Create accountLogin

Recent searches

No recent searches

Search options

Only available when logged in.
mastodon.world is one of the many independent Mastodon servers you can use to participate in the fediverse.
Generic Mastodon server for anyone to use.

Administered by:

Server stats:

8.9K
active users

mastodon.world: AboutStatusProfiles directoryPrivacy policy

Mastodon: AboutGet the appKeyboard shortcutsView source codev4.3.8

#yesterdayatwork

1 post1 participant0 posts today
Alexander Bokovoy<p><a href="https://mastodon.social/tags/YesterdayAtWork" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>YesterdayAtWork</span></a>: <br>It is a Red Hat Summit's week and I'm in Boston.<br>- ran a talk about post-quantum crypto in RHEL together with <span class="h-card" translate="no"><a href="https://fosstodon.org/@simo5" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@<span>simo5</span></a></span> and Amy.<br>- gave 4 lightning talks about different <a href="https://mastodon.social/tags/FreeIPA" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>FreeIPA</span></a> features that we either have implemented recently or are working upstream:<br> - `ipa-migrate`<br> - `ipa-tuura` integration with <a href="https://mastodon.social/tags/Keycloak" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Keycloak</span></a><br> - IPA-IPA trust demo<br> - dynamic inventory in ansible-freeipa<br> - had a bunch of meetings with customers, tomorrow will have more<br> - met a lot of <a href="https://mastodon.social/tags/FreeIPA" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>FreeIPA</span></a> users</p>
Alexander Bokovoy<p><a href="https://mastodon.social/tags/YesterdayAtWork" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>YesterdayAtWork</span></a>: </p><p>- together with <span class="h-card" translate="no"><a href="https://mastodon.social/@cryptomilk" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@<span>cryptomilk</span></a></span> we've got <a href="https://mastodon.social/tags/localkdc" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>localkdc</span></a> to handle IP addresses associated with the host as aliases for Kerberos authentication. You'd be able to do SMB3 with Kerberos using IP address and still use Kerberos auth. This is work in progress.</p><p>- keep discussing with DocHelp folks IAKERB interop with Windows. Both sides need some work, which is exciting. MSFT also works on improvements in the collaboration area: <a href="https://bsky.app/profile/syfuhs.net/post/3lny4ppwevs2x" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">bsky.app/profile/syfuhs.net/po</span><span class="invisible">st/3lny4ppwevs2x</span></a></p><p>..</p>
Alexander Bokovoy<p><a href="https://mastodon.social/tags/YesterdayAtWork" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>YesterdayAtWork</span></a>, or rather for couple weeks: <br>- in <a href="https://mastodon.social/tags/FreeIPA" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>FreeIPA</span></a> completed DNSSEC support recovery after OpenSSL provider API migration<br>- in order to merge that upstream, we had to migrate to Fedora 42 builds in CI. This wasn't easy for our Azure CI<br>- python-dnspython removal in Fedora caused additional turmoil; luckily, Python team did react quickly (from bug to fix in F42 stable under one day)<br>- started looking into IP address-based aliases in local KDC together with <span class="h-card" translate="no"><a href="https://mastodon.social/@cryptomilk" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@<span>cryptomilk</span></a></span> <br>...</p>
Alexander Bokovoy<p><a href="https://mastodon.social/tags/YesterdayAtWork" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>YesterdayAtWork</span></a>: </p><p>Finished backporting FreeIPA Encrypted DNS support to Fedora. It took several steps, as <span class="h-card" translate="no"><a href="https://fosstodon.org/@pemensik" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@<span>pemensik</span></a></span> had to do DoT and OpenSSL provider API support backport to Bind 9.18 first, then I had to fix upgrade code that switched our Bind setup from OpenSSL engine use to OpenSSL provider.</p><p>These fixes landed in Fedora 42 updates-testing and in Rawhide, the packages are pretty much the same as in CentOS 10 Stream. However, that means ansible-freeipa cannot install them due to ...</p>
Alexander Bokovoy<p>Past week's <a href="https://mastodon.social/tags/YesterdayAtWork" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>YesterdayAtWork</span></a>: </p><p>- Discussed with Greg and Nico IAKERB changes we need to make sure local KDC-issued tickets can work in cross-realm environments. We need IAKERB spec update to clarify the error handling to allow exchanges to proceed properly and not to drop the connection. Todo: draft spec update proposal.</p><p>- Augeas CVE fix got merged upstream, one outstanding PR less.</p><p>- On the same topic, my VHS PR got closed but an alternative (3rd, already) fix was merged and it is working.</p>
Alexander Bokovoy<p><a href="https://mastodon.social/tags/YesterdayAtWork" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>YesterdayAtWork</span></a>: <br>- IAKERB realm discovery changes merged to MIT Kerberos development branch, as well as fixes to shortcut crashes. They'll appear in the next MIT Kerberos release. So we are good here.<br>- continue working on sysaccounts support API for <a href="https://mastodon.social/tags/FreeIPA" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>FreeIPA</span></a> <br>- helped <span class="h-card" translate="no"><a href="https://mastodon.social/@cryptomilk" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@<span>cryptomilk</span></a></span> with reviews in Kirmes. Basic userdb communication works fine now and Rust code is accessible from C apps. Next step is to find out how we can do proper async stuff as Rust version of libvarlink cannot do async yet.</p>
