May 2018 - FreeIPA-users - Fedora Mailing-Lists

using freeipa with an AWS elastic load balancer

by ridha.zorgui＠infor.com

I set up a FreeIPA master and replica behind an elastic load balancer in AWS cloud. FreeIPA Clients will be contacting the replica and the master sever through the load balancer so the dns name used when configurting the clients is the ELB CNAME. The problem is when retreiving ldap data and during the authentication, the SSL handshake fails as the certificate sent back from the master or replica has a hostname different than the one used in the sssd ( the ELB CNAME). so the connection is terminated. There is a workaround which is the use reqcert=allow but this bring a security issue with a MITM attack. another solution i found is the use SAN. I was able to add the ELB DNS as a SAN in freeipa servers certificate. i made sure it is there by downloading the certificate and checking that the elb san exist but when testing it the same problem remain. Please help.

5 years, 6 months

3
3
0 / 0

Can't install CA from replica file - Failed to import EncryptedPrivateKeyInfo to token

by H. Frenzel

Hi, I tried to install a CA to the 2nd master a replicafile which was created on the 1st master (with self-signed CA), with fails with: ipa : DEBUG stderr=TokenException: Failed to import EncryptedPrivateKeyInfo to token: (-8152) The key does not support the requested operation. What could be wrong here? - Please find the detailed debug log of ipa-ca-install as attachment. Thx & b/r H.

5 years, 6 months

3
3
0 / 0

How to replace a failed CA?

by Bret Wortman

I may be going about this in the hardest way possible, so let me stop and roll everything back to my root need: I have two IPA servers which manage our infrastructure. We used to have three, but a catastrophic failure on one led to its total loss. And it was our CA. So now we have no CA -- is there a way to promote an existing system to take over? I realize it may well mean distributing a new root CA cert to everyone, but that seems less painful now than trying to set up a brand new cluster of servers and try to port our data over to them... -- photo *Bret Wortman* President, Damascus Products LLC 855-644-2783 <tel:855-644-2783> | 303-523-8037 <tel:303-523-8037> | bret(a)damascusproducts.com <mailto:bret@damascusproducts.com> | http://damascusproducts.com/ | 10332 Main St Suite 319 Fairfax, VA 22030 <http://facebook.com/wrapbuddiesco> <http://twitter.com/wrapbuddiesco> <http://instagram.com/wrapbuddies> <https://facebook.com/wrapbuddiesco><https://instagram.com/wrapbuddies>

5 years, 7 months

5
9
0 / 0

Certificates renewing with the wrong Subject

by Roderick Johnstone

Hi Our freeipa certificates need to be renewed due to passing their expiry dates. While some certificates have renewed ok, the ipaCert and auditSigningCert are renewing but the new certificates have the wrong Subject. Environment is: serverA (CRL, first, master) RHEL 7.3, ipa 4.4 serverB (replica) RHEL 7.3, ipa 4.4 serverC (replica) RHEL 7.4, ipa 4.5 Once there are renewed certificates with the wrong Subject present, there are various problems with renewing the remaining certificates, which I think might be related to the bad Subject: 1) When just ipaCert has the wrong subject no further renewals happen 2) When auditSigningCert has the wrong subject the ipa pki-tomcatd service will not start and no further renewals happen. I've been round the following loop many times on ServerA, our first master: 1) Restore good certificates from backup 2) Put the clock back to a time when certificates are all valid 3) Resubmit certificates for renewal Each time the ipaCert renews it has the same wrong Subject. The wrong Subject includes the host name of one of our ipa client systems. Each time the auditSigningCert renews it has the same wrong Subject but a different subject to the ipaCert. The wrong Subject in this case includes the host name of a system which has never been an ipa client, but might have been added and removed with ipa host-add and ipa host-del for testing something, a while ago. As far as I can see, the "cert_subject" is set correctly in the file /var/lib/certmonger/<request id> until the point at which the certificate is actually renewed. I'd be very grateful for some pointers as to which configuration options and logs to check through to resolve this problem on our production system. If its of any relevance we did change which server is the first master some time ago. Thanks Roderick Johnstone

5 years, 8 months

3
21
0 / 0

Documented monitoring best practices

by Alex Corcoles

Hi all, Is there any official literature about how to monitor FreeIPA? The upstream guide mentions: 1) Testing clients using id https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/... 2) Adding a user on a replica and verifying it appears on another server https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/... There's also some troubleshooting appendices which look interesting. I see also ipactl, "ipa ping", there seems to be: https://www.freeipa.org/page/V4/Tool_to_Check_Status_of_All_Replicas (but it seems dead) https://www.freeipa.org/page/V4/Monitor_Replication_Topology , and also some indepedent initiatives all over the web. Is there any plan to provide an official way to monitor FreeIPA? My foremost concern would be to ensure that all clients are correctly enrolled and sudo/ssh work, so I am not locked out of my systems. Ensuring that replication works seems good and popular. Of course I can check that all services are running and ports respond. What are the most common ways for FreeIPA to break? Thoughts? Álex -- ___ {~._.~} ( Y ) ()~*~() mail: alex at corcoles dot net (_)-(_) http://alex.corcoles.net/

