[Freeipa-users] unindexed searches?

2015-10-07 Thread Janelle
Hello, I hope this is a simply question. I have 1000's of these on my servers and it severely bogs them down. Any ideas on how to get rid of unindexed searches? [04/Oct/2015:13:27:54 -0700] conn=1344502 op=11158 RESULT err=0 tag=101 nentries=0 etime=0 notes=U [04/Oct/2015:13:27:54 -0700]

Re: [Freeipa-users] unindexed searches?

2015-10-07 Thread Rob Crittenden
Janelle wrote: > Hello, > > I hope this is a simply question. I have 1000's of these on my servers > and it severely bogs them down. Any ideas on how to get rid of unindexed > searches? > > [04/Oct/2015:13:27:54 -0700] conn=1344502 op=11158 RESULT err=0 tag=101 > nentries=0 etime=0 notes=U >

[Freeipa-users] Cant setup replica (freeipa 4.1.3), problem with pki

2015-10-07 Thread Łukasz Jaworski
Hi, I have problem with setup new replicas. I tried setup two replicas, both failed with the same error. environment: Fedora 21 packages: freeipa-server-4.1.3-2.fc21.x86_64 389-ds-base-1.3.3.8-1.fc21.x86_64 389-ds-base-libs-1.3.3.8-1.fc21.x86_64 pki-server-10.2.0-5.fc21.noarch same on server

Re: [Freeipa-users] ssh and sudo password authentication not working with freeipa-client 3.3.4-0ubuntu3.1 on Ubuntu 14.04

2015-10-07 Thread Sumit Bose
On Tue, Oct 06, 2015 at 03:39:43PM +0200, Alexander Skwar wrote: > Hello Sumit > > ipa-client-install hasn't set krb5_realm. I did that. > > We're using Chef-Solo to manage our systems and I have /etc/sssd/sssd.conf > in chef. So it overwrote, whatever ipa-client-install put there. And that's >

Re: [Freeipa-users] Searching for things in the UI no longer seems to work, neither does ipa host-find or hostgroup-find after schema upgrade to dogtag 10

2015-10-07 Thread Martin Basti
On 10/07/2015 09:49 AM, Alex Williams wrote: Hi guys, yesterday I finally managed to get our IPA3.0.0 servers in a state that I could upgrade the schema to dogtag 10, using the migration script and launched a new RHEL7.1 IPA4.1 server as a replica. Unfortunately, in both the new RHEL7.1

Re: [Freeipa-users] RedHat IdM Active Directory Integration

2015-10-07 Thread Sumit Bose
On Tue, Oct 06, 2015 at 01:48:21PM -0500, Lesley Kimmel wrote: > Hi all; > > I'm working an initiative to centralize user accounts in Active Directory. > We have a large RHEL (6+) footprint and want to manage these as well. I am > a Red Hat Engineer on the project and, while it is possible to

Re: [Freeipa-users] SUDO does not always works on first try

2015-10-07 Thread Jakub Hrozek
On Mon, Oct 05, 2015 at 01:25:09PM +, Zoske, Fabian wrote: > Dear Jakub, > > I found only the following entries in the /var/log/auth.log: > > Oct 5 11:57:38 hl-srv10 sudo: pam_unix(sudo:auth): conversation failed > Oct 5 11:57:38 hl-srv10 sudo: pam_unix(sudo:auth): auth could not identify

[Freeipa-users] Searching for things in the UI no longer seems to work, neither does ipa host-find or hostgroup-find after schema upgrade to dogtag 10

2015-10-07 Thread Alex Williams
Hi guys, yesterday I finally managed to get our IPA3.0.0 servers in a state that I could upgrade the schema to dogtag 10, using the migration script and launched a new RHEL7.1 IPA4.1 server as a replica. Unfortunately, in both the new RHEL7.1 IPA4.1 server AND the old RHEL6.6 IPA3.0.0 server

Re: [Freeipa-users] sudo rules do not seem to work

2015-10-07 Thread Jakub Hrozek
On Tue, Oct 06, 2015 at 06:28:14PM +0200, Karl Forner wrote: > Hello, > > I had assumed sudo rules worked because I have an "allow_all for admins" > sudo rule that seemed to work, but I wonder if there is an implicit rule > for the special group admins ? > > > Because I have tried to replicate

