Stepping down from working group
by David Timothy Strauss
Hi folks,
The Server Working Group focuses on technologies that aren't terribly
applicable to my work (which involves managing hundreds of machines,
orchestration of millions of containers, and dense utilization of
NUMA-scale machines). Because of this, I haven't had much reason to
contribute in a while -- or even to form opinions on most issues. I'm
going to step down and let someone else take my seat.
Now that the working group has an established focus, I hope such
misalignment won't be as much a problem in the future. I wish you
folks the best for the upcoming Fedora 21 release; I know there will
be exciting tools this group has cultivated for the server product.
David
9 years, 4 months
Draft Test Cases for Fedora Server Final Criteria
by Stephen Gallagher
So, at today's Server WG meeting, I was asked to come up with a
high-level draft of some additional requirements to validate for Final
criteria. Most of these probably should be Beta criteria in F22, but we
didn't have them as such this time around. I'll differentiate them as
such below. It should be understood that Final validation is a superset
of Beta validation, so anything we add in that category applies to both.
== Beta Criteria ==
=== Domain Controller ===
* The Domain Controller must be capable of serving LDAP requests on port
389. This should be validated by the use of the ldapsearch tool.
* The Domain Controller must be capable of serving TLS-encrypted LDAP
requests on port 389. This should be validated by the use of the
ldapsearch tool.
* The Domain Controller must be capable of serving LDAPS (LDAP encrypted
with SSL) over port 636. This should be validated by the use of the
ldapsearch tool.
* The Domain Controller must be capable of returning LDAP and LDAPS
search results using simple auth (the -x option to ldapsearch) or
SASL/GSSAPI auth (the -Y GSSAPI option). This should be validated by the
use of the ldapsearch tool.
* The Domain Controller must be capable of serving DNS host records on
port 53. This should be validated by the use of the 'dig' tool.
=== FreeIPA Domain Client ===
* Enrolled clients must be capable of authenticating against a valid
user account using SSSD.
* Enrolled clients must honor FreeIPA HBAC rules for access-control.
* Enrolled clients must be able to change their passwords according to
the password policy specified by the FreeIPA server
* Users must be capable of performing password-less single-sign-on
between two enrolled clients using GSSAPI.
== Final Criteria ==
=== Domain Controller ===
* The Domain Controller must be capable of serving DNS SRV records for
ldap and kerberos on port 53. This is used for auto-discovery.
=== FreeIPA Domain Client ===
* When configured to use the Domain Controller for DNS services, the
domain client must be able to use DNS to discover the Domain Controller
address using SRV records.
* When configured to use FreeIPA for host-key validation, initial SSH
between domain clients should not prompt the user to accept the SSH
public key.
9 years, 5 months
How to test 389 Directory Server and openldap using TLS 1.1+
by Mark Reynolds
How to test the new openldap with TLS1.1+ and 389 Directory Server
Get the new 389 Directory Server scratch builds:
F22 - http://koji.fedoraproject.org/koji/taskinfo?taskID=8194738
F21 - http://koji.fedoraproject.org/koji/taskinfo?taskID=8194917
[1] Install DS using setup-ds.pl. Then setup SSL on the Directory Server.
I use this script to setup SSL:
https://github.com/richm/scripts/blob/master/setupssl2.sh
./setupSSL2.sh /etc/dirsrv/slapd-INSTANCE 389 636
slapd-INSTANCE is an example, it is usually slapd-<hostname>. This can
also depend on what you specify during the server install. The script
also expects the Directory Manager DN to be "cn=directory manager".
