freeIPA Status Debian/Ubuntu

[Nico Maas]

Hello there,

with the decline of CentOS I need to migrate away from CentOS 8 to something different.
I just wanted to ask how currently the status of the Debian or Ubuntu versions of freeIPA
is - and if there is any possibility to migrate freeIPA installation / "backup and
restore"?

Best regards,

Nico

[LHEUREUX Bernard]

Decline of CentOS ???

-----Message d'origine-----
De : Nico Maas via FreeIPA-users <freeipa-users(a)lists.fedorahosted.org&gt;
Envoyé : mercredi 9 décembre 2020 12:30
À : freeipa-users(a)lists.fedorahosted.org
Cc : Nico Maas <mail(a)nico-maas.de&gt;
Objet : [Freeipa-users] freeIPA Status Debian/Ubuntu

Hello there,

with the decline of CentOS I need to migrate away from CentOS 8 to something different.
I just wanted to ask how currently the status of the Debian or Ubuntu versions of freeIPA
is - and if there is any possibility to migrate freeIPA installation / "backup and
restore"?

Best regards,

Nico
_______________________________________________
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/[e-mail]...
Ce message transmis par voie électronique ainsi que toutes ses annexes contiennent des
informations qui peuvent être confidentielles ou protégées. Ces informations sont
uniquement destinées à l’usage des personnes ou des entités précisées dans les champs ‘A’,
‘Cc’ et ‘Cci’. Si vous n’êtes pas l’un de ces destinataires, soyez conscient que toute
forme, partielle ou complète, de divulgation, copie, distribution ou utilisation de ces
informations est strictement interdite. Si vous avez reçu ce message par erreur, veuillez
nous en informer par téléphone ou par message électronique et détruire les informations
immédiatement. Ce message n’engage que son signataire et aucunement son employeur.

[Jonathan Aquilina]

From what I understand Centos Stream is going to be a rolling distro.

-----Original Message-----
From: LHEUREUX Bernard via FreeIPA-users <freeipa-users(a)lists.fedorahosted.org&gt; 
Sent: 09 December 2020 12:51
To: FreeIPA users list <freeipa-users(a)lists.fedorahosted.org&gt;
Cc: Nico Maas <mail(a)nico-maas.de>; LHEUREUX Bernard
<Bernard.LHEUREUX(a)nethys.be&gt;
Subject: [Freeipa-users] Re: freeIPA Status Debian/Ubuntu

Decline of CentOS ???

-----Message d'origine-----
De : Nico Maas via FreeIPA-users <freeipa-users(a)lists.fedorahosted.org&gt;
Envoyé : mercredi 9 décembre 2020 12:30
À : freeipa-users(a)lists.fedorahosted.org
Cc : Nico Maas <mail(a)nico-maas.de&gt;
Objet : [Freeipa-users] freeIPA Status Debian/Ubuntu

Hello there,

with the decline of CentOS I need to migrate away from CentOS 8 to something different.
I just wanted to ask how currently the status of the Debian or Ubuntu versions of freeIPA
is - and if there is any possibility to migrate freeIPA installation / "backup and
restore"?

Best regards,

Nico
_______________________________________________
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/[e-mail]...
Ce message transmis par voie électronique ainsi que toutes ses annexes contiennent des
informations qui peuvent être confidentielles ou protégées. Ces informations sont
uniquement destinées à l’usage des personnes ou des entités précisées dans les champs ‘A’,
‘Cc’ et ‘Cci’. Si vous n’êtes pas l’un de ces destinataires, soyez conscient que toute
forme, partielle ou complète, de divulgation, copie, distribution ou utilisation de ces
informations est strictement interdite. Si vous avez reçu ce message par erreur, veuillez
nous en informer par téléphone ou par message électronique et détruire les informations
immédiatement. Ce message n’engage que son signataire et aucunement son employeur.
_______________________________________________
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/[e-mail]...

[Timo Aaltonen]

On 9.12.2020 13.30, Nico Maas via FreeIPA-users wrote:
>  Hello there,
>  
>  with the decline of CentOS I need to migrate away from CentOS 8 to something different.
>  I just wanted to ask how currently the status of the Debian or Ubuntu versions of freeIPA
> is - and if there is any possibility to migrate freeIPA installation / "backup and
> restore"?
>  
>  Best regards,
>  
>  Nico 
Hi,

Short answer:

ipaserver-install fails (Debian bug #970880), but client works. Debian 
'bullseye' will be frozen for release next month, so it's likely that it 
comes only with the client, just like Ubuntu since 20.04. But miracles 
could happen during the holidays..

Long answer:

The server worked fine back in April (with bind 9.11 forced in) when I 
set up an Azure pipeline and worked through some kinks there to get 
through the tests. Best coverage I got to was around 95% of all tests. 
But since then things fell apart and I don't have a working baseline 
anymore, and shoving updates on top of others haven't helped.. The 
blocker bug is somewhere between Certmonger, Dogtag CA, Tomcat, and TLS. 
We'll see how long it still takes until the bug is found and fixed..


-- 
t

[Nico Maas]

Thank you for your update and hard work Timo :)!

