Re: [Freeipa-users] TTL in individual DNS records

2013-10-21 Thread Petr Spacek
On 18.10.2013 21:44, Stephen Ingram wrote: I'm using IPA 3.0.x on RHEL 6.4 and trying to setup other zones in DNS. I notice that regardless of the TTL set in the SOA for the zone, the individual records default to 86400. I see there has been previous discussion on the list (

Re: [Freeipa-users] TTL in individual DNS records

2013-10-21 Thread Stephen Ingram
On Sun, Oct 20, 2013 at 11:44 PM, Petr Spacek pspa...@redhat.com wrote: On 18.10.2013 21:44, Stephen Ingram wrote: I'm using IPA 3.0.x on RHEL 6.4 and trying to setup other zones in DNS. I notice that regardless of the TTL set in the SOA for the zone, the individual records default to 86400.

[Freeipa-users] RHEL 5.x client functionality with ipa-server 3.0

2013-10-21 Thread Brian Lee
Hello All, We have a mixed RHEL environment (5.x, 6.x, x86, and x86_64). Our FreeIPA server is running RHEL 6.4 x86_64 with ipa-server 3.0. My question is what are the hurdles or feature limitations should I expect to encounter in this mixed environment, especially in regards to the RHEL 5.x

Re: [Freeipa-users] TTL in individual DNS records

2013-10-21 Thread Petr Spacek
On 21.10.2013 17:58, Stephen Ingram wrote: On Sun, Oct 20, 2013 at 11:44 PM, Petr Spacek pspa...@redhat.com wrote: On 18.10.2013 21:44, Stephen Ingram wrote: I'm using IPA 3.0.x on RHEL 6.4 and trying to setup other zones in DNS. I notice that regardless of the TTL set in the SOA for the

Re: [Freeipa-users] DNS views: request for comments

2013-10-21 Thread Petr Spacek
On 1.10.2013 17:11, Petr Spacek wrote: Hello list, we would like to get more details about DNS views and how you use them in real life. Also, any idea how user a interface should work is more than welcome! (If you don't know views, read it as differentiate answer to a DNS query on client's IP

Re: [Freeipa-users] Authenticating sudo with ipa on Centos

2013-10-21 Thread Rob Crittenden
Andrew Holway wrote: It is a bit strange that your ipa_domain and ipa_hostname are the same. I think the domain should be just local. I'd run klist -kt /etc/krb5.keytab to see what principals are in there. ipa_hostname = 192-168-0-110.local ipa_server = _srv_, 192-168-0-100.local Hi, I'm a

Re: [Freeipa-users] TTL in individual DNS records

2013-10-21 Thread Stephen Ingram
On Mon, Oct 21, 2013 at 9:37 AM, Petr Spacek pspa...@redhat.com wrote: On 21.10.2013 17:58, Stephen Ingram wrote: On Sun, Oct 20, 2013 at 11:44 PM, Petr Spacek pspa...@redhat.com wrote: On 18.10.2013 21:44, Stephen Ingram wrote: I'm using IPA 3.0.x on RHEL 6.4 and trying to setup other

Re: [Freeipa-users] RHEL 5.x client functionality with ipa-server 3.0

2013-10-21 Thread Dmitri Pal
On 10/21/2013 12:25 PM, Brian Lee wrote: Hello All, We have a mixed RHEL environment (5.x, 6.x, x86, and x86_64). Our FreeIPA server is running RHEL 6.4 x86_64 with ipa-server 3.0. My question is what are the hurdles or feature limitations should I expect to encounter in this mixed

Re: [Freeipa-users] DNS views: request for comments

2013-10-21 Thread Dmitri Pal
On 10/21/2013 12:48 PM, Petr Spacek wrote: On 1.10.2013 17:11, Petr Spacek wrote: Hello list, we would like to get more details about DNS views and how you use them in real life. Also, any idea how user a interface should work is more than welcome! (If you don't know views, read it as

Re: [Freeipa-users] Problems with expired certificates

2013-10-21 Thread Rob Crittenden
Tómas Edwardsson wrote: I'm having issues with expired certificates in /var/lib/pki-ca/alias which I'm quite unsure on how to fix. The ones that have expired are: subsystemCert cert-pki-ca Server-Cert cert-pki-ca According to getcert list the following 2 requests are stuck The error

Re: [Freeipa-users] Authenticating sudo with ipa on Centos

2013-10-21 Thread Jakub Hrozek
On Mon, Oct 21, 2013 at 01:34:17PM -0400, Rob Crittenden wrote: Andrew Holway wrote: It is a bit strange that your ipa_domain and ipa_hostname are the same. I think the domain should be just local. I'd run klist -kt /etc/krb5.keytab to see what principals are in there. ipa_hostname =

Re: [Freeipa-users] DNS views: request for comments

2013-10-21 Thread Simo Sorce
Comments inline. On Mon, 2013-10-21 at 18:48 +0200, Petr Spacek wrote: On 1.10.2013 17:11, Petr Spacek wrote: [trim] Proposal - variant A (classical views) - keep it simple :-) - single level inheritance, all views inherit from 'base' (Base is our current cn=dns

Re: [Freeipa-users] Authenticating sudo with ipa on Centos

2013-10-21 Thread Andrew Holway
Hi, ipa_domain and ipa_hostname was indeed a config error. Also, using a .local domain caused all manner of problems. Thanks all for your help! Andrew On 21 October 2013 21:03, Jakub Hrozek jhro...@redhat.com wrote: On Mon, Oct 21, 2013 at 01:34:17PM -0400, Rob Crittenden wrote: Andrew

[Freeipa-users] Failure decoding Certificate Signing Request

2013-10-21 Thread Thomson, Ryan
Hello FreeIPA users and developers, I'm facing a problem with expired certificates in FreeIPA. I have searched through the list archives and found advice to stop the IPA service, roll back the system clock to a time when the certs were valid but nearly expired, start IPA and then use