November 2018 - FreeIPA-users - Fedora mailing-lists

Info - cli - Powershell module for FreeIPA published and available on GitHub
by Lucas Cueff 19 Nov '18

19 Nov '18

Hello FreeIPA world, First thanks for this great product, I was looking for an Active Directory 'clone' for the opensource world and I have successfully tested and deployed a FreeIPA infra, thanks to your great job guys ! Because I am also a Windows admin sys working from Windows platform, I wanted to keep PowerShell as my main shell and script platform. I have started to port the Python cli in a Powershell module. For the Powershell user, my work is available at : https://github.com/MS-LUF/Manage-FreeIPA Currently, the APIs already implemented in the v0.1 are : config_mod config_show env group_add group_add_member group_del group_find group_mod group_remove_member group_show Host_add Host_del Host_mod Host_show passwd permission_add permission_add_member permission_add_Noaci permission_find permission_mod permission_remove_member permission_show privilege_add privilege_add_member privilege_add_permission privilege_del privilege_find privilege_mod privilege_remove_member privilege_remove_permission privilege_show role_add role_add_member role_add_privilege role_del role_find role_mod role_remove_member role_remove_privilege role_show sessionlogout user_add user_del user_disable user_Enable user_find user_mod user_show user_status user_unlock host_find More, to come soon. @+ Luf35

2 5

Connect to WebUI fails: ERR_CONNECTION_TIMED_OUT
by 74cmonty 18 Nov '18

18 Nov '18

Hi, I have completed installation on Fedora Server 29 w/o issues. Before I tried WebUI I ensured that administrative ticket is valid. '''' [root@ipa ~]# ipa user-show admin Anmeldename: admin Nachname: Administrator Home-Verzeichnis: /home/admin Anmeldeshell: /bin/bash Principal alias: admin@<MYDOMAIN>.DE UID: 202400000 Gruppen-ID: 202400000 Konto ist deaktiviert: False Passwort: True Mitglied der Gruppen: admins, trust admins Kerberos-Schlüssel verfügbar: True '''' When I try to access WebUI using this URL https://ipa.<mydomain>.de/ipa/ui I get this error: ERR_CONNECTION_TIMED_OUT '''' [root@ipa ~]# date -R Mon, 19 Nov 2018 00:08:03 +0100 semanage port -l | grep ssh [root@ipa ~]# journalctl -u httpd -- Logs begin at Sun 2018-11-18 13:18:31 CET, end at Mon 2018-11-19 00:08:50 CET. -- Nov 18 16:56:22 ipa.<mydomain>.de systemd[1]: Starting The Apache HTTP Server... Nov 18 16:56:23 ipa.<mydomain>.de ipa-httpd-kdcproxy[7343]: ipa: INFO: KDC proxy enabled Nov 18 16:56:23 ipa.<mydomain>.de ipa-httpd-kdcproxy[7343]: ipa-httpd-kdcproxy: INFO KDC proxy enabled Nov 18 16:56:23 ipa.<mydomain>.de httpd[7345]: Server configured, listening on: port 443, port 80 Nov 18 16:56:23 ipa.<mydomain>.de systemd[1]: Started The Apache HTTP Server. Nov 18 16:57:57 ipa.<mydomain>.de systemd[1]: Stopping The Apache HTTP Server... Nov 18 16:57:58 ipa.<mydomain>.de systemd[1]: Stopped The Apache HTTP Server. Nov 18 16:57:58 ipa.<mydomain>.de systemd[1]: Starting The Apache HTTP Server... Nov 18 16:57:58 ipa.<mydomain>.de ipa-httpd-kdcproxy[7948]: ipa: INFO: KDC proxy enabled Nov 18 16:57:58 ipa.<mydomain>.de ipa-httpd-kdcproxy[7948]: ipa-httpd-kdcproxy: INFO KDC proxy enabled Nov 18 16:57:59 ipa.<mydomain>.de httpd[7950]: Server configured, listening on: port 443, port 80 Nov 18 16:57:59 ipa.<mydomain>.de systemd[1]: Started The Apache HTTP Server. Nov 18 16:58:05 ipa.<mydomain>.de [7957]: GSSAPI client step 1 Nov 18 16:58:05 ipa.<mydomain>.de [7957]: GSSAPI client step 1 Nov 18 16:58:05 ipa.<mydomain>.de [7957]: GSSAPI client step 1 Nov 18 16:58:06 ipa.<mydomain>.de [7959]: GSSAPI client step 1 Nov 18 16:58:06 ipa.<mydomain>.de [7959]: GSSAPI client step 1 Nov 18 16:58:06 ipa.<mydomain>.de [7959]: GSSAPI client step 1 Nov 18 16:58:06 ipa.<mydomain>.de [7956]: GSSAPI client step 1 Nov 18 16:58:06 ipa.<mydomain>.de [7956]: GSSAPI client step 1 Nov 18 16:58:06 ipa.<mydomain>.de [7956]: GSSAPI client step 1 Nov 18 16:58:07 ipa.<mydomain>.de [7960]: GSSAPI client step 1 Nov 18 16:58:07 ipa.<mydomain>.de [7960]: GSSAPI client step 1 Nov 18 16:58:07 ipa.<mydomain>.de [7960]: GSSAPI client step 1 Nov 18 17:00:57 ipa.<mydomain>.de [7957]: GSSAPI client step 1 Nov 18 17:00:57 ipa.<mydomain>.de [7957]: GSSAPI client step 1 Nov 18 17:00:57 ipa.<mydomain>.de [7957]: GSSAPI client step 1 Nov 18 17:06:00 ipa.<mydomain>.de systemd[1]: Stopping The Apache HTTP Server... Nov 18 17:06:02 ipa.<mydomain>.de systemd[1]: Stopped The Apache HTTP Server. -- Reboot -- Nov 18 17:06:21 ipa.<mydomain>.de systemd[1]: Starting The Apache HTTP Server... Nov 18 17:06:21 ipa.<mydomain>.de ipa-httpd-kdcproxy[926]: ipa: INFO: KDC proxy enabled Nov 18 17:06:21 ipa.<mydomain>.de ipa-httpd-kdcproxy[926]: ipa-httpd-kdcproxy: INFO KDC proxy enabled Nov 18 17:06:21 ipa.