Am Do., 10. Dez. 2020 um 19:38 Uhr schrieb Timo Aaltonen <
tjaalton(a)ubuntu.com&gt;:

>  On 9.12.2020 13.30, Nico Maas via FreeIPA-users wrote:
>  > Hello there,
>  >
>  > with the decline of CentOS I need to migrate away from CentOS 8 to
>  something different.
>  > I just wanted to ask how currently the status of the Debian or Ubuntu
>  versions of freeIPA is - and if there is any possibility to migrate freeIPA
>  installation / "backup and restore"?
>  >
>  > Best regards,
>  >
>  > Nico
>
>  Hi,
>
>  Short answer:
>
>  ipaserver-install fails (Debian bug #970880), but client works. Debian
>  'bullseye' will be frozen for release next month, so it's likely that it
>  comes only with the client, just like Ubuntu since 20.04. But miracles
>  could happen during the holidays..
>
>  Long answer:
>
>  The server worked fine back in April (with bind 9.11 forced in) when I
>  set up an Azure pipeline and worked through some kinks there to get
>  through the tests. Best coverage I got to was around 95% of all tests.
>  But since then things fell apart and I don't have a working baseline
>  anymore, and shoving updates on top of others haven't helped.. The
>  blocker bug is somewhere between Certmonger, Dogtag CA, Tomcat, and TLS.
>  We'll see how long it still takes until the bug is found and fixed..
>
>
>  --
>  t
>

[Ilya Kogan]

It looks like Bullseye doesn't even have the client, if I'm not mistaken?
After an upgrade, it's telling me that `freeipa-common` is no longer needed
and there's no longer a `freeipa-client` package.
Is there any way to get an idea of what the situation is with this?

Ilya Kogan
w: github.com/ikogan   e:  ikogan(a)mythicnet.org
  <http://twitter.com/ilkogan>    <https://www.linkedin.com/in/ilyakogan/>


On Thu, Dec 10, 2020 at 2:20 PM Nico Maas via FreeIPA-users <
freeipa-users(a)lists.fedorahosted.org&gt; wrote:

>  Thank you for your update and hard work Timo :)!
>
>  Am Do., 10. Dez. 2020 um 19:38 Uhr schrieb Timo Aaltonen <
>  tjaalton(a)ubuntu.com&gt;:
>
> > On 9.12.2020 13.30, Nico Maas via FreeIPA-users wrote:
> > > Hello there,
> > >
> > > with the decline of CentOS I need to migrate away from CentOS 8 to
> > something different.
> > > I just wanted to ask how currently the status of the Debian or Ubuntu
> > versions of freeIPA is - and if there is any possibility to migrate freeIPA
> > installation / "backup and restore"?
> > >
> > > Best regards,
> > >
> > > Nico
> >
> > Hi,
> >
> > Short answer:
> >
> > ipaserver-install fails (Debian bug #970880), but client works. Debian
> > 'bullseye' will be frozen for release next month, so it's likely that it
> > comes only with the client, just like Ubuntu since 20.04. But miracles
> > could happen during the holidays..
> >
> > Long answer:
> >
> > The server worked fine back in April (with bind 9.11 forced in) when I
> > set up an Azure pipeline and worked through some kinks there to get
> > through the tests. Best coverage I got to was around 95% of all tests.
> > But since then things fell apart and I don't have a working baseline
> > anymore, and shoving updates on top of others haven't helped.. The
> > blocker bug is somewhere between Certmonger, Dogtag CA, Tomcat, and TLS.
> > We'll see how long it still takes until the bug is found and fixed..
> >
> >
> > --
> > t
> >
>  _______________________________________________
>  FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>  To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
>  Fedora Code of Conduct:
>  https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>  List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>  List Archives:
>  https://lists.fedorahosted.org/archives/list/[e-mail]...
>

[Nico Maas]

Looks like you're right: https://packages.debian.org/search?keywords=freeipa
Is there any client planned for Bullseye?

Cheers,

Nico

Am So., 5. Sept. 2021 um 22:19 Uhr schrieb Ilya Kogan <ikogan(a)mythicnet.org
> : 
> It looks like Bullseye doesn't even have the client, if I'm not mistaken?
> After an upgrade, it's telling me that `freeipa-common` is no longer needed
> and there's no longer a `freeipa-client` package.
> Is there any way to get an idea of what the situation is with this?
>
> Ilya Kogan
> w: github.com/ikogan   e:  ikogan(a)mythicnet.org
>   <http://twitter.com/ilkogan>   
<https://www.linkedin.com/in/ilyakogan/>
>
>
> On Thu, Dec 10, 2020 at 2:20 PM Nico Maas via FreeIPA-users <
> freeipa-users(a)lists.fedorahosted.org&gt; wrote:
>
>> Thank you for your update and hard work Timo :)!
>>
>> Am Do., 10. Dez. 2020 um 19:38 Uhr schrieb Timo Aaltonen <
>> tjaalton(a)ubuntu.com
> : 
>>
>>> On 9.12.2020 13.30, Nico Maas via FreeIPA-users wrote:
>>> > Hello there,
>>> >
>>> > with the decline of CentOS I need to migrate away from CentOS 8 to
>>> something different.
>>> > I just wanted to ask how currently the status of the Debian or Ubuntu
>>> versions of freeIPA is - and if there is any possibility to migrate freeIPA
>>> installation / "backup and restore"?
>>> >
>>> > Best regards,
>>> >
>>> > Nico
>>>
>>> Hi,
>>>
>>> Short answer:
>>>
>>> ipaserver-install fails (Debian bug #970880), but client works. Debian
>>> 'bullseye' will be frozen for release next month, so it's likely
that it
>>> comes only with the client, just like Ubuntu since 20.04. But miracles
>>> could happen during the holidays..
>>>
>>> Long answer:
>>>
>>> The server worked fine back in April (with bind 9.11 forced in) when I
>>> set up an Azure pipeline and worked through some kinks there to get
>>> through the tests. Best coverage I got to was around 95% of all tests.
>>> But since then things fell apart and I don't have a working baseline
>>> anymore, and shoving updates on top of others haven't helped.. The
>>> blocker bug is somewhere between Certmonger, Dogtag CA, Tomcat, and TLS.
>>> We'll see how long it still takes until the bug is found and fixed..
>>>
>>>
>>> --
>>> t
>>>
>> _______________________________________________
>> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>> To unsubscribe send an email to
>> freeipa-users-leave(a)lists.fedorahosted.org
>> Fedora Code of Conduct:
>> https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>> List Archives:
>>
https://lists.fedorahosted.org/archives/list/[e-mail]...
>>
>

[Harald Dunkel]

On 9/5/21 22:24, Nico Maas via FreeIPA-users wrote:
>  Looks like you're right:
> https://packages.debian.org/search?keywords=freeipa
>  Is there any client planned for Bullseye?
>   
AFAICT: No.

