Re: [Freeipa-users] freeipa client wont install on host where a ipa server guest is already installed.

2013-12-19 Thread Lukas Slebodnik
On (18/12/13 20:40), Joshua Nager wrote: Does this mean I should be able to login with the credentials supplied by the ipa-server? If so, I can not. The host box does not recognize any user accounts in the ipa domain at all. Any help is much appreciated as I would love to get this working. Is

Re: [Freeipa-users] Sudo issues with FreeIPA

2013-12-21 Thread Lukas Slebodnik
On (20/12/13 18:42), Dimitar Georgievski wrote: Hi Dmitri, One follow up question about the management of the SSSD local cache. I've tried to clean cache entries with the sss_cache utility, but it looks like this utility is not working. I was able to confirm with ldbsearch that records for

Re: [Freeipa-users] Sudo issues with FreeIPA

2013-12-23 Thread Lukas Slebodnik
On (23/12/13 10:16), Dimitar Georgievski wrote: Hi Lukas, Does the LDAP entry need to be removed or just modified? Could the LDAP entry be a sudo policy assigned to the user? sudo rules are special case, I didn't noticed anything about sudo rules in the previous mail. There is periodical task in

Re: [Freeipa-users] ipa-client-install fails on replica because of kinit cannot contact any KDC

2014-02-08 Thread Lukas Slebodnik
On (06/02/14 18:33), Shree wrote: First of all, the ipa-replica-install did not allow me to use the --setup-ca option complaining that a cert already exists, replicate creation was successful after I skipped the option. Seems like the replica is one except  1) There is no CA Service running on

Re: [Freeipa-users] Migration mode

2014-03-10 Thread Lukas Slebodnik
On (10/03/14 13:55), Jitse Klomp wrote: Hello all, I'm migrating our OpenLDAP-based IdM-system to IPA. Instead of using migrate-ds I used some custom scripts to import all of our users (~250) and groups (~85) with IPA commands (ipa user-add etc.). To move passwords I configured the ipa-server to

Re: [Freeipa-users] Migration mode

2014-03-10 Thread Lukas Slebodnik
On (10/03/14 15:19), Jitse Klomp wrote: On 10-03-14 14:59, Jitse Klomp wrote: On 10-03-14 14:35, Lukas Slebodnik wrote: On (10/03/14 13:55), Jitse Klomp wrote: Hello all, I'm migrating our OpenLDAP-based IdM-system to IPA. Instead of using migrate-ds I used some custom scripts to import all

Re: [Freeipa-users] Migration mode

2014-03-10 Thread Lukas Slebodnik
On (10/03/14 16:35), Jitse Klomp wrote: On 10-03-14 16:10, Lukas Slebodnik wrote: On (10/03/14 15:19), Jitse Klomp wrote: On 10-03-14 14:59, Jitse Klomp wrote: On 10-03-14 14:35, Lukas Slebodnik wrote: On (10/03/14 13:55), Jitse Klomp wrote: Hello all, I'm migrating our OpenLDAP-based IdM-system

Re: [Freeipa-users] Migration mode

2014-03-10 Thread Lukas Slebodnik
On (10/03/14 16:58), Lukas Slebodnik wrote: On (10/03/14 16:35), Jitse Klomp wrote: On 10-03-14 16:10, Lukas Slebodnik wrote: On (10/03/14 15:19), Jitse Klomp wrote: On 10-03-14 14:59, Jitse Klomp wrote: On 10-03-14 14:35, Lukas Slebodnik wrote: On (10/03/14 13:55), Jitse Klomp wrote: Hello all

Re: [Freeipa-users] Migration mode

2014-03-10 Thread Lukas Slebodnik
On (10/03/14 15:14), Rob Crittenden wrote: Jitse Klomp wrote: On 10-03-14 18:57, Sumit Bose wrote: On Mon, Mar 10, 2014 at 05:23:59PM +0100, Jitse Klomp wrote: On 10-03-14 17:03, Lukas Slebodnik wrote: On (10/03/14 16:58), Lukas Slebodnik wrote: On (10/03/14 16:35), Jitse Klomp wrote: On 10-03-14

Re: [Freeipa-users] Migration mode

2014-03-10 Thread Lukas Slebodnik
On (10/03/14 21:47), Lukas Slebodnik wrote: On (10/03/14 15:14), Rob Crittenden wrote: Jitse Klomp wrote: On 10-03-14 18:57, Sumit Bose wrote: On Mon, Mar 10, 2014 at 05:23:59PM +0100, Jitse Klomp wrote: On 10-03-14 17:03, Lukas Slebodnik wrote: On (10/03/14 16:58), Lukas Slebodnik wrote: On (10

Re: [Freeipa-users] Migration mode

2014-03-13 Thread Lukas Slebodnik
On (13/03/14 14:51), Jitse Klomp wrote: 2014-03-11 16:15 GMT+01:00 Jitse Klomp jitsekl...@gmail.com: On 03/11/2014 03:06 PM, Sumit Bose wrote: On Mon, Mar 10, 2014 at 11:09:48PM +0100, Jitse Klomp wrote: On 10-03-14 22:06, Sumit Bose wrote: Thank you. Maybe there is a change in return

Re: [Freeipa-users] SSSD Failover does not work

2014-03-21 Thread Lukas Slebodnik
On (21/03/14 09:32), Arthur Faizullin wrote: Will it be represented in documentationwiki? :) It is written in manual pages: man sssd-sudo - CONFIGURING SUDO TO COOPERATE WITH SSSD - CONFIGURING SSSD TO FETCH SUDO RULES Any contribution is welcomed. If you want to upgrade

Re: [Freeipa-users] freeIPA client sudo / sssd setup

2014-04-08 Thread Lukas Slebodnik
On (08/04/14 12:52), Nathan Broadbent wrote: I know I'm missing something simple. But I just can't get this ipa client to accept any sudo rules. I rand into the same issue. It's not documented anywhere, but you need to enable the 'sudo' service in /etc/sssd/sssd.conf You need to change:

Re: [Freeipa-users] freeIPA client sudo / sssd setup

2014-04-08 Thread Lukas Slebodnik
On (08/04/14 13:34), Nathan Broadbent wrote: man sssd-sudo says: CONFIGURING SSSD TO FETCH SUDO RULES All configuration that is needed on SSSD side is to extend the list of services with sudo in [sssd] section of sssd.conf(5).

