February 2022 - FreeIPA-users - Fedora Mailing-Lists

Automount options: -ghost or browse

by Simon Matthews

Can I set the "-ghost" or "browse" option on an automount map? If so, how?

2 years, 2 months

2
1
0 / 0

How to add user directori for jira admin and confluence admin user

by Mehrdad Hosseinzadeh

How to add user directori for jira admin and confluence admin user?

2 years, 2 months

1
0
0 / 0

new DNS setup

by Stephen Berg, Code 7309

New-ish ipa-4.9.6 setup on rocky linux 8.5. Initially we just setup the basic IPA services without DNS. I've started setting up ipa-dns now and not quite sure what the best way to proceed. Hypothetical settings: All hosts are set up as: hostname.domain.com All hosts have an alias: hostname.realm.domain.com I do not administer the authoritative DNS but I can add and delete records for the areas I manage. We currently run a few dnsmasq servers on our subnets with manually managed /etc/hosts on each. I want to utilize the ipa-dns to take over for our dnsmasq servers. I've done the ipa-dns-install, pointed forwarders to our authoritative DNS servers. What I can't quite wrap my head around is the best way to proceed from that point? Should I add the zone for the realm version hostnames and a separate zone for the domain level hostnames? Or add one zone and then add a CNAME for the other hostname? Should the zone I setup be the hostname.realm.domain version or the hostname.domain version. Or does it really matter much? I do have quite a few hostnames that do not have a realm hostname setup. They are mostly service ports and won't ever be bound to IPA. After starting to add some of those I seem to be unable to resolve them to an IP. -- Stephen Berg, IT Specialist, Ocean Sciences Division, Code 7309 Naval Research Laboratory W: (228) 688-5738 DSN: (312) 823-5738 C: (228) 365-0162 Email: stephen.berg(a)nrlssc.navy.mil <- (Preferred contact) Flank Speed: stephen.p.berg.civ(a)us.navy.mil

2 years, 2 months

2
2
0 / 0

How to configure random serial numbers for the CA in the Docker container

by Mark Sibering

I am running FreeIPA 4.9.8 as a Docker container and Firefox refuses the certificate as the serial has been reused. I found this post: https://bugzilla.redhat.com/show_bug.cgi?id=747959 and this post: https://galenabell.com/2018/10/23/random-certificate-serials-in-freeipa/, but the files mentioned do no longer exist in FreeIPA 4.9.8 (or I cannot find them). I tried adding: ``` PKI_RANDOM_SERIAL_NUMBERS_ENABLED="true" export PKI_RANDOM_SERIAL_NUMBERS_ENABLED ``` to /usr/share/pki/etc/pki.conf and I tried adding PKI_RANDOM_SERIAL_NUMBERS_ENABLED=TRUE as environment variable in the docker-compose file. Neither worked. During install I see the variable being set to false in the logs. Any suggestion on how to have random serials after an unattended install?

2 years, 2 months

3
3
0 / 0

SSHFP records

by Simon Matthews

When enrolling a client, I get the message: Could not update DNS SSHFP records. Everything seems to be working. Is this an issue I need to worry about? The reason it can't update these records is that the master DNS for the network is on a different server and it needs a TSIG in order to accept an update.

2 years, 2 months

3
3
0 / 0

host certs - Organizational Unit - ?

by lejeczek

Hi guys Is it possible to insert/include Organizational Unit (OU) for host certificates? many thanks, L

2 years, 2 months

2
3
0 / 0

certificate management - best practices - ?

by lejeczek

Hi guys. I ponder what I think must be trivial for at the same time, also an obvious idea - services & hosts. All the hosts, domain members and all possible or maybe just a handful services, one might run on those hosts - should you want a unique certificate for each host+service or perhaps a single cert for a host which then be used by all services on the host, is a better practice? All ideas & notions shared are greatly appreciated. many thanks, L.

2 years, 2 months

3
5
0 / 0

Need help with confusing query results

by Edward Valley

Hi there. I'm using latest FreeIPA available on Rocky Linux 8.5 VERSION: 4.9.6, API_VERSION: 2.245 When I run the following LDAP query: ldapsearch -H "ldap://idm-host:389" -x -s sub \ -D "cn=Directory Manager" -w "dm-password" \ -b "cn=users,cn=accounts,dc=..." \ '(objectClass=inetOrgPerson)' \ uid entryUUID I get the following result: (entryUUID is present) # user1, users, accounts, ... dn: uid=user1,cn=users,cn=accounts,dc=... uid: user1 entryUUID: aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee # user2, users, accounts, ... dn: uid=user2,cn=users,cn=accounts,dc=... uid: user2 entryUUID: aaaaaaaa-bbbb-cccc-dddd-ffffffffffff But, when I use this query: ldapsearch -H "ldap://idm-host:389" -x -s sub \ -D "cn=Directory Manager" -w "dm-password" \ -b "cn=users,cn=accounts,dc=..." \ '(&(objectClass=inetOrgPerson)(uid=user1))' \ uid entryUUID The result is this one: (No entryUUID attribute) # user1, users, accounts, ... dn: uid=user1,cn=users,cn=accounts,dc=... uid: user1 Can somebody please guide me on what's happening here? If you need more info just tell me. Thank you very much.

2 years, 2 months

3
16
0 / 0

use ipa-user with xorg

by Sascha Hartl

Hello I'm looking for a solution to use IPA and AD Users via IPA-provider for xorg Sessions on OL8. I've found some methods with "access_provider = ad" or "access_provider = simple" but i use "access_provider = ipa" in the sssd.conf to enforce rules. The login an sudo-rulset works fine, i added the service xrdp to the rules on the server. sssd.conf [domain/mydomain.com] id_provider = ipa dns_discovery_domain = mydomain.com ipa_server = server.mydomain.com ipa_domain = mydomain.com ipa_hostname = host.mydomain.com auth_provider = ipa chpass_provider = ipa access_provider = ipa cache_credentials = True ldap_tls_cacert = /etc/ipa/ca.crt krb5_store_password_if_offline = True ldap_sudo_smart_refresh_interval = 900 ldap_sudo_full_refresh_interval = 300 [sssd] services = nss, pam, ssh, sudo domains = mydomain.com [nss] homedir_substring = /home [pam] [sudo] [autofs] [ssh] [pac] [ifp] [secrets] but i don't know if i have to set some informations in the xrdp.ini [Xorg] name=Xorg lib=libxup.so username=ask password=ask ip=127.0.0.1 port=-1 code=20

2 years, 2 months

2
8
2 / 0

Inconsistent LDAP data for one of my IPA replicas

by William Faulk

I've got a bunch of replication errors that I'm trying to resolve with a re-initialization, but the biggest one right now is that one of my IPA replicas has inconsistent LDAP attributes and I'm not sure of the best way to proceed. The inconsistent attributes are: * ipaUniqueID * krbPrincipalKey * krbExtraData * krbLastPwdChange Certainly at least the first two seem really significant. I'm hesitant to re-initialize and overwrite data about one of the IPA servers itself. Should I try to delete it as a replica? Try to manually update the data on the replicas with bad data? Just re-initialize from a replica with good data? For the latter two options, how can I determine which data is the correct data?

2 years, 2 months

2
1
0 / 0

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users February 2022