My FreeIPA server have two IP addresses. It registers itself with the internal and the external addresses. There’s a way to only register the IPs from the internal interfaces?
I only want the entries from the network 172.26.0.0/16.
- a CA with Freeipa
- a sub CA with Freeipa too
- a server with certmonger installed on and connected to the sub CA
- an external client without freeipa neither Certmonger.
CA, sub CA and server are on the same realm: domaine.fr
The external client is on a different realm: newdomaine.fr
My goal is to generate a certificate for the external client.
So, with the web ui in the sub ca, i've added the DNS zone newdomaine.fr and the host external.domaine.fr .
From the server when i run the command below:
ipa-getcert request -v -f /etc/pki/tls/certs/externe.crt -k /etc/pki/tls/private/externe.key -N CN=externe.domaine.fr -D externe.newdomaine.fr -K host/externe.newdomaine.fr(a)SUB.DOMAINE.FR -I externe
i get the result is:
Request ID 'externe':
ca-error: Server at https://subca.domaine.fr/ipa/xml denied our request, giving up: 2100 (RPC failed at server. Insufficient access: Insufficient 'write' privilege to the 'userCertificate' attribute of entry 'fqdn=externe.newdomaine.fr,cn=computers,cn=accounts,dc=sub,dc=domaine,dc=fr'.).
I don't understand because the host is added.
Could you explain to me how to fix that please?
Thank you very much!
I have followed this documentation for enabling an automount to show up for
a NIS client that is bound to FreeIPA, and it worked as expected and the
NIS client can see the automount:
I then went back and dumped the entire ldap tree out of curiosity to see my
changes I just added, and they are not there. If I search for the keys
"nis-base" or "nis-domain" for example, it's no where to be found.
Where did this change actually go? I feel like I'm going crazy! :)
Thanks for the help in furthering my understanding!
I have a client bound to FreeIPA using NIS, however when doing a "ypcat
passwd" the password fields are an asterisk (*) instead of a password hash.
The NIS integration docs are a bit sparse - am I missing something to allow
NIS clients to authenticate against FreeIPA as an actual NIS client? Is
I have been trying various LDAP extensions without success.
Most Google-able information is years old.
Anyone use this : https://www.freeipa.org/page/Setting_up_MediaWiki_to_run_against_FreeIPA ?
Daniel E. White
NICS Linux Engineer
NASA Goddard Space Flight Center
8800 Greenbelt Road
Building 14, Room E175
Greenbelt, MD 20771
Office: (301) 286-6919
Mobile: (240) 513-5290
The NIST recommendations for passwords say they don’t think character classes and expiration are useful. Instead, they recommend using a blacklist of known common passwords. There’s no way to implement this policy without writing your own plugin. It would be useful for IPA’s password policy to allow you to specify a database of forbidden passwords.
We’ve done this using a plugin, but I’d rather not have to write C code to implement policy.
The client is joined to the IPA domain and gets a certificate from the
sub-ca `puppet` with `ipa-getcert request -x puppet`. In order to have the
puppet agent to be able to talk to puppet server I need the puppet sub-ca
How can I distribute the sub-ca certificate to the client? Running
`ipa-certupdate` did not work.