Re: [Freeipa-users] Web login problems

2015-10-07 Thread Simo Sorce
On 07/10/15 13:36, Pat Gunn wrote: Hi, I'm trying to build a cluster of 3 IPA (staging at this point, but eventually later I'll make a prod version) systems (that will reside in AWS) that will manage select systems in our infrastructure (mostly but not entirely in AWS). The systems will be

Re: [Freeipa-users] RedHat IdM Active Directory Integration

2015-10-07 Thread Martin Kosek
On 10/06/2015 07:35 PM, Lesley Kimmel wrote: > Hi all; > > I'm working an initiative to centralize user accounts in Active Directory. > We have a large RHEL (6+) footprint and want to manage these as well. I am > a Red Hat Engineer on the project and, while it is possible to integrate > all of

Re: [Freeipa-users] sudo rules do not seem to work

2015-10-07 Thread Jakub Hrozek
On Wed, Oct 07, 2015 at 11:19:02AM +0200, Pavel Březina wrote: > On 10/07/2015 10:03 AM, Jakub Hrozek wrote: > >On Tue, Oct 06, 2015 at 06:28:14PM +0200, Karl Forner wrote: > >>Hello, > >> > >>I had assumed sudo rules worked because I have an "allow_all for admins" > >>sudo rule that seemed to

Re: [Freeipa-users] Searching for things in the UI no longer seems to work, neither does ipa host-find or hostgroup-find after schema upgrade to dogtag 10

2015-10-07 Thread Martin Basti
On 10/07/2015 12:28 PM, Martin Basti wrote: On 10/07/2015 12:10 PM, Alex Williams wrote: On 07/10/15 10:57, Martin Basti wrote: On 10/07/2015 11:23 AM, Alex Williams wrote: On 07/10/15 09:53, Martin Basti wrote: On 10/07/2015 09:49 AM, Alex Williams wrote: Hi guys, yesterday I

Re: [Freeipa-users] DNS forwarding configuration randomly breaks and stops working

2015-10-07 Thread Petr Spacek
On 6.10.2015 18:57, nat...@nathanpeters.com wrote: >> Your expectation #1 is correct, but there can be multiple reasons why it >> fails. >> >> Did you try to set forward policy = only as I advised you in the previous >> e-mail? Forward policy 'first' does not make sense when split-DNS is >>

Re: [Freeipa-users] Searching for things in the UI no longer seems to work, neither does ipa host-find or hostgroup-find after schema upgrade to dogtag 10

2015-10-07 Thread Alex Williams
On 07/10/15 10:57, Martin Basti wrote: On 10/07/2015 11:23 AM, Alex Williams wrote: On 07/10/15 09:53, Martin Basti wrote: On 10/07/2015 09:49 AM, Alex Williams wrote: Hi guys, yesterday I finally managed to get our IPA3.0.0 servers in a state that I could upgrade the schema to dogtag

Re: [Freeipa-users] RedHat IdM Active Directory Integration

2015-10-07 Thread Martin Kosek
On 10/07/2015 12:01 PM, Martin Kosek wrote: > On 10/06/2015 07:35 PM, Lesley Kimmel wrote: >> Hi all; >> >> I'm working an initiative to centralize user accounts in Active Directory. >> We have a large RHEL (6+) footprint and want to manage these as well. I am >> a Red Hat Engineer on the project

Re: [Freeipa-users] Searching for things in the UI no longer seems to work, neither does ipa host-find or hostgroup-find after schema upgrade to dogtag 10

2015-10-07 Thread Martin Basti
On 10/07/2015 01:26 PM, Alex Williams wrote: On 07/10/15 11:31, Martin Basti wrote: On 10/07/2015 12:28 PM, Martin Basti wrote: On 10/07/2015 12:10 PM, Alex Williams wrote: On 07/10/15 10:57, Martin Basti wrote: On 10/07/2015 11:23 AM, Alex Williams wrote: On 07/10/15 09:53, Martin

Re: [Freeipa-users] FreeIPA 3.3 performance issues with many hosts

2015-10-07 Thread Martin Kosek
On 10/05/2015 02:13 PM, Dominik Korittki wrote: > > > Am 01.10.2015 um 21:52 schrieb Rob Crittenden: >> Dominik Korittki wrote: >>> Hello folks, >>> >>> I am running two FreeIPA Servers with around 100 users and around 15.000 >>> hosts, which are used by users to login via ssh. The FreeIPA

Re: [Freeipa-users] sudo rules do not seem to work

2015-10-07 Thread Pavel Březina
On 10/07/2015 10:03 AM, Jakub Hrozek wrote: On Tue, Oct 06, 2015 at 06:28:14PM +0200, Karl Forner wrote: Hello, I had assumed sudo rules worked because I have an "allow_all for admins" sudo rule that seemed to work, but I wonder if there is an implicit rule for the special group admins ?

