Re: [Freeipa-users] 4.1.0: Logon issue after upgrading IPA

2015-03-16 Thread Jakub Hrozek
On 16 Mar 2015, at 22:03, Andreas Skarmutsos Lindh andr...@superblock.se wrote: Hi everyone, After upgrading (using rpm, yum upgrade) I can no longer login to my machines using ssh. Before the upgrade everything was working fine. Some loose facts: - I'm installing IPA packages from

Re: [Freeipa-users] IPA Trusts

2015-03-16 Thread Gould, Joshua
FWIW, we have IPA working with AD managed DNS. As Alexander mentioned, you¹ll need to have DNS properly configured. What I¹ve found is the most critical is having the SRV records properly defined for the AD domain and the IPA domains. I kind of wish the docs were a bit clearer on which of the SRV

Re: [Freeipa-users] AD trust users cannot login to Solaris

2015-03-16 Thread nathan
and put IPA's ca.crt (available on any IPA machine at /etc/ipa/ca.crt) into /var/ldap's database with certutil: # certutil -A -a -i ca.crt -n CA -t CT -d /var/ldap Ok, following your advice I installed the SUNWtlsu package (prepares rant about how the top 3 pages of google results didn't tell

Re: [Freeipa-users] Fwd: Re: AD -- FreeIPA Password Sync --- Peer reports incompatible or unsupported protocol

2015-03-16 Thread Noriko Hosoi
Hello, Gonzalo, Any progress on your Password Synchronization? Let me double check a couple of things. You wrote you installed PassSync on Windows 2013 (which could be a typo?) We support Windows Server 2008 R2 and 2012 R2. We also confirmed it works on Windows Server 2003 R2. On

Re: [Freeipa-users] OTP and cached credentials

2015-03-16 Thread Dmitri Pal
On 03/15/2015 04:04 PM, Steven Jones wrote: The ability to use OTP with laptops is targeted to the 1.13 release. For my background reference, which version of RHEL will that probably be please? regards Steven Probably 7.2 -- Thank you, Dmitri Pal Sr. Engineering Manager IdM

Re: [Freeipa-users] Saltstack and ipa-install on Centos7 failing

2015-03-16 Thread Andrew Holway
Hi, I think this is perhaps a bug? Thanks, Andrew On 13 March 2015 at 15:55, Andrew Holway andrew.hol...@gmail.com wrote: On 13 March 2015 at 15:33, Michael Lasevich mlasev...@gmail.com wrote: Is SELinux on? Yes, ipa-server-install is running in the initrc_t domain but I guess its

Re: [Freeipa-users] AD trust users cannot login to Solaris

2015-03-16 Thread Alexander Bokovoy
On Mon, 16 Mar 2015, nat...@nathanpeters.com wrote: and put IPA's ca.crt (available on any IPA machine at /etc/ipa/ca.crt) into /var/ldap's database with certutil: # certutil -A -a -i ca.crt -n CA -t CT -d /var/ldap Ok, following your advice I installed the SUNWtlsu package (prepares rant

[Freeipa-users] 4.1.0: Logon issue after upgrading IPA

2015-03-16 Thread Andreas Skarmutsos Lindh
Hi everyone, After upgrading (using rpm, yum upgrade) I can no longer login to my machines using ssh. Before the upgrade everything was working fine. Some loose facts: - I'm installing IPA packages from the RHEL repositories onto RHEL systems, so I'm not sure if this is the right mailing list to

Re: [Freeipa-users] Gave Up on RHEL6-7 migration, starting over. (ipa migrate-ds)

2015-03-16 Thread Dmitri Pal
On 03/16/2015 03:49 PM, Steven Jones wrote: Hi, Our present IPA started on RHEL6.2 (I think) and has a self-signed cert which has the wrong encoding. I am just replacing it now, its preventing RHEL7.1 joining/working/replicating. Now I am waiting on a BZ, so upgrading to RHEL7.1 isnt easy