<mydomain>.de httpd[930]: Server configured, listening on: port 443, port 80 Nov 18 17:06:21 ipa.<mydomain>.de systemd[1]: Started The Apache HTTP Server. Nov 18 23:50:30 ipa.<mydomain>.de [938]: GSSAPI client step 1 Nov 18 23:50:30 ipa.<mydomain>.de [938]: GSSAPI client step 1 Nov 18 23:50:30 ipa.<mydomain>.de [938]: GSSAPI client step 1 Nov 18 23:50:31 ipa.<mydomain>.de [940]: GSSAPI client step 1 Nov 18 23:50:31 ipa.<mydomain>.de [940]: GSSAPI client step 1 Nov 18 23:50:31 ipa.<mydomain>.de [940]: GSSAPI client step 1 Nov 19 00:08:44 ipa.<mydomain>.de systemd[1]: Stopping The Apache HTTP Server... Nov 19 00:08:46 ipa.<mydomain>.de systemd[1]: Stopped The Apache HTTP Server. Nov 19 00:08:46 ipa.<mydomain>.de systemd[1]: Starting The Apache HTTP Server... Nov 19 00:08:47 ipa.<mydomain>.de ipa-httpd-kdcproxy[1954]: ipa: INFO: KDC proxy enabled Nov 19 00:08:47 ipa.<mydomain>.de ipa-httpd-kdcproxy[1954]: ipa-httpd-kdcproxy: INFO KDC proxy enabled Nov 19 00:08:47 ipa.<mydomain>.de httpd[1956]: Server configured, listening on: port 443, port 80 Nov 19 00:08:47 ipa.<mydomain>.de systemd[1]: Started The Apache HTTP Server. [root@ipa ~]# tail /var/log/httpd/access_log 192.168.100.200 - host/ipa.<mydomain>.de@<mydomain>.DE [18/Nov/2018:16:58:01 +0100] "POST /ipa/json HTTP/1.1" 200 97382 192.168.100.200 - host/ipa.<mydomain>.de@<mydomain>.DE [18/Nov/2018:16:58:06 +0100] "POST /ipa/session/json HTTP/1.1" 200 310 192.168.100.200 - host/ipa.<mydomain>.de@<mydomain>.DE [18/Nov/2018:16:58:06 +0100] "POST /ipa/session/json HTTP/1.1" 200 158 192.168.100.200 - host/ipa.<mydomain>.de@<mydomain>.DE [18/Nov/2018:16:58:07 +0100] "POST /ipa/session/json HTTP/1.1" 200 917 192.168.100.200 - admin@<MYDOMAIN>.DE [18/Nov/2018:17:00:57 +0100] "POST /ipa/json HTTP/1.1" 200 300 192.168.100.200 - admin@<MYDOMAIN>.DE [18/Nov/2018:23:50:30 +0100] "POST /ipa/json HTTP/1.1" 200 97388 192.168.100.200 - admin@<MYDOMAIN>.DE [18/Nov/2018:23:50:31 +0100] "POST /ipa/session/json HTTP/1.1" 200 318 [root@ipa ~]# tail /var/log/httpd/error_log [Mon Nov 19 00:08:44.866365 2018] [mpm_event:notice] [pid 930:tid 140260991723776] AH00492: caught SIGWINCH, shutting down gracefully [Mon Nov 19 00:08:47.145079 2018] [core:notice] [pid 1956:tid 140406450063616] SELinux policy enabled; httpd running as context system_u:system_r:httpd_t:s0 [Mon Nov 19 00:08:47.145750 2018] [suexec:notice] [pid 1956:tid 140406450063616] AH01232: suEXEC mechanism enabled (wrapper: /usr/sbin/suexec) [Mon Nov 19 00:08:47.175352 2018] [lbmethod_heartbeat:notice] [pid 1956:tid 140406450063616] AH02282: No slotmem from mod_heartmonitor [Mon Nov 19 00:08:47.182262 2018] [mpm_event:notice] [pid 1956:tid 140406450063616] AH00489: Apache/2.4.37 (Fedora) OpenSSL/1.1.1 mod_wsgi/4.6.4 Python/3.7 mod_auth_gssapi/1.6.1 configured -- resuming normal operations [Mon Nov 19 00:08:47.182286 2018] [core:notice] [pid 1956:tid 140406450063616] AH00094: Command line: '/usr/sbin/httpd -D FOREGROUND' [Mon Nov 19 00:08:50.622921 2018] [wsgi:error] [pid 1964:tid 140406450063616] ipa: INFO: *** PROCESS START *** [Mon Nov 19 00:08:50.648152 2018] [wsgi:error] [pid 1963:tid 140406450063616] ipa: INFO: *** PROCESS START *** [Mon Nov 19 00:08:50.654892 2018] [wsgi:error] [pid 1962:tid 140406450063616] ipa: INFO: *** PROCESS START *** [Mon Nov 19 00:08:50.690071 2018] [wsgi:error] [pid 1965:tid 140406450063616] ipa: INFO: *** PROCESS START *** '''' What's causing this issue? THX

