Re: [Freeipa-users] copy encrypted password into IPA?

2014-09-22 Thread Jitse Klomp
2014-09-22 21:31 GMT+02:00 Rob Crittenden : > The trick is having the hash in a format acceptable to 389-ds. I know it > works with crypt, you just need to prefix it with {crypt}. For > other formats, I don't know. ​{SHA} works as well - Jitse​ -- Manage your subscription for the Freeipa-user

Re: [Freeipa-users] State of play with 2FA and Kerberos please?

2014-07-08 Thread Jitse Klomp
2014-07-07 23:00 GMT+02:00 Steven Jones : > Hi, > > Apparently RHEL7 has limited 2FA? > > Is there any documentation on what it can do at present in RHEL7 please? > IPA in RHEL 7 doesn't support 2FA at the moment. Docs are here: https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Lin

Re: [Freeipa-users] Migration mode

2014-03-13 Thread Jitse Klomp
2014-03-13 18:00 GMT+01:00 Lukas Slebodnik : > On (13/03/14 14:51), Jitse Klomp wrote: > >2014-03-11 16:15 GMT+01:00 Jitse Klomp : > > > >> On 03/11/2014 03:06 PM, Sumit Bose wrote: > >> > >>> On Mon, Mar 10, 2014 at 11:09:48PM +0100, Jitse Klomp wrot

Re: [Freeipa-users] Migration mode

2014-03-13 Thread Jitse Klomp
2014-03-11 16:15 GMT+01:00 Jitse Klomp : > On 03/11/2014 03:06 PM, Sumit Bose wrote: > >> On Mon, Mar 10, 2014 at 11:09:48PM +0100, Jitse Klomp wrote: >> >>> On 10-03-14 22:06, Sumit Bose wrote: >>> >>>> Thank you. Maybe there is a change in retur

Re: [Freeipa-users] Migration mode

2014-03-11 Thread Jitse Klomp
On 03/11/2014 03:06 PM, Sumit Bose wrote: On Mon, Mar 10, 2014 at 11:09:48PM +0100, Jitse Klomp wrote: On 10-03-14 22:06, Sumit Bose wrote: Thank you. Maybe there is a change in return codes between MIT Kerberos 1.10 (Centos 6) and 1.11 (F20, RHEL7). Can you try to run KRB5_TRACE=/dev/stdout

Re: [Freeipa-users] Migration mode

2014-03-10 Thread Jitse Klomp
On 10-03-14 22:06, Sumit Bose wrote: Thank you. Maybe there is a change in return codes between MIT Kerberos 1.10 (Centos 6) and 1.11 (F20, RHEL7). Can you try to run KRB5_TRACE=/dev/stdout kinit unmigrated_u...@domain.nl on the different platforms and paste the results? I would expect to see [

Re: [Freeipa-users] Migration mode

2014-03-10 Thread Jitse Klomp
On 10-03-14 20:34, Sumit Bose wrote: On Mon, Mar 10, 2014 at 07:56:07PM +0100, Jitse Klomp wrote: On 10-03-14 18:57, Sumit Bose wrote: On Mon, Mar 10, 2014 at 05:23:59PM +0100, Jitse Klomp wrote: On 10-03-14 17:03, Lukas Slebodnik wrote: On (10/03/14 16:58), Lukas Slebodnik wrote: On (10/03

Re: [Freeipa-users] Migration mode

2014-03-10 Thread Jitse Klomp
On 10-03-14 18:57, Sumit Bose wrote: On Mon, Mar 10, 2014 at 05:23:59PM +0100, Jitse Klomp wrote: On 10-03-14 17:03, Lukas Slebodnik wrote: On (10/03/14 16:58), Lukas Slebodnik wrote: On (10/03/14 16:35), Jitse Klomp wrote: On 10-03-14 16:10, Lukas Slebodnik wrote: On (10/03/14 15:19

Re: [Freeipa-users] Migration mode

2014-03-10 Thread Jitse Klomp
On 10-03-14 17:03, Lukas Slebodnik wrote: On (10/03/14 16:58), Lukas Slebodnik wrote: On (10/03/14 16:35), Jitse Klomp wrote: On 10-03-14 16:10, Lukas Slebodnik wrote: On (10/03/14 15:19), Jitse Klomp wrote: On 10-03-14 14:59, Jitse Klomp wrote: On 10-03-14 14:35, Lukas Slebodnik wrote: On

Re: [Freeipa-users] Migration mode

2014-03-10 Thread Jitse Klomp
On 10-03-14 16:10, Lukas Slebodnik wrote: On (10/03/14 15:19), Jitse Klomp wrote: On 10-03-14 14:59, Jitse Klomp wrote: On 10-03-14 14:35, Lukas Slebodnik wrote: On (10/03/14 13:55), Jitse Klomp wrote: Hello all, I'm migrating our OpenLDAP-based IdM-system to IPA. Instead of using mi

Re: [Freeipa-users] Migration mode

2014-03-10 Thread Jitse Klomp
On 10-03-14 14:59, Jitse Klomp wrote: On 10-03-14 14:35, Lukas Slebodnik wrote: On (10/03/14 13:55), Jitse Klomp wrote: Hello all, I'm migrating our OpenLDAP-based IdM-system to IPA. Instead of using migrate-ds I used some custom scripts to import all of our users (~250) and groups

Re: [Freeipa-users] Migration mode

2014-03-10 Thread Jitse Klomp
On 10-03-14 14:35, Lukas Slebodnik wrote: On (10/03/14 13:55), Jitse Klomp wrote: Hello all, I'm migrating our OpenLDAP-based IdM-system to IPA. Instead of using migrate-ds I used some custom scripts to import all of our users (~250) and groups (~85) with IPA commands (ipa user-add etc.

[Freeipa-users] Migration mode

2014-03-10 Thread Jitse Klomp
Hello all, I'm migrating our OpenLDAP-based IdM-system to IPA. Instead of using migrate-ds I used some custom scripts to import all of our users (~250) and groups (~85) with IPA commands (ipa user-add etc.). To move passwords I configured the ipa-server to run in migration mode and did an ldapmo

Re: [Freeipa-users] FreeIPA Security issue : Anonymous user can fetch user details from IPA without authenticating

2014-01-01 Thread Jitse Klomp
It is possible to disable anonymous binds to the directory server. Take a look at https://docs.fedoraproject.org/en-US/Fedora/18/html/FreeIPA_Guide/disabling-anon-binds.html - Jitse On 01/01/2014 07:01 PM, Rajnesh Kumar Siwal wrote: It exposes the details of all the users/admins in the envi