P is for Policy. One aspect of policy management that has the potential to be the killer feature is centralized SUDO.
Centralized SUDO with FreeIPA
Reply
Category Archives: Sysadmin
Firefox and Multiple Kerberos Realms
You will need two profiles: I use my default for my corporate setup, and a new one for development.
(Note:Â if you want to keep open a browser, you can use the –no-remote switch so that Firefox doesn’t ignore your pleas to use a different profile, and instead just makes another window that uses the same one.)
firefox -P kfrog –no-remote &
Go through the steps to create another profile.
In the second window, you need to establish kinit, but running with a different TGT. You do this with an environment variable:
export KRB5CCNAME=/tmp/krb5ccache
kinit kfrog@TESTREALM.COM
Close and restart firefox.
firefox –no-remote -P ayoung &
Kerberize the Enterprise
FreeIPA makes Kerberos a lot less painful.
Mounting a KVM/Qemu VM root partition in Fedora 14
Since My development now needs to target F14, not F13, I figured I start using a F14 virtual machine, but leave my F13 VM alone, just in case I needed something off of it. Well, it turns out I do need something off of it. But why should I have to wait for it to boot in order to see it? I can mount it loop back, right…
Announcing FreeIPA v2 Server Beta 1 Release
(reposted from the mailing list)
The FreeIPA project team is pleased to announce the availability of the Beta 1 release of freeIPA 2.0 server [1].
DNS Use cases in FreeIPA
The below is my notes on how DNS is used. This document is neither accurate nor authoritative, just meandering. You’ve been warned.
RFI: SPEGNO multiple requests
From what we are seeing and what I’ve read, the browser seems to send a JSON request with no Auth info, and then the whole SPEGNO handshake takes place, turning what should be a single request response into (at a minimum) two. It seems to me that we should be able to avoid that after the initial auth has taken place.
Is there any way to cache SPEGNO information such that successive JSON RPC calls provide the needed information automatically, instead of requiring multiple round trips per request?
Any Fedora people worked with this stuff and know how to optimize it? Do I need to revert to a Cookie based approach?
Unit tests in FreeIPA
I’m working through the issues getting the unit tests to run cleanly. Here’s my setup:
Talking to FreeIPA JSON web API via curl
One of the benefits of web APIs is that we can use command line tools to call them. FreeIPA is no different, but perhaps a hair trickier, as it combines the use of Kerberos with a strict JSON format. Getting it right took a little trial and error.
Continue readingSysadmin’s Req
(If you can’t guess the tune, get off my lawn!)
Are you posting a Sys Admin’s Req
telnet, CUPS, Sendmail, and BIND
Consider her I worked with at DEC
She once was an admin of mine
Have her crimp me a crossover cable
telnet, CUPS, Sendmail, and BIND
Bridging hub and subnet unstable
And then she’ll be an admin of mine
Have her build me a server of web
telnet, CUPS, Sendmail, and BIND
Without virtualized overhead
And then she’ll be an admin of mine
Have her craft me a Kerberos Key
telnet, CUPS, Sendmail, and BIND
But not based on code writ at MIT
And then she’ll be an Admin of mine
Have her write me a recovery plan
telnet, CUPS, Sendmail, and BIND
With servers unconnected to SAN
And then she’ll be an admin of mine