Re: [Freeipa-users] Timeout (?) issues

2013-09-20 Thread Petr Spacek
On 20.9.2013 01:24, KodaK wrote: This is ridiculous, right? IPA server 1: # for i in $(ls access*); do echo -n $i:\ ;grep err=32 $i | wc -l; done access: 248478 access.20130916-043207: 302774 access.20130916-123642: 272572 access.20130916-201516: 294308 access.20130917-081053: 295060

[Freeipa-users] Export SSL Cert

2013-09-20 Thread Andrew Lau
Hi, On my ever quest to finally get freeipa working behind a reverse proxy, the final thing was is it possible to export the private key and cert of the freeipa http cert? I would like to put the SSL cert on the reverse proxy but it seems I'm not having any luck getting the private key out from

Re: [Freeipa-users] Export SSL Cert

2013-09-20 Thread Jan Cholasta
On 20.9.2013 10:14, Andrew Lau wrote: Hi, On my ever quest to finally get freeipa working behind a reverse proxy, the final thing was is it possible to export the private key and cert of the freeipa http cert? I would like to put the SSL cert on the reverse proxy but it seems I'm not having any

Re: [Freeipa-users] Export SSL Cert

2013-09-20 Thread Andrew Lau
On Fri, Sep 20, 2013 at 8:48 PM, Jan Cholasta jchol...@redhat.com wrote: On 20.9.2013 10:14, Andrew Lau wrote: Hi, On my ever quest to finally get freeipa working behind a reverse proxy, the final thing was is it possible to export the private key and cert of the freeipa http cert? I would

[Freeipa-users] Fwd: Windows, Samba and IPA

2013-09-20 Thread Fred van Zwieten
Hi, I wonder if it is possible to have Windows clients (member of some domain) to connect to SAMBA shares with an IPA account. I found various howto's voor Kerberized SAMBA but they al use Linux as the client platform. I have tried to set it up using a Red Hat Solution article, but I did not get

Re: [Freeipa-users] Joining a Windows Workstation to an IPA realm (It works better than expected!)

2013-09-20 Thread Alexander Bokovoy
On Fri, 20 Sep 2013, Loris Santamaria wrote: Hi all, yesterday I was going to try puppet on windows, so I fired up a Windows 7 VM, and just for curiosity, instead of joining it to the AD realm, i decided to try the instructions outlined in the wiki to join the machine to the IPA realm:

Re: [Freeipa-users] Recomendations on multi-domain environments

2013-09-20 Thread Dmitri Pal
On 09/18/2013 07:55 AM, Andrew Lau wrote: On Wed, Sep 18, 2013 at 9:40 PM, Arturo Borrero aborr...@cica.es mailto:aborr...@cica.es wrote: Hi there! This is my situation. I have some users of my main domain cica.es http://cica.es. But I also maintain a database of users

Re: [Freeipa-users] Replica of a Replica and Master Recovery

2013-09-20 Thread Rob Crittenden
Trevor T Kates (Services - 6) wrote: I apologize for the weird subject. The problem I'm facing feels a little weird and I could use some help. I'm running IPA in a test environment and trying to find different ways in which I can break it and then repair it. My IPA is running on CentOS 6.4:

Re: [Freeipa-users] Elliptic curves with the CA

2013-09-20 Thread Dmitri Pal
On 09/18/2013 01:53 PM, mees virk wrote: I do not have a valid support contract, or other contracts with RedHat. Doesn't that stop me from opening proper RFE ticket? In any case, my interest was this time solely for evaluation purposes. If I were actively choosing an integrated identity

Re: [Freeipa-users] ipa-client auth with windomain account

2013-09-20 Thread Dmitri Pal
On 09/18/2013 11:42 AM, ?? ? wrote: Hi, Do I need network access to ports from the ipa-client to the server- windows for authentication with windomain accounts? ipa-server fedora19 ipa-client fedora19 winserver win2012 the ipa-client is located in another network within the

Re: [Freeipa-users] slapi-nis bypass Password Policies

2013-09-20 Thread cbul...@gmail.com
Hi Simon, The first option. I would like to be able to continue to authenticate even if the passwords are expired. It sounds crazy but we need to accomplish that just for one service. Thanks in advance! On 09/19/2013 10:28 PM, Simo Sorce wrote: On Wed, 2013-09-18 at 12:00 -0500,

Re: [Freeipa-users] Joining a Windows Workstation to an IPA realm (It works better than expected!)

2013-09-20 Thread Alexander Bokovoy
On Fri, 20 Sep 2013, Dmitri Pal wrote: On 09/20/2013 11:01 AM, Alexander Bokovoy wrote: On Fri, 20 Sep 2013, Loris Santamaria wrote: Hi all, yesterday I was going to try puppet on windows, so I fired up a Windows 7 VM, and just for curiosity, instead of joining it to the AD realm, i decided

Re: [Freeipa-users] Joining a Windows Workstation to an IPA realm (It works better than expected!)

2013-09-20 Thread Dmitri Pal
On 09/20/2013 11:01 AM, Alexander Bokovoy wrote: On Fri, 20 Sep 2013, Loris Santamaria wrote: Hi all, yesterday I was going to try puppet on windows, so I fired up a Windows 7 VM, and just for curiosity, instead of joining it to the AD realm, i decided to try the instructions outlined in the

Re: [Freeipa-users] slapi-nis bypass Password Policies

2013-09-20 Thread JR Aquino
Is your client simply using LDAP to bind and authenticate your service? If so, you may be able to create a special dedicated sysaccount in: cn=sysaccounts,cn=etc,dc=domain,dc=com This account could be used to bind your service without having it be a member of the standard users database

Re: [Freeipa-users] Elliptic curves with the CA

2013-09-20 Thread Ade Lee
As a partial answer to this, work has been ongoing to fully support ECC in Dogtag. Attached is a most likely out-of-date wiki page detailing ECC support in Dogtag. https://pki.fedoraproject.org/wiki/ECC_in_Dogtag If I recall correctly, we are somewhere around phase 3. Ade On Fri, 2013-09-20

Re: [Freeipa-users] Fwd: Windows, Samba and IPA

2013-09-20 Thread Dmitri Pal
On 09/20/2013 07:33 AM, Fred van Zwieten wrote: Hi, I wonder if it is possible to have Windows clients (member of some domain) to connect to SAMBA shares with an IPA account. I found various howto's voor Kerberized SAMBA but they al use Linux as the client platform. I have tried to set it up

Re: [Freeipa-users] Replica of a Replica and Master Recovery

2013-09-20 Thread Dmitri Pal
On 09/17/2013 03:40 PM, Trevor T Kates (Services - 6) wrote: I apologize for the weird subject. The problem I'm facing feels a little weird and I could use some help. I'm running IPA in a test environment and trying to find different ways in which I can break it and then repair it. My IPA is