<html><head></head><body style="background-color: rgb(255, 255, 255); line-height: initial;"> <div style="width: 100%; font-size: initial; font-family: Calibri, 'Slate Pro', sans-serif; color: rgb(31, 73, 125); text-align: initial; background-color: rgb(255, 255, 255);">LDAP is easier to DOS that kerberos.</div><div style="width: 100%; font-size: initial; font-family: Calibri, 'Slate Pro', sans-serif; color: rgb(31, 73, 125); text-align: initial; background-color: rgb(255, 255, 255);">I've seen instances with OpenLDAP where bad code in a web app caused clusters of LDAP servers to run out of connections but the kerberos servers stayed up so none of the users noticed because of SSSD and or nscd had the data from the LDAP servers cached‎. In those instances keeping the kerberos servers separate saved the day, because if they had shared their database it would have locked out all of the users.</div> <div style="width: 100%; font-size: initial; font-family: Calibri, 'Slate Pro', sans-serif; color: rgb(31, 73, 125); text-align: initial; background-color: rgb(255, 255, 255);"><br></div><div style="width: 100%; font-size: initial; font-family: Calibri, 'Slate Pro', sans-serif; color: rgb(31, 73, 125); text-align: initial; background-color: rgb(255, 255, 255);"><br></div> <div style="font-size: initial; font-family: Calibri, 'Slate Pro', sans-serif; color: rgb(31, 73, 125); text-align: initial; background-color: rgb(255, 255, 255);"></div> <table width="100%" style="background-color:white;border-spacing:0px;"> <tbody><tr><td colspan="2" style="font-size: initial; text-align: initial; background-color: rgb(255, 255, 255);"> <div style="border-style: solid none none; border-top-color: rgb(181, 196, 223); border-top-width: 1pt; padding: 3pt 0in 0in; font-family: Tahoma, 'BB Alpha Sans', 'Slate Pro'; font-size: 10pt;"> <div><b>From: </b>Joshua Brodie</div><div><b>Sent: </b>Friday, September 25, 2015 15:36</div><div><b>To: </b>General discussion list for the 389 Directory server project.</div><div><b>Reply To: </b>General discussion list for the 389 Directory server project.</div><div><b>Subject: </b>[389-users] Kerberos KDC</div></div></td></tr></tbody></table><div style="border-style: solid none none; border-top-color: rgb(186, 188, 209); border-top-width: 1pt; font-size: initial; text-align: initial; background-color: rgb(255, 255, 255);"></div><br><div id="_originalContent" style=""><div dir="ltr"><div><div>Hi All:<br><br></div>On a large 389 implementation - where downtime is not an option - are there pros/cons to having the KDC on same server as 389 (sharing the database) - or having the KDC on separate, redundant, servers?<br><br></div>Thanks.<br></div>
<br><!--end of _originalContent --></div></body></html>