ROSA Server Setup

[galactus]

I try to setup the server, after successful installation.
Using the ROSA setup web-GUI, I encounter persistent problems with the Realm name, the message states "incorrect realm name" !?

Kerberos authentication with RDS backend
Realm akron.com : Incorrect realm
Kerberos realm (e.g., REALM.COM). Attention! It can be set only when the module is u.

I think this is probably a bug in the setup framework?

[ДроноваЮ]

Yes, please file a new bug on http://bugs.rosalinux.ru/, category 'server'.

[galactus]

Not a bug.. name MUST be in Capitals !

[ДроноваЮ]

Good.
ps -- I think we need a new forum for Server issues.

[galactus]

Agree, would be a good Idea..

[andrew.lukoshko]

Thanks for report. Here is the answer from RSS developer:

This error appears because of there is a convention to set the realm name in upper-case letters and today the realm check logic is oriented on this only.
http://web.mit.edu/kerberos/krb5-1.5/kr ... ealms.html

So to avoid this mistake it is need to enter the realm name in uppercase.
This is unnecessary restrictions which can be identified as a bug. It will be solved in the next RSS versions.

There are another (still undocumented) requirements for Kerberos in RSS:
1)You have to create the dns zone, where is ROSA Sever machine
2)You have to add the host for the Kerberos KDC machine (IP for this host should be equal to the IP for ROSA Server machine)
You can solve that via ROSA Management Console.

And it is desirable to don't forget to update your /etc/resolv.conf by adding a record for your DNS name server.

If all was configured correctly then the commands
host <your ROSA server machine IP>
host <your Kerberos KDC machine hostname>
don't return any errors.

Since this moment Kerberos is ready to be configured.

[galactus]

Thanks Andrew,

That was exactly where I stuck...the undocumented features

I see great potential for ROSA Server filling the gap in central user and resource management

[andrew.lukoshko]

You're welcome and thanks for feedback!
We will try to improve Kerberos-related RSS behavior in updates.