June 2024 - FreeIPA-users - Fedora mailing-lists

replica in DMZ with trust-agent
by slek kus 01 Jul '24

01 Jul '24

Hi I deployed a third replica in a dmz network for clients that do not route to the main ipa masters. Not sure if this is a workable setup. I can join clients using --fixed-primary and can logon with AD (one-way trust). This third replica has the trust-agent role. I might be approaching this incorrectly. Posting here for advise, has anyone attepted this and how to approach? It seems to be working, except the sudo rules. I have posted a diagram here: https://ibb.co/WkQj9yD

3 5

Unable to access LDAP server
by Meikel Bloch 30 Jun '24

30 Jun '24

Hey everyone, just tried to install freeipa on a hetzner cloud server cause i'm actually looking for alternative to UCS. I still dont get it, why FreeIPA is in need to be reachable on a public net, but thats not the point here. I have a clean, fresh Fedora 40 with running network, hostname resolves, also reverse dns - behind a OPNsense NAT Gateway with its own ipv4 public ip. I have opened the Ports 389 & 636 When trying to run ipa-server-install, the following error occurs, where i cant understand why it cant access the LDAP server. I've checked up with nmap - port is open. Further LDAP service seems to run. Maybe someone has an idea whats going on? INFO: Loading PKI Tomcat config: /usr/share/pki/etc/tomcat.conf INFO: Connecting to LDAP server at ldap://fsn-ipa.domain.tld:389 ERROR: Unable to access LDAP server: ldap://fsn-ipa.domain.tld:389 Traceback (most recent call last): File "<frozen runpy>", line 198, in _run_module_as_main File "<frozen runpy>", line 88, in _run_code File "/usr/lib/python3.12/site-packages/pki/server/pkispawn.py", line 987, in <module> main(sys.argv) File "/usr/lib/python3.12/site-packages/pki/server/pkispawn.py", line 560, in main check_ds() File "/usr/lib/python3.12/site-packages/pki/server/pkispawn.py", line 722, in check_ds verify_ds_configuration() File "/usr/lib/python3.12/site-packages/pki/server/pkispawn.py", line 58, in verify_ds_configuration deployer.ds_bind() File "/usr/lib/python3.12/site-packages/pki/server/deployment/__init__.py", line 2442, in ds_bind self.ds_connection.simple_bind_s( File "/usr/lib64/python3.12/site-packages/ldap/ldapobject.py", line 248, in simple_bind_s msgid = self.simple_bind(who,cred,serverctrls,clientctrls) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/usr/lib64/python3.12/site-packages/ldap/ldapobject.py", line 242, in simple_bind return self._ldap_call(self._l.simple_bind,who,cred,RequestControlTuples(serverctrls),RequestControlTuples(clientctrls)) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/usr/lib64/python3.12/site-packages/ldap/ldapobject.py", line 128, in _ldap_call result = func(*args,**kwargs) ^^^^^^^^^^^^^^^^^^^^ ldap.SERVER_DOWN: {'result': -1, 'desc': "Can't contact LDAP server", 'errno': 107, 'ctrls': [], 'info': 'Transport endpoint is not connected'} 2024-06-29T10:58:32Z CRITICAL Failed to configure CA instance 2024-06-29T10:58:32Z CRITICAL See the installation logs and the following files/directories for more information: 2024-06-29T10:58:32Z CRITICAL /var/log/pki/pki-tomcat 2024-06-29T10:58:32Z DEBUG Traceback (most recent call last): File "/usr/lib/python3.12/site-packages/ipaserver/install/service.py", line 686, in start_creation run_step(full_msg, method) File "/usr/lib/python3.12/site-packages/ipaserver/install/service.py", line 672, in run_step method() File "/usr/lib/python3.12/site-packages/ipaserver/install/cainstance.py", line 678, in __spawn_instance DogtagInstance.spawn_instance( File "/usr/lib/python3.12/site-packages/ipaserver/install/dogtaginstance.py", line 227, in spawn_instance self.handle_setup_error(e) File "/usr/lib/python3.12/site-packages/ipaserver/install/dogtaginstance.py", line 609, in handle_setup_error raise RuntimeError( RuntimeError: CA configuration failed. 2024-06-29T10:58:32Z DEBUG [error] RuntimeError: CA configuration failed. 2024-06-29T10:58:32Z DEBUG Removing /root/.dogtag/pki-tomcat/ca 2024-06-29T10:58:32Z DEBUG File "/usr/lib/python3.12/site-packages/ipapython/admintool.py", line 180, in execute return_value = self.run() ^^^^^^^^^^ File "/usr/lib/python3.12/site-packages/ipapython/install/cli.py", line 344, in run return cfgr.run() ^^^^^^^^^^ File "/usr/lib/python3.12/site-packages/ipapython/install/core.py", line 360, in run return self.execute() ^^^^^^^^^^^^^^ File "/usr/lib/python3.12/site-packages/ipapython/install/core.py", line 386, in execute for rval in self._executor(): File "/usr/lib/python3.12/site-packages/ipapython/install/core.py", line 435, in __runner exc_handler(exc_info) File "/usr/lib/python3.12/site-packages/ipapython/install/core.py", line 468, in _handle_execute_exception self._handle_exception(exc_info) File "/usr/lib/python3.12/site-packages/ipapython/install/core.py", line 458, in _handle_exception six.reraise(*exc_info) File "/usr/lib/python3.12/site-packages/six.py", line 719, in reraise raise value File "/usr/lib/python3.12/site-packages/ipapython/install/core.py", line 425, in __runner step() File "/usr/lib/python3.12/site-packages/ipapython/install/core.py", line 419, in step_next return next(self.__gen) ^^^^^^^^^^^^^^^^ File "/usr/lib/python3.12/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from six.reraise(*exc_info) File "/usr/lib/python3.12/site-packages/six.py", line 719, in reraise raise value File "/usr/lib/python3.12/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from value = gen.send(prev_value) ^^^^^^^^^^^^^^^^^^^^ File "/usr/lib/python3.12/site-packages/ipapython/install/core.py", line 663, in _configure next(executor) File "/usr/lib/python3.12/site-packages/ipapython/install/core.py", line 435, in __runner exc_handler(exc_info) File "/usr/lib/python3.12/site-packages/ipapython/install/core.py", line 468, in _handle_execute_exception self._handle_exception(exc_info) File "/usr/lib/python3.12/site-packages/ipapython/install/core.py", line 526, in _handle_exception self.__parent._handle_exception(exc_info) File "/usr/lib/python3.12/site-packages/ipapython/install/core.py", line 458, in _handle_exception six.reraise(*exc_info) File "/usr/lib/python3.12/site-packages/six.py", line 719, in reraise raise value File "/usr/lib/python3.12/site-packages/ipapython/install/core.py", line 523, in _handle_exception super(ComponentBase, self)._handle_exception(exc_info) File "/usr/lib/python3.12/site-packages/ipapython/install/core.py", line 458, in _handle_exception six.reraise(*exc_info) File "/usr/lib/python3.12/site-packages/six.py", line 719, in reraise raise value File "/usr/lib/python3.12/site-packages/ipapython/install/core.py", line 425, in __runner step() File "/usr/lib/python3.12/site-packages/ipapython/install/core.py", line 419, in step_next return next(self.__gen) ^^^^^^^^^^^^^^^^ File "/usr/lib/python3.12/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from six.reraise(*exc_info) File "/usr/lib/python3.12/site-packages/six.py", line 719, in reraise raise value File "/usr/lib/python3.12/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from value = gen.send(prev_value) ^^^^^^^^^^^^^^^^^^^^ File "/usr/lib/python3.12/site-packages/ipapython/install/common.py", line 65, in _install for unused in self._installer(self.parent): File "/usr/lib/python3.12/site-packages/ipaserver/install/server/__init__.py", line 608, in main master_install(self) File "/usr/lib/python3.12/site-packages/ipaserver/install/server/install.py", line 278, in decorated func(installer) File "/usr/lib/python3.12/site-packages/ipaserver/install/server/install.py", line 960, in install ca.install_step_0(False, None, options, custodia=custodia) File "/usr/lib/python3.12/site-packages/ipaserver/install/ca.py", line 607, in install_step_0 ca.configure_instance( File "/usr/lib/python3.12/site-packages/ipaserver/install/cainstance.py", line 515, in configure_instance self.start_creation(runtime=runtime) File "/usr/lib/python3.12/site-packages/ipaserver/install/service.py", line 686, in start_creation run_step(full_msg, method) File "/usr/lib/python3.12/site-packages/ipaserver/install/service.py", line 672, in run_step method() File "/usr/lib/python3.12/site-packages/ipaserver/install/cainstance.py", line 678, in __spawn_instance DogtagInstance.spawn_instance( File "/usr/lib/python3.12/site-packages/ipaserver/install/dogtaginstance.py", line 227, in spawn_instance self.handle_setup_error(e) File "/usr/lib/python3.12/site-packages/ipaserver/install/dogtaginstance.py", line 609, in handle_setup_error raise RuntimeError( 2024-06-29T10:58:32Z DEBUG The ipa-server-install command failed, exception: RuntimeError: CA configuration failed. 2024-06-29T10:58:32Z ERROR CA configuration failed. 2024-06-29T10:58:32Z ERROR The ipa-server-install command failed. See /var/log/ipaserver-install.log for more information

1 0

Strange user search result limits appeared
by Anton PalkoBrosov 28 Jun '24

28 Jun '24

I make some synchronization features with freeipa. For this i need to fetch users from LDAP db. By default search limit is 2000 users both in GUI and API. So i made modofications in freeipa configs ldapmodify -x -D "cn=Directory Manager" -W -H ldap://localhost dn: cn=config changetype: modify replace: nsslapd-sizelimit nsslapd-sizelimit: 20000000 so all started to work fine, for starter there were just around 3000 users in db so it worked fine, returned all users. then i started to generate new users to see perfomance of DB, so i used "pkey_only: true" in "user_find" command so when quantity of users reached 90k users it spend around 25sec to response, so ok its tolerable.... so all 90k+ users still returned by API So issue happened when quantity of users reached around 100к+ users, so search limit shrinked to 49629 users shrikage info started to add to responses "count": 49629, "truncated": true, "messages": [ { "type": "warning", "name": "SearchResultTruncated", "message": "Search result has been truncated: Configured administrative server limit exceeded", "code": 13017, "data": { "reason": "Configured administrative server limit exceeded" } } ] i do not do anything with freeipa server, just worked python script which generated users, script worked delicate and slow , he always waited for response from API that user created before creating another one user, so there were no high parallel overload on DB so i searched for nsslapd-sizelimit again with command: ldapsearch -x -D "cn=Directory Manager" -W -H ldap://localhost -b "cn=config" nsslapd-sizelimit but is showed normally nsslapd-sizelimit: 20000000 so with settings all fine, it shows that number that i set so what happened? Where freeipa get this strange limit in 49629 users and why? How to handle this? so projected size of LDAP DB is around 15 millons users I tried to workaround this with python ldap-3 library in hope it make some more low-level requests without any limits, but via python script i have this limit too, so its totally global for all, UI, API and python API... So how to remove this strange limit?

2 2

Strange users search limit appeared
by Anton PalkoBrosov 28 Jun '24

28 Jun '24

I make some synchronization features with freeipa. For this i need to fetch users from LDAP db. By default search limit is 2000 users both in GUI and API. So i made modofications in freeipa configs ldapmodify -x -D "cn=Directory Manager" -W -H ldap://localhost dn: cn=config changetype: modify replace: nsslapd-sizelimit nsslapd-sizelimit: 20000000 so all started to work fine, for starter there were just around 3000 users in db so it worked fine, returned all users. then i started to generate new users to see perfomance of DB, so i used "pkey_only: true" in "user_find" command so when quantity of users reached 90k users it spend around 25sec to response, so ok its tolerable.... so all 90k+ users still returned by API So issue happened when quantity of users reached around 100к+ users, so search limit shrinked to 49629 users shrikage info started to add to responses "count": 49629, "truncated": true, "messages": [ { "type": "warning", "name": "SearchResultTruncated", "message": "Search result has been truncated: Configured administrative server limit exceeded", "code": 13017, "data": { "reason": "Configured administrative server limit exceeded" } } ] i do not do anything with freeipa server, just worked python script which generated users, script worked delicate and slow , he always waited for response from API that user created before creating another one user, so there were no high parallel overload on DB so i searched for nsslapd-sizelimit again with command: ldapsearch -x -D "cn=Directory Manager" -W -H ldap://localhost -b "cn=config" nsslapd-sizelimit but is showed normally nsslapd-sizelimit: 20000000 so with settings all fine, it shows that number that i set so what happened? Where freeipa get this strange limit in 49629 users and why? How to handle this? so projected size of LDAP DB is around 15 millons users I tried to workaround this with python ldap-3 library in hope it make some more low-level requests without any limits, but via python script i have this limit too, so its totally global for all, UI, API and python API... So how to remove this strange limit?