Freeipa is in sid (aka "Unstable"). The current version 4.8.10-2 is easy to
backport to Debian 11 and to store in a private repository. I have asked for
a backport on the debian-backports mailing list.

Ubuntu provides freeipa 4.8.6 and some older versions, but I did not try
these.


Regards

[Timo Aaltonen]

On 6.9.2021 10.48, Harald Dunkel via FreeIPA-users wrote:
>  On 9/5/21 22:24, Nico Maas via FreeIPA-users wrote:
> > Looks like you're right: 
> > https://packages.debian.org/search?keywords=freeipa
> > Is there any client planned for Bullseye?
> >
>  
>  AFAICT: No.
>  
>  Freeipa is in sid (aka "Unstable"). The current version 4.8.10-2 is easy to
>  backport to Debian 11 and to store in a private repository. I have asked 
>  for
>  a backport on the debian-backports mailing list. 
The server install is still broken, and apparently the backports policy 
is to get the package in testing first (meaning, no release critical 
bugs). So the only way to do that is to upload a client-only version to 
sid, then wait for it to migrate to testing, and then backport.




-- 
t

[Ian Willis]

Hi All,

If you're looking for a relatively simple solution the migration to
Rocky linux can be achieved relatively painlessly. We've been kicking
the tyres over the past few months and it fits our use case and Centos8
going forward doesn't. This isn't a shot at either Centos, Redhat or
IBM its a simple statement of fact given the future direction of
Centos.

They have a script for migration and the maintainer is one of the
original creators of Centos which provides a degree of assurance in
terms of project scope and continuity.

While I like Debian, the body of knowledge associated with Redhat based
platforms and relative complexity/fragility of freeIPA would make me
think twice before going down this path. 
That being said, I would like to see a vibrant Debian freeIPA community
however depending upon your use case there may be some issues. 

Regards

Ian

-----Original Message-----
From: Ilya Kogan via FreeIPA-users <
freeipa-users(a)lists.fedorahosted.org&gt;
Reply-To: FreeIPA users list <freeipa-users(a)lists.fedorahosted.org&gt;
To: FreeIPA users list <freeipa-users(a)lists.fedorahosted.org&gt;
Cc: Nico Maas <mail(a)nico-maas.de&gt;, Timo Aaltonen <tjaalton(a)ubuntu.com&gt;,
Ilya Kogan <ikogan(a)mythicnet.org&gt;
Subject: [Freeipa-users] Re: freeIPA Status Debian/Ubuntu
Date: Sun, 5 Sep 2021 16:19:38 -0400

It looks like Bullseye doesn't even have the client, if I'm not
mistaken? After an upgrade, it's telling me that `freeipa-common` is no
longer needed and there's no longer a `freeipa-client` package.Is there
any way to get an idea of what the situation is with this?

Ilya Koganw:github.com/ikogan   e:  ikogan(a)mythicnet.org    


On Thu, Dec 10, 2020 at 2:20 PM Nico Maas via FreeIPA-users <
freeipa-users(a)lists.fedorahosted.org&gt; wrote:
>  Thank you for your update and hard work Timo :)!
>  
>  Am Do., 10. Dez. 2020 um 19:38 Uhr schrieb Timo Aaltonen <
>  tjaalton(a)ubuntu.com&gt;:
>  > On 9.12.2020 13.30, Nico Maas via FreeIPA-users wrote:
>  > 
>  > > Hello there,
>  > 
>  > > 
>  > 
>  > > with the decline of CentOS I need to migrate away from CentOS 8
>  > to something different.
>  > 
>  > > I just wanted to ask how currently the status of the Debian or
>  > Ubuntu versions of freeIPA is - and if there is any possibility to
>  > migrate freeIPA installation / "backup and restore"?
>  > 
>  > > 
>  > 
>  > > Best regards,
>  > 
>  > > 
>  > 
>  > > Nico
>  > 
>  > 
>  > 
>  > Hi,
>  > 
>  > 
>  > 
>  > Short answer:
>  > 
>  > 
>  > 
>  > ipaserver-install fails (Debian bug #970880), but client works.
>  > Debian 
>  > 
>  > 'bullseye' will be frozen for release next month, so it's likely
>  > that it 
>  > 
>  > comes only with the client, just like Ubuntu since 20.04. But
>  > miracles 
>  > 
>  > could happen during the holidays..
>  > 
>  > 
>  > 
>  > Long answer:
>  > 
>  > 
>  > 
>  > The server worked fine back in April (with bind 9.11 forced in)
>  > when I 
>  > 
>  > set up an Azure pipeline and worked through some kinks there to
>  > get 
>  > 
>  > through the tests. Best coverage I got to was around 95% of all
>  > tests. 
>  > 
>  > But since then things fell apart and I don't have a working
>  > baseline 
>  > 
>  > anymore, and shoving updates on top of others haven't helped.. The 
>  > 
>  > blocker bug is somewhere between Certmonger, Dogtag CA, Tomcat, and
>  > TLS. 
>  > 
>  > We'll see how long it still takes until the bug is found and
>  > fixed..
>  > 
>  > 
>  > 
>  > 
>  > 
>  > _______________________________________________FreeIPA-users
>  > mailing list -- freeipa-users(a)lists.fedorahosted.org
>  > To unsubscribe send an email to 
>  > freeipa-users-leave(a)lists.fedorahosted.org
>  > Fedora Code of Conduct: 
>  > https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>  > List Guidelines: 
>  > https://fedoraproject.org/wiki/Mailing_list_guidelines
>  > List Archives: 
>  > https://lists.fedorahosted.org/archives/list/[e-mail]...
>  > Do not reply to spam on the list, report it: 
>  > https://pagure.io/fedora-infrastructure

