Re: [Freeipa-users] Is the krb5.conf no longer used?

2016-06-01 Thread Alexander Bokovoy
On Wed, 01 Jun 2016, Geordie Grindle wrote: Does IPA only use ‘sssd.conf’ for kerberos authentication? Is there another file used to configure kerberos? I’ve built a host using Foreman and our puppet configuration usually pushes a krb5.conf file. However, if I delete it, everything still works

Re: [Freeipa-users] Is the krb5.conf no longer used?

2016-06-01 Thread Matrix
Hi, Geordie I think it should be optional. here is one of my IPA client's krb5.conf # cat /etc/krb5.conf #File modified by ipa-client-install includedir /var/lib/sss/pubconf/krb5.include.d/ [libdefaults] default_realm = EXAMPLE.NET dns_lookup_realm = true dns_lookup_kdc = true rdns =

Re: [Freeipa-users] ns-slapd hangs for 2-3 minutes, then resumes.

2016-06-01 Thread Guillermo Fuentes
I'm now taking stack traces every minute and waiting for it to hang again to check it. It happens usually under load but it's unpredictable. Must likely tomorrow. GUILLERMO FUENTES SR. SYSTEMS ADMINISTRATOR 561-880-2998 x1337 guillermo.fuen...@modmed.com On Wed, Jun 1, 2016 at 2:03 PM,

[Freeipa-users] Is the krb5.conf no longer used?

2016-06-01 Thread Geordie Grindle
Does IPA only use ‘sssd.conf’ for kerberos authentication? Is there another file used to configure kerberos? I’ve built a host using Foreman and our puppet configuration usually pushes a krb5.conf file. However, if I delete it, everything still works fine. What if any function does

Re: [Freeipa-users] FreeIPA4.2: Recovering from an IPA master server failure

2016-06-01 Thread Michael Rainey (Contractor)
My apologies for the duplicate thread, but from my vantage point I did not see any signs of my message making it to the mailing list. My original message was not posted back to me, nor was your reply posted to me. Now back to your reply. I did try the command you suggested and it does

Re: [Freeipa-users] ns-slapd hangs for 2-3 minutes, then resumes.

2016-06-01 Thread Rich Megginson
On 06/01/2016 10:37 AM, Guillermo Fuentes wrote: Hi all, We are experiencing a similar issue like the one discussed in the following thread but we are running FreeIPA 4.2 on CentOS 7.2: https://www.redhat.com/archives/freeipa-users/2015-February/msg00205.html Are your stack traces similar?

[Freeipa-users] sessions failing when using different hostname

2016-06-01 Thread Anthony Clark
Hello All, I've been asked to allow access to our FreeIPA web UI from a more user friendly url than I'm currently using. So I've set up a CNAME password.example.com for ns01.example.com At the moment, if I go to the real hostname of the FreeIPA server ( ns01.example.com), everything works. If

[Freeipa-users] FreeIPA 4.2.0 on CentOS 7.2 as replica of FreeIPA 3.0.0 on CentOS 6.8; cannot install CA components as replica, cannot promote to master

2016-06-01 Thread Dan.Finkelstein
Hi folks, As the subject suggests, we're converting from FreeIPA 3.0.0 on CentOS 6 to 4.2.0 on CentOS 7. The way we're doing it is to create FreeIPA replicas in CentOS 7 and then hope to promote one of them to the CA master. I'm running into two problems: The first is that when we create a

[Freeipa-users] ns-slapd hangs for 2-3 minutes, then resumes.

2016-06-01 Thread Guillermo Fuentes
Hi all, We are experiencing a similar issue like the one discussed in the following thread but we are running FreeIPA 4.2 on CentOS 7.2: https://www.redhat.com/archives/freeipa-users/2015-February/msg00205.html LDAP service stops responding to queries (hangs). LDAP connections on the server

Re: [Freeipa-users] IPA 2.2 Certificate Renewal issue

2016-06-01 Thread Rob Crittenden
Kay Zhou Y wrote: Hi Rob, 1. I have made snapshots for this system for test, so NSS databases has been backed up. 2. For the pki-cad service, I can't find it in my system, it shows there is no such service. but there is one service failed as below: root@ecnshlx3039-test2(SH):requests

Re: [Freeipa-users] EXAMPLE.COM IPA CA Import /etc/httpd/alias

2016-06-01 Thread Rob Crittenden
Günther J. Niederwimmer wrote: Hello, Am Dienstag, 31. Mai 2016, 11:06:09 CEST schrieb Rob Crittenden: Günther J. Niederwimmer wrote: Hello I found any Help for the IPA Certificate but I found no way to import the IPA CA ? I like to create a webserver with a owncloud virtualhost and other..

Re: [Freeipa-users] IPA 2.2 Certificate Renewal issue

2016-06-01 Thread Kay Zhou Y
Hi Rob, 1. I have made snapshots for this system for test, so NSS databases has been backed up. 2. For the pki-cad service, I can't find it in my system, it shows there is no such service. but there is one service failed as below: root@ecnshlx3039-test2(SH):requests #systemctl status

Re: [Freeipa-users] dns location based discovery

2016-06-01 Thread Petr Spacek
On 31.5.2016 17:41, Winfried de Heiden wrote: > Hi all, > > I've been playing on this topic but one can implement services discovery. > Allthough it looks a bit dirty, you add _sites support to IPA by manually > create > a DNS zone, something like: > > _tcp.locationX._sites.example.com > and

Re: [Freeipa-users] EXAMPLE.COM IPA CA Import /etc/httpd/alias

2016-06-01 Thread Günther J . Niederwimmer
Hello, Am Dienstag, 31. Mai 2016, 11:06:09 CEST schrieb Rob Crittenden: > Günther J. Niederwimmer wrote: > > Hello > > I found any Help for the IPA Certificate but I found no way to import the > > IPA CA ? > > I like to create a webserver with a owncloud virtualhost and other.. > > > > But it is