anyone trial freeipa load balancing will it make the mess?
by barrykfl@gmail.com
Hi all:
Any one try ha proxy/nginx/ etc LB . I tried use ldirector before.
it seem when A<>B syn ....if u still load balancing it with different
weight.
May cause not update of one side server ...so finally I only apply HA.
Any one have better LB solution have reference ?
(or it ;s not necessary LB actually)
Regards
Barry
6 years, 5 months
FreeIPA and 802.1x with wireless
by Andrew Meyer
Is anyone doing authentication with wireless using FreeIPA? IF so are you using RADIUS? What wireless equipment are you using? Has anyone auth'ed straight to LDAP? I am trying to set this up with Aruba Networks using MacBook Pro running MacOS X 10.11, 10.12, and 10.13 and having minimal success especially with the newer versions.
I am willing to setup RADIUS but trying to avoid it.
6 years, 5 months
freeipa trust issues
by Zach Bayne
I have active directory as dc1.ad.domainname and dc2.ad.domainname
I also have freeipa at ipa1.ipa.domainname and ipa2.ipa.domainname
both of them seem to work fine independently, I then created a trust and
set smb min and max to 2. from the server 2k12 side the trust validates
and from the ipa side i can kinit user(a)ad.domainname but thats where the
working ends. I can not login to webinterface as ad it says my session has
expired and to relogin. wbinfo status shows ad as offline
[root@ipa1 ~]# wbinfo -n 'AD\Domain Admins'
failed to call wbcLookupName: WBC_ERR_DOMAIN_NOT_FOUND
Could not lookup name AD\Domain Admins
[root@ipa1 ~]# ipa --version
VERSION: 4.5.0, API_VERSION: 2.228
[root@ipa1 ~]# sssd --version
1.15.2
attached below is the log.wd.ad
I am happy to provide any more information and thank anyone who can help me
solve this, have been beaten up for a bit on it.
https://gist.github.com/anonymous/36d1a48cf1a1116b116f9ce911d91d8a
6 years, 5 months
FOSDEM
by Thomas Woerner
Hello Alexander,
is the dev room for IPA on FOSDEM still open to submit new proposals?
Regards,
Thomas
6 years, 5 months
SSSD Virtual Test Suite
by Pavel Březina
Hello,
The primary intent of this is to develop and test SSSD, but I think it
can be also used by freeIPA developers and users.
This [1] is my set of scripts that use vagrant and Ansible to
automatically provision virtual environment that I use to develop and
test SSSD.
To create this environment you only need to run one command:
$ ./setup.sh
and after a while you have several machines provisioned and ready. This
machines include LDAP, IPA and AD servers with one machine dedicated to
SSSD. This machine is already enrolled to those servers.
To start building and/or testing SSSD with all available providers, you
can just run:
$ vagrant ssh client
Additionally, it allows you to automatically source your set of scripts
on each login and access IPA web-ui from your browser.
I tried to make the provisioning as fast as possible but it still takes
approximately one hour on my machine. So be patient.
Any ideas and patches for improvements are welcomed.
The source is available at:
[1] https://github.com/pbrezina/sssd-test-suite
6 years, 5 months
ldap cache
by Andrew Meyer
Let's say I have a user that starts today and I forgot to add their username to FreeIPA. I add their username and they need to start working fairly quickly. I know that I can clear the sudo cache on each server with sss_cache -E but is there a way to do this w/ ldap/kerberos queries to have it reread the ldap database?
6 years, 5 months
sudoers issues
by Andrew Meyer
Hello, I am trying to setup a few of my users to have the ability to su - jira or another user using FreeIPA.
