LXC and FreeIPA

[thinkdez]

I am currently migrating some VM's to LXC's and I use FreeIPA for authentication etc. I was able to install the FreeIPA client on the LXC using the --no-ntp flag but when I try to login with a user account I get an error:

sshd[3742]: fatal: initgroups: testuser: Invalid argument

I believe this is due to the LXC being unprivleged and I tried to map the users but the documentation I am reading is confusing me.

Should I be joining my Proxmox VE host to FreeIPA first? Then map the UID and GID's to the LXC Guest? OR can I just do a direct connection to the LXC?

Does this bind the LXC to a specific host or if I copy the config to all hosts in the cluster will I be able to migrate my LXC's across hosts?

I came from a VMWare background so I have this mentality to not modify the Host system as little as possible but this doesn't seem to be the case with Proxmox.

Thanks

 

[thinkdez]

Found a solution to this thanks to @Judge

J

Thread 'How to handle unprivileged containers and large UIDs/GIDs?'

Jul 14, 2021

Hi everyone,

I am facing the issue that our central authentication service (FreeIPA) is using quite large UIDs/GIDs (the range is 1546400000 - 1546600000) and unprivileged containers seem to not be able to deal with this. To make this work, it seems like there are two things necessary to change manually for each Proxmox Host and, what's even more inconvenient, for each container after their creation:

1. On the Host:
   Align /etc/subgid and /etc/subuid to generally allow the ranges on that host.
2. Per Container:
   Add the lxc.idmap values to the container's config file...

• Judge
• Replies: 5
• Forum: Proxmox VE: Installation and configuration