[Nico Maas]

Dear Ian,
thanks for the infos :)
I did need to migrate to CentOS 8 Stream as it was assured in this group
this would be the best way in the future a few months ago.
Is there an easy way to go from CentOS 8 Stream to Rocky Linux and would
this be the prefered way now?
(I need to have freeIPA running obviously and don't want anything to break
:))

Second question:
We were talking about the Debian Bullseye Client, not freeIPA server.
e.g. how to integrate a Debian Bullseye machine into freeIPA...
With Buster, we had the freeipa-client which was easy to install via apt,
now, it looks like thats not an option anymore... or are we just too early
to the party? :

Cheers

Nico

Am Mo., 6. Sept. 2021 um 02:23 Uhr schrieb Ian Willis <
fedora(a)checksum.net.au&gt;:

>  Hi All,
>
>  If you're looking for a relatively simple solution the migration to Rocky
>  linux can be achieved relatively painlessly. We've been kicking the tyres
>  over the past few months and it fits our use case and Centos8 going forward
>  doesn't. This isn't a shot at either Centos, Redhat or IBM its a simple
>  statement of fact given the future direction of Centos.
>
>  They have a script for migration and the maintainer is one of the original
>  creators of Centos which provides a degree of assurance in terms of project
>  scope and continuity.
>
>  While I like Debian, the body of knowledge associated with Redhat based
>  platforms and relative complexity/fragility of freeIPA would make me think
>  twice before going down this path.
>  That being said, I would like to see a vibrant Debian freeIPA community
>  however depending upon your use case there may be some issues.
>
>  Regards
>
>  Ian
>
>  -----Original Message-----
>  *From*: Ilya Kogan via FreeIPA-users <freeipa-users(a)lists.fedorahosted.org
>  <Ilya%20Kogan%20via%20FreeIPA-users%20%3cfreeipa-users(a)lists.fedorahosted.org%3e&gt;
>  >
>  *Reply-To*: FreeIPA users list <freeipa-users(a)lists.fedorahosted.org
>  <FreeIPA%20users%20list%20%3cfreeipa-users(a)lists.fedorahosted.org%3e&gt;&gt;
>  *To*: FreeIPA users list <freeipa-users(a)lists.fedorahosted.org
>  <FreeIPA%20users%20list%20%3cfreeipa-users(a)lists.fedorahosted.org%3e&gt;&gt;
>  *Cc*: Nico Maas <mail(a)nico-maas.de <Nico%20Maas%20%3cmail(a)nico-maas.de%3e&gt;&gt;,
>  Timo Aaltonen <tjaalton(a)ubuntu.com
>  <Timo%20Aaltonen%20%3ctjaalton(a)ubuntu.com%3e&gt;&gt;, Ilya Kogan <
>  ikogan(a)mythicnet.org <Ilya%20Kogan%20%3cikogan(a)mythicnet.org%3e&gt;&gt;
>  *Subject*: [Freeipa-users] Re: freeIPA Status Debian/Ubuntu
>  *Date*: Sun, 5 Sep 2021 16:19:38 -0400
>
>  It looks like Bullseye doesn't even have the client, if I'm not mistaken?
>  After an upgrade, it's telling me that `freeipa-common` is no longer needed
>  and there's no longer a `freeipa-client` package.
>  Is there any way to get an idea of what the situation is with this?
>
>  Ilya Kogan
>  w: github.com/ikogan   e:  ikogan(a)mythicnet.org
>    <http://twitter.com/ilkogan>    <https://www.linkedin.com/in/ilyakogan/>
>
>
>  On Thu, Dec 10, 2020 at 2:20 PM Nico Maas via FreeIPA-users <
>  freeipa-users(a)lists.fedorahosted.org&gt; wrote:
>
>  Thank you for your update and hard work Timo :)!
>
>  Am Do., 10. Dez. 2020 um 19:38 Uhr schrieb Timo Aaltonen <
>  tjaalton(a)ubuntu.com&gt;:
>
>  On 9.12.2020 13.30, Nico Maas via FreeIPA-users wrote:
>  > Hello there,
>  >
>  > with the decline of CentOS I need to migrate away from CentOS 8 to
>  something different.
>  > I just wanted to ask how currently the status of the Debian or Ubuntu
>  versions of freeIPA is - and if there is any possibility to migrate freeIPA
>  installation / "backup and restore"?
>  >
>  > Best regards,
>  >
>  > Nico
>
>  Hi,
>
>  Short answer:
>
>  ipaserver-install fails (Debian bug #970880), but client works. Debian
>  'bullseye' will be frozen for release next month, so it's likely that it
>  comes only with the client, just like Ubuntu since 20.04. But miracles
>  could happen during the holidays..
>
>  Long answer:
>
>  The server worked fine back in April (with bind 9.11 forced in) when I
>  set up an Azure pipeline and worked through some kinks there to get
>  through the tests. Best coverage I got to was around 95% of all tests.
>  But since then things fell apart and I don't have a working baseline
>  anymore, and shoving updates on top of others haven't helped.. The
>  blocker bug is somewhere between Certmonger, Dogtag CA, Tomcat, and TLS.
>  We'll see how long it still takes until the bug is found and fixed..
>
>
>  _______________________________________________
>
>  FreeIPA-users mailing list --
>
>  freeipa-users(a)lists.fedorahosted.org
>
>
>  To unsubscribe send an email to
>
>  freeipa-users-leave(a)lists.fedorahosted.org
>
>
>  Fedora Code of Conduct:
>
>  https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>
>
>  List Guidelines:
>
>  https://fedoraproject.org/wiki/Mailing_list_guidelines
>
>
>  List Archives:
>
>  https://lists.fedorahosted.org/archives/list/[e-mail]...
>
>
>  Do not reply to spam on the list, report it:
>
>  https://pagure.io/fedora-infrastructure
>
>
>