2 3

Nfs Shares to Map Automatically
by Alper AYKUT 28 Jun '24

28 Jun '24

Hello, I have a total of 6 servers. Each user logs in to all servers separately and does their operations in their home directories. All Servers are Free IPA Registered. User Management Center. However, in the new structure, I plan a scenario like this. Users will only log in to the Master Server with their usernames. Under the /home/user directory of the Master server, the home directories of the 6 servers that it used to connect to will be shared with nfs. How can I mount the home directories of 6 servers shared with nfs to the Master Server. It can be with autofs or automount. The easiest way seemed to be Autofs, but when I run autofs, unfortunately the user authorization under the home directory on the Master Server is root. When I close autofs, it reverts back to user:user privileges. However, uid and gid are the same on all servers. Can you help me to solve this problem? Login Server: Master - 6 Home directories of the server I want to have a user-based map to the home directories that the user is authorized on the master server. Server1: Nfs sharing Server2: Nfs sharing Server3: Nfs sharing Server4: Nfs sharing Server5: Nfs sharing Server6: Nfs sharing

2 1

[SSSD] Announcing SSSD 2.10.0-beta2
by Pavel Březina 26 Jun '24

26 Jun '24

# SSSD 2.10.0-beta2 The SSSD team is announcing the release of version 2.10.0-beta2 of the System Security Services Daemon. The tarball can be downloaded from: https://github.com/SSSD/sssd/releases/tag/2.10.0-beta2 See the full release notes at: https://sssd.io/release-notes/sssd-2.10.0-beta2.html RPM packages will be made available for Fedora shortly. ## Feedback Please provide comments, bugs and other feedback via the sssd-devel or sssd-users mailing lists: https://lists.fedorahosted.org/mailman/listinfo/sssd-devel https://lists.fedorahosted.org/mailman/listinfo/sssd-users # SSSD 2.10-beta2 Release Notes ## Highlights ### General information * A number of minor glitches of `sssd-2.10.0-beta1` around building and packaging were fixed. ### Packaging changes * `sssd_pam` binary lost public `rx` bits and got `cap_dac_read_search=p` file capability to be able to use GSSAPI

1 0

Re: ipa upgrade failed
by Johannes Falke 25 Jun '24

25 Jun '24

How did you actually manage to resolve this issue? I'm seeing the same thing trying to upgrade either f35->f37 or f35->f36 (and NO ldap errors). On f35, freeipa says it's healthy.

3 4

Override Sudo Rule for one host
by Russ Long 25 Jun '24

25 Jun '24

I'm setting up a new FreeIPA cluster/environment, and have one host that I do not want included in my sudo rule that normally allows sudo to all hosts. Basically this machine is holding highly sensitive data, and will be used by multiple people who normally have sudo to all hosts, but I do not want them to have sudo on this host. I do not see a way to exclude a host, is the only option to add every other host manually to a rule or is there a way to "blacklist" a certain host in a sudo rule. --Russ

2 2

SMB share with IPA ID Views user and group mapping
by Yossi Hayat 25 Jun '24

25 Jun '24

Hi, To centrally manage all credentials from Active Directory, we configured FreeIPA integration with Active Directory to authenticate users to IPA-joined Linux machines via SSSD using AD credentials. The Linux machines have NFS shares mounted on their local filesystems which we use to work in a sharable way. We have configured FreeIPA "ID Views" for each user to override the AD-originating generic UID and GID with shorter UID and GID values. This is to preserve IPA-authenticated users' NFS permissions that were inherited from the previous Linux directory management system (NIS) we used and for simplicity. When working locally or remotely (SSH/VNC) on the Linux machines, everything is working as expected with no issues. Our problem is with SMB - We need to share the NFS shares over SMB for direct File Explorer access for Windows users. For this purpose, we have an Ubuntu machine we use as an SMB server. The server is joined to IPA as a client and has all NFS shares mounted locally on its filesystem. The ideal way is to somehow configure SMB to forward authentication to IPA (as it was a local/SSH authentication to the server) and map the ID views user and group IDs to preserve permissions. We searched all over the internet and didn't find a working solution for this use case. Is this supported? If yes, how can this be implemented?

2 2

Prevent domain-local groups from being mapped at all
by Ronald Wimmer 24 Jun '24

24 Jun '24

Is there a way for preventing AD domain-local groups from being mapped into IPA? From time to time colleagues try to use AD groups with scope 'domain local'. Personally, I do not see a use case for these groups mapped into IPA... Cheers, Ronald

2 1

Ranger FreeIPA Integration
by Mike Patterson 20 Jun '24

20 Jun '24

Anyone have success with integrating FreeIPA with Ranger? I have them sync-ed and it generally works, but I'm confused by the lack of attributes being shared by FreeIPA concerning Users. I'm unclear if FreeIPA isnt sharing attributes (beyond the most basic) via the LDAP protocol or if Ranger is not setup to read/display/use them or both. Any suggestions are greatly appreciated. Mike

2 3

Ranger FreeIPA Integration
by Mike Patterson 20 Jun '24

20 Jun '24

Anyone have success with integrating FreeIPA with Ranger? I have them sync-ed and it generally works, but I'm confused by the lack of attributes being shared by FreeIPA concerning Users. I'm unclear if FreeIPA isnt sharing attributes (beyond the most basic) via the LDAP protocol or if Ranger is not setup to read/display/use them or both. Any suggestions are greatly appreciated. Mike

1 0

Ranger FreeIPA Integration
by Mike Patterson 20 Jun '24

20 Jun '24

Anyone have success with integrating FreeIPA with Ranger? I have them sync-ed and it generally works, but I'm confused by the lack of attributes being shared by FreeIPA concerning Users. I'm unclear if FreeIPA isnt sharing attributes (beyond the most basic) via the LDAP protocol or if Ranger is not setup to read/display/use them or both. Any suggestions are greatly appreciated. Mike

1 0

FreeIPA on CentOS 7 fails with latest bind packages
by Jeremy Utley 19 Jun '24

19 Jun '24

Hello Everyone! We have a pair of IPA servers running under CentOS 7 (I know, EOL is approaching, and we are working on migrating!). When we applied the latest patches this morning, the new bind packages were causing named-pkcs11 to core dump during ipa-server-upgrade. The new package versions were: bind-9.11.4-26.P2.el7_9.16.x86_64 bind-dyndb-ldap-11.1-7.el7_9.1.x86_64.rpm The error we saw is almost identical to what is documented at: https://access.redhat.com/solutions/7065748 for RHEL8/9, but the recommended fixes did not help. We rolled our installation back to the previous bind packages and everything works again. I don't think there's anyplace remaining to submit CentOS 7 bug reports, and I'm also not sure if this same issue would impact the remaining RHEL 7 installs, since we have no RHEL licensing. So I thought I would put it out on here, so at least others are aware of the issue!

