Hi folks! I want to talk about the Active Directory requirements in the
release criteria.
Since Fedora Server was created, we've had this in the criteria:
"It must be possible to join the system to a FreeIPA or Active
Directory domain at install time and post-install, and the system must
respect the identity, authentication and access control configuration
provided by the domain."
...plus various further requirements at Beta and Final.
For FreeIPA we have this testing entirely automated, it's no problem at
all. For Active Directory we...don't. At every release point this does
not get tested until very late. Often Stephen Gallagher has to test it
manually at the very last minute, which is an unfair burden on him.
When we *do* find problems, there is a mad scramble to fix them or at
least find workarounds, because we find them way too late.
We've looked into automating it and still kinda intend to do so, but
it's not really simple. There's a legal side to it - it's not clear
what the licensing requirements involved would be - and a technical
side to it - we'd need a way to reliably and quite quickly deploy an AD
domain controller using openQA automation, which is not a trivial job.
When I estimate the time that's going to take and consider what *else*
I (or anyone else) could do with that time, I'm not certain that
"automating AD testing" is the best use of it. To me it doesn't feel
like a really key feature of Fedora to the point that would justify the
work involved, or justify continuing to throw Stephen and others under
the last-minute-manual-testing bus. But I'm not sure!
What do others think? Do you use the AD client support of Fedora
Server? Do you think it's a key feature that we should keep as a
release-blocking requirement, or no?
Thanks!
--
Adam Williamson (he/him/his)
Fedora QA
Fedora Chat: @adamwill:fedora.im | Mastodon: @adamw@fosstodon.org
https://www.happyassassin.net
Again, for everyone's convenience, a brief summary of our last IRC meeting right here.
For greater Details see:
https://docs.fedoraproject.org/en-US/server-working-group/wg-minutes-2023/
=== Highlight(s) ===
As an absolute highlight, we finally found the time to discuss our Ansible / Wildfly project in detail. We have made some decisions:
* We'll use nginx as proxy solution, because it is able to handle the proxy protocol.
* We will create a separate log. Volume for /opt/wildfly according the Fedora Server Edition storage concept
We’ll continue next meeting with Ansible details and probably a proxy test installation.
--
Peter Boy
https://fedoraproject.org/wiki/User:Pboy
PBoy(a)fedoraproject.org
Timezone: CET (UTC+1) / CEST /UTC+2)
Fedora Server Edition Working Group member
Fedora Docs team contributor and board member
Java developer and enthusiast
Again, a bit late but hopefully not too late and for everyone's convenience, a brief summary of our last IRC meeting right here.
For greater Details see:
https://docs.fedoraproject.org/en-US/server-working-group/wg-minutes-2023/
1.
As it looks at the moment the committee has accepted and is planning with a presentation: Fedora Server Edition – Quo Vadis? Unfortunately a workshop about Server in virtual environment, that I proposed, too, didn’t make it.
2.
WG agrees about to use automated testing using Samba AD as the server end (instead of a native Windows server) and to keep the status of release criteria.
Full compatibility with Windows Server remains the goal regardless of the testing procedure. And an inability to connect to a real Microsoft AD server remains a release blocking criterion, since that is (and remains) the most prominent domain controller in the world
3.
Regarding Fedora Server on (ARM) SBC, we’ll complete the current device documentation draft with the devices nominated until now.
4.
We want to replace the "DVD" in the naming of the installation media by "STD".
--
Peter Boy
https://fedoraproject.org/wiki/User:Pboy
PBoy(a)fedoraproject.org
Timezone: CET (UTC+1) / CEST /UTC+2)
Fedora Server Edition Working Group member
Fedora Docs team contributor and board member
Java developer and enthusiast
As we had discussed last meeting I’ve published the first part of a draft of a mail service tutorial.
https://docs.stg.fedoraproject.org/en-US/fedora-server/tutorials/mailservic…
@eseyman was about to implement (and document) a mail gateway, so we can coordinate.
Best
Peter
--
Peter Boy
https://fedoraproject.org/wiki/User:Pboy
PBoy(a)fedoraproject.org
Timezone: CET (UTC+1) / CEST /UTC+2)
Fedora Server Edition Working Group member
Fedora Docs team contributor and board member
Java developer and enthusiast
LLMNR [1] is multicast name resolution protocol. I think it should be
disabled on all Server deployments unless explicitly requested by the
administrator. Unfortunately it breaks some kinds of DNS queries [2]
because the way it is implemented in systemd-resolved. It makes dig -t
NS org. return error telling that domain does not exist.
I think LLMNR should be disabled in whole distribution, because even
Microsoft is removing support for it [3]. I doubt it were wanted even in
Server builds especially. Those usually rely on more controlled
infrastructure, meaning standard unicast DNS.
If you would know a common use case, why it should be still wanted, can
you share it? I have created issue #114 for it on fedora-server [4].
Have you ever used single label name to connect to your server? I think
mDNS has less problematic implementation in avahi, but that has to be
enabled explicitly. I think that is desired especially on servers.
It were introduced by systemd-resolved change [5], but there were no
statement that it would have negative impact on DNS resolution.
What would you think about it?
1. https://www.rfc-editor.org/rfc/rfc4795
2. https://bugzilla.redhat.com/show_bug.cgi?id=2220973
3.
https://techcommunity.microsoft.com/t5/networking-blog/aligning-on-mdns-ram…
4. https://pagure.io/fedora-server/issue/114
5.
https://fedoraproject.org/wiki/Changes/systemd-resolved#Local_multicast_DNS
--
Petr Menšík
Software Engineer, RHEL
Red Hat, https://www.redhat.com/
PGP: DFCF908DB7C87E8E529925BC4931CA5B6C9FC5CB
Again, for everyone's convenience, a brief summary of our IRC meeting right here.
For greater details see meetbot
== Summary: ==
https://meetbot.fedoraproject.org/fedora-meeting/2023-06-07/fedora-server.2…
== Full log: ==
https://meetbot.fedoraproject.org/fedora-meeting/2023-06-07/fedora-server.2…
== Essentials ==
==== Flock 2023 ====
Date: Aug. 2 -4 in Cork Ireland
We will discuss a contribution and who plans to attend the event in person.
==== F39 Work Project: Fedora Server on (ARM) SBC ====
We agreed upon publishing a reference list according to the plan in issue -108.
W’ll collect what models are available in Server WG.
==== F39/40 Work Project: Fedora Server in a virtualized runtime environment ====
We agreed to perform the community survey as proposed in #110 .
Peter
--
Peter Boy
https://fedoraproject.org/wiki/User:Pboy
PBoy(a)fedoraproject.org
Timezone: CET (UTC+1) / CEST /UTC+2)
Fedora Server Edition Working Group member
Fedora Docs team contributor and board member
Java developer and enthusiast