Nfs Shares to Map Automatically
by Alper AYKUT
Hello, I have a total of 6 servers. Each user logs in to all servers
separately and does their operations in their home directories. All Servers
are Free IPA Registered. User Management Center. However, in the new
structure, I plan a scenario like this. Users will only log in to the
Master Server with their usernames. Under the /home/user directory of the
Master server, the home directories of the 6 servers that it used to
connect to will be shared with nfs. How can I mount the home directories of
6 servers shared with nfs to the Master Server. It can be with autofs or
automount. The easiest way seemed to be Autofs, but when I run autofs,
unfortunately the user authorization under the home directory on the Master
Server is root. When I close autofs, it reverts back to user:user
privileges. However, uid and gid are the same on all servers. Can you help
me to solve this problem?
Login Server: Master - 6 Home directories of the server I want to have a
user-based map to the home directories that the user is authorized on the
master server.
Server1: Nfs sharing
Server2: Nfs sharing
Server3: Nfs sharing
Server4: Nfs sharing
Server5: Nfs sharing
Server6: Nfs sharing
6 hours, 54 minutes
Re: ipa upgrade failed
by Johannes Falke
How did you actually manage to resolve this issue? I'm seeing the same
thing trying to upgrade either f35->f37 or f35->f36 (and NO ldap errors).
On f35, freeipa says it's healthy.
1 day, 15 hours
Override Sudo Rule for one host
by Russ Long
I'm setting up a new FreeIPA cluster/environment, and have one host that I do not want included in my sudo rule that normally allows sudo to all hosts.
Basically this machine is holding highly sensitive data, and will be used by multiple people who normally have sudo to all hosts, but I do not want them to have sudo on this host.
I do not see a way to exclude a host, is the only option to add every other host manually to a rule or is there a way to "blacklist" a certain host in a sudo rule.
--Russ
1 day, 22 hours
SMB share with IPA ID Views user and group mapping
by Yossi Hayat
Hi,
To centrally manage all credentials from Active Directory, we configured FreeIPA integration with Active Directory to authenticate users to IPA-joined Linux machines via SSSD using AD credentials.
The Linux machines have NFS shares mounted on their local filesystems which we use to work in a sharable way.
We have configured FreeIPA "ID Views" for each user to override the AD-originating generic UID and GID with shorter UID and GID values. This is to preserve IPA-authenticated users' NFS permissions that were inherited from the previous Linux directory management system (NIS) we used and for simplicity.
When working locally or remotely (SSH/VNC) on the Linux machines, everything is working as expected with no issues.
Our problem is with SMB - We need to share the NFS shares over SMB for direct File Explorer access for Windows users. For this purpose, we have an Ubuntu machine we use as an SMB server.
The server is joined to IPA as a client and has all NFS shares mounted locally on its filesystem.
The ideal way is to somehow configure SMB to forward authentication to IPA (as it was a local/SSH authentication to the server) and map the ID views user and group IDs to preserve permissions.
We searched all over the internet and didn't find a working solution for this use case.
Is this supported? If yes, how can this be implemented?
2 days
replica in DMZ with trust-agent
by slek kus
Hi I deployed a third replica in a dmz network for clients that do not route to the main ipa masters. Not sure if this is a workable setup.
I can join clients using --fixed-primary and can logon with AD (one-way trust). This third replica has the trust-agent role.
I might be approaching this incorrectly. Posting here for advise, has anyone attepted this and how to approach?
It seems to be working, except the sudo rules.
I have posted a diagram here: https://ibb.co/WkQj9yD
2 days, 3 hours
Prevent domain-local groups from being mapped at all
by Ronald Wimmer
Is there a way for preventing AD domain-local groups from being mapped
into IPA? From time to time colleagues try to use AD groups with scope
'domain local'. Personally, I do not see a use case for these groups
mapped into IPA...
Cheers,
Ronald
2 days, 4 hours
Ranger FreeIPA Integration
by Mike Patterson
Anyone have success with integrating FreeIPA with Ranger?
I have them sync-ed and it generally works, but I'm confused by the lack of attributes being shared by FreeIPA concerning Users.
I'm unclear if FreeIPA isnt sharing attributes (beyond the most basic) via the LDAP protocol or if Ranger is not setup to read/display/use them or both.
Any suggestions are greatly appreciated.
Mike
6 days, 1 hour
Ranger FreeIPA Integration
by Mike Patterson
Anyone have success with integrating FreeIPA with Ranger?
I have them sync-ed and it generally works, but I'm confused by the lack of attributes being shared by FreeIPA concerning Users.
I'm unclear if FreeIPA isnt sharing attributes (beyond the most basic) via the LDAP protocol or if Ranger is not setup to read/display/use them or both.
Any suggestions are greatly appreciated.
Mike
6 days, 22 hours
Ranger FreeIPA Integration
by Mike Patterson
Anyone have success with integrating FreeIPA with Ranger?
I have them sync-ed and it generally works, but I'm confused by the lack of attributes being shared by FreeIPA concerning Users.
I'm unclear if FreeIPA isnt sharing attributes (beyond the most basic) via the LDAP protocol or if Ranger is not setup to read/display/use them or both.
Any suggestions are greatly appreciated.
Mike
6 days, 22 hours