5 years, 8 months

5
5
0 / 0

Getting Synology NAS to play nice with FreeIPA

by Kristian Petersen

I have a synology NAS which hosts some SMB shares on my network. I would like to be able to use FreeIPA as the LDAP provider it checks against for authenticating these shares. I have a system user that I created in FreeIPA for this purpose. I configured the NAS to connect to my FreeIPA server for LDAP, but I get a message about a failure to access some users NT passwords and how the Samba service may not work for these users. It also says it could be either a lack of NT passwords for the users or insufficient privileges to access them. After chatting with Synology support they wanted me to enable CIFS plaintext password authentication. However, if I select that option it given me a warning about the share not being able to be the remote mount target of CIFS anymore due to SMB being set to v1 only and disabling the SMB related Bonjour service. If the system user doesn't have the needed privileges, how can I fix that since I can't enroll the NAS? -- Kristian Petersen System Administrator BYU Dept. of Chemistry and Biochemistry

5 years, 9 months

2
1
0 / 0

Server install fails on Ubuntu due to missing crypto.fips_enabled

by Kees Bakker

Hey, Trying to do a test installation of a FreeIPA server on Ubuntu 18.04. It fails setting up the certificate server (pki-tomcatd). Configuring certificate server (pki-tomcatd). Estimated time: 3 minutes [1/28]: configuring certificate server instance ipaserver.install.dogtaginstance: CRITICAL Failed to configure CA instance: CalledProcessError(Command ['/usr/sbin/pkispawn', '-s', 'CA', '-f', '/tmp/tmp5ejwx5'] returned non-zero exit status 1: u"pkispawn : ERROR ....... subprocess.CalledProcessError: Command '['sysctl', 'crypto.fips_enabled', '-bn']' returned non-zero exit status 255!\npkispawn : ERROR ........... server did not start after 60s\npkispawn : ERROR ....... server failed to restart\n") ipaserver.install.dogtaginstance: CRITICAL See the installation logs and the following files/directories for more information: ipaserver.install.dogtaginstance: CRITICAL /var/log/pki/pki-tomcat [error] RuntimeError: CA configuration failed. ipapython.admintool: ERROR CA configuration failed. ipapython.admintool: ERROR The ipa-server-install command failed. See /var/log/ipaserver-install.log for more information The failing command is: sysctl crypto.fips_enabled -bn On my system there is no /proc/sys/crypto. BTW. I'm installing in a LXC container, the host is Ubuntu 16.04. That should not matter, because none of my Ubuntu systems (16.04 and 18.04) have /proc/sys/crypto. The problem seems to be in pki/server/deployment/pkihelper.py When the sysctl commands fails due to a missing /proc/sys/crypto/fips_enabled or even /proc/sys/crypto it raises an exception. Notice that there is a ipaplatform with is_fips_enabled. Shouldn't that be used in pkihelper.py ? -- Kees

5 years, 10 months

5
9
0 / 0

Promoting CA replica to master

by Carlos Fernández Manteiga

Hi, We've created a new replica from our FreeIPA infrastructure, with CA capabilities. Now we want it to be the CA renewal master, as it's written here: https://www.freeipa.org/page/Howto/Promote_CA_to_Renewal_and_CRL_Master However, the first step, knowing which is the present master, is blocking us. ldapsearch does not return the info we need: ldapsearch -D 'cn=Directory Manager' -W -b 'cn=masters,cn=ipa,cn=etc,dc=bitban,dc=int' '(ipaConfigString=caRenewalMaster)' dn Enter LDAP Password: # extended LDIF # # LDAPv3 # base <cn=masters,cn=ipa,cn=etc,dc=bitban,dc=int> with scope subtree # filter: (ipaConfigString=caRenewalMaster) # requesting: dn # # search result search: 2 result: 0 Success # numResponses: 1 Neither one of the servers have "ca.crl.MasterCRL.enableCRLUpdates=true" on /etc/pki/pki-tomcat/ca/CS.cfg Is there any more updated doc about this? All FreeIPA servers are: CentOS Linux release 7.5.1804 (Core) VERSION: 4.5.4, API_VERSION: 2.228 Thank you

5 years, 10 months

2
6
0 / 0

rotate host keytabs

by Natxo Asenjo

hi, does anybody rotate host keytabs? Is it worth it security-wise? Reading on how AD computer objects reset their password every 30 days ( https://blogs.technet.microsoft.com/askds/2009/02/15/machine-account-pass...) got me thinking about the host keytabs ... Any ideas about this? -- Groeten, natxo

5 years, 10 months

3
4
0 / 0

auth to pther providers still using freeipa

by Andrew Meyer

My company is wanting to use FreeIPA for everything. However we also utilize other external services that have their own auth system but can support oauth, or gsuite/facebook etc etc. Is this possible w/ FreeIPA? Also,Searching through google I found this - Ipsilon. Would you recommend I use that? | | | Ipsilon By Ipsilon Project Ipsilon identity provider project homepage | | | Thank you!

5 years, 10 months

2
1
0 / 0

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users May 2018