Hi Alex,
On 2024-01-24 08:13:44, Alexander Bokovoy wrote:
On Аўт, 23 сту 2024, Harald Dunkel wrote:
I found one problem by now: Regular UIDs start with 501 in my environment,
for historical reasons. The GIDs are >=1000. When we migrated from good ol'
yellow pages to FreeIPA there was no problem with small UIDs. And in the
BSD and SYSV years before Linux only the UIDs <100 were reserved for system.
Do I have to migrate the existing users between 501 and 999 to new UIDs
> 1000? I would like to see an error message showing that this is indeed the
problem, first. Surely I would prefer to just adjust the ID ranges instead
of migrating about 90 user accounts.
What would you suggest?
You can add a new local ID range to cover existing UIDs/GIDs. Make sure
to set base RID and secondary base RID when defining a new ID range.
See https://access.redhat.com/articles/7027037 for details.
ACK. One question, though: Shouldn't the
ipa config-mod --enable-sid --add-sids
I had run set the missing ipantsecurityidentifier entries at least
for the users matching the existing address range from 1000 to 99999?
It didn't, AFAICT. It didn't show an error message, either.
Looking at the changes between the previously installed freeipa
packages and the version I have right now I got
# rpm -q --changelog ipa-server
* Fri Dec 01 2023 Julien Rische <[email protected]> - 4.9.12-11
- Generate Kerberos PAC as soon as server installation completed
Resolves: RHEL-16532
* Thu Nov 16 2023 Julien Rische <[email protected]> - 4.9.12-10
- ipa-kdb: Detect and block Bronze-Bit attacks
Resolves: RHEL-16532
- Fix for CVE-2023-5455
Resolves: RHEL-12577
* Wed Oct 04 2023 Julien Rische <[email protected]> - 4.9.12-9
:
:
4.9.12-9 was the previous version. It worked fine. Fixing the CVEs
was the reason for the upgrade. Kerberos authentication is fine in
the new setup, too. How comes these changes triggered the problem
about missing ipantsecurityidentifier entries? Is this as intended?
Regards
Harri
--
_______________________________________________
FreeIPA-users mailing list -- [email protected]
To unsubscribe send an email to [email protected]
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/[email protected]
Do not reply to spam, report it:
https://pagure.io/fedora-infrastructure/new_issue
