[Freeipa-users] install with external CA failed

2014-03-05 Thread Robert Story
Hi, I'm trying to install on CentOS 6.5 (ipa-server-3.0.0-37.el6.x86_64) and an external CA. I'm getting this error: Command '/usr/bin/sslget -v -n ipa-ca-agent -p -d /tmp/tmp-jNYt3P -r /ca/agent/ca/profileReview?requestId=6 auth.lan:9443' returned non-zero exit status 4 I found a

Re: [Freeipa-users] install with external CA failed

2014-03-10 Thread Robert Story
On Mon, 10 Mar 2014 15:44:01 +0100 Jan wrote: JC On 6.3.2014 05:42, Robert Story wrote: JC I'm trying to install on CentOS 6.5 (ipa-server-3.0.0-37.el6.x86_64) JC and an external CA. I'm getting this error: JC [snip] JC Can you please run certutil -V on the issuer certificate JC (CN=Certificate

Re: [Freeipa-users] install with external CA failed

2014-03-11 Thread Robert Story
On Mon, 10 Mar 2014 16:07:54 -0400 Simo wrote: SS Unfortunately I've already scrapped that install and just went with SS the internal self-signed CA. So far, the only annoyance is that the SS webserver also presents a self-signed cert for the UI. Is it safe to SS replace just the web cert

Re: [Freeipa-users] Mountain Lion GUI Login (Expired passwords / Mavericks too)

2014-03-13 Thread Robert Story
On Thu, 13 Mar 2014 14:08:29 + Jason wrote: JW Now if I create a new user in IPA. It will require a password change on JW logon. JW JW When I logon on the Mac with this new user. The password box wiggles JW and a box appears underneath it. Reset your password. Saying I need JW to set a new

[Freeipa-users] Another CentOS 6.x to CentOS 7.1 migration question

2015-09-21 Thread Robert Story
I've followed the migration document https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Linux_Domain_Identity_Authentication_and_Policy_Guide/migrating-ipa-proc.html almost to the end. I'm at step 10, which stops everything on the old . My concern is all the installed

[Freeipa-users] disaster recovery

2016-06-26 Thread Robert Story
Hello, I was running a single ipa instance on Centos 7 for a small lab (ipa-server-4.2.0-15.0.1.el7.centos.17.x86_64), and the disk was corrupted. I have a (mostly) full backup (/var/log/ and /var/run/ excluded), which I restored. ipa server didn't start, and wanted me to run ipa-server-upgrade.

Re: [Freeipa-users] IPA vulnerability management SSL

2016-04-30 Thread Robert Story
On Fri, 29 Apr 2016 08:56:57 -0700 Sean wrote: SH> Hi Rob, SH> SH> I stopped IPA, modified dse.ldif, restarted with the cipher list and it SH> started without issue Just thought I'd point out the other recent thread, "freeipa update changed my cipher set", which mentions that dse.ldif can get

Re: [Freeipa-users] slow login with freeipa 4.2.0

2016-07-25 Thread Robert Story
On Mon, 25 Jul 2016 21:23:19 +0530 Rakesh wrote: RR> Hi, RR> RR> I am facing slow login issue with IPA 4.2.0 version. The login takes around RR> 18-19s Any change that it's running on a VM? If so, check your entropy: cat /proc/sys/kernel/random/entropy_avail If it's low (like < 1k), install

Re: [Freeipa-users] disaster recovery

2016-06-27 Thread Robert Story
On Mon, 27 Jun 2016 08:09:59 +0200 Martin wrote: MB> On 26.06.2016 08:17, Robert Story wrote: MB> > Hello, MB> > MB> > I was running a single ipa instance on Centos 7 for a small lab MB> > (ipa-server-4.2.0-15.0.1.el7.centos.17.x86_64), and the disk was corrupted. M

Re: [Freeipa-users] disaster recovery

2016-06-28 Thread Robert Story
On Mon, 27 Jun 2016 08:59:14 -0400 Robert wrote: RS> On Mon, 27 Jun 2016 08:09:59 +0200 Martin wrote: RS> MB> On 26.06.2016 08:17, Robert Story wrote: RS> MB> > Hello, RS> MB> > RS> MB> > I was running a single ipa instance on Centos 7 for a small lab RS

Re: [Freeipa-users] Getting error "Permission denied (publickey, gssapi-with-mic, password)" when running below ssh command

2017-01-09 Thread Robert Story
On Mon, 9 Jan 2017 10:55:05 +0100 Sumit wrote: SB> There are older reports that a similar audit message was triggered by SB> wrong SELinux labels on $HOME/.ssh and the files within. Although none SB> of the typical files in this directory are needed by GSSAPI SB> authentication it might worth to

[Freeipa-users] backing up and starting over...

2016-12-21 Thread Robert Story
I'm running a small instance of freeipa on CentOS 7 in our lab, for about 20 machines. Since CentOS 7.3 came out and upgraded from 4.2 to 4.4, things have gotten flaky. e.g. clicking on a user get the spinning 'Working' dialog and can take 3-5 minutes to load the page. But often it will die with

Re: [Freeipa-users] backing up and starting over...

2016-12-22 Thread Robert Story
On Thu, 22 Dec 2016 16:48:10 -0500 Robert wrote: RS> I tried to create a replica. It went well for the directory server, but RS> then: RS> RS> Configuring certificate server (pki-tomcatd). Estimated time: 3 minutes 30 RS> seconds [1/27]: creating certificate server user RS> [2/27]: configuring

Re: [Freeipa-users] backing up and starting over...

2016-12-22 Thread Robert Story
On Thu, 22 Dec 2016 09:25:52 +0100 Florence wrote: FBR> you can find more information about backup and restore procedure in this FBR> guide [1]. But, as stated in the documentation, the safest method would FBR> rather be to install a replica [2]. FBR> [...] FBR> [2] FBR>

Re: [Freeipa-users] backing up and starting over...

2016-12-22 Thread Robert Story
On Thu, 22 Dec 2016 13:02:18 +0100 Martin wrote: MB> On 22.12.2016 09:25, Florence Blanc-Renaud wrote: MB> > On 12/21/2016 10:26 PM, Robert Story wrote: MB> >> I'm running a small instance of freeipa on CentOS 7 in our lab, for MB> >> about 20 MB> >>

[Freeipa-users] replication mess

2017-03-23 Thread Robert Story
Hello, we have 2 auth servers with a replication agreement. Turns out that auth-2 had network issues that went unnoticed from some time after a reboot. This wasn't discovered until after a yum update on auth-1 this morning. Now my logfile is filling up with this message: