March 2019 - FreeIPA-users - Fedora mailing-lists

FreeIPA and laptop question
by Albert Szostkiewicz 10 Mar '19

10 Mar '19

Hi! If os login for domain user is verified by FreeIpa (which sets uid etc) what happens if I use ipa-client on laptop and be outside my network ? If I won't be able to connect to IPA for login verification, is there any kind of fallback ? Or should i make any specific settings for such situation ? (assuming that i don't have access to network at all) Cheers!

3 3

OTP + SSHKey/Certificate Authentication
by Callum Smith 08 Mar '19

08 Mar '19

Dear FreeIPA Gurus, I was wondering if it's possible to configure `sshd` such that for OTP based authentication the first factor could be passed as a ssh key or certificate. So specifically: The user's password would not be required for auth, only the key and OTP token. Is there a magic combination of AuthenticationMethods for `sshd_config` that would allow this to work? Regards, Callum -- Callum Smith Research Computing Core Wellcome Trust Centre for Human Genetics University of Oxford e. callum(a)well.ox.ac.uk<mailto:callum@well.ox.ac.uk>

2 1

list all users and their password expiration date?
by Anthony Jarvis-Clark 08 Mar '19

08 Mar '19

Hello Everyone, Is there a command line method to get a list of users and their password expiration date? Thanks! -Anthony

1 0

Multiple dot in hostname - DNS error
by Vivek Aggarwal 08 Mar '19

08 Mar '19

Our current implementation has multiple dots(.) names in the hostname ,details mentioned below & we're using below setting while configuring the IPA/Redhat IDM server with integrated DNS. Hostname : testing-infra-01-dal1.testing.stg.avtar.local realm_name: avtar.local domain_name: avtar.local Once the setup completes ., we're getting below error . We're suspecting its related to multiple dots in the hostname. Considering the fact we cannot rename these hostname , please suggest how to resolve it . Is there a possibility to resolve it or we have to install/configure BIND DNS separately. Does this error really prevents us from registering other machines within our environment having similar multi dot pattern in hostnames ? +++++++++++++++++++++ ipapython.dnsutil: DEBUG The DNS query name does not exist: testing-infra-01-dal1.testing.stg.avtar.local. ipaserver.dns_data_management: ERROR unable to resolve host name testing-infra-01-dal1.testing.stg.avtar.local. to IP address, ipa-ca DNS record will be incomplete ++++++++++++++++++++

4 14

FreeIPA and AD
by Kristian Petersen 07 Mar '19

07 Mar '19

Hello, Where I work we are a small shop. We are currently using just FreeIPA for authentication and DNS and other Linux management stuff that it does for us. We have enough Windows workstations now that it would be really nice to be able to manage those like we can our Linux stuff. From what I have read thus far, it seems that if you use FreeIPA with AD AD is the primary user store and FreeIPA kind of takes a back seat. I am looking for some help in better understanding the implications of using FreeIPA along with AD. Is there someone who could help me unravel this a bit or point me at some good resources? -- Kristian Petersen System Administrator BYU Dept. of Chemistry and Biochemistry

3 2

pki-tomcatd no longer working
by Sina Owolabi 07 Mar '19

07 Mar '19

Hi! I am running a small IPA domain (CentOS 7 servers, ipa version 4.5.4, api version 2.228), with one master, and two replicas, and I noticed that pki-tomcatd no longer works on the master, after attempting a reboot. pki-tomcatd works fine on the slaves. I noticed if I try to run IPA functions (dns record removal, hosts management, user passwords, etc), I receive responses like this: ipa: ERROR: Certificate operation cannot be completed: Unable to communicate with CMS (Internal Server Error) But on the replicas, functions work fine. Please can someone guide me on how to fix this?

4 15

Re: Squid proxy digest authentication
by Edward Valley 06 Mar '19

06 Mar '19

3 12

Re: Lost IPA master Left with replica only
by Rob van Halteren 06 Mar '19

06 Mar '19

thanks for the hint. I ran stuck during the search for the needed files in /var/lib/pki-ca/conf/CS.cfg on the master in the CS.cfg file the related ca.crl items do not exist. and the ca.listenToCloneModifications=true. This would implicate that its not the ca-master. Unfortunately it is the ca-master. Appart from this, I also was not able to install a CA on the replica with ipa-ca-install. I abbondoned the effort to promote this replica and decided to install a new ipa-server. This leads to an other problems for which i will open a new tread. Regards, Rob. <http://www.linkedin.com/company/filmmore-amsterdam/>

1 0

IPA server on multiple subzones
by Callum Smith 05 Mar '19

05 Mar '19

Dear All, We have a number of DNS sub zones in different IP subnets, and we want to ensure that DNS queries respond quickly and aren't waiting for timeouts. So as such we're thinking of putting our IPA on multiple interfaces, one in each sub zone, and registering the host and it's clients within that sub zone separately. To achieve this we need to add principal aliases for each sub zone to the IPA services - which appears to be working well so far, but I have a question: what's the best way to setup a new certificate for the web interface to allow SSL on the new sub zone interface. We're thinking of simply adding alt names to the certificate and getting a newly issued one from the local CA. Should we be looking to do this exclusively with certutil or should we be using ipa-server-certinstall. I hope that this makes sense and our approach isn't complete madness. Regards, Callum -- Callum Smith Research Computing Core Wellcome Trust Centre for Human Genetics University of Oxford e. callum(a)well.ox.ac.uk<mailto:callum@well.ox.ac.uk>

1 0

Adding the attribute jpegPhoto to the default attributes list
by Boudjoudad Abdelkader 04 Mar '19

04 Mar '19

photHello, I added the attribute jpegPhoto of the objectclass inetOrgPerson to a user and set it with a path to a picture, is there a way to add this attribute the the default attributes list ? Thanks,

1 0

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users March 2019