Re: [Freeipa-users] Centos7, selinux, certmonger, and openldap

2014-08-05 Thread Martin Kosek
On 08/04/2014 07:06 PM, Nordgren, Bryce L -FS wrote: Hmm, sorry for incomplete instructions then. I updated the instructions to cope with that situation better (details in https://fedorahosted.org/freeipa/ticket/4466#comment:2). Please feel free to report more findings or even better help us

Re: [Freeipa-users] Centos7, selinux, certmonger, and openldap

2014-08-04 Thread Martin Kosek
On 08/04/2014 01:36 AM, Nordgren, Bryce L -FS wrote: Spoke too soon. I needed the following extra selinux policy module to make all the AVCs go away. BTW: the instructions on http://www.freeipa.org/page/PKI really only work if you leave the password blank when you create a new database

[Freeipa-users] Centos7, selinux, certmonger, and openldap

2014-08-03 Thread Nordgren, Bryce L -FS
Hey all, On CentOS 7 (presumably RHEL7 too), the tutorial on http://www.freeipa.org/page/PKI breaks (when applied to installing a certificate in /etc/openldap/certs). The offending line is ipa-getcert request -d /etc/openldap/certs ..., and the failure message is /etc/openldap/certs must be a

Re: [Freeipa-users] Centos7, selinux, certmonger, and openldap

2014-08-03 Thread Nordgren, Bryce L -FS
Spoke too soon. I needed the following extra selinux policy module to make all the AVCs go away. BTW: the instructions on http://www.freeipa.org/page/PKI really only work if you leave the password blank when you create a new database with certutil. Otherwise, the ipa-getcert request command

Re: [Freeipa-users] Centos7, selinux, certmonger, and openldap

2014-08-03 Thread Simo Sorce
On Sun, 2014-08-03 at 23:36 +, Nordgren, Bryce L -FS wrote: Spoke too soon. I needed the following extra selinux policy module to make all the AVCs go away. BTW: the instructions on http://www.freeipa.org/page/PKI really only work if you leave the password blank when you create a new