John Keates via FreeIPA-users wrote:
Sounds great! Where do we find this tool? In an upcoming release or
as a stand-alone package?
It's a standalone package, freeipa-healthcheck.
rob
John
> On 14 Jun 2019, at 16:29, Rob Crittenden via FreeIPA-users
<freeipa-users(a)lists.fedorahosted.org> wrote:
>
> I'd like to introduce a new tool for an IPA adminstrators tool kit we're
> working on, currently in a beta state and shipping in Fedora 29+.
>
> ipa-healthcheck is proactive tool for identifying current, potential and
> future issues within an IPA installation.
>
> It executes a series of checks in the areas of certificates, AD trust,
> replication and the filesystem (and a few others). These checks can
> return a success, warning or error. Any check executed will return a
> value, the idea being if something with the check blows up and causes it
> to not execute you'd otherwise not know and would have a false sense of
> security.
>
> A systemd timer is configured which will execute this on a nightly
> basis, dumping the output in JSON format in /var/log/ipa/healthcheck/.
>
> It can also be executed from the command-line as root and requires an
> admin Kerberos ticket. From the command-line it is probably most useful
> to use the --failures-only option in order to suppress the SUCCESS
> messages: no news is good news in this case.
>
> It currently only works with IPA 4.7.2+. Will we backport to 4.6? I
> don't know yet.
>
> I'd appreciate any feedback on whether it:
>
> - is helpful
> - works
> - doesn't report false positives
> - is usable: a lot of the output is what I think would be useful but we
> won't know until applied in the real world
> - does what you need. We can add more checks so if you have ideas please
> let us know
>
> Note that there are a few things we run that just produce output that
> needs to be analyzed separately. DNA range checking is an example. It is
> perfectly fine to not have a DNA range assigned on all masters but you'd
> want to know if you had none defined on all masters.
>
> thanks
>
> rob
> _______________________________________________
> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
> Fedora Code of Conduct:
https://getfedora.org/code-of-conduct.html
> List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
_______________________________________________
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
Fedora Code of Conduct:
https://getfedora.org/code-of-conduct.html
List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...