secure/auth log Audit + shell history of all users to a central secured log

If you want to log everything everybody does and store it away securely do the following:

a) Install snoopy https://github.com/sensepost/Snoopy
b) setup a rsyslog server who writes a dedicated secure/auth log
c) configure rsyslog on each host to send secure/auth log info to the central rsyslog server

This will log even command history and you are also able to tell root users apart by session id.

sssd ldap error "cannot parse authtok"

If you ever come across this "cannot parse authtok" error in sssd, you most likely have a typo in your config:
ldap_default_authok --> ldap_default_authtok