1 0

certmonger (back in time) renewal is onyl 50% successful
by Zarko D 17 Nov '18

17 Nov '18

Hi there, still working on cert renewal with little bit of progress, hence asking kindly for more support until final resolution. As per the subject, certmonger renews two out of four certificates. [1] stop ntpd, go back in time (Aug 10 2018), where all certs are valid [2] restart krb5kdc, 389, httpd, CA [3] Verify that CA is running. # SSL_DIR=/etc/httpd/alias/ curl -v -o /dev/null --cacert /etc/ipa/ca.crt https://`hostname`:8443/ca/agent/ca/profileReview % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0* About to connect() to ca-ldap01.domain.com port 8443 (#0) * Trying x.x.x.x... * Connected to ca-ldap01.domain.com (IP) port 8443 (#0) * Initializing NSS with certpath: sql:/etc/httpd/alias/ * CAfile: /etc/ipa/ca.crt CApath: none * NSS: client certificate not found (nickname not specified) * SSL connection using TLS_DHE_RSA_WITH_AES_256_CBC_SHA * Server certificate: * subject: CN=ca-ldap01.domain.com,O=domain.com * start date: Jul 18 01:47:45 2018 GMT * expire date: Jul 07 01:47:45 2020 GMT * common name: ca-ldap01.domain.com * issuer: CN=Certificate Authority,O=domain.com > GET /ca/agent/ca/profileReview HTTP/1.1 > User-Agent: curl/7.29.0 > Host: ca-ldap01.domain.com:8443 > Accept: */* > * NSS: client certificate not found (nickname not specified) < HTTP/1.1 200 OK < Server: Apache-Coyote/1.1 < Content-Type: text/html;charset=UTF-8 < Transfer-Encoding: chunked < Date: Fri, 10 Aug 2018 08:54:11 GMT < { [data not shown] 100 17641 0 17641 0 0 203k 0 --:--:-- --:--:-- --:--:-- 205k * Connection #0 to host ca-ldap01.domain.com left intact [4] ipactl status reads: # ipactl status Directory Service: RUNNING krb5kdc Service: RUNNING kadmin Service: RUNNING named Service: RUNNING ipa_memcached Service: RUNNING httpd Service: RUNNING ipa-custodia Service: RUNNING ntpd Service: STOPPED pki-tomcatd Service: RUNNING ipa-otpd Service: RUNNING ipa-dnskeysyncd Service: RUNNING ipa: INFO: The ipactl command was successful [5] restart certmonger, four cert are in submitting status # getcert list | egrep "certificate|expire|status" Number of certificates and requests being tracked: 6. status: SUBMITTING certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert cert-pki-ca',token='NSS Certificate DB' expires: 2018-08-14 20:49:38 UTC status: SUBMITTING certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert cert-pki-ca',token='NSS Certificate DB' expires: 2018-08-14 20:49:35 UTC status: SUBMITTING certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert cert-pki-ca',token='NSS Certificate DB' expires: 2018-08-14 20:49:36 UTC status: MONITORING certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert cert-pki-ca',token='NSS Certificate DB' expires: 2036-08-24 20:49:35 UTC status: SUBMITTING certificate: type=NSSDB,location='/etc/httpd/alias',nickname='ipaCert',token='NSS Certificate DB' expires: 2018-08-14 20:50:00 UTC status: MONITORING certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert cert-pki-ca',token='NSS Certificate DB' expires: 2020-07-07 01:47:45 UTC [6] Here is where problem starts, the CA stop running, and /var/lib/pki/pki-tomcat/logs/ca/selftests.log report 0.localhost-startStop-1 - [10/Aug/2018:01:52:12 PDT] [20] [1] CAPresence: CA is present 0.localhost-startStop-1 - [10/Aug/2018:01:52:12 PDT] [20] [1] SystemCertsVerification: system certs verification success 0.localhost-startStop-1 - [10/Aug/2018:01:52:12 PDT] [20] [1] SelfTestSubsystem: All CRITICAL self test plugins ran SUCCESSFULLY at startup! 0.localhost-startStop-1 - [10/Aug/2018:02:28:05 PDT] [20] [1] SelfTestSubsystem: Initializing self test plugins: 0.localhost-startStop-1 - [10/Aug/2018:02:28:05 PDT] [20] [1] SelfTestSubsystem: loading all self test plugin logger parameters 0.localhost-startStop-1 - [10/Aug/2018:02:28:05 PDT] [20] [1] SelfTestSubsystem: loading all self test plugin instances 0.localhost-startStop-1 - [10/Aug/2018:02:28:05 PDT] [20] [1] SelfTestSubsystem: loading all self test plugin instance parameters 0.localhost-startStop-1 - [10/Aug/2018:02:28:05 PDT] [20] [1] SelfTestSubsystem: loading self test plugins in on-demand order 0.localhost-startStop-1 - [10/Aug/2018:02:28:05 PDT] [20] [1] SelfTestSubsystem: loading self test plugins in startup order 0.localhost-startStop-1 - [10/Aug/2018:02:28:05 PDT] [20] [1] SelfTestSubsystem: Self test plugins have been successfully loaded! 0.localhost-startStop-1 - [10/Aug/2018:02:28:05 PDT] [20] [1] SelfTestSubsystem: Running self test plugins specified to be executed at startup: 0.localhost-startStop-1 - [10/Aug/2018:02:28:05 PDT] [20] [1] CAPresence: CA is present 0.localhost-startStop-1 - [10/Aug/2018:02:28:05 PDT] [20] [1] SystemCertsVerification: system certs verification failure: Certificate auditSigningCert cert-pki-ca is invalid: Invalid certificate: (-8181) Peer's Certificate has expired. 0.localhost-startStop-1 - [10/Aug/2018:02:28:05 PDT] [20] [1] SelfTestSubsystem: The CRITICAL self test plugin called selftests.container.instance.SystemCertsVerification running at startup FAILED! [7] I see that 'auditSigningCert' and ocspSigningCert have been renewed, so obviously at this very moment their validity time is not same as for other certs. Hence selftests.logs reports auditSigningCert is invalid, and CA stops running and I am left with tow certs not renewed. New cert list now is: # getcert list | egrep "certificate|expires" Number of certificates and requests being tracked: 6. certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert cert-pki-ca',token='NSS Certificate DB' expires: 2020-10-29 06:35:38 UTC certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert cert-pki-ca',token='NSS Certificate DB' expires: 2020-10-11 20:15:53 UTC certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert cert-pki-ca',token='NSS Certificate DB' expires: 2018-08-14 20:49:36 UTC certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert cert-pki-ca',token='NSS Certificate DB' expires: 2036-08-24 20:49:35 UTC certificate: type=NSSDB,location='/etc/httpd/alias',nickname='ipaCert',token='NSS Certificate DB' expires: 2018-08-14 20:50:00 UTC certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert cert-pki-ca',token='NSS Certificate DB' expires: 2020-07-07 01:47:45 UTC The question now is how to work around this problem? Instead of restarting certmonger service, is it better to renew certs with 'getcert resubmit' in some specific order? thanks, Zarko

