Re: [Freeipa-users] Centos 7.2 ipa-backup failure

2016-05-31 Thread Martin Kosek
On 05/30/2016 06:57 PM, Ken Bass wrote: > On 05/30/2016 10:32 AM, Martin Kosek wrote: >> On 05/29/2016 05:33 PM, Ken Bass wrote: >>> Today I tried my very first ipa-backup attempt. The command reported 'The >>> ipa-backup command was successful' >>> >>> YET I saw: >>> >>> /usr/sbin/db2ldif: line

Re: [Freeipa-users] OCSP and CRL in certs for java firefox plugin

2016-05-31 Thread Martin Kosek
On 05/30/2016 10:53 PM, Prasun Gera wrote: > > To summarize, your options seem to be: > * Create ipa-ca DNS record in your primary domain > * Update the main default certificate profile (present in FreeIPA 4.2+) > * Migrate whole FreeIPA deployment to other DNS primary you would

[Freeipa-users] Sudo ALL rule

2016-05-31 Thread Tony Brian Albers
Hi guys, I'm implementing FreeIPA to auhenticate users on a small HPC cluster here. For a few of these I need a sudo rule that in essence does the same as the standard ALL(ALL) rule. How do I implement that in FreeIPA? I've found some links/guides on the net, but they don't seem appropriate for

Re: [Freeipa-users] IPA 2.2 Certificate Renewal issue

2016-05-31 Thread Kay Zhou Y
Hi Rob, The status for ipaCert is MONITORING no matter before or after resubmit this request ID, as below: Request ID '20140605220249': status: MONITORING stuck: no key pair storage: type=NSSDB,location='/etc/httpd/alias',nickname='ipaCert',token='NSS Certificate

Re: [Freeipa-users] IPA 2.2 Certificate Renewal issue

2016-05-31 Thread Rob Crittenden
Kay Zhou Y wrote: Hi Rob, The status for ipaCert is MONITORING no matter before or after resubmit this request ID, as below: Request ID '20140605220249': status: MONITORING stuck: no key pair storage:

Re: [Freeipa-users] FreeIPA4.2: Recovering from an IPA master server failure

2016-05-31 Thread Martin Basti
On 31.05.2016 17:36, Michael Rainey (Contractor) wrote: Greetings community, I've run into an interesting problem which may be old hat to all of you. I was working to bring down my IPA master server and did it improperly. It was a rookie mistake, but I'm willing to view it as an

Re: [Freeipa-users] EXAMPLE.COM IPA CA Import /etc/httpd/alias

2016-05-31 Thread Rob Crittenden
Günther J. Niederwimmer wrote: Hello I found any Help for the IPA Certificate but I found no way to import the IPA CA ? I like to create a webserver with a owncloud virtualhost and other.. But it is for me not possible to create the /etc/httpd/alias correct ? I found this in IPC DOCS certutil

Re: [Freeipa-users] IPA 2.2 Certificate Renewal issue

2016-05-31 Thread Rob Crittenden
Kay Zhou Y wrote: Hi Rob, Thanks for your reply. And about your suggestion, actually I have done it. but it just renew the two 389-ds certs and Apache certs. Since the ipaCert and subsystem certs are expired at 20140624, so I must roll back time before it. then begin to renew, but after I

Re: [Freeipa-users] Sudo ALL rule

2016-05-31 Thread Pavel Březina
On 05/31/2016 11:19 AM, Tony Brian Albers wrote: Hi guys, I'm implementing FreeIPA to auhenticate users on a small HPC cluster here. For a few of these I need a sudo rule that in essence does the same as the standard ALL(ALL) rule. How do I implement that in FreeIPA? I've found some

Re: [Freeipa-users] dynamic dns working for forward zone but not reverse zone

2016-05-31 Thread Brian J. Murrell
On Mon, 2016-05-30 at 13:43 +0200, Petr Spacek wrote: > > Can you query the SOA record from the reverse zone, please? > > $ dig @10.75.22.247 0.10.8.in-addr.arpa. SOA Ahhh.  That's the problem.  The subnet is 10.8.0.0/24 so the query should be for 0.8.10.in-addr.arpa. Sometimes it just takes a

[Freeipa-users] FreeIPA4.2: Recovering from an IPA master server failure

2016-05-31 Thread Michael Rainey (Contractor)
Greetings community, I've run into an interesting problem which may be old hat to all of you. I was working to bring down my IPA master server and did it improperly. It was a rookie mistake, but I'm willing to view it as an exercise in recovering from a massive system failure. The

Re: [Freeipa-users] dns location based discovery

2016-05-31 Thread Winfried de Heiden
Hi all, I've been playing on this topic but one can implement services discovery. Allthough it looks a bit dirty, you add _sites support to IPA by manually create a DNS zone, something like: _tcp.locationX._sites.example.com and