Re: [Freeipa-users] ipa: ERROR: did not receive Kerberos credentials

2014-04-11 Thread Lukas Slebodnik
On (11/04/14 11:22), rashard.ke...@sita.aero wrote: I changed the permissions to world readable to test, afterward I changed it back to be readable only by the owner. The problem then reappeared. [rkelly@replicahostname ~]$ ls -lZa| grep krb -r rootroot?

Re: [Freeipa-users] sudo and NIS domain name

2014-05-03 Thread Lukas Slebodnik
On (01/05/14 15:53), Dean Hunter wrote: On Thu, 2014-05-01 at 16:32 -0400, Dmitri Pal wrote: On 05/01/2014 04:07 PM, Dean Hunter wrote: I just noticed that I had been incorrectly setting the NIS domain name since upgrading to Fedora 20 and FreeIPA 3.3.4, yet I appear to be successfully

Re: [Freeipa-users] sudo and NIS domain name

2014-05-03 Thread Lukas Slebodnik
On (03/05/14 10:39), Dean Hunter wrote: On Sat, 2014-05-03 at 12:36 +0200, Lukas Slebodnik wrote: On (01/05/14 15:53), Dean Hunter wrote: On Thu, 2014-05-01 at 16:32 -0400, Dmitri Pal wrote: On 05/01/2014 04:07 PM, Dean Hunter wrote: I just noticed that I had been incorrectly

Re: [Freeipa-users] SSSD Cacheing issues

2014-05-07 Thread Lukas Slebodnik
On (06/05/14 20:45), Todd Maugh wrote: Hello Guys, Im having a problem with a one off my clients, t seems the sssd cache keeps having a problem and is blocking users from authenticating, I am able to solve it by stopping sssd clearing out the cache in /var/lib/sss/db with a rm -rf * and

Re: [Freeipa-users] sudo and NIS domain name

2014-05-09 Thread Lukas Slebodnik
On (08/05/14 19:46), Dean Hunter wrote: On Mon, 2014-05-05 at 10:02 -0400, Rob Crittenden wrote: Dean Hunter wrote: On Sat, 2014-05-03 at 22:50 +0200, Lukas Slebodnik wrote: On (03/05/14 10:39), Dean Hunter wrote: On Sat, 2014-05-03 at 12:36 +0200, Lukas Slebodnik wrote: On (01/05/14

Re: [Freeipa-users] Announcing FreeIPA 4.0.0

2014-07-11 Thread Lukas Slebodnik
On (11/07/14 08:36), Orion Poplawski wrote: On 07/08/2014 03:53 AM, Petr Viktorin wrote: The FreeIPA team is proud to announce FreeIPA v4.0.0! It can be downloaded from http://www.freeipa.org/page/Downloads. As this is a major release, we did not add it to any stable Fedora release (yet), but we

Re: [Freeipa-users] Announcing FreeIPA 4.0.0

2014-07-13 Thread Lukas Slebodnik
On (11/07/14 16:04), Dmitri Pal wrote: On 07/11/2014 10:57 AM, Lukas Slebodnik wrote: On (11/07/14 08:36), Orion Poplawski wrote: On 07/08/2014 03:53 AM, Petr Viktorin wrote: The FreeIPA team is proud to announce FreeIPA v4.0.0! It can be downloaded from http://www.freeipa.org/page/Downloads

Re: [Freeipa-users] FreeIPA 4.0.0 and CentOS release 6.5

2014-07-24 Thread Lukas Slebodnik
On (24/07/14 13:57), Rob Crittenden wrote: Petr Spacek wrote: On 24.7.2014 18:26, Chris Whittle wrote: Would CentOS7 work with FreeIPA 4? In theory - it could work. However you will have to build few new packages, including 389 DS, Kerberos libs, Dogtag CA and bind-dyndb-ldap. I'm

Re: [Freeipa-users] Building previous release rpms are failing

2014-08-07 Thread Lukas Slebodnik
On (07/08/14 07:39), Curtis L. Knight wrote: On Tue, Aug 5, 2014 at 11:26 PM, Rob Crittenden rcrit...@redhat.com wrote: Curtis L. Knight wrote: On Tue, Aug 5, 2014 at 7:21 AM, Martin Kosek mko...@redhat.com mailto:mko...@redhat.com wrote: On 08/05/2014 12:32 PM, Martin Kosek wrote:

Re: [Freeipa-users] Install FreeIPA 4 on ubuntu

2014-08-21 Thread Lukas Slebodnik
On (20/08/14 20:27), Chris Whittle wrote: Is there instructions anywhere? My FreeIPA 3 on CentOS died so I'm starting over You can try FreeIPA 3.3. on CentOS 7 bash-4.2# yum info ipa-server Loaded plugins: fastestmirror Loading mirror speeds from cached hostfile * base: mirror.raystedman.net *

