Re: [Freeipa-users] ipa-getkeytab and mandatory password change

2012-06-20 Thread Darran Lofthouse
On 06/19/2012 07:12 PM, Stephen Ingram wrote: On Tue, Jun 19, 2012 at 9:55 AM, Simo Sorce s...@redhat.com wrote: On Tue, 2012-06-19 at 09:15 -0700, Stephen Ingram wrote: On Tue, Jun 19, 2012 at 2:54 AM, Dmitri Pal d...@redhat.com wrote: On 06/18/2012 11:58 AM, Darran Lofthouse wrote: Just

Re: [Freeipa-users] Request for comments - Apache SNI via IPA with kerberos authentication

2012-06-20 Thread James Hogarth
I'll try and replicate the blog findings in the course of the next couple of days if it works I'll add it to the wiki ... Set up a test this morning using Centos 6: nss-3.13.1-7.el6_2.x86_64 mod_nss-1.0.8-14.el6_2.x86_64 The behaviour was... odd SNI itself must have been working as

Re: [Freeipa-users] ipa-getkeytab and mandatory password change

2012-06-20 Thread Simo Sorce
On Wed, 2012-06-20 at 10:01 +0100, Darran Lofthouse wrote: On 06/19/2012 07:12 PM, Stephen Ingram wrote: On Tue, Jun 19, 2012 at 9:55 AM, Simo Sorce s...@redhat.com wrote: On Tue, 2012-06-19 at 09:15 -0700, Stephen Ingram wrote: On Tue, Jun 19, 2012 at 2:54 AM, Dmitri Pal d...@redhat.com

Re: [Freeipa-users] Request for comments - Apache SNI via IPA with kerberos authentication

2012-06-20 Thread Rob Crittenden
James Hogarth wrote: I'll try and replicate the blog findings in the course of the next couple of days if it works I'll add it to the wiki ... Set up a test this morning using Centos 6: nss-3.13.1-7.el6_2.x86_64 mod_nss-1.0.8-14.el6_2.x86_64 The behaviour was... odd SNI itself must

Re: [Freeipa-users] Request for comments - Apache SNI via IPA with kerberos authentication

2012-06-20 Thread James Hogarth
Only one nss database may be opened at a time. mod_nss should probably error out if multiple are defined to prevent confusion. I'd think a nickname should be unique to a given VirtualServer. If not then it's a bug. That makes sense - and yeah it should probably error out rather than just

[Freeipa-users] Updated 389-ds-base released

2012-06-20 Thread Rob Crittenden
An update of 389-ds-base has been released which should resolve the problems that IPA was having. 389-ds-base-1.2.11.5-1.fc17 corrects the problems we were seeing with managed entries. Don't forget to remove 389-ds-base from excludes in your yum.conf and/or use yum versionlock delete

[Freeipa-users] IPA client ldapsearch

2012-06-20 Thread Joe Linoff
Hi: This is a best practices question. I am really impressed with FreeIPA and I want to make sure that I follow the recommended usage paradigms. What is the best way to do a ldapsearch operation on a FreeIPA client? One approach would be to install LDAP utilities on the client and run

Re: [Freeipa-users] IPA client ldapsearch

2012-06-20 Thread Rob Crittenden
Joe Linoff wrote: Hi: This is a best practices question. I am really impressed with FreeIPA and I want to make sure that I follow the recommended usage paradigms. What is the best way to do a ldapsearch operation on a FreeIPA client? One approach would be to install LDAP utilities on the

Re: [Freeipa-users] Do clients have to be in teh same DNS zone / FQDN as the IPA servers / Kerberos Realm?

2012-06-20 Thread Steven Jones
I assume with no reply, now one knows? regards Steven Jones Technical Specialist - Linux RHCE Victoria University, Wellington, NZ 0064 4 463 6272 From: freeipa-users-boun...@redhat.com [freeipa-users-boun...@redhat.com] on behalf of Steven Jones

Re: [Freeipa-users] Do clients have to be in teh same DNS zone / FQDN as the IPA servers / Kerberos Realm?

2012-06-20 Thread Rob Crittenden
Steven Jones wrote: I assume with no reply, now one knows? That's not really fair, it hasn't even been 24 hours. My IPA servers are say ipa1 and 2.ipa.example.com I have existing linux servers that I would rather not change the FQDN on, say server1.example.com Do I actually have to make

Re: [Freeipa-users] Do clients have to be in teh same DNS zone / FQDN as the IPA servers / Kerberos Realm?

2012-06-20 Thread Steven Jones
Hi, Sorry. but Im getting hammered by my management for instant answers...they asked last night and expect an answer this morning.and I'm expected to catch up and deploy several important solutions/projects all hinging on IPA ASAP... 2.2 isnt in RHEL6.3 though? Anyway I

Re: [Freeipa-users] IPA client ldapsearch

2012-06-20 Thread Joe Linoff
Hi Rob: Your best bet is to use the ipa-admintools package. Thank you, I appreciate the help. As you suggested, I will use the ipa-admintools package. You probably don't to install this on every client. That makes sense. Regards, Joe -Original Message- From: Rob Crittenden

Re: [Freeipa-users] IPA client ldapsearch

2012-06-20 Thread Steven Jones
Hi, I export an ldif and use jexplorer regards Steven Jones Technical Specialist - Linux RHCE Victoria University, Wellington, NZ 0064 4 463 6272 From: freeipa-users-boun...@redhat.com [freeipa-users-boun...@redhat.com] on behalf of Joe Linoff

Re: [Freeipa-users] ipa installation problem -- 2

2012-06-20 Thread george he
Hi Rob, Client configuration complete. but it says Failed to upload host SSH public keys. Hope it's OK. Thanks a lot, George From: Rob Crittenden rcrit...@redhat.com To: george he george_...@yahoo.com Cc: freeipa-users@redhat.com freeipa-users@redhat.com