<html><body><div style="color:#000; background-color:#fff; font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size:16px"><div dir="ltr" id="yui_3_16_0_1_1422051702168_19221"><span id="yui_3_16_0_1_1422051702168_19533">Thank you all for your input. I am still unable to get this working but I am going to ask one of our Solaris admins to take a look at the config as I am no Solaris expert. <br></span></div><div id="yui_3_16_0_1_1422051702168_19588" dir="ltr"><span id="yui_3_16_0_1_1422051702168_19533">We do have sudo packages installed:</span></div><div class="" id="yui_3_16_0_1_1422051702168_19769" style="margin-left: 30px;">libintl-3.4.0-sol10-x86-local.pkg</div><div id="yui_3_16_0_1_1422051702168_19776" class="" style="margin-left: 30px;">libiconv-1.14-sol10-x86-local.pkg</div><div id="yui_3_16_0_1_1422051702168_19775" class="" style="margin-left: 30px;">libgcc-3.4.6-sol10-x86-local.pkg</div><div id="yui_3_16_0_1_1422051702168_19774" class="" style="margin-left: 30px;"><div id="yui_3_16_0_1_1422051702168_19779">sudo-1.8.5p2-sol10-x86-local.pkg</div><div id="yui_3_16_0_1_1422051702168_19780"><br></div></div><div id="yui_3_16_0_1_1422051702168_19768" dir="ltr"><span id="yui_3_16_0_1_1422051702168_19533"> and I modified the ldapclient init to include: NS_LDAP_SERVICE_SEARCH_DESC=sudoers:cn=sysaccounts,cn=etc,dc=example,dc=com</span></div><div id="yui_3_16_0_1_1422051702168_19783" dir="ltr"><span id="yui_3_16_0_1_1422051702168_19533"><br></span></div><div id="yui_3_16_0_1_1422051702168_19585" dir="ltr"><span id="yui_3_16_0_1_1422051702168_19533">And added this line to nsswitch.conf</span></div><div id="yui_3_16_0_1_1422051702168_19590" dir="ltr"><span style="" class="" id="yui_3_16_0_1_1422051702168_19533">sudoers: files ldap</span></div><div id="yui_3_16_0_1_1422051702168_19970" dir="ltr"><br></div><div id="yui_3_16_0_1_1422051702168_19982" dir="ltr">I set the NIS domainname as suggested here:</div><div style="" class="" id="yui_3_16_0_1_1422051702168_20183" dir="ltr"></div><div style="" class="" id="yui_3_16_0_1_1422051702168_20183" dir="ltr"> </div><div id="yui_3_16_0_1_1422051702168_20190" style="" class=""><a id="yui_3_16_0_1_1422051702168_20189" style="" class="" href="http://www.freeipa.org/page/ConfiguringUnixClients#Client_Configuration_Files">http://www.freeipa.org/page/ConfiguringUnixClients#Client_Configuration_Files</a></div><div id="yui_3_16_0_1_1422051702168_20517" dir="ltr" style="" class=""><a id="yui_3_16_0_1_1422051702168_20189" style="" class="" href="http://www.freeipa.org/page/ConfiguringUnixClients#Client_Configuration_Files"> </a></div><div></div><ol id="yui_3_16_0_1_1422051702168_20520" style="" class=""><li id="yui_3_16_0_1_1422051702168_20519" style="" class="">echo “example.com” > /etc/defaultdomain</li><li id="yui_3_16_0_1_1422051702168_20521" style="" class="">domainname `cat /etc/defaultdomain`</li></ol><div id="yui_3_16_0_1_1422051702168_20687" dir="ltr">/etc/ldap.conf does not exist so I tried adding that as well following this:</div><div id="yui_3_16_0_1_1422051702168_20683" dir="ltr"><a id="yui_3_16_0_1_1422051702168_20685" href="http://www.freeipa.org/docs/1.2/Client_Setup_Guide/en-US/html/chap-Client_Configuration_Guide-Configuring_Solaris_as_an_IPA_Client.html">http://www.freeipa.org/docs/1.2/Client_Setup_Guide/en-US/html/chap-Client_Configuration_Guide-Configuring_Solaris_as_an_IPA_Client.html</a><br></div><div id="yui_3_16_0_1_1422051702168_20183" dir="ltr"><br> </div><div id="yui_3_16_0_1_1422051702168_21125" dir="ltr">And when none of these work I did follow Ajeet's instructions for using the opencsw packages but to no avail.