2 1

Re: Create IPA user via LDAP
by Ronald Wimmer 19 Jun '24

19 Jun '24

On 08.01.24 17:58, Alexander Bokovoy wrote: > On Пан, 08 сту 2024, Ronald Wimmer wrote: >> On 02.01.24 17:57, Ronald Wimmer via FreeIPA-users wrote: >>> On 02.01.24 16:27, Rob Crittenden wrote: >>>> Ronald Wimmer via FreeIPA-users wrote: >>>>> >>>>> >>>>> On 14.12.23 14:42, Alexander Bokovoy wrote: >>>>>> On Чцв, 14 сне 2023, Ronald Wimmer via FreeIPA-users wrote: >>>>>>> In our company we do have an IAM tool for user management. We >>>>>>> need to >>>>>>> create IPA users via this particular tool. I am aware of all IPA >>>>>>> commands or API calls to create/modify or delete a user. >>>>>>> >>>>>>> As the tool does not support FreeIPA yet they asked if there is a >>>>>>> way >>>>>>> to manage users by using LDAP only. Could that work? What about >>>>>>> attributes like ipaNTSecurityIdentifier, ipaUniqueID or uidNumber? >>>>>> >>>>>> Learn about lifecycle management. This is your way of integrating >>>>>> with >>>>>> such tools bvy creating staged users: >>>>>> https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/ht… >>>>>> >>>>> >>>>> I followed the instructions from the documentation. >>>>> >>>>> How could I possibly overcome >>>>> >>>>> Dec 19 09:18:39 tipa01.ipatest.mydomain.at ipa-activate-all[836863]: >>>>> ipa: ERROR: Constraint violation: pre-hashed passwords are not valid >>>>> >>>>> I need to set passwords from the external system. >>>> >>>> You need to enable migration mode (ipa config-mod --enable-migration >>>> true). >>>> >>>> By default a pre-hashed password can only be set once: during the user >>>> add operation. >>> >>> Ok. So this would not work for a password change. So if we need to >>> set an initial password and change that particular password in some >>> point in time the only feasible way is the IPA API, right? >>> >>> Can the immediate password expiration be overridden? >> >> As we have an upcoming please allow me to ask if I got the point here. >> >> I appreciate your support in this matter! >> > > I was looking over the code. The only way to accept pre-hashed passwords > is when they also have Kerberos keys set. This means you cannot use > external LDAP modify/add for that as you cannot create the Kerberos key > without knowing a Kerberos master key. > > So the only other option is to submit a clear-text password: > > userPassword: {CLEAR}text-password > > That will be accepted and if bind DN that performed this change is > either a cn=Directory Manager or a one from the passsync managers, it > would also not be marked for expiration immediately. If I try to set the userPassword attribute to some value with an LDAP browser and chose "plaintext" the value gets hashed immediately. I do see {PBKDF2_SHA256}. As a consequence the user cannot be activated. What am I doing wrong? I tried to enable migration mode and wanted to try it again but now I cannot connect to IPA's LDAP directory at all anymore... [root@tipa01 ~]# ipa config-mod --enable-migration=true Maximum username length: 32 Maximum hostname length: 64 Home directory base: /home Default shell: /bin/sh Default users group: ipausers Default e-mail domain: ipatest.mydomain.at Search time limit: 2 Search size limit: 100 User search fields: uid,givenname,sn,telephonenumber,ou,title Group search fields: cn,description Enable migration mode: True Certificate Subject base: O=IPATEST.MYDOMAIN.AT Password Expiration Notification (days): 4 Password plugin features: AllowNThash, KDC:Disable Last Success SELinux user map order: guest_u:s0$xguest_u:s0$user_u:s0$staff_u:s0-s0:c0.c1023$sysadm_u:s0-s0:c0.c1023$unconfined_u:s0-s0:c0.c1023 Default SELinux user: unconfined_u:s0-s0:c0.c1023 Default PAC types: MS-PAC, nfs:NONE IPA masters: tipa01.ipatest.mydomain.at, tipa02.ipatest.mydomain.at IPA master capable of PKINIT: tipa01.ipatest.mydomain.at, tipa02.ipatest.mydomain.at IPA CA servers: tipa01.ipatest.mydomain.at IPA CA renewal master: tipa01.ipatest.mydomain.at Domain resolution order: org.mydomain.at:ipatest.mydomain.at [root@tipa01 ~]# ipa config-mod --enable-migration=false ipa: ERROR: Major (851968): Unspecified GSS failure. Minor code may provide more information, Minor (2529638972): KDC returned error string: PROCESS_TGS

4 29

I am unable to install freeIPA server by dnf in Redhat Linux 8.1
by veck zuo 19 Jun '24

19 Jun '24

=> I am trying to deploy a freeIPA server in VM. Following the steps from https://www.freeipa.org/page/Quick_Start_Guide . I am unable to install the package by dnf . VM: [root@freeipa ~]# cat /etc/redhat-release Red Hat Enterprise Linux release 8.10 (Ootpa) [root@freeipa ~]# uname -r 4.18.0-372.9.1.el8.x86_64 [root@freeipa ~]# [root@freeipa ~]# dnf search freeipa-server Updating Subscription Management repositories. Last metadata expiration check: 0:13:36 ago on Sun 16 Jun 2024 12:57:13 AM CST. No matches found. [root@freeipa ~]#

2 1

How to grant sysaccount rights to change attributes of user (ldap bind)
by Se Fer 19 Jun '24

19 Jun '24

Hey there I provisioned a FreeIPA instance (IPA, version: 4.10.2, dockerized) to switch from atlassian crowd. For the ldap bind in i.e. Jira I created a sysaccount and already added it to "cn=System: Change User password,cn=permissions,cn=pbac,$SUFFIX". This way users can change their password in Jira itself. Now I want my users to be able to change their Display Name or Mail Address. Therefore I tried adding the sysaccount to "cn=System: Modify Users,cn=permissions,cn=pbac,$SUFFIX" but the changes do not get through to FreeIPA. There is no error displayed in Jira and I cannot find any hint within FreeIPA logs so far. Do you have any advice on how to proceed from here? Best regards Sefer

