<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
</head>
<body text="#000000" bgcolor="#FFFFFF">
Yeah, ubuntu's ipa-client doesn't work for 12.04. I wish it had been easier to find this out, but you can benefit from my weeks of hard work! :-)<br>
<br>
install the ipa client from the freeIPA PPA:<br>
<pre style="color: rgb(0, 0, 0); font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; word-wrap: break-word; white-space: pre-wrap;">apt-add-repository ppa:freeipa/ppa
</pre>
You'll also need the sssd updates PPA:<br>
<pre style="color: rgb(0, 0, 0); font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; word-wrap: break-word; white-space: pre-wrap;">apt-add-repository ppa:sssd/updates</pre>
Run apt-get update, then<br>
<pre style="color: rgb(0, 0, 0); font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; word-wrap: break-word; white-space: pre-wrap;">apt-get -y install openssh-server freeipa-client sssd</pre>
That may work. If it doesn't install those packages, run apt-get dist-upgrade.<br>
<br>
Next run ipa-client install. You need to add a -N so that it doesn't check for ntp. That's broken on ubuntu for some reason. If the install doesn't work, and it tells you to uninstall first, check for /etc/ipa/default.conf and remove it. If it still doesn't
work, remove the files under /var/lib/ipa-client/sysrestore/ and run the ipa-client install again. You'll get many warning & error messages, even with a successful install. After install you can do a "ipa host-find host.domain" on your ipa server and you
should see "Keytab: True"<br>
<br>
restart sssd to get ssh authentication to work.<br>
<br>
The ubuntu client install does not seem to do anything with the --mkhomedir switch, so you need to do that yourself. create the file
<tt>/usr/share/pam-configs/mkhomedir with the contents:<br>
</tt>
<div class="moz-cite-prefix"><tt>Name: activate mkhomedir</tt><tt><br>
</tt><tt>Default: yes</tt><tt><br>
</tt><tt>Priority: 900</tt><tt><br>
</tt><tt>Session-Type: Additional</tt><tt><br>
</tt><tt>Session:</tt><tt><br>
</tt><tt> required pam_mkhomedir.so umask=0022 skel=/etc/skel</tt><br>
<br>
and run pam-auth-update<br>
<br>
That should do it.<br>
<br>
MANY thanks to tjaalton of ubuntu-freeipa for helping me out with most of this!!<br>
<br>
On 06/13/2013 06:47 PM, Marcelo Carvalho wrote:<br>
</div>
<blockquote cite="mid:CAL__MToBvkxAo7GfhFhJw1QJCiAX3i4DuEMLcLH1fepqoCqv_g@mail.gmail.com" type="cite">
<div dir="ltr">My first question is answered.
<div><br>
</div>
<div>It took aa "ipa-client-install --uninstall" to clean up all the mess done up to now and a new</div>
<div><br>
</div>
<div><span style="font-family:arial,sans-serif;font-size:13px"> ipa-client-install --domain=xxxx.xxx --server=ipaserver.xxxxxx.xxx </span><span style="font-family:arial,sans-serif;font-size:13px">--realm=XXXXXX.XXX</span><br>
</div>
<div><span style="font-family:arial,sans-serif;font-size:13px"><br>
</span></div>
<div style=""><span style="font-family:arial,sans-serif;font-size:13px">It is working on the CentOS 6.4 but this did not clean the mess at the Ubuntu node.</span></div>
<div style=""><span style="font-family:arial,sans-serif;font-size:13px"><br>
</span></div>
</div>
<div class="gmail_extra"><br>
<br>
<div class="gmail_quote">On Thu, Jun 13, 2013 at 3:24 PM, Marcelo Carvalho <span dir="ltr">
<<a moz-do-not-send="true" href="mailto:joaquimdecarvalho@gmail.com" target="_blank">joaquimdecarvalho@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0
.8ex;border-left:1px #ccc solid;padding-left:1ex">
<div dir="ltr">Sorry I do not use Ubuntu as my main desktop, and got confused by it. All files are in /home/root-local.
