Power Up Your Authentication with Open LDAP and Puppet

datacentred.co.uk

14 points·seanhandley··9 comments

With this sort of authentication scheme what happens when the network connection goes down or the LDAP server crashes? Can you no longer login? Or can you only login to local accounts? Ideally I would like to have centralized authentication management, but if the central server goes down to still have a local read-only copy of the authentication data. Is something like this possible? Or would it be easier to just sync passwd files?

For OS level auth, you'd want to use sssd, which will handle most failure conditions:

https://fedorahosted.org/sssd/ https://wiki.ubuntu.com/Enterprise/Authentication/sssd

It's not such a big problem on a Linux host - it's more of a problem on network hardware.

ldap & tacacs+ solves that issue

We actually create local accounts where possible via Puppet i.e. on Linux hosts. That way we can draw from the same set of credentials in Hiera and ensure presence/absence on all systems.

It's true that it's a single point of failure. Sadly it's a trade-off for being able to easily manage access to hundreds of devices.

We're keen on finding ways of handling failure but it largely depends on the device itself and what (if anything) it supports as a secondary authentication source.

I'm not sure if this is exactly what you're looking for, but I think this will do that:

https://code.google.com/p/nsscache/

Cached version since the site is returning a 508

http://webcache.googleusercontent.com/search?q=cache:gyIeexA...

Thanks for this - our company blog's currently hosted by a third party.

Reply on news.ycombinator.com