[Antoine Gatineau]

On Mon, 2021-09-06 at 07:52 +0200, Nico Maas via FreeIPA-users wrote:
>  Dear Ian,
>  thanks for the infos :)
>  I did need to migrate to CentOS 8 Stream as it was assured in this group this would be
> the best way in the future a few months ago.
>  Is there an easy way to go from CentOS 8 Stream to Rocky Linux and would this be the
> prefered way now?
>  (I need to have freeIPA running obviously and don't want anything to break :))
From what I have seen, packages are built in centos stream only once at the begining
of a release cycle (ie: 8.4 8.5 etc...). Then there is
no activity until the next release cycle.
Migration from Stream to rocky or any other rhel clone would be tricky as Stream is
ahead.

>  
>  Second question:
>  We were talking about the Debian Bullseye Client, not freeIPA server.
>  e.g. how to integrate a Debian Bullseye machine into freeIPA...
>  With Buster, we had the freeipa-client which was easy to install via apt, now, it looks
> like thats not an option anymore... or are we just
>  too early to the party? :
>   
Hi,

At the moment, freeipa-client is blocked because of building issues on the server part.
freeipa server and client are part of the same
source package.
IIRC it was the same when buster came out and freeipa-client was included later on.

However, freeipa-client is available in sid. It is possible to install just those packages
from sid. (haven't tried that yet).

Regards,
Antoine

>  Cheers
>  
>  Nico
>  
>  Am Mo., 6. Sept. 2021 um 02:23 Uhr schrieb Ian Willis <fedora(a)checksum.net.au&gt;:
>  > Hi All,
>  > 
>  > If you're looking for a relatively simple solution the migration to Rocky linux
> can be achieved relatively painlessly. We've been
>  > kicking the tyres over the past few months and it fits our use case and Centos8
> going forward doesn't. This isn't a shot at either
>  > Centos, Redhat or IBM its a simple statement of fact given the future direction of
> Centos.
>  > 
>  > They have a script for migration and the maintainer is one of the original creators
> of Centos which provides a degree of assurance in
>  > terms of project scope and continuity.
>  > 
>  > While I like Debian, the body of knowledge associated with Redhat based platforms
> and relative complexity/fragility of freeIPA would
>  > make me think twice before going down this path. 
>  > That being said, I would like to see a vibrant Debian freeIPA community however
> depending upon your use case there may be some issues. 
>  > 
>  > Regards
>  > 
>  > Ian
>  > 
>  > -----Original Message-----
>  > From: Ilya Kogan via FreeIPA-users <freeipa-users(a)lists.fedorahosted.org&gt;
>  > Reply-To: FreeIPA users list <freeipa-users(a)lists.fedorahosted.org&gt;
>  > To: FreeIPA users list <freeipa-users(a)lists.fedorahosted.org&gt;
>  > Cc: Nico Maas <mail(a)nico-maas.de&gt;, Timo Aaltonen <tjaalton(a)ubuntu.com&gt;,
> Ilya Kogan <ikogan(a)mythicnet.org&gt;
>  > Subject: [Freeipa-users] Re: freeIPA Status Debian/Ubuntu
>  > Date: Sun, 5 Sep 2021 16:19:38 -0400
>  > 
>  > It looks like Bullseye doesn't even have the client, if I'm not mistaken?
> After an upgrade, it's telling me that `freeipa-common` is no
>  > longer needed and there's no longer a `freeipa-client` package.
>  > Is there any way to get an idea of what the situation is with this?
>  > 
>  > Ilya Kogan w: github.com/ikogan   e:  [e-mail]      
>  > 
>  > 
>  > On Thu, Dec 10, 2020 at 2:20 PM Nico Maas via FreeIPA-users
> <freeipa-users(a)lists.fedorahosted.org&gt; wrote:
>  > > Thank you for your update and hard work Timo :)!
>  > > 
>  > > Am Do., 10. Dez. 2020 um 19:38 Uhr schrieb Timo Aaltonen
> <tjaalton(a)ubuntu.com&gt;:
>  > > > On 9.12.2020 13.30, Nico Maas via FreeIPA-users wrote:
>  > > > > Hello there,
>  > > > > 
>  > > > > with the decline of CentOS I need to migrate away from CentOS 8 to
> something different.
>  > > > > I just wanted to ask how currently the status of the Debian or Ubuntu
> versions of freeIPA is - and if there is any possibility to
>  > > > > migrate freeIPA installation / "backup and restore"?
>  > > > > 
>  > > > > Best regards,
>  > > > > 
>  > > > > Nico
>  > > > 
>  > > > Hi,
>  > > > 
>  > > > Short answer:
>  > > > 
>  > > > ipaserver-install fails (Debian bug #970880), but client works. Debian 
>  > > > 'bullseye' will be frozen for release next month, so it's
> likely that it 
>  > > > comes only with the client, just like Ubuntu since 20.04. But miracles 
>  > > > could happen during the holidays..
>  > > > 
>  > > > Long answer:
>  > > > 
>  > > > The server worked fine back in April (with bind 9.11 forced in) when I 
>  > > > set up an Azure pipeline and worked through some kinks there to get 
>  > > > through the tests. Best coverage I got to was around 95% of all tests. 
>  > > > But since then things fell apart and I don't have a working baseline 
>  > > > anymore, and shoving updates on top of others haven't helped.. The 
>  > > > blocker bug is somewhere between Certmonger, Dogtag CA, Tomcat, and TLS. 
>  > > > We'll see how long it still takes until the bug is found and fixed..
>  > > > 
>  > > > 
>  > > > _______________________________________________
>  > > > FreeIPA-users mailing list -- 
>  > > > freeipa-users(a)lists.fedorahosted.org
>  > > > 
>  > > > To unsubscribe send an email to 
>  > > > freeipa-users-leave(a)lists.fedorahosted.org
>  > > > 
>  > > > Fedora Code of Conduct: 
>  > > > https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>  > > > 
>  > > > List Guidelines: 
>  > > > https://fedoraproject.org/wiki/Mailing_list_guidelines
>  > > > 
>  > > > List Archives: 
>  > > >
> https://lists.fedorahosted.org/archives/list/[e-mail]...
>  > > > 
>  > > > Do not reply to spam on the list, report it: 
>  > > > https://pagure.io/fedora-infrastructure
>  > > > 
>  _______________________________________________
>  FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>  To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
>  Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>  List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>  List Archives:
> https://lists.fedorahosted.org/archives/list/[e-mail]...
>  Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure

[Alexander Bokovoy]

On ma, 06 syys 2021, Antoine Gatineau via FreeIPA-users wrote:
> On Mon, 2021-09-06 at 07:52 +0200, Nico Maas via FreeIPA-users wrote:
> > Dear Ian,
> > thanks for the infos :)
> > I did need to migrate to CentOS 8 Stream as it was assured in this group this would
> be the best way in the future a few months ago.
> > Is there an easy way to go from CentOS 8 Stream to Rocky Linux and would this be the
> prefered way now?
> > (I need to have freeIPA running obviously and don't want anything to break :))
> From what I have seen, packages are built in centos stream only once at the begining of a
> release cycle (ie: 8.4 8.5 etc...). Then there is
> no activity until the next release cycle. 
I don't think this reflects a reality we have. Remember that Stream
tracks next version to be released. This means it is always updated when
next version development is in progress. There is a slight inversion
between 9 Stream and 8 Stream for historical reasons: 9 Stream git
repos updated first, then packages built in both CentOS 9 Stream and
RHEL 9 development branch, then QA process runs on both and once RHEL QA
process allows to gate the builds through, both RHEL and CentOS Stream
composes get updated -- all this automatically. In CentOS 8 Stream
situation is reverted: RHEL 8 git is updated first, then builds for RHEL
run through QA process and once they succeed through the gating and
appear in the composes, CentOS 8 Stream git gets updated and packages
get built -- all this manually. That's a historical thing since with
Stream the real process change is happening in 9.

What we see in https://git.centos.org/rpms/ipa/commits/c8s-stream-DL1,
sadly, is that somehow it misses quite a number of updates in RHEL 8
development that happened through the summer. I'll ask CentOS people to
sync-up the 8 Stream, if possible.

Anyway, I do not see how changing to Rocky Linux or anything else based
off CentOS [Stream] would help to bring a new version of IPA into them
since all of those are using the same git.centos.org for 8.x. These
downstreams are aiming for package-level and binary compatibility with
RHEL, after all.


> > Second question:
> > We were talking about the Debian Bullseye Client, not freeIPA server.
> > e.g. how to integrate a Debian Bullseye machine into freeIPA...
> > With Buster, we had the freeipa-client which was easy to install via apt, now, it
> looks like thats not an option anymore... or are we just
> > too early to the party? :
> >
> Hi,
>
> At the moment, freeipa-client is blocked because of building issues on
> the server part. freeipa server and client are part of the same source
> package.  IIRC it was the same when buster came out and freeipa-client
> was included later on.
>
> However, freeipa-client is available in sid. It is possible to install
> just those packages from sid. (haven't tried that yet). 
Anyone who wants to have FreeIPA in Debian/Ubuntu needs to focus on
helping Timo Aaltonen with the packaging and integration work. A
distribution integration is not just 'get the package and compile'. I
did a talk about it at FOSDEM 2019:
https://archive.fosdem.org/2019/schedule/event/freeipa_cross_distrbution_...