Re: [Freeipa-users] Centos 7 and 4.0

2014-08-23 Thread Lukas Slebodnik
On (22/08/14 23:13), Chris Whittle wrote: I'm trying to install the repo from https://copr.fedoraproject.org/coprs/pviktori/freeipa/ and when I go to install I get yum install freeipa-server You will not be able to install freeipa-server on CentOS from this repo, because freeipa-4.0 is not

Re: [Freeipa-users] Centos 7 and 4.0

2014-08-25 Thread Lukas Slebodnik
On (23/08/14 22:48), Dmitri Pal wrote: On 08/23/2014 10:32 PM, Kat wrote: I am working on the same thing - specifically I have found the libnl dependencies to be the biggest headache. If I get anywhere over the weekend, I will let you all know. do not forget about sssd, samba, certmonger,

Re: [Freeipa-users] users AD can not sudo in centos 6.5

2014-08-25 Thread Lukas Slebodnik
On (25/08/14 14:31), alireza baghery wrote: hi i integrated AD windows 208 R2 with IPA server (centos 6.5) i write a sudo policy and access for specified user and host with allow any command. user can execute sudo in centos 7 but when user loggin on centos 6.5 can not execute sudo and get error

Re: [Freeipa-users] sudo with freeIPA

2014-08-26 Thread Lukas Slebodnik
On (25/08/14 08:33), Megan . wrote: ok. Changed debug_level to 7. I already it in the domain section (first line). Not sure if this makes a difference [root@map1 pam.d]# cat system-auth #%PAM-1.0 # This file is auto-generated. # User changes will be destroyed the next time authconfig is

Re: [Freeipa-users] sudo with freeIPA

2014-08-26 Thread Lukas Slebodnik
On (25/08/14 14:54), William Graboyes wrote: Hi Megan, I had the same problem with CENTOS 6.5 and free-ipa. I did a ton of searching, and IIRC the conclusion was a bug in that version of sssd, I don't remember all of the details, however I do remember the work around. Create a system account

Re: [Freeipa-users] users AD can not sudo in centos 6.5

2014-08-26 Thread Lukas Slebodnik
On (26/08/14 16:50), alireza baghery wrote: sorry for delay file sssd.conf: == domain/example.com] debug_level = 6 cache_credentials = True krb5_store_password_if_offline = True ipa_domain = l.example.com id_provider = ipa auth_provider = ipa access_provider = ipa ipa_hostname =

Re: [Freeipa-users] How to use sudo rules on ubuntu

2014-08-29 Thread Lukas Slebodnik
On (28/08/14 14:15), Tevfik Ceydeliler wrote: Hi, I try to apply sudo policies on ubuntu client. Is there any examples how to apply it? Regards... You may be interested in this presentation. http://www.freeipa.org/images/7/77/Freeipa30_SSSD_SUDO_Integration.pdf LS -- Manage your subscription

Re: [Freeipa-users] How to use sudo rules on ubuntu

2014-08-29 Thread Lukas Slebodnik
On (29/08/14 17:37), Tevfik Ceydeliler wrote: Thnx for document. I know this. I think there is no problem abot configuration generally. Maybe some nish details. Problem is why dont work in my test env. Could you write more details about version of sssd, sudo? Which ubuntu release do you use?

Re: [Freeipa-users] How to use sudo rules on ubuntu

2014-09-01 Thread Lukas Slebodnik
On (01/09/14 09:59), Tevfik Ceydeliler wrote: Client side: sssd -- 1.11.5 sudo -- 1.8.9p5-1ubuntu1 (sudo-ldap package conflicts) Thats good. The package sudo-ldap is not compiled with sssd support. OS -- Ubuntu 14.04.1 LTS Do you have installed package libsss-sudo. Could you show us your

Re: [Freeipa-users] How to use sudo rules on ubuntu

2014-09-01 Thread Lukas Slebodnik
On (01/09/14 12:20), Alexander Bokovoy wrote: On Mon, 01 Sep 2014, Tevfik Ceydeliler wrote: libsss-sudo already installed. Here is my sssd.conf: [domain/ipa.grp] krb5_realm = IPA.GRP cache_credentials = True krb5_store_password_if_offline = True ipa_domain = ipa.grp id_provider = ipa

Re: [Freeipa-users] How to use sudo rules on ubuntu

2014-09-01 Thread Lukas Slebodnik
On (01/09/14 15:38), Tevfik Ceydeliler wrote: I correct that line. But still same: tevfik@Darktower ~ $ ssh user1@10.1.1.174 user1@10.1.1.174's password: Permission denied, please try again. user1@10.1.1.174's password: Welcome to Ubuntu 14.04.1 LTS (GNU/Linux 3.13.0-24-generic x86_64) *

Re: [Freeipa-users] How to use sudo rules on ubuntu

2014-09-01 Thread Lukas Slebodnik
On (01/09/14 15:48), Tevfik Ceydeliler wrote: Actually All I wanna do is , give permission to user to use some commanf. for example apt-get or something else. I Think I can do it with IPA right? Yes, but you need to use sudo. Step 1: configure sudo rules for ordinary user Please follow the

Re: [Freeipa-users] How to use sudo rules on ubuntu

2014-09-01 Thread Lukas Slebodnik
On (01/09/14 17:52), Tevfik Ceydeliler wrote: 1. I think I configure instead of this document Sorry you didn't. 2. I can login with ordinary user login and sudo are not the same think. My FreeIPA server is alredy properly configured with sudo rules. I tried to install freipa-client on ubuntu