1 2

dirsrv not starting
by Andrew Meyer 16 Nov '18

16 Nov '18

We have 2 servers in our AWS west environment running CentOS 7. The server just went unresponsive and I rebooted it. After it came back up it won't start drisrv service. I get the following errors from systemd/journalctl: [root@freeipa02 slapd-EXAMPLE-NET]# systemctl status dirsrv(a)EXAMPLE.NET -l● dirsrv(a)EXAMPLE.NET.service - 389 Directory Server EXAMPLE.NET. Loaded: loaded (/usr/lib/systemd/system/dirsrv@.service; enabled; vendor preset: disabled) Active: failed (Result: resources) Nov 16 20:27:46 freeipa02.west.example systemd[1]: dirsrv(a)EXAMPLE.NET.service failed to run 'start-pre' task: No such file or directoryNov 16 20:27:46 freeipa02.west.example systemd[1]: Failed to start 389 Directory Server EXAMPLE.NET..Nov 16 20:27:46 freeipa02.west.example systemd[1]: Unit dirsrv(a)EXAMPLE.NET.service entered failed state.Nov 16 20:27:46 freeipa02.west.example systemd[1]: dirsrv(a)EXAMPLE.NET.service failed.Nov 16 20:27:46 freeipa02.west.example systemd[1]: Starting 389 Directory Server EXAMPLE.NET....Nov 16 20:29:10 freeipa02.west.example systemd[1]: Failed to load environment files: No such file or directoryNov 16 20:29:10 freeipa02.west.example systemd[1]: dirsrv(a)EXAMPLE.NET.service failed to run 'start-pre' task: No such file or directoryNov 16 20:29:10 freeipa02.west.example systemd[1]: Failed to start 389 Directory Server EXAMPLE.NET..Nov 16 20:29:10 freeipa02.west.example systemd[1]: dirsrv(a)EXAMPLE.NET.service failed.Nov 16 20:29:10 freeipa02.west.example systemd[1]: Starting 389 Directory Server EXAMPLE.NET....[root@freeipa02 slapd-EXAMPLE-NET]# All the files are there. I did a comparison to the 01 server. Regards,Andrew

1 2

FreeIPA 4.5.4 + OpenVPN 2.4.6 + OTP
by Eric Fredrickson 16 Nov '18

16 Nov '18

Hello everyone, I'm having an issue with OTP when logging into a vpn server that is a client of FreeIPA. I can login with no issues when OTP is disabled. FreeIPA Setup: CentOS 7.5 FreeIPA 4.5.4 HBAC Service: openvpn HBAC Rule: [root@ipa ~]# ipa hbacrule-show openvpn_access Rule name: openvpn_access Description: VPN users HBAC rule for accessing ,vpnhost> via openvpn service. Enabled: TRUE Users: <users> Hosts: vpnhost.localdomain.local Services: openvpn User account: [root@ipa ~]# ipa user-show <omitted> User login: <omitted> First name: <omitted> Last name: <omitted> Home directory: /home/<omitted> Login shell: /bin/bash Principal name: <omitted> Principal alias: <omitted> Email address: <omitted> UID: 1909600003 GID: 1909600003 User authentication types: otp Certificate: <omitted> Account disabled: False Password: True Member of groups: vpn_users Member of HBAC rule: openvpn_access Indirect Member of HBAC rule: user_ipa_access Kerberos keys available: True OpenVPN server: /etc/pam.d/openvpn #%PAM-1.0 # This file is auto-generated. # User changes will be destroyed the next time authconfig is run. auth required pam_env.so auth required pam_faildelay.so delay=2000000 auth [default=1 ignore=ignore success=ok] pam_succeed_if.so uid >= 1000 quiet auth [default=1 ignore=ignore success=ok] pam_localuser.so auth sufficient pam_unix.so nullok try_first_pass auth requisite pam_succeed_if.so uid >= 1000 quiet_success auth sufficient pam_sss.so forward_pass auth required pam_deny.so account required pam_unix.so account sufficient pam_localuser.so account sufficient pam_succeed_if.so uid < 1000 quiet account [default=bad success=ok user_unknown=ignore] pam_sss.so account required pam_permit.so password requisite pam_pwquality.so try_first_pass local_users_only retry=3 authtok_type= ucredit=-1 lcredit=-1 dcredit=-1 ocredit=-1 password sufficient pam_unix.so sha512 shadow nullok try_first_pass use_authtok password sufficient pam_sss.so use_authtok password required pam_deny.so session optional pam_keyinit.so revoke session required pam_limits.so -session optional pam_systemd.so session optional pam_oddjob_mkhomedir.so umask=0077 session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid session required pam_unix.so session optional pam_sss.so server.conf plugin /usr/lib64/openvpn/plugins/openvpn-plugin-auth-pam.so openvpn Any help would be greatly appreciated. Any other information that you may need, please feel free to ask. I've read multiple threads, some have gotten it to work without posting answers, some have not and has stated openvpn does not support multiple prompts. Eric

2 1

FreeIPA 4.5.4 + OpenVPN 2.4.6 + OTP
by Eric Fredrickson 16 Nov '18

16 Nov '18

Hello everyone, I'm having an issue with OTP when logging into a vpn server that is a client of FreeIPA. I can login with no issues when OTP is disabled. FreeIPA Setup: CentOS 7.5 FreeIPA 4.5.4 HBAC Service: openvpn HBAC Rule: [root@ipa ~]# ipa hbacrule-show openvpn_access Rule name: openvpn_access Description: VPN users HBAC rule for accessing ,vpnhost> via openvpn service. Enabled: TRUE Users: <users> Hosts: vpnhost.localdomain.local Services: openvpn User account: [root@ipa ~]# ipa user-show <omitted> User login: <omitted> First name: <omitted> Last name: <omitted> Home directory: /home/<omitted> Login shell: /bin/bash Principal name: <omitted> Principal alias: <omitted> Email address: <omitted> UID: 1909600003 GID: 1909600003 User authentication types: otp Certificate: <omitted> Account disabled: False Password: True Member of groups: vpn_users Member of HBAC rule: openvpn_access Indirect Member of HBAC rule: user_ipa_access Kerberos keys available: True OpenVPN server: /etc/pam.d/openvpn #%PAM-1.0 # This file is auto-generated. # User changes will be destroyed the next time authconfig is run. auth required pam_env.so auth required pam_faildelay.so delay=2000000 auth [default=1 ignore=ignore success=ok] pam_succeed_if.so uid >= 1000 quiet auth [default=1 ignore=ignore success=ok] pam_localuser.so auth sufficient pam_unix.so nullok try_first_pass auth requisite pam_succeed_if.so uid >= 1000 quiet_success auth sufficient pam_sss.so forward_pass auth required pam_deny.so account required pam_unix.so account sufficient pam_localuser.so account sufficient pam_succeed_if.so uid < 1000 quiet account [default=bad success=ok user_unknown=ignore] pam_sss.so account required pam_permit.so password requisite pam_pwquality.so try_first_pass local_users_only retry=3 authtok_type= ucredit=-1 lcredit=-1 dcredit=-1 ocredit=-1 password sufficient pam_unix.so sha512 shadow nullok try_first_pass use_authtok password sufficient pam_sss.so use_authtok password required pam_deny.so session optional pam_keyinit.so revoke session required pam_limits.so -session optional pam_systemd.so session optional pam_oddjob_mkhomedir.so umask=0077 session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid session required pam_unix.so session optional pam_sss.so server.conf plugin /usr/lib64/openvpn/plugins/openvpn-plugin-auth-pam.so openvpn Any help would be greatly appreciated. Any other information that you may need, please feel free to ask. I've read multiple threads, some have gotten it to work without posting answers, some have not and has stated openvpn does not support multiple prompts. Eric