Alexander Bokovoy<p><a href="https://mastodon.social/tags/YesterdayAtWork" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>YesterdayAtWork</span></a>: </p><p>Thursday/Friday were spent in iakerb land. We mostly fixed realm discovery, found a bug in iakerb state machine shortcuts that existed for ~10 years if not more. There is an issue in mixed use of Kerberos and IAKerb mechs which we cannot currently solve, so this will be handled later.</p><p>Next part is to fix Samba command line processing. Samba cannot combine an explicit user name and a credentials cache on the command line. This needs to be fixed but there are edge cases.</p>
Alexander Bokovoy<p><a href="https://mastodon.social/tags/YesterdayAtWork" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>YesterdayAtWork</span></a>: </p><p>- When adjusting full 32-bit IDs pull request to review comments, found a bug in a separate upgrade plugin in <a href="https://mastodon.social/tags/FreeIPA" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>FreeIPA</span></a>. The issue shouldn't happen in normal situation, uncovered by my new changes only. The PR is acked now, so should land in release branches soon.</p><p>- Got IAKerb discovery working for both client and target names. Found out that Wireshark parsing of IAKerb does not support discovery operations. Need a fix!</p><p>...</p>
Alexander Bokovoy<p><a href="https://mastodon.social/tags/YesterdayAtWork" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>YesterdayAtWork</span></a>: (more of end of past week + today)<br>- worked with <span class="h-card" translate="no"><a href="https://mastodon.social/@cryptomilk" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@<span>cryptomilk</span></a></span> on IAKerb discovery in MIT Kerberos. Submitted <a href="https://github.com/krb5/krb5/pull/1415" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="">github.com/krb5/krb5/pull/1415</span><span class="invisible"></span></a> which implements client side of the default server realm discovery. It needs target service realm propagation as well but we need to discuss things with MIT first.</p><p>- finished 32-bit ID range support, tests also work in <a href="https://github.com/freeipa/freeipa/pull/7713" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">github.com/freeipa/freeipa/pul</span><span class="invisible">l/7713</span></a>.</p><p>- close to finishing eDNS design doc review and prepare for FreeIPA upstream release.</p>
Alexander Bokovoy<p><a href="https://mastodon.social/tags/YesterdayAtWork" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>YesterdayAtWork</span></a>: </p><p>- meetings, meetings</p><p>- first cut of 32-bit ID ranges support in <a href="https://mastodon.social/tags/FreeIPA" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>FreeIPA</span></a>. Next step is to actually test a switch over procedure and write docs</p><p>- talked to <span class="h-card" translate="no"><a href="https://hachyderm.io/@SteveSyfuhs" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@<span>SteveSyfuhs</span></a></span> on how we can get early interop with Windows version of localkdc/iakerb. Hopefully, something will come out before SDC IOLab.</p><p>- Julien submitted a PR to support multiple master keys in FreeIPA. ToDo: tests and review, but it looks promising.</p>
Alexander Bokovoy<p><a href="https://mastodon.social/tags/YesterdayAtWork" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>YesterdayAtWork</span></a>: </p><p>- getting closer to replace outdated vagrant VMs with ipalab-config-based setup for <a href="https://mastodon.social/tags/FreeIPA" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>FreeIPA</span></a> modern Web UI development. Some issues with Cypress tests still need to be figured out</p><p>- Greg did merge alias support to KDB. All basic infra for localkdc is now in MIT <a href="https://mastodon.social/tags/Kerberos" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Kerberos</span></a> upstream.</p>
Alexander Bokovoy<p><a href="https://mastodon.social/tags/YesterdayAtWork" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>YesterdayAtWork</span></a>: <br>- finished up bits and pieces of the <a href="https://mastodon.social/tags/FreeIPA" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>FreeIPA</span></a> local tests repo, <a href="https://github.com/abbra/freeipa-local-tests/" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">github.com/abbra/freeipa-local</span><span class="invisible">-tests/</span></a></p><p>- made a minimal demo lab available. It produces one server and one enrolled client, with a purpose to demonstrate how to extend a demo (including video recording). </p><p>- started libouath2 2.1.0 packaging but was stopped by the mainframe builds lagging. Will finish today.</p><p>Published a blog: <a href="https://vda.li/en/posts/2025/02/14/FreeIPA-local-tests/" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">vda.li/en/posts/2025/02/14/Fre</span><span class="invisible">eIPA-local-tests/</span></a></p>
