October 2019 - FreeIPA-users - Fedora mailing-lists

ca-certificate file not being parses correctly on Ubuntu with p11-kit-trust.so due to data inserted by FreeIPA Client install
by Kevin Vasko 28 Oct '19

28 Oct '19

Mainly looking for input on where to file a bug I think I found in p11-kit-trust.so but potentially caused by the FreeIPA client install process on Ubuntu. I have been trying to figure out a way of getting Ubuntu to load the system wide certs like CentOS/Fedora does. Alexander helped me troubleshoot my issues on CentOS/Fedora and those system work out of the box (after I fixed my mistake https://www.mail-archive.com/freeipa-users@lists.fedorahosted.org/msg07903.…). However, on Ubuntu you have to take it a slight step further by using the p11-kit-trust.so manually it seems. I found this link https://bugs.launchpad.net/ubuntu/+source/ca-certificates/+bug/1647285 that has a bug report that states you can just symlink the p11-kit-trust.so to the /usr/lib/x86_64-linux-gnu/nss/libnssckbi.so https://superuser.com/a/1312419/411058and it would “just work”. Unfortunately, I was having trouble figuring out how to get it to work. I spent a couple days or so troubleshooting and trying to figure out why it wasn’t working. Once I would do the symlink to the p11-kit-trust.so, no certificates _at all_ would load in any browser (chome/firefox). If I removed the symlink and put the libnssckbi.so file the browsers would go back to loading the static system wide certs (obviously the certs I included wouldn’t work). Eventually I ran across this documentation from p11-kit to find out how to debug p11-kit. https://p11-glue.github.io/p11-glue/trust-module.html I ran P11_KIT_DEBUG=all firefox With that log output I finally found something to point me in the correct direction. Based on this log it seems like p11-kit is having issues parsing the ca-certificates.crt file. $ P11_KIT_DEBUG=all firefox (p11-kit:10001) p11_library_init_impl: initializing library (p11-kit:10001) uninit_common: uninitializing library (p11-kit:10057) p11_library_init_impl: initializing library (p11-kit:10057) uninit_common: uninitializing library (p11-kit:10001) p11_library_init_impl: initializing library (p11-kit:10001) sys_C_Initialize: in (p11-kit:10001) sys_C_Initialize: doing initialization (p11-kit:10001) create_tokens_inlock: using paths: /etc/ssl/certs/ca-certificates.crt (p11-kit:10001) p11_token_new: token: System Trust: /etc/ssl/certs/ca-certificates.crt (p11-kit:10001) sys_C_Initialize: out: 0x0 (p11-kit:10001) sys_C_GetInfo: in (p11-kit:10001) sys_C_GetInfo: out: 0x0 (p11-kit:10001) sys_C_GetSlotList: in (p11-kit:10001) sys_C_GetSlotList: out: 0x0 (p11-kit:10001) sys_C_GetSlotList: in (p11-kit:10001) sys_C_GetSlotList: out: 0x0 (p11-kit:10001) sys_C_GetSlotInfo: in (p11-kit:10001) sys_C_GetSlotInfo: out: 0x0 (p11-kit:10001) sys_C_GetTokenInfo: in (p11-kit:10001) sys_C_GetTokenInfo: out: 0x0 (p11-kit:10001) sys_C_GetMechanismList: in (p11-kit:10001) sys_C_GetMechanismList: out: 0x0 (p11-kit:10001) sys_C_GetMechanismList: in (p11-kit:10001) sys_C_GetMechanismList: out: 0x0 (p11-kit:10001) sys_C_OpenSession: in (p11-kit:10001) sys_C_OpenSession: session: 17 (p11-kit:10001) sys_C_OpenSession: out: 0x0 (p11-kit:10001) sys_C_FindObjectsInit: in: 17, (1) [ { CKA_CLASS = CKO_NSS_BUILTIN_ROOT_LIST } ] (p11-kit:10001) message: ca-certificates.crt: BEGIN ...: pem block before p11-kit section header (p11-kit:10001) loader_load_file: failed to parse: /etc/ssl/certs/ca-certificates.crt (p11-kit:10001) sys_C_FindObjectsInit: out: 0x0 (p11-kit:10001) sys_C_FindObjects: in: 17, 1 (p11-kit:10001) sys_C_FindObjects: out: 0x11, 1 (p11-kit:10001) sys_C_FindObjectsFinal: in (p11-kit:10001) sys_C_FindObjectsFinal: out: 0x0 I looked at the ca-certificates.crt file Nothing looked abnormal until I saw this… ----previous part of ca-certificates.crt---- # This file was created by IPA. Do not edit. [p11-kit-object-v1] class: certificate certificate-type: x-509 certificate-category: authority label: <removed> subject: ": <removed>" issuer: ": <removed>" serial-number: “<removed>" x-public-key-info: ": <removed>" trusted: true ------BEGIN CERTIFICATE------ ….. ----rest of ca-certificates.crt ---- Once I removed the section above the “…BEGIN CERTIFICATE…” and after the prior “----END CERTIFICATE----“ everything started working properly. I put it back and things broke again. So this indicates that p11-kit-trust.so isn’t parsing the ca-certificate.crt file due to the information that the FreeIPA client install put into the file. I am using the latest version that comes with Ubuntu 18.04 of p11-kit-trust (0.23). So my question is, should this be a bug report to Ubuntu’s implementation of the FreeIPA client install that adds the certificate information or should I file a bug report against the p11-kit module to have them fix the parsing issue? Any thoughts/suggestions? -Kevin

