Re: [Freeipa-users] FreeIPA + Foreman 1.5

2014-04-28 Thread Jakub Hrozek
On Fri, Apr 25, 2014 at 04:16:11AM -0400, Stephen Benjamin wrote: - Original Message - From: Jan Cholasta jchol...@redhat.com To: Martin Kosek mko...@redhat.com, d...@redhat.com, Stephen Benjamin stben...@redhat.com Cc: freeipa-users@redhat.com Sent: Friday, April 25, 2014

Re: [Freeipa-users] FreeIPA + Foreman 1.5

2014-04-28 Thread Stephen Benjamin
- Original Message - From: Jakub Hrozek jhro...@redhat.com To: freeipa-users@redhat.com Sent: Monday, April 28, 2014 10:55:16 AM Subject: Re: [Freeipa-users] FreeIPA + Foreman 1.5 On Fri, Apr 25, 2014 at 04:16:11AM -0400, Stephen Benjamin wrote: - Original Message -

Re: [Freeipa-users] FreeIPA + Foreman 1.5

2014-04-28 Thread Tomas Babej
On 04/28/2014 11:23 AM, Stephen Benjamin wrote: - Original Message - From: Jakub Hrozek jhro...@redhat.com To: freeipa-users@redhat.com Sent: Monday, April 28, 2014 10:55:16 AM Subject: Re: [Freeipa-users] FreeIPA + Foreman 1.5 On Fri, Apr 25, 2014 at 04:16:11AM -0400, Stephen

[Freeipa-users] Best practices for core servers

2014-04-28 Thread Bret Wortman
We are planning to reconfigure our core Freeipa servers, basically building a replacement infrastructure and migrating to it. What we're planning right now is a core of three Freeipa servers each of which has a CA, with as much distribution of replication as we can manage. I imagine that means

Re: [Freeipa-users] Best practices for core servers

2014-04-28 Thread Petr Spacek
On 28.4.2014 13:03, Bret Wortman wrote: We are planning to reconfigure our core Freeipa servers, basically building a replacement infrastructure and migrating to it. What we're planning right now is a core of three Freeipa servers each of which has a CA, with as much distribution of replication

[Freeipa-users] Error creating new freeipa-server

2014-04-28 Thread Bret Wortman
I'm trying to stand up a new ipa server on a clean box, and I keep getting this error so _something_ is amiss but I'm not sure what: : Configuring certificate server (pki-tomcatd): Estimated time 3 minutes 30 seconds [1/22]: creating certificate server user [2/22]: configuring

Re: [Freeipa-users] Error creating new freeipa-server

2014-04-28 Thread Dmitri Pal
On 04/28/2014 07:52 AM, Bret Wortman wrote: I'm trying to stand up a new ipa server on a clean box, and I keep getting this error so _something_ is amiss but I'm not sure what: : Configuring certificate server (pki-tomcatd): Estimated time 3 minutes 30 seconds [1/22]: creating

Re: [Freeipa-users] Error creating new freeipa-server

2014-04-28 Thread Bret Wortman
Not to be thick, but what's the best way to check the DS instance for a pki entry? On 04/28/2014 07:57 AM, Dmitri Pal wrote: On 04/28/2014 07:52 AM, Bret Wortman wrote: I'm trying to stand up a new ipa server on a clean box, and I keep getting this error so _something_ is amiss but I'm not

[Freeipa-users] Google Apps Directory Sync and Free-IPA

2014-04-28 Thread Chris Whittle
I've seen a lot of people have issues with making GADS work with FreeIPA. Does anyone have it working and care to share how? ___ Freeipa-users mailing list Freeipa-users@redhat.com https://www.redhat.com/mailman/listinfo/freeipa-users

Re: [Freeipa-users] Google Apps Directory Sync and Free-IPA

2014-04-28 Thread Dmitri Pal
On 04/28/2014 08:11 AM, Chris Whittle wrote: I've seen a lot of people have issues with making GADS work with FreeIPA. Does anyone have it working and care to share how? ___ Freeipa-users mailing list Freeipa-users@redhat.com