Here is what happens when I am logged in as the user and try to su - jira
[user1@jira02 ~]$ sudo su - process[sudo] password for user1:Sorry, user user1 is not allowed to execute '/bin/su - jira' as root on jira02.example.net.[user1@jira02 ~]$
[andrew.meyer@jira02 ~]$ ipa sudorule-show su_jira Rule name: su_jira Enabled: TRUE Host category: all RunAs User category: all RunAs Group category: all User Groups: developers, ops_sudoers Sudo Allow Command Groups: jira_access Sudo Option: !authenticate[andrew.meyer@jira02 ~]$
[andrew.meyer@jira02 ~]$ ipa sudocmd-find su_jira_cmds----------------------1 Sudo Command matched---------------------- Sudo Command: /usr/bin/su - jira,/usr/bin/sudo su - jira,/bin/su - jira,/bin/sudo - jira Description: su_jira_cmds----------------------------Number of entries returned 1----------------------------
What am I doing wrong?
6 years, 5 months
sudo not working with hostgroups
by Michael Gusek
Hello,
we are using FreeIPA in the current version 4.5 under current CentOS 7.
In order to grant access we are using sudo rules in conjunction with
host groups. We have found that these rules do not work under Debian 8/9
and Ubuntu 16.04, but with Centos 6/7. Suggestions from the web require
a set nisdomainname (nisdomainname example.com), which does not work. In
fact, the nisdomainname is not set under CentOS 6, but under Centos 7 it
is. What settings under Debian/Ubuntu must be made for sudo rules to
work with hostgroups?
Debian 8 Debian 9 Ubuntu 16.04 Centos 6 Centos 7
sssd-Version 1.15.0-3 1.15.0-3 1.15.0-3ubuntu2~ubuntu16.04.1~ppa1
sssd-1.15.3-1.el6.x86_64 sssd-1.15.2-50.el7_4.2.x86_64
sudo-Version 1.8.10p3-1+deb8u4 1.8.19p1-2.1 1.8.16-0ubuntu1.5
sudo-1.8.6p3-29.el6_9.x86_64 sudo-1.8.19p2-11.el7_4.x86_64
Regards,
Michael
--
________________________________________________
*Michael**Gusek*| System Administrator| Webtrekk GmbH |
*t*+49 30 755 415 302| *f *+49 30 755 415 100 | *w *www.webtrekk.com
<https://www.webtrekk.com/?wt_mc=signature.-.-.-.homepageURL>
Amtsgericht/Local Court Berlin, HRB 93435 B | Geschäftsführer/CEO
Christian Sauer und Wolf Lichtenstein
6 years, 5 months
Cannot start freeipa service after upgrade to Fedora 26
by Fuji San
I upgraded my freeipa server to F26 and I noticed it wasn't working anymore.
So I ran 'ipa-server-upgrade' and got the following :
Upgrading IPA:
[1/8]: saving configuration
[2/8]: disabling listeners
[3/8]: enabling DS global lock
[4/8]: starting directory server
[5/8]: updating schema
[6/8]: upgrading server
[7/8]: stopping directory server
[8/8]: restoring configuration
Done.
Update complete
Upgrading IPA services
Upgrading the configuration of the IPA services
[Verifying that root certificate is published]
[Migrate CRL publish directory]
CRL tree already moved
/etc/dirsrv/slapd-OPERA/certmap.conf is now managed by IPA. It will be overwritten. A backup of the original will be made.
[Verifying that CA proxy configuration is correct]
[Verifying that KDC configuration is using ipa-kdb backend]
[Fix DS schema file syntax]
Syntax already fixed
[Removing RA cert from DS NSS database]
RA cert already removed
[Enable sidgen and extdom plugins by default]
[Updating HTTPD service IPA configuration]
[Updating mod_nss protocol versions]
Protocol versions already updated
[Updating mod_nss cipher suite]
[Fixing trust flags in /etc/httpd/alias]
Trust flags already processed
[Exporting KRA agent PEM file]
KRA is not enabled
IPA server upgrade failed: Inspect /var/log/ipaupgrade.log and run command ipa-server-upgrade manually.
Unexpected error - see /var/log/ipaupgrade.log for details:
CalledProcessError: Command '/bin/systemctl start httpd.service' returned non-zero exit status 1
The ipa-server-upgrade command failed. See /var/log/ipaupgrade.log for more information
What can i do ?
Thanks.
F.
6 years, 5 months