<div dir="ltr">D'Oh! Thanks, Petr.</div><div class="gmail_extra"><br clear="all"><div><div dir="ltr"><div><br></div><div><u><br></u></div><div><b>Bret Wortman</b></div><div><img src="http://damascusgrp.com/item/51f7de33e4b08d2bdb8b4860?format=1500w" width="200" height="53"><br>
</div><div><a href="http://damascusgrp.com/" target="_blank">http://damascusgrp.com/</a><br></div><div><a href="http://about.me/wortmanbret" target="_blank">http://about.me/wortmanbret</a><br></div></div></div>
<br><br><div class="gmail_quote">On Thu, Sep 5, 2013 at 2:33 AM, Petr Spacek <span dir="ltr"><<a href="mailto:pspacek@redhat.com" target="_blank">pspacek@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div class="im">On 4.9.2013 20:23, Bret Wortman wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
...and I tried exporting the DNS data but ended up with a bunch of files<br>
that looked liket his:<br>
<br>
# cat foo.net.db<br>
<br>
; <<>> DiG 9.9.3-rl.156.01.P1-RedHat-9.9.<u></u>3-3.P1.fc18 <<>> +onesoa -t AXFR<br>
<a href="http://foo.net" target="_blank">foo.net</a><br>
;; global options: +cmd<br>
; Transfer failed.<br>
#<br>
<br>
The logs showed:<br>
<br>
<timestamp> ipamaster named[31633]: client 1.2.3.4#39992 (<a href="http://foo.net" target="_blank">foo.net</a>) : zone<br>
transfer '<a href="http://foo.net/AXFR/IN" target="_blank">foo.net/AXFR/IN</a>' denied<br>
</blockquote>
<br></div>
You have to add IP '1.2.3.4' to the allow-transfer Address List Match.<br>
<br>
$ ipa dnszone-mod --allow-transfer='localhost; 1.2.3.4;'<br>
<br>
See<br>
<a href="http://www.zytrax.com/books/dns/ch7/address_match_list.html" target="_blank">http://www.zytrax.com/books/<u></u>dns/ch7/address_match_list.<u></u>html</a><br>
for further details.<br>
<br>
Petr^2 Spacek<div class="HOEnZb"><div class="h5"><br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
On Wed, Sep 4, 2013 at 1:32 PM, Simo Sorce <<a href="mailto:simo@redhat.com" target="_blank">simo@redhat.com</a>> wrote:<br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
On Wed, 2013-09-04 at 09:40 -0400, Dmitri Pal wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
On 09/04/2013 09:26 AM, Petr Spacek wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
On 4.9.2013 15:04, Bret Wortman wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
What's the right venue for making a suggestion? In particular, I'd<br>
like to<br>
toss out there that it would be really nice to be able to export, at a<br>
minimum, DNS and user data from IPA in the form of a zone file and a<br>
passwd/shadow file pair.<br>
<br>
I realize there might be security implications to the latter, and<br>
masking<br>
out passwords might be advisiable. And there's no easy way,<br>
necessarily, to<br>
get out sudo information. But having DNS and user details would at<br>
</blockquote></blockquote></blockquote>
least<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
permit a sysadmin having major issues (like I have been for the past<br>
</blockquote></blockquote></blockquote>
two<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
weeks) to get up and running in some form, using puppet or some other<br>
tool<br>
to distribute flat files with named running against a static zone<br>
file, or<br>
even to migrate off IPA if absolutely necessary.<br>
</blockquote>
<br>
Hello,<br>
<br>
for DNS you can use normal zone transfer. Just configure IPA zone to<br>
allow zone transfer to an IP address (localhost means 'localy to IPA<br>
server') and use standard DNS tools, e.g. dig:<br>
<br>
$ ipa dnszone-mod <a href="http://example.com" target="_blank">example.com</a> --allow-transfer='localhost;'<br>
$ dig +onesoa -t AXFR <a href="http://example.com" target="_blank">example.com</a> > /root/example.com.db<br>
<br>
That is all you need for DNS, you have the standard zone file.<br>
<br>
<br>
I believe that you can use SSSD (with enumeration enabled) to run<br>
"getent passwd > /root/passwd.bck". I have no idea how it works with<br>
shadow map/password. Try to ask <a href="mailto:sssd-users@lists.fedorahosted.org" target="_blank">sssd-users@lists.fedorahosted.<u></u>org</a>.<br>
<br>
</blockquote>
And to add to it:<br>
IPA does not keep password in clear or the hashes that are used in<br>
passwd and shadow files for security reasons so it can't generate these<br>
files as you suggest.<br>
</blockquote>
<br>
We do have hashes, the default is SHA256, it is stored in userPassword<br>
and is used to validate LDAP binds, however we never let it out of LDAP,<br>
neither SSSD not the integrate NIS server expose the password hash to<br>
clients. You need Directory Manager privileges to read it.<br>
</blockquote></blockquote>
<br></div></div><div class="HOEnZb"><div class="h5">
______________________________<u></u>_________________<br>
Freeipa-users mailing list<br>
<a href="mailto:Freeipa-users@redhat.com" target="_blank">Freeipa-users@redhat.com</a><br>
<a href="https://www.redhat.com/mailman/listinfo/freeipa-users" target="_blank">https://www.redhat.com/<u></u>mailman/listinfo/freeipa-users</a><br>
</div></div></blockquote></div><br></div>