2 2

IPA ocsp responder cert
by Sandor Juhasz 28 Oct '19

28 Oct '19

Hi, we are running freeipa server 4.6.5. Facing the issue, where the ocsp responder in the Server-Cert is set to Name: Authority Information Access Method: PKIX Online Certificate Status Protocol Location: URI: "http://ipa-ca.bpo.cxn/ca/ocsp" Where the hosts cert's subject is Subject: "CN=ipa14.bpo.cxn,O=CXN" I have added DNS alias for the given machine, but the httpd shows only cert for the subject, but cannot add the ocsp. Tried with certutil, with ipa-getcert, but i was not able to add the alias to the given cert. Is there a way to fix this? -- *Sándor Juhász* System Administrator *ChemAxon* *Kft*. Building Hx, GraphiSoft Park, Záhony utca 7, Budapest, Hungary, H-1031 Cell: +36704258964

2 2

Re: Ipa user can't login via ssh
by Rob Crittenden 28 Oct '19

28 Oct '19

Elhamsadat Azarian wrote: > Hi. > Which details do u need? I will send. Adding freeipa-users yet again. I'll stop responding if this continues. We'd need to see the active HBAC Rules, hbactest output at a minimum. The sssd logs on the failing machine might be relevant too but you'll probably need to enable debugging first to capture the right data. See https://docs.pagure.org/SSSD.sssd/users/troubleshooting.html rob > > On Mon, 21 Oct 2019, 18:28 Rob Crittenden, <rcritten(a)redhat.com > <mailto:rcritten@redhat.com>> wrote: > > Elhamsadat Azarian wrote: > > Hi Rob > > Thank you for helping > > I disabled default HBAC rule and add a new rule that user "elham" > could > > login and ssh on hosts "ipa-client and ipa-server" > > Now it can ssh to ipa-server but still it had problem with ipa-client. > > So rules couldnt solve my problem. > > I don't know what to tell you without more details. > > rob > > > > > On Tue, 15 Oct 2019, 16:44 Rob Crittenden, <rcritten(a)redhat.com > <mailto:rcritten@redhat.com> > > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com>>> wrote: > > > > Please keep freeipa-users in the responses. > > > > Elhamsadat Azarian wrote: > > > Hi Rob > > > I did it and i got this answer: > > > > > > Access granted : false > > > > > > What can i do now? > > > > IPA ships with a default HBAC rule, allow_all, which allows > all users to > > authenticate on all hosts. I can only assume you've deleted or > disabled > > that, and that's fine. > > > > But if you do then you need to create the set of rules to > grant access > > to hosts for the appropriate users. > > > > To provide specific assistance you'd need to share a bit of > internal > > details, current HBAC rules, etc. It is understandable if you > can't > > do that. > > > > But basically you need to evaluate your HBAC rules to find out > why this > > user can't log into hosts. The user may be missing from a > group, for > > example. > > > > rob > > > > > > On Mon, 14 Oct 2019, 18:07 Rob Crittenden, > <rcritten(a)redhat.com <mailto:rcritten@redhat.com> > > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com>> > > > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com> > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com>>>> wrote: > > > > > > Elhamsadat Azarian wrote: > > > > I tryed to add HBAC rules to my user but it said : some > > operation > > > > failed. Users cannot be added when user category = all > > > > > > Adding list back. > > > > > > Try something like: > > > > > > ipa hbactest --user elham --service ssh --host <your host> > > > > > > There is an equivalent way to do it in the UI. > > > > > > rob > > > > > > > > > > > On Wed, 9 Oct 2019, 17:19 Rob Crittenden, > > <rcritten(a)redhat.com <mailto:rcritten@redhat.com> > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com>> > > > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com> > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com>>> > > > > <mailto:rcritten@redhat.com > <mailto:rcritten@redhat.com> <mailto:rcritten@redhat.com > <mailto:rcritten@redhat.com>> > > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com> > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com>>>>> wrote: > > > > > > > > Kevin Vasko via FreeIPA-users wrote: > > > > > Have you made sure your “elham” user has the correct > > permissions > > > > to access the machines? Take a look in the UI at the > > > > groups/permissions that user elham has. Take a look at > > your HBAC > > > > rules as well. That would be my first > recommendation to > > check > > > if it > > > > was me. > > > > > > > > Right, and the troubleshooting page suggests that (and > > > increasing debug > > > > logging). > > > > > > > > Please provide the