On 31/01/2024 13.28, Bo Lind via FreeIPA-users wrote:
I'm rolling out some servers providing a graphical desktop, and
everything is fine except this: our desktop software of choice is XRDP which needs a
certificate. It ships with a self-signed one, but that gives warnings on the clients, so
I'd much rather go with a FreeIPA managed one.
So after installing XRDP, I issue the command:
ipa-getcert request -f /etc/xrdp/cert.pem -k /etc/xrdp/key.pem -r -w
Problem is, this fails with SELinux enabled, because ipa-getcert is not permitted to
write to /etc/xrdp.
Proposed solution 1: Use a better dir, the certificate and key are configured in
/etc/xrdp/xrdp.conf so I'm guessing certs can reside anywhere. What's a good
default one? Somewhere in /etc/pki?
Yes, use /etc/pki/tls/certs/xrdp.pem and /etc/pki/tls/private/xrdp.key .
The directories /etc/pki/tls/certs and /etc/pki/tls/private are writable
by certmonger.
HTH,
Christian
--
Christian Heimes
Principal Software Engineer, Identity Management and Platform Security
Red Hat
GmbH,https://de.redhat.com/ , Registered seat: Grasbrunn,
Commercial register: Amtsgericht Muenchen, HRB 153243,
Managing Directors: Charles Cachera, Brian Klemm, Laurie Krebs, Michael O'Neill