Re: [Freeipa-users] How to use sudo rules on ubuntu

2014-09-02 Thread Lukas Slebodnik
On (02/09/14 11:02), Tevfik Ceydeliler wrote: Step 0 root@clnt:/home/awtadm# grep sudoers /etc/nsswitch.conf sudoers_debug:1 sudoers: files sss root@clnt:/home/awtadm# ipa-client-install --no-ntp IPA client is already configured on this system. root@clnt:/home/awtadm# grep services

Re: [Freeipa-users] How to use sudo rules on ubuntu

2014-09-08 Thread Lukas Slebodnik
On (08/09/14 11:24), Tevfik Ceydeliler wrote: Is there any article to describe how to configure ubuntu client for ipa and sudo policy? I have already described steps in this thread. It works for me. You did the same steps. It means there is problem on server side. LS -- Manage your

Re: [Freeipa-users] Sudo on Ubuntu Client works, on CentOS it doesn't

2014-10-13 Thread Lukas Slebodnik
On (13/10/14 01:16), Matt . wrote: OK, found it... I needed to comment out my other ldap lines, but I wonder why this is needed on CentOS and Ubuntu works without them. Which version of CentOS do you mean? LS -- Manage your subscription for the Freeipa-users mailing list:

Re: [Freeipa-users] No result when trying to integrate a FreeBSD client with the FreeIPA server

2014-10-13 Thread Lukas Slebodnik
On (13/10/14 20:33), Jakub Hrozek wrote: On Mon, Oct 13, 2014 at 10:10:12PM +0400, Орхан Касумов wrote: Good day to everybody. There`s a post on how to make a FreeBSD client work with a FreeIPA server: https://forums.freebsd.org/viewtopic.php?f=39t=46526p=260146#p260146   For some reason

Re: [Freeipa-users] No result when trying to integrate a FreeBSD client with the FreeIPA server

2014-10-14 Thread Lukas Slebodnik
On (14/10/14 10:23), Orkhan Gasimov wrote: Thanks to both of you for the interest. Here`s the info you asked: 1. Putting debug_level = 7 either in [domain] or/and [nss] section of the /usr/local/etc/sssd/sssd.conf file gives nothing in the log. The log file located at /var/log/sssd/sssd.log is

Re: [Freeipa-users] strange error from EL 7 install?

2014-10-14 Thread Lukas Slebodnik
On (14/10/14 16:03), Fraser Tweedale wrote: On Mon, Oct 13, 2014 at 10:08:55PM -0700, Janelle wrote: Actually, I did find a fix and forgot to post. I was able to mirror the COPR repo, and after reviewing it, found that simply removing the pki-base...fc21 directory, and regenning the repo data

Re: [Freeipa-users] No result when trying to integrate a FreeBSD client with the FreeIPA server

2014-10-16 Thread Lukas Slebodnik
On (16/10/14 13:04), Orkhan Gasimov wrote: OK, back to FreeIPA - FreeBSD setup. I changed my setup: instead of 2 VMs now I have 4 VMs: 1: DNS server - set up as shown by Rajnesh Kumar Siwal in http://www.youtube.com/watch?v=0SmiwFoHVeIindex=4list=PLdKXnZQzEG-KmtKq-LelPn5RTKfJig0Wc 2 and 3: IPA

Re: [Freeipa-users] No result when trying to integrate a FreeBSD client with the FreeIPA server

2014-10-17 Thread Lukas Slebodnik
On (17/10/14 12:27), Orkhan Gasimov wrote: Replying to myself is great... Anyway, maybe this info will be useful for people like me, trying to integrate FreeBSD with FreeIPA. Solved some problems: 1. SSH-ing as existing IPA user rsiwal to my FreeBSD client fails. The same user can SSH or locally

Re: [Freeipa-users] No result when trying to integrate a FreeBSD client with the FreeIPA server

2014-10-17 Thread Lukas Slebodnik
On (17/10/14 12:01), Alexander Bokovoy wrote: Didn`t find a solution yet. But I think this is caused by lack of proper configuration of Kerberos on my FreeBSD client. On my Linux client I found such a configuration in /etc/krb5.conf file. However, there's no such file on my FreeBSD client, as the

Re: [Freeipa-users] No result when trying to integrate a FreeBSD client with the FreeIPA server

2014-10-17 Thread Lukas Slebodnik
On (17/10/14 15:44), Orkhan Gasimov wrote: Unfortunately, putting that line in /etc/pam.d/system prevents me from being able to locally login to the BSD client. At the same time, the same line in /etc/pam.d/sshd or /etc/pam.d/login doesn't give unexpected behaviours. Bug, bug, bug... It works for

Re: [Freeipa-users] No result when trying to integrate a FreeBSD client with the FreeIPA server

2014-10-17 Thread Lukas Slebodnik
On (17/10/14 16:28), Orkhan Gasimov wrote: Of course! But for now I'm in process of checking my integration and there are some things I don't like. First and foremost, any change on the IPA server is not automatically reflected on the BSD client. sssd uses few levels of caches. If you want to have

Re: [Freeipa-users] No result when trying to integrate a FreeBSD client with the FreeIPA server

2014-10-20 Thread Lukas Slebodnik
On (19/10/14 08:45), Orkhan Gasimov wrote: 2. About my pam.d files - please read carefully my previous posts. I commented out the line in pam.d - system and added it explicitly to You didn't have account required /usr/local/lib/pam_sss.so ignore_unknown_user in pam.d/system. The line is

Re: [Freeipa-users] No result when trying to integrate a FreeBSD client with the FreeIPA server

