FreeIPA-users July 2024

freeipa-users@lists.fedorahosted.org

46 participants
64 discussions

Best way to upgrade FreeIpa version and OS
by Youssef CHTOUROU 01 Jul '24

01 Jul '24

Hello I've 3 FreeIpa Servers (version =4.6.8) runned on Centos 7. I'am looking for upgrade these servers like that : Centos 7 to Rocky 8 FreeIpa server to most recent version possible I would like to see your advice : what is the best / secure way to do this upgrade ? Thanks a lot

1 0

Kerberos / Samba authentication issue after updating to 4.9.13-10
by Florian Spicher 01 Jul '24

01 Jul '24

Hello, We experience some problems with Kerberos / Samba authentication after updating our two FreeIPA servers. The issue appeared after updating the following packages: ipa-server-trust-ad-4.9.13-10.module_el8.10.0+3857+9c8da539.x86_64 ipa-server-dns-4.9.13-10.module_el8.10.0+3857+9c8da539.noarch ipa-server-4.9.13-10.module_el8.10.0+3857+9c8da539.x86_64 python3-ipaserver-4.9.13-10.module_el8.10.0+3857+9c8da539.noarch ipa-client-4.9.13-10.modue_el8.10.0+3857+9c8da539.x86_64 python3-ipaclient-4.9.13-10.module_el8.10.0+3857+9c8da539.noarch python3-ipalib-4.9.13-10.module_el8.10.0+3857+9c8da539.noarch ipa-common-4.9.13-10.module_el8.10.0+3857+9c8da539.noarch ipa-selinux-4.9.13-10.module_el8.10.0+3857+9c8da539.noarch ipa-server-common-4.9.13-10.module_el8.10.0+3857+9c8da539.noarch ipa-client-common-4.9.13-10.module_el8.10.0+3857+9c8da539.noarch We've running an Samba server which uses FreeIPA for authentication, set up with "ipa-client-samba". After the updates, the authentication failed. Samba Log Error: ../../auth/gensec/spnego.c:1245(gensec_spnego_server_negTokenInit_step) gensec_spnego_server_negTokenInit_step: gse_krb5: parsing NEG_TOKEN_INIT content failed (next[(null)]): NT_STATUS_LOGON_FAILURE krb5kdc.log Error: krb5kdc[1903](Information): TGS_REQ (5 etypes {aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17), DEPRECATED:arcfour-hmac(23), DEPRECATED:arcfour-hmac-exp(24), UNSUPPORTED:(-135)}) SERVER NOT ALLOWED: authtime 0, etypes {rep=UNSUPPORTED:(0)} user@ad for cifs/host@IPA Der Server-Principal ist nur für »user2user« gültig Has anyone experienced a similar issue or an idea why the issue appeared? Thanks, Florian

2 1

Disable user password expiration immediately after password reset.
by luckydog xf 01 Jul '24

01 Jul '24

Once the admin changes the user password, it will expire immediately. Can we disable this policy?

1 0

replica in DMZ with trust-agent
by slek kus 01 Jul '24

01 Jul '24

Hi I deployed a third replica in a dmz network for clients that do not route to the main ipa masters. Not sure if this is a workable setup. I can join clients using --fixed-primary and can logon with AD (one-way trust). This third replica has the trust-agent role. I might be approaching this incorrectly. Posting here for advise, has anyone attepted this and how to approach? It seems to be working, except the sudo rules. I have posted a diagram here: https://ibb.co/WkQj9yD

3 5

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users July 2024