Re: [Freeipa-users] HBAC Test - web vs command line - returns different results

2012-09-17 Thread Michael Mercier
On 2012-09-08, at 11:08 AM, Dmitri Pal wrote: On 08/31/2012 09:33 AM, Michael Mercier wrote: Hello, I seem to be having a problem with the HBAC test: Versions: [root@ipaserver ipatest]# rpm -qa|grep ^ipa ipa-server-2.2.0-16.el6.x86_64 ipa-pki-common-theme-9.0.3-7.el6.noarch

Re: [Freeipa-users] errors when one ipa server down

2012-09-17 Thread Michael Mercier
On 2012-09-07, at 4:50 PM, Rob Crittenden wrote: Michael Mercier wrote: On 2012-09-07, at 2:47 PM, Dmitri Pal wrote: On 09/07/2012 12:42 PM, Michael Mercier wrote: On 2012-09-07, at 12:14 PM, Dmitri Pal wrote: On 09/06/2012 10:40 AM, Michael Mercier wrote: Hello, I have

Re: [Freeipa-users] errors when one ipa server down

2012-09-17 Thread Michael Mercier
On 2012-09-10, at 4:35 AM, Petr Spacek wrote: On 09/08/2012 05:03 PM, Dmitri Pal wrote: On 09/07/2012 04:50 PM, Rob Crittenden wrote: Michael Mercier wrote: On 2012-09-07, at 2:47 PM, Dmitri Pal wrote: On 09/07/2012 12:42 PM, Michael Mercier wrote: On 2012-09-07, at 12:14 PM, Dmitri

Re: [Freeipa-users] HBAC Test - web vs command line - returns different results

2012-09-17 Thread Dmitri Pal
On 09/17/2012 09:47 AM, Michael Mercier wrote: On 2012-09-08, at 11:08 AM, Dmitri Pal wrote: On 08/31/2012 09:33 AM, Michael Mercier wrote: Hello, I seem to be having a problem with the HBAC test: Versions: [root@ipaserver ipatest]# rpm -qa|grep ^ipa ipa-server-2.2.0-16.el6.x86_64

Re: [Freeipa-users] HBAC Test - web vs command line - returns different results

2012-09-17 Thread Rob Crittenden
Michael Mercier wrote: On 2012-09-08, at 11:08 AM, Dmitri Pal wrote: On 08/31/2012 09:33 AM, Michael Mercier wrote: Hello, I seem to be having a problem with the HBAC test: Versions: [root@ipaserver ipatest]# rpm -qa|grep ^ipa ipa-server-2.2.0-16.el6.x86_64

Re: [Freeipa-users] HBAC Test - web vs command line - returns different results

2012-09-17 Thread Michael Mercier
On 2012-09-17, at 10:33 AM, Rob Crittenden wrote: Michael Mercier wrote: On 2012-09-08, at 11:08 AM, Dmitri Pal wrote: On 08/31/2012 09:33 AM, Michael Mercier wrote: Hello, I seem to be having a problem with the HBAC test: Versions: [root@ipaserver ipatest]# rpm -qa|grep ^ipa

[Freeipa-users] NFS on Mac

2012-09-17 Thread george he
Hello all, I have IPA server and NFS server set up on a computer running centos 6.3. Is there a way to set up a mac laptop to access the data on the NFS server? The laptop does not have a static IP. DNS is not configured with IPA. If yes, how do I config the mac? Thanks,

Re: [Freeipa-users] errors when one ipa server down

2012-09-17 Thread Dmitri Pal
On 09/17/2012 10:27 AM, Michael Mercier wrote: On 2012-09-10, at 4:35 AM, Petr Spacek wrote: On 09/08/2012 05:03 PM, Dmitri Pal wrote: On 09/07/2012 04:50 PM, Rob Crittenden wrote: Michael Mercier wrote: On 2012-09-07, at 2:47 PM, Dmitri Pal wrote: On 09/07/2012 12:42 PM, Michael Mercier