Re: [Freeipa-users] Error creating new freeipa-server

2014-04-28 Thread Dmitri Pal
On 04/28/2014 08:06 AM, Bret Wortman wrote: Not to be thick, but what's the best way to check the DS instance for a pki entry? I do not remember the exact path and I do not have an instance handy. Something like /var/lib/dirsrv/PKI, do not want to mislead you. On 04/28/2014 07:57 AM,

Re: [Freeipa-users] Google Apps Directory Sync and Free-IPA

2014-04-28 Thread Chris Whittle
Ha! that was my thread about SAML vs GADS but there ended up not being any info on how to actually use GADS with Free IPA. It dropped after Simo saying he was going to work on getting docs for ipsilon (which from the conversation and I can gather is basically SAML) and I asked for someone who had

Re: [Freeipa-users] Google Apps Directory Sync and Free-IPA

2014-04-28 Thread Dmitri Pal
On 04/28/2014 08:22 AM, Chris Whittle wrote: Ha! that was my thread about SAML vs GADS but there ended up not being any info on how to actually use GADS with Free IPA. It dropped after Simo saying he was going to work on getting docs for ipsilon (which from the conversation and I can gather

Re: [Freeipa-users] Error creating new freeipa-server

2014-04-28 Thread Petr Viktorin
On 04/28/2014 01:52 PM, Bret Wortman wrote: I'm trying to stand up a new ipa server on a clean box, and I keep getting this error so _something_ is amiss but I'm not sure what: : Configuring certificate server (pki-tomcatd): Estimated time 3 minutes 30 seconds [1/22]: creating certificate

Re: [Freeipa-users] Error creating new freeipa-server

2014-04-28 Thread Bret Wortman
Great. I'll try that next. Bret Wortman http://bretwortman.com/ http://twitter.com/BretWortman On Apr 28, 2014, at 8:33 AM, Petr Viktorin pvikt...@redhat.com wrote: On 04/28/2014 01:52 PM, Bret Wortman wrote: I'm trying to stand up a new ipa server on a clean box, and I keep getting this

Re: [Freeipa-users] Error creating new freeipa-server

2014-04-28 Thread Bret Wortman
I thought that might be it and didn't see anything but will look again. Bret Wortman http://bretwortman.com/ http://twitter.com/BretWortman On Apr 28, 2014, at 8:20 AM, Dmitri Pal d...@redhat.com wrote: On 04/28/2014 08:06 AM, Bret Wortman wrote: Not to be thick, but what's the best way

Re: [Freeipa-users] FreeIPA + Foreman 1.5

2014-04-28 Thread Jakub Hrozek
On Mon, Apr 28, 2014 at 05:23:18AM -0400, Stephen Benjamin wrote: - Original Message - From: Jakub Hrozek jhro...@redhat.com To: freeipa-users@redhat.com Sent: Monday, April 28, 2014 10:55:16 AM Subject: Re: [Freeipa-users] FreeIPA + Foreman 1.5 On Fri, Apr 25, 2014 at

Re: [Freeipa-users] Hardening freeipa on the internet

2014-04-28 Thread Petr Spacek
On 25.4.2014 11:00, Petr Spacek wrote: On 25.4.2014 10:11, Martin Kosek wrote: On 04/25/2014 09:50 AM, Andrew Holway wrote: Hello, I am having a think about running freeipa on the open seas for more distributed organisations and would like to understand where the weaknesses might be. I would

Re: [Freeipa-users] Error creating new freeipa-server

2014-04-28 Thread Rob Crittenden
Bret Wortman wrote: On 04/28/2014 10:21 AM, Bret Wortman wrote: On 04/28/2014 08:33 AM, Petr Viktorin wrote: According to the error you're getting, there is a CA instance already installed. After uninstalling IPA, destroy it with: pkidestroy -s CA -i pki-tomcat I tried, this, but no

Re: [Freeipa-users] Error creating new freeipa-server

2014-04-28 Thread Bret Wortman
On 04/28/2014 10:48 AM, Rob Crittenden wrote: Bret Wortman wrote: On 04/28/2014 10:21 AM, Bret Wortman wrote: On 04/28/2014 08:33 AM, Petr Viktorin wrote: According to the error you're getting, there is a CA instance already installed. After uninstalling IPA, destroy it with:

