[Freeipa-users] Howto re-deploy an IPA-client using kickstart

[Fred van Zwieten]

On Sat, Jan 26, 2013 at 2:13 AM, Charlie Derwent <
shelltoesuperstar at gmail.com> wrote:

> Hi Fred
>
> Little unsure about what you mean here. What is it you're trying to do
> exactly? Do you mean you can't run IPA commands on your satellite server?
> Do you just need to install ipa-admin-tools?
>
> Do you mean IPA commands don't work on a IPA client until the client is
> enrolled? That would make sense as how else would the server authenticate
> the commands?
>
>
First of all, the RFE solves my problem.

The discussion was how it might be solved without the RFE in my use case.

We redeploy systems using Satellite Web UI. What Satellite basically does
when requesting a re-install is scheduling a remote command on the system.
This remote command is "koan" (kickstart-over-a-network).
Koan<http://linux.die.net/man/1/koan> will
prep the system so it will re-install at the next reboot using the correct
kickstart profile, usually through PXE.

Now, this to-be-redeployed system is also an IPA-client. In the kickstart
file for this system we have "ipa-client-install -w <password> --unattend
etc" for unattended enrolledment. The part that is missing is the
unattended un-enrollment prior to the systems re-install.

I am trying to find a place in the workflow up untill the
reboot-before-reinstall sequence to have a script started that does this.
Koan would be the ideal candidate, but it does not give this possibility.

The RFE solves this problem. I can save the keytab before re-installation
and get it back afterwards. Then I can call ipa-client-install with the old
keytab to enroll the client, revoke the old keytab and get a new one in one
go.

I have already also asked about this on the satellite-user mailing-list.

Fred


>

>
>
> On Fri, Jan 25, 2013 at 8:35 AM, Fred van Zwieten <fvzwieten at vxcompany.com
> > wrote:
>
>> And, using the ipa command is only possible on ipa clients.
>>
>> Although our Satellite server is an IPA client, I am (as of yet) unable
>> to execute ipa commands from any ipa client prior to the re-install request
>> from Satellite. There is, afaik, no such thing as a pre-reinstall hook or
>> anything like that.
>>
>> As for the ipa-host-mod --password=foo thing. You can first run the
>> command "ipa disable-host <fqdn> and _then_ run "ipa host-mod <fqdn>
>> --password=foo
>>
>>
>> Met vriendelijke groeten,
>> *
>> Fred van Zwieten
>> *
>> *Enterprise Open Source Services*
>> *
>> Consultant*
>> *(vrijdags afwezig)*
>>
>> *VX Company IT Services B.V.*
>> *T* (035) 539 09 50 mobiel (06) 41 68 28 48
>> *F* (035) 539 09 08
>> *E* fvzwieten at vxcompany.com
>> *I*  www.vxcompany.com
>>
>>
>> On Fri, Jan 25, 2013 at 3:40 AM, Simo Sorce <simo at redhat.com> wrote:
>>
>>>  On Thu, 2013-01-24 at 21:36 -0500, Matthew Barr wrote:
>>> > On Jan 24, 2013, at 6:53 PM, Dmitri Pal <dpal at redhat.com> wrote:
>>> > >
>>> > > Yes you can set it again. This is how we envisioned the feature to
>>> be used.
>>> > > If it does not work it is a bug.
>>> >
>>> >
>>> > ipa-server-2.2.0-16.el6.x86_64, Centos 6.3
>>> >
>>> > [mbarr at ipa ~]$ ipa host-mod wiki01.ayisnap.com --password=foo
>>> > ipa: ERROR: invalid 'password': Password cannot be set on enrolled
>>> host.
>>>
>>> Matthew this is indeed the correct behavior, previous information from
>>> Dmitri was not correct.
>>>
>>> Once a host is enrolled you cannot reset the OTP password as that would
>>> effectively mean destroying the hosts credentials while the host is
>>> enrolled. Currently the IPA workflow expects you unenroll the client
>>> first.
>>>
>>> Simo.
>>>
>>> --
>>> Simo Sorce * Red Hat, Inc * New York
>>>
>>> _______________________________________________
>>> Freeipa-users mailing list
>>> Freeipa-users at redhat.com
>>> https://www.redhat.com/mailman/listinfo/freeipa-users
>>>
>>
>>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://listman.redhat.com/archives/freeipa-users/attachments/20130126/41214310/attachment.htm>