Re: [Freeipa-users] 389-ds memory usage

2012-06-05 Thread JR Aquino
On Jun 5, 2012, at 3:42 PM, Sigbjorn Lie wrote: > On 06/06/2012 12:26 AM, JR Aquino wrote: >> On Jun 5, 2012, at 3:12 PM, Sigbjorn Lie wrote: >> >>> On 06/05/2012 11:44 PM, JR Aquino wrote: On Jun 5, 2012, at 1:54 PM, Sigbjorn Lie wrote: > On 06/05/2012 10:42 PM, Steven Jones wrote

Re: [Freeipa-users] 389-ds memory usage

2012-06-05 Thread Steven Jones
Hi, Im not aware that the KDC dying is related to a restart...it just died on us over the weekend for no reason I can determine and I couldnt login to my desktopbut it is possible as I dont know when it died..eg in the mrning I did a, [root@vuwunicoipam001 ~]# service ipa

Re: [Freeipa-users] 389-ds memory usage

2012-06-05 Thread Dmitri Pal
On 06/05/2012 06:47 PM, Sigbjorn Lie wrote: > On 06/06/2012 12:38 AM, Dmitri Pal wrote: >> On 06/05/2012 06:31 PM, Sigbjorn Lie wrote: >>> Could the Kerberos issue have anything to do with the sssd_be process >>> crashing at the exact time you are restarting IPA? >>> >>> I have seen the same issue,

Re: [Freeipa-users] token/swipe pass deployments with IPA

2012-06-05 Thread Dmitri Pal
On 06/01/2012 03:14 AM, Dale Macartney wrote: > > > > On 31/05/12 23:54, Dmitri Pal wrote: > > On 05/31/2012 03:03 PM, Dale > Macartney wrote: > > > > > > >> Evening all > > >> > > >> http://www.youtube.com/watch?v=uvfkj8V6ylM > > >> > > >> This video was floating around Google plus a few days ago

Re: [Freeipa-users] 389-ds memory usage

2012-06-05 Thread Sigbjorn Lie
On 06/06/2012 12:38 AM, Dmitri Pal wrote: On 06/05/2012 06:31 PM, Sigbjorn Lie wrote: Could the Kerberos issue have anything to do with the sssd_be process crashing at the exact time you are restarting IPA? I have seen the same issue, twice, but it got sorted after running "ipactl restart" a se

Re: [Freeipa-users] 389-ds memory usage

2012-06-05 Thread Sigbjorn Lie
On 06/06/2012 12:26 AM, JR Aquino wrote: On Jun 5, 2012, at 3:12 PM, Sigbjorn Lie wrote: On 06/05/2012 11:44 PM, JR Aquino wrote: On Jun 5, 2012, at 1:54 PM, Sigbjorn Lie wrote: On 06/05/2012 10:42 PM, Steven Jones wrote: Hi This has bug has pretty much destroyed my IPA deployment...I

Re: [Freeipa-users] 389-ds memory usage

2012-06-05 Thread Dmitri Pal
On 06/05/2012 06:31 PM, Sigbjorn Lie wrote: > Could the Kerberos issue have anything to do with the sssd_be process > crashing at the exact time you are restarting IPA? > > I have seen the same issue, twice, but it got sorted after running > "ipactl restart" a second time. Never really figured out

Re: [Freeipa-users] 389-ds memory usage

2012-06-05 Thread Sigbjorn Lie
Could the Kerberos issue have anything to do with the sssd_be process crashing at the exact time you are restarting IPA? I have seen the same issue, twice, but it got sorted after running "ipactl restart" a second time. Never really figured out what happened, except I noticed sssd_be crashing

Re: [Freeipa-users] 389-ds memory usage

2012-06-05 Thread JR Aquino
On Jun 5, 2012, at 3:12 PM, Sigbjorn Lie wrote: > On 06/05/2012 11:44 PM, JR Aquino wrote: >> On Jun 5, 2012, at 1:54 PM, Sigbjorn Lie wrote: >> >>> On 06/05/2012 10:42 PM, Steven Jones wrote: Hi This has bug has pretty much destroyed my IPA deployment...I had a pretty b

