Re: [Freeipa-users] Replica not syncing 'memberOf' attributes

2010-10-06 Thread Nathan Kinder
On 10/06/2010 03:08 PM, Dan Scott wrote: I'm not sure which group this is referring to. Admins only contains 3 users, no nested groups. Do any other groups have a member attribute that points to your cn=admins group's DN? The error message indicates that some other group has your admins

Re: [Freeipa-users] Replica not syncing 'memberOf' attributes

2010-10-07 Thread Nathan Kinder
On 10/06/2010 07:03 PM, Rich Megginson wrote: Dan Scott wrote: Hi, On Wed, Oct 6, 2010 at 19:29, Nathan Kinder nkin...@redhat.com wrote: On 10/06/2010 03:08 PM, Dan Scott wrote: I'm not sure which group this is referring to. Admins only contains 3 users, no nested groups. Do any other

Re: [Freeipa-users] Replica not syncing 'memberOf' attributes

2010-10-08 Thread Nathan Kinder
On 10/08/2010 12:08 PM, Dan Scott wrote: On Fri, Oct 8, 2010 at 14:52, James Romanjames.ro...@ssaihq.com wrote: On 10/08/2010 01:49 PM, Dan Scott wrote: On Fri, Oct 8, 2010 at 13:18, Rich Megginsonrmegg...@redhat.comwrote: Dan Scott wrote: On Fri, Oct 8,

Re: [Freeipa-users] 389 DS server closing connection after upgrade from Fedora 12 to 13

2011-02-21 Thread Nathan Kinder
On 02/21/2011 07:10 AM, Simo Sorce wrote: On Mon, 21 Feb 2011 02:07:36 +0100 tomasz.napier...@allegro.pltomasz.napier...@allegro.pl wrote: Feb 20 23:47:19 Updated: 389-ds-base-1.2.7.5-1.fc13.x86_64 Any one have an idea what could be the reason? If I remember correctly, some people reported

Re: [Freeipa-users] Auto membership plugin

2011-03-30 Thread Nathan Kinder
On 03/30/2011 06:32 AM, Rob Crittenden wrote: Dmitri Pal wrote: Hello, Please find the design for the auto membership plugin: https://fedorahosted.org/freeipa/ticket/753 Here: http://directory.fedoraproject.org/wiki/Auto_Membership_Design I have some comments and questions: 1) Is the AND

Re: [Freeipa-users] Auto membership plugin

2011-03-30 Thread Nathan Kinder
On 03/30/2011 06:00 AM, Dmitri Pal wrote: Hello, Please find the design for the auto membership plugin: https://fedorahosted.org/freeipa/ticket/753 Here: http://directory.fedoraproject.org/wiki/Auto_Membership_Design I have some comments and questions: 1) Is the AND functionality for inclusion

Re: [Freeipa-users] Auto membership plugin

2011-03-30 Thread Nathan Kinder
On 03/30/2011 08:06 AM, Dmitri Pal wrote: On 03/30/2011 10:43 AM, Nathan Kinder wrote: On 03/30/2011 07:34 AM, Rob Crittenden wrote: Nathan Kinder wrote: On 03/30/2011 06:32 AM, Rob Crittenden wrote: Dmitri Pal wrote: Hello, Please find the design for the auto membership plugin: https

Re: [Freeipa-users] Auto membership plugin

2011-03-30 Thread Nathan Kinder
On 03/30/2011 08:03 AM, Dmitri Pal wrote: On 03/30/2011 10:39 AM, Nathan Kinder wrote: On 03/30/2011 06:00 AM, Dmitri Pal wrote: Hello, Please find the design for the auto membership plugin: https://fedorahosted.org/freeipa/ticket/753 Here: http://directory.fedoraproject.org/wiki

Re: [Freeipa-users] Auto membership plugin

2011-04-11 Thread Nathan Kinder
On 04/08/2011 09:07 AM, Dmitri Pal wrote: On 04/08/2011 11:49 AM, JR Aquino wrote: Is there any way to capture a description associated with the regex - group mapping? I was thinking that after time, it would be important to look back on rules and know why they were put there. Particularly

Re: [Freeipa-users] HBAC rule refreshes and read-only slaves

2012-06-08 Thread Nathan Kinder
On 06/08/2012 07:26 AM, Dmitri Pal wrote: On 06/07/2012 09:22 PM, Cam McK wrote: Hello 2). We would also like to use FreeIPA in a trusted network but then have perhaps a read-only slave sitting in DMZ with the possibility of not containing the KDC or LDAP password stores on it, is this

Re: [Freeipa-users] UID 999, not possible?

