[Freeipa-users] Re: upgrade to ubuntu 17.10 fails

[David Harvey]

Ok, thanks for the clarification. Hopefully can still mitigate by changing
platform or waiting for a better supported Ubuntu release!

On 1 Dec 2017 18:40, "Rob Crittenden"  wrote:
> David Harvey via FreeIPA-users wrote:
> > Well that sounds fun :)
> > I'm hesistent to crosspost to [e-mail]
> >  to ask after
> > likelihood of seeing 4.5 in 18.04/Bionic but hope someone here might be
> > able to comment?
> >
> > WRT the exploding CA situation. I guess I'll need to get to a more sane
> > build, or switch over to a better supported rpm based distro if that's
> > not on the cards.. I should be safe in the short term given the standard
> > lifetime of an IPA cert I hope!?
> >
> > I'll continue to try and dig into why pki-tomcat dies on one but not all
> > VMs (ca enabled on 2 of them)
>
> The risk you have isn't with the CA itself expiring but with the support
> certificates (OCSP, audit, subsystem, etc). Those have a 2-year validity
> period.
>
> rob
> > On 1 December 2017 at 13:53, Peter Fern via FreeIPA-users
> > <[e-mail]
> > > wrote:
> > Without installing a system to check, it appears to me that nss-pem
> > is still not packaged for Debian/Ubuntu, which means that certmonger
> > will break on you when it comes time to auto-renew your CAs.
> >
> > I found this out the hard way early this year while running FreeIPA
> > with CA on Ubuntu, and recovery is very painful once your CA certs
> > have expired (actually impossible without compiling nss-pem, which
> > requires some source hacking and compiling of libnss to obtain
> > static libs).
> >
> > Since nss-pem is unlikely to be packaged on Debian/-derivs, it looks
> > to me like until FreeIPA 4.5+ is packaged (where the conversion to
> > OpenSSL has been completed), it is still not safe to run a CA on
>
> Ubuntu.
> > On 01/12/17 23:27, David Harvey via FreeIPA-users wrote:
> > > hi Peter,
> > >
> > > Not a full answer to your questions but from my experience:
> > >
> > > Xenial: Worked, except OTP functionality
> > > Zesty: Worked except for DNS
> > > Artful: Seems fully functional and stable on the fresh installed
> > > replica, my upgraded from Zesty rig (with the workarounds noted
> > > earlier in thread) Still has pki-tomcat bombing fairly frequently.
> > > Bionic: I have high hopes for given LTS.. Currently showing same
> > > package versions
> > > <https://packages.ubuntu.com/search?keywords=freeipa&
>
> searchon=names&suite=bionic&section=all>
> > > 4.4.4 as Artful
> > >
> > > Most of them required some cajoling during install or upgrade due
> > > to broken installer components (like directories not being created
> > > in one case, /etc/pki/pki.version confusing postinstall in
> > > another), but most of these behaviours were captured as bugs too.
> > > It feels very close to being something that can be reliably
> > > deployed, so I don't think it needs a huge amount more TLC to make
> > > it more of a pleasure to install ;)
> > >
> > > Cheers,
> > >
> > > David
> > >
> > > On 28 November 2017 at 20:58, Peter Fern via FreeIPA-users
> > > <[e-mail]
> > > <mailto:[e-mail]>> wrote:
> > >
> > >     On 23/11/17 05:34, David Harvey via FreeIPA-users wrote:
> > >     > Not sure why tomcat is more resilient when launched as root,
> > >     but the
> > >     > pki seems to work ok at issuing certs after the above and a
> > >     reboot for
> > >     > good measure.
> > >
> > >     This sounds like there are broken permissions in the current
> > >     Ubuntu
> > >     packages.  You should be aware that last time I checked,
> > >     FreeIPA on
> > >     Ubuntu was subtly yet severely broken, mostly due to the NSS
>
> libs
> > >     missing PEM support, which will stop your CA from renewing,
> > >     amongst
> > >     other things.
> > >
> > >     Does anyone know what the state of packaging for deb distros is
> > >     currently?  Now that the OpenSSL migration is complete(?), the
> > >     barriers
> > >     to functional packages should be removed, but it looks like
> > >     that only
> > >     happened in 4.5, and it appears only 4.4 is packaged, which is
> > >     likely
> > >     still broken?
> > >     _______________________________________________
> > >     FreeIPA-users mailing list --
> > >     [e-mail]
> > >     <mailto:[e-mail]>
> > >     To unsubscribe send an email to
> > >     [e-mail]
> > >     <mailto:[e-mail]>
> > >
> > >
> > >
> > >
> > > _______________________________________________
> > > FreeIPA-users mailing list -- [e-mail]
> > > <mailto:[e-mail]>
> > > To unsubscribe send an email to freeipa-users-leave@lists.
>
> fedorahosted.org
> > > <mailto:[e-mail]>
> > _______________________________________________
> > FreeIPA-users mailing list -- [e-mail]
> > <mailto:[e-mail]>
> > To unsubscribe send an email to
> > [e-mail]
> > <mailto:[e-mail]>
> >
> >
> >
> >
> > FreeIPA-users mailing list -- [e-mail]
> > To unsubscribe send an email to freeipa-users-leave@lists.
>
> fedorahosted.org
> >