blob: a480b549d8df428eda30d6ae588d9d5712319f88 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
|
[services]
description = Local Service Configuration
activeServices = nss, dp, pam
# Number of times services should attempt to reconnect in the
# event of a Data Provider crash or restart before they give up
reconnection_retries = 3
[services/nss]
description = NSS Responder Configuration
# the following prevents sssd for searching for the root user/group in
# all domains (you can add here a comma separated list of system accounts are
# always going to be /etc/passwd users, or that you want to filter out)
filterGroups = root
filterUsers = root
[services/dp]
description = Data Provider Configuration
[services/pam]
description = PAM Responder Configuration
[services/monitor]
description = Service Monitor Configuration
#if a backend is particularly slow you can raise this timeout here
sbusTimeout = 30
[domains]
description = Domains served by SSSD
; domains = LOCAL,LDAP
# SSSD will not start if you don't configure any domain.
# Add new domains condifgurations as [domains/<NAME>] sections.
# Then add the list of domains (in the order you want them to be
# queried in the 'domains" attribute above and uncomment it
# Example LOCAL domain that proxies to /etc/passwd and /etc/group files
# This configuration is meant mostly as a migration path to be able to store
# additional information about users while still keeping /etc/passwd
# authoritative.
; [domains/LOCAL]
; description = LOCAL migration domain
; enumerate = 3
; minId = 500
; magicPrivateGroups = FALSE
; legacy = TRUE
;
; provider = proxy
; libName = files
; libPath = libnss_files.so.2
# optionally a file named sssdproxylocal can be place in pam.d configured to
# check pam_unix only and pam_sss can be used in the normal pam stack
; auth-module = proxy
; pam-target = sssdproxylocal
# Example LOCAL domain that stores all users natively in the SSSD internal
# directory. These local users and groups are not visibile in /etc/passwd, it
# now contains only root and system accounts.
; [domains/LOCAL]
; description = LOCAL Users domain
; enumerate = 3
; minId = 500
; maxId = 999
; legacy = FALSE
; magicPrivateGroups = TRUE
# Example LDAP domain that uses the proxy backend and the standard nss_ldap
# and pam_ldap modules (Useful until we have good working native ldap backends).
# For this to work the /etc/ldap.conf file needs to be correctly configured just
# like you would do when using nss_ldap in nsswitch.conf, but instead of setting
# passwd: files ldap, set passwd: files, sss instead there.
# Also consider using the following setting in /etc/ldap.conf to avoid needless
# delays if the ldap server is offline:
# timelimit 10
# bind_timelimit 5
# nss_reconnect_maxsleeptime 2
# nss_reconnect_sleeptime 1
; [domains/LDAP]
; description = Proxy request to our LDAP server
; enumerate = 0
; minId = 1000
; legacy = TRUE
;
; provider = proxy
; libName = ldap
; libPath = libnss_ldap.so.2
;
#if a backend is particularly slow you can raise this timeout here
; timeout = 60
|