2012-07-02 Thread Nathan Kinder
On 06/29/2012 07:10 AM, Petr Viktorin wrote: On 06/29/2012 03:55 PM, Alexander Bokovoy wrote: On Fri, 29 Jun 2012, Petr Viktorin wrote: On 06/29/2012 03:04 PM, Alexander Bokovoy wrote: On Thu, 28 Jun 2012, sysad...@noboost.org wrote: Hi All, Is there a weird restriction to UID 999 in ipa,

Re: [Freeipa-users] UID 999, not possible?

2012-07-03 Thread Nathan Kinder
On 07/03/2012 12:38 AM, Petr Viktorin wrote: On 07/03/2012 05:55 AM, Nathan Kinder wrote: On 06/29/2012 07:10 AM, Petr Viktorin wrote: On 06/29/2012 03:55 PM, Alexander Bokovoy wrote: On Fri, 29 Jun 2012, Petr Viktorin wrote: On 06/29/2012 03:04 PM, Alexander Bokovoy wrote: On Thu, 28 Jun

Re: [Freeipa-users] Resynchronize Samba Passwort

2012-10-16 Thread Nathan Kinder
On 10/16/2012 05:21 AM, Simo Sorce wrote: On Tue, 2012-10-16 at 10:06 +0200, Marc Grimme wrote: Am 15.10.2012 15:50, schrieb Simo Sorce: On Mon, 2012-10-15 at 14:15 +0200, Marc Grimme wrote: Am 14.10.2012 23:14, schrieb Simo Sorce: On Fri, 2012-10-12 at 16:47 +0200, Marc Grimme wrote: Right

Re: [Freeipa-users] Resynchronize Samba Passwort

2012-10-16 Thread Nathan Kinder
On 10/16/2012 02:40 PM, Simo Sorce wrote: On Tue, 2012-10-16 at 14:22 -0700, Nathan Kinder wrote: On 10/16/2012 05:21 AM, Simo Sorce wrote: On Tue, 2012-10-16 at 10:06 +0200, Marc Grimme wrote: Am 15.10.2012 15:50, schrieb Simo Sorce: On Mon, 2012-10-15 at 14:15 +0200, Marc Grimme wrote: Am

Re: [Freeipa-users] ipa-replica-install errors

2013-04-04 Thread Nathan Kinder
On 04/04/2013 07:14 AM, Joseph, Matthew (EXP) wrote: Hello, I'm trying to setup a replica server with ipa-2.2.0-16 on both the Server and the Replica Server. Here are the steps I ran (From the Red Hat 6.3 IdM Administration Guide); *IPA_Server:*

Re: [Freeipa-users] automember issues

2013-04-30 Thread Nathan Kinder
thought was that technically the user is not doing the addition to the group it's the system technically doing it so there shouldn't be a permissions issue. The user's roles shouldn't really matter to the best of my knowledge (Nathan Kinder may need to refresh my memory), but the 389 plugin

Re: [Freeipa-users] PKI-CAD couldn't start

2013-07-12 Thread Nathan Kinder
On 07/12/2013 01:58 PM, Dmitri Pal wrote: On 07/12/2013 05:18 AM, natxo asenjo wrote: On 07/12/2013 10:55 AM, Christian Schmitt wrote: I can't start the IPA Service with service ipa start after an reboot. It fails on the pki-cad service, that only outputs 'grep --help' gives you more

Re: [Freeipa-users] [Freeipa-devel] [SSSD] FreeIPA on Debian

2013-09-03 Thread Nathan Kinder
On 09/03/2013 01:50 PM, Timo Aaltonen wrote: On 03.09.2013 23:30, Nathan Kinder wrote: On 09/01/2013 01:35 PM, Timo Aaltonen wrote: On 01.09.2013 21:43, Dmitri Pal wrote: On 09/01/2013 02:20 PM, Timo Aaltonen wrote: On 31.08.2013 00:04, Dmitri Pal wrote: Hello, Sorry for cross posting to 4

Re: [Freeipa-users] FreeIPA on Fedora 20: Configuration of CA failed

2013-09-11 Thread Nathan Kinder
On 09/11/2013 03:33 PM, Mateusz Marzantowicz wrote: I'm trying to install FreeIPA Server on Fedora 20 (with all updates installed) but it fails on ipa-server-install -N command. Error message: CRITICAL failed to configure ca instance Command '/usr/sbin/pkispawn -s CA -f /tmp/tmppTdhYM' returned

Re: [Freeipa-users] Required services are not started after reboot

2013-10-10 Thread Nathan Kinder
On 10/10/2013 06:48 AM, Rob Crittenden wrote: Mateusz Marzantowicz wrote: On 08.10.2013 18:43, Tamas Papp wrote: On 10/08/2013 06:33 PM, Mateusz Marzantowicz wrote: Finally, I've managed to install FreeIPA on Fedora 20 without any errors. I was even able to log in through web UI and make