Alexander Bokovoy<p><a href="https://mastodon.social/tags/YesterdayAtWork" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>YesterdayAtWork</span></a>: <br>- mostly Thursday-Monday, really.</p><p>- worked on encrypted DNS PR review for FreeiPA. Found some issues but in the end we solved all what mattered and the PR merged upstream. No release yet as we need remaining package updates in Fedora/CentOS Stream first. C10S builds today.</p><p>- Samba 4.22.0RC1 is in F42/F43(Rawhide) with SMB3 UNIX extensions enabled by default. Needs Linux 6.13+ with some kernel-side fixes but should finally give home directories on encrypted SMB3, full POSIX.</p>
Alexander Bokovoy<p>This will mostly go for the past week, not a day, as there were CentOS Connect and FOSDEM<br><a href="https://mastodon.social/tags/YesterdayAtWork" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>YesterdayAtWork</span></a>: <br>- travelled to Brussels on Wednesday<br>- attended CentOS Connect on Thursday/Friday. Lots of hallway track discussions.<br>- productive talks with alternative images SIG and hyperscale SIG folks on Thursday. Some clearing up of the potential issues in early boot that systemd folks weren't aware of. Our encrypted DNS work is popping up in interested places.</p><p>...</p>
Alexander Bokovoy<p><a href="https://mastodon.social/tags/YesterdayAtWork" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>YesterdayAtWork</span></a>: </p><p>This is mostly Friday-Sunday, preparation to FOSDEM is ongoing.</p><p>- got local KDC demos fully automated. It is a relief.<br>- in the process of doing them realised we need to rebuild Samba in the asn/localkdc COPR as newer Samba build went to Fedora. Andreas rebuilt it.<br>- Also we need update to Samba IAKerb support to work with existing Kerberos ccaches. <span class="h-card" translate="no"><a href="https://mastodon.social/@cryptomilk" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@<span>cryptomilk</span></a></span> will look at that<br>- more changes will be needed for easier UX (discover realms, foreign creds, etc)<br>...</p>
Alexander Bokovoy<p><a href="https://mastodon.social/tags/YesterdayAtWork" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>YesterdayAtWork</span></a>: </p><p>- rebuilt slapi-nis and python-whoosh in <a href="https://mastodon.social/tags/Fedora" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Fedora</span></a> rawhide after mass rebuild failures<br>- Greg continues to poke possible ACL issues with aliases in <a href="https://github.com/krb5/krb5/pull/1393" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="">github.com/krb5/krb5/pull/1393</span><span class="invisible"></span></a>. It is an interesting example of how to look at new features which take a little to implement but grow in scope.<br>- Trivino did a bit of reorganization for our demos, now ipalab-config demos are in a separate folder: <a href="https://github.com/abbra/freeipa-local-tests/tree/main/ipalab-config" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">github.com/abbra/freeipa-local</span><span class="invisible">-tests/tree/main/ipalab-config</span></a></p>
Alexander Bokovoy<p><a href="https://mastodon.social/tags/YesterdayAtWork" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>YesterdayAtWork</span></a>: </p><p>- looked at the fallout of Fedora mass rebuild with GCC 15. Few broken packages, nothing dramatic, small patches needed. Will work on the fixes today</p><p>- I'll fix python-whoosh this time but probably will have to disable internal tests. The only real dependency left in Fedora is mailman's web UI.</p><p>- Steve started looking at smb3.ko support for IAKerb and Local KDC. Found some bugs in localkdc package, will be looking at that today/tomorrow.</p>
Alexander Bokovoy<p><a href="https://mastodon.social/tags/YesterdayAtWork" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>YesterdayAtWork</span></a>: <br>- meetings<br>- got external IdP tests reintroduced to <a href="https://mastodon.social/tags/FreeIPA" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>FreeIPA</span></a> gating and client secret regression fixed (now in all branches). TODO: rebuild Fedora packages<br>- looked at python-whoosh which does not build in Rawhide. When fixing sphinx references got to a test that now fails on older Fedora. whoosh is not active upstream, things about to get orphaned again, it seems<br>- started working on bind-dyndb-ldap release to support bind 9.18. All patches are in git master...</p><p>...</p>
Alexander Bokovoy<p>Mostly Friday and Saturday but also today.<br><a href="https://mastodon.social/tags/YesterdayAtWork" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>YesterdayAtWork</span></a>: <br>- Worked on converting <a href="https://mastodon.social/tags/FreeIPA" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>FreeIPA</span></a> Web UI CI testing to use ipalab-config. Discovered in the process that some tests don't work with newer cypress. Also found that some logic in web ui components is different from what IPA allows to do.<br>- Fixed one fall off from CVE 2024-11029 fixes in IPA. A CI test for this use case isn't running due to changes in Keycloak and now I'm trying to improve that test<br>....</p>
Alexander Bokovoy<p><a href="https://mastodon.social/tags/YesterdayAtWork" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>YesterdayAtWork</span></a>: </p><p>- MSFT dochelp confirmed we'd need to support another checksum field in pkAuthenticator in PKINIT exchange to be able to use non-SHA1 checksums. This certainly can cause compatibility issues with older releases.<br>- On the other hand, Windows seems to have some difference when using ECDH vs FFDH in this scenario and the specs aren't really up to date, so both sides need some work.<br>- worked on converting freeipa-webui CI from use of vagrant to podman-compose + ipalab-config...</p>
ExploreLive feeds
About