1 1

Re: `ipactl restart` fails with `Unknown error when retrieving list of services from LDAP: not enough values to unpack (expected 2, got 1)`
by Schwerdlin, Jason T RTX 18 Jun '24

18 Jun '24

Did you get a resolution to this? Were seeing the same thing when installing on Rocky9. Initial bring up is OK but after restart it fails. In our case it is because the ldap_uri line is missing from /etc/ipa/default.conf (the topic of the Redhat article) Once we manually insert that, we hit an error with krb5kdc and kadmin failing to start and we more or les follow the steps documented here to get them to start up: https://stackoverflow.com/questions/60273441/kerberos-service-started-with-…

1 0

freeipa behind loadbalancer? is it doable?
by slek kus 14 Jun '24

14 Jun '24

Hi, I have placed a load balancer (using netfilter's LVS) before both freeipa servers (main and replica). Trying to join a client pointing to this loadbalancer simply doesn't work. Firewall is tested and all needed ports are open and correctly forwarded to the freeipa nodes. Also tried adding the lb dns rec to the existing DNS record types, such as ldap, kerberos, ns, txt etc.. Has anyone attempted freeipa invalid behind an LB? Is this a terrible idea and if possible does anyone have any pointers? ADDING CLIENT RESULTS IN: Using existing certificate '/etc/ipa/ca.crt'. Skip idmlb.linux.redacted.invalid: LDAP server is not responding, unable to verify if this is an IPA server Failed to verify that idmlb.linux.redacted.invalid is an IPA Server. This may mean that the remote server is not up or is not reachable due to network or firewall settings. Please make sure the following ports are opened in the firewall settings: TCP: 80, 88, 389 UDP: 88 (at least one of TCP/UDP ports 88 has to be open) Also note that following ports are necessary for ipa-client working properly after enrollment: TCP: 464 UDP: 464, 123 (if NTP enabled) The ipa-client-install command failed. See /var/log/ipaclient-install.log for more information DEBUG: 2024-06-13T14:18:36Z DEBUG stderr= 2024-06-13T14:18:36Z DEBUG Deleting invalidalid keytab: '/etc/krb5.keytab'. 2024-06-13T14:18:36Z WARNING Using existing certificate '/etc/ipa/ca.crt'. 2024-06-13T14:18:36Z DEBUG [IPA Discovery] 2024-06-13T14:18:36Z DEBUG Starting IPA discovery with domain=linux.redacted.invalid, servers=['idmlb.linux.redacted.invalid'], hostname=happyhost.infra.redacted.invalid 2024-06-13T14:18:36Z DEBUG Server and domain forced 2024-06-13T14:18:36Z DEBUG [Kerberos realm search] 2024-06-13T14:18:36Z DEBUG Kerberos realm forced 2024-06-13T14:18:36Z DEBUG [LDAP server check] 2024-06-13T14:18:36Z DEBUG Verifying that idmlb.linux.redacted.invalid (realm LINUX.redacted.invalid) is an IPA server 2024-06-13T14:18:36Z DEBUG Init LDAP connection to: ldap://idmlb.linux.redacted.invalid:389 2024-06-13T14:18:36Z DEBUG LDAP Error: cannot connect to 'ldap://idmlb.linux.redacted.invalid:389': 2024-06-13T14:18:36Z WARNING Skip idmlb.linux.redacted.invalid: LDAP server is not responding, unable to verify if this is an IPA server 2024-06-13T14:18:36Z DEBUG Discovery result: NO_LDAP_SERVER; server=None, domain=linux.redacted.invalid, kdc=idmlb.linux.redacted.invalid, basedn=None 2024-06-13T14:18:36Z DEBUG Validated servers: 2024-06-13T14:18:36Z ERROR Failed to verify that idmlb.linux.redacted.invalid is an IPA Server. 2024-06-13T14:18:36Z ERROR This may mean that the remote server is not up or is not reachable due to network or firewall settings.

1 1

Strange user search result limits appeared
by Anton PalkoBrosov 12 Jun '24

12 Jun '24

I make some synchronization features with freeipa. For this i need to fetch users from LDAP db. By default search limit is 2000 users both in GUI and API. So i made modofications in freeipa configs ldapmodify -x -D "cn=Directory Manager" -W -H ldap://localhost dn: cn=config changetype: modify replace: nsslapd-sizelimit nsslapd-sizelimit: 20000000 so all started to work fine, for starter there were just around 3000 users in db so it worked fine, returned all users. then i started to generate new users to see perfomance of DB, so i used "pkey_only: true" in "user_find" command so when quantity of users reached 90k users it spend around 25sec to response, so ok its tolerable.... so all 90k+ users still returned by API So issue happened when quantity of users reached around 100к+ users, so search limit shrinked to 49629 users shrikage info started to add to responses "count": 49629, "truncated": true, "messages": [ { "type": "warning", "name": "SearchResultTruncated", "message": "Search result has been truncated: Configured administrative server limit exceeded", "code": 13017, "data": { "reason": "Configured administrative server limit exceeded" } } ] i do not do anything with freeipa server, just worked python script which generated users, script worked delicate and slow , he always waited for response from API that user created before creating another one user, so there were no high parallel overload on DB so i searched for nsslapd-sizelimit again with command: ldapsearch -x -D "cn=Directory Manager" -W -H ldap://localhost -b "cn=config" nsslapd-sizelimit but is showed normally nsslapd-sizelimit: 20000000 so with settings all fine, it shows that number that i set so what happened? Where freeipa get this strange limit in 49629 users and why? How to handle this? so projected size of LDAP DB is around 15 millons users I tried to workaround this with python ldap-3 library in hope it make some more low-level requests without any limits, but via python script i have this limit too, so its totally global for all, UI, API and python API... So how to remove this strange limit?