</div><div id="yui_3_16_0_1_1422051702168_21144" dir="ltr"><br></div><div id="yui_3_16_0_1_1422051702168_21146" dir="ltr">I saw several posts about changing pam.conf but any time I followed those suggestions freeipa shell logins did not work. I do understand we are on an old version of IPA but can't change all our servers to run rhel7 at this time.<br><span style="" class="" id="yui_3_16_0_1_1422051702168_19533"></span></div><div id="yui_3_16_0_1_1422051702168_19975" dir="ltr"><span style="" class="" id="yui_3_16_0_1_1422051702168_19533"><br></span></div> <div class="qtdSeparateBR"><br><br></div><div style="display: block;" class="yahoo_quoted"> <div style="font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif; font-size: 16px;"> <div style="font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif; font-size: 16px;"> <div dir="ltr"> <font size="2" face="Arial"> On Monday, January 19, 2015 11:42 AM, "freeipa-users-request@redhat.com" <freeipa-users-request@redhat.com> wrote:<br> </font> </div> <br><br> <div class="y_msg_container">Send Freeipa-users mailing list submissions to<br> <a ymailto="mailto:freeipa-users@redhat.com" href="mailto:freeipa-users@redhat.com">freeipa-users@redhat.com</a><br><br>To subscribe or unsubscribe via the World Wide Web, visit<br> <a href="https://www.redhat.com/mailman/listinfo/freeipa-users" target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-users</a><br>or, via email, send a message with subject or body 'help' to<br> <a ymailto="mailto:freeipa-users-request@redhat.com" href="mailto:freeipa-users-request@redhat.com">freeipa-users-request@redhat.com</a><br><br>You can reach the person managing the list at<br> <a ymailto="mailto:freeipa-users-owner@redhat.com" href="mailto:freeipa-users-owner@redhat.com">freeipa-users-owner@redhat.com</a><br><br>When replying, please edit your Subject line so it is more specific<br>than "Re: Contents of Freeipa-users digest..."<br><br><br>Today's Topics:<br><br> 1. Re: Having trouble running FreeIPA with SRV records on<br> externally managed DNS (Petr Spacek)<br> 2. freeipa managed sudoers on Solaris 10 (sipazzo)<br> 3. Re: freeipa managed sudoers on Solaris 10 (Dmitri Pal)<br> 4. Re: freeipa managed sudoers on Solaris 10<br> (Murty, Ajeet (US - Arlington))<br><br><br>----------------------------------------------------------------------<br><br>Message: 1<br>Date: Mon, 19 Jan 2015 18:04:25 +0100<br>From: Petr Spacek <<a ymailto="mailto:pspacek@redhat.com" href="mailto:pspacek@redhat.com">pspacek@redhat.com</a>><br>To: <a ymailto="mailto:freeipa-users@redhat.com" href="mailto:freeipa-users@redhat.com">freeipa-users@redhat.com</a><br>Subject: Re: [Freeipa-users] Having trouble running FreeIPA with SRV<br> records on externally managed DNS<br>Message-ID: <<a ymailto="mailto:54BD3919.4070008@redhat.com" href="mailto:54BD3919.4070008@redhat.com">54BD3919.4070008@redhat.com</a>><br>Content-Type: text/plain; charset=windows-1252<br><br>On 19.1.2015 16:54, <a ymailto="mailto:rob.harper@stfc.ac.uk" href="mailto:rob.harper@stfc.ac.uk">rob.harper@stfc.ac.uk</a> wrote:<br>> Hi all,<br>> <br>> I have successfully set up a test FreeIPA server and run it for a while, but the time has come to move towards a production service. I am currently running ipa-server version 3.0.0-25 on Scientific Linux 6.4 (if you don't know it, Scientific Linux is basically a rebuild of RedHat, much like CentOS). Yes, I know this is an older FreeIPA, but I am going through the path of least resistance given our site's current standard configuration.