I am trying to get a deeper understanding how services are organized.
When browsing the LDAP directory in FreeIPA I can see that services are
organized in a separate (DN:
cn=services,cn=accounts,dc=linux,dc=mydomain,dc=at) and that each
services connection to the computer object can be found in the ManagedBy
attribute. So far, so good.
In the Windows world I see services specified directly in SPN attributes
of a computer object. That makes sense and looks very similar to the IPA
What I do not completely understand is why SPNs cann also be specified
as an attribute of an AD (service account) user. Why? What's the purpose
of that? (almost every tutorial on the web uses the mapuser-parameter of
the ktpass command but none states why this is needed.) I can imagine
that it makes sense for Linux servers when there is no computer object
in the AD. But what are other reasons/use cases?
I do know that this question is slightly off-topic. Nevertheless, I am
sure somebody here has a good answer to it which I would highly
appreciate to hear.
I am attempting to deploy a cluster using ansible-freeipa:
The ipaserver role successfully deploys the server but I have a question
about dns specifically: What is the format for "ipaserver_reverse_zones". I
haven't seen an example. We have a LOT of reverse zones and would like to
get them all set out out the gate using vars.
Server is mostly alright and I think I have it figured out but replicas
fail to deploy.
They specifically fail at Install - Replica preparation connection check,
if I set it to ignore the connection check they simply fail later for the
same reason. I have managed to suss out that the replicas aren't added to
DNS on the primary server however I cannot seem to get them to add during
deployment. They show up in Hosts on the primary but not in DNS. I could
add them manually but I will be handing this over for multiple regions to
use to deploy FreeIPA so everything needs to work from the ansible-freeipa
collection and playbooks.
Vars here : https://pastebin.com/hZr0npHH
- name: Install FreeIPA Primary
- role: freeipa.ansible_freeipa.ipaserver
- name: Install FreeIPA replicas
- role: freeipa.ansible_freeipa.ipareplica
Senior Linux Administrator
I have seen more threats like this but not exactly this topic.
I am setting up an IPA server in a existing internal domain on a B-class network range . I have already a DNS server running for this domain, but it holds only a C-class network range.
I tried to setup the IPA server with the "ipa-server-install --setup-dns --no-forwarders --auto-reverse --allow-zone-overlap" options but this does not work and results in the disability to create PTR records for any network range in my domain. + it than needs the existing DNS server as forwarder to be able to resolve global addresses.
I intent to install the IPA server as qualified DNS server for my domain , next to the existing DNS server and when setup, decommission the existing
Any help would be appreciated