Lion Cipher Lab
Centralize Linux logins on a directory with SSSD
- Identity & Access Management
- Intermediate
- ~60 min
- Free · no account required
Why it matters
The moment an organisation has more than a couple of Linux servers, local accounts become a quiet catastrophe. Every host keeps its own /etc/passwd and /etc/shadow, so a new joiner has to be created on twenty machines, a leaver has to be deleted on twenty machines (and the one you forget is the breach in the incident report), and 'who can log into what' has no single answer. Central identity fixes this: users and groups live once, in a directory, and every host asks the directory. SSSD — the System Security Services Daemon — is the standard Linux client that makes that happen, sitting between…
What you'll learn
- joining a Linux host to an LDAP directory
- configuring SSSD (sssd.conf, id_provider, access_provider)
- understanding NSS vs PAM (name resolution vs access control)
- central identity for fleets of Linux hosts
- group-based login access control with simple_allow_groups
- offline credential caching and its trade-offs
Steps in this lab
- The problem: every Linux host is its own island
- Stand up a directory to point at (OpenLDAP in Docker)
- Install and configure SSSD on the host (mind the 0600 gotcha)
- Prove central identity resolves (the 'before' for access control)
- Enforce access control — same directory, only the right group logs in
- Judgment: caching, simple vs filters, TLS, and the honest caveat