June 2018 - FreeIPA-users - Fedora Mailing-Lists

by Thomas Letherby

Hello all, I'm running FreeIPA on two CentOS 7 servers, one, the master is on a physical server, the other (a replica with CA, DNS etc) is running on an Ovirt cluster. I patched the boxes and upgraded IPA on the two servers a few days ago, and the master ran through the upgrade without any issue, however the replica fails when starting the CA, timing out after the 300 seconds. Increasing the timeout to 600 didn't help, and I rebuilt the replica from scratch which still gives the same error. If I try and restart the services after promoting it it tells me to run the upgrade, and if I do so I get the same error as the install: 2018-06-15T04:48:07Z DEBUG The CA status is: check interrupted due to error: Retrieving CA status failed with status 500 2018-06-15T04:48:07Z DEBUG Waiting for CA to start... 2018-06-15T04:48:08Z DEBUG request POST <replica>:8080 2018-06-15T04:48:08Z DEBUG request body '' 2018-06-15T04:48:08Z DEBUG response status 500 2018-06-15T04:48:08Z DEBUG response headers Server: Apache-Coyote/1.1 Content-Type: text/html;charset=utf-8 2018-06-15T04:48:09Z DEBUG The ipa-server-upgrade command failed, exception: ScriptError: CA did not start in 300.0s 2018-06-15T04:48:09Z ERROR CA did not start in 300.0s Googling gets me similar problems people have had due to certificate expiry, but the dates look good as far as I can see and after a complete rebuild it should have issued new ones anyway I think. Digging through the logs I see variations on the below error, but I'm not sure why this would be the case: Could not connect to LDAP server host <Replica> port 636 Error netscape.ldap.LDAPException: Authentication failed (49) Browsing to http://<Replica>:8080/ca/admin/ca/getStatus Gets me this: *type* Exception report *message* *Subsystem unavailable* *description* *The server encountered an internal error that prevented it from fulfilling this request.* *exception* javax.ws.rs.ServiceUnavailableException: Subsystem unavailable com.netscape.cms.tomcat.ProxyRealm.findSecurityConstraints(ProxyRealm.java:145) org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:500) org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:103) org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:962) org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:445) org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1087) org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:637) org.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:316) java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) java.lang.Thread.run(Thread.java:748) *note* *The full stack trace of the root cause is available in the Apache Tomcat/7.0.76 logs.* I'm a bit stuck as to how to proceed fixing this, I'm not overly familiar with what logs do what with IPA, and I'm not seeing anything obviously wrong with the configuration. Has anyone seen this before, or can point me in the right direction to track this down? Thanks, Thomas

5 years, 10 months

2
2
0 / 0

FreeIPA in cloud environment

by Peter Viskup

Need to extend FreeIPA deployment into cloud environment (at the moment we use it in our HQ only) and seek for options how to do the deployment with keeping security in mind. Have some questions: - is it possible to configure FreeIPA replica for subtree? - not all FreeIPA accounts are required being available in cloud environment (not all teams use clouds), would be great to be able to limit amount of security objects being pushed to not controlled environment - is it possible to configure one way replica (HQ-to-cloud) with possibility to register hosts on cloud instance? - what are best practices for FreeIPA deployment in dynamic environment (e.g. in Kubernetes/Docker containers for DevOps)? - how to properly register/unregister hosts/containers? - what is the implementation status of External Authentication feature [1] (which might allow proper cloud deployment) [1] https://www.freeipa.org/page/V4/External_Authentication Peter

5 years, 10 months

2
1
0 / 0

Email account creation

by Alfredo De Luca

Hi all. We have freeIPA VERSION: 4.4.0, and we are creating users and all works fine. What if we would like to create as long as the username also its email account on our email server? Would it be possible? how? Cheers thx in advance -- *Alfredo*

