On ti, 13 elo 2019, Boyd Ako via FreeIPA-users wrote:
> On to, 01 elo 2019, Boyd Ako via FreeIPA-users wrote:
> Are you retrieving existing key or the key does not exist yet?
Created the host and the service. Not entirely sure about creating a key.
> What does 'ipa service-show NFS/...' show?
[root@ipa binary]# ipa service-show nfs/abyss.neverland.ddns.me
Principal name: NFS/abyss.neverland.ddns.me(a)NEVERLAND.DDNS.ME
Principal alias: NFS/abyss.neverland.ddns.me(a)NEVERLAND.DDNS.ME
Managed by: abyss.neverland.ddns.me
Hosts allowed to retrieve keytab: ipa.neverland.ddns.me
> Does it have 'Keytab: True' in the output?
Apparently no... How do I change it to true?
By running ipa-getkeytab. Please read the documentation for
ipa-getkeytab and note the difference in behavior when '-r' is passed.
In short, if you haven't yet created a key (Keytab: False) you should
not use '-r' option.
If you have already generated the key (Keytab: True) and you want to
retrieve it for other server (typically for clustered environment), you
must use '-r' option, after setting up who is allowed to retrieve the
> BTW, for NFS your service principal has to be nfs/..., not NFS/....
> This is described in the man page for rpc.gssd, section "Machine
Well the Web UI seems to have made them with caps.
It does not. The code for Web UI
has the following (editable) list of
and in the code of Web UI I don't see the service value normalized
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland