Re: [Freeipa-users] trouble creating a replica in the cloud

2014-02-13 Thread Petr Spacek
On 13.2.2014 01:13, Todd Maugh wrote: thanks Guys, turns out this was a redhat bug in the 6.4 image of the aws instance, so I built in 6.5 and was able to get past it, but now I'm failing with this: Your system may be partly configured. Run /usr/sbin/ipa-server-install --uninstall to clean

Re: [Freeipa-users] SELinux user categories

2014-02-13 Thread Martin Kosek
On 02/12/2014 09:33 PM, Josh wrote: On Feb 12, 2014, at 3:20 PM, Rob Crittenden rcrit...@redhat.com wrote: Josh wrote: On Feb 11, 2014, at 2:52 PM, Rob Crittenden rcrit...@redhat.com wrote: Josh wrote: On Feb 11, 2014, at 2:44 PM, Rob Crittenden rcrit...@redhat.com

Re: [Freeipa-users] authentication against compat

2014-02-13 Thread Jakub Hrozek
On Wed, Feb 12, 2014 at 03:35:58PM -0800, Will Sheldon wrote: Is SSSD working for IPA sudo now? It was working even before, just with a bit of manual config, as I said in the reply you quoted, you just had to configure 'sudo_provider=ldap' I saw this From Jakub Horozek in this list a little

Re: [Freeipa-users] ipa-client-install fails on replica because of kinit cannot contact any KDC

2014-02-13 Thread Rob Crittenden
Shree wrote: Ok, failed at the same stage, would you like the entire /var/log/ipareplica-install.log. If yes, should I attach to the email? pa : INFO File /usr/lib/python2.6/site-packages/ipaserver/install/installutils.py, line 614, in run_script return_value =

Re: [Freeipa-users] SELinux user categories

2014-02-13 Thread Rob Crittenden
Martin Kosek wrote: On 02/12/2014 09:33 PM, Josh wrote: On Feb 12, 2014, at 3:20 PM, Rob Crittenden rcrit...@redhat.com wrote: Josh wrote: On Feb 11, 2014, at 2:52 PM, Rob Crittenden rcrit...@redhat.com wrote: Josh wrote: On Feb 11, 2014, at 2:44 PM, Rob Crittenden rcrit...@redhat.com

[Freeipa-users] cannot delete PTR DNS records from the command line

2014-02-13 Thread Brent Clark
I have run into a problem where I cannot delete PTR DNS records from the command line. This is something that until recently I have never attempted. IPA version = ipa-server-2.2.0-17.el6_3.1.x86_64 When I try to delete a PTR record I get this message. ipa dnsrecord-del 41.100.10.in-addr-arpa.

Re: [Freeipa-users] cannot delete PTR DNS records from the command line

2014-02-13 Thread Martin Kosek
On 02/13/2014 04:15 PM, Brent Clark wrote: I have run into a problem where I cannot delete PTR DNS records from the command line. This is something that until recently I have never attempted. IPA version = ipa-server-2.2.0-17.el6_3.1.x86_64 When I try to delete a PTR record I get this

Re: [Freeipa-users] cannot delete PTR DNS records from the command line

2014-02-13 Thread Petr Spacek
On 13.2.2014 16:15, Brent Clark wrote: I have run into a problem where I cannot delete PTR DNS records from the command line. This is something that until recently I have never attempted. IPA version = ipa-server-2.2.0-17.el6_3.1.x86_64 When I try to delete a PTR record I get this message. ipa

Re: [Freeipa-users] cannot delete PTR DNS records from the command line

2014-02-13 Thread Brent Clark
Here are the results of the commands asked for. Also attached is a png of the webui showing the zone and record exists that I want to delete. Many Thanks! ipa dnsrecord-find 41.100.10.in-addr-arpa. 250 Number of entries returned 0 ipa

[Freeipa-users] IPA Replica cannot add user

2014-02-13 Thread Bruno Henrique Barbosa
Hi everyone, I've installed my IPA environment as it follows: ipa01.example.com - master install ipa02.example.com - replica install, as the guide says, with ipa-replica-prepare on ipa01 and ipa-replica-install using gpg key generated. All good, environment is fine, can access both UI,

Re: [Freeipa-users] cannot delete PTR DNS records from the command line

2014-02-13 Thread Brent Clark
Hmm, amazing what works when you spell stuff right. Epic Fail on my part. Face plant in the mud. Apologies to all for such silliness that I have put you all thru. Thanks! On Thu, Feb 13, 2014 at 9:25 AM, Petr Vobornik pvobo...@redhat.com wrote: Hello, The zone name is:

[Freeipa-users] WebUI questions.

2014-02-13 Thread Brent Clark
When I assign a user the role of User Administrator, when they log into the WebUI, they can see all the role, dns, config, tab and links. They should only see the necessary tabs and links that having that role requires and none of the extra stuff. Is there a way to limit when appears in the

[Freeipa-users] IPA not Starting after crash

2014-02-13 Thread John Moyer
Hello All, We’ve been running IPA now nicely for a while, and I wrote a script to run something every minute and that filled the logs and crashed the server. I cleared the logs and started IPA again. [root@ log]# ipactl start Starting Directory Service Starting dirsrv:

Re: [Freeipa-users] IPA not Starting after crash

2014-02-13 Thread Rob Crittenden
John Moyer wrote: Hello All, We’ve been running IPA now nicely for a while, and I wrote a script to run something every minute and that filled the logs and crashed the server. I cleared the logs and started IPA again. [root@ log]# ipactl start Starting Directory Service Starting dirsrv:

Re: [Freeipa-users] WebUI questions.

2014-02-13 Thread Dmitri Pal
On 02/13/2014 01:51 PM, Brent Clark wrote: When I assign a user the role of User Administrator, when they log into the WebUI, they can see all the role, dns, config, tab and links. They should only see the necessary tabs and links that having that role requires and none of the extra stuff.

Re: [Freeipa-users] WebUI questions.

2014-02-13 Thread Rob Crittenden
Brent Clark wrote: When I assign a user the role of User Administrator, when they log into the WebUI, they can see all the role, dns, config, tab and links. They should only see the necessary tabs and links that having that role requires and none of the extra stuff. Is there a way to limit

Re: [Freeipa-users] IPA not Starting after crash

2014-02-13 Thread Dmitri Pal
On 02/13/2014 02:12 PM, John Moyer wrote: This is the error log when I try to start it: [13/Feb/2014:19:08:28 +] - 389-Directory/1.2.11.15 B2013.357.177 starting up [13/Feb/2014:19:08:28 +] schema-compat-plugin - warning: no entries set up under cn=computers,

Re: [Freeipa-users] IPA not Starting after crash

2014-02-13 Thread John Moyer
I think I know my problem, back in August I was having performance issues so I hooked part of my IPA server to RAM disk. I’m assuming looking at the symlink below that since I’ve rebooted the server that I’m completely out of luck. This is in this directory :

Re: [Freeipa-users] authentication against compat

2014-02-13 Thread Steve Dainard
Is this server or client side where sudo_provider=ipa is included in ver 1.11.x? My fedora 20 client doesn't have this option listed, or is it baked in? *Steve Dainard * IT Infrastructure Manager Miovision http://miovision.com/ | *Rethink Traffic* *Blog http://miovision.com/blog | **LinkedIn

Re: [Freeipa-users] IPA not Starting after crash

2014-02-13 Thread Rich Megginson
On 02/13/2014 12:58 PM, John Moyer wrote: I think I know my problem, back in August I was having performance issues so I hooked part of my IPA server to RAM disk. I'm assuming looking at the symlink below that since I've rebooted the server that I'm completely out of luck. This is in this

Re: [Freeipa-users] authentication against compat

2014-02-13 Thread Jakub Hrozek
On Thu, Feb 13, 2014 at 03:05:07PM -0500, Steve Dainard wrote: Is this server or client side where sudo_provider=ipa is included in ver 1.11.x? Client side (sssd) My fedora 20 client doesn't have this option listed, or is it baked in? Where exactly do you see the documentation lacking,

Re: [Freeipa-users] authentication against compat

2014-02-13 Thread Steve Dainard
I don't think this is an issue of bugs or documentation, more of design. Perhaps there's someplace other than a users list this belongs in but: If IPA is a centrally managed identity and access control system, should these configurations not be passed to clients, rather than every client needing

[Freeipa-users] Setting up sudo

2014-02-13 Thread Todd Maugh
the documentation is kinda vague on some parts from the documentation: Because the sudo information is not available anonymously over LDAP by default, Identity Management defines a default sudo user, uid=sudo,cn=sysaccounts,cn=etc,$SUFFIX, which can be set in the LDAP/sudo configuration file,

Re: [Freeipa-users] Setting up sudo

2014-02-13 Thread Todd Maugh
and If I am configuring the sud-ldap.conf what should it look like does any one have an example? From: freeipa-users-boun...@redhat.com [freeipa-users-boun...@redhat.com] on behalf of Todd Maugh [tma...@boingo.com] Sent: Thursday, February 13, 2014 3:17 PM To:

Re: [Freeipa-users] authentication against compat

2014-02-13 Thread Dmitri Pal
On 02/13/2014 06:04 PM, Steve Dainard wrote: I don't think this is an issue of bugs or documentation, more of design. Perhaps there's someplace other than a users list this belongs in but: If IPA is a centrally managed identity and access control system, should these configurations not be

Re: [Freeipa-users] Setting up sudo

2014-02-13 Thread Dmitri Pal
On 02/13/2014 06:23 PM, Todd Maugh wrote: and If I am configuring the sud-ldap.conf what should it look like does any one have an example? You have two options. Sudo can be integrated with SSSD or not. If you want SUDO to be integrated then this should help:

Re: [Freeipa-users] authentication against compat

2014-02-13 Thread Alexander Bokovoy
On Thu, 13 Feb 2014, Steve Dainard wrote: I don't think this is an issue of bugs or documentation, more of design. Perhaps there's someplace other than a users list this belongs in but: If IPA is a centrally managed identity and access control system, should these configurations not be passed

Re: [Freeipa-users] IPA Replica cannot add user

2014-02-13 Thread Martin Kosek
On 02/13/2014 06:55 PM, Bruno Henrique Barbosa wrote: Hi everyone, I've installed my IPA environment as it follows: ipa01.example.com - master install ipa02.example.com - replica install, as the guide says, with ipa-replica-prepare on ipa01 and ipa-replica-install using gpg