5 years, 10 months

2
1
0 / 0

Replica can ipa-find but can't id

by Lachlan Musicman

CentOS 7.5 ipa --version VERSION: 4.5.4, API_VERSION: 2.228 When on my replica, and I use ipa idoverrideuser-find 'Default Trust View' <user> I get the expected results: -------------------------- 1 User ID override matched -------------------------- Anchor to override: :SID:S-1-5-21-55386287-1424373824-1154838474-51686 User login: <user> UID: 1503 GECOS: User Name GID: 1503 Home directory: /home/uname Login shell: /bin/bash ---------------------------- Number of entries returned 1 ---------------------------- But when I do id <user> I get id: uname: no such user What have I done wrong? I've also seen the error listed on this thread - could it be that my replica is not a trust agent? https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho... Having read https://bugzilla.redhat.com/show_bug.cgi?id=1206613 and https://pagure.io/freeipa/issue/7410 I see that I can test this [root@ipa-replica ~]# ipa server-show Server name: ipa-master.company.com Server name: ipa-master.company.com Managed suffixes: domain, ca Min domain level: 0 Max domain level: 1 Enabled server roles: CA server, NTP server, AD trust agent, AD trust controller [root@ipa-replica ~]# ipa server-show Server name: ipa-replica.company.com Server name: ipa-replica.company.com Managed suffixes: domain, ca Min domain level: 0 Max domain level: 1 Enabled server roles: CA server, NTP server It's not a trust agent or controller. I presume it should be? Yes, having now read to the end of ticket 7410 I see that I should have set the replica up with --setup-adtrust https://github.com/freeipa/freeipa/pull/1825 And from here https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho... it looks like I need to run ipa-adtrust-install --add-agents on the master and follow the prompts? L.

5 years, 10 months

2
5
0 / 0

sss_ssh_knownhostsproxy and known_hosts

by Chris Herdt

FreeIPA (via sssd) adds the following to my /etc/ssh/ssh_config: GlobalKnownHostsFile /var/lib/sss/pubconf/known_hosts PubkeyAuthentication yes ProxyCommand /usr/bin/sss_ssh_knownhostsproxy -p %p %h If I understand correctly, that means that `/etc/ssh/ssh_known_hosts` will not be referenced, correct? If I add an entry to /var/lib/sss/pubconf/known_hosts manually, it is not persistent. After I add the host key for my GitHub Enterprise host, for example, I still get the message: The authenticity of host 'github.example.com (<no hostip for proxy command>)' can't be established. When I check /var/lib/sss/pubconf/known_hosts after the attempted connection, the file is empty -- zero bytes. (I also noted in the man page for sssd.conf that the ssh_known_hosts_timeout has a default value of 180 seconds.) Is there a way to add public keys for arbitrary external hosts? If not, what are others doing as a workaround? Currently I am overriding the GlobalKnownHostsFile and ProxyCommand settings on a per user or per user per host basis, e.g.: GlobalKnownHostsFile /etc/ssh/ssh_known_hosts ProxyCommand none I'd rather avoid that if possible. -- Chris Herdt UIS Systems Administrator cherdt(a)umn.edu

5 years, 10 months

2
1
0 / 0

migrate stand-alone named to freeipa

by Peter Larsen

Is there an easy procedure to import an existing zone file on an existing stand-alone named server to freeipa? I saw some pages suggest you need to setup a zone-transfer - but that seems a rather complex way to replace one infrastructure with another (plus I don't want to transfer the SOA and NS records). -- Regards Peter Larsen

5 years, 10 months

3
4
0 / 0

Two way trust setup issue

by Merritt, Todd R - (tmerritt)

