Hi Florence

Thank you so much.

Questions:

1) How do we "type a carriage return at the end?" 2) Will just a "\n" suffice, or do we need a "control character?" 3) If "control character" is needed how do e embed it on our copy-n-paste? Hitting return for that new line does not work.

Please advise.

Many thanks.

Marcelo

And if you want to have Ansible do it (setting either ‘off’ or ‘rootdse’ as the value) I’ve used this

- name: Disable FreeIPA anonymous LDAP access community.general.ldap_attrs: dn: cn=config attributes: nsslapd-allow-anonymous-access: 'off' server_uri: ldaps://localhost validate_certs: false bind_dn: cn=Directory Manager bind_pw: '{{ freeipa_directory_manager_password }}'

On Sep 27, 2023, at 11:21 AM, Rob Crittenden via FreeIPA-users freeipa-users@lists.fedorahosted.org wrote:

Marcelo Carvalho via FreeIPA-users wrote:

...

Hi Florence

Thank you so much.

Questions:

1. How do we "type a carriage return at the end?"
2. Will just a "\n" suffice, or do we need a "control character?"
3. If "control character" is needed how do e embed it on our copy-n-paste? Hitting return for that new line does not work.

You just need an empty line to tell ldapmodify that the current mod request is complete. You can alternatively put this into a file and pass it in that way. EOF is treated as the end as well.

rob _______________________________________________ FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahoste... Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue

The password can be stored in Ansible Vault, prompted for, or whatever preferred Ansible secret management strategy you employ.

I run it from the FreeIPA nodes, so it’s over an encrypted SSH session and then done via the loopback. It’s also using “ldaps” not “ldap,” so even a privileged used sniffing on the loopback wouldn’t see it (although a privileged user would have a hundred other ways to potentially gain access).

On Sep 27, 2023, at 3:20 PM, Marcelo Carvalho via FreeIPA-users freeipa-users@lists.fedorahosted.org wrote:

Thank you so much Andrew.

Question: Does "freeipa_directory_manager_password" go in the clear?

_M _______________________________________________ FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahoste... Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue

On 27/09/2023 22.00, Andrew Imeson via FreeIPA-users wrote:

The password can be stored in Ansible Vault, prompted for, or whatever preferred Ansible secret management strategy you employ.

I run it from the FreeIPA nodes, so it’s over an encrypted SSH session and then done via the loopback. It’s also using “ldaps” not “ldap,” so even a privileged used sniffing on the loopback wouldn’t see it (although a privileged user would have a hundred other ways to potentially gain access).

It may be easier to use ipa-ldap-updater as root. The command uses LDAP over Unix sockets for secure communication and authentication. You don't have to pass any additional options like shost, port, or password. The update syntax is based on LDIF, but shorter and IMO easier to read.

Create a file "rootdse.update" with content:

dn: cn=config only: nsslapd-allow-anonymous-access: rootdse

then run "ipa-ldap-updater rootdse.update" on every IPA server. Changes to cn=config are not replicated.

Christian

Thank you Rob.

It worked perfectly. All done.

Many thanks

Marcelo