[2] Next configure DS to set the minimum SSL version it will accept:
ldapmodify -h host -p port -D "cn=directory manager" -w password
cn: cn=encryption,cn=config
changetype: modify
replace: nsSSL3
nsSSL3: off
-
replace: nsTLS
nsTLS: on
-
replace: sslVersionMin
sslVersionMin: TLS1.1
[3] Restart the Directory Server: restart-dirsrv
[4] Perform an ldapsearch using SSL
LDAPTLS_CACERTDIR=/etc/dirsrv/slapd-INSTANCE ldapsearch -xLLL -H
"<host>:<secure port>" -b "" -s base objectclass=*
example:
LDAPTLS_CACERTDIR=/etc/dirsrv/slapd-localhost ldapsearch -xLLL -H
"localhost.localdomain:636" -b "" -s base objectclass=*
Let me know if there are any questions.
Thanks,
Mark
9 years, 5 months
Gnome Desktop?
by Dean Hunter
How do I install the Gnome desktop on Fedora Server?
9 years, 5 months
Server Working Group Weekly Meeting Minutes (2014-11-18)
by Stephen Gallagher
===================================================================
#fedora-meeting-1: Server Working Group Weekly Meeting (2014-11-18)
===================================================================
Meeting started by sgallagh at 16:03:13 UTC. The full logs are available
at
http://meetbot.fedoraproject.org/fedora-meeting-1/2014-11-18/fedora-meeti...
.
Meeting summary
---------------
* roll call (sgallagh, 16:03:19)
* Agenda (sgallagh, 16:05:44)
* Agenda Item: Approval of the Final Criteria (sgallagh, 16:06:11)
* Agenda Item: Status check as we enter Final Freeze (sgallagh,
16:06:17)
* Agenda Item: Fedora 22 Planning - GUI (sgallagh, 16:06:26)
* Agenda Item: Fedora 22 Planning - Roles (sgallagh, 16:06:30)
* Approval of the Final Criteria (sgallagh, 16:08:26)
* LINK:
https://lists.fedoraproject.org/pipermail/server/2014-November/001551.html
(sgallagh, 16:08:49)
* Adjusted text: "* Enrolled clients must be capable of authenticating
against a valid user account using SSSD's 'ipa' provider."
(sgallagh, 16:15:20)
* AGREED: Draft Criteria approved and will be submitted to QA for
inclusion. (+5, 0, -0) (sgallagh, 16:19:30)
* Status check as we enter Final Freeze (sgallagh, 16:19:39)
* simo notes that there are several potential blocker issues in
FreeIPA. (sgallagh, 16:33:11)
* ACTION: simo to propose blockers and freeze exceptions for FreeIPA
issues (sgallagh, 16:33:26)
* Cockpit needs a branding update. We will propose it as a Freeze
Exception and not a blocker. (sgallagh, 16:33:53)
* rolekit is good to go for F21 Final (sgallagh, 16:37:53)
* Branding issues for all of the products are still being sorted, but
should be in their final phases now. (sgallagh, 16:38:25)
* Fedora Server brochure page looking good; remaining piece is in the
Websites team's hands. (sgallagh, 16:39:50)
* LINK:
https://git.fedorahosted.org/cgit/fedora-web.git/tree/getfedora.org/data/...
(nirik, 16:41:30)
* Fedora 22 Planning - GUI (sgallagh, 16:43:16)
* Fedora 22 Planning - Roles (sgallagh, 16:57:25)
* Deferred until next week (sgallagh, 16:57:30)
* Open Floor (sgallagh, 16:57:36)
Meeting ended at 16:59:04 UTC.
Action Items
------------
* simo to propose blockers and freeze exceptions for FreeIPA issues
Action Items, by person
-----------------------
* simo
* simo to propose blockers and freeze exceptions for FreeIPA issues
* **UNASSIGNED**
* (none)
People Present (lines said)
---------------------------
* sgallagh (91)
* simo (38)
* stefw (32)
* nirik (30)
* danofsatx-work (24)
* junland (17)
* mitr (15)
* zodbot (3)
* adamw (0)
* tuanta (0)
* davidstrauss (0)
* mizmo (0)
Generated by `MeetBot`_ 0.1.4
.. _`MeetBot`: http://wiki.debian.org/MeetBot
9 years, 5 months
