[SSSD-users] feasible to use sssd in mostly offline mode?
For our on-site Linux machines, we use the sssd-ad provider to both
map users/groups from Active Directory, and to authenticate users via
Kerberos. It works fantastically well, to the point where we have
absolutely no desire to go back to maintaining local users/groups in
/etc/passwd and /etc/group (respectively).
We are contemplating offering remote Linux laptops to our users. But
our InfoSec team is adamant that our AD DCs must not be reachable from
the Internet at large. So unless the owner of the laptop logs in to
the laptop locally and then connects to our VPN, the laptop will have
no access to Active Directory, and therefore sssd will be in offline
mode.
We are wondering whether it would be feasible to set the various sssd
caches to have long values (e.g. 180 days) so that as long as the user
fires up the laptop and connects to the VPN once every 180 days, they
will still be able to login (using their cached password) and
getpwnam/getpwuid/getgrnam/getgrgid will still work for their
uids/gids (because sssd will return the values it cached from the last
time it was able to reach the AD DCs).
It’s not clear to us how we would implement this. We could adjust
various timeouts; e.g., from:
entry_cache_timeout = 5400
cache_credentials = FALSE
To:
entry_cache_timeout = 7776000
cache_credentials = TRUE
…but I don’t think this is going to do what we want. We only want
sssd to keep entries in the cache for 90 days when it is offline. If
sssd comes back online (because the user connected to the VPN and thus
AD is reachable again), we want AD to refresh any cached entries that
are older than 90 minutes.
So, what we really want is an option for sssd that essentially says,
“You are frequently going to be operating in offline mode, so only
kick things out of the cache when you are in online mode, because
otherwise there’s a good chance that the user won’t be able to login
to fire up the VPN so that you can switch to online mode.”
Has anyone attempted running sssd in a mostly-offline environment like
this? If so, how well does it work, and what settings are you using?
Thanks!