<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
Hi Sumit,<br>
<br>
Your test packages and configuration changes are working very well.
I See no issues with the two machines on which the fixes were
applied. The two systems are running Scientific LInux 7.2 and
Centos 7.2. I will continue to perform more tests to see if there
are any issues.<br>
<br>
I do have another question to ask you in the meantime. The question
was asked, "How long would it take for these changes to make there
way into the current repos?" Do you think it will take few weeks,
or will we need to wait for the next point release? We are just
trying to determine how to proceed in rolling out the packages.<br>
<br>
Thanks again,<br>
<br>
<div class="moz-signature"><b>Michael Rainey</b><br>
<br>
</div>
<div class="moz-cite-prefix">On 03/24/2016 05:09 AM, Sumit Bose
wrote:<br>
</div>
<blockquote cite="mid:20160324100916.GG18816@p.redhat.com"
type="cite">
<pre wrap="">On Wed, Mar 23, 2016 at 12:25:50PM -0500, Michael Rainey (Contractor) wrote:
</pre>
<blockquote type="cite">
<pre wrap="">Hi Sumit,
I've trying to download the rpm via the Koji client and have been unable to
locate package. Are there any extra steps I need to complete before I can
find the package, such as, create an account in Fedora Build System.
Performing a general search for SSSD only returns a list of packages from
Fedora Projects and nothing from the EL repo.
</pre>
</blockquote>
<pre wrap="">
The link I sent is the meta link for the different supported platforms
(x86_64, pcc64 and pcc64le). If you select the link for x86_64 you
should be able to see download links for the x86_64 packages.
Nevertheless I created a new build
<a class="moz-txt-link-freetext" href="http://koji.fedoraproject.org/koji/taskinfo?taskID=13446490">http://koji.fedoraproject.org/koji/taskinfo?taskID=13446490</a> to fix some
issue with the package version number in the previous build. The x86_64
packages can be found at
<a class="moz-txt-link-freetext" href="http://koji.fedoraproject.org/koji/taskinfo?taskID=13446491">http://koji.fedoraproject.org/koji/taskinfo?taskID=13446491</a> . To make
the download easy you can try the following command:
curl <a class="moz-txt-link-freetext" href="http://koji.fedoraproject.org/koji/taskinfo?taskID=13446491">http://koji.fedoraproject.org/koji/taskinfo?taskID=13446491</a> | grep -o '<a class="moz-txt-link-rfc2396E" href="https://.*.rpm">"https://.*.rpm"</a>' | xargs -n 1 curl -L -O
HTH
bye,
Sumit
</pre>
<blockquote type="cite">
<pre wrap="">
Thanks,
*Michael Rainey*
NRL 7320
Computer Support Group
Building 1009, Room C156
Stennis Space Center, MS 39529
On 03/22/2016 07:25 AM, Sumit Bose wrote:
</pre>
<blockquote type="cite">
<pre wrap="">On Fri, Mar 18, 2016 at 10:53:08AM -0500, Michael Rainey (Contractor) wrote:
</pre>
<blockquote type="cite">
<pre wrap="">Hi Sumit,
It has been a week and I am following up with you on the lock screen issue.
Have you had any progress? If so, I am hoping implementing the fix will be
quick and easy.
</pre>
</blockquote>
<pre wrap="">Thank you for your patience. Please find a test build for RHEL/CentOS
7.2 at <a class="moz-txt-link-freetext" href="https://koji.fedoraproject.org/koji/taskinfo?taskID=13412048">https://koji.fedoraproject.org/koji/taskinfo?taskID=13412048</a> .
Besides the updated version of SSSD you should replace
/etc/pam.d/smartcard-auth with
======== /etc/pam.d/smartcard-auth =========
auth required pam_env.so
auth sufficient pam_sss.so allow_missing_name
auth required pam_deny.so
account required pam_unix.so
account sufficient pam_localuser.so
account sufficient pam_succeed_if.so uid < 1000 quiet
account [default=bad success=ok user_unknown=ignore] pam_sss.so
account required pam_permit.so
session optional pam_keyinit.so revoke
session required pam_limits.so
-session optional pam_systemd.so
session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session required pam_unix.so
session optional pam_sss.so
===========================================
and /etc/dconf/db/distro.d/10-authconfig
===== /etc/dconf/db/distro.d/10-authconfig =====
[org/gnome/login-screen]
enable-fingerprint-authentication=false
[org/gnome/settings-daemon/peripherals/smartcard]
removal-action='lock-screen'
===============================================
and /etc/dconf/db/distro.d/locks/10-authconfig-locks
====== /etc/dconf/db/distro.d/locks/10-authconfig-locks ===
/org/gnome/login-screen/enable-fingerprint-authentication
/org/gnome/settings-daemon/peripherals/smartcard
===========================================================
and call 'dconf update' to get the new setting loaded. Finally it might
be a good idea to restart gdm to make sure the new setting and PAM
configuration is really active although I would expect that gdm is able
to pick up the changes at run-time.
Any feedback, good or bad, is welcome.
bye,
Sumit
</pre>
<blockquote type="cite">
<pre wrap="">Thanks,
*Michael Rainey*
On 03/11/2016 02:32 AM, Sumit Bose wrote:
</pre>
<blockquote type="cite">
<pre wrap="">On Thu, Mar 10, 2016 at 01:36:15PM -0600, Michael Rainey (Contractor) wrote:
</pre>
<blockquote type="cite">
<pre wrap="">Greetings,
I have been adding systems to my new domain and utilizing the smart card
login feature. To date the smart card login feature is working very well.
However, my group has been trying to implement locking the screen when the
smart card is removed, but have not been successful at making it work. Does
anyone have any suggestions as to what it would take to enable locking the
screen when the smart card is removed.
</pre>
</blockquote>
<pre wrap="">This requires a better integration with gdm which is currently WIP
(<a class="moz-txt-link-freetext" href="https://fedorahosted.org/sssd/ticket/2941">https://fedorahosted.org/sssd/ticket/2941</a>). If you don't mind please
ping me in about a week about this again, then I might have done some
more testing.
bye,
Sumit
</pre>
<blockquote type="cite">
<pre wrap="">Thank you in advance.
--
*Michael Rainey*
--
Manage your subscription for the Freeipa-users mailing list:
<a class="moz-txt-link-freetext" href="https://www.redhat.com/mailman/listinfo/freeipa-users">https://www.redhat.com/mailman/listinfo/freeipa-users</a>
Go to <a class="moz-txt-link-freetext" href="http://freeipa.org">http://freeipa.org</a> for more info on the project
</pre>
</blockquote>
</blockquote>
<pre wrap="">--
Manage your subscription for the Freeipa-users mailing list:
<a class="moz-txt-link-freetext" href="https://www.redhat.com/mailman/listinfo/freeipa-users">https://www.redhat.com/mailman/listinfo/freeipa-users</a>
Go to <a class="moz-txt-link-freetext" href="http://freeipa.org">http://freeipa.org</a> for more info on the project
</pre>
</blockquote>
</blockquote>
<pre wrap="">
</pre>
</blockquote>
</blockquote>
<br>
</body>
</html>