<div><br>
</div>
<div>I can login as root-local from the console using the local password. From the GUI it show <user> name and does not allow me to login with either the local passwd nor the IPA one.</div>
</div>
<div class="HOEnZb">
<div class="h5">
<div class="gmail_extra"><br>
<br>
<div class="gmail_quote">On Thu, Jun 13, 2013 at 2:48 PM, Marcelo Carvalho <span dir="ltr">
<<a moz-do-not-send="true" href="mailto:joaquimdecarvalho@gmail.com" target="_blank">joaquimdecarvalho@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0
.8ex;border-left:1px #ccc solid;padding-left:1ex">
<div dir="ltr">"It shows on the Login GUI" I meant.</div>
<div>
<div>
<div class="gmail_extra"><br>
<br>
<div class="gmail_quote">On Thu, Jun 13, 2013 at 2:47 PM, Marcelo Carvalho <span dir="ltr">
<<a moz-do-not-send="true" href="mailto:joaquimdecarvalho@gmail.com" target="_blank">joaquimdecarvalho@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px
#ccc solid;padding-left:1ex">
<div dir="ltr">Ubuntu 12.04.2
<div><br>
</div>
<div>This is a box I use very often for testing and now after the ipa-client-install and a reboot, I complete lost my local user. I show on the Login GUI but does not allow me to authenticate any password, not the IPA one not the local user one. In fact I
just logged as root and the local user is not even listed on the passwd file and there is NO files left on the /home/user directory. /home/user is empty, but exist.</div>
<div><br>
</div>
<div><br>
</div>
</div>
<div>
<div>
<div class="gmail_extra"><br>
<br>
<div class="gmail_quote">On Thu, Jun 13, 2013 at 2:21 PM, Guy Matz <span dir="ltr">
<<a moz-do-not-send="true" href="mailto:gmatz@collective.com" target="_blank">gmatz@collective.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0
.8ex;border-left:1px #ccc
solid;padding-left:1ex">
Which version of ubuntu are you using?<br>
<div>
<div><br>
On 06/13/2013 04:12 PM, Marcelo Carvalho wrote:<br>
> Hi Folks.<br>
><br>
> I have installed an ipa server and a replica on linux CentOS release<br>
> 6.4 (Final). It is using outside DNS. I have https console access<br>
> authenticating admin user through kerberos, and have migrated<br>
> information on 80+ users and groups to it from a LDAP server.<br>
><br>
> Packages related to ipa installed at main server are:<br>
><br>
> [root ~]# rpm -qa | grep ipa<br>
> ipa-server-selinux-3.0.0-26.el6_4.2.x86_64<br>
> ipa-pki-ca-theme-9.0.3-7.el6.noarch<br>
> libipa_hbac-1.9.2-82.el6.x86_64<br>
> ipa-python-3.0.0-26.el6_4.2.x86_64<br>
> ipa-admintools-3.0.0-26.el6_4.2.x86_64<br>
> ipa-client-3.0.0-26.el6_4.2.x86_64<br>
> python-iniparse-0.3.1-2.1.el6.noarch<br>
> ipa-pki-common-theme-9.0.3-7.el6.noarch<br>
> libipa_hbac-python-1.9.2-82.el6.x86_64<br>
> ipa-server-3.0.0-26.el6_4.2.x86_64<br>
> [root ~]#<br>
><br>
> I am now on the process of installing a CentOS 6.4 as IPA client, and<br>
> switch my Ubuntu desktop to use IPA as well.<br>
><br>
> 1- On the CentOS 6.4 as IPA client:<br>
><br>
> Packages installed are:<br>
><br>
> $ rpm -qa | grep ipa<br>
> ipa-client-3.0.0-26.el6_4.2.x86_64<br>
> ipa-python-3.0.0-26.el6_4.2.x86_64<br>
> python-iniparse-0.3.1-2.1.el6.noarch<br>
> libipa_hbac-python-1.9.2-82.el6.x86_64<br>
> libipa_hbac-1.9.2-82.el6.x86_64<br>
><br>
><br>
> I run installation line as follows and<br>
><br>
> ipa-client-install --domain=xxxx.xxx --server=ipaserver.xxxxxx.xxx<br>
> --realm=XXXXXX.XXX<br>
><br>
> Id did go well and I see output line:<br>
><br>
> Client configuration complete.<br>
><br>
> Although all of the above I still cannot login into this new node<br>
> using IPA. It still checks the local users.<br>
><br>
><br>
> 2- On the Ubunto desktop<br>
><br>
> I am locked out. It now does not accept my IPA user-passwd not my<br>
> local-user-passwd.<br>
><br>
> Please advise on both.<br>
><br>
> Many thanks,<br>
><br>
> Marcelo<br>
><br>
> _______________________________________________<br>
> Freeipa-users mailing list<br>
> <a moz-do-not-send="true" href="mailto:Freeipa-users@redhat.com" target="_blank">
Freeipa-users@redhat.com</a><br>
> <a moz-do-not-send="true" href="https://www.redhat.com/mailman/listinfo/freeipa-users" target="_blank">
https://www.redhat.com/mailman/listinfo/freeipa-users</a><br>
><br>
<br>
</div>
</div>
</blockquote>
</div>
<br>
</div>
</div>
</div>
</blockquote>
</div>
<br>
</div>
</div>
</div>
</blockquote>
</div>
<br>
</div>
</div>
</div>
</blockquote>
</div>
<br>
</div>
</blockquote>
<br>
</body>
</html>