2014-10-21 Thread Lukas Slebodnik
On (17/10/14 16:46), Orkhan Gasimov wrote: 1. I use FreeBSD 10.0 64-bit. (For some files bits are also important - for example, on a 32-bit machine the same configuration of /usr/local/etc/sssd/sssd.conf file introduces problems because of the line enumerate = True in the [domain] section; only

Re: [Freeipa-users] No result when trying to integrate a FreeBSD client with the FreeIPA server

2014-10-21 Thread Lukas Slebodnik
On (20/10/14 15:06), Orkhan Gasimov wrote: OK, Lukas, I did as you say: 1) reset my pam.d - login to its defaul state 2) added to my pam.d - system: account required /usr/local/lib/pam_sss.so ignore_unknown_user ignore_authinfo_unavail; 3) commented out enumerate = True in my

Re: [Freeipa-users] No result when trying to integrate a FreeBSD client with the FreeIPA server

2014-10-21 Thread Lukas Slebodnik
On (21/10/14 23:20), Орхан Касумов wrote: 1. Yes, being able to find simple typos is what distinguishes a good troubleshooter from a bad one. The problem really was between the chair and the keyboard. 2. Not only you were right in this aspect, but also regarding the idea that comments in

Re: [Freeipa-users] No result when trying to integrate a FreeBSD client with the FreeIPA server

2014-10-22 Thread Lukas Slebodnik
On (22/10/14 17:10), Fraser Tweedale wrote: Further to my earlier email, I have written a blog post about all these matters, with a particular focus on the custom package repo. I will update it tomorrow with a bit more about the package flavours topic. For now, all the details for enabling and

Re: [Freeipa-users] No result when trying to integrate a FreeBSD client with the FreeIPA server

2014-10-23 Thread Lukas Slebodnik
On (23/10/14 11:27), Outback Dingo wrote: On Thu, Oct 23, 2014 at 11:20 AM, Fraser Tweedale ftwee...@redhat.com wrote: On Wed, Oct 22, 2014 at 03:23:56PM +0200, Lukas Slebodnik wrote: On (22/10/14 17:10), Fraser Tweedale wrote: Further to my earlier email, I have written a blog post about

Re: [Freeipa-users] FreeIPA 3.3.3 and sssd segfault

2014-10-23 Thread Lukas Slebodnik
On (23/10/14 12:23), crony wrote: Hi, I have a FreeIPA 3.3.3 in transitive trust with AD2008. Today I saw a lot of sssd segfaults on the server side: [ 420.412011] sssd_be[734]: segfault at 8 ip 7fa54fa73334 sp 7fff62b2ec40 error 4 in libldb.so.1.1.16[7fa54fa66000+2c000] Could you

Re: [Freeipa-users] FreeIPA 3.3.3 and sssd segfault

2014-10-23 Thread Lukas Slebodnik
On (23/10/14 14:44), crony wrote: Already sent directly to your email. Thank you for coredump. It is a known bug (https://fedorahosted.org/sssd/ticket/2391) Bug is fixed in sssd upstream sh$ git tag --contains 895f045dd4aad7f5857826cc1496cfa048a790dd sssd-1_11_7 sh$ git tag --contains

Re: [Freeipa-users] FreeIPA 3.3.3 and sssd segfault

2014-10-23 Thread Lukas Slebodnik
On (23/10/14 16:31), crony wrote: yes, sure, it would be great to see if it works in upstream version. thank you Here you are https://copr.fedoraproject.org/coprs/lslebodn/sssd-1-11/ LS -- Manage your subscription for the Freeipa-users mailing list:

Re: [Freeipa-users] FreeIPA 3.3.3 and sssd segfault

2014-10-23 Thread Lukas Slebodnik
On (23/10/14 18:12), crony wrote: Thank you! I prepared repo for epel6, epel7 and fedora 19 Error: Package: sssd-client-1.11.7-2.el7.centos.x86_64 (lslebodn-sssd-1-11) Requires: libc.so.6(GLIBC_2.14)(64bit) Error: Package: python-sssdconfig-1.11.7-2.el7.centos.noarch

Re: [Freeipa-users] unable to sudo

2014-11-06 Thread Lukas Slebodnik
On (06/11/14 15:42), Craig White wrote: As Bob pointed out in a direct e-mail to me, there was the detail of adding sudo and sss to /etc/nsswitch.conf but – once I did so, it pointed out that the Rackspace RHEL packaging that doesn’t provide what I need – possibly need from epel. # yum search

Re: [Freeipa-users] Centos IPA Client fails after upgrade to 6.6

2014-11-06 Thread Lukas Slebodnik
On (06/11/14 21:00), Michael Lasevich wrote: I am seeing somewhat similar behavior once upgrading from sssd 1.9 to 1.11 (centos 6.5 to 6.6) I seem to be able to log in via ssh, but when I use http pam service, I get inconsistent behavior - seems like sometimes it works and others it errors out

Re: [Freeipa-users] Centos IPA Client fails after upgrade to 6.6

2014-11-08 Thread Lukas Slebodnik
On (08/11/14 12:24), Diaulas Castro wrote: We have similar issue but on RHEL 6.6 (sssd 1.11), the problem is about enumerating groups. Diaulas, Have you reported your problem? I know just about one problem with IPA and sssd-1.11 (on RHEL 6.6) The upstream bug is

Re: [Freeipa-users] Group membership not populated

2014-11-14 Thread Lukas Slebodnik
On (14/11/14 16:30), Darren Poulson wrote: Ok, I've shoved them on pastebin. They were a bit big to put in a mailing list really. ldap_child.log: http://pastebin.com/qGCZF4vK sssd_nss.log: http://pastebin.com/gTBA8NEj sssd_bur.us.genops.log: http://pastebin.com/ithUqb1z

Re: [Freeipa-users] Group membership not populated

2014-11-15 Thread Lukas Slebodnik
On (15/11/14 15:01), Darren Poulson wrote: Sorry, it seems I failed at cutting and pasting. sssd_bur.us.genops.log http://pastebin.com/7c5bH1Wq Thank you very much for log file. It is know bug: https://fedorahosted.org/sssd/ticket/2471 https://bugzilla.redhat.com/show_bug.cgi?id=1154042

Re: [Freeipa-users] Is it possible to set up SUDO with redudancy?

