Multiboot and FreeIPA

[Pascal Ernster]

Hi,


is it possible to use multiple operating systems (for example different
versions of Fedora and CentOS) at the same time on one and the same
computer, with the same IP address/hostname, with all of these OS
installations being valid FreeIPA clients at the same time?

Could this cause problems as every operating system gets its own
Kerberos TGT, its own SSH host keys, LDAP entries, etc?

In case it matters: I'm using the FreeIPA packages from the official
distro repos, which means that different OS installations may have
differing versions of the FreeIPA client and its dependency packages.

The use case would be a (hopefully) seamless distro upgrade, with an
easy fallback option for users if they experience problems with the new
distro release.


Regards
Pascal

[Alexander Bokovoy]

On ti, 07 marras 2017, Pascal Ernster via FreeIPA-users wrote:
> Hi,
>
>
> is it possible to use multiple operating systems (for example different
> versions of Fedora and CentOS) at the same time on one and the same
> computer, with the same IP address/hostname, with all of these OS
> installations being valid FreeIPA clients at the same time?
>
> Could this cause problems as every operating system gets its own
> Kerberos TGT, its own SSH host keys, LDAP entries, etc?
>
> In case it matters: I'm using the FreeIPA packages from the official
> distro repos, which means that different OS installations may have
> differing versions of the FreeIPA client and its dependency packages.
>
> The use case would be a (hopefully) seamless distro upgrade, with an
> easy fallback option for users if they experience problems with the new
> distro release. 
If they all have the same hostname, you are better to enroll and
share
keytab across all configurations. To do so, enroll first time and then
specify /etc/krb5.keytab from that installation with ipa-client-install
-k option. See ipa-client-install man page for more details.
-- 
/ Alexander Bokovoy

[Pascal Ernster]

[2017-11-07 14:50] Alexander Bokovoy via FreeIPA-users:
>  If they all have the same hostname, you are better to enroll and
> share
>  keytab across all configurations. To do so, enroll first time and then
>  specify /etc/krb5.keytab from that installation with ipa-client-install
>  -k option. See ipa-client-install man page for more details. 
Thanks for the advice. Would the kerberos keytab and the SSH host keys 
be the only possible/likely causes for problems?

Please note that I run FreeIPA with external nameservers, on which I 
added the necessary DNS entries for the FreeIPA servers manually. The 
FreeIPA client machines only have their respective A/AAAA records (and 
the corresponding reverse DNS records, of course).


Regards
Pascal

[Pascal Ernster]

[2017-11-07 14:50] Alexander Bokovoy via FreeIPA-users:
>  If they all have the same hostname, you are better to enroll and
> share
>  keytab across all configurations. To do so, enroll first time and then
>  specify /etc/krb5.keytab from that installation with ipa-client-install
>  -k option. See ipa-client-install man page for more details. 
Thanks for the advice. Would the kerberos keytab and the SSH host keys
be the only possible/likely causes for problems?

Please note that I run FreeIPA with external nameservers, on which I
added the necessary DNS entries for the FreeIPA servers manually. The
FreeIPA client machines only have their respective A/AAAA records (and
the corresponding reverse DNS records, of course).


Regards
Pascal

[Pascal Ernster]

[2017-11-07 14:50] Alexander Bokovoy via FreeIPA-users:
>  If they all have the same hostname, you are better to enroll and
> share
>  keytab across all configurations. To do so, enroll first time and then
>  specify /etc/krb5.keytab from that installation with ipa-client-install
>  -k option. See ipa-client-install man page for more details. 
Thanks for the advice. Would the kerberos keytab and the SSH host keys
be the only possible/likely causes for problems?

Please note that I run FreeIPA with external nameservers, on which I
added the necessary DNS entries for the FreeIPA servers manually. The
FreeIPA client machines only have their respective A/AAAA records (and
the corresponding reverse DNS records, of course).


Regards
Pascal

[Pascal Ernster]

Please disregard this message/subthread. I used the wrong envelope
sender due to a bug in my mail client.

[Pascal Ernster]

Please disregard this message/subthread. I used the wrong envelope
sender due to a typo.

[Alexander Bokovoy]

On ke, 08 marras 2017, Pascal Ernster via FreeIPA-users wrote:
> [2017-11-07 14:50] Alexander Bokovoy via FreeIPA-users:
> > If they all have the same hostname, you are better to enroll and share
> > keytab across all configurations. To do so, enroll first time and then
> > specify /etc/krb5.keytab from that installation with ipa-client-install
> > -k option. See ipa-client-install man page for more details.
>
> Thanks for the advice. Would the kerberos keytab and the SSH host keys
> be the only possible/likely causes for problems? 
The only thing that would be common
to all these machines is LDAP object
for the machine. It is indexed by the hostname, so having the same
hostname means sharing that LDAP object and all its attributes,
including Kerberos key.

You can have multiple SSHFP entries for the same host, this is normal.

> Please note that I run FreeIPA with external nameservers, on which I
> added the necessary DNS entries for the FreeIPA servers manually. The
> FreeIPA client machines only have their respective A/AAAA records (and
> the corresponding reverse DNS records, of course). 
How DNS is managed is irrelevant
here.

-- 
/ Alexander Bokovoy