<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<p><br>
</p>
<br>
<div class="moz-cite-prefix">On 12.04.2017 23:06, Jeremy Utley
wrote:<br>
</div>
<blockquote
cite="mid:CA+wSwnrtZRFcb0-ZYTqon9U80JidCZQo775onLVThTzY==xwqg@mail.gmail.com"
type="cite">
<div dir="ltr">Hello all! We've got 2 replicated instances of
FreeIPA 4.4.0 from the EPEL repository running on fully-updated
CentOS 7 instances. We're going thru an audit right now, and I
have to provide some proof of certain things related to IPA to
our auditors. Unfortunately, the person who originally set
these up evidently did not document the Directory Manager
password in our docs, so I was forced to reset this password,
using the process at:
<div><br>
</div>
<div><a moz-do-not-send="true"
href="http://directory.fedoraproject.org/docs/389ds/howto/howto-resetdirmgrpassword.html">http://directory.fedoraproject.org/docs/389ds/howto/howto-resetdirmgrpassword.html</a><br>
</div>
<div><br>
</div>
<div>This was successful, and I can now bind to the DS with the
new password. I'm now trying to follow the steps at:</div>
<div><br>
</div>
<div><a moz-do-not-send="true"
href="https://www.freeipa.org/page/Howto/Change_Directory_Manager_Password">https://www.freeipa.org/page/Howto/Change_Directory_Manager_Password</a></div>
<div><br>
</div>
<div>A few things are rather confusing to me. I've tried Google
searching without much luck either. So hopefully you guys can
answer a few questions for me.</div>
<div><br>
</div>
<div>1) First off, the doc says:</div>
<div><br>
</div>
<div><span style="color:rgb(0,0,0);font-family:"source sans
pro",sans-serif;font-size:14px;background-color:rgb(222,243,254)">The
following procedure is only applicable to FreeIPA 3.2.1 or
older. Since FreeIPA 3.2.2 (and ticket </span><a
moz-do-not-send="true" rel="nofollow" class="external
gmail-text"
href="https://fedorahosted.org/freeipa/ticket/3594"
style="color:rgb(78,154,6);text-decoration-line:none;font-weight:600;background:url("images/lock-icon.png")
100% 50% no-repeat
rgb(222,243,254);padding-right:13px;font-family:"source
sans pro",sans-serif;font-size:14px">#3594</a><span
style="color:rgb(0,0,0);font-family:"source sans
pro",sans-serif;font-size:14px;background-color:rgb(222,243,254)">),
the procedure is automated as a part of preparing a replica
info file by using </span><tt
style="color:rgb(0,0,0);font-size:14px;background-color:rgb(222,243,254)">ipa-replica-prepare</tt><br>
</div>
<div><tt
style="color:rgb(0,0,0);font-size:14px;background-color:rgb(222,243,254)"><br>
</tt></div>
<div>So do I even need to perform these steps at all,
considering I'm well beyond 3.2.2. We don't have any
intention of running ipa-replica-prepare for the forseeable
future (we shouldn't ever need to add a third directory server
here).</div>
<div><br>
</div>
<div>2) The first step (Update LDAP bind password) seems to
indicate you're adding the new password in clear-text to the
password.conf file - this seems like a major security issue.
Am I misunderstanding what is being requested here? The old
password is not in this file (All my current files have is
lines for "internal" and "replicationdb"</div>
<div><br>
</div>
<div>3) The next step regenerates the cacert.p12 file, but seems
to do nothing with it, just leaves it sitting in /root - what
should be done with this file afterward?</div>
<div><br>
</div>
<div>Thanks for any help you can give!</div>
<div><br>
</div>
<div>Jeremy Utley</div>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
</blockquote>
<br>
Hello,<br>
<br>
you have to follow only this howto
<a class="moz-txt-link-freetext" href="http://directory.fedoraproject.org/docs/389ds/howto/howto-resetdirmgrpassword.html">http://directory.fedoraproject.org/docs/389ds/howto/howto-resetdirmgrpassword.html</a><br>
<br>
The PKI parts are relevant only for old IPA servers, so with newer
versions there is no need to manually update pki servers.<br>
<br>
Martin<br>
<pre class="moz-signature" cols="72">--
Martin Bašti
Software Engineer
Red Hat Czech</pre>
</body>
</html>