Hi, I'm trying to establish a two way trust with an AD domain and seem to be running into some issues. I am able to establish a one way trust following the guide at https://www.freeipa.org/page/Active_Directory_trust_setup without any issues. When I destroy that trust and try to establish a new one with two-way specified to the same AD domain it throws what I believe to be a misleading error message and the trust is not established. [root(a)IPA.DOMAIN /]# ipa trust-add --type=ad AD_DOMAIN --admin AD_ADMIN_USER --password --two-way=true Active Directory domain administrator's password: ipa: ERROR: AD DC was unable to reach any IPA domain controller. Most likely it is a DNS or firewall issue I've checked that both the AD DC and the free IPA hosts can resolve the service entries and verified that there are no firewall blocks in place between these two hosts. I believe the issue is an LDAP permission issue of some sort based on the following log snippet [29/May/2018:16:59:07 +0000] conn=1227 op=25 ADD dn="krbPrincipalName=krbtgt/AD_DOMAIN(a)IPA.DOMAIN,cn=AD_DOMAIN,cn=ad,cn=trusts,dc=arizona,dc=cui" [29/May/2018:16:59:07 +0000] conn=1227 op=25 RESULT err=0 tag=105 nentries=0 etime=0 csn=5b0d876e000c00040000 [29/May/2018:16:59:07 +0000] conn=1227 op=26 EXT oid="2.16.840.1.113730.3.8.10.1" name="Keytab Retrieval Extended Operation" [29/May/2018:16:59:07 +0000] conn=1227 op=26 RESULT err=0 tag=120 nentries=0 etime=0 [29/May/2018:16:59:07 +0000] conn=1227 op=27 SRCH base="cn=ad,cn=trusts,dc=IPA,dc=DOMAIN" scope=2 filter="(&(objectClass=ipaNTTrustedDomain)(|(ipaNTFlatName=AD_DOMAIN)(ipaNTTrustPartner=AD_DOMAIN)(cn=AD_DOMAIN)))" attrs=ALL [29/May/2018:16:59:07 +0000] conn=1227 op=27 RESULT err=0 tag=101 nentries=1 etime=0 [29/May/2018:16:59:07 +0000] conn=1227 op=28 SRCH base="cn=ad,cn=trusts,dc=IPA,dc=DOMAIN" scope=2 filter="(&(objectClass=ipaNTTrustedDomain)(ipaNTTrustedDomainSID=S-1-5-21-3264147221-199175665-3033697611))" attrs=ALL [29/May/2018:16:59:07 +0000] conn=1227 op=28 RESULT err=0 tag=101 nentries=1 etime=0 [29/May/2018:16:59:07 +0000] conn=1227 op=29 SRCH base="cn=ad,cn=trusts,dc=IPA,dc=DOMAIN" scope=2 filter="(&(objectClass=ipaNTTrustedDomain)(|(ipaNTFlatName=AD_DOMAIN)(ipaNTTrustPartner=AD_DOMAIN)(cn=AD_DOMAIN)))" attrs=ALL [29/May/2018:16:59:07 +0000] conn=1227 op=29 RESULT err=0 tag=101 nentries=1 etime=0 [29/May/2018:16:59:07 +0000] conn=1227 op=30 MOD dn="cn=AD_DOMAIN,cn=ad,cn=trusts,dc=IPA,dc=DOMAIN" [29/May/2018:16:59:07 +0000] conn=1227 op=30 RESULT err=50 tag=103 nentries=0 etime=0 csn=5b0d876e000f00040000 [29/May/2018:16:59:07 +0000] conn=1227 op=31 SRCH base="cn=ad,cn=trusts,dc=IPA,dc=DOMAIN" scope=2 filter="(&(objectClass=ipaNTTrustedDomain)(ipaNTTrustedDomainSID=S-1-5-21-3264147221-199175665-3033697611))" attrs=ALL [29/May/2018:16:59:07 +0000] conn=1227 op=31 RESULT err=0 tag=101 nentries=1 etime=0 [29/May/2018:16:59:07 +0000] conn=1227 op=32 SRCH base="cn=ad,cn=trusts,dc=IPA,dc=DOMAIN" scope=2 filter="(&(objectClass=ipaNTTrustedDomain)(ipaNTTrustedDomainSID=S-1-5-21-3264147221-199175665-3033697611))" attrs=ALL [29/May/2018:16:59:07 +0000] conn=1227 op=32 RESULT err=0 tag=101 nentries=1 etime=0 [29/May/2018:16:59:07 +0000] conn=1227 op=33 SRCH base="cn=ad,cn=trusts,dc=IPA,dc=DOMAIN" scope=2 filter="(&(objectClass=ipaNTTrustedDomain)(|(ipaNTFlatName=AD_DOMAIN)(ipaNTTrustPartner=AD_DOMAIN)(cn=AD_DOMAIN)))" attrs=ALL [29/May/2018:16:59:07 +0000] conn=1227 op=33 RESULT err=0 tag=101 nentries=1 etime=0 [29/May/2018:16:59:07 +0000] conn=1227 op=34 MOD dn="cn=AD_DOMAIN,cn=ad,cn=trusts,dc=IPA,dc=DOMAIN" [29/May/2018:16:59:07 +0000] conn=1227 op=34 RESULT err=50 tag=103 nentries=0 etime=0 csn=5b0d876e001000040000 I have run kinit prior to issuing the trust-add in both the two-way and one-way setup commands. Any thoughts where I should go from here? Thanks, Todd

