githubmirror/authselect

profiles/sssd/README
115 строк4 KB
Pavel Březina
sssd: remove with-sudo duplicate from readme
12 ноя 2018, 15:09
12 ноя 2018, 15:091113d3c
Enable SSSD for system authentication (also for local users only)
=================================================================

Selecting this profile will enable SSSD as the source of identity
and authentication providers.

SSSD provides a set of daemons to manage access to remote directories
and authentication mechanisms such as LDAP, Kerberos or FreeIPA. It provides
an NSS and PAM interface toward the system and a pluggable backend system
to connect to multiple different account sources.

More information about SSSD can be found on its project page:
https://pagure.io/SSSD/sssd

By default, local users are served from SSSD rather then local files if SSSD
is enabled (however they authenticate via pam_unix). This have a performance
benefit since SSSD caches the files content in fast in-memory cache and thus
reduces number of disk operations.

However, if you do not want to keep SSSD running on your machine, you can
keep this profile selected and just disable SSSD service. The resulting
configuration will still work correctly even with SSSD disabled and local users
and groups will be read from local files directly.

SSSD CONFIGURATION
------------------

Authselect does not touch SSSD's configuration. Please, read SSSD's
documentation to see how to configure it manually. Only local users
will be available on the system if there is no existing SSSD configuration.

AVAILABLE OPTIONAL FEATURES
---------------------------

with-faillock::
    Enable account locking in case of too many consecutive
    authentication failures.
    
with-mkhomedir::
    Enable automatic creation of home directories for users on their
    first login.

with-ecryptfs::
    Enable automatic per-user ecryptfs.

with-smartcard::
    Enable authentication with smartcards through SSSD. Please note that
    smartcard support must be also explicitly enabled within
    SSSD's configuration.

with-smartcard-lock-on-removal::
    Lock screen when a smartcard is removed.
    Note: "with-smartcard" must be set as well.

with-smartcard-required::
    Smartcard authentication is required. No other means of authentication
    (including password) will be enabled.
    Note: "with-smartcard" must be set as well.

with-fingerprint::
    Enable authentication with fingerprint reader through *pam_fprintd*.

with-silent-lastlog::
    Do not produce pam_lastlog message during login.

with-sudo::
    Allow sudo to use SSSD as a source for sudo rules in addition of /etc/sudoers.

with-pamaccess::
    Check access.conf during account authorization.

without-nullok::
    Do not add nullok parameter to pam_unix.

DISABLE SPECIFIC NSSWITCH DATABASES
-----------------------------------

Normally, nsswitch databases set by the profile overwrites values set in
user-nsswitch.conf. The following options can force authselect to
ignore value set by the profile and use the one set in user-nsswitch.conf
instead.

with-custom-passwd::
Ignore "passwd" database set by the profile.

with-custom-group::
Ignore "group" database set by the profile.

with-custom-netgroup::
Ignore "netgroup" database set by the profile.

with-custom-automount::
Ignore "automount" database set by the profile.

with-custom-services::
Ignore "services" database set by the profile.

with-custom-sudoers::
Ignore "sudoers" database set by the profile.

EXAMPLES
--------

* Enable SSSD with sudo and smartcard support

  authselect select sssd with-sudo with-smartcard

* Enable SSSD with sudo support and create home directories for users on their 
  first login

  authselect select sssd with-mkhomedir with-sudo

SEE ALSO
--------
* man sssd.conf(8)