Re: [Freeipa-users] freeipa / sudo

2014-12-16 Thread Chris Card
What command did you use to get sudo options working please? I noticed from below mail that you have‎ Sudo Option: !authenticate I am having trouble getting that working The first issue is what version of FreeIPA you are using. Before version 4 sudo rules don't work without some

Re: [Freeipa-users] strange problem - IPA related?

2014-12-16 Thread Patrick Hurrelmann
On 15.12.2014 19:28, Janelle wrote: Hi all.. Not sure if this is IPA related, but here it is: 1. IPA 4.1.2 install on CentOS 7 2. IPA 4.1.2 install on Fedora 21 So both systems are systemd based - the fedora system reboots in less than 30 seconds. The CentOS system reboots and has

[Freeipa-users] Certificate Authorities requirement for Cross realm trust?

2014-12-16 Thread Genadi Postrilko
In the Windows Integration guide the need for CA is mentioned. Both Active Directory and Identity Management must be configured with integrated certificate services.

Re: [Freeipa-users] Certificate Authorities requirement for Cross realm trust?

2014-12-16 Thread Sumit Bose
On Tue, Dec 16, 2014 at 11:28:47AM +0200, Genadi Postrilko wrote: In the Windows Integration guide the need for CA is mentioned. Both Active Directory and Identity Management must be configured with integrated certificate services.

Re: [Freeipa-users] strange problem - IPA related?

2014-12-16 Thread Janelle
That is indeed what it was -- thank you so much. Now they both boot in about 60 seconds. Gosh, keeping up with all the little annoyances is indeed a fulltime job. The team is doing great with the product and I truly appreciate all the work and quick responses on the mailing-list. ~J On

Re: [Freeipa-users] 3.0.0-42 Replication issue after Centos6.5-6.6 upgrade

2014-12-16 Thread dbischof
Hi, On Mon, 15 Dec 2014, dbisc...@hrz.uni-kassel.de wrote: On Tue, 25 Nov 2014, Rich Megginson wrote: On 11/25/2014 12:32 PM, dbisc...@hrz.uni-kassel.de wrote: with the help of Thierry and Rich I managed to debug the running ns-slapd on Server1 (see below). The failing attempt of decoding

Re: [Freeipa-users] Freeipa-users Digest, Vol 77, Issue 15

2014-12-16 Thread Shashi M
On Fri, Dec 5, 2014 at 12:26 PM, freeipa-users-requ...@redhat.com wrote: Send Freeipa-users mailing list submissions to freeipa-users@redhat.com To subscribe or unsubscribe via the World Wide Web, visit https://www.redhat.com/mailman/listinfo/freeipa-users or, via email,

[Freeipa-users] ldapsearch queries for audit

2014-12-16 Thread Herb Burnswell
All, We are running the following versions on RHEL 6.6: ipa-server.x86_64 3.0.0-42.el6 389-ds.noarch1.2.2-1.el6 I'm not very experienced with the ldapsearch and would greatly appreciate some guidance. I'd like to run some ldapsearch's that will return access information for specific

Re: [Freeipa-users] ldapsearch queries for audit

2014-12-16 Thread Craig White
From: freeipa-users-boun...@redhat.com [mailto:freeipa-users-boun...@redhat.com] On Behalf Of Herb Burnswell Sent: Tuesday, December 16, 2014 12:32 PM To: freeipa-users@redhat.com Subject: [Freeipa-users] ldapsearch queries for audit All, We are running the following versions on RHEL 6.6:

Re: [Freeipa-users] ldapsearch queries for audit

2014-12-16 Thread Herb Burnswell
Craig, Thank you for the reply. Running the ipa hostgroup-show does not appear to provide specific information about individual users. Also, ideally I'd like to see if I can gather the actual sudo rules that one would see in an /etc/sudoers file to the specific hosts. I'll investigate if the

Re: [Freeipa-users] Clients in multiple domains, any known issues?

2014-12-16 Thread Dmitri Pal
On 12/16/2014 02:24 AM, Eivind Olsen wrote: Hello. I have so far been running IPA on RHEL6, with a single domain (and a matching realm). I now have a use-case where it looks like I'll need to set up a new IPA realm, with the IPA servers in one DNS domain and the IPA clients in multiple (2-4)

Re: [Freeipa-users] ldapsearch queries for audit

2014-12-16 Thread Dmitri Pal
On 12/16/2014 02:31 PM, Herb Burnswell wrote: All, We are running the following versions on RHEL 6.6: ipa-server.x86_64 3.0.0-42.el6 389-ds.noarch1.2.2-1.el6 I'm not very experienced with the ldapsearch and would greatly appreciate some guidance. I'd like to run some ldapsearch's

Re: [Freeipa-users] trust non-IPA certificate client

2014-12-16 Thread Stephen Ingram
On Mon, Dec 15, 2014 at 6:40 PM, Stephen Ingram sbing...@gmail.com wrote: I have one client using a certificate issued by a third party provider such that any secure (TLS) LDAP queries are refused since the certificates were not issued by IPA. Since there are only a few clients with foreign