[SSSD] [Freeipa-users] IPA/Kerberos5 and Upper Case/Lower-case Hostnames

Dmitri Pal dpal at redhat.com
Mon Jan 19 12:38:54 UTC 2015


On 01/18/2015 03:24 AM, Traiano Welcome wrote:
> Hi Dmitri
>
>
> On Tue, Dec 30, 2014 at 12:17 AM, Dmitri Pal <dpal at redhat.com> wrote:
>> On 12/24/2014 01:04 AM, Traiano Welcome wrote:
>>> Hi List
>>>
>>> I have a large number of legacy hosts with upper-case host names, that
>>> I'd like to configure as IPA clients. However ipa client refuses to
>>> accept upper case hostnames during configuration time.
>>>
>>> I think this derives from the fact that the kerberos5 database stores
>>> host names in a case sensitive way and requires that the DNS hostname
>>> matches the server hostname case.
>>>
>>> My question is: Is it mandatory that the hostname be lower-cased, or
>>> is there a safe workaround that will allow IPA client to work with
>>> hosts that have upper case host names ?
>>>
>>> Thanks in advance!
>>> Traiano
>>>
>> See man sssd-ipa
>>
>>         ipa_hostname (string)
>>             Optional. May be set on machines where the hostname(5) does not
>> reflect the fully qualified name used in the IPA domain to identify this
>>             host.
>>
>> AFAIR you use this setting for the cases when you want the actual machine
>> name be different than the one IPA has.
>
>
> It looks like I would have to add this parameter in the sssd.conf
> before running the ipa client configuration. In that case, would the
> configurator not overwrite this parameter ?
> Or is there some way to provide this option to  ipa-client-install initially?

AFAIR then you have to configure it manually.
But this question belongs more to SSSD list so I am moving it there.

Also I think the option is to change the name of the host, enroll 
automatically, then change it back and update the configuration.
But I would prefer SSSD gurus to confirm that.

>
>
>> --
>> Thank you,
>> Dmitri Pal
>>
>> Sr. Engineering Manager IdM portfolio
>> Red Hat, Inc.
>>
>> --
>> Manage your subscription for the Freeipa-users mailing list:
>> https://www.redhat.com/mailman/listinfo/freeipa-users
>> Go To http://freeipa.org for more info on the project
> Thanks in advance,
> Traiano


-- 
Thank you,
Dmitri Pal

Sr. Engineering Manager IdM portfolio
Red Hat, Inc.




More information about the sssd-devel mailing list