4 3

Get IPA server of location
by Peter Tselios 16 Nov '18

16 Nov '18

Hello, I have 2 FreeIPA servers placed in 2 AWS placement groups (AZ1, AZ2). I want to register my hosts in the IPA Server of the same placement group. Using dig I get the following: dig +short -t SRV _ldap._tcp.example.com. _ldap._tcp.AWS-eu-west-1a._locations.example.com. 50 100 389 euw1-prd-l-ipa02.example.com. 0 100 389 euw1-prd-l-ipa01.example.com. which, at least in my eyes, means that I have an LDAP server in a location. So, if I search this location I will get only ONE LDAP (or kerberos, it's the same) server. But no: dig +short -t SRV _ldap._tcp.AWS-eu-west-1a._locations.example.com. 50 100 389 euw1-prd-l-ipa02.example.com. 0 100 389 euw1-prd-l-ipa01.example.com. Now, I have some issues with this: Why do I have BOTH IPA servers in ONE location, since I have set only one of them in the specific location? Replication has nothing to do with it, we talk about the host of the location! If this a cognitive decision to add all replicated IPA servers to all locations? If so, why? Finally, is there any way to I get the IPA server(s) of a specific location? (My understanding is that we don't have the SUBNET entries as in IPA 2.x series and this is handled automatically with service discovery).

2 2

Mix and Match Local Users and Groups with IPA Users and Groups?
by Ryan Slominski 15 Nov '18

15 Nov '18

What is the recommended way to handle a local user in an IPA group? For example, I have the standard local user "apache" that I'd like to add to an IPA group. I don't really want to add an "apache" user to IPA as it isn't really a regular user. Similarly, I don't want to create a local group of the same name and membership as the group in IPA. NIS seems to allow groups that reference local users. Can IPA? An IPA User in a local group is a similar problem, what is the solution there?

3 3

smartcard auth + kerberos ticket?
by Natxo Asenjo 15 Nov '18

15 Nov '18

hi, I can successfully login using a smartcard (fedora 29 client, centos 7 kdcs, latest patch level). However, when I try to access a kerberized service, I need to kinit first, because I don't have a ticket: $ klist klist: Credentials cache 'KCM:1006000001' not found I already have krb5-pkinit in de client and if I kinit -n I get a wellknown/anonymous ticket from the kdcs, but this is obviously not what I had in mind :-) Am I doing something wrong or is this to be expected? -- regards, Natxo

4 10

Change IP address of IPA server
by John Duino 15 Nov '18

15 Nov '18

Due to some preferred changes in our environment, we would like to change the IP address of two of our servers. My thinking is that we stop IPA on those hosts, change their IP and power down, then change the IP in the DNS of the running IPA's, then bring the two servers up. I am assuming all associations are done via fqdn and not an IP, is that correct? Is this safe or am I risking some corruption to the environment? -- John Duino jduino(a)oblong.com

2 2

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users November 2018