sssd very specifically requires file mode = 0600