freeipa / freeipa-healthcheck

Check the health of a freeIPA installation
GNU General Public License v3.0
50 stars 28 forks source link

Warn if nsslapd-idletimeout is set lower than the default or is 0 #316

Open rcritten opened 11 months ago

rcritten commented 11 months ago

nsslapd-idletimeout is used by 389 to determine when a client has gone idle. The default value is 3600. A value of 0 is unlimited.

We saw a case where a user set it to 10 which caused all sorts of issues because the client though it was still connected and reported failures as SERVER_DOWN and much later than the connection was created.

So we should WARN if the value is less than 3600 or if it is set to 0. The attribute lives in cn=config.