1 1

Certificate problem
by Yavor Marinov 12 Jun '24

12 Jun '24

Hello all, I've tried to look over the list for the problem I have, but it seems I can't find anything related. We are using FreeIPA 4.11 on Alma9 with Letsencrypt certificates. Until now I didn't had issues renewing certificates (using https://github.com/freeipa/freeipa-letsencrypt for renewing certificates) but since last night's renewal I can't get in to login into webui and can't enroll any new resources. The error i got from webui is standart Login failed due to an unknown reason and there are no errors in pki-tomcat. In apache's error logs the following error is produced: [Wed Jun 12 13:58:11.298021 2024] [wsgi:error] [pid 211427:tid 211669] [remote 91.239.13.253:34362] ipa: INFO: 401 Unauthorized: HTTPSConnectionPool(host='login.example.net', port=443): Max retries exceeded with url: /ipa/session/cookie (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1129)'))) Trying with curl to reach some of the certificates with curl https://login.example.net:443/ca/rest/certs/1 returns error "unable to get local issuer certificate". However, reaching the IPA webui using Chrome doesn't return an error "ERROR_UNKNOWN_ISSUER" but FireFox reports that the certificate is unknown. I know this is a trivial problem, but since I'm using letsencrypt I'm a bit worried since this is the first time having issues with certificates. The same problem is present on our replica. Any help would be much appreciated.

2 4

ipa-server upgrades not possible on RHEL 9 - samba-client-libs outdated
by Sam Morris 12 Jun '24

12 Jun '24

Hi folks. On a RHEL 9 system I'm getting: # dnf upgrade Updating Subscription Management repositories. Last metadata expiration check: 3:01:24 ago on Tue Jun 11 05:37:06 2024. Error: Problem 1: cannot install the best update candidate for package ipa-server-4.11.0-10.el9_4.x86_64 - nothing provides samba-client-libs >= 4.19.4-105.el9_4 needed by ipa-server-4.11.0-15.el9_4.x86_64 from rhel-9-for-x86_64-appstream-rpms Problem 2: [...] etc. Currently only the older version of samba-client-libs is available: # dnf list samba-client-libs Not root, Subscription Management repositories not updated Last metadata expiration check: 8:22:10 ago on Tue Jun 11 00:17:42 2024. Installed Packages samba-client-libs.x86_64 4.19.4-104.el9 @rhel-9-for-x86_64-baseos-rpms Available Packages samba-client-libs.i686 4.19.4-104.el9 rhel-9-for-x86_64-baseos-rpms I guess this will fix itself soon but I wanted to check on the chance that I've managed to break something locally... Thanks -- Sam Morris <https://robots.org.uk/> PGP: rsa4096/CAAA AA1A CA69 A83A 892B 1855 D20B 4202 5CDA 27B9

2 2

Fedora 40/FreeIPA 4.12
by Jochen Kellner 11 Jun '24

11 Jun '24

Hi, I've re-installed my test system with Fedora 40. ipa-healthcheck says: { "source": "ipahealthcheck.ipa.files", "check": "TomcatFileCheck", "result": "WARNING", "uuid": "0cad1a21-d450-4c68-845f-e72a640af360", "when": "20240610020014Z", "duration": "0.000986", "kw": { "key": "_var_lib_pki_pki-tomcat_conf_ca_CS.cfg_mode", "path": "/var/lib/pki/pki-tomcat/conf/ca/CS.cfg", "type": "mode", "expected": "0660", "got": "0664", "msg": "Permissions of /var/lib/pki/pki-tomcat/conf/ca/CS.cfg are too permissive: 0664 and should be 0660" } }, Otherwise the system seems to run fine. Might be a packaging problem... Jochen -- This space is intentionally left blank.

2 2

FreeIPA 4.12.1
by Antonio Torres 10 Jun '24

10 Jun '24

The FreeIPA team would like to announce FreeIPA 4.12.1 release! It can be downloaded from http://www.freeipa.org/page/Downloads. Builds for Fedora distributions will be available from the official repository soon. Full release notes are available at: https://www.freeipa.org/release-notes/4-12-1.html

1 0

FreeIPA 4.11.2
by Antonio Torres 10 Jun '24

10 Jun '24

The FreeIPA team would like to announce FreeIPA 4.11.2 release! It can be downloaded from http://www.freeipa.org/page/Downloads. Builds for Fedora distributions will be available from the official repository soon. Full release notes are available at: https://www.freeipa.org/release-notes/4-11-2.html

1 0

[SSSD] Announcing SSSD 2.10.0-beta1
by Pavel Březina 08 Jun '24

08 Jun '24

# SSSD 2.10.0-beta1 The SSSD team is announcing the release of version 2.10.0-beta1 of the System Security Services Daemon. The tarball can be downloaded from: https://github.com/SSSD/sssd/releases/tag/2.10.0-beta1 See the full release notes at: https://sssd.io/release-notes/sssd-2.10.0-beta1.html RPM packages will be made available for Fedora shortly. ## Feedback Please provide comments, bugs and other feedback via the sssd-devel or sssd-users mailing lists: https://lists.fedorahosted.org/mailman/listinfo/sssd-devel https://lists.fedorahosted.org/mailman/listinfo/sssd-users # SSSD 2.10-beta1 Release Notes ## Highlights ### General information * **IMPORTANT note for downstream maintainers!** This release features significant improvements of "running with less privileges (under unprivileged service user)" feature. There is still a `./configure` option `--with-sssd-user=` available that allows downstream package maintainers to choose if support of non-root service user should be built. In case such support is built, a preferred way to configure service user is simply by starting SSSD under this user; for example, using `User=/Group=` options of systemd sssd.service file. Upstream defaults are to build `--with-sssd-user=sssd` and to install systemd service with `User=/Group=sssd`. In this case, only several helper processes - `ldap_child`, `krb5_child` and `selinux_child` - are executed with elevated capabilities (that are now granted using fine grained file capabilities instead of SUID bit). All other SSSD components run without any capabilities. In this scenario it's still possible to re-configure SSSD to run under `root` (if needed for some reason): besides changing `User/Group=` options, some other tweaks of systemd service files are required. A legacy method to configure a service user - sssd.conf `user` option - is now deprecated and its support isn’t built by default. It can be enabled using `--with-conf-service-user-support` `./configure` option if needed (for example, due to backward compatibility requirements of stable releases). Further, no matter if SSSD is built `--with-sssd-user=sssd` or `--with-sssd-user=root`, when it's configured to run under `root` (in both cases) it still runs without capabilities, the same way as when it's configured to run under `sssd` user. The only difference is from the DAC perspective. Important note: owner of `/etc/sssd/sssd.conf` file (and snippets) should match the user configured to start SSSD service. Upstream spec file changes ownership of existing `sssd.conf` to `sssd` during package installation for seamless upgrades. Additionally, this release fixes a large number of issues with "socket activation of responders" feature, making it operable out-of-the-box when the package is built `--with-sssd-user=sssd`. Please take a note, that user configured to run main sssd.service and socket activated responders (if used) should match (i.e. if sssd.service is re-configured from upstream defaults to `root` then responders services also should be re-configured). Downstream package maintainers are advised to carefully inspect changes in `contrib/sssd.spec.in`, `src/sysv/systemd/*` and `./configure` options that this release brings! * sssctl `cache-upgrade` command was removed. SSSD performs automatic upgrades at startup when needed. * Support of `enumeration` feature (i.e. ability to list all users/groups using `getent passwd/group` without argument) for AD/IPA providers is deprecated and might be removed in further releases. Those who are interested to keep using it awhile should configure its build explicitly using `--with-extended-enumeration-support` ./configure option. ### New features * The new tool `sss_ssh_knownhosts` can be used with ssh's KnownHostsCommand configuration option to retrieve the host's public keys from a remote server (FreeIPA, LDAP, etc.). This new tool, which is more reliable, replaces `sss_ssh_knownhostsproxy`. Please consider switching to using the new tool as the old one will be removed. ### Packaging changes * Building SSSD now unconditionally requires availability of `ucred`/ `SO_PEERCRED` to enforce certain security checks at runtime (see `man 7 unix` for details). * SSSD now requires `libini` not older than v1.3 * Explicit `--with-semanage` ./configure switch was removed, going forward `--with-selinux` includes this. ### Configuration changes * Default `ldap_id_use_start_tls` value changed from `false` to `true` for improved security. * Added a `ldap_use_ppolicy` option for backends with broken ppolicy extension handling. * Obsolete `config_file_version` option was removed.