Re: [Freeipa-users] Hardening freeipa on the internet

2014-04-28 Thread Andrew Holway
I realized that you probably want to disable anonymous access to LDAP. It will prevent random strangers to enumerate all users in your database... This sounds like a bug no? anonymous access to LDAP? -- Petr^2 Spacek ___ Freeipa-users mailing

Re: [Freeipa-users] Hardening freeipa on the internet

2014-04-28 Thread Simo Sorce
On Mon, 2014-04-28 at 16:11 +0100, Andrew Holway wrote: I realized that you probably want to disable anonymous access to LDAP. It will prevent random strangers to enumerate all users in your database... This sounds like a bug no? anonymous access to LDAP? Historically many Linux and Unix

Re: [Freeipa-users] Error creating new freeipa-server

2014-04-28 Thread Rob Crittenden
Bret Wortman wrote: On 04/28/2014 10:48 AM, Rob Crittenden wrote: Bret Wortman wrote: On 04/28/2014 10:21 AM, Bret Wortman wrote: On 04/28/2014 08:33 AM, Petr Viktorin wrote: According to the error you're getting, there is a CA instance already installed. After uninstalling IPA, destroy

Re: [Freeipa-users] Error creating new freeipa-server

2014-04-28 Thread Bret Wortman
On 04/28/2014 11:08 AM, Bret Wortman wrote: On 04/28/2014 10:48 AM, Rob Crittenden wrote: Bret Wortman wrote: On 04/28/2014 10:21 AM, Bret Wortman wrote: On 04/28/2014 08:33 AM, Petr Viktorin wrote: According to the error you're getting, there is a CA instance already installed. After

Re: [Freeipa-users] Error creating new freeipa-server

2014-04-28 Thread Bret Wortman
On 04/28/2014 11:17 AM, Rob Crittenden wrote: Bret Wortman wrote: So is there a recommended way to clean it up and get it working? Re-run pkidestroy, then if the subsequent IPA install fails closely examine the logs to determine the reason. The problem in cases like this is that the first

Re: [Freeipa-users] Error creating new freeipa-server

2014-04-28 Thread Rob Crittenden
Bret Wortman wrote: On 04/28/2014 11:17 AM, Rob Crittenden wrote: Bret Wortman wrote: So is there a recommended way to clean it up and get it working? Re-run pkidestroy, then if the subsequent IPA install fails closely examine the logs to determine the reason. The problem in cases like this

Re: [Freeipa-users] Error creating new freeipa-server

2014-04-28 Thread Bret Wortman
On 04/28/2014 11:52 AM, Rob Crittenden wrote: Bret Wortman wrote: On 04/28/2014 11:17 AM, Rob Crittenden wrote: Bret Wortman wrote: So is there a recommended way to clean it up and get it working? Re-run pkidestroy, then if the subsequent IPA install fails closely examine the logs to

Re: [Freeipa-users] Google Apps Directory Sync and Free-IPA

2014-04-28 Thread Simon Williams
I do have it working, but I have Atlassian Crowd sitting between FreeIPA and the Google Apps log in. On 28 Apr 2014 15:44, Simo Sorce s...@redhat.com wrote: On Mon, 2014-04-28 at 08:24 -0400, Dmitri Pal wrote: On 04/28/2014 08:22 AM, Chris Whittle wrote: Ha! that was my thread about SAML vs

[Freeipa-users] Can't use ipa commands on brand new ipa server instance

2014-04-28 Thread Bret Wortman
I just got a new ipa server instantiated and haven't actually installed any users or hosts on it yet. No replicas. No migrated data. Yet when I run any ipa commands from the command line, it behaves exactly as our older, troubled servers do and exits the login session immediately, whether I'm

Re: [Freeipa-users] Can't use ipa commands on brand new ipa server instance

2014-04-28 Thread Bret Wortman
On 04/28/2014 01:19 PM, Bret Wortman wrote: I just got a new ipa server instantiated and haven't actually installed any users or hosts on it yet. No replicas. No migrated data. Yet when I run any ipa commands from the command line, it behaves exactly as our older, troubled servers do and

