Dmitri Pal wrote:
On 04/10/2014 12:18 PM, quest monger wrote:
Sorry about that. So I am Looking at the Solaris 10 client
documentation here -

It says do the following on Solaris client -

    ldapclient manual
    -a proxyPassword={NS1}fbc123a92116812

Whats that proxyPassword for?

I suspect that it is a password that corresponds to the proxy user.
The client component on Solaris (pure speculation on my side) seems to
use proxy user to connect to LDAP server and do some operations for the
host. It is similar to SSSD but SSSD does not use passwords, it uses
keytabs if talks to IPA.

There are a number of different profile levels available, see

proxy is usually a shared account that the Solaris box uses to authenticate to the LDAP server.

Solaris uses passwords but to prevent them from being stored in
configuration in clear the are "obfuscated" with the NS1 method
I suspect there should be some tool on Solaris that takes password and
creates an obfuscated string like this.

I didn't experiment using a proxy password inside a profile. I'll bet that if you manually enroll a client then you can dig out the password on that local system and store that in the profile.

There is also a self level which uses Kerberos. I've never used it myself (it may be newer than my experience with Solaris) but there are some fairly detailed docs on it at




On Thu, Apr 10, 2014 at 12:09 PM, Dmitri Pal <
<>> wrote:

    On 04/10/2014 11:41 AM, quest monger wrote:
    Thanks Rob, those bug reports help.
    One more question, in the official Solaris 10 documentation, i
    see this stuff -


    Is there a way to generate that password hash for a new password.
    I think that should be part of the documentation, dont want all
    Solaris IPA users to be using the same password and corresponding

    Can you rephrase the question?
    It is unclear what hash you are asking about.
    If you are using IPA you do not need local password hashes.


    On Wed, Apr 9, 2014 at 4:36 PM, Rob Crittenden
    < <>> wrote:

        quest monger wrote:

            I have read through the official documentation here for
            Solaris-10 -
            I have found a few web posts on how to make it work for
            Have any of you tried adding a Solaris-11 host to an
            existing IPA
            server? If so, do you have any
            documentation/how-tos/instructions that i
            could use to do the same. Any help is appreciated.
            I am trying to do this to so I can centralize SSH
            authentication for all
            my Solaris-11 and Linux hosts.

        That is pretty much all we've got. There is a bug open with
        some documentation updates, and some
        more in

        We use sssd to help with centralized SSH auth so it probably
        won't work as smoothly on Solaris as it does on sssd-based
        Linux systems. See sss_ssh_authorizedkeys(1) and

        This document describes how it works in IPA


    Freeipa-users mailing list  <>

    Thank you,
    Dmitri Pal

    Sr. Engineering Manager IdM portfolio
    Red Hat, Inc.

    Freeipa-users mailing list <>

Thank you,
Dmitri Pal

Sr. Engineering Manager IdM portfolio
Red Hat, Inc.

Freeipa-users mailing list

Freeipa-users mailing list

Reply via email to