output of the things you have > already > > > looked at. > > > > > > > > rob > > > > > > > > > > > > > > -Kevin > > > > > > > > > >> On Oct 9, 2019, at 7:23 AM, Elhamsadat Azarian via > > > FreeIPA-users > > > > <freeipa-users(a)lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org> > > <mailto:freeipa-users@lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org>> > > > <mailto:freeipa-users@lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org> > > <mailto:freeipa-users@lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org>>> > > > > <mailto:freeipa-users@lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org> > > <mailto:freeipa-users@lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org>> > > > <mailto:freeipa-users@lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org> > > <mailto:freeipa-users@lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org>>>>> wrote: > > > > >> > > > > >> ### Request for enhancement > > > > >> as a Linux admin i want to login into my ipa client > > with a user > > > > that is defined in ipa-server UI. > > > > >> > > > > >> ### Issue > > > > >> I installed Ipa-server and an Ipa-client on > CentOS7.6 > > > > >> I defined Internal DNS on ipa-server and i > defined A > > and PTR > > > > records for client on ipa-server. > > > > >> now i can see my client in ipa-UI and i defined a > > user with > > > name > > > > "elham" and i expect that it can login into > ipa-client. > > > > >> when i login with root in ipa-client and i do sudo > > elham, it > > > > works and kinit elham works too but > > > > >> when i do ssh into ipa-client with this user, > it show > > > "Access denied" > > > > >> i have errors with this context: > > > > >> pam_reply : authentication failure to the client > > > > >> pam_sss: authentication falure > > > > >> > > > > >> im tired of this issue. please help me if you > know the > > > solution. > > > > >> > > > > >> #### Steps to Reproduce > > > > >> 1. define new user "elham" in ipa UI > > > > >> 2. SSH to ipa-client with elham > > > > >> 3. access denied > > > > >> > > > > >> #### Actual behavior > > > > >> (what happens) > > > > >> > > > > >> #### Expected behavior > > > > >> login into ipa-client successfully > > > > >> > > > > >> #### Version/Release/Distribution > > > > >> ipa-server 4.6.5-11.el7 > > > > >> ipa-client 4.6.4-10.el7.centos.3 > > > > >> Log files and config files are added below: > > > > >> > > > > >> > > > > >> > > > > >> krb5.conf > > > > >> ------------ > > > > >> #File modified by ipa-client-install > > > > >> > > > > >> includedir /etc/krb5.conf.d/ > > > > >> includedir /var/lib/sss/pubconf/krb5.include.d/ > > > > >> > > > > >> > > > > >> [logging] > > > > >> default = FILE:/var/log/krb5libs.log > > > > >> kdc = FILE:/var/log/krb5kdc.log > > > > >> admin_server = FILE:/var/log/kadmind.log > > > > >> [libdefaults] > > > > >> default_realm = LSHS.DC > > > > >> dns_lookup_realm = false > > > > >> dns_lookup_kdc = false > > > > >> rdns = false > > > > >> ticket_lifetime = 24h > > > > >> forwardable = yes > > > > >> allow_weak_crypto = true > > > > >> default_ccache_name = KEYRING:persistent:%{uid} > > > > >> > > > > >> [realms] > > > > >> LSHS.DC = { > > > > >> kdc = ipa-irvlt01.example.dc:88 > > > > >> admin_server = ipa-irvlt01.example.dc:749 > > > > >> default_domain = example.dc > > > > >> } > > > > >> [domain_realm] > > > > >> .example.com <http://example.com> > <http://example.com> > > <http://example.com> <http://example.com> = > > > LSHS.DC > > > > >> example.com <http://example.com> > <http://example.com> <http://example.com> > > <http://example.com> = LSHS.DC > > > > >> ############################################ > > > > >> > > > > >> > > > > >> sssd.conf > > > > >> ------------- > > > > >> [domain/example.dc] > > > > >> > > > > >> cache_credentials = True > > > > >> krb5_store_password_if_offline = True > > > > >> ipa_domain = example.dc > > > > >> id_provider = ipa > > > > >> auth_provider = ipa > > > > >> access_provider = ipa > > > > >> ldap_tls_cacert = /etc/ipa/ca.crt > > > > >> ipa_hostname = ipacli-irvlt01.example.dc > > > > >> chpass_provider = ipa > > > > >> dyndns_update = True > > > > >> ipa_server = _srv_, ipa-irvlt01.example.dc > > > > >> dyndns_iface = ens160 > > > > >> dns_discovery_domain = example.dc > > > > >> > > > > >> debug_level = 10 > > > > >> [sssd] > > > > >> ########### AFTER IPA ################### > > > > >> #services = nss, sudo, pam, ssh > > > > >> services = nss, pam > > > > >> config_file_version = 2 > > > > >> ######################################### > > > > >> domains = example.dc > > > > >> > > > > >> debug_level = 10 > > > > >> [nss] > > > > >> homedir_substring = /home > > > > >> > > > > >> [pam] > > > > >> debug_level = 10 > > > > >> > > > > >> [sudo] > > > > >> > > > > >> [autofs] > > > > >> > > > > >> [ssh] > > > > >> > > > > >> [pac] > > > > >> > > > > >> [ifp] > > > > >> > > > > >> [secrets] > > > > >> > > > > >> [session_recording] > > > > >> > > > > >> ########################################## > > > > >> > > > > >> > > > > >> _______________________________________________ > > > > >> FreeIPA-users mailing list -- > > > > freeipa-users(a)lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org> > > <mailto:freeipa-users@lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org>> > > > <mailto:freeipa-users@lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org> > > <mailto:freeipa-users@lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org>>> > > > > <mailto:freeipa-users@lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org> > > <mailto:freeipa-users@lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org>> > > > <mailto:freeipa-users@lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org> > > <mailto:freeipa-users@lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org>>>> > > > > >> To unsubscribe send an email to > > > > freeipa-users-leave(a)lists.fedorahosted.org > <mailto:freeipa-users-leave@lists.fedorahosted.org> > > <mailto:freeipa-users-leave@lists.fedorahosted.org > <mailto:freeipa-users-leave@lists.fedorahosted.org>> > > > <mailto:freeipa-users-leave@lists.fedorahosted.org > <mailto:freeipa-users-leave@lists.fedorahosted.org> > > <mailto:freeipa-users-leave@lists.fedorahosted.org > <mailto:freeipa-users-leave@lists.fedorahosted.org>>> > > > > <mailto:freeipa-users-leave@lists.fedorahosted.org > <mailto:freeipa-users-leave@lists.fedorahosted.org> > > <mailto:freeipa-users-leave@lists.fedorahosted.org > <mailto:freeipa-users-leave@lists.fedorahosted.org>> > > > <mailto:freeipa-users-leave@lists.fedorahosted.org > <mailto:freeipa-users-leave@lists.fedorahosted.org> > > <mailto:freeipa-users-leave@lists.fedorahosted.org > <mailto:freeipa-users-leave@lists.fedorahosted.org>>>> > > > > >> Fedora Code of Conduct: > > > > > > https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > > > > >> List Guidelines: > > > > https://fedoraproject.org/wiki/Mailing_list_guidelines > > > > >> List Archives: > > > > > > > > > > https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost… > > > > > _______________________________________________ > > > > > FreeIPA-users mailing list -- > > > freeipa-users(a)lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org> > > <mailto:freeipa-users@lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org>> > > > <mailto:freeipa-users@lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org> > > <mailto:freeipa-users@lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org>>> > > > > <mailto:freeipa-users@lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org> > > <mailto:freeipa-users@lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org>> > > > <mailto:freeipa-users@lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org> > > <mailto:freeipa-users@lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org>>>> > > > > > To unsubscribe send an email to > > > > freeipa-users-leave(a)lists.fedorahosted.org > <mailto:freeipa-users-leave@lists.fedorahosted.org> > > <mailto:freeipa-users-leave@lists.fedorahosted.org > <mailto:freeipa-users-leave@lists.fedorahosted.org>> > > > <mailto:freeipa-users-leave@lists.fedorahosted.org > <mailto:freeipa-users-leave@lists.fedorahosted.org> > > <mailto:freeipa-users-leave@lists.fedorahosted.org > <mailto:freeipa-users-leave@lists.fedorahosted.org>>> > > > > <mailto:freeipa-users-leave@lists.fedorahosted.org > <mailto:freeipa-users-leave@lists.fedorahosted.org> > > <mailto:freeipa-users-leave@lists.fedorahosted.org > <mailto:freeipa-users-leave@lists.fedorahosted.org>> > > > <mailto:freeipa-users-leave@lists.fedorahosted.org > <mailto:freeipa-users-leave@lists.fedorahosted.org> > > <mailto:freeipa-users-leave@lists.fedorahosted.org > <mailto:freeipa-users-leave@lists.fedorahosted.org>>>> > > > > > Fedora Code of Conduct: > > > > > > https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > > > > > List Guidelines: > > > > https://fedoraproject.org/wiki/Mailing_list_guidelines > > > > > List Archives: > > > > > > > > > > https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost… > > > > > > > > > > > > > > >