2014-11-25 Thread Lukas Slebodnik
On Mon, Nov 24, 2014 at 8:38 PM, William Muriithi william.murii...@gmail.com wrote: Evening, After looking at almost all the SUDO documentation I could find, it looks one has to hardcode FreeIPA hostname on sssd.conf file. Below is what red hat advice to add in sssd config file. services

Re: [Freeipa-users] Is it possible to set up SUDO with redudancy

2014-11-26 Thread Lukas Slebodnik
On (25/11/14 19:39), William Muriithi wrote: Implications of adding above is that SUDO would break if the hardcoded ipa is not available even if there is another replica somewhere in the network. Is that correct assumption? Is there a better way of doing it that I have missed? Which version

Re: [Freeipa-users] sudo utilizing sssd rhel6.6

2014-12-03 Thread Lukas Slebodnik
On (03/12/14 06:05), sipazzo wrote: Good morning, I have a fairly new ipa domain (server version 3.0.0-42 and clients mixed 3.0.0-37 and 3.0.0-42) set up with a mix of rhel6, rhel5 and solaris. It seemed like my sudo config using sssd in rhel6.5 was working and then we patched to 6.6 and it is

Re: [Freeipa-users] DNS configuration

2014-12-09 Thread Lukas Slebodnik
On (08/12/14 14:26), Dmitri Pal wrote: On 12/08/2014 02:10 PM, Matthew Herzog wrote: Here are some errors I'm seeing on the client. tail -f sssd_lnx.e-bozo.com.log (Mon Dec 8 14:03:20 2014) [sssd[be[lnx.e-bozo.com http://lnx.e-bozo.com]]] [sbus_dispatch] (0x4000): dbus conn: 0x1e72ad0 (Mon Dec

Re: [Freeipa-users] FreeIPA for Debian Wheezy, Ubuntu 12.04

2015-01-17 Thread Lukas Slebodnik
On (17/01/15 10:51), Sina Owolabi wrote: I think I've made a go of it! I was able to uninstall freeipa-client, and it complained about some leftover files, like so Removing freeipa-client ... dpkg: warning: while removing freeipa-client, directory '/var/lib/ipa-client/sysrestore' not empty so not

Re: [Freeipa-users] FreeIPA for Debian Wheezy, Ubuntu 12.04

2015-01-15 Thread Lukas Slebodnik
On (15/01/15 09:17), Petr Spacek wrote: On 15.1.2015 03:34, Sina Owolabi wrote: Hi List Please is it really possible to have Debian and Ubuntu serve as IPA clients? I've tried some instructions/guidelines on the list and they always fail with the IPA client install being halfway completed

Re: [Freeipa-users] Problems with ntpd when running FreeIPA in a Docker container

2015-01-15 Thread Lukas Slebodnik
On (15/01/15 09:01), Jan Pazdziora wrote: On Wed, Jan 14, 2015 at 08:18:02PM -0800, Nathan Kinder wrote: Hi, I'm running into a strange problem related to ntpd when trying to use IPA in a container. I'm using the adelton/freeipa-server:fedora-21 and adelton/freeipa-client:fedora-21 docker

Re: [Freeipa-users] FreeIPA for Debian Wheezy, Ubuntu 12.04

2015-01-15 Thread Lukas Slebodnik
On (15/01/15 10:54), Petr Spacek wrote: On 15.1.2015 09:36, Lukas Slebodnik wrote: Hi List Please is it really possible to have Debian and Ubuntu serve as IPA clients? I've tried some instructions/guidelines on the list and they always fail with the IPA client install being halfway

Re: [Freeipa-users] sudo !requiretty !authenticate

2015-01-06 Thread Lukas Slebodnik
On (06/01/15 10:21), Pavel Březina wrote: On 01/05/2015 07:32 PM, Craig White wrote: Hi - reply at bottom -Original Message- From: Martin Kosek [mailto:mko...@redhat.com] Sent: Monday, January 05, 2015 4:33 AM To: Craig White; freeipa-users@redhat.com; Pavel Brezina Subject: Re:

Re: [Freeipa-users] freeipa authentication token manipulation error

2015-01-12 Thread Lukas Slebodnik
On (12/01/15 14:12), Rakesh Rajasekharan wrote: The sssd version is 1.11.6 The password does not get changed, whatever password gets generated by ipa user-mod --random stays valid even after attempting the change. krb5_child.log does not have any contents. The logging in sssd is dibsabled by

Re: [Freeipa-users] freeipa authentication token manipulation error

2015-01-13 Thread Lukas Slebodnik
On (13/01/15 12:48), Rakesh Rajasekharan wrote: This is how I get the logs in krb5_child. when a user tries to authenticate with the random password that I generated, WARNING: Your password has expired. You must change your password now and login again! Changing password for user hq-testuser.

