November 2017 - FreeIPA-users - Fedora mailing-lists

anyone trial freeipa load balancing will it make the mess?
by barrykfl＠gmail.com 13 Nov '17

13 Nov '17

Hi all: Any one try ha proxy/nginx/ etc LB . I tried use ldirector before. it seem when A<>B syn ....if u still load balancing it with different weight. May cause not update of one side server ...so finally I only apply HA. Any one have better LB solution have reference ? (or it ;s not necessary LB actually) Regards Barry

1 0

FreeIPA and 802.1x with wireless
by Andrew Meyer 13 Nov '17

13 Nov '17

Is anyone doing authentication with wireless using FreeIPA? IF so are you using RADIUS? What wireless equipment are you using? Has anyone auth'ed straight to LDAP? I am trying to set this up with Aruba Networks using MacBook Pro running MacOS X 10.11, 10.12, and 10.13 and having minimal success especially with the newer versions. I am willing to setup RADIUS but trying to avoid it.

2 2

freeipa trust issues
by Zach Bayne 13 Nov '17

13 Nov '17

I have active directory as dc1.ad.domainname and dc2.ad.domainname I also have freeipa at ipa1.ipa.domainname and ipa2.ipa.domainname both of them seem to work fine independently, I then created a trust and set smb min and max to 2. from the server 2k12 side the trust validates and from the ipa side i can kinit user(a)ad.domainname but thats where the working ends. I can not login to webinterface as ad it says my session has expired and to relogin. wbinfo status shows ad as offline [root@ipa1 ~]# wbinfo -n 'AD\Domain Admins' failed to call wbcLookupName: WBC_ERR_DOMAIN_NOT_FOUND Could not lookup name AD\Domain Admins [root@ipa1 ~]# ipa --version VERSION: 4.5.0, API_VERSION: 2.228 [root@ipa1 ~]# sssd --version 1.15.2 attached below is the log.wd.ad I am happy to provide any more information and thank anyone who can help me solve this, have been beaten up for a bit on it. https://gist.github.com/anonymous/36d1a48cf1a1116b116f9ce911d91d8a

1 0

FOSDEM
by Thomas Woerner 13 Nov '17

13 Nov '17

Hello Alexander, is the dev room for IPA on FOSDEM still open to submit new proposals? Regards, Thomas

2 1

SSSD Virtual Test Suite
by Pavel Březina 13 Nov '17

13 Nov '17

Hello, The primary intent of this is to develop and test SSSD, but I think it can be also used by freeIPA developers and users. This [1] is my set of scripts that use vagrant and Ansible to automatically provision virtual environment that I use to develop and test SSSD. To create this environment you only need to run one command: $ ./setup.sh and after a while you have several machines provisioned and ready. This machines include LDAP, IPA and AD servers with one machine dedicated to SSSD. This machine is already enrolled to those servers. To start building and/or testing SSSD with all available providers, you can just run: $ vagrant ssh client Additionally, it allows you to automatically source your set of scripts on each login and access IPA web-ui from your browser. I tried to make the provisioning as fast as possible but it still takes approximately one hour on my machine. So be patient. Any ideas and patches for improvements are welcomed. The source is available at: [1] https://github.com/pbrezina/sssd-test-suite

1 0

Upgrade from CentOS 7.3 to 7.4 - Safe?
by Christophe TREFOIS 11 Nov '17

11 Nov '17

Hi, Is it considered safe to go from CentOS 7.3 FreeIPA 4.4 to CentOS 7.4 with FreeIPA 4.5? Anything that we should know? Any issues? Things to consider? Should we run yum update on all pending packages replica by replica? Thanks for any feedback or stories you might have encountered. Christophe Dr Christophe Trefois, Dipl.-Ing. Technical Specialist / Post-Doc UNIVERSITÉ DU LUXEMBOURG LUXEMBOURG CENTRE FOR SYSTEMS BIOMEDICINE Campus Belval | House of Biomedicine 6, avenue du Swing L-4367 Belvaux T: +352 46 66 44 6124 F: +352 46 66 44 6949 http://www.uni.lu/lcsb <https://www.facebook.com/trefex><https://twitter.com/Trefex><https://plus.google.com/+ChristopheTrefois/><https://www.linkedin.com/in/trefoischristophe><http://skype:Trefex?call> ---- This message is confidential and may contain privileged information. It is intended for the named recipient only. If you receive it in error please notify me and permanently delete the original message and any copies. ----

4 5

ldap cache
by Andrew Meyer 10 Nov '17

10 Nov '17

Let's say I have a user that starts today and I forgot to add their username to FreeIPA. I add their username and they need to start working fairly quickly. I know that I can clear the sudo cache on each server with sss_cache -E but is there a way to do this w/ ldap/kerberos queries to have it reread the ldap database?