> Regards,
> Antoine
>
> > Cheers
> >
> > Nico
> >
> > Am Mo., 6. Sept. 2021 um 02:23 Uhr schrieb Ian Willis
> <fedora(a)checksum.net.au&gt;:
> > > Hi All,
> > >
> > > If you're looking for a relatively simple solution the migration to Rocky
> linux can be achieved relatively painlessly. We've been
> > > kicking the tyres over the past few months and it fits our use case and Centos8
> going forward doesn't. This isn't a shot at either
> > > Centos, Redhat or IBM its a simple statement of fact given the future direction
> of Centos.
> > >
> > > They have a script for migration and the maintainer is one of the original
> creators of Centos which provides a degree of assurance in
> > > terms of project scope and continuity.
> > >
> > > While I like Debian, the body of knowledge associated with Redhat based
> platforms and relative complexity/fragility of freeIPA would
> > > make me think twice before going down this path. 
> > > That being said, I would like to see a vibrant Debian freeIPA community however
> depending upon your use case there may be some issues.
> > >
> > > Regards
> > >
> > > Ian
> > >
> > > -----Original Message-----
> > > From: Ilya Kogan via FreeIPA-users <freeipa-users(a)lists.fedorahosted.org&gt;
> > > Reply-To: FreeIPA users list <freeipa-users(a)lists.fedorahosted.org&gt;
> > > To: FreeIPA users list <freeipa-users(a)lists.fedorahosted.org&gt;
> > > Cc: Nico Maas <mail(a)nico-maas.de&gt;, Timo Aaltonen
> <tjaalton(a)ubuntu.com&gt;, Ilya Kogan <ikogan(a)mythicnet.org&gt;
> > > Subject: [Freeipa-users] Re: freeIPA Status Debian/Ubuntu
> > > Date: Sun, 5 Sep 2021 16:19:38 -0400
> > >
> > > It looks like Bullseye doesn't even have the client, if I'm not
> mistaken? After an upgrade, it's telling me that `freeipa-common` is no
> > > longer needed and there's no longer a `freeipa-client` package.
> > > Is there any way to get an idea of what the situation is with this?
> > >
> > > Ilya Kogan w: github.com/ikogan   e:  [e-mail]     
> > >
> > >
> > > On Thu, Dec 10, 2020 at 2:20 PM Nico Maas via FreeIPA-users
> <freeipa-users(a)lists.fedorahosted.org&gt; wrote:
> > > > Thank you for your update and hard work Timo :)!
> > > >
> > > > Am Do., 10. Dez. 2020 um 19:38 Uhr schrieb Timo Aaltonen
> <tjaalton(a)ubuntu.com&gt;:
> > > > > On 9.12.2020 13.30, Nico Maas via FreeIPA-users wrote:
> > > > > > Hello there,
> > > > > >
> > > > > > with the decline of CentOS I need to migrate away from CentOS 8
> to something different.
> > > > > > I just wanted to ask how currently the status of the Debian or
> Ubuntu versions of freeIPA is - and if there is any possibility to
> > > > > > migrate freeIPA installation / "backup and restore"?
> > > > > >
> > > > > > Best regards,
> > > > > >
> > > > > > Nico
> > > > >
> > > > > Hi,
> > > > >
> > > > > Short answer:
> > > > >
> > > > > ipaserver-install fails (Debian bug #970880), but client works.
> Debian
> > > > > 'bullseye' will be frozen for release next month, so it's
> likely that it
> > > > > comes only with the client, just like Ubuntu since 20.04. But
> miracles
> > > > > could happen during the holidays..
> > > > >
> > > > > Long answer:
> > > > >
> > > > > The server worked fine back in April (with bind 9.11 forced in) when
> I
> > > > > set up an Azure pipeline and worked through some kinks there to get
> > > > > through the tests. Best coverage I got to was around 95% of all
> tests.
> > > > > But since then things fell apart and I don't have a working
> baseline
> > > > > anymore, and shoving updates on top of others haven't helped..
> The
> > > > > blocker bug is somewhere between Certmonger, Dogtag CA, Tomcat, and
> TLS.
> > > > > We'll see how long it still takes until the bug is found and
> fixed..
> > > > >
> > > > >
> > > > > _______________________________________________
> > > > > FreeIPA-users mailing list --
> > > > > freeipa-users(a)lists.fedorahosted.org
> > > > >
> > > > > To unsubscribe send an email to
> > > > > freeipa-users-leave(a)lists.fedorahosted.org
> > > > >
> > > > > Fedora Code of Conduct:
> > > > > https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> > > > >
> > > > > List Guidelines:
> > > > > https://fedoraproject.org/wiki/Mailing_list_guidelines
> > > > >
> > > > > List Archives:
> > > > >
> https://lists.fedorahosted.org/archives/list/[e-mail]...
> > > > >
> > > > > Do not reply to spam on the list, report it:
> > > > > https://pagure.io/fedora-infrastructure
> > > > >
> > _______________________________________________
> > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> > To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
> > Fedora Code of Conduct:
> https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> > List Archives:
> https://lists.fedorahosted.org/archives/list/[e-mail]...
> > Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure
>
>
>
> _______________________________________________
> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
> https://lists.fedorahosted.org/archives/list/[e-mail]...
> Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure


-- 
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland

[Alexander Bokovoy]

On ma, 06 syys 2021, Alexander Bokovoy via FreeIPA-users wrote:
> On ma, 06 syys 2021, Antoine Gatineau via FreeIPA-users wrote:
> >On Mon, 2021-09-06 at 07:52 +0200, Nico Maas via FreeIPA-users wrote:
> >>Dear Ian,
> >>thanks for the infos :)
> >>I did need to migrate to CentOS 8 Stream as it was assured in this group this
> would be the best way in the future a few months ago.
> >>Is there an easy way to go from CentOS 8 Stream to Rocky Linux and would this be
> the prefered way now?
> >>(I need to have freeIPA running obviously and don't want anything to break
> :))
> >From what I have seen, packages are built in centos stream only once at the begining
> of a release cycle (ie: 8.4 8.5 etc...). Then there is
> >no activity until the next release cycle.
>
> I don't think this reflects a reality we have. Remember that Stream
> tracks next version to be released. This means it is always updated when
> next version development is in progress. There is a slight inversion
> between 9 Stream and 8 Stream for historical reasons: 9 Stream git
> repos updated first, then packages built in both CentOS 9 Stream and
> RHEL 9 development branch, then QA process runs on both and once RHEL QA
> process allows to gate the builds through, both RHEL and CentOS Stream
> composes get updated -- all this automatically. In CentOS 8 Stream
> situation is reverted: RHEL 8 git is updated first, then builds for RHEL
> run through QA process and once they succeed through the gating and
> appear in the composes, CentOS 8 Stream git gets updated and packages
> get built -- all this manually. That's a historical thing since with
> Stream the real process change is happening in 9.
>
> What we see in https://git.centos.org/rpms/ipa/commits/c8s-stream-DL1,
> sadly, is that somehow it misses quite a number of updates in RHEL 8
> development that happened through the summer. I'll ask CentOS people to
> sync-up the 8 Stream, if possible. 
git.centos.org was updated to include a recent RHEL 8.5 development build
sources for the build that passed RHEL QA process:
https://git.centos.org/rpms/ipa/c/b1d4275a7802984346fd6978b967731997ca488...
It is referenced in the recent idm:DL1 module stream commit:
https://git.centos.org/modules/idm/c/24193e615b839395dc094d396aad4918d143...

I can see 4.9.6-4 in
http://mirror.centos.org/centos/8-stream/AppStream/x86_64/os/Packages/ipa...
so looks like it was built yesterday and is now available through the 8
Stream's repositories.


-- 
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland

[Angus Clarke]

AFAIK Oracle still produce RHEL based Linux releases for free, however I haven't yet
migrated to EL8.

