replica installation without CA
by Amit
Hello,
In installed IPA Server successfully with following command:
# ipa-server-install
--ca-cert-file /root/ca-hierarchy/rootCA.crt
--dirsrv-cert-file /root/ca-hierarchy/dirsrv.crt --dirsrv-cert-file
/root/ca-hierarchy/dirsrv.key --dirsrv-pin amit
--http-cert-file /root/ca-hierarchy/http.crt --http-cert-file
/root/ca-hierarchy/http.key --http-pin amit
--no-pkinit
Now when I tried installing replica using this process:
1. scp http.key, http.crt, dirsrv.key, dirsrv.crt to replica
2. Made replica as IPA client:
# vim /etc/hosts
<ipa-server-ip> <ipa-server-domain>
# ntpdate <ipa-ip-address>
# ipa-client-install --domain <ipa-server-domain-name> --server
<ipa-server-fdqn>
# kinit admin
# getent passwd admin; id admin; //Works
3. # ipa-replica-install --dirsrv-cert-file /root/dirsrv.crt
--dirsrv-cert-file /root/dirsrv.key --dirsrv-pin amit --http-cert-file
/root/http.crt --http-cert-file /root/http.key --http-pin amit --no-pkinit
WARNING: conflicting time&date synchronization service 'chronyd' will
be disabled in favor of ntpd
Your system may be partly configured.
Run /usr/sbin/ipa-server-install --uninstall to clean up.
ipa.ipapython.install.cli.install_tool(CompatServerReplicaInstall):
ERROR The full certificate chain is not present in /root/http.crt,
/root/http.key
ipa.ipapython.install.cli.install_tool(CompatServerReplicaInstall):
ERROR The ipa-replica-install command failed. See
/var/log/ipareplica-install.log for more information
[root@rhel7u4-7 site-packages]#
Attached ipareplica-install.log
Huge Thanks In Advance
Amit
6 years, 2 months
Re: authconfig replacement design
by Alexander Bokovoy
On Thu, 15 Feb 2018, Alexander Koksharov wrote:
>Hello,
>
>I would like to confirm whether we do want to completelly drop --no-sssd
>option.
>"no-sssd" configuration is not supported by authselect - there is not such
>profile available.
>If we drop dependency on authconfig there will be a need to do code cleanup
>and also to rewrite related parts. And if we agreed on rewriting some parts
>there wont be any problems replacing multiple calls to authconfig with a
>single one to outhselect.
I think we should make sure authselect does support non-sssd profile.
Otherwise it is not a real replacement for authconfig in Fedora.
>
>
>
>
>Alexander
>
>On Wed, Feb 14, 2018 at 10:00 AM, Alexander Bokovoy <abokovoy(a)redhat.com>
>wrote:
>
>> On ke, 14 helmi 2018, Alexander Koksharov via FreeIPA-devel wrote:
>>
>>> Hello,
>>>
>>> Please take a look on a design page here:
>>> https://www.freeipa.org/page/V4/Authselect_migration
>>> I would like to
>>> ??? ???
>>> hear you critics and suggessions.
>>>
>> Thanks!
>>
>> One note I have is about authconfig arguments. We gather them together
>> and launch only one authconfig command. There is, I believe, a
>> conceptual difference when you run authconfig with all options in a
>> single line and as separate executions so you'd get different
>> configurations.
>>
>> This may be subtle on a first view but we need to ensure that an
>> authselect replacement would continue to provide the same configuration
>> in the end.
>>
>>
>> I assume you are going to add actual authselect part later.
>> --
>> / Alexander Bokovoy
>>
--
/ Alexander Bokovoy
6 years, 2 months