Meeting started at 2026-03-18 17:00:36 UTC

The Meeting name is 'fedora-server '

!hi

John Himpel (jwhimpel)

Welcome to our weekly Server WG meeting.

!hi

Sorry if my responses are a little slow sometimes. I just set up my new laptop today with a new GUI, so not everything works the way I'm used to.

Alexander Bokovoy (abbra) - he / him / his

I'll post the agenda in 2-3 minutes.

As usual, let's wait a moment for everybody to show up.

my internet connection is unstable today

!hello

Emmanuel Seyman (eseyman) - he / him / his

Again, welcome John Himpel abbra Emmanuel Seyman We meet our quorum, so let's start.

Any addition / modification ?

I'm good

Regarding the action, I'll include the list in our

https://docs.fedoraproject.org/en-US/server-working-group/wg-minutes-2026/

meetings overview:

Otherwise, nothing to announce from me.

Something to add here?

Obviously nothing. So let's go on.

Tracking issue: https://forge.fedoraproject.org/server/tickets/issues/186

As far as I see it, we have done all our release testings. No serious probs found.

Emmanuel Seyman: did you found something with your special cases?

No, nothing to report

OK.

Peter Robinson is hopeful that he will have rpi5 working by the release of f44. If he manages to do that, I will test that.

release 44? in the current arm u-boot package there is no rpi5. Or did I miss something?

Peter Boy (ServerWG, Docs): He has a raw image available that he has posted on fedoraplanet. It doesn't yet support nvme or usb attached external disks, but he thinks he will have that done by f44 release.

OK, then there is obviously a very late freeze exception.

Glad that's his problem and not mine.

I'll argue RPi5 support is a solid argument for a late-freeze exception

I think we need to move on.

Yes, I assume we're in agreement:

proposed !agreed The Server f44 installation media are ready for release.

Any objection?

I see no objection.

Nope, I'm ok with that

Anything else here?

I'm fine too.

OK, let's move on to the intesting part today

There might be last minute changes if we want to get Samba 4.24.0 which came out today

we already have release candidates in F44

Hm, that means again intensiv testing of the rc.

But it would be worth it, I guess.

Let's move on

Tracking issue: https://forge.fedoraproject.org/server/tickets/issues/184

Tracking issue: https://forge.fedoraproject.org/server/tickets/issues/189

Sorry for the copy&paste error

the second link is valid

So, the local KDC work is ongoing upstream. We have few components that will need to be built for Fedora first and then integrated. We are going to provide upstream state update in second half of April at SambaXP.

What is in the second link, though, valid in itself for FreeIPA and Active Directory deployments

without Local KDC

so we want to get it available as a general feature to Fedora 45. It is already in CentOS 10 Stream and will be in autumn's version of RHEL 10.

And I thought, Fedora is "first" 😏

Anyway, I've studied the demos. And as I understood, the first demo is our first original use case: NFS via logging in?

Yep, COPR repo for Fedora was first

The NFS on login requires S4U2Proxy (not just S4U2Self), that's in both demos as we demonstrate access to FreeIPA API

what needs to be expanded on is how to set it up with both FreeIPA and Samba AD (Active Directory)

Oh, I thought our case is just S4U2Self

that is something that should be in scope of Fedora Server documentation

S4U2Self is "I logged in with some method, now I want a Kerberos ticket locally". If I need to use Kerberos ticket to access some remote service (e.g. NFS or SMB server), that's 'local service behaving on behalf of a user', e.g. S4U2Proxy.

And S4U2Proxy is ready / included in the COPR version, too?

yes

it needs administrative configuration at the Kerberos realm level. So far this is supported by FreeIPA, Samba AD, and Microsoft's AD.

I couldn't install the COPR package, because I was busy with all the installation media testing. I want to do it tomorrow, install it in a VM. Can I already try NFS and if, how does it work?

yes, you can try. If you have FreeIPA, I can give instructions right away. For AD setup I need to find time to do them.

Well, FreeIPA would be fine.

That would be the standalone server use case, isn't it?

No, standalone server is when you don't have pre-existing Kerberos infrastructure

e.g. a single Fedora Server machine. Such machine will get its own Kerberos infrastructure with local KDC, once that is ready.

the Kerberos tickets issued by this local KDC will be valid within the machine itself, so SSH server transition to Kerberos tickets on public key authentication will work but presenting these Kerberos tickets to other machines will not currently work.

The latter will require extensions we are implementing together with Microsoft and will need application level help (e.g. IAKERB over SMB, for example).

OK, I get it.

And will the "other" case ready for F45, too? (or hopefully ready)?

We are aiming at that. Microsoft publicly announced they want to 'kill NTLM' by second half of this year which requires them to deliver IAKERB support for standalone Windows machines.

OK, that let's us hope.

(Hoping MS is more on time than with Windows 97

- getting local KDC basic support to Fedora by F45

For the purpose of our working group, following actions are needed:

- testing the proposed features. SSH protocol transition can be tested now against FreeIPA and Active Directory (Samba AD or Microsoft's implementation)

- testing and documenting use of SSH protocol transition for NFS + SMB home shares

Emmanuel Seyman: You did a lot with FreeIPA recently. Could you try the COPR package?

I haven't done anything with FreeIPA but I can give it a shot

Oh, then I missunterstood something.

Nevertheless, I would give it a try, too. abbra Could you provide us the informations you already have for FreeIPA?

will provide that

Thanks.

Any other questions?

OK, I see none, So, let's proceed.

No tracking issue

Has someone had a recent look at our list of issues and PRs?

Unfortunately, I was too busy with other things so far.

Obviously not.

So I propose to skip this today. And probably select 1-2 issues for discussion next meeting.

We should really try to clear our backlog there.

Even if it's boring.

The floor is open

I'll take a look at issues and PRs for our next meeting

!hi

Mat H (theprogram)

droppi g by late :)

better late than never

In docs there was some interest in making a "beginners guide to server"

that could have work started on it.

Jocelyn (she/her) (Server WG: Docs) was interested in getting that going, and I could work on it too

the ticket mentioning it is in docs https://forge.fedoraproject.org/docs/tickets/issues/8

Yes, that was an idea of me, and it was a long standing request from various users in the user discussion and mailing list.

So if anyone else wants to help, I'll put up a ticket in 'server' and jump in

unless there already is a ticket, i'll look

The problem / questions with those users was: After installation there is just a prompt. What can I do with that?

I'm sure we can address that

Yes, put a ticket in server. And I can contribute the ideas I have so far.

awesome, thanks

Unfortenately, I can't write a lot. I've too much on my plate.

not a problem, your suggestions will get us over the line

thats all from me!

So, we have a new project 😃

We would need such a guide specifically for the home server spin-off we are working on. But for the non-home-server as well.

I added FreeIPA-specific document to the ticket

Very good, FreeIPA is one of our central services with blocking status. But unfortunately so var w/o any documentation.

Well, time is nearly up.

So let's close, if there are no additional topics at the moment.

RHEL documentation is extensive and is the project documentation: https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/10#Identity%20Management. It has several dozen books.

OK, thanks! I'll have a look at it.

several dozen books...

Literally, there are ~20+ books there

Well, I'll start with the first. :-)

OK, let's close to today.

Bye bye and thanks erveryone for coming.!

See you next week, folks!