subject:"Re\: Packagers \- Flag day 2016 Important changes"

Re: Packagers - Flag day 2016 Important changes

2017-01-07 Thread Kevin Fenzi

On Thu, 22 Dec 2016 14:52:45 +
Dave Love  wrote:

> Kevin Fenzi  writes:
> 
> > In this case you should simply be able to kinit on the RHEL node you
> > wish to push changes/builds from?  
> 
> That would be a good start in case epel-testing's fedora-packager was
> installable, but I can't.
> 
>   $ kinit lovesh...@fedoraproject.org
>   kinit: Cannot contact any KDC for realm 'FEDORAPROJECT.ORG' while
> getting initial credentials $ grep -i fedora /etc/krb5.conf
>FEDORAPROJECT.ORG =
> { kdc =
> https://id.fedoraproject.org/KdcProxy STG.FEDORAPROJECT.ORG = {
>   kdc = https://id.stg.fedoraproject.org/KdcProxy
>fedoraproject.org =
> FEDORAPROJECT.ORG .fedoraproject.org =
> FEDORAPROJECT.ORG .stg.fedoraproject.org = STG.FEDORAPROJECT.ORG
>stg.fedoraproject.org = STG.FEDORAPROJECT.ORG

So, this mail is from Dec 22nd... did you get everything working since
then, or is there still an issue? If there is, can you please file a
infrastructure ticket and we can get things sorted out. 

kevin



pgpamNvhc5_bM.pgp
Description: OpenPGP digital signature
___
devel mailing list -- devel@lists.fedoraproject.org
To unsubscribe send an email to devel-le...@lists.fedoraproject.org

Re: Packagers - Flag day 2016 Important changes

2017-01-07 Thread Dave Love

Kevin Fenzi  writes:

>> Some people use "Enterprise Linux" (ugh) server systems in
>> "enterprises" which have Kerberized services -- like networked home
>> filestores, where the old certificate is.  (I did copy the
>> credentials with Firefox sync.) OK, Red Hat people think we shouldn't
>> work that way, and apparently now can't, but that's why.
>
> "Red Hat people" ? 

People @redhat.com

> In this case you should simply be able to kinit on the RHEL node you
> wish to push changes/builds from?

That would be a good start in case epel-testing's fedora-packager was
installable, but I can't.

  $ kinit lovesh...@fedoraproject.org
  kinit: Cannot contact any KDC for realm 'FEDORAPROJECT.ORG' while getting 
initial credentials
  $ grep -i fedora /etc/krb5.conf
   FEDORAPROJECT.ORG = {  
 kdc = https://id.fedoraproject.org/KdcProxy  
   STG.FEDORAPROJECT.ORG = {
  kdc = https://id.stg.fedoraproject.org/KdcProxy
   fedoraproject.org = FEDORAPROJECT.ORG  
   .fedoraproject.org = FEDORAPROJECT.ORG 
   .stg.fedoraproject.org = STG.FEDORAPROJECT.ORG
   stg.fedoraproject.org = STG.FEDORAPROJECT.ORG
___
devel mailing list -- devel@lists.fedoraproject.org
To unsubscribe send an email to devel-le...@lists.fedoraproject.org

Re: Packagers - Flag day 2016 Important changes

2017-01-07 Thread Dave Love

Kevin Fenzi  writes:

> If you are using the default kerberos cache (the linux kernel keyring),

For what it's worth, not on RHEL6, and some of the (unsatisfactory)
methods for dealing with Kerberos in batch systems currently rely on the
traditional ccache, whether or not they could copy credentials another
way.

> I think it may be possible to copy your tickets to another machine, but
> it's definitely not trivial (not like scp .fedora.cert). It might
> require root access also. I am not sure. Does anyone know how it uses
> the linux kernel keyring here?
___
devel mailing list -- devel@lists.fedoraproject.org
To unsubscribe send an email to devel-le...@lists.fedoraproject.org

Re: Packagers - Flag day 2016 Important changes - KDE wallet kinit

2017-01-02 Thread Igor Gnatenko

On Mon, Jan 2, 2017 at 11:27 PM, Orion Poplawski  wrote:
> On 12/11/2016 05:34 PM, Dennis Gilmore wrote:
>> * koji and the source lookaside were changed to use kerberos
>> authentication
>> instead of ssl certificates. All maintainers will need to:
>>
>> kinit your-fas-accountn...@fedoraaproject.org
>>
>> to get a valid kerberos TGT and be able to authenticate to koji and
>> the lookaside upload cgi.
>
> KDE users may find this useful - I've started using the newly packaged
> kwalletcli to do:
Cool, would be nice add it into wiki:
https://fedoraproject.org/wiki/Infrastructure/Kerberos
>
> $ cat ~/.kde/Autostart/kinit.desktop
> [Desktop Entry]
> Comment[en_US]=
> Comment=
> Exec=bash -c 'kwalletcli -f Passwords -e or...@fedoraproject.org | kinit
> or...@fedoraproject.org;kswitch -p m...@domain.com'
> GenericName[en_US]=Initialize Fedora Kerberos
> GenericName=Initialize Fedora Kerberos
> MimeType=
> Name[en_US]=kinit
> Name=kinit
> Path=
> StartupNotify=false
> Terminal=false
> TerminalOptions=
> Type=Application
> X-DBUS-ServiceName=
> X-DBUS-StartupType=
> X-KDE-SubstituteUID=false
> X-KDE-Username=
> name[en_US]=Kinit
>
> After storing the password in the wallet's "Passwords" directory under my
> principal name.
>
> I find that I have to also kswitch back to my local principal for NFS to work
> for me at work.
>
> --
> Orion Poplawski
> Technical Manager  720-772-5637
> NWRA, Boulder/CoRA Office FAX: 303-415-9702
> 3380 Mitchell Lane   or...@nwra.com
> Boulder, CO 80301   http://www.nwra.com
> ___
> devel mailing list -- devel@lists.fedoraproject.org
> To unsubscribe send an email to devel-le...@lists.fedoraproject.org