1 0

Problem with freeip and samba 4.9
by Николай Савельев 28 Oct '19

28 Oct '19

Hi I updated my samba server to 4.9 After that I had problem with starting samba an found this tred: https://pagure.io/freeipa/issue/7705 I add user mapping net groupmap add sid=S-1-5-32-546 unixgroup=nobody type=builtin and samba works But now samba is very-very-very slow! Some operations, like copy big file, ar normal, other - open dirs or create new files - very slow. Any ideas? Wat can I do? -- С уважением, Николай.

2 4

cannot create PTR record - too many address components
by Stephen Ingram 26 Oct '19

26 Oct '19

I'm trying to setup service discovery for our printers on the network using a CUPS bonjour tutorial. Specifically the record I'm trying to create is: _ipp._tcp PTR m477fdw._ipp._tcp.i.example.com. Every time I try to create this record in IPA I receive the error message: Invalid 'ptrrecord': Reverse zone in-addr.arpa. requires exactly 4 IP address components, 5 given Does IPA DNS just not support service discovery records or do I need to do something differently? I'm using CentOS 7.6.1810 and IPA 4.6.4. Steve

3 4

ssh ProxyCommand in ipa-client causes crash of x2goclient
by Kees Bakker 25 Oct '19

25 Oct '19

Hey, With x2go [1] you can start a remote desktop. Going from UNIX (client) to UNIX (server) it will use SSH behinds the scenes. However, on a IPA client the x2goclient command fails with a segfault (somewhere in a ssh library). This is caused by the modified /etc/ssh/ssh_config. More specifically this ProxyCommand /usr/bin/sss_ssh_knownhostsproxy -p %p %h When you disable this line the x2go connection succeeds. [1] https://wiki.x2go.org/doku.php -- Kees

