[Freeipa-users] Valid documentation for sudo setup for version 4.0.3

Hi, is there any valid documentation/setup to get sudo working? http://docs.fedoraproject.org/en-US/Fedora/15/html/FreeIPA_Guide/example-configuring-sudo.html is not usable, modification of another files are needed to get at least attempts to ldap (for example on CentOS /etc/sudo-ldap.conf).

Re: [Freeipa-users] Valid documentation for sudo setup for version 4.0.3

On Fri, Oct 17, 2014 at 8:39 AM, Alexander Bokovoy aboko...@redhat.com wrote: On Fri, 17 Oct 2014, Vaclav Adamec wrote: Mixture of bot method is result of testing, just registration via ipa-client (maybe CentOS 6 has only ipa-client-3.0.0-37 ?) definitely not setup anything about sudo. I'll try

Re: [Freeipa-users] Valid documentation for sudo setup for version 4.0.3

Thanks everyone for help, for centos65 latest, I really need to do these steps: yum install ipa-client libsss_sudo ipa-client-install ... modify: /etc/sssd/sssd.conf (ldap setup based on man) /etc/nsswitch.conf (sss provider for sudoers based on man) and set nisdomainname than sudo starts to

[Freeipa-users] Installed OpenSSH server does not support dynamically loading authorized user keys - no key login support

Hi, I'm getting Installed OpenSSH server does not support dynamically loading authorized user keys. Public key authentication of IPA users will not be available during ipa client install on CentOS 6.6 Packages openssh-server-6.1p1-5.el6.1.x86_64 and ipa-client-3.0.0-42.el6.centos.x86_64 Manual

Re: [Freeipa-users] Installed OpenSSH server does not support dynamically loading authorized user keys - no key login support

:33Z DEBUG stdout=openssh-daemon (pid 24698) is running... On Tue, Nov 11, 2014 at 3:15 PM, Rob Crittenden rcrit...@redhat.com wrote: Vaclav Adamec wrote: Hi, I'm getting Installed OpenSSH server does not support dynamically loading authorized user keys. Public key authentication of IPA

Re: [Freeipa-users] Installed OpenSSH server does not support dynamically loading authorized user keys - no key login support

about any disabled functionality. Also I'll try fresh CentOS 6.6 with default 5.3 openssh. Vasek On Tue, Nov 11, 2014 at 3:44 PM, Rob Crittenden rcrit...@redhat.com wrote: Vaclav Adamec wrote: Here it is: 2014-11-11T11:45:33Z DEBUG stderr= 2014-11-11T11:45:33Z DEBUG Backing up system

[Freeipa-users] Failed to remove host

Hi, I'm encounter strange behavior, I run host removing from web UI and it failed with error Some entries were not deleted : host not found but it's still showing in list. Via cmd: ipa host-find -- 1 host matched -- Host name: Principal name:

Re: [Freeipa-users] Failed to remove host

Thanks, that's it. Not very clear how to fix it (example with uid converted to host issue is not working) but at least I known what's wrong Vasek On Wed, Nov 26, 2014 at 8:58 AM, Martin Kosek mko...@redhat.com wrote: On 11/26/2014 08:33 AM, Vaclav Adamec wrote: Hi, I'm encounter strange

Re: [Freeipa-users] Fwd: problem users AD can not sudo in centos 6.6

Hi, I had same issue after upgrading registered Centos 6.5 to 6.6 (and with new IPA client). New version already contain sudo support, so sssd.conf doesn't contain it. You can uninstall ipa client and register server again - keep configuration file generated by IPA client itself (I used puppet

Re: [Freeipa-users] IPA RUV unable to decode

/2015 07:49 AM, Ludwig Krispenz wrote: On 05/05/2015 01:27 PM, Martin Kosek wrote: On 05/05/2015 12:38 PM, Vaclav Adamec wrote: Hi, I tried migrate to newest version IPA, but result is quite unstable and removing old replicas ends with RUV which cannot be decoded (it stucked in queue

Re: [Freeipa-users] more replication fun

Hi, Mike Reynolds recommend cleanallruv script (IPA RUV unable to decode thread), if you are sure that's not any live replica server behind this id than just try cleanallruv.pl -w X -b dc= -r 9 Vasek On Thu, May 7, 2015 at 2:25 AM, Janelle janellenicol...@gmail.com wrote: Hi again..

Re: [Freeipa-users] IPA RUV unable to decode

wrote: On 05/05/2015 01:27 PM, Martin Kosek wrote: On 05/05/2015 12:38 PM, Vaclav Adamec wrote: Hi, I tried migrate to newest version IPA, but result is quite unstable and removing old replicas ends with RUV which cannot be decoded (it stucked in queue forever): ipa-replica-manage del

[Freeipa-users] IPA RUV unable to decode

Hi, I tried migrate to newest version IPA, but result is quite unstable and removing old replicas ends with RUV which cannot be decoded (it stucked in queue forever): ipa-replica-manage del ipa-master-dmz002.test.com -fc Cleaning a master is irreversible. This should not normally be require, so

[Freeipa-users] Any thoughts on sssd_sudo memory usage ?

Hi, after last update I see this: PID USERPR NI VIRT RES SHR S %CPU %MEMTIME+ COMMAND 5918 root 20 0 4413m 4.1g 1596 S 2.8 35.4 31:12.72 sssd_sudo sssd-common-1.11.6-30.el6_6.4.x86_64 on CentOS release 6.6 final (up2date) restart, sync + swap cleanup and in less then

Re: [Freeipa-users] Any thoughts on sssd_sudo memory usage ?

With higher debug level I see that sssd sudo trying to resolve local account (for nagios monitoring) Vasek On Tue, May 26, 2015 at 6:39 AM, Vaclav Adamec vaclav.ada...@suchy-zleb.cz wrote: ps -eo pid,cmd,size,rss | grep sssd_sudo 1533 /usr/libexec/sssd/sssd_sudo 4245972 4247700 and huge

Re: [Freeipa-users] Any thoughts on sssd_sudo memory usage ?

Thanks, I'll try some workarounds and wait for new package in centos repositories On Tue, May 26, 2015 at 7:53 AM, Lukas Slebodnik lsleb...@redhat.com wrote: On (26/05/15 06:44), Vaclav Adamec wrote: With higher debug level I see that sssd sudo trying to resolve local account (for nagios

[Freeipa-users] FreeIPA state - performace, commercial usage

Hi, Don't want to start flame, but my question is quite simple, is there anybody who use it in real production/commercial setup without any major issues ? don't you lack commercial support ? no issues with auditors ? after a year/two of usage/testing/troubleshooting of freeipa/redhat ipa it

Re: [Freeipa-users] stubborn old replicas

You could try this (RH recommended way). It works for me better than cleanallruv.pl as this sometimes leads to ldap freeze) unable to decode: {replica 30} 5548fa20001e 5548fa20001e unable to decode: {replica 26} 5548a9a8001a 5548a9a8001a for all of them,