Unable to delete replica - TLS error -8054...
by lejeczek
$ ipa-csreplica-manage del "long non-existent replica"
Unable to delete replica swir: Connect error: TLS error
-8054:You are attempting to import a cert with the same
issuer/serial as an existing cert, but that is not the same
cert.
Would you gents know where to start troubleshooting?
many thanks, L.
6 years
Re: Obtain TGT at login.
by Alexander Bokovoy
Don't drop the mailing list, please.
On ke, 04 huhti 2018, Michael Rainey (Contractor, Code 7320) wrote:
>I'm talking about Kerberos. Logging into the system is not an issue.
>How do I obtain a Ticket Granting Ticket (TGT) without having to
>execute "kinit" and enter a password.
>
>Once I log into my workstation, via console or graphical environment,
>I should have my kerberos credentials created or renewed and ready to
>use on my network. As it works currently, I log into my system, I
>open a terminal, run kinit and enter a password. Is it possible to
>configure my system to obtain my kerberos credentials without needing
>a password once I am successfully logged into my workstation?
This doesn't help either.
Unless you changed SSSD configuration, a default one on IPA clients
should populate your credentials cache.
That's why I'm asking for more details because without them it is
literally not possible to provide you any guidance.
A generic SSSD troubleshooting can be found here:
https://docs.pagure.org/SSSD.sssd/users/troubleshooting.html
>On 04/04/2018 11:20 AM, Alexander Bokovoy via FreeIPA-users wrote:
>>On ke, 04 huhti 2018, Michael Rainey (Contractor, Code 7320) via
>>FreeIPA-users wrote:
>>>Greetings,
>>>
>>>My organization is working to remove the need for passwords for
>>>its end-users. While moving forward on this project I have
>>>noticed after logging into a system the user is never given a TGT
>>>after login. A TGT can be obtained by using kinit and entering a
>>>password, but this defeats the purpose eliminating the use of
>>>passwords. Is there some guidance I can follow to configure
>>>freeIPA to obtain a TGT at login. So farmy searches have come up
>>>empty.
>>>
>>>Is this type of configuration handled by SSSD or do I need to
>>>configure kerberos?
>>>
>>>Any guidance is greatly appreciated.
>>What type of a login do you talk about? SSH access, console login, using
>>graphical environment, etc?
>>
>>Login without password is possible to achieve multiple ways. Which one
>>is in use here?
>>A bit more details on what is the workflow in use would help.
>>
>
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland
6 years
ipareplica role
by Thomas Woerner
Hello,
the ipareplica role just landed in the ansible-freeipa repo at
https://github.com/freeipa/ansible-freeipa
There are example playbooks for installation and uninstallation of replica with
(un)install-replica and (un)install-cluster. In the inventory directory there
are example inventory files hosts.replica and hosts.cluster.
The support for external cert files is not complete yet.
More docs are on the way to hit the repo soon.
Regards,
Thomas
6 years
How freeIPA saved the day on AWS EC2 ...
by Chris Dagdigian
FreeIPA with AD integration inside an AWS VPC took what was going to be
a 60-minute downtime on a production server and let me solve the issue
in about 60 seconds ...
Story below:
One of the great things about moving a company to AWS is that I can
usually delegate far more administrative powers to the end-users and
developers than they are used to having on-premise or coming out of a
managed services environment.
The downside to this power is that sometimes people accidentally do
inconvenient things like break /etc/sudoers file on an EC2 node
And since the usual best practice for secure AWS operations is:
- SSH with keys only (no passwords
- Sudo rules that allow passwordless power
But all of this hinges upon a sudo system that works.
If your sudoers file is broken then your AWS admin key is useless
because you can login but you can't use sudo to elevate yourself. Total
catch-22 problem.
Getting admin access locked out on an AWS EC2 server is really nasty.
Not all of us can run immutable infrastructure and not every server can
be built from start to finish using automation. The server in this case
was a massive beast with dozens of disk drives and LVM volumes in use.
Nightmare to rebuild even with good backups and automation.
The fix for this is operationally nasty and time consuming:
- Shut down server
- Detach root EBS volume
- Start new server in same subnet
- Mount the broken root disk onto the other server
- Manually fix the things that are broken
- Detach EBS disk and move back to original server
- Start original server and hope you fixed all the broken things
This can take 60 min or more if your automation is not prepared for
things like this.
This is where FreeIPA with RBAC rules saved the day.
I was able to SSH into the server using my corporate AD username and
password
And thanks to a good RBAC rule that lets me run sudo on all AWS hosts I
was able to "sudo su" and enter my AD password to gain root . The OS
interaction between PAM and IPA does not depend on /etc/sudoers being
syntactically correct!
... and this was the pivot I needed to fix the broken /etc/sudoers file
and allow regular admin ops to occur
Just wanted to shout out IPA for this. It totally took a 60min
production issue and turned it into a 2 minute issue
-Chris
6 years
NTP
by Andrew Meyer
I need some clarification on this. I have my FreeIPA server in talking. NTP is working. However Some servers are getting ntp drift. If I go into /etc/ntp.conf I see that at the bottom FreeIPA adds server at the bottom of the file.
### Added by IPA Installer ###server 127.127.1.0 iburstfudge 127.127.1.0 stratum 10server 1.2.3.4 # added by /sbin/dhclient-scriptserver 5.6.7.8 # added by /sbin/dhclient-scriptserver 9.0.1.2 # added by /sbin/dhclient-scriptserver 3.4.5.6 # added by /sbin/dhclient-script[centos@freeipa03 ~]$
But under the public servers at the top should I leave the the centos public ntp servers? Should I add the FreeIPA servers?