Re: [Freeipa-users] 389-ds memory usage

2012-06-05 Thread Steven Jones
I started with 2gb but went to 4 gb to try and last overnight and the weekend...might have to go to 8gb to last the weekend I also have a frequent failure to start IPA when I do a "service ipa restart" that means I cant cron an over-night restart And the KDC on the master IPA server seems

Re: [Freeipa-users] 389-ds memory usage

2012-06-05 Thread Sigbjorn Lie
You still have to restart IPA after 36 hours with that few users/machines? My issues started occuring more frequently after more users / hosts we're migrated. How much memory do you have in your IPA servers? Rgds, Siggi On 06/05/2012 11:51 PM, Steven Jones wrote: I have<10 users and<10 ser

Re: [Freeipa-users] 389-ds memory usage

2012-06-05 Thread Sigbjorn Lie
On 06/05/2012 11:44 PM, JR Aquino wrote: On Jun 5, 2012, at 1:54 PM, Sigbjorn Lie wrote: On 06/05/2012 10:42 PM, Steven Jones wrote: Hi This has bug has pretty much destroyed my IPA deployment...I had a pretty bad memory leak had to reboot every 36 hours...made worse by trying later 6.3?

Re: [Freeipa-users] 389-ds memory usage

2012-06-05 Thread Steven Jones
Hi, I am just trying to figure out sudo now, however I cant understand how...I find the documentation confusing/inadequate regards Steven Jones Technical Specialist - Linux RHCE Victoria University, Wellington, NZ 0064 4 463 6272 8><--- Are either of you currently utilizing sud

Re: [Freeipa-users] 389-ds memory usage

2012-06-05 Thread Steven Jones
I have <10 users and <10 serversI cant see any tuning is necessary as yet However I did up the cache and that made no difference original [root@vuwunicoipam001 ~]# ls -lh /var/lib/dirsrv/slapd-ODS-VUW-AC-NZ/db/userRoot/id2entry.db4 -rw---. 1 dirsrv dirsrv 6.3M May 8 11:34 /va

Re: [Freeipa-users] 389-ds memory usage

2012-06-05 Thread JR Aquino
On Jun 5, 2012, at 1:54 PM, Sigbjorn Lie wrote: > On 06/05/2012 10:42 PM, Steven Jones wrote: >> Hi >> >> This has bug has pretty much destroyed my IPA deployment...I had a >> pretty bad memory leak had to reboot every 36 hours...made worse by trying >> later 6.3? rpms didnt fix the leak an

Re: [Freeipa-users] 389-ds memory usage

2012-06-05 Thread Sigbjorn Lie
On 06/05/2012 10:42 PM, Steven Jones wrote: Hi This has bug has pretty much destroyed my IPA deployment...I had a pretty bad memory leak had to reboot every 36 hours...made worse by trying later 6.3? rpms didnt fix the leak and it went split brain2 months and no fixboy did tha

Re: [Freeipa-users] Freeipa-users Digest, Vol 46, Issue 104

2012-06-05 Thread Alexander Bokovoy
On Tue, 05 Jun 2012, Dmitri Pal wrote: On 06/04/2012 06:52 PM, Lucas Yamanishi wrote: On 05/17/2012 10:47 AM, Lucas Yamanishi wrote: On 05/17/2012 09:34 AM, Rob Crittenden wrote: Lucas Yamanishi wrote: Hi everybody, I've added some custom schema to my directory, but it's useless to me if if

Re: [Freeipa-users] 389-ds memory usage

2012-06-05 Thread Steven Jones
Hi This has bug has pretty much destroyed my IPA deployment...I had a pretty bad memory leak had to reboot every 36 hours...made worse by trying later 6.3? rpms didnt fix the leak and it went split brain2 months and no fixboy did that open up a can of worms. :/ In my case