Re: [Freeipa-users] NFS on Mac

2012-09-17 Thread Dmitri Pal
On 09/17/2012 11:07 AM, george he wrote: Hello all, I have IPA server and NFS server set up on a computer running centos 6.3. Is there a way to set up a mac laptop to access the data on the NFS server? The laptop does not have a static IP. DNS is not configured with IPA. If yes, how do I

Re: [Freeipa-users] errors when one ipa server down

2012-09-17 Thread Dmitri Pal
On 09/17/2012 10:14 AM, Michael Mercier wrote: On 2012-09-07, at 4:50 PM, Rob Crittenden wrote: Michael Mercier wrote: On 2012-09-07, at 2:47 PM, Dmitri Pal wrote: On 09/07/2012 12:42 PM, Michael Mercier wrote: On 2012-09-07, at 12:14 PM, Dmitri Pal wrote: On 09/06/2012 10:40 AM, Michael

Re: [Freeipa-users] errors when one ipa server down

2012-09-17 Thread Michael Mercier
On 2012-09-17, at 11:27 AM, Dmitri Pal wrote: On 09/17/2012 10:14 AM, Michael Mercier wrote: On 2012-09-07, at 4:50 PM, Rob Crittenden wrote: Michael Mercier wrote: On 2012-09-07, at 2:47 PM, Dmitri Pal wrote: On 09/07/2012 12:42 PM, Michael Mercier wrote: On 2012-09-07, at 12:14 PM,

Re: [Freeipa-users] NFS on Mac

2012-09-17 Thread george he
sounds to me the link may work for nfs version 3 only. Now with IPA and NFS4, there got to be something more. George From: Dmitri Pal d...@redhat.com To: freeipa-users@redhat.com Sent: Monday, September 17, 2012 11:20 AM Subject: Re: [Freeipa-users] NFS on Mac

Re: [Freeipa-users] NFS on Mac

2012-09-17 Thread Dmitri Pal
On 09/17/2012 02:21 PM, george he wrote: sounds to me the link may work for nfs version 3 only. Now with IPA and NFS4, there got to be something more. George I do not know the exact steps on mac because the is no ipa-client on Mac so you would have to configure the machine to be an IPA client

Re: [Freeipa-users] NFS on Mac

2012-09-17 Thread Steven Jones
If anyone has MAC instructions' I'd love a copy pls. regards regards Steven Jones Technical Specialist - Linux RHCE Victoria University, Wellington, NZ 0064 4 463 6272 From: freeipa-users-boun...@redhat.com [freeipa-users-boun...@redhat.com] on behalf of

Re: [Freeipa-users] winsync agreements, mostly one way.

2012-09-17 Thread Dmitri Pal
On 09/17/2012 04:55 PM, Steven Jones wrote: In section 8.4.5 it talks about making an agreement one way...which is mostly what I want, so everything incl password changes from AD to IPA. except I want account disabled / enabled to flow both ways. So if I do a ldapmodify -x -D cn=directory

Re: [Freeipa-users] winsync agreements, mostly one way.

2012-09-17 Thread Steven Jones
Hi, Im confused as section 8.4.5 page 182 first para of the Red Hat admin guide for IPA says this (its bi-directional).so that section needs updating? regards Steven Jones Technical Specialist - Linux RHCE Victoria University, Wellington, NZ 0064 4 463 6272

Re: [Freeipa-users] winsync agreements, mostly one way.

2012-09-17 Thread Rich Megginson
On 09/17/2012 03:34 PM, Steven Jones wrote: Hi, Im confused as section 8.4.5 page 182 first para of the Red Hat admin guide for IPA says this (its bi-directional).so that section needs updating? In IPA, adding users is uni-directional, from AD to IPA. However, once the users are in

Re: [Freeipa-users] winsync agreements, mostly one way.

