[Freeipa-users] Re: How to make ipa root certificate available system wide

2020-03-02 Thread Nick DeMarco via FreeIPA-users
This article explains how Firefox and the OS certificate database are related. Starting with Firefox 64, an enterprise policy controls the relationship between Firefox trusted roots and OS trusted roots. https://support.mozilla.org/en-US/kb/setting-certificate-authorities-firefox

[Freeipa-users] Re: Debian client browsers don't trust root cert after ipa-client-install

2020-03-02 Thread Nicholas DeMarco via FreeIPA-users
Just after pressing send on this message, I found where Firefox can be configured to trust enterprise root certificates. See this article: https://support.mozilla.org/en-US/kb/setting-certificate-authorities-firefox Once configured, Firefox should trust the OS certificate store. But I haven't

[Freeipa-users] Debian client browsers don't trust root cert after ipa-client-install

2020-03-02 Thread Nicholas DeMarco via FreeIPA-users
Hello, Thanks to this group's help, I'm learning my way through IPA's certificate system. I read Fraser's well written post on creating sub-CAs, and successfully got everything to work. I then ran into the same problem Kevin Vasko hit in this thread:

[Freeipa-users] Re: sshd.config overwriten during FIRST ipa-client-installation

2020-03-02 Thread Rob Crittenden via FreeIPA-users
pgb205 wrote: > 1.correct > 2. only port is configured to something else. the rest of sshd_conf is > default > 3. correct. only append --no-sshd option to prevent reconfiguration of > sshd_conf file > 4. correct. after install port 22 is again in effect > 5. no. after uninstall there are no

[Freeipa-users] Re: sshd.config overwriten during FIRST ipa-client-installation

2020-03-02 Thread pgb205 via FreeIPA-users
1.correct2. only port is configured to something else. the rest of sshd_conf is default3. correct. only append --no-sshd option to prevent reconfiguration of sshd_conf file4. correct. after install port 22 is again in effect5. no. after uninstall there are no changes. And trying to re-install

[Freeipa-users] Re: Domain controllers switch to LDAPS

2020-03-02 Thread Ronald Wimmer via FreeIPA-users
On 25.02.20 17:26, Alexander Bokovoy via FreeIPA-users wrote: [...] Some people are panicking and want to switch everything to LDAPS. For those there is additional enhancement in works. For everyone else there is no need to do anything. [...] According to the information I have our AD guys are