = 

[sssd]
config_file_version = 2
reconnection_retries = 3
sbus_timeout = 30
services = nss, pam, ssh, autofs
domains = DOMAINXYZ
debug_level = 10

[nss]
filter_groups = root
filter_users = root
reconnection_retries = 3
entry_cache_nowait_percentage = 75
debug_level = 10

[pam]
reconnection_retries = 3
offline_credentials_expiration = 3
offline_failed_login_attempts = 3
offline_failed_login_delay = 5
debug_level = 10

[domain/DOMAINXYZ]
cache_credentials = true
account_cache_expiration = 7
entry_cache_timeout = 400
ad_maximum_machine_account_password_age = 14

description = LDAP domain with AD server
enumerate = false
default_shell = /bin/bash
fallback_homedir = /home/%d/%u
ldap_idmap_range_min = 200000
ldap_idmap_range_max = 2000200000
ldap_idmap_range_size = 100000000

id_provider = ad
auth_provider = ad
access_provider = ad
chpass_provider = ad
ad_domain = domainxyz

ignore_group_members = true
use_fully_qualified_names = False
debug_level = 10

#Access
access_provider = simple
simple_allow_groups = 
simple_allow_users =

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.