Updating a certificate for a FreeIPA web server

As I install, uninstall, and re-install FreeIPA, I start getting:sec_error_reused_issuer_and_serial. This used to be a minor annoyance, solved by clearing the certificates out of, and restarting, the browser.  Recent versions of Firefox have complained even after doing this, leading to the current approach: clear your browser cache.  Instead, you can update the certificate on the web server, and this should give you a cert with a new serial number, and avoid the error message.

Continue reading

Announcing FreeIPA 2.1.0

Cross posted from the FreeIPA mailing lists:

The FreeIPA Project is proud to announce the latest release of the FreeIPA. As always, the latest tarball can be found at http://freeipa.org/

FreeIPA 2.1 is available in Fedora 15. It is currently in the updates-testing repository along with a number of its dependencies. Fedora 16 and rawhide builds will be coming soon.

== Highlights ==

* General client and server installation improvements. Server installation is significantly faster.
* Improved support for IPv6.
* General UI improvements related to navigation and work flow.
* Added UI for automount.
* A Host-based Access Control (HBAC) test tool
* Deprecation of HBAC deny rules
* A CA is no longer required on every replica and may be added post-install to a replica (see ipa-ca-install).
* A new replication tool for dogtag has been added (ipa-cs-manage). This allows you to control the replication topology of your CA.

 

Continue reading

Automount and home directory creation

NFS is the NAS equivalent of Democracy: the worst implementation except for all the others. If you want a remote home directory for your users, chances are you’ve contemplated Automount as the solution for it.  I’ve been working on Automount support for the web UI in FreeIPA.  Here’s the concept.  When you add a user, you want to delay creation of the users home directory on some subset of Network Devices.  This is a tricky problem to solve.  Here’s why.
Continue reading

Summit IPA FAQ

Here are the most frequently asked (technical) questions by people about Red Hat Enterprise Identity (IPA) from this past week at the Red Hat summit.

Question:  What is it?

Answer:  IPA is a domain controller for Linux/Unix environments. For the Linux/Unix world it does what Active Directory  does in the Windows world, but following open standards and by the means of open source software.  It is an identity management solution that integrates MIT Kerberos, LDAP via Red Hat Directory Server, DNS via Bind with an LDAP back end, and a Certificate Signing Authority (Dog Tag).  Its administration framework is a Python based server that runs inside Apache HTTPD.

Continue reading

FreeIPA 2.0 RC3

Reposted from the FreeIPA devel list.

To all freeipa-interest, freeipa-users and freeipa-devel list members,

The FreeIPA project team is pleased to announce the availability of the Release Candidate 3 release of freeIPA 2.0 server [1]. This should be the last release candidate, becoming the final release if no critical problems are found.

Continue reading