<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
On 09/16/2011 11:19 AM, Johan Sunnerstig wrote:
<blockquote
cite="mid:47CE7527FAFAD348AEA328EB66E545A114E8EDEF@exchappvp1.adauriga.auriganet.net"
type="cite">
<meta http-equiv="Content-Type" content="text/html;
charset=ISO-8859-1">
<style id="owaParaStyle" type="text/css">P {margin-top:0;margin-bottom:0;}</style>
<div style="direction: ltr; font-family: Tahoma; color: rgb(0, 0,
0); font-size: 10pt;">Hello.<br>
I'm wondering if anyone has used FreeIPA with Debian clients,
and if so, what client software you opted to use?<br>
Right now I have nss-pam-ldapd
(<a class="moz-txt-link-freetext" href="http://arthurdejong.org/nss-pam-ldapd/">http://arthurdejong.org/nss-pam-ldapd/</a>) and the MIT-based krb
software that's included in Debian 6 working decently. By that I
mean I can use it to allow logins as expected, but so far I
haven't worked out allowing or disallowing login based on group
membership.<br>
<br>
Obviously the best solution would be a "real" IPA client, but
has anyone attempted this? I mucked around a bit with the SSSD
included in the Debian repos(1.2.1) but didn't get it to work.
Though in all fairness I didn't try THAT hard since it seems
like SSSD has evolved quite a bit since 1.2.1.<br>
Is the SSSD route worthwhile?<br>
</div>
</blockquote>
<br>
If you can get SSSD 1.5.x (latest) working that would be best avenue
as it supports natively IPA host based access control features.<br>
If you manage to do so we will help you to setup it manually. If you
as a result of this would be able to share youer experience and
create a wiki page with the steps need to do all this manually would
be awesome.<br>
<br>
An alternative would be to try and port ipa-client to Debian.<br>
<br>
<blockquote
cite="mid:47CE7527FAFAD348AEA328EB66E545A114E8EDEF@exchappvp1.adauriga.auriganet.net"
type="cite">
<div style="direction: ltr; font-family: Tahoma; color: rgb(0, 0,
0); font-size: 10pt;">
<br>
I really just need group based logins, sudo controls I can
handle based on groups with Puppet, but again, if the real
client route isn't too much work that's of course preferable.<br>
</div>
</blockquote>
<br>
If you want something simple there might be some options in the nss
ldap but you need to dig it from man pages or from Nalin...<br>
<blockquote
cite="mid:47CE7527FAFAD348AEA328EB66E545A114E8EDEF@exchappvp1.adauriga.auriganet.net"
type="cite">
<div style="direction: ltr; font-family: Tahoma; color: rgb(0, 0,
0); font-size: 10pt;">
<br>
I hope this makes sense, late friday and I have a horrible
headache, so if it doesn't I apologize in advance. :)<br>
<br>
Regards<br>
Johan<br>
</div>
<pre wrap="">
<fieldset class="mimeAttachmentHeader"></fieldset>
_______________________________________________
Freeipa-users mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Freeipa-users@redhat.com">Freeipa-users@redhat.com</a>
<a class="moz-txt-link-freetext" href="https://www.redhat.com/mailman/listinfo/freeipa-users">https://www.redhat.com/mailman/listinfo/freeipa-users</a></pre>
</blockquote>
<br>
<br>
<pre class="moz-signature" cols="72">--
Thank you,
Dmitri Pal
Sr. Engineering Manager IPA project,
Red Hat Inc.
-------------------------------
Looking to carve out IT costs?
<a class="moz-txt-link-abbreviated" href="http://www.redhat.com/carveoutcosts/">www.redhat.com/carveoutcosts/</a>
</pre>
</body>
</html>