<br>> <br>> On our site there is a central DNS service and it is unlikely we will be allowed to run our own DNS service (other than as a slave/cacheing NS). <br>> <br>> I have been trying to set up SRV records for the FreeIPA server by providing the autogenerated zone file to our DNS manager, who has incorporated the configuration. When we deployed these changes, I used dig to confirm that SRV queries were giving appropriate responses, which they appear to be.<br>> <br>> I then tried setting up a client using ipa-client-install and got an error:<br>> <br>> Failed to verify that freeipa01.<munged.domain> is an IPA Server.<br>> This may mean that the remote server is not up or is not reachable due to network or firewall settings.<br>> <br>> The install worked on a client before deploying the SRV records, using manual specification of the server. I disabled iptables on the server to eliminate potential problems there, and got the same result. If we disable the SRV records, I am able to do the manual set-up again.<br>> <br>> So it looks like the problem is at the DNS end of things, so maybe our zone configuration is missing something. <br>> <br>> The zone config we currently have in place is as follows (we changed hostnames in the sample file to fqdns for this attempt, but the same symptoms came from bare hostnames)...<br>> <br>> ; ldap servers<br>> _ldap._tcp.my.domain. IN SRV 0 100 389 freeipa01.my.domain.<br>> ;<br>> ; kerberos realm<br>> _kerberos.my.domain. IN TXT my.domain.<br>> ;<br>> ; kerberos servers<br>> _kerberos._tcp.my.domain. IN SRV 0 100 88 freeipa01.my.domain.<br>> _kerberos._udp.my.domain. IN SRV 0 100 88 freeipa01.my.domain.<br>> _kerberos-master._tcp.my.domain. IN SRV 0 100 88 freeipa01.my.domain.<br>> _kerberos-master._udp.my.domain. IN SRV 0 100 88 freeipa01.my.domain.<br>> _kpasswd._tcp.my.domain. IN SRV 0 100 464 freeipa01.my.domain.<br>> _kpasswd._udp.my.domain. IN SRV 0 100 464 freeipa01.my.domain.<br>> ;<br>> ; ntp server<br>> _ntp._udp.my.domain. IN SRV 0 100 123 freeipa01.my.domain.<br>> <br>> <br>> ...So that is where I am. I was hoping that someone could give me a pointer or two as to how I might debug this problem and actually get service discovery working.<br>> <br>> Many thanks for reading this far!<br><br>Interesting. Please provide us with information listed on<br><a href="http://www.freeipa.org/page/Troubleshooting#Client_Installation" target="_blank">http://www.freeipa.org/page/Troubleshooting#Client_Installation</a><br><br>Additionally not-obfuscated output from dig could help too.<br><br>Also, please keep in mind that:<br>1) Log obfuscation will make debugging harder for us.<br>2) Obfuscating DNS names does not bring any real security.<br><br>Did you read your e-mail headers? DNS domain EXCHMBX01.fed.cclrc.ac.uk is in<br>there ...<br><br>Have a nice day!