1 1

ipa host-add one time password validity period?
by Masanari Iida 07 Jun '24

07 Jun '24

" ipa host-add hostname -random " create a random one time password for this system. My question is, is there any expiring date for this random one time password? Let's say, if the random password expires in 7 days, I should mention my co-worker to let them add the hosts within that period. So far, I don't see such limitation online manual "Add Hosts to IPA" section. Just I want to double check this with developer. Masa

2 2

Is there a way to change a private group to a normal user group?
by Djerk Geurts 07 Jun '24

07 Jun '24

Hi all, Working on NFS access for local system accounts I found that one NFS client was only able to use a primary group to gain access to an NFS share via group privileges, and not a secondary group. But now, I’ve run into an issue where I need to grant others access to the same files, and their use of secondary group membership isn’t a problem. So now I’m considering if I can change the private group to a normal group and still have it as the primary group for the system account. I don’t want to have to change the group ownership of 10TB of files and folders again as this takes a long time. So the gid must stay ideally stay the same. Can I: Change the group type, so it shows up in the IPA GUI and add another group to it. Delete the private group and recreate it as a normal group with the same gid and name? Or am I screwed and need to remove the user and group and recreate them from scratch? Thanks, Djerk Geurts

2 4

Setting up FreeIPA to work with Windows and other Linux Boxes
by Duncan Small 05 Jun '24

05 Jun '24

I am attempting to follow this guide (https://www.rootusers.com/how-to-login-to-windows-with-a-freeipa-account/) to add a windows box to my cluster of FreeIPA-managed linux (rhel 8/9 and ubuntu) boxes. I have gotten to the point where I have a user account on the windows box connected to FreeIPA, I change the password (since it always starts expired) but then I am hit with this error: “To sign in remotely, you need the right to sign in through Remote Desktop Services. By default, members of the Remote Desktop Users group have this right. If the group you’re in doesn’t have this right, or if the right has been removed from the Remote Desktop Users group, you need to be granted this right manually.” My user account is in the "Remote Desktop Users" and I have verified that this group has the correct permissions to allow logon via RDP (as well as verifying that no user groups are denied from logging onto the box). I also added the user to the Remote Desktop Services group policy, but that did not work. I am able to RDP in as Administrator, so I tried adding the user to Administrator just to ensure it had the right permissions, but that did not work. I have been able to replicate this behavior with a fresh box and different FreeIPA accounts. Any help, advice, or resources would be greatly appreciated. TIA

2 2

Setting up FreeIPA to work with Windows and other Linux Boxes
by Duncan Small 05 Jun '24

05 Jun '24

I am attempting to follow this guide (https://www.rootusers.com/how-to-login-to-windows-with-a-freeipa-account/) to add a windows box to my cluster of FreeIPA-managed linux (rhel 8/9 and ubuntu) boxes. I have gotten to the point where I have a user account on the windows box connected to FreeIPA, I change the password (since it always starts expired) but then I am hit with this error: “To sign in remotely, you need the right to sign in through Remote Desktop Services. By default, members of the Remote Desktop Users group have this right. If the group you’re in doesn’t have this right, or if the right has been removed from the Remote Desktop Users group, you need to be granted this right manually.” My user account is in the "Remote Desktop Users" and I have verified that this group has the correct permissions to allow logon via RDP (as well as verifying that no user groups are denied from logging onto the box). I also added the user to the Remote Desktop Services group policy, but that did not work. I am able to RDP in as Administrator, so I tried adding the user to Administrator just to ensure it had the right permissions, but that did not work. I have been able to replicate this behavior with a fresh box and different FreeIPA accounts. Any help, advice, or resources would be greatly appreciated. TIA