6 years
FreeIPA Certs for Chromebooks CMC,SCEP and extensions
by David Harvey
Hi FreeIPA users,
As briefly mentioned in "[Freeipa-users] FreeIPA PKI with OpenVPN",
I'm looking into using FreeIPA and Dogtag to provide network certs for
Chromebooks (from reading so far it looks like I'll need to use SCEP or CMC
- the latter being preferred).
Has anyone achieved this, or can anyone offer any pointers to either the
server or client/extension side hurdles?
Kind regards,
David
6 years
ca/agent/ca/displayBySerial': (SSL_ERROR_BAD_CERT_ALERT) SSL peer cannot verify your certificate.
by amitj1jan＠gmail.com
I came to the team new and don’t know the background, as to what all had been done, and recently we started getting one issue in DR environment:
Using IPA 3.0.0 in both PROD/DR
While trying to delete a host using IPA-UI or CLI, it is giving SSL error in DR(working in Prod):
cannot connect to 'https://hostname:443/ca/agent/ca/displayBySerial': (SSL_ERROR_BAD_CERT_ALERT) SSL peer cannot verify your certificate.
I set the debug mode and on making request: (ipa ping), I can see below error:
ipa: INFO: Connection to https:hostnmae/ipa/xml failed with (SSL_ERROR_RX_RECORD_TOO_LONG) SSL received a record that exceeded the maximum permissible length.
ipa: ERROR: cannot connect to Gettext('any of the configured servers', domain='ipa', localedir=None): https://hostname, https:hostname1/ipa/xml
On troubleshooting, came across this(https://www.freeipa.org/page/Troubleshooting#Authentication_Errors):
Ran below on DR:
Use getcert list -d /etc/httpd/alias -n ipaCert
Request ID '20170303094036':
status: MONITORING
stuck: no
------------------------------------
OK, till here, it means certificate nick-named ipaCert is being managed by Certmonger
If it isn't in MONITORING, or it is and things still aren't working, compare the serial number of the certificate with that on other IPA masters:
# certutil -L -d /etc/httpd/alias -n ipaCert | grep Serial
certutil: Could not find cert: ipaCert
: PR_FILE_NOT_FOUND_ERROR: File not found
So, something is wrong here.
In PROD, it works fine:
[root@ProdHostName ~]# certutil -L -d /etc/httpd/alias -n ipaCert | grep Serial
Serial Number: 7 (0x7)
Further, investing the issue on DR:
On DR:
[root@DRHostName ipacerts]# certutil -L -d /etc/httpd/alias
Certificate Nickname Trust Attributes
SSL,S/MIME,JAR/XPI
Internal_Issuing_CA CT,C,C
Internal_Root_CA CT,C,C
DRHostName u,u,u
On PROD:
[root@ProdHostName ~]# certutil -L -d /etc/httpd/alias
Certificate Nickname Trust Attributes
SSL,S/MIME,JAR/XPI
FQDN IPA CA CT,C,C
ipaCert u,u,u
Signing-Cert u,u,u
Server-Cert u,u,u
I am not sure, but certificate - ‘ipaCert’ not being shown on using ‘certutil’ command seems to be an issue, need guidelines to understand, whether my investigation is on current line and if yes, how to resolve this.
Will be happy to provide the output of any command or log-file.
Thanks,
Amit.
6 years
HOTP issues
by Spencer Shimko
Hi all,
I'm having problems with HOTP with hardware tokens. They are Yubkey
Neos, but physical access to the server is not a viable solution.
I've configured keys and converted the hex to base 32. I've also
generated HOTP via FreeIPA from the GUI and the CLI and converted
those to hex and wrote those to the key. Both approaches have been
tested and the generated OTPs appear to be valid.
The issue is that when HOTP is enabled OTP does not appear to work.
I've tested via kinit with an armored request and no pre-auth prompt
for the OTP is presented. However, when tested with TOTP a prompt does
appear and works appropriately.
Perusing the list and web led me to a bug that was specific to expired
passwords, which is not what I'm dealing with (AFAIK). I'm wondering
if anyone else is seeing this issue - HOTP not working when TOTP does
work.
Thanks,
--Spencer
6 years
Re: FreeIPA Assistance
by Vaibhav Jain
Thanks Michal,
++ Adding Team freeipa-users(a)lists.fedorahosted.org
Team Need help on the above concern.
On 28 March 2018 at 12:29, Michal Reznik <mreznik(a)redhat.com> wrote:
> Hello,
>
> Thanks for your interest in FreeIPA. I would like to point you to "
> freeipa-users(a)lists.fedorahosted.org" mailing list with regards of your
> question as my knowledge of AD domain is quite limited and so that also
> others can benefit from the info in the thread.
>
> Cheers...
>
>
> On Tue, Mar 27, 2018 at 8:08 PM, Vaibhav Jain <vaibhavjain882(a)gmail.com>
> wrote:
>
>> Hey Michal,
>>
>> Hope you are doing good. I am working with FreeIPA these days and I find
>> this software amazing. Currently I am struggling with one problem, How to
>> sync all the Windows AD users with password in FreeIPA deployed on a Centos
>> box in replication mode. I tried searching for this over internet but
>> didn't find any feasible solution for this. If you have any idea on this or
>> any document on this please share. That will be a great help for me. If you
>> know someone who can help me out with this please forward this mail to
>> him/her or add him in this mail chain.
>>
>> Happy to have your contact. :D
>>
>>
>> Thanks,
>> Vaibhav Jain
>> +91-8930011448 <+91%2089300%2011448>
>>
>
>
>
> --
>
>
> Michal Reznik
>
> FreeIPA QE,
>
> Red Hat Brno <https://www.redhat.com>
>
> mreznik(a)redhat.com
> <https://red.ht/sig>
>
>
6 years