3 3

sudoers issues
by Andrew Meyer 10 Nov '17

10 Nov '17

Hello, I am trying to setup a few of my users to have the ability to su - jira or another user using FreeIPA. Here is what happens when I am logged in as the user and try to su - jira [user1@jira02 ~]$ sudo su - process[sudo] password for user1:Sorry, user user1 is not allowed to execute '/bin/su - jira' as root on jira02.example.net.[user1@jira02 ~]$ [andrew.meyer@jira02 ~]$ ipa sudorule-show su_jira Rule name: su_jira Enabled: TRUE Host category: all RunAs User category: all RunAs Group category: all User Groups: developers, ops_sudoers Sudo Allow Command Groups: jira_access Sudo Option: !authenticate[andrew.meyer@jira02 ~]$ [andrew.meyer@jira02 ~]$ ipa sudocmd-find su_jira_cmds----------------------1 Sudo Command matched---------------------- Sudo Command: /usr/bin/su - jira,/usr/bin/sudo su - jira,/bin/su - jira,/bin/sudo - jira Description: su_jira_cmds----------------------------Number of entries returned 1---------------------------- What am I doing wrong?

4 10

sudo not working with hostgroups
by Michael Gusek 10 Nov '17

10 Nov '17

Hello, we are using FreeIPA in the current version 4.5 under current CentOS 7. In order to grant access we are using sudo rules in conjunction with host groups. We have found that these rules do not work under Debian 8/9 and Ubuntu 16.04, but with Centos 6/7. Suggestions from the web require a set nisdomainname (nisdomainname example.com) which does not work. In fact, the nisdomainname is not set under CentOS 6, but under Centos 7 it is. What settings under Debian/Ubuntu must be made for sudo rules to work with hostgroups? Debian 8 Debian 9 Ubuntu 16.04 Centos 6 Centos 7 sssd-Version 1.15.0-3 1.15.0-3 1.15.0-3ubuntu2~ubuntu16.04.1~ppa1 sssd-1.15.3-1.el6.x86_64 sssd-1.15.2-50.el7_4.2.x86_64 sudo-Version 1.8.10p3-1+deb8u4 1.8.19p1-2.1 1.8.16-0ubuntu1.5 sudo-1.8.6p3-29.el6_9.x86_64 sudo-1.8.19p2-11.el7_4.x86_64 Regards, Michael -- ________________________________________________ *Michael**Gusek*| System Administrator| Webtrekk GmbH | *t*+49 30 755 415 302| *f *+49 30 755 415 100 | *w *www.webtrekk.com <https://www.webtrekk.com/?wt_mc=signature.-.-.-.homepageURL> Amtsgericht/Local Court Berlin, HRB 93435 B | Geschäftsführer/CEO Christian Sauer und Wolf Lichtenstein

5 9

Cannot start freeipa service after upgrade to Fedora 26
by Fuji San 10 Nov '17

10 Nov '17

I upgraded my freeipa server to F26 and I noticed it wasn't working anymore. So I ran 'ipa-server-upgrade' and got the following : Upgrading IPA: [1/8]: saving configuration [2/8]: disabling listeners [3/8]: enabling DS global lock [4/8]: starting directory server [5/8]: updating schema [6/8]: upgrading server [7/8]: stopping directory server [8/8]: restoring configuration Done. Update complete Upgrading IPA services Upgrading the configuration of the IPA services [Verifying that root certificate is published] [Migrate CRL publish directory] CRL tree already moved /etc/dirsrv/slapd-OPERA/certmap.conf is now managed by IPA. It will be overwritten. A backup of the original will be made. [Verifying that CA proxy configuration is correct] [Verifying that KDC configuration is using ipa-kdb backend] [Fix DS schema file syntax] Syntax already fixed [Removing RA cert from DS NSS database] RA cert already removed [Enable sidgen and extdom plugins by default] [Updating HTTPD service IPA configuration] [Updating mod_nss protocol versions] Protocol versions already updated [Updating mod_nss cipher suite] [Fixing trust flags in /etc/httpd/alias] Trust flags already processed [Exporting KRA agent PEM file] KRA is not enabled IPA server upgrade failed: Inspect /var/log/ipaupgrade.log and run command ipa-server-upgrade manually. Unexpected error - see /var/log/ipaupgrade.log for details: CalledProcessError: Command '/bin/systemctl start httpd.service' returned non-zero exit status 1 The ipa-server-upgrade command failed. See /var/log/ipaupgrade.log for more information What can i do ? Thanks. F.

3 8

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users November 2017