Re: [Freeipa-users] AD trust users cannot login to Solaris

2015-03-16 Thread Dmitri Pal
On 03/16/2015 04:21 PM, nat...@nathanpeters.com wrote: and put IPA's ca.crt (available on any IPA machine at /etc/ipa/ca.crt) into /var/ldap's database with certutil: # certutil -A -a -i ca.crt -n CA -t CT -d /var/ldap Ok, following your advice I installed the SUNWtlsu package (prepares

Re: [Freeipa-users] solaris 10 ad authentication happening with only one user

2015-03-16 Thread Gianluca Cecchi
On Mon, Mar 16, 2015 at 6:57 AM, Ben .T.George bentech4...@gmail.com wrote: HI the user Ben is from Ad, how can i assign shell to that user.? Regards, Ben Yes I know. I have not administered it so I have nt experience from a configuration point of view, but I think you have to extend

Re: [Freeipa-users] solaris 10 ad authentication happening with only one user

2015-03-16 Thread Ben .T.George
HI the user Ben is from Ad, how can i assign shell to that user.? Regards, Ben On Sun, Mar 15, 2015 at 7:14 PM, Gianluca Cecchi gianluca.cec...@gmail.com wrote: Il 15/Mar/2015 11:04 Ben .T.George bentech4...@gmail.com ha scritto: here is the getent passwd: skipped

[Freeipa-users] IPA Trusts

2015-03-16 Thread Erinn Looney-Triggs
Reading through the RHEL 7.1 documents on setting up a trust between IPA and AD I came across a note that IPA had to be managing DNS in order for this to work. Why is this? Is there any way around this? At this point the DNS IPA would manage is DNSSEC signed and as such can't be managed by IPA,

Re: [Freeipa-users] IPA Trusts

2015-03-16 Thread Erinn Looney-Triggs
On Monday, March 16, 2015 09:13:56 PM Alexander Bokovoy wrote: On Mon, 16 Mar 2015, Erinn Looney-Triggs wrote: Reading through the RHEL 7.1 documents on setting up a trust between IPA and AD I came across a note that IPA had to be managing DNS in order for this to work. Why is this? Is there

Re: [Freeipa-users] IPA Trusts

2015-03-16 Thread Alexander Bokovoy
On Mon, 16 Mar 2015, Erinn Looney-Triggs wrote: Reading through the RHEL 7.1 documents on setting up a trust between IPA and AD I came across a note that IPA had to be managing DNS in order for this to work. Why is this? Is there any way around this? At this point the DNS IPA would manage is

[Freeipa-users] Gave Up on RHEL6-7 migration, starting over. (ipa migrate-ds)

2015-03-16 Thread Benjamin Reed
So given my RHEL6 machine started on an older FreeIPA 3.0, was a self-signed cert, and has gone through all kinds of hell and I'm having an impossible time setting up new master(s), I've decided to start over. I installed the EPEL7 FreeIPA 4.1.3 RPMs, in the hopes that being on the latest would

Re: [Freeipa-users] Gave Up on RHEL6-7 migration, starting over. (ipa migrate-ds)

2015-03-16 Thread Steven Jones
Hi, Our present IPA started on RHEL6.2 (I think) and has a self-signed cert which has the wrong encoding. I am just replacing it now, its preventing RHEL7.1 joining/working/replicating. Now I am waiting on a BZ, so upgrading to RHEL7.1 isnt easy or quick. regards Steven

Re: [Freeipa-users] solaris to free IPA user issue

2015-03-16 Thread Martin Kosek
On 03/15/2015 09:31 AM, Ben .T.George wrote: HI i am using free ipa 4.1.2 on centos 7. from root user, i can able to switch to IPA user : su ben but from any other user if i try that, it's asking for password. if i gave the correct passord also, its not accepting .This is what i am

Re: [Freeipa-users] solaris to free IPA user issue

2015-03-16 Thread Jakub Hrozek
On Mon, Mar 16, 2015 at 09:55:55AM +0100, Martin Kosek wrote: On 03/15/2015 09:31 AM, Ben .T.George wrote: HI i am using free ipa 4.1.2 on centos 7. from root user, i can able to switch to IPA user : su ben but from any other user if i try that, it's asking for password. if i