Vinícius Ferrão via FreeIPA-users wrote:
Hello all,
> On 23 Sep 2019, at 12:59, Alexander Bokovoy <abokovoy(a)redhat.com
> <mailto:abokovoy@redhat.com>> wrote:
>
> On Mon, 23 Sep 2019, Vinícius Ferrão via FreeIPA-users wrote:
>> Florence and Angus, thanks for the replies.
>>
>> xCAT definitely can run scripts at boot time. And the kickstart
>> method seems to be the way to go. But I sill have some questions:
>>
>> The nodes are stateless, so in a reboot all the configuration is lost
>> and get back from the image. FreeIPA configuration will be lost and
>> then restarted. Which appears to be ok. But there are two issues:
>>
>> * The password for “joining” the FreeIPA domain that expires after
>> the first use
>> * The necessity of the hostname on the ipa-client-install command:
>>
hostname=client.example.com <
http://client.example.com>
>> <
http://client.example.com/>
>>
>> With this two things I think we are unable to move forward, so the
>> first question is:
>>
>> 1. Do I really need this password? Or better, the password can be
>> permanent? It’s a “closed” system, so in terms of security I think
>> there’s no problem.
> Please check ipa-client-install manual page. It has all explanations for
> methods of enrollment. You can create a special user that has privileges
> to create machines and enroll them and record the user's credentials in
> the kickstart file.
I was worried about the RTM but I really can’t find the exact answer.
That’s why I came to the list. Searching a little but further, I came
across the Forced Re-enrollment page and I think you’re mentioning this
one,
right? https://www.freeipa.org/page/V3/Forced_client_re-enrollment
But in this page it says about the OTP to primary join the FreeIPA
domain, but I can’t use another OTP to do the re-enrollment. Is this
expected?
Did you get an error about unenrolling? You probably need to call
host-disable to mark it as unenrolled, then you can set a new OTP and
enroll. If, when you decommission the machine, you call
ipa-client-install --uninstall the host-disable should happen
automatically IIRC
The only was to successfully re-enroll a machine is passing the
Keytab
or passing admin username and password.
With this in mind:
* Can I recover the Keytab directly from the server and try to send it
to the new booted machine to avoid passing user/pass combination?
* If not is it possible to have a service account to do this?
I don't think you can recover the keytab per se but I guess there is no
reason you couldn't run ipa-getkeytab to get a new one and use that to
enroll.
About the service accounts, it’s little confusing in the documentation
either. There’s something in this link, but I can’t be sure if it’s the
same
thing: https://www.freeipa.org/page/HowTo/LDAP
Service account to do what?
rob
>
>>
>> 2. Ipa-client-install can’t use the hostname of the node automatically?
>> Do I really need to fill the hostname? Because this kills the ideia of
>> a generic image.
> This is also covered in the man page. In short, there is no need to
> supply hostname explicitly, it will be discovered.
Thanks, this one I completely missed:
--hostname
The hostname of this machine (FQDN). If specified, the hostname will be
set and the system configuration will be updated to persist over reboot.
By default a nodename result from uname(2) is used.
>
>>
>> Thank you all guys.
>>
>>
>>> On 23 Sep 2019, at 04:04, Florence Blanc-Renaud <flo(a)redhat.com
>>> <mailto:flo@redhat.com>> wrote:
>>>
>>> On 9/23/19 1:10 AM, Vinícius Ferrão via FreeIPA-users wrote:
>>>> Hello, the subject of the message may sound a little bit strange,
>>>> but let me explain what I’m trying to do.
>>>> I have a machine with an provisioner (xCAT) that is able to boot
>>>> and control different types of computer nodes. A stateless node is
>>>> just a machine that boots over the network from a shared image on
>>>> the server.
>>>> What I’m trying to do?
>>>> Join those stateless nodes to FreeIPA Server.
>>>> To do this, I’m aware that I can’t just run freeipa-client-install
>>>> on the image chroot, since it will not behave as expected.
>>>> At this point xCAT (the provisioner) can create the DNS registers
>>>> of the stateless nodes on FreeIPA integrated DNS (using TSIG keys).
>>>> But I need to properly join the nodes to the server.
>>>> There’s a way to manually register the nodes on the server?
>>>> And about the users? How to enable them? Just Configure SSSD on the
>>>> image and it should be fine?
>>>> The certificates, client certificates and things like this? There’s
>>>> something that I need to do?
>>>> Automount?
>>>> Any help is really appreciated.
>>>> Thanks,
>>>> _______________________________________________
>>>> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>>>> <mailto:freeipa-users@lists.fedorahosted.org>
>>>> To unsubscribe send an email to
>>>> freeipa-users-leave(a)lists.fedorahosted.org
>>>> <mailto:freeipa-users-leave@lists.fedorahosted.org>
>>>> Fedora Code of Conduct:
>>>>
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>>>> List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
>>>> List Archives:
>>>>
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
>>>
>>> Hi,
>>> xCAT probably offers you the possibility to run a custom script at
>>> the end of the installation. If it's the case, you can use a
>>> workflow similar to what is described in "Setting up an IdM Client
>>> Through Kickstart" [1]. You need to create a client host entry
>>> first, and the custom script on the client will call ipa-client-install.
>>>
>>> HTH,
>>> flo
>>>
>>> [1]
>>>
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/...
>>
>
>
> --
> / Alexander Bokovoy
> Sr. Principal Software Engineer
> Security / Identity Management Engineering
> Red Hat Limited, Finland
_______________________________________________
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...