Re: [Freeipa-users] Ubuntu sssd client -- FreeIPA Server fed from AD

2015-03-30 Thread Lukas Slebodnik
On (30/03/15 05:36), g.fer.or...@unicyber.co.uk wrote: Hey Guys Not sure if I am missing any bit but this was the thing in the end: http://generations.menteyarte.org/archives/195-freeipa-server-and-SSSD-on-Ubuntu.html I managed to have it working and I have documented all those nasty bits

[Freeipa-users] [RFC] COPR drop support for old distribution

2015-04-01 Thread Lukas Slebodnik
ehlo, CentOS 7.1 was finally released[1]. Yupi. Fedora 21 was rewleased[2] few months ago. People can use FreeIPA 4.1 without any problem. So there's no more reason to maintain COPR repositories for older distributions. It will significantly reduce extra dependencies in repositories. It would

Re: [Freeipa-users] config sudo with ipa

2015-03-27 Thread Lukas Slebodnik
On (27/03/15 14:56), Benoit Rousselle wrote: hi, I setup a sudo config in client ipa and set rule in ipa server. sudo rules from ipa are not found : it return 0 rules for the user This config is ambiguous. Is there a method to check if everything is OK ? The best way for this moment is to set

Re: [Freeipa-users] RHEL 5 client?

2015-04-03 Thread Lukas Slebodnik
On (03/04/15 17:13), Guertin, David S. wrote: I don't see any request going to sssd. Can you try with ju...@middlebury.edu? Old SSSD is incapable to see MIDD\juser being the same as ju...@middlebury.edu. When I try: ssh -l 'ju...@middlebury.edu' yakko.ipa.middlebury.edu There is no response

Re: [Freeipa-users] Stuck getting sudo working with Ubuntu client

2015-04-21 Thread Lukas Slebodnik
On (20/04/15 17:54), Andrew Sacamano wrote: Thanks again, Lukas! I was wondering if the overlaps of names was a problem, so I redid parts of my IPA setup to rename them - thanks for pointing out the ticket! Also, your suggestion to use ldap_group_object_class = ipaUserGroup worked - which saves

Re: [Freeipa-users] Stuck getting sudo working with Ubuntu client

2015-04-20 Thread Lukas Slebodnik
On (19/04/15 12:51), Andrew Sacamano wrote: Thanks again Lukas, These turned out to be very helpful debugging suggestions, and were the critical part of getting the problem solved - the pointer to ldb-tools was extremely helpful in identifying where the issue was happening! With them, I was able

Re: [Freeipa-users] RHEL5 clients not getting ssh key

2015-04-30 Thread Lukas Slebodnik
On (30/04/15 15:34), Jakub Hrozek wrote: On Thu, Apr 30, 2015 at 03:13:44PM +0200, Martin Kosek wrote: On 04/30/2015 02:56 PM, Aric Wilisch wrote: Is there a trick to getting a users SSH key that’s attached to their FreeIPA account to work on RHEL 5 servers? users can ssh into the RHEL 6

Re: [Freeipa-users] HBAC rules don't work with PAM - problem

2015-05-11 Thread Lukas Slebodnik
On (11/05/15 14:57), Vangass wrote: Hi, I try to access Cisco switch via ssh. Cisco has tacacs login configured. # tail /var/log/secure May 11 14:18:46 freeipa tac_plus[29096]: pam_sss(tac_plus:auth): authentication success; logname=bartosz uid=0 euid=0 tty= ruser= rhost= user=bartosz May 11

Re: [Freeipa-users] trusted user groups

2015-05-14 Thread Lukas Slebodnik
On (14/05/15 15:53), Andy Thompson wrote: -Original Message- From: freeipa-users-boun...@redhat.com [mailto:freeipa-users- boun...@redhat.com] On Behalf Of Jakub Hrozek Sent: Thursday, May 14, 2015 11:46 AM To: freeipa-users@redhat.com Subject: Re: [Freeipa-users] trusted user groups

Re: [Freeipa-users] username case sensitivity

2015-05-15 Thread Lukas Slebodnik
On (15/05/15 17:27), Andy Thompson wrote: Is there a way to enforce case sensitivity for trusted AD users? I am trying to use username for ssh chroots and I can authenticated with any case combination of UsERname but if ssh is set to match on username then the chroot is not enforced and the

Re: [Freeipa-users] trusted user groups

2015-05-18 Thread Lukas Slebodnik
On (18/05/15 13:55), Andy Thompson wrote: -Original Message- From: Lukas Slebodnik [mailto:lsleb...@redhat.com] Sent: Thursday, May 14, 2015 4:41 PM To: Andy Thompson Cc: freeipa-users@redhat.com Subject: Re: [Freeipa-users] trusted user groups On (14/05/15 15:53), Andy Thompson

Re: [Freeipa-users] Slow user logon with IPA

2015-04-15 Thread Lukas Slebodnik
On (15/04/15 08:53), Jakub Hrozek wrote: On Tue, Apr 14, 2015 at 05:36:16PM +0200, Mateusz Malek wrote: On Fri, Apr 10, 2015 at 08:48 PM, Jakub Hrozek wrote: On Fri, Apr 10, 2015 at 12:39:20PM -0400, Dmitri Pal wrote: On 04/10/2015 08:13 AM, Mateusz Malek wrote: I'm about to migrate my

Re: [Freeipa-users] Freeipa4 - AD SSH logins

2015-04-15 Thread Lukas Slebodnik
On (15/04/15 13:43), Aric Wilisch wrote: Today I managed to finally get a trust established between my AD Domain and my FreeIPA 4 environment. However I’m noticing a couple issues and hope someone might be able to give me some help. First when the user logs in it creates their home directory

