yum install sssd[sssd]
config_file_version = 2
domains = comp.local
services = nss
[nss]
filter_users = root
shell_fallback = /sbin/nologin
fallback_homedir = /usr/share/smbusers/%u (любой, должен существовать!)
default_shell = /bin/sh
[domain/comp.local]
id_provider = ldap
auth_provider = ad
access_provider = ldap
selinux_provider = none
ldap_referrals = false
ldap_uri = ldap://dc1.comp.local/
ldap_backup_uri = ldap://dc3.comp.local/
ad_server = dc1.comp.local
ad_backup_server = dc3.comp.local
ldap_sasl_mech = GSSAPI
ldap_id_mapping = true
ldap_schema = ad
ldap_idmap_default_domain_sid = [SID]
lookup_family_order = ipv4_only
case_sensitive = false
ldap_user_search_base = dc=comp,dc=local
ldap_group_search_base = dc=comp,dc=local
ldap_access_order = expire
ldap_account_expire_policy = ad
ldap_force_upper_case_realm = true
krb5_realm = COMP.LOCAL
krb5_canonicalize = false
ldap_user_object_class = user
ldap_user_name = sAMAccountName
ldap_user_gecos = displayName
ldap_user_principal = userPrincipalName
ldap_user_modify_timestamp = whenChanged
ldap_user_shadow_last_change = pwdLastSet
ldap_user_shadow_expire = accountExpires
ldap_group_object_class = group
ldap_group_name = cnobjectSid: S-1-5-21-BBBBBBBBB-AAAAAAAAAA-XXXXXXXX-YYYYYpasswd: files sss
group: files sss
shadow: files sss
hosts: files dns
bootparams: files
ethers: files
netmasks: files
networks: files
protocols: files
rpc: files
services: files sss
automount: files sss
aliases: files
netgroup: files ssskEECDH+AES:kEDH+AESGCM:kRSA+AES:kRSA+3DES+SHA:!aNULL:!DSS:!SSLv2# openssl ciphers -V 'kEECDH+AES:kEDH+AESGCM:kRSA+AES:kRSA+3DES+SHA:!aNULL:!DSS:!SSLv2'
0xC0,0x30 - ECDHE-RSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH Au=RSA Enc=AESGCM(256) Mac=AEAD
0xC0,0x2C - ECDHE-ECDSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH Au=ECDSA Enc=AESGCM(256) Mac=AEAD
0xC0,0x28 - ECDHE-RSA-AES256-SHA384 TLSv1.2 Kx=ECDH Au=RSA Enc=AES(256) Mac=SHA384
0xC0,0x24 - ECDHE-ECDSA-AES256-SHA384 TLSv1.2 Kx=ECDH Au=ECDSA Enc=AES(256) Mac=SHA384
0xC0,0x14 - ECDHE-RSA-AES256-SHA SSLv3 Kx=ECDH Au=RSA Enc=AES(256) Mac=SHA1
0xC0,0x0A - ECDHE-ECDSA-AES256-SHA SSLv3 Kx=ECDH Au=ECDSA Enc=AES(256) Mac=SHA1
0xC0,0x2F - ECDHE-RSA-AES128-GCM-SHA256 TLSv1.2 Kx=ECDH Au=RSA Enc=AESGCM(128) Mac=AEAD
0xC0,0x2B - ECDHE-ECDSA-AES128-GCM-SHA256 TLSv1.2 Kx=ECDH Au=ECDSA Enc=AESGCM(128) Mac=AEAD
0xC0,0x27 - ECDHE-RSA-AES128-SHA256 TLSv1.2 Kx=ECDH Au=RSA Enc=AES(128) Mac=SHA256
0xC0,0x23 - ECDHE-ECDSA-AES128-SHA256 TLSv1.2 Kx=ECDH Au=ECDSA Enc=AES(128) Mac=SHA256
0xC0,0x13 - ECDHE-RSA-AES128-SHA SSLv3 Kx=ECDH Au=RSA Enc=AES(128) Mac=SHA1
0xC0,0x09 - ECDHE-ECDSA-AES128-SHA SSLv3 Kx=ECDH Au=ECDSA Enc=AES(128) Mac=SHA1
0x00,0x9F - DHE-RSA-AES256-GCM-SHA384 TLSv1.2 Kx=DH Au=RSA Enc=AESGCM(256) Mac=AEAD
0x00,0x9E - DHE-RSA-AES128-GCM-SHA256 TLSv1.2 Kx=DH Au=RSA Enc=AESGCM(128) Mac=AEAD
0x00,0x9D - AES256-GCM-SHA384 TLSv1.2 Kx=RSA Au=RSA Enc=AESGCM(256) Mac=AEAD
0x00,0x3D - AES256-SHA256 TLSv1.2 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA256
0x00,0x35 - AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1
0x00,0x9C - AES128-GCM-SHA256 TLSv1.2 Kx=RSA Au=RSA Enc=AESGCM(128) Mac=AEAD
0x00,0x3C - AES128-SHA256 TLSv1.2 Kx=RSA Au=RSA Enc=AES(128) Mac=SHA256
0x00,0x2F - AES128-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(128) Mac=SHA1
0x00,0x0A - DES-CBC3-SHA SSLv3 Kx=RSA Au=RSA Enc=3DES(168) Mac=SHA1