5 years, 10 months

2
8
0 / 0

FreeIPA API dynamic inventory script for Ansible, Ansible AWX, and Ansible Tower

by Aaron Hicks

Hello the list, I thought I'd share this with you, it's a dynamic inventory script that uses the FreeIPA API to populate the Ansible inventory. I'm using it in AWX, but I expect it'll work with Ansible and RedHat Ansible Tower https://gist.github.com/Aethylred/0ea0d2899eca1da790aa078f9f2a885a Regards, Aaron

5 years, 10 months

1
0
0 / 0

ipa commands run from cron with keytab sometimes failing

by Roderick Johnstone

Hi Environment: RHEL 7.5, ipa-server-4.5.4-10.el7.x86_64 Part of our IPA backup strategy is to take ascii dumps of various tables every night using commands like 'ipa user-find --all --preserved=false' with output redirected to a file. We run a cron job which first gets a keytab for an ipa user and then runs several ipa commands to dump the tables. Every so often we are seeing (apparently at random) failures of one of the ipa commands early on in the script (usually the first or the second one). The rest of the commands then succeed. I'm appending some debug output from the script at the end of this message. In the httpd access_log on the server at the relevant time there is: [Wed Jun 13 21:30:04.437056 2018] [:error] [pid 29635] ipa: INFO: 401 Unauthorized: Insufficient access: SASL(-1): generic failure: GSSAPI Error: The referenced context has expired (Success) This used to work reliably until the update to RHEL7.4. I'd appreciate any thoughts on what might be causing this or where to look for further diagnostics. Thanks. Roderick Johnstone Here is the debug output: Attempting kinit Status is 0 Attempting non-preserved user dump: ** First try Status is 0 Attempting non-preserved user dump: ** Second try ipa: ERROR: ResponseNotReady: Traceback (most recent call last): File "/usr/lib/python2.7/site-packages/ipalib/cli.py", line 1359, in run sys.exit(api.Backend.cli.run(argv)) File "/usr/lib/python2.7/site-packages/ipalib/cli.py", line 1109, in run self.create_context() File "/usr/lib/python2.7/site-packages/ipalib/backend.py", line 127, in create_context self.Backend.rpcclient.connect() File "/usr/lib/python2.7/site-packages/ipalib/backend.py", line 66, in connect conn = self.create_connection(*args, **kw) File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 1034, in create_connection command([], {}) File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 1246, in _call return self.__request(name, args) File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 1213, in __request verbose=self.__verbose >= 3, File "/usr/lib64/python2.7/xmlrpclib.py", line 1273, in request return self.single_request(host, handler, request_body, verbose) File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 687, in single_request response = h.getresponse(buffering=True) File "/usr/lib64/python2.7/httplib.py", line 1101, in getresponse raise ResponseNotReady() ResponseNotReady ipa: ERROR: an internal error has occurred Status is 1 Attempting preserved user dump Status is 0 Attempting group dump Status is 0 ...