3 5

Multiple HBAC rules in one Apache config
by Ronald Wimmer 25 Oct '19

25 Oct '19

Hi, is there a way to use multiple HBAC rules in the same "Require pam-account" line in on and the same Apache config? Something like Require pam-account hbacA|hbacB Cheers, Ronald

2 1

Re: group management on freeipa clients
by Kevin Vasko 25 Oct '19

25 Oct '19

So. this is an interesting read thanks for that. But just a FYI to the OP, if you are using any Ubuntu 18.04 clients (i haven’t tried it with Fedora/CentOS) there is an issue with not having local docker groups on the system. What ends up happening is on a boot, docker services try starting up, but look for a local docker group when they do. If there is no docker group the service times out. When the machine does finally boot up, DNS resolution for some reason is broken. Networking works fine (e.g can ping 8.8.8.8 or any local ip). But without DNS resolution the machine won’t properly find the IPA server and won’t allow users to login. Docker made this service change from 16.04 to 18.04. Here I detailed how I determined what the issue was. I put in another ticket with this information but was told it wasn’t an issue with docker. https://github.com/docker/libnetwork/issues/2335 -Kevin > On Oct 24, 2019, at 6:18 PM, Simo Sorce via FreeIPA-users <freeipa-users(a)lists.fedorahosted.org> wrote: > > I strongly recommend reading this article: > https://www.projectatomic.io/blog/2015/08/why-we-dont-let-non-root-users-ru… > > And based on it, I would a) reconsider if using sudo is not a better > idea, b) recommend, if possible, to create the docker group locally and > add users explicitly on the specific machines. > > I would fallback to a global docker group that basically gives root to > any user on any machine with docker installed they have access to only > as a least resort. > > Simo. > >> On Wed, 2019-10-23 at 19:07 +0000, Jason Dunham via FreeIPA-users >> wrote: >> Hi I'm trying to figure out the best practice for groups on my client servers. >> I have several computation workstation hosts that have been added as freeipa clients, and several engineers who want to run docker on them >> Members of the 'docker' group (gid=999 on some machines, for example) can run docker without needing sudo, which is what I want to roll out to all machines. Ideally this would be managed from freeipa with LDAP groups, and so anyone in the 'engineers' group should also be a member of the 'docker' group. >> When I create a 'docker' group on freeIPA it will have some other gid and the client sees that. >> Should I just delete the original docker group from my hosts and let it get it from ldap, or should I go into /etc/group and change the gid to the one that matches the right ldap gid, or preferably something easier than that? >> _______________________________________________ >> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org >> To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org >> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ >> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines >> List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost… > > -- > Simo Sorce > RHEL Crypto Team > Red Hat, Inc > > > > _______________________________________________ > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org > To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org > Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost…

1 0

group management on freeipa clients
by Jason Dunham 24 Oct '19

24 Oct '19

Hi I'm trying to figure out the best practice for groups on my client servers. I have several computation workstation hosts that have been added as freeipa clients, and several engineers who want to run docker on them Members of the 'docker' group (gid=999 on some machines, for example) can run docker without needing sudo, which is what I want to roll out to all machines. Ideally this would be managed from freeipa with LDAP groups, and so anyone in the 'engineers' group should also be a member of the 'docker' group. When I create a 'docker' group on freeIPA it will have some other gid and the client sees that. Should I just delete the original docker group from my hosts and let it get it from ldap, or should I go into /etc/group and change the gid to the one that matches the right ldap gid, or preferably something easier than that?

3 4

valid hostname?
by Amos 24 Oct '19

24 Oct '19

When enrolling a host, an error was presented: root : INFO Joining realm failed: RPC failed at server. invalid 'hostname': invalid domain-name: only letters, numbers, '-' are allowed. DNS label may not start or end with '-' Where does this error originate from? Is it truly impossible to allow hosts with "_" in their name? Amos

3 2

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users October 2019