2012-09-17 Thread Steven Jones
Hi, So cool, I think that is what I wantbut I think the documentation so be updated with thsi cooemnt as it makes it a lot clearer. regards Steven Jones Technical Specialist - Linux RHCE Victoria University, Wellington, NZ 0064 4 463 6272 From: Rich

[Freeipa-users] winsync agreement wipes IPA users

2012-09-17 Thread Steven Jones
Hi, I just tried to do a winsync agreement with specifying the AD point as cn=VUW_Staff,dc=staff,dc=vuw,dc=vuw,dc=ac,dc=nz as my users are not in the users folder but the VUW_Staff folder (at the same level) and it wiped all IPA users that are also in AD. While doing the actual update does

Re: [Freeipa-users] winsync agreement wipes IPA users

2012-09-17 Thread Rich Megginson
On 09/17/2012 04:17 PM, Steven Jones wrote: Hi, I just tried to do a winsync agreement with specifying the AD point as cn=VUW_Staff,dc=staff,dc=vuw,dc=vuw,dc=ac,dc=nz as my users are not in the users folder but the VUW_Staff folder (at the same level) and it wiped all IPA users that are

Re: [Freeipa-users] winsync agreement wipes IPA users

2012-09-17 Thread Steven Jones
Hi, The first time missed the --win-subtree settings so I wiped the admins in the IPA admin group and users as they were not in cn=users as per the bug. The second time as far as I can tell I specified the correct cn via win-subtree flag but I still appear to have lost the users in

Re: [Freeipa-users] winsync agreement wipes IPA users

2012-09-17 Thread Rich Megginson
On 09/17/2012 06:17 PM, Steven Jones wrote: Hi, The first time missed the --win-subtree settings so I wiped the admins in the IPA admin group and users as they were not in cn=users as per the bug. The second time as far as I can tell I specified the correct cn via win-subtree flag but I

Re: [Freeipa-users] winsync agreement wipes IPA users

2012-09-17 Thread Steven Jones
Hi, I understand that I'll lose users that are cn=Staff_Admins,dc=etc So the Q is why I am losing users in the --win-subtree cn=VUW_Staff,dc= etc This I dont understand I have the -v already, anyway to make it very verbose? regards Steven Jones Technical Specialist - Linux RHCE

[Freeipa-users] Password requirements too stringent

2012-09-17 Thread Tim Hildred
Hey all; I'm running IPA internally to control access to our cloud environment. I must admit, I do not understand the password requirements. I have had them set to the defaults. I read this:

Re: [Freeipa-users] Password Expiration Grace Limit

2012-09-17 Thread Tim Hildred
latetotheparty There seems to be nothing in the documentation about a user being able to initiate a password change dialogue after their password has expired

Re: [Freeipa-users] Password requirements too stringent

2012-09-17 Thread Steven Jones
Maybe its the local system having requirements and not IPA? In my secure logs I see pam is quering first locally and then the sss daemonmaybe its failing you on the default rh setup of the OS? regards Steven Jones Technical Specialist - Linux RHCE Victoria University, Wellington, NZ

Re: [Freeipa-users] Password requirements too stringent

2012-09-17 Thread JR Aquino
Tim, please check your /etc/pam.d/system-auth with the password block. If you see passwordrequisite pam_cracklib.so, then this is why you are having a problem. $ man pam_cracklib It is a local security library for enforcing strong password practices from the unix cli. ProTip: If you

Re: [Freeipa-users] Password requirements too stringent

2012-09-17 Thread Tim Hildred
JR I had that line. I commented it out. Thank you. Now, what do I have to restart? Tim Hildred, RHCE Content Author II - Engineering Content Services, Red Hat, Inc. Brisbane, Australia Email: thild...@redhat.com Internal: 8588287 Mobile: +61 4 666 25242 IRC: thildred - Original Message

Re: [Freeipa-users] Password requirements too stringent

2012-09-17 Thread JR Aquino
On Sep 17, 2012, at 7:53 PM, Tim Hildred wrote: JR I had that line. I commented it out. Thank you. Now, what do I have to restart? I believe it should take effect in real time, but you may need to test to be sure. If it is still happening, you may need to double check that some other