<html dir="ltr">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style id="owaParaStyle" type="text/css">P {margin-top:0;margin-bottom:0;}</style>
</head>
<body ocsi="0" fpstyle="1">
<div style="direction: ltr;font-family: Tahoma;color: #000000;font-size: 10pt;">Hi,<br>
<br>
1) HBAC update, Ive never seen a delay.....so seems to be a few seconds.....so Im not sure why you ned to restart sssd.<br>
<br>
2) I also I think have asked on that.....not sure what you are aiming to achieve/mean....with having no kdc / ldap stores. I'd like a read only slave capability for out in the dmz...and possibly only export certain groups from the read/write out to the slave....but
maybe Im being overly paranoid....but I think AD2008r2? can do that.<br>
<div><br>
<div style="font-family: Tahoma; font-size: 13px;">
<p>regards</p>
<p>Steven Jones</p>
<p>Technical Specialist - Linux RHCE</p>
<p>Victoria University, Wellington, NZ</p>
<p>0064 4 463 6272<br>
</p>
</div>
</div>
<div style="font-family: Times New Roman; color: rgb(0, 0, 0); font-size: 16px;">
<hr tabindex="-1">
<div style="direction: ltr;" id="divRpF867393"><font color="#000000" face="Tahoma" size="2"><b>From:</b> freeipa-users-bounces@redhat.com [freeipa-users-bounces@redhat.com] on behalf of Cam McK [tomoyo@cam34.endjunk.com]<br>
<b>Sent:</b> Friday, 8 June 2012 1:22 p.m.<br>
<b>To:</b> freeipa-users@redhat.com<br>
<b>Subject:</b> [Freeipa-users] HBAC rule refreshes and read-only slaves<br>
</font><br>
</div>
<div></div>
<div>Hello<br>
<br>
Thanks for an awesome product! I have two questions that I can't seem to find answers for...<br>
<br>
1). How long is the delay between changing a HBAC rule and it coming into affect on the host machine?<br>
Currently this information only seems to be updated on the host after an 'service sssd reload/restart' also are the HBAC access rules are stored within LDAP Directory?<br>
<br>
2). We would also like to use FreeIPA in a trusted network but then have perhaps a read-only slave sitting in DMZ with the possibility of not containing the KDC or LDAP password stores on it, is this possible?<br>
(Basically authentication being done by a different PAM module, but pam_sss.so still allowing HBAC via the PAM 'account' directive.)<br>
Is it possible to have a 'regular' LDAP directory (in the DMZ) just slurping down the required LDAP info?<br>
<br>
Many Thanks<br>
Campbell<br>
<br>
</div>
</div>
</div>
</body>
</html>