Re: [Freeipa-users] Can't use ipa commands on brand new ipa server instance

2014-04-28 Thread Simo Sorce
On Mon, 2014-04-28 at 13:25 -0400, Bret Wortman wrote: On 04/28/2014 01:19 PM, Bret Wortman wrote: I just got a new ipa server instantiated and haven't actually installed any users or hosts on it yet. No replicas. No migrated data. Yet when I run any ipa commands from the command line,

Re: [Freeipa-users] Can't use ipa commands on brand new ipa server instance

2014-04-28 Thread Bret Wortman
bash. On 04/28/2014 01:32 PM, Simo Sorce wrote: On Mon, 2014-04-28 at 13:25 -0400, Bret Wortman wrote: On 04/28/2014 01:19 PM, Bret Wortman wrote: I just got a new ipa server instantiated and haven't actually installed any users or hosts on it yet. No replicas. No migrated data. Yet when I

Re: [Freeipa-users] Can't use ipa commands on brand new ipa server instance

2014-04-28 Thread Dmitri Pal
On 04/28/2014 01:25 PM, Bret Wortman wrote: On 04/28/2014 01:19 PM, Bret Wortman wrote: I just got a new ipa server instantiated and haven't actually installed any users or hosts on it yet. No replicas. No migrated data. Yet when I run any ipa commands from the command line, it behaves

Re: [Freeipa-users] Can't use ipa commands on brand new ipa server instance

2014-04-28 Thread Simo Sorce
On 04/28/2014 01:32 PM, Simo Sorce wrote: On Mon, 2014-04-28 at 13:25 -0400, Bret Wortman wrote: On 04/28/2014 01:19 PM, Bret Wortman wrote: I just got a new ipa server instantiated and haven't actually installed any users or hosts on it yet. No replicas. No migrated data. Yet when I

Re: [Freeipa-users] Can't use ipa commands on brand new ipa server instance

2014-04-28 Thread Bret Wortman
On 04/28/2014 01:53 PM, Simo Sorce wrote: On 04/28/2014 01:32 PM, Simo Sorce wrote: On Mon, 2014-04-28 at 13:25 -0400, Bret Wortman wrote: On 04/28/2014 01:19 PM, Bret Wortman wrote: I just got a new ipa server instantiated and haven't actually installed any users or hosts on it yet. No

Re: [Freeipa-users] Can't use ipa commands on brand new ipa server instance

2014-04-28 Thread Simo Sorce
On Mon, 2014-04-28 at 14:05 -0400, Bret Wortman wrote: On 04/28/2014 01:53 PM, Simo Sorce wrote: On 04/28/2014 01:32 PM, Simo Sorce wrote: On Mon, 2014-04-28 at 13:25 -0400, Bret Wortman wrote: On 04/28/2014 01:19 PM, Bret Wortman wrote: I just got a new ipa server instantiated and

Re: [Freeipa-users] Can't use ipa commands on brand new ipa server instance

2014-04-28 Thread Bill Peck
Let me guess, ipa logs you out so you can go have a beer? On Mon, Apr 28, 2014 at 2:10 PM, Simo Sorce s...@redhat.com wrote: On Mon, 2014-04-28 at 14:05 -0400, Bret Wortman wrote: On 04/28/2014 01:53 PM, Simo Sorce wrote: On 04/28/2014 01:32 PM, Simo Sorce wrote: On Mon, 2014-04-28 at

Re: [Freeipa-users] Google Apps Directory Sync and Free-IPA

2014-04-28 Thread Chris Whittle
Thanks Simon I'm not sure it'll work for what I need I really wish someone had Google Apps Directory Sync either working or not working so I can either research more or strike it off my list On Mon, Apr 28, 2014 at 11:34 AM, Simon Williams simon.willi...@thehelpfulcat.com wrote: I do

[Freeipa-users] RHEL7 rc 64bit

2014-04-28 Thread Steven Jones
Hi, Would it be expected that a RHEL7rc machine would be connectible to IPA on RHEL6.5? Just tried and it doesnt seem to be. regards Steven Jones Technical Specialist - Linux RHCE Victoria University ITS, Level 8 Rankin Brown Building, Wellington, NZ 6012 0064 4 463 6272