<br><br>-- <br>Petr^2 Spacek<br><br><br><br>------------------------------<br><br>Message: 2<br>Date: Mon, 19 Jan 2015 18:50:11 +0000 (UTC)<br>From: sipazzo <<a ymailto="mailto:sipazzo@yahoo.com" href="mailto:sipazzo@yahoo.com">sipazzo@yahoo.com</a>><br>To: "<a ymailto="mailto:freeipa-users@redhat.com" href="mailto:freeipa-users@redhat.com">freeipa-users@redhat.com</a>" <<a ymailto="mailto:freeipa-users@redhat.com" href="mailto:freeipa-users@redhat.com">freeipa-users@redhat.com</a>><br>Subject: [Freeipa-users] freeipa managed sudoers on Solaris 10<br>Message-ID:<br> <<a ymailto="mailto:759625883.2039340.1421693411249.JavaMail.yahoo@jws100202.mail.ne1.yahoo.com" href="mailto:759625883.2039340.1421693411249.JavaMail.yahoo@jws100202.mail.ne1.yahoo.com">759625883.2039340.1421693411249.JavaMail.yahoo@jws100202.mail.ne1.yahoo.com</a>><br> <br>Content-Type: text/plain; charset="utf-8"<br><br>I am having trouble finding relevant documentation on using freeipa to manage sudoers for a Solaris client. Has anyone successfully set this up without adding a bunch of non-standard packages? I am running freeipa 3.0.0-42 and any help is appreciated. <br>-------------- next part --------------<br>An HTML attachment was scrubbed...<br>URL: <<a href="https://www.redhat.com/archives/freeipa-users/attachments/20150119/10a3021b/attachment.html" target="_blank">https://www.redhat.com/archives/freeipa-users/attachments/20150119/10a3021b/attachment.html</a>><br><br>------------------------------<br><br>Message: 3<br>Date: Mon, 19 Jan 2015 14:01:53 -0500<br>From: Dmitri Pal <<a ymailto="mailto:dpal@redhat.com" href="mailto:dpal@redhat.com">dpal@redhat.com</a>><br>To: <a ymailto="mailto:freeipa-users@redhat.com" href="mailto:freeipa-users@redhat.com">freeipa-users@redhat.com</a><br>Subject: Re: [Freeipa-users] freeipa managed sudoers on Solaris 10<br>Message-ID: <<a ymailto="mailto:54BD54A1.3040808@redhat.com" href="mailto:54BD54A1.3040808@redhat.com">54BD54A1.3040808@redhat.com</a>><br>Content-Type: text/plain; charset="iso-8859-1"; Format="flowed"<br><br>On 01/19/2015 01:50 PM, sipazzo wrote:<br>> I am having trouble finding relevant documentation on using freeipa to <br>> manage sudoers for a Solaris client. Has anyone successfully set this <br>> up without adding a bunch of non-standard packages? I am running <br>> freeipa 3.0.0-42 and any help is appreciated.<br>><br>><br>AFAIR Solaris does not carry sudo packages so if you plan to use sudo <br>you would need to get packages from upstream.<br>Other than that it is not different from using SUDO from a Linux client <br>that does not have SSSD.<br><br>-- <br>Thank you,<br>Dmitri Pal<br><br>Sr. Engineering Manager IdM portfolio<br>Red Hat, Inc.<br><br>-------------- next part --------------<br>An HTML attachment was scrubbed...<br>URL: <<a href="https://www.redhat.com/archives/freeipa-users/attachments/20150119/300c69b7/attachment.html" target="_blank">https://www.redhat.com/archives/freeipa-users/attachments/20150119/300c69b7/attachment.html</a>><br><br>------------------------------<br><br>Message: 4<br>Date: Mon, 19 Jan 2015 19:24:56 +0000<br>From: "Murty, Ajeet (US - Arlington)" <<a ymailto="mailto:amurty@deloitte.com" href="mailto:amurty@deloitte.com">amurty@deloitte.com</a>><br>To: "<a ymailto="mailto:dpal@redhat.com" href="mailto:dpal@redhat.com">dpal@redhat.com</a>" <<a ymailto="mailto:dpal@redhat.com" href="mailto:dpal@redhat.com">dpal@redhat.com</a>>, "<a ymailto="mailto:freeipa-users@redhat.com" href="mailto:freeipa-users@redhat.com">freeipa-users@redhat.com</a>"<br> <<a ymailto="mailto:freeipa-users@redhat.com" href="mailto:freeipa-users@redhat.com">freeipa-users@redhat.com</a>><br>Subject: Re: [Freeipa-users] freeipa managed sudoers on Solaris 10<br>Message-ID:<br> <<a ymailto="mailto:e6e9ade8398c411eb72e02f6610dc301@USNDC0426.us.deloitte.com" href="mailto:e6e9ade8398c411eb72e02f6610dc301@USNDC0426.us.deloitte.com">e6e9ade8398c411eb72e02f6610dc301@USNDC0426.us.deloitte.com</a>><br>Content-Type: text/plain; charset="us-ascii"<br><br>We had to use OpenCSW packages.