Re: [Freeipa-users] Searching for things in the UI no longer seems to work, neither does ipa host-find or hostgroup-find after schema upgrade to dogtag 10

2015-10-07 Thread Alex Williams
On 07/10/15 12:40, Martin Basti wrote: On 10/07/2015 01:26 PM, Alex Williams wrote: On 07/10/15 11:31, Martin Basti wrote: On 10/07/2015 12:28 PM, Martin Basti wrote: On 10/07/2015 12:10 PM, Alex Williams wrote: On 07/10/15 10:57, Martin Basti wrote: On 10/07/2015 11:23 AM, Alex

Re: [Freeipa-users] Searching for things in the UI no longer seems to work, neither does ipa host-find or hostgroup-find after schema upgrade to dogtag 10

2015-10-07 Thread Martin Basti
On 10/07/2015 11:23 AM, Alex Williams wrote: On 07/10/15 09:53, Martin Basti wrote: On 10/07/2015 09:49 AM, Alex Williams wrote: Hi guys, yesterday I finally managed to get our IPA3.0.0 servers in a state that I could upgrade the schema to dogtag 10, using the migration script and

Re: [Freeipa-users] Searching for things in the UI no longer seems to work, neither does ipa host-find or hostgroup-find after schema upgrade to dogtag 10

2015-10-07 Thread Alex Williams
On 07/10/15 09:53, Martin Basti wrote: On 10/07/2015 09:49 AM, Alex Williams wrote: Hi guys, yesterday I finally managed to get our IPA3.0.0 servers in a state that I could upgrade the schema to dogtag 10, using the migration script and launched a new RHEL7.1 IPA4.1 server as a replica.

Re: [Freeipa-users] Cant setup replica (freeipa 4.1.3), problem with pki

2015-10-07 Thread Łukasz Jaworski
Looks like system is missing ca cert (should it be added during ipa-replica-install?) I don't know if missing cert is main problem in my case, but I made some tests: try 1: openssl s_client -connect `hostname -f`:8443 (…) Verify return code: 19 (self signed certificate in certificate chain)

[Freeipa-users] Slow SSH login for IPA users only

2015-10-07 Thread Guillem Liarte
All, I have an IPA 4.1 installation that works perfectly. We just suffer from slow logins ( this is also slow in other operations such invoking SUDO ) IPA user: 1st. login: 30 seconds 2nd login: 8 seconds 3rd login: 6.5 seconds 4rth login: 20 seconds Local user: Consistently under 2 seconds

Re: [Freeipa-users] Searching for things in the UI no longer seems to work, neither does ipa host-find or hostgroup-find after schema upgrade to dogtag 10

2015-10-07 Thread Martin Basti
On 10/07/2015 12:10 PM, Alex Williams wrote: On 07/10/15 10:57, Martin Basti wrote: On 10/07/2015 11:23 AM, Alex Williams wrote: On 07/10/15 09:53, Martin Basti wrote: On 10/07/2015 09:49 AM, Alex Williams wrote: Hi guys, yesterday I finally managed to get our IPA3.0.0 servers in a

[Freeipa-users] ACI for full replica

2015-10-07 Thread Nicola Canepa
Hello, I'm trying to replicate a subtree of the data from FreeIPA to a "foreign" LDAP server, by using LSC (http://lsc-project.org). The replication seems to work correctly, but I was unable to create an user (maybe even not visible from the web GUI) which could read userPassword field. Which

Re: [Freeipa-users] Slow SSH login for IPA users only

2015-10-07 Thread Sumit Bose
On Wed, Oct 07, 2015 at 12:07:08PM +0200, Guillem Liarte wrote: > All, > > I have an IPA 4.1 installation that works perfectly. We just suffer from > slow logins ( this is also slow in other operations such invoking SUDO ) > > IPA user: > > 1st. login: 30 seconds > 2nd login: 8 seconds > 3rd

Re: [Freeipa-users] Searching for things in the UI no longer seems to work, neither does ipa host-find or hostgroup-find after schema upgrade to dogtag 10

2015-10-07 Thread Alex Williams
On 07/10/15 11:31, Martin Basti wrote: On 10/07/2015 12:28 PM, Martin Basti wrote: On 10/07/2015 12:10 PM, Alex Williams wrote: On 07/10/15 10:57, Martin Basti wrote: On 10/07/2015 11:23 AM, Alex Williams wrote: On 07/10/15 09:53, Martin Basti wrote: On 10/07/2015 09:49 AM, Alex

