Re: [Freeipa-users] Integrating with Smart Cards

Hi, We want to use 2FA tokens and cant because of a Kerberos issue. I assume if this hasnt been upgraded yet that you cant get the passthrough? I'll we interested to know if that is now not the case or at least an idea when it will be GA. regards Steven Jones Technical Specialist - Linux RHC

[Freeipa-users] RHEL7 IPA servers

Hi, Any thoughts / issues on upgrading RHEL6.5 IPA servers to RHEL7 when it comes out? ie from the process of doing it, mixing issues ie 1 RHEL7 master with 2 x 6.5 masters? new capabilities making it a must have? that wont be on 6.5? regards Steven Jones Technical Specialist - Linux RHCE

[Freeipa-users] Integrating with Smart Cards

Hi all, I'm very new to FreeIPA, so I hope this isn't answered in documentation somewhere already. I'm working to get my infrastructure DIACAP approved, and part of this process includes unique user accounts with smart card integration. I was hoping that since FreeIPA utilizes Dogtag, I'd be

Re: [Freeipa-users] ipa <-> samba

On Wed, 30 Apr 2014, Torsten Scholak wrote: Hi there, I am considering to set up a smb2 server intended for certain windows machines and macs that are not member of the kerberos realm and hence not single sign-on enabled (read: guest machines). The server for the smb service runs a fresh Fedora

[Freeipa-users] ipa <-> samba

Hi there, I am considering to set up a smb2 server intended for certain windows machines and macs that are not member of the kerberos realm and hence not single sign-on enabled (read: guest machines). The server for the smb service runs a fresh Fedora 20 and is also holding an ipa replica. Le

[Freeipa-users] Biasing which master clients talk to first

Hi, We have a master at our DR site which is "further way" than our 2 local masters, is there a way (in DNS say) that we could "encourage" clients to use the closer IPA masters? eg host -t SRV _ldap._tcp.ods.vuw.ac.nz _ldap._tcp.ods.vuw.ac.nz has SRV record 0 100 389 serveripa3 _ldap._tcp.ods

[Freeipa-users] Automembership not working

Hi, I am trying to create rules to place users in given user groups based on the value of their ou (Organization Unit) field in their profiles. For some reason it is not working, and I am trying to understand why. The rule is very simple and looks like this > ipa automember-find engineering > G

Re: [Freeipa-users] dse.ldif and dse.ldif.bak are lost

Selon Rich Megginson : > On 04/30/2014 09:22 AM, artj...@free.fr wrote: > > Thanks a lot. My answers below. > > Please keep replies on list, for others to see. Sorry, I knew it but I forgot. > > > > > Selon Rich Megginson : > > > >> On 04/30/2014 03:26 AM, artj...@free.fr wrote: > >>> Hi, > >>> >

Re: [Freeipa-users] dse.ldif and dse.ldif.bak are lost

On 04/30/2014 09:22 AM, artj...@free.fr wrote: Thanks a lot. My answers below. Please keep replies on list, for others to see. Selon Rich Megginson : On 04/30/2014 03:26 AM, artj...@free.fr wrote: Hi, I have 1 ipa master 'ipasrv' and 2 replicas 'iparpl1 iparpl2' installed with --setup-

Re: [Freeipa-users] dse.ldif and dse.ldif.bak are lost

artj...@free.fr wrote: Hi, I have 1 ipa master 'ipasrv' and 2 replicas 'iparpl1 iparpl2' installed with --setup-ca option. Since a few days I have an issue with '389 Directory Server' on the master (ipasrv) and on the 2nd replica (iparpl2) with the following messages: The configuration file /et

Re: [Freeipa-users] dse.ldif and dse.ldif.bak are lost

On 04/30/2014 03:26 AM, artj...@free.fr wrote: Hi, I have 1 ipa master 'ipasrv' and 2 replicas 'iparpl1 iparpl2' installed with --setup-ca option. Since a few days I have an issue with '389 Directory Server' on the master (ipasrv) and on the 2nd replica (iparpl2) with the following messages: Th

[Freeipa-users] Fwd: Re: dse.ldif and dse.ldif.bak are lost

Original Message Subject:Re: [Freeipa-users] dse.ldif and dse.ldif.bak are lost Date: Wed, 30 Apr 2014 08:37:01 -0400 From: Dmitri Pal Reply-To: d...@redhat.com Organization: Red Hat To: artj...@free.fr On 04/30/2014 05:26 AM, artj...@free.fr wrote:

Re: [Freeipa-users] Best practices for core servers

I can already see from this that our key problem may have been that we had one server functioning as the hub and every other remote replica had just one agreement, but those agreements were all with the hub. So that hub had ten agreements. Badness. We'll give this some good attention as we mo

[Freeipa-users] dse.ldif and dse.ldif.bak are lost

Hi, I have 1 ipa master 'ipasrv' and 2 replicas 'iparpl1 iparpl2' installed with --setup-ca option. Since a few days I have an issue with '389 Directory Server' on the master (ipasrv) and on the 2nd replica (iparpl2) with the following messages: The configuration file /etc/dirsrv/slapd-MYINSTANCE

Re: [Freeipa-users] Hardening freeipa on the internet

On 04/28/2014 05:16 PM, Simo Sorce wrote: > On Mon, 2014-04-28 at 16:11 +0100, Andrew Holway wrote: >>> I realized that you probably want to disable anonymous access to LDAP. It >>> will prevent random strangers to enumerate all users in your database... >> >> This sounds like a bug no? anonymous a

Re: [Freeipa-users] Best practices for core servers

On 04/28/2014 01:03 PM, Bret Wortman wrote: > We are planning to reconfigure our core Freeipa servers, basically building a > replacement infrastructure and migrating to it. What we're planning right now > is > a core of three Freeipa servers each of which has a CA, with as much > distribution