-- 
-Igor Gnatenko
___
devel mailing list -- devel@lists.fedoraproject.org
To unsubscribe send an email to devel-le...@lists.fedoraproject.org

Re: Packagers - Flag day 2016 Important changes - KDE wallet kinit

2017-01-02 Thread Orion Poplawski

On 12/11/2016 05:34 PM, Dennis Gilmore wrote:
> * koji and the source lookaside were changed to use kerberos
> authentication
> instead of ssl certificates. All maintainers will need to:
> 
> kinit your-fas-accountn...@fedoraaproject.org
> 
> to get a valid kerberos TGT and be able to authenticate to koji and 
> the lookaside upload cgi. 

KDE users may find this useful - I've started using the newly packaged
kwalletcli to do:

$ cat ~/.kde/Autostart/kinit.desktop
[Desktop Entry]
Comment[en_US]=
Comment=
Exec=bash -c 'kwalletcli -f Passwords -e or...@fedoraproject.org | kinit
or...@fedoraproject.org;kswitch -p m...@domain.com'
GenericName[en_US]=Initialize Fedora Kerberos
GenericName=Initialize Fedora Kerberos
MimeType=
Name[en_US]=kinit
Name=kinit
Path=
StartupNotify=false
Terminal=false
TerminalOptions=
Type=Application
X-DBUS-ServiceName=
X-DBUS-StartupType=
X-KDE-SubstituteUID=false
X-KDE-Username=
name[en_US]=Kinit

After storing the password in the wallet's "Passwords" directory under my
principal name.

I find that I have to also kswitch back to my local principal for NFS to work
for me at work.

-- 
Orion Poplawski
Technical Manager  720-772-5637
NWRA, Boulder/CoRA Office FAX: 303-415-9702
3380 Mitchell Lane   or...@nwra.com
Boulder, CO 80301   http://www.nwra.com
___
devel mailing list -- devel@lists.fedoraproject.org
To unsubscribe send an email to devel-le...@lists.fedoraproject.org

Re: Packagers - Flag day 2016 Important changes

2016-12-29 Thread Kevin Fenzi

On Tue, 27 Dec 2016 19:13:39 -0600
Michael Catanzaro  wrote:

> Hi,
> 
> I tried again today, but still having problems. When I try from the
> command line:
> 
> $ kinit catanz...@fedoraproject.org
> Password for catanz...@fedoraproject.org: 
> kinit: Password incorrect while getting initial credentials
> 
> But I know my password is correct, because I just used it to log into
> Bodhi.
> 
> When trying with gnome-online-accounts, I get this error:
> 
> "Error connecting to enterprise identity server: Decrypt integrity
> check failed"

So, things to check: 

* Does your /etc/krb5.conf file have a
includedir /etc/krb5.conf.d/
at the top?

* Does your /etc/krb5.conf file have: 
 rdns = false

(it might be you have a /etc/krb5.conf.rpmnew if you modified the file)

If those things don't work, please open a infrastructure ticket or stop
by #fedora-admin and we can get it tracked down. 

kevin


pgpml6odmiZYN.pgp
Description: OpenPGP digital signature
___
devel mailing list -- devel@lists.fedoraproject.org
To unsubscribe send an email to devel-le...@lists.fedoraproject.org

Re: Packagers - Flag day 2016 Important changes

2016-12-28 Thread Mattia Verga

Il 28/12/2016 02:13, Michael Catanzaro ha scritto:

Hi,

I tried again today, but still having problems. When I try from the
command line:

$ kinit catanz...@fedoraproject.org
Password for catanz...@fedoraproject.org:
kinit: Password incorrect while getting initial credentials

But I know my password is correct, because I just used it to log into
Bodhi.

When trying with gnome-online-accounts, I get this error:

"Error connecting to enterprise identity server: Decrypt integrity
check failed"

Michael
___
devel mailing list -- devel@lists.fedoraproject.org
To unsubscribe send an email to devel-le...@lists.fedoraproject.org
From
https://fedoraproject.org/wiki/Infrastructure/Kerberos?rd=Infrastructure_kerberos_authentication
:

*Question*: When I run kinit I get: Client 'yourn...@fedoraproject.org'
not found in Kerberos database while getting initial credentials

*Answer*: Login to fas ( https://admin.fedoraproject.org/accounts ) and
then retry. Your information needs to be synced from fas to the ipa
server. Logging into fas does so.

*Question*: I did that (logged into FAS) in the last answer, and it
didn't help, I still get the same error message. Whats going on?

*Answer*: For some small number of users there may be some issue with
syncing information from fas->ipa. If this happens to you, please file
an infrastructure ticket or talk with us on #fedora-admin and we can
manually fix things.

1 2 >

1 - 100 of 120 matches

Mail list logo