On ti, 07 marras 2017, Pascal Ernster via FreeIPA-users wrote:

Hi,

is it possible to use multiple operating systems (for example different versions of Fedora and CentOS) at the same time on one and the same computer, with the same IP address/hostname, with all of these OS installations being valid FreeIPA clients at the same time?

Could this cause problems as every operating system gets its own Kerberos TGT, its own SSH host keys, LDAP entries, etc?

In case it matters: I'm using the FreeIPA packages from the official distro repos, which means that different OS installations may have differing versions of the FreeIPA client and its dependency packages.

The use case would be a (hopefully) seamless distro upgrade, with an easy fallback option for users if they experience problems with the new distro release.

If they all have the same hostname, you are better to enroll and share keytab across all configurations. To do so, enroll first time and then specify /etc/krb5.keytab from that installation with ipa-client-install -k option. See ipa-client-install man page for more details.

[2017-11-07 14:50] Alexander Bokovoy via FreeIPA-users:

If they all have the same hostname, you are better to enroll and share keytab across all configurations. To do so, enroll first time and then specify /etc/krb5.keytab from that installation with ipa-client-install -k option. See ipa-client-install man page for more details.

Thanks for the advice. Would the kerberos keytab and the SSH host keys be the only possible/likely causes for problems?

Please note that I run FreeIPA with external nameservers, on which I added the necessary DNS entries for the FreeIPA servers manually. The FreeIPA client machines only have their respective A/AAAA records (and the corresponding reverse DNS records, of course).

Regards Pascal

Please disregard this message/subthread. I used the wrong envelope sender due to a bug in my mail client.

On ke, 08 marras 2017, Pascal Ernster via FreeIPA-users wrote:

[2017-11-07 14:50] Alexander Bokovoy via FreeIPA-users:

...

If they all have the same hostname, you are better to enroll and share keytab across all configurations. To do so, enroll first time and then specify /etc/krb5.keytab from that installation with ipa-client-install -k option. See ipa-client-install man page for more details.

Thanks for the advice. Would the kerberos keytab and the SSH host keys be the only possible/likely causes for problems?

The only thing that would be common to all these machines is LDAP object for the machine. It is indexed by the hostname, so having the same hostname means sharing that LDAP object and all its attributes, including Kerberos key.

You can have multiple SSHFP entries for the same host, this is normal.

Please note that I run FreeIPA with external nameservers, on which I added the necessary DNS entries for the FreeIPA servers manually. The FreeIPA client machines only have their respective A/AAAA records (and the corresponding reverse DNS records, of course).

How DNS is managed is irrelevant here.