5 years, 10 months

2
1
0 / 0

Hardship setting up samba share that depends on IPA trust with AD

by William Muriithi

Hello everyone, I am attempting to setup a samba file server that uses IPA as a proxy to authentication AD users. I am using the document below as a template but its not working as currently documented. I am wondering if something has changed on the code since that time but the doc hasn't had any update. https://www.freeipa.org/page/Howto/Integrating_a_Samba_File_Server_With_IPA For the samba client, this is the version of binaries that I am using: [root@samba4 ~]# rpm -qa | grep samba samba-common-tools-4.7.1-6.el7.x86_64 samba-common-libs-4.7.1-6.el7.x86_64 samba-common-4.7.1-6.el7.noarch samba-4.7.1-6.el7.x86_64 samba-client-libs-4.7.1-6.el7.x86_64 samba-client-4.7.1-6.el7.x86_64 samba-libs-4.7.1-6.el7.x86_64 For IPA server, this is the version I am running: ipa-server-4.5.4-10.el7_5.1.x86_64 There is a trust relationship between the IPA and the Active directory. The AD is on corp.example.com domain and the IPA is on eng.example.com. When I point any of the IPA clients to \\samba4.eng.example.com, all works as expected. However, when I point any of the AD clients (Windows 10) to \\samba4.eng.example.com, I am not having any joy. After parsing the logs, the section below looks like the most relevant part of the logs. What would cause this issue? Any pointer on how to overcome it would be highly appreciated. Another odd thing is, if I enroll a RHEL 7 system to AD, and then attempt to browse the samba share, everything works fine. I have shared the full logs on the following link too. https://pastebin.com/wrycv1UR Regards, William [2018/06/13 13:42:20.963867, 5, pid=14330, effective(0, 0), real(0, 0)] ../auth/gensec/gensec_start.c:739(gensec_start_mech) Starting GENSEC mechanism spnego [2018/06/13 13:42:20.963942, 5, pid=14330, effective(0, 0), real(0, 0)] ../auth/gensec/gensec_start.c:739(gensec_start_mech) Starting GENSEC submechanism gse_krb5 [2018/06/13 13:42:20.964334, 10, pid=14330, effective(0, 0), real(0, 0)] ../lib/krb5_wrap/krb5_samba.c:1326(smb_krb5_kt_open_relative) smb_krb5_open_keytab: resolving: FILE:/etc/samba/samba.keytab [2018/06/13 13:42:20.965559, 10, pid=14330, effective(0, 0), real(0, 0)] ../source3/smbd/smb2_server.c:3011(smbd_smb2_request_done_ex) smbd_smb2_request_done_ex: idx[1] status[NT_STATUS_OK] body[64] dyn[yes:96] at ../source3/smbd/smb2_negprot.c:657 [2018/06/13 13:42:20.965625, 10, pid=14330, effective(0, 0), real(0, 0)] ../source3/smbd/smb2_server.c:923(smb2_set_operation_credit) smb2_set_operation_credit: requested 1, charge 1, granted 1, current possible/max 512/512, total granted/max/low/range 1/8192/2/1 [2018/06/13 13:42:35.997960, 10, pid=14330, effective(0, 0), real(0, 0)] ../source3/smbd/smb2_server.c:1080(smbd_server_connection_terminate_ex) smbd_server_connection_terminate_ex: conn[ipv4:192.168.11.108:61944] reason[NT_STATUS_CONNECTION_RESET] at ../source3/smbd/smb2_server.c:3935 [2018/06/13 13:42:35.998102, 4, pid=14330, effective(0, 0), real(0, 0)] ../source3/smbd/sec_ctx.c:320(set_sec_ctx_internal) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 [2018/06/13 13:42:35.998142, 5, pid=14330, effective(0, 0), real(0, 0)] ../libcli/security/security_token.c:53(security_token_debug) Security token: (NULL) [2018/06/13 13:42:35.998174, 5, pid=14330, effective(0, 0), real(0, 0)] ../source3/auth/token_util.c:651(debug_unix_user_token) UNIX token of user 0

5 years, 10 months

2
3
0 / 0

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users June 2018