Re: [Freeipa-users] Required services are not started after reboot

2013-10-10 Thread Nathan Kinder
On 10/10/2013 03:50 PM, Nathan Kinder wrote: On 10/10/2013 06:48 AM, Rob Crittenden wrote: Mateusz Marzantowicz wrote: On 08.10.2013 18:43, Tamas Papp wrote: On 10/08/2013 06:33 PM, Mateusz Marzantowicz wrote: Finally, I've managed to install FreeIPA on Fedora 20 without any errors. I

Re: [Freeipa-users] Required services are not started after reboot

2013-10-10 Thread Nathan Kinder
On 10/10/2013 04:11 PM, Nathan Kinder wrote: On 10/10/2013 03:50 PM, Nathan Kinder wrote: On 10/10/2013 06:48 AM, Rob Crittenden wrote: Mateusz Marzantowicz wrote: On 08.10.2013 18:43, Tamas Papp wrote: On 10/08/2013 06:33 PM, Mateusz Marzantowicz wrote: Finally, I've managed to install

Re: [Freeipa-users] Required services are not started after reboot

2013-10-11 Thread Nathan Kinder
On 10/10/2013 04:57 PM, Nathan Kinder wrote: On 10/10/2013 04:11 PM, Nathan Kinder wrote: On 10/10/2013 03:50 PM, Nathan Kinder wrote: On 10/10/2013 06:48 AM, Rob Crittenden wrote: Mateusz Marzantowicz wrote: On 08.10.2013 18:43, Tamas Papp wrote: On 10/08/2013 06:33 PM, Mateusz

Re: [Freeipa-users] ipa sync agreement to AD DC is taking a very long time

2013-10-14 Thread Nathan Kinder
On 10/14/2013 08:26 PM, janice.psyop wrote: Hi, I've been setting up an IPA server (centos 6.4) with AD trust (2008R2 domain) following the FC18 freeipa guide. Everything has gone smoothly until I ran the ipa-replica-manage connect command to the AD DC and it seems to be running (no errors

Re: [Freeipa-users] weak and null ciphers detected on ldap ports

2014-09-22 Thread Nathan Kinder
On 09/22/2014 05:03 AM, Murty, Ajeet (US - Arlington) wrote: Security scan of FreeIPA server ports uncovered weak, medium and null ciphers on port 389 and 636. We are running ‘ipa-server-3.0.0-37.el6.i686’. How can I disable/remove these ciphers in my existing setup? This has recently been

Re: [Freeipa-users] Problems with ntpd when running FreeIPA in a Docker container

2015-01-15 Thread Nathan Kinder
On 01/15/2015 08:56 AM, Nathan Kinder wrote: On 01/15/2015 12:01 AM, Jan Pazdziora wrote: ... You need to use --cap-add=SYS_TIME when running the server container or ntpd will fail. Thanks for the tip. This works. It would be handy to add this to the README for your freeipa-server

Re: [Freeipa-users] Problems with ntpd when running FreeIPA in a Docker container

2015-01-15 Thread Nathan Kinder
On 01/15/2015 12:01 AM, Jan Pazdziora wrote: On Wed, Jan 14, 2015 at 08:18:02PM -0800, Nathan Kinder wrote: Hi, I'm running into a strange problem related to ntpd when trying to use IPA in a container. I'm using the adelton/freeipa-server:fedora-21 and adelton/freeipa-client:fedora-21

Re: [Freeipa-users] Problems with ntpd when running FreeIPA in a Docker container

2015-01-15 Thread Nathan Kinder
On 01/15/2015 09:41 AM, Jan Pazdziora wrote: On Thu, Jan 15, 2015 at 08:56:29AM -0800, Nathan Kinder wrote: Even if you do that, SELinux will likely prevent ntpd doing its job but at least it will stay around so that the client can connect to it. What is interesting though is the fact

[Freeipa-users] Problems with ntpd when running FreeIPA in a Docker container

2015-01-14 Thread Nathan Kinder
Hi, I'm running into a strange problem related to ntpd when trying to use IPA in a container. I'm using the adelton/freeipa-server:fedora-21 and adelton/freeipa-client:fedora-21 docker images. Basically, the client install hangs when it runs ntpd. This is reproducible on two different docker

Re: [Freeipa-users] FREEIPA REPLICA - ITS USE AND HOW IT SHOULD OPERATE WHEN PRIMARY FAILS

2015-04-10 Thread Nathan Kinder
On 04/10/2015 06:54 PM, Martin Chamambo wrote: Good day I have a freeipa primary server working as i wanted , no complex stuff has been setup yet except the basic service and sudo controls which is fine by me. I have also setup a replica from the primary. the dns server is running