10:41 a.m.
Hi,
So I do have an user on my laptop with same username as IPA user. I've noticed that
after installing client, this existing user is still being authenticated by it's
original password and is with its original UID.
What is the best procedure in such cases? Should I remove existing users and just keep
root before installation ? is there a way to sync existing users towards ipa users?
Cheers!
11:56 a.m.
New subject: how to deal with an existing user before client installation
On su, 24 helmi 2019, Albert Szostkiewicz via FreeIPA-users wrote:
Hi,
So I do have an user on my laptop with same username as IPA user. I've
noticed that after installing client, this existing user is still being
authenticated by it's original password and is with its original UID.
What is the best procedure in such cases? Should I remove existing
users and just keep root before installation ? is there a way to sync
existing users towards ipa users?
It all depends on the order of PAM modules.
Typically, pam_unix is the
first and if it finds a user in /etc/passwd, it is used for
authentication.
You probably want to remove that entry from /etc/passwd if you already
have the user migrated to IPA.
A 'sync' is a variation of a process described in
https://www.redhat.com/archives/freeipa-users/2010-September/msg00105.html and
https://www.freeipa.org/page/NIS_accounts_migration_preserving_Passwords
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland
12:56 p.m.
New subject: how to deal with an existing user before client installation
Albert Szostkiewicz via FreeIPA-users
<freeipa-users(a)lists.fedorahosted.org> writes:
So I do have an user on my laptop with same username as IPA user.
I've
noticed that after installing client, this existing user is still
being authenticated by it's original password and is with its original
UID.
What is the best procedure in such cases?
I've renamed the local user to "l<username>" and kept it as a
fallback/emergency user. My user in IPA is just "<username>" and I
normally log in with the IPA user. The users have different UIDs and
both users have sudo rights, so I can fix whatever is broken when
something isn't working.
It's somewhat unconvenient to rename the local user, but I'm quite happy
to have a fallback. After moving to IPA I've started adding that user
when installing a new system as the first user.
Jochen
--
This space is intentionally left blank.
1885
days inactive
1885
days old
freeipa-users@lists.fedorahosted.org
2 comments
3 participants
participants (3)
-
Albert Szostkiewicz -
Alexander Bokovoy -
Jochen Hein