May 2017 - FreeIPA-users - Fedora mailing-lists

convert freeipa (ldap) pass to htpasswd
by Sebastian Kösters 24 May '17

24 May '17

Hi, maybe one of you guys is able to help me with that. Please dont ask why, but i have to convert my users ldap pass to htpasswd. In my ldap setup running at the moment i do it like this: --- ldapsearch -D 'cn=admin,dc=doman,dc=de' -w $PASS -LLL -x -b "dc=domain,dc=de" uid=$user | grep userPassword | cut -d ":" -f 3 | openssl base64 -d --- with the "openssl base64 -d" part i get a working htpasswd password. I now tried the same with my freeIPA installation. I am able to get the ldap pass, but the return of the "openssl base64 -d" command is just empty. Is there a way to "convert" the pass in my needed format? BR Sebastian

1 0

4.5.0+ Rhel 7 support
by Jason Hensley 24 May '17

24 May '17

Is anyone running FreeIPA 4.5.0+ successfully on Rhel7/CentOS7? Are there any plans to officially support Rhel7/CentOS7? Thanks, J

4 4

Fwd: matching rule errors?
by Zak Wolfinger 24 May '17

24 May '17

Running FreeIPA Version 4.2.0 Seeing a lot of these in the slapd error log: the EQUALITY matching rule [caseIgnoreIA5Match] is not compatible with the syntax [1.3.6.1.4.1.1466.115.121.1.15] for the attribute [dc] the SUBSTR matching rule [caseIgnoreIA5SubstringsMatch] is not compatible with the syntax [1.3.6.1.4.1.1466.115.121.1.15] for the attribute [dc] Any clue as to what this means and specifically how to fix it? Cheers, Zak Wolfinger Infrastructure Engineer | Emma® zak.wolfinger(a)myemma.com <mailto:zak.wolfinger@myemma.com> 800.595.4401 or 615.292.5888 x197 615.292.0777 (fax) Emma helps organizations everywhere communicate & market in style. Visit us online at www.myemma.com <http://myemma.com/?utm_source=%20EmmaSignatures&utm_medium=%20email&utm_con…>

2 1

Re: UI customization: Default values on host addition
by Pavel Vomacka 24 May '17

24 May '17

Hello Steve, On 05/16/2017 05:21 PM, Steve Huston wrote: > I've extended the UI for host addition by including a multivalued > widget which stores puppetVar values (as well as the accompanying > Python plugin to handle it and schema update in the directory). This > works well, but I'd like to add one more thing and am not sure how to > do it. > > There are certain variables which are basically always set for every > host, and so I'd like them to default to those values in the UI, while > still giving the admin the choice to edit or remove them just like > they were entered by hand. I'm not sure, however, how to "push" > values into the UI that way. Could you please write an example of the variable? > > Is there some attribute of a field I can edit to insert a default > value into the UI, while still allowing that to be removed or edited > before the user submits the page? > > In case you want to prefill a dialog by default values you can do it by using that.get_field('fieldname').set_value(['value1']); in open() method of the dialog. But I'm not sure whether this is what you want. If not please send an example of what you want to achieve. HTH -- Pavel^3 Vomacka

2 3

Re-initialize replica question
by John Bowman 23 May '17

23 May '17

This is technically two issues but hopefully one solution would solve both problems. We have a replica that has an EXTREMELY large cldb file and unfortunately not in a position to be able to grow it. # pwd /var/lib/dirsrv/slapd-IPA-US/cldb # ls -la -rw------- 1 dirsrv dirsrv 38G May 22 10:40 3f194d88-fc9b11e3-a48ba575-885328fc_5255c5c5000000040000.db4 -rw------- 1 dirsrv dirsrv 27G Aug 3 2016 3f194d88-fc9b11e3-a48ba575-885328fc.ldif Not certain why this particular replica (non-ca replica) would have about 30gb larger files than the others. It is fairly old has has been running steadily for the last few years without incident other than the continuous growth of the .db4 file. My question is if its possible to delete that file and re-initialize the replica to rebuild it or perhaps another safer option? Thanks! -- John Bowman john.bowman(a)zayo.com