<br><br>run this on cmd-line -<br> pkgadd -d <a href="http://get.opencsw.org/now" target="_blank">http://get.opencsw.org/now</a><br> /opt/csw/bin/pkgutil -y -i CSWbdb4 CSWcommon CSWlibnet CSWosslutils CSWsasl CSWsudo-common CSWsudoldap cswpki gcc4core gcc4g++ gmake libssl_dev openldap_client openldap_dev<br><br>optional one pkg at a time install -<br> /opt/csw/bin/pkgutil -y -i CSWbdb4<br> /opt/csw/bin/pkgutil -y -i CSWcommon<br> /opt/csw/bin/pkgutil -y -i CSWlibnet<br> /opt/csw/bin/pkgutil -y -i CSWosslutils<br> /opt/csw/bin/pkgutil -y -i CSWsasl<br> /opt/csw/bin/pkgutil -y -i CSWsudo-common<br> /opt/csw/bin/pkgutil -y -i CSWsudoldap<br> /opt/csw/bin/pkgutil -y -i cswpki<br><br><br>Ajeet Murty<br>Deloitte & Touche LLP<br>Tel: +1 571 882 5614 | Mobile: +1 704 421 8756<br><a ymailto="mailto:amurty@deloitte.com" href="mailto:amurty@deloitte.com">amurty@deloitte.com</a><mailto:<a ymailto="mailto:amurty@deloitte.com" href="mailto:amurty@deloitte.com">amurty@deloitte.com</a>> | www.deloitte.com<br><br><br><br><br><br><br><br><br>This message (including any attachments) contains confidential information intended for a specific individual and purpose, and is protected by law. If you are not the intended recipient, you should delete this message and any disclosure, copying, or distribution of this message, or the taking of any action based on it, by you is strictly prohibited.<br><br>v.E.1<br><br><br><br>From: <a ymailto="mailto:freeipa-users-bounces@redhat.com" href="mailto:freeipa-users-bounces@redhat.com">freeipa-users-bounces@redhat.com</a> [mailto:<a ymailto="mailto:freeipa-users-bounces@redhat.com" href="mailto:freeipa-users-bounces@redhat.com">freeipa-users-bounces@redhat.com</a>] On Behalf Of Dmitri Pal<br>Sent: Monday, January 19, 2015 2:02 PM<br>To: <a ymailto="mailto:freeipa-users@redhat.com" href="mailto:freeipa-users@redhat.com">freeipa-users@redhat.com</a><br>Subject: Re: [Freeipa-users] freeipa managed sudoers on Solaris 10<br><br>On 01/19/2015 01:50 PM, sipazzo wrote:<br>I am having trouble finding relevant documentation on using freeipa to manage sudoers for a Solaris client. Has anyone successfully set this up without adding a bunch of non-standard packages? I am running freeipa 3.0.0-42 and any help is appreciated.<br><br><br>AFAIR Solaris does not carry sudo packages so if you plan to use sudo you would need to get packages from upstream.<br>Other than that it is not different from using SUDO from a Linux client that does not have SSSD.<br><br><br><br>--<br><br>Thank you,<br><br>Dmitri Pal<br><br><br><br>Sr. Engineering Manager IdM portfolio<br><br>Red Hat, Inc.<br><br><br><br><br>-------------- next part --------------<br>An HTML attachment was scrubbed...<br>URL: <<a href="https://www.redhat.com/archives/freeipa-users/attachments/20150119/963cd0df/attachment.html" target="_blank">https://www.redhat.com/archives/freeipa-users/attachments/20150119/963cd0df/attachment.html</a>><br><br>------------------------------<br><br>_______________________________________________<br>Freeipa-users mailing list<br><a ymailto="mailto:Freeipa-users@redhat.com" href="mailto:Freeipa-users@redhat.com">Freeipa-users@redhat.com</a><br><a href="https://www.redhat.com/mailman/listinfo/freeipa-users" target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-users</a><br><br>End of Freeipa-users Digest, Vol 78, Issue 74<br>*********************************************<br><br><br></div> </div> </div> </div> </div></body></html>