I'm probably not using the correct terminology, so giving me a starting
point would be great.
FreeIPA is authoritative for / master of 'identity.demarcohome.com'. Our
common domain is 'demarcohome.com', and a BIND9 server is authoritative
within our internal network for that zone. DiG-ging 'demarcohome.com' shows
it's not authoritative outside our network. If there's a better way to do
this dual / split personality DNS that *is straightforward for a mere
mortal*, please share it.
Otherwise, how do I make FreeIPA respond to queries for '*.demarcohom.com'
records. I've already made a forward zone for 'demarcohome.com' and
populated it with a few records. Querying the ipa server for those records
returns no answer.
I'd show some command line examples, but I'm still working through the ipa
dns commands. Here's a DiG query for a server with a record in zone '
[nick@ipa1 ~]$ dig vcenter.demarcohome.com
; <<>> DiG 9.11.14-RedHat-9.11.14-2.fc31 <<>> vcenter.demarcohome.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 33303
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
; COOKIE: 789ce7f015d2b67d5abfa8635e42b601057c47bc7fc1b041 (good)
;; QUESTION SECTION:
;vcenter.demarcohome.com. IN A
;; Query time: 0 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Tue Feb 11 09:11:13 EST 2020
;; MSG SIZE rcvd: 80
After successfully promoting an IPA server to a replica, ipa-ca-install
fails with "Directory Manager password is invalid"
This noob would appreciate a command and example to verify I have the
correct directory manager password. I've looked through this page:
but haven't been successful in getting dsconf or ldapmodify to work.
# dsconf -D "cn=Directory Manager" slapd-IDENTITY-DEMARCOHOME-COM
Error: Could not find configuration for instance:
My FreeIPA server have two IP addresses. It registers itself with the internal and the external addresses. There’s a way to only register the IPs from the internal interfaces?
I only want the entries from the network 172.26.0.0/16.
- a CA with Freeipa
- a sub CA with Freeipa too
- a server with certmonger installed on and connected to the sub CA
- an external client without freeipa neither Certmonger.
CA, sub CA and server are on the same realm: domaine.fr
The external client is on a different realm: newdomaine.fr
My goal is to generate a certificate for the external client.
So, with the web ui in the sub ca, i've added the DNS zone newdomaine.fr and the host external.domaine.fr .
From the server when i run the command below:
ipa-getcert request -v -f /etc/pki/tls/certs/externe.crt -k /etc/pki/tls/private/externe.key -N CN=externe.domaine.fr -D externe.newdomaine.fr -K host/externe.newdomaine.fr(a)SUB.DOMAINE.FR -I externe
i get the result is:
Request ID 'externe':
ca-error: Server at https://subca.domaine.fr/ipa/xml denied our request, giving up: 2100 (RPC failed at server. Insufficient access: Insufficient 'write' privilege to the 'userCertificate' attribute of entry 'fqdn=externe.newdomaine.fr,cn=computers,cn=accounts,dc=sub,dc=domaine,dc=fr'.).
I don't understand because the host is added.
Could you explain to me how to fix that please?
Thank you very much!
I have followed this documentation for enabling an automount to show up for
a NIS client that is bound to FreeIPA, and it worked as expected and the
NIS client can see the automount:
I then went back and dumped the entire ldap tree out of curiosity to see my
changes I just added, and they are not there. If I search for the keys
"nis-base" or "nis-domain" for example, it's no where to be found.
Where did this change actually go? I feel like I'm going crazy! :)
Thanks for the help in furthering my understanding!
I have a client bound to FreeIPA using NIS, however when doing a "ypcat
passwd" the password fields are an asterisk (*) instead of a password hash.
The NIS integration docs are a bit sparse - am I missing something to allow
NIS clients to authenticate against FreeIPA as an actual NIS client? Is
I have been trying various LDAP extensions without success.
Most Google-able information is years old.
Anyone use this : https://www.freeipa.org/page/Setting_up_MediaWiki_to_run_against_FreeIPA ?
Daniel E. White
NICS Linux Engineer
NASA Goddard Space Flight Center
8800 Greenbelt Road
Building 14, Room E175
Greenbelt, MD 20771
Office: (301) 286-6919
Mobile: (240) 513-5290