1 0

pki-tomcatd service stopped
by Natxo Asenjo 05 Jun '24

05 Jun '24

hi, after a botched update (https://access.redhat.com/solutions/7065748) and rolling back the changes, this service will not start: # ipactl status Directory Service: RUNNING krb5kdc Service: RUNNING kadmin Service: RUNNING named Service: RUNNING httpd Service: RUNNING ipa-custodia Service: RUNNING pki-tomcatd Service: STOPPED smb Service: RUNNING winbind Service: RUNNING ipa-otpd Service: RUNNING ipa-dnskeysyncd Service: RUNNING 1 service(s) are not running in journalctl I found this stdout/stderr messages: May 24 11:40:35 kdc1.sub.domain.tld named[27437]: zone sub.domain.tld/IN: sending notifies (serial 1716543629) May 24 11:40:35 kdc1.sub.domain.tld pki-server[27758]: ERROR: Unable to parse version number: "11.5.0" May 24 11:40:35 kdc1.sub.domain.tld pki-server[27758]: Traceback (most recent call last): May 24 11:40:35 kdc1.sub.domain.tld pki-server[27758]: File "/usr/lib/python3.9/site-packages/pki/server/pkiserver.py", line 41, in <module> May 24 11:40:35 kdc1.sub.domain.tld pki-server[27758]: cli.execute(sys.argv) May 24 11:40:35 kdc1.sub.domain.tld pki-server[27758]: File "/usr/lib/python3.9/site-packages/pki/server/cli/__init__.py", line 145, in execute May 24 11:40:35 kdc1.sub.domain.tld pki-server[27758]: super().execute(args) May 24 11:40:35 kdc1.sub.domain.tld pki-server[27758]: File "/usr/lib/python3.9/site-packages/pki/cli/__init__.py", line 217, in execute May 24 11:40:35 kdc1.sub.domain.tld pki-server[27758]: module.execute(module_args) May 24 11:40:35 kdc1.sub.domain.tld pki-server[27758]: File "/usr/lib/python3.9/site-packages/pki/server/cli/upgrade.py", line 144, in execute May 24 11:40:35 kdc1.sub.domain.tld pki-server[27758]: self.upgrade( May 24 11:40:35 kdc1.sub.domain.tld pki-server[27758]: File "/usr/lib/python3.9/site-packages/pki/server/cli/upgrade.py", line 178, in upgrade May 24 11:40:35 kdc1.sub.domain.tld pki-server[27758]: upgrader.upgrade() May 24 11:40:35 kdc1.sub.domain.tld pki-server[27758]: File "/usr/lib/python3.9/site-packages/pki/upgrade.py", line 481, in upgrade May 24 11:40:35 kdc1.sub.domain.tld pki-server[27758]: versions = self.versions() May 24 11:40:35 kdc1.sub.domain.tld pki-server[27758]: File "/usr/lib/python3.9/site-packages/pki/upgrade.py", line 238, in versions May 24 11:40:35 kdc1.sub.domain.tld pki-server[27758]: current_version = self.get_current_version() May 24 11:40:35 kdc1.sub.domain.tld pki-server[27758]: File "/usr/lib/python3.9/site-packages/pki/upgrade.py", line 341, in get_current_version May 24 11:40:35 kdc1.sub.domain.tld pki-server[27758]: current_version = self.get_tracker().get_version() May 24 11:40:35 kdc1.sub.domain.tld pki-server[27758]: File "/usr/lib/python3.9/site-packages/pki/upgrade.py", line 141, in get_version May 24 11:40:35 kdc1.sub.domain.tld pki-server[27758]: return pki.util.Version(version) May 24 11:40:35 kdc1.sub.domain.tld pki-server[27758]: File "/usr/lib/python3.9/site-packages/pki/util.py", line 613, in __init__ May 24 11:40:35 kdc1.sub.domain.tld pki-server[27758]: raise Exception('Unable to parse version number: %s' % obj) May 24 11:40:35 kdc1.sub.domain.tld pki-server[27758]: Exception: Unable to parse version number: "11.5.0" May 24 11:40:35 kdc1.sub.domain.tld systemd[1]: pki-tomcatd(a)pki-tomcat.service: Control process exited, code=exited, status=1/FAILURE May 24 11:40:35 kdc1.sub.domain.tld systemd[1]: pki-tomcatd(a)pki-tomcat.service: Failed with result 'exit-code'. May 24 11:40:35 kdc1.sub.domain.tld systemd[1]: Failed to start PKI Tomcat Server pki-tomcat. So it seems something is broken on this upgrade script. This is in in almalinux 9.3 ipa-server-4.10.2-5.el9_3.alma.1.x86_64 I cannot upgrade because I get bitten by the named ldap thing, even though the versions are newer. I will create a replicat to a rhel host but first I need to get the CA up and running obviously :-). Any ideas? Thanks! -- regards, natxo -- -- Groeten, natxo

3 11

kpi-tomcatd failing to start
by girish f 03 Jun '24

03 Jun '24

I have IPA setup long back. Some of the certificates expired. So i went back in time and then it's working super smooth. When i did ipa-cert-fix --> error is Server-Cert not found I renewed kerberos kdc.key kdc.crt. But still it's failing to start the kpi_tomcatd. When i check status of kpi-tomcatd@kpi-tomcatd it shows running, but service starts to fail when i come back to current time and restart ipactl restart. need urgent help please

3 7

Remove bad replica nodes from list
by Satish Patel 03 Jun '24

03 Jun '24

Folks, I am trying to build some replicas and somehow they failed but because they are half baked they are stuck in master nodes and not letting me remove them. I have tried all the options and don't know how to get rid of them. I want to remove ldap-vx-010103-1.site5.example.com and ldap-vx-010103-2.site5.example.com. I have removed them from topology and from host and hostgroup ipaservers list but no luck. I have totally shut down replicas nodes but still no luck. Are there any good ways to clean them up? [root@ldap-vx-010101-4 ~]# ipa-replica-manage list -v `hostname` ldap-vx-010101-1.site5.example.com: replica last init status: None last init ended: 1970-01-01 00:00:00+00:00 last update status: Error (0) Replica acquired successfully: Incremental update succeeded last update ended: 2024-05-16 01:58:02+00:00 ldap-vx-010101-2.site5.example.com: replica last init status: None last init ended: 1970-01-01 00:00:00+00:00 last update status: Error (0) Replica acquired successfully: Incremental update succeeded last update ended: 2024-05-16 01:58:02+00:00 ldap-vx-010101-3.site5.example.com: replica last init status: None last init ended: 1970-01-01 00:00:00+00:00 last update status: Error (0) Replica acquired successfully: Incremental update succeeded last update ended: 2024-05-16 01:58:02+00:00 ldap-vx-010101-5.site5.example.com: replica last init status: None last init ended: 1970-01-01 00:00:00+00:00 last update status: Error (0) Replica acquired successfully: Incremental update succeeded last update ended: 2024-05-16 01:58:02+00:00 ldap-vx-010103-1.site5.example.com: replica last init status: Error (0) last init ended: 1970-01-01 00:00:00+00:00 last update status: Error (-1) Problem connecting to replica - LDAP error: Can't contact LDAP server (connection error) last update ended: 2024-05-11 10:30:33+00:00 ldap-vx-010103-2.site5.example.com: replica last init status: Error (0) Total update succeeded last init ended: 2024-05-10 20:35:02+00:00 last update status: Error (-1) Problem connecting to replica - LDAP error: Can't contact LDAP server (connection error) last update ended: 1970-01-01 00:00:00+00:00 ldap-vx-010103-3.site5.example.com: replica last init status: Error (0) Total update succeeded last init ended: 2024-05-10 21:14:53+00:00 last update status: Error (0) Replica acquired successfully: Incremental update succeeded last update ended: 2024-05-16 01:58:02+00:00

2 4

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users June 2024