2 1

Encrypting user's home directory
by Kees Bakker 23 May '17

23 May '17

Hey, Does anyone have a setup with a FreeIPA server and client PC's where users have an encrypted HOME directory? I'm having difficulty to set it up. I'd be grateful if someone could give some hints how to set it up. I have Ubuntu on the server and on the PC's (and laptops). What I tried so far. * enable PAM "Create home directory on login" * as root convert the home directory with ecryptfs-migrate-home The first step succeeds, a new home directory is created for the user. However, in the next step, ecryptfs-migrate-home asks for the passphrase of the user, but it claims that the passphrase is wrong. The result is that the migration fails. I've tried another route * create a new local user with fake name * rename the new home directory to match the actual user (also the new directory in /home/.ecryptfs The reason for a fake name is that you can't add a local user with the same name that exists in FreeIPA. The renaming is doable, but tedious. There are symlinks to be changed and there is ~/.ecryptfs/Private.mnt to be edited. Anyway, with this latter method I can now login through lightdm, but like I mentioned it is quiet a clumsy process. -- Kees

1 0

freeipa ldap + htaccess question
by Sebastian Kösters 23 May '17

23 May '17

Hi all! i have a question about the use of LDAP with .htaccess in freeIPA. i am using freeIPA (V. 4.4.0-14 with CentOS 7). I now wanted to also use .htaccess with LDAP. My first try was this: --- Order allow,deny Allow from all AuthName "test" AuthType Basic AuthBasicProvider ldap AuthLDAPURL "ldaps://ipa01.hostname.de:636 ipa02.hostname.de:636/cn=users,cn=accounts,dc=domain,dc=de?uid" Require valid-user --- This works perfectly fine for users i created in the freeIPA Webinterface. I now have to make some changes. Some Users should be able to login on the Website that uses the .htaccess and some should not be able to login. So i decided to create a group and add all users, which should be allowd to login via .htaccess. So my first try was this: --- [...] Require ldap-attribute gidNumber=101010 [...] --- 101010 is the gid of my newly created group (webtest). That did not work. If i use the gid of the "main" group of the users, its working fine (the user is definitely part of the new group). I also tried several other ways if found with the help of google, to only allow users which are member of the group to have access, but every attempt failed. Maybe one of you guys is able to help me?! Thank you and best regards Sebastian

7 11

Setup and Configuration guide for AIX 6.1/7.1
by Lakshan Jayasekara 23 May '17

23 May '17

Hi All, Need to setup and configure AIX 6.1 and 7.1 clients on our existing IPA server. Currently all Linux clients have integrated and working fine. If anyone has configured AIX client share me the configuration document, will beneficial for my exercise. On web it contains guide to setup AIX 5.3 and not for latest AIX versions. Lakshan Jayasekara Senior Systems Engineer Mobile: +94 77 294 0396 | Dir: +94 11 235 6949 General:+94 11 235 6949 Ext: 949 | Fax: +94 11 2544346 LankaClear (Pvt) Ltd, Level 18, Bank of Ceylon Head Office, “BOC Square”, No. 01, Bank of Ceylon Mw, Colombo 01, Sri Lanka. http://www.lankaclear.com<http://www.lankaclear.com/> [cid:image66cf17.JPG@f917de6e.408e315c] Confidentiality Notice: The information contained in this message is privileged and confidential information intended only for the use of the individual or entity named above. If the reader of this message is not the intended recipient, or the employee or agent responsible to deliver it to the intended recipient, you are hereby notified that any release, dissemination, distribution, or copying of this communication is strictly prohibited. If you have received this communication in error, please notify the author immediately by replying to this message and delete the original message. Internet communications cannot be guaranteed to be timely, secure, error or virus-free. The sender does not accept liability for any errors or omissions. This email has been scanned for all viruses by the Symantec End Point Protection Email Security System. [cid:image014da8.JPG@b2f9c489.419d30bf]<http://>