Re: [Freeipa-users] 389-ds memory usage

2012-06-05 Thread Richard Megginson
- Original Message - > On 06/05/2012 05:55 PM, Richard Megginson wrote: > > - Original Message - > >> On Mon, April 23, 2012 20:38, Rich Megginson wrote: > >> > >>> Ok. The current theory is that the memory growth is caused by > >>> the > >>> churn > >>> of entries being added to a

Re: [Freeipa-users] 389-ds memory usage

2012-06-05 Thread Sigbjorn Lie
On 06/05/2012 05:55 PM, Richard Megginson wrote: - Original Message - On Mon, April 23, 2012 20:38, Rich Megginson wrote: Ok. The current theory is that the memory growth is caused by the churn of entries being added to and removed from the entry cache. It's not yet known why this gr

Re: [Freeipa-users] HOWTO: Zimbra Authentication and GAL lookups with FreeIPA backend

2012-06-05 Thread Dmitri Pal
On 06/02/2012 07:56 PM, Dale Macartney wrote: > > Morning all > > Just a quick mail to to let everyone know that I have placed a new wiki > page for integrating Zimbra authentication and GAL lookups into IPA. > > Link is here > http://freeipa.org/page/Zimbra_Collaboration_Server_7.2_Authentication_

Re: [Freeipa-users] FreeIPA webserver cert expired.

2012-06-05 Thread Rob Crittenden
JR Aquino wrote: On Jun 5, 2012, at 11:18 AM, Paul Tader wrote: A couple days ago my (apache) certificates expired. Users are able to kinit but tools such as sudo fail because of the expired certificates. Lots of reading/Google'ing later I found this script (steps) to renew these certs: I'

Re: [Freeipa-users] FreeIPA webserver cert expired.

2012-06-05 Thread JR Aquino
On Jun 5, 2012, at 11:18 AM, Paul Tader wrote: > A couple days ago my (apache) certificates expired. Users are able to kinit > but tools such as sudo fail because of the expired certificates. Lots of > reading/Google'ing later I found this script (steps) to renew these certs: I'm just curious,

[Freeipa-users] FreeIPA webserver cert expired.

2012-06-05 Thread Paul Tader
A couple days ago my (apache) certificates expired. Users are able to kinit but tools such as sudo fail because of the expired certificates. Lots of reading/Google'ing later I found this script (steps) to renew these certs: I'd rather run the commands one at a time, but my question is am I on

Re: [Freeipa-users] 389-ds memory usage

2012-06-05 Thread Richard Megginson
- Original Message - > On Mon, April 23, 2012 20:38, Rich Megginson wrote: > > > Ok. The current theory is that the memory growth is caused by the > > churn > > of entries being added to and removed from the entry cache. It's > > not yet known why this growth is > > seen. It could be ju

Re: [Freeipa-users] mail entries not populated for users

2012-06-05 Thread Dale Macartney
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On 05/06/12 14:21, Rob Crittenden wrote: > Dale Macartney wrote: >> >> -BEGIN PGP SIGNED MESSAGE- >> Hash: SHA1 >> >> >> >> On 05/06/12 14:09, Rob Crittenden wrote: >>> Dale Macartney wrote: -BEGIN PGP SIGNED MESSAGE-

Re: [Freeipa-users] mail entries not populated for users

2012-06-05 Thread Rob Crittenden
Dale Macartney wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On 05/06/12 14:09, Rob Crittenden wrote: Dale Macartney wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hi all I may be overlooking something here, but from what I can gather, the value in the ipa config of "Default

Re: [Freeipa-users] mail entries not populated for users

2012-06-05 Thread Dale Macartney
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On 05/06/12 14:09, Rob Crittenden wrote: > Dale Macartney wrote: >> >> -BEGIN PGP SIGNED MESSAGE- >> Hash: SHA1 >> >> Hi all >> >> I may be overlooking something here, but from what I can gather, the >> value in the ipa config of "Default e-

