[Freeipa-users] mixed DNS subnets for FreeIPA and M$ AD

2015-12-08 Thread Harald Dunkel
Hi folks, currently I have a DNS domain "example.com" with several subdomains "s1.example.com", "s2.example.com", etc. (using NIS for IM). DNServer is bind9. There is a special stub zone "ws.example.com" provided by AD (including the correct TXT DNS records). Now I would like to move the Unix

Re: [Freeipa-users] Reverse Zone IPv6 Syntax ?

2015-12-08 Thread Martin Basti
On 08.12.2015 12:52, Günther J. Niederwimmer wrote: Hello, Am Monday 07 December 2015, 22:46:45 schrieb Martin Basti: On 07.12.2015 21:26, Günther J. Niederwimmer wrote: Am Monday 07 December 2015, 20:41:29 schrieb Martin Basti: On 07.12.2015 20:12, Pavel Picka wrote: Hello for me

Re: [Freeipa-users] Reverse Zone IPv6 Syntax ?

2015-12-08 Thread Günther J . Niederwimmer
Hello Martin, Am Tuesday 08 December 2015, 13:10:57 schrieb Martin Basti: > On 08.12.2015 12:52, Günther J. Niederwimmer wrote: > > Hello, > > > > Am Monday 07 December 2015, 22:46:45 schrieb Martin Basti: > >> On 07.12.2015 21:26, Günther J. Niederwimmer wrote: > >>> Am Monday 07 December 2015,

Re: [Freeipa-users] Reverse Zone IPv6 Syntax ?

2015-12-08 Thread Günther J . Niederwimmer
Hello, Am Monday 07 December 2015, 22:46:45 schrieb Martin Basti: > On 07.12.2015 21:26, Günther J. Niederwimmer wrote: > > Am Monday 07 December 2015, 20:41:29 schrieb Martin Basti: > >> On 07.12.2015 20:12, Pavel Picka wrote: > >>> Hello > >>> > >>> for me working if ipv6 address is e.g.

Re: [Freeipa-users] Reverse Zone IPv6 Syntax ? [solved]

2015-12-08 Thread Martin Basti
On 08.12.2015 13:27, Günther J. Niederwimmer wrote: Hello Martin, Am Tuesday 08 December 2015, 13:10:57 schrieb Martin Basti: On 08.12.2015 12:52, Günther J. Niederwimmer wrote: Hello, Am Monday 07 December 2015, 22:46:45 schrieb Martin Basti: On 07.12.2015 21:26, Günther J. Niederwimmer

Re: [Freeipa-users] .k5login and auth_to_local_names principal -> account mapping and localauth plugin not working on 6.7

2015-12-08 Thread Stefano Cortese
Jakub Hrozek wrote: On Mon, Dec 07, 2015 at 06:04:30PM +0100, Stefano Cortese wrote: So the questions are: - is there another cleaner way to exclude the localauth sssd plugin (considering that the configuration snippet is recreated at every sssd restart)?

Re: [Freeipa-users] .k5login and auth_to_local_names principal -> account mapping and localauth plugin not working on 6.7

2015-12-08 Thread Stefano Cortese
Sumit Bose wrote: On Mon, Dec 07, 2015 at 06:04:30PM +0100, Stefano Cortese wrote: So the questions are: - is there another cleaner way to exclude the localauth sssd plugin (considering that the configuration snippet is recreated at every sssd restart)?

Re: [Freeipa-users] .k5login and auth_to_local_names principal -> account mapping and localauth plugin not working on 6.7

2015-12-08 Thread Stefano Cortese
Sumit Bose wrote: On Mon, Dec 07, 2015 at 06:04:30PM +0100, Stefano Cortese wrote: So the questions are: - is there another cleaner way to exclude the localauth sssd plugin (considering that the configuration snippet is recreated at every sssd restart)?

Re: [Freeipa-users] mixed DNS subnets for FreeIPA and M$ AD

2015-12-08 Thread Petr Spacek
On 8.12.2015 13:17, Harald Dunkel wrote: > Hi folks, > > currently I have a DNS domain "example.com" with several > subdomains "s1.example.com", "s2.example.com", etc. (using > NIS for IM). DNServer is bind9. There is a special stub zone > "ws.example.com" provided by AD (including the correct >

Re: [Freeipa-users] .k5login and auth_to_local_names principal -> account mapping and localauth plugin not working on 6.7

2015-12-08 Thread Sumit Bose
On Tue, Dec 08, 2015 at 02:33:40PM +0100, Stefano Cortese wrote: > Hi Sumit > yes it works commenting out the line 'enable_only = sssd' and making > the file immutable , namely the .k5login file is read and enforced. > But respect to the solution emptying completely the snippet, it is lost > the

Re: [Freeipa-users] .k5login and auth_to_local_names principal -> account mapping and localauth plugin not working on 6.7

2015-12-08 Thread Stefano Cortese
Simo Sorce wrote: I am attempting to log from a local machine as "userA" using the credentials of a "service principal" defined in IPA to a remote machine as "userB" The userB principal is resolvable on the remote host via "getent passwd userB" because it is a user principal.

Re: [Freeipa-users] .k5login and auth_to_local_names principal -> account mapping and localauth plugin not working on 6.7

2015-12-08 Thread Jakub Hrozek
On Tue, Dec 08, 2015 at 02:30:54PM +0100, Stefano Cortese wrote: >Jakub Hrozek wrote: > > On Mon, Dec 07, 2015 at 06:04:30PM +0100, Stefano Cortese wrote: > > > So the questions are: > - is there another cleaner way to exclude the localauth sssd plugin > (considering that the

Re: [Freeipa-users] mixed DNS subnets for FreeIPA and M$ AD

2015-12-08 Thread Harald Dunkel
On 12/08/2015 03:08 PM, Petr Spacek wrote: > > Does > > https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Linux_Domain_Identity_Authentication_and_Policy_Guide/prerequisites.html#dns-reqs > > and > >

Re: [Freeipa-users] HBAC access denied, all AD groups not detected

2015-12-08 Thread Sauls, Jeff
> Jakub Hrozek wrote: > > On Mon, Dec 07, 2015 at 02:04:26PM -0600, Sauls, Jeff wrote: > > > Jakub Hrozek wrote: > > > > > > On Fri, Dec 04, 2015 at 02:03:04PM -0600, Sauls, Jeff wrote: > > > > Hello, > > > > > > > > We are having a problem with HBAC that appears to be related to > > > > group