<html> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"> <style type="text/css" style="display:none"></style> </head> <body dir="ltr"> <div id="divtagdefaultwrapper" style="font-size:12pt;color:#000000;background-color:#FFFFFF;font-family:Calibri,Arial,Helvetica,sans-serif;"> <p>Hi,</p> <p><br> </p> <p>Not knowing your specific circumstance but my experience over the last decade plus would be keep the RHEL, Debian/Ubuntu and Solaris servers up to date all the time, or at least 1~2 months behind max. eg we clone off RHEL channels into testing channels and patch then clone production from test and patch. (playing catch now is now a risk for you)<br> </p> <p><br> </p> <p>If there is an issue with a rpm then you will find it and we then for instance freeze patching until it is resolved. If you dont have a test group of servers run 1~2months behind the latest and import specific rpms if a nasty bug appears eg the recent bash one.<br> </p> <p><br> </p> <div id="Signature"> <div name="divtagdefaultwrapper" style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:; margin:0"> <div style="font-family:Tahoma; font-size:13px"> <div style="font-family:Tahoma; font-size:13px"> <div style="font-family:Tahoma; font-size:13px"> <p>regards</p> <p>Steven <br> </p> </div> </div> </div> </div> </div> <div style="color: rgb(33, 33, 33);"> <hr tabindex="-1" style="display:inline-block; width:98%"> <div id="divRplyFwdMsg" dir="ltr"><font style="font-size:11pt" color="#000000" face="Calibri, sans-serif"><b>From:</b> freeipa-users-bounces@redhat.com <freeipa-users-bounces@redhat.com> on behalf of Genadi Postrilko <genadipost@gmail.com><br> <b>Sent:</b> Tuesday, 3 February 2015 10:35 a.m.<br> <b>To:</b> Identity Managment; freeipa-users@redhat.com<br> <b>Subject:</b> Re: [Freeipa-users] sssd compatibility with older RHEL 6 minor releases.</font> <div> </div> </div> <div> <div dir="rtl"> <div dir="ltr"><span style="font-size:12.8000001907349px">Thank you for your reply.</span><br> </div> <div dir="ltr">I think ill go with the first option, it about time to upgrade :).</div> <div dir="ltr"><br> </div> <div dir="ltr">Genadi.</div> </div> <div class="gmail_extra"><br> <div class="gmail_quote"> <div dir="ltr">2015-02-01 2:09 GMT+02:00 Dmitri Pal <span dir="ltr"><<a href="mailto:dpal@redhat.com" target="_blank">dpal@redhat.com</a>></span>:</div> <blockquote class="gmail_quote" style="margin:0 .8ex; border-left:1px #ccc solid; border-right:1px #ccc solid; padding-left:1ex; padding-right:1ex"> <div bgcolor="#FFFFFF"> <div> <div class="h5"> <div>On 01/31/2015 01:37 PM, Genadi Postrilko wrote:<br> </div> <blockquote type="cite"> <div dir="rtl"> <div dir="ltr">Hello all.</div> <div dir="ltr"><br> </div> <div dir="ltr">The environment i'm currently working to migrate under IPA identity management contains mostly RHEL 6.2 servers. </div> <div dir="ltr">I'm planing to use Active Directory Cross Forest Trust for Identities, IPA as sudo provider, and all the other goodies that IPA provides.</div> <div dir="ltr"><br> </div> <div dir="ltr">If i want to enjoy all the new features (at least most of them), i know that clients have to be sssd version > 1.9. And if i want IPA to be auto configured as sudo provider it has to be sssd > 1.11.</div> <div dir="ltr"><br> </div> <div dir="ltr">When reading the mailing list i noticed that sssd 1.11 is mentioned as feature of rhel 6.6.</div> <div dir="ltr">What i would like and understand is what could go wrong if i will install sssd 1.11 on rhel 6.2 servers.And what is is your general recommendations for older RHEL 6 (minor) releases?</div> </div> </blockquote> <br> </div> </div> It will pull a lot of dependencies and most of your system will look like 6.6 system<br> Also the upgrade like this might reveal some issues as the upgrades are expected to be gradual. 1-2 versions is ok but 4 is quit a big leap.<br> <br> Overall it is a bit risky to do it.<br> You have three options:<br> - upgrade properly but probably in two steps 6.2 -> 6.4 -> 6.6<br> - use SSSD from 6.2 as is for now. It will have limited functionality but can leverage AD users from the trust. You would need to configure SSSD to use LDAP for authentication and point to compat tree of IPA to take advantage of the trust. See details here: <a href="http://www.freeipa.org/images/0/0d/FreeIPA33-legacy-clients.pdf" target="_blank"> http://www.freeipa.org/images/0/0d/FreeIPA33-legacy-clients.pdf</a><br> - take your chances and try a hybrid you propose but it is not a formally supported configuration.<br> <br> <blockquote type="cite"> <div dir="rtl"> <div dir="ltr"><br> </div> <div dir="ltr">Thanks in advance,</div> <div dir="ltr">Genadi. </div> <div dir="ltr"><br> </div> </div> <br> <fieldset></fieldset> <br> <span class="HOEnZb"><font color="#888888"></font></span></blockquote> <span class="HOEnZb"><font color="#888888"><br> <br> <pre cols="72">-- Thank you, Dmitri Pal Sr. Engineering Manager IdM portfolio Red Hat, Inc.</pre> </font></span></div> <br> --<br> Manage your subscription for the Freeipa-users mailing list:<br> <a href="https://www.redhat.com/mailman/listinfo/freeipa-users" target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-users</a><br> Go To <a href="http://freeipa.org" target="_blank">http://freeipa.org</a> for more info on the project<br> </blockquote> </div> <br> </div> </div> </div> </div> </body> </html>