1 0

cannot re-enroll server (mutliple errors)
by Vinny Del Signore 23 May '17

23 May '17

Hello all, Has anyone seen this issue or have suggestions? We had FreeIPA configured a few years ago by a team that is now gone. Several months ago we had an issue where passwords seemed to expire and authentication started failing for users. For example we were not able to login to the LDAP server via ssh as an LDAP user, shows "Permission denied ": [fred@fred ~]$ ssh cr0777kk@biobb-ss cr0777kk@biobb-ss's password: Permission denied, please try again. ... We checked the user status in LDAP and it is not locked and has the correct permissions. Then we noticed that the server is marked as LOCKED by kerberos in kerberos log: [/var/log/krb5kdc.log] root ldap-p1 ~ # grep biobb-ss /var/log/krb5kdc.log | tail May 16 15:49:51 ldap-p1.freeipa.example.com krb5kdc[20459](info): AS_REQ (4 etypes {18 17 16 23}) 10.107.179.53: LOCKED_OUT: host/biobb-ss.freeipa.example.com(a)FREEIPA.EXAMPLE.COM for krbtgt/FREEIPA.EXAMPLE.COM(a)FREEIPA.EXAMPLE.COM, Clients credentials have been revoked ... We used to workaround this issue by re-enrolling the server in LDAP DB: On the LDAP server, we execute these commands: # kinit <LDAP_Admin> # ipa host-del biobb-ss.freeipa.example.com # ipa host-add biobb-ss.freeipa.example.com --password xxxxxxxxxxx # ipa hostgroup-add-member dev --hosts=biobb-ss.freeipa.example.com This worked in the past, but now when the second command (to delete the server from the LDAP DB) fails. And if we re execute the same command it shows three different errors in the order below: Here is what we see now: # ipa host-del host.freeipa.example.com # ipa: ERROR: cannot connect to 'https://host.freeipa.example.com:443/ca/agent/ca/displayBySerial': (SSL_ERROR_BAD_CERT_ALERT) SSL peer cannot verify your certificate. # ipa host-del host.freeipa.example.com # ipa: ERROR: cannot connect to 'https://host.freeipa.example.com:443/ca/agent/ca/displayBySerial': (SEC_ERROR_BUSY) NSS could not shutdown. Objects are still in use. # ipa host-del host.freeipa.example.com # ipa: ERROR: Certificate format error: (SEC_ERROR_LEGACY_DATABASE) The certificate/key database is in an old, unsupported format. When we restart the IPA services (ipactl restart) we see the following errors in the errors log: [18/May/2017:12:04:24 -0500] - 389-Directory/1.2.11.15 B2016.155.1910 starting up [18/May/2017:12:04:24 -0500] attrcrypt - attrcrypt_unwrap_key: failed to unwrap key for cipher AES [18/May/2017:12:04:24 -0500] attrcrypt - attrcrypt_cipher_init: symmetric key failed to unwrap with the private key; Cert might have been renewed since the key is wrapped. To recover the encrypted contents, keep the wrapped symmetric key value. [18/May/2017:12:04:24 -0500] attrcrypt - attrcrypt_unwrap_key: failed to unwrap key for cipher 3DES [18/May/2017:12:04:24 -0500] attrcrypt - attrcrypt_cipher_init: symmetric key failed to unwrap with the private key; Cert might have been renewed since the key is wrapped. To recover the encrypted contents, keep the wrapped symmetric key value. [18/May/2017:12:04:24 -0500] attrcrypt - All prepared ciphers are not available. Please disable attribute encryption. [18/May/2017:12:04:24 -0500] - slapd started. Listening on All Interfaces port 7389 for LDAP requests [18/May/2017:12:04:24 -0500] - Listening on All Interfaces port 7390 for LDAPS requests [18/May/2017:12:04:24 -0500] slapi_ldap_bind - Error: could not send startTLS request: error -11 (Connect error) errno 0 (Success) [18/May/2017:12:04:24 -0500] NSMMReplicationPlugin - agmt="cn=masterAgreement1-biogendb-p2.wgap.ibm.com-pki-ca" (biogendb-p2:7389): Replication bind with SIMPLE auth failed: LDAP error -11 (Connect error) (TLS error -8054:You are attempting to import a cert with the same issuer/serial as an existing cert, but that is not the same cert.) [18/May/2017:12:04:27 -0500] slapi_ldap_bind - Error: could not send startTLS request: error -11 (Connect error) errno 0 (Success) [18/May/2017:12:04:33 -0500] slapi_ldap_bind - Error: could not send startTLS request: error -11 (Connect error) errno 0 (Success) [18/May/2017:12:04:45 -0500] slapi_ldap_bind - Error: could not send startTLS request: error -11 (Connect error) errno 0 (Success) Has anyone seen this issue before? Thank you in advance. -Vin

1 0

FreeIPA 4.5.0 Rhel7 support
by Jason Hensley 23 May '17

23 May '17

Is anyone running FreeIPA 4.5.0+ successfully on Rhel7/CentOS7? Are there any plans to officially support Rhel7/CentOS7? Thanks, J

2 1

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users May 2017