Regards
Angus

________________________________
From: Nico Maas via FreeIPA-users <freeipa-users(a)lists.fedorahosted.org&gt;
Sent: 06 September 2021 07:52
To: Ian Willis <fedora(a)checksum.net.au&gt;
Cc: FreeIPA users list <freeipa-users(a)lists.fedorahosted.org>; Timo Aaltonen
<tjaalton(a)ubuntu.com>; Nico Maas <mail(a)nico-maas.de>; Ilya Kogan
<ikogan(a)mythicnet.org&gt;
Subject: [Freeipa-users] Re: freeIPA Status Debian/Ubuntu

Dear Ian,
thanks for the infos :)
I did need to migrate to CentOS 8 Stream as it was assured in this group this would be the
best way in the future a few months ago.
Is there an easy way to go from CentOS 8 Stream to Rocky Linux and would this be the
prefered way now?
(I need to have freeIPA running obviously and don't want anything to break :))

Second question:
We were talking about the Debian Bullseye Client, not freeIPA server.
e.g. how to integrate a Debian Bullseye machine into freeIPA...
With Buster, we had the freeipa-client which was easy to install via apt, now, it looks
like thats not an option anymore... or are we just too early to the party? :

Cheers

Nico

Am Mo., 6. Sept. 2021 um 02:23 Uhr schrieb Ian Willis
<[e-mail]<mailto:[e-mail]>>:
Hi All,

If you're looking for a relatively simple solution the migration to Rocky linux can be
achieved relatively painlessly. We've been kicking the tyres over the past few months
and it fits our use case and Centos8 going forward doesn't. This isn't a shot at
either Centos, Redhat or IBM its a simple statement of fact given the future direction of
Centos.

They have a script for migration and the maintainer is one of the original creators of
Centos which provides a degree of assurance in terms of project scope and continuity.

While I like Debian, the body of knowledge associated with Redhat based platforms and
relative complexity/fragility of freeIPA would make me think twice before going down this
path.
That being said, I would like to see a vibrant Debian freeIPA community however depending
upon your use case there may be some issues.

Regards

Ian

-----Original Message-----
From: Ilya Kogan via FreeIPA-users
<[e-mail]<mailto:[e-mail]%3e>>
Reply-To: FreeIPA users list
<[e-mail]<mailto:[e-mail]%3e>>
To: FreeIPA users list
<[e-mail]<mailto:[e-mail]%3e>>
Cc: Nico Maas
<[e-mail]<mailto:[e-mail]%3e>>, Timo
Aaltonen
<[e-mail]<mailto:[e-mail]%3e>>,
Ilya Kogan
<[e-mail]<mailto:[e-mail]%3e>>
Subject: [Freeipa-users] Re: freeIPA Status Debian/Ubuntu
Date: Sun, 5 Sep 2021 16:19:38 -0400

It looks like Bullseye doesn't even have the client, if I'm not mistaken? After an
upgrade, it's telling me that `freeipa-common` is no longer needed and there's no
longer a `freeipa-client` package.
Is there any way to get an idea of what the situation is with this?

[http://www.gravatar.com/avatar/a35eac7a03cfc0049f13ff2d3e7a4a7f]
Ilya Kogan
w:     
github.com/ikogan<https://emea01.safelinks.protection.outlook.com/?url...
  e:  [e-mail]<mailto:[e-mail]>
[http://cdn2.hubspot.net/hubfs/184235/dev_images/signature_app/twitter_sig...]
<https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Ftwitter...
   [http://cdn2.hubspot.net/hubfs/184235/dev_images/signature_app/linkedin_si...]
<https://emea01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.li...


On Thu, Dec 10, 2020 at 2:20 PM Nico Maas via FreeIPA-users
<[e-mail]<mailto:[e-mail]>>
wrote:
Thank you for your update and hard work Timo :)!

Am Do., 10. Dez. 2020 um 19:38 Uhr schrieb Timo Aaltonen
<[e-mail]<mailto:[e-mail]>>:
On 9.12.2020 13.30, Nico Maas via FreeIPA-users wrote:
>  Hello there,
>
>  with the decline of CentOS I need to migrate away from CentOS 8 to something different.
>  I just wanted to ask how currently the status of the Debian or Ubuntu versions of freeIPA
> is - and if there is any possibility to migrate freeIPA installation / "backup and
> restore"?
>
>  Best regards,
>
>  Nico 
Hi,

Short answer:

ipaserver-install fails (Debian bug #970880), but client works. Debian
'bullseye' will be frozen for release next month, so it's likely that it
comes only with the client, just like Ubuntu since 20.04. But miracles
could happen during the holidays..

Long answer:

The server worked fine back in April (with bind 9.11 forced in) when I
set up an Azure pipeline and worked through some kinks there to get
through the tests. Best coverage I got to was around 95% of all tests.
But since then things fell apart and I don't have a working baseline
anymore, and shoving updates on top of others haven't helped.. The
blocker bug is somewhere between Certmonger, Dogtag CA, Tomcat, and TLS.
We'll see how long it still takes until the bug is found and fixed..



_______________________________________________

FreeIPA-users mailing list --

<mailto:[e-mail]>

freeipa-users(a)lists.fedorahosted.org


To unsubscribe send an email to

<mailto:[e-mail]>

freeipa-users-leave(a)lists.fedorahosted.org


Fedora Code of Conduct:

<https://emea01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdocs.f...

https://docs.fedoraproject.org/en-US/project/code-of-conduct/


List Guidelines:

<https://emea01.safelinks.protection.outlook.com/?url=https%3A%2F%2Ffedora...

https://fedoraproject.org/wiki/Mailing_list_guidelines


List Archives:

<https://emea01.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists....

https://lists.fedorahosted.org/archives/list/[e-mail]...


Do not reply to spam on the list, report it:

<https://emea01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fpagure...

https://pagure.io/fedora-infrastructure