Re: [Freeipa-users] Stuck getting sudo working with Ubuntu client

2015-04-17 Thread Lukas Slebodnik
On (17/04/15 11:32), Andrew Sacamano wrote: Hi everyone, I've spent a couple of days digging around the web, watching logs, and poking things, and I'm stuck getting sudo working with IPA on a new box I've just set up. I have had it working in the past on a test box, but something about this box

Re: [Freeipa-users] FreeIPA sudo configuration on FreeIPA, version: 4.1.0

2015-04-07 Thread Lukas Slebodnik
On (07/04/15 12:57), Jakub Hrozek wrote: On Tue, Apr 07, 2015 at 12:48:37PM +0200, Chamambo Martin wrote: Sorry for the confusion about that one ,that client I used to aunthenticate to a pure 389 directory server and I have since changed it to free ipa and below is the correct configuration.

Re: [Freeipa-users] FreeIPA, version: 4.1.0 and sudo configuration

2015-04-08 Thread Lukas Slebodnik
On (08/04/15 09:25), Chamambo Martin wrote: Good day I am running FreeIPA, version: 4.1.0 and everything is working well except SUDO configuration. ipa-client-install on CentOS 7.1 should configure sudo by default. I have 3 questions 1: I have configured the bare minimum sudo

Re: [Freeipa-users] Configuring SUDO on centos and RHEL 5 clients

2015-04-09 Thread Lukas Slebodnik
On (09/04/15 01:04), Martin Chamambo wrote: I managed to install my ipa client on centos 5 using this command below ipa-client-install --server cyclops.ai.co.zw --domain ai.co.zw Pease follow instruction for rhel 5

Re: [Freeipa-users] ns-slapd started crashing suddenly

2015-06-05 Thread Lukas Slebodnik
On (05/06/15 07:35), Rich Megginson wrote: On 06/05/2015 03:40 AM, Dawid Rabiega wrote: Hi, One of my ipa server on fedora 19 since yesterday started to crash, with following message to dmesg: $ dmesg | tail -n 20 [6706148.291648] ns-slapd[3212]: segfault at 0 ip 7f6fc9a84421 sp

Re: [Freeipa-users] sssd not caching public keys in sss_authorized_keys file

2015-06-03 Thread Lukas Slebodnik
On (02/06/15 15:25), nat...@nathanpeters.com wrote: I am running FreeIPA 4.1.3 on CentOS 7 for the server and on the client is CentOS 6.5 with client 3.0.0-42 (sssd 1.11.6-30). I have created a user in FreeIPA and he has access to a server through HBAC rules. This user has created a public /

Re: [Freeipa-users] How to handle users with multiple homedirs on different machines?

2015-06-03 Thread Lukas Slebodnik
On (02/06/15 17:07), swartz wrote: I have a environment that spans across multiple physical locations where there is a mix of Linux and Solaris workstations/servers. So far we've been managing accounts (/etc/password) via Puppet. Problem: FreeIPA allows to store only one homedir path. Q: Is there

Re: [Freeipa-users] How to handle users with multiple homedirs on different machines?

2015-06-03 Thread Lukas Slebodnik
On (03/06/15 12:54), Coy Hile wrote: For solaris, just use the standard automounter config in auto_home: *  /export/home/ I thought that automount and getent passwd user are two different thigs on Solaris (the same as on Linux) LS -- Manage your subscription for the Freeipa-users mailing

Re: [Freeipa-users] ssh known hosts gets recreated on client

2015-06-10 Thread Lukas Slebodnik
On (10/06/15 11:33), Bob Hinton wrote: Hello, If I uninstall the ipa client with ipa-client-install --uninstall then reinstall it to the same ipa master then most functions work fine. However, if I attempt to ssh from the client to the master then I get.

Re: [Freeipa-users] sssd not caching public keys in sss_authorized_keys file

2015-06-04 Thread Lukas Slebodnik
On (03/06/15 11:48), nat...@nathanpeters.com wrote: On Wed, 2015-06-03 at 09:57 -0700, nat...@nathanpeters.com wrote: Comments inline On (02/06/15 15:25), nat...@nathanpeters.com wrote: I am running FreeIPA 4.1.3 on CentOS 7 for the server and on the client is CentOS 6.5 with client

Re: [Freeipa-users] hesitate to deploy freeipa

2015-06-26 Thread Lukas Slebodnik
On (26/06/15 12:48), Petr Spacek wrote: On 26.6.2015 12:18, Lukas Slebodnik wrote: On (26/06/15 01:29), Prasun Gera wrote: I've found that if you are setting up a new environment from scratch which is mostly going to involve RHEL/Fedora systems, and that you have full control over your network

Re: [Freeipa-users] newer sssd on centos 5?

2015-06-12 Thread Lukas Slebodnik
On (11/06/15 18:21), Janelle wrote: Has anyone built a newer version of sssd for RHEL/centos 5.x?? Currently only 1.5.x There is also 1.9 in COPR repo[1] Just wondering if maybe it is limited due to some library or compatibility issues? It's possible to build sssd-1.11 on el5 as well but without

Re: [Freeipa-users] 4.x on CentOS 6?

2015-06-15 Thread Lukas Slebodnik
On (13/06/15 16:04), Janelle wrote: Hi everyone, Does anyone know if it is possible to install the 4.1 ipa-CLIENT (not the server - just the client) on a CentOS 6.6 system? My guess is this is really just based on sssd, or am I missing something? If you want newer version of sssd you can test

  1   2   3   >