Re: [Freeipa-users] mail entries not populated for users

2012-06-05 Thread Rob Crittenden
Dale Macartney wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hi all I may be overlooking something here, but from what I can gather, the value in the ipa config of "Default e-mail domain for new users" should automatically create the mail attribute for said user upon creation? Do I nee

Re: [Freeipa-users] Provision user accounts & groups from external IM

2012-06-05 Thread Willem Bos
Thanks, you probably saved me some time/frustration ;-) On Tue, Jun 5, 2012 at 1:14 PM, Petr Viktorin wrote: > On 06/05/2012 12:51 PM, Alexander Bokovoy wrote: > >> On Tue, 05 Jun 2012, Willem Bos wrote: >> >>> Hi Alexander, >>> >>> Thanks for your quick response. >>> >>> Yes, the server on whic

Re: [Freeipa-users] Provision user accounts & groups from external IM

2012-06-05 Thread Petr Viktorin
On 06/05/2012 12:51 PM, Alexander Bokovoy wrote: On Tue, 05 Jun 2012, Willem Bos wrote: Hi Alexander, Thanks for your quick response. Yes, the server on which the external IM environment is hosted does not have the ipa utils available. As a matter of fact, the server might even be hosted off-s

Re: [Freeipa-users] Provision user accounts & groups from external IM

2012-06-05 Thread Alexander Bokovoy
On Tue, 05 Jun 2012, Willem Bos wrote: Hi Alexander, Thanks for your quick response. Yes, the server on which the external IM environment is hosted does not have the ipa utils available. As a matter of fact, the server might even be hosted off-site. We're just beginning to explore IM solutions

Re: [Freeipa-users] Provision user accounts & groups from external IM

2012-06-05 Thread Willem Bos
Hi Alexander, Thanks for your quick response. Yes, the server on which the external IM environment is hosted does not have the ipa utils available. As a matter of fact, the server might even be hosted off-site. We're just beginning to explore IM solutions for our environment and the most likely a

[Freeipa-users] mail entries not populated for users

2012-06-05 Thread Dale Macartney
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hi all I may be overlooking something here, but from what I can gather, the value in the ipa config of "Default e-mail domain for new users" should automatically create the mail attribute for said user upon creation? Do I need to do an additional st

Re: [Freeipa-users] Provision user accounts & groups from external IM

2012-06-05 Thread Alexander Bokovoy
On Tue, 05 Jun 2012, Willem Bos wrote: Hi all, Is there an API to provision user accounts to FreeIPA that I can use from an external Identity Management environment? Of course, we could just simply create an LDAP object in the 389 server but this probably won't trigger the same actions as using

Re: [Freeipa-users] sudo documentation 6.3beta documentation page 279 section 13.2.1.1.

2012-06-05 Thread Petr Vobornik
On 06/05/2012 05:54 AM, Steven Jones wrote: Hi, Trying to setup sudo via the gui but I suspect at least one stage is missing can we have some screenshots also so I know what I'm expecting to see? = 5. Click the Add and Edit button to go immediately to the edit pages for the command.

Re: [Freeipa-users] su: [ID 219349 auth.debug] pam_unix_auth: user craig not found (Solaris 10 IPA client)

2012-06-05 Thread Sigbjorn Lie
Please try to initialize the client using the default DUA profile included with IPA: $ ldapclient -v init \ -a profileName=default \ ipaserver.example.com You can also take a look at these two request I've opened to update the Solaris 10 documentation, and including a default DUA config prof

Re: [Freeipa-users] 389-ds memory usage

2012-06-05 Thread Sigbjorn Lie
On Mon, April 23, 2012 20:38, Rich Megginson wrote: > Ok. The current theory is that the memory growth is caused by the churn > of entries being added to and removed from the entry cache. It's not yet > known why this growth is > seen. It could be just that the memory is getting fragmented, or