Re: [Freeipa-users] FreeIPA 3.3 performance issues with many hosts

2015-10-07 Thread thierry bordaz
On 10/07/2015 11:19 AM, Martin Kosek wrote: On 10/05/2015 02:13 PM, Dominik Korittki wrote: Am 01.10.2015 um 21:52 schrieb Rob Crittenden: Dominik Korittki wrote: Hello folks, I am running two FreeIPA Servers with around 100 users and around 15.000 hosts, which are used by users to login

Re: [Freeipa-users] ACI for full replica

2015-10-07 Thread Rob Crittenden
Nicola Canepa wrote: > Hello, I'm trying to replicate a subtree of the data from FreeIPA to a > "foreign" LDAP server, by using LSC (http://lsc-project.org). > The replication seems to work correctly, but I was unable to create an > user (maybe even not visible from the web GUI) which could read >

Re: [Freeipa-users] FreeIPA 3.3 performance issues with many hosts

2015-10-07 Thread Dominik Korittki
Am 07.10.2015 um 15:25 schrieb thierry bordaz: On 10/07/2015 11:19 AM, Martin Kosek wrote: On 10/05/2015 02:13 PM, Dominik Korittki wrote: Am 01.10.2015 um 21:52 schrieb Rob Crittenden: Dominik Korittki wrote: Hello folks, I am running two FreeIPA Servers with around 100 users and around

Re: [Freeipa-users] FreeIPA 3.3 performance issues with many hosts

2015-10-07 Thread thierry bordaz
On 10/07/2015 05:03 PM, Dominik Korittki wrote: Am 07.10.2015 um 15:25 schrieb thierry bordaz: On 10/07/2015 11:19 AM, Martin Kosek wrote: On 10/05/2015 02:13 PM, Dominik Korittki wrote: Am 01.10.2015 um 21:52 schrieb Rob Crittenden: Dominik Korittki wrote: Hello folks, I am running two

Re: [Freeipa-users] Cant setup replica (freeipa 4.1.3), problem with pki

2015-10-07 Thread Rob Crittenden
Łukasz Jaworski wrote: > Hi, > > I have problem with setup new replicas. > I tried setup two replicas, both failed with the same error. > > environment: > Fedora 21 > > packages: > freeipa-server-4.1.3-2.fc21.x86_64 > 389-ds-base-1.3.3.8-1.fc21.x86_64 > 389-ds-base-libs-1.3.3.8-1.fc21.x86_64 >

Re: [Freeipa-users] FreeIPA DMZ topology

2015-10-07 Thread Baird, Josh
I'm also interested in how people are handling this - especially when using AD Trusts. When using a trust, the IPA host not only has to communicate with IPA servers, but with potentially every AD domain controller in your HUB site. For us, this is a large number of domain controllers which

Re: [Freeipa-users] FreeIPA DMZ topology

2015-10-07 Thread Aly Khimji
Yes sorry I should expand on my question as per Josh's point my scenario also has an AD trust involved. I recently learned of KDC proxying but I am not sure if replica's and KDC proxies are the preferred/accepted design solutions for DMZ's Aly On Wed, Oct 7, 2015 at 1:18 PM, Baird, Josh

[Freeipa-users] Web login problems

2015-10-07 Thread Pat Gunn
Hi, I'm trying to build a cluster of 3 IPA (staging at this point, but eventually later I'll make a prod version) systems (that will reside in AWS) that will manage select systems in our infrastructure (mostly but not entirely in AWS). The systems will be fronted (like most of our infrastructure)

[Freeipa-users] Certmonger and dogtag not working....issues manually renewing Server-Cert

2015-10-07 Thread Gronde, Christopher (Contractor)
I am new to FreeIPA and have inherited two IPA servers not sure if one is a master/slave or how they are different. I will try to give some pertinent outputs below of some of the things I am seeing. I know the Server-Cert is expired but can't figure out how to renew it. There also appears to

[Freeipa-users] FreeIPA DMZ topology

2015-10-07 Thread Aly Khimji
Hey guys, Question for you, would having a replica be the ideal solution for authorizing hosts in a DMZ? Do you have any use cases for DMZ access/authorization or topologies you can share for DMZ zones where FreeIPA is used? Aly -- Manage your subscription for the Freeipa-users mailing list: