October 2019 - FreeIPA-users - Fedora mailing-lists

sebastien.toulmonde@proximus.com
by TOULMONDE Sébastien (SPC/DCS) 10 Oct '19

10 Oct '19

sebastien.toulmonde(a)proximus.com This e-mail cannot be used for other purposes than Proximus business use. See more on https://www.proximus.be/maildisclaimer

1 0

Categories vs Groups
by Russell Jones 09 Oct '19

09 Oct '19

Hi all, I am in the beginning stages of researching moving from NIS to FreeIPA. I am running through the workshop on the FreeIPA github, and am having difficulty understanding the difference between categories and groups. For example, I have one HBAC rule that came pre-defined on my FreeIPA server for "allow_systemd-user" that says it applies for user category and host category of "all". But then the workshop has me add an HBAC rule to allow a user to access a specific host by adding user and host groups, not categories. I'm sure there is a simple difference between the two, but I am not having much luck finding these concepts explained anywhere in the documentation. Can you point me towards where I can find this? Thank you!

2 2

How to change the timeout of 60 seconds on the login with AD users
by SOLER SANGUESA Miguel 09 Oct '19

09 Oct '19

Hello, After a primary DNS server problem, I have realized that the IDM client has a timeout of 60 s for the log in. As the primary DNS was not working, server used the secondary DNS and it takes 4s for resolving any name, as I use AD users, on the authentication phase, all AD servers must be translated (9 servers) so it makes the authentication very slow and timeout of 60 s is triggered. I have modified the resolv.conf to make the transition to the second DNS server faster (resolving any name takes 2s), and then authentication is done on 48s so it works. But what I want to know is how to modify those 60s of timeout. I have checked the logs with debug_level = 9 and I don't see the "timeout" log. I have also changed (on client side): krb5_auth_timeout = 190 pam_id_timeout = 190 but it still have the timeout at 60s the client is: RHEL 6.10 (but I think it happens the same on RHEL 7) sssd-client-1.13.3-60.el6_10.2.x86_64 ipa-client-3.0.0-51.el6.x86_64 sssd.conf: [domain/IPAdomain] krb5_auth_timeout = 190 cache_credentials = True krb5_store_password_if_offline = True ipa_domain = IPAdomain id_provider = ipa auth_provider = ipa access_provider = ipa ldap_tls_cacert = /etc/ipa/ca.crt ipa_hostname = CLIENT.domain.org chpass_provider = ipa ipa_server = _srv_, IPASERVER1, IPASERVER2 dns_discovery_domain = IPAdomain [sssd] config_file_version = 2 services = nss, sudo, pam, ssh domains = IPAdomain default_domain_suffix = AD.domain [nss] filter_groups = root filter_users = root,iccsecure,tomcat,oracle reconnection_retries = 3 [pam] reconnection_retries = 3 pam_id_timeout = 190 [sudo] [ssh] On the Server side: RHEL 7.6 sssd-1.16.2-13.el7_6.8.x86_64 ipa-server-4.6.4-10.el7_6.3.x86_64 sssd.conf: [domain/IPAdomain] cache_credentials = True krb5_store_password_if_offline = True ipa_domain = IPAdomain id_provider = ipa auth_provider = ipa access_provider = ipa ipa_hostname = IPASERVER1 chpass_provider = ipa ipa_server = IPASERVER1 ipa_server_mode = True ldap_tls_cacert = /etc/ipa/ca.crt subdomain_homedir = %o [sssd] config_file_version = 2 services = nss, sudo, pam, ssh domains = IPAdomain [domain/IPAdomain/ADdomain] ldap_search_base = ou=XXX,dc=XXXX,dc=XXXXX,dc=XXX [nss] filter_groups = root filter_users = root, iccsecure, tomcat, oracle reconnection_retries = 3 memcache_timeout = 600 homedir_substring = /home [pam] reconnection_retries = 3 [ssh] [sudo] I have attached the logs, timeout is triggered at 12:21:50 Thanks & Regards.

2 1

Ipa user can't login via ssh
by Elhamsadat Azarian 09 Oct '19

09 Oct '19

### Request for enhancement as a Linux admin i want to login into my ipa client with a user that is defined in ipa-server UI. ### Issue I installed Ipa-server and an Ipa-client on CentOS7.6 I defined Internal DNS on ipa-server and i defined A and PTR records for client on ipa-server. now i can see my client in ipa-UI and i defined a user with name "elham" and i expect that it can login into ipa-client. when i login with root in ipa-client and i do sudo elham, it works and kinit elham works too but when i do ssh into ipa-client with this user, it show "Access denied" i have errors with this context: pam_reply : authentication failure to the client pam_sss: authentication falure im tired of this issue. please help me if you know the solution. #### Steps to Reproduce 1. define new user "elham" in ipa UI 2. SSH to ipa-client with elham 3. access denied #### Actual behavior (what happens) #### Expected behavior login into ipa-client successfully #### Version/Release/Distribution ipa-server 4.6.5-11.el7 ipa-client 4.6.4-10.el7.centos.3 Log files and config files are added below: krb5.conf ------------ #File modified by ipa-client-install includedir /etc/krb5.conf.d/ includedir /var/lib/sss/pubconf/krb5.include.d/ [logging] default = FILE:/var/log/krb5libs.log kdc = FILE:/var/log/krb5kdc.log admin_server = FILE:/var/log/kadmind.log [libdefaults] default_realm = LSHS.DC dns_lookup_realm = false dns_lookup_kdc = false rdns = false ticket_lifetime = 24h forwardable = yes allow_weak_crypto = true default_ccache_name = KEYRING:persistent:%{uid} [realms] LSHS.DC = { kdc = ipa-irvlt01.example.dc:88 admin_server = ipa-irvlt01.example.dc:749 default_domain = example.dc } [domain_realm] .example.com = LSHS.DC example.com = LSHS.DC ############################################ sssd.conf ------------- [domain/example.dc] cache_credentials = True krb5_store_password_if_offline = True ipa_domain = example.dc id_provider = ipa auth_provider = ipa access_provider = ipa ldap_tls_cacert = /etc/ipa/ca.crt ipa_hostname = ipacli-irvlt01.example.dc chpass_provider = ipa dyndns_update = True ipa_server = _srv_, ipa-irvlt01.example.dc dyndns_iface = ens160 dns_discovery_domain = example.dc debug_level = 10 [sssd] ########### AFTER IPA ################### #services = nss, sudo, pam, ssh services = nss, pam config_file_version = 2 ######################################### domains = example.dc debug_level = 10 [nss] homedir_substring = /home [pam] debug_level = 10 [sudo] [autofs] [ssh] [pac] [ifp] [secrets] [session_recording] ##########################################

4 4

Fwd: mod_rewrite proxying for CA
by Natxo Asenjo 08 Oct '19

08 Oct '19

hi, We need to deploy an Idm environment in a firewalled network with different layers (untrusted/semi-trusted/trusted). In the untrusted network there will be no Idm servers. In the trusted, we will have replicas with the base services (ldap/kerberos/dns). Hosts in the untrusted zone will talk to these replicas. In the trusted zone we will have replicas with the CA functionality as well, and obviously the idm servers will communicate between the semi-trusted and trusted zone. According to: https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/ht… "If you set up a replica without a CA, it will forward all requests for certificate operations to the CA server in your topology." The question is: will certmonger on hosts in the untrusted zone be able to request and renew certificates and have the requests proxied to the trusted zone servers with the CA service? I know mod_rewrite can do this using the [P] flag (https://httpd.apache.org/docs/2.4/rewrite/proxy.html) but is this something we can use for our goal? Thanks! -- Groeten, natxo

2 1

FreeIPA with multiple domains not mappings ids correctly on NFS
by Kevin Vasko 07 Oct '19

07 Oct '19

Hello, I’ve got FreeIPA setup where I have multiple domains for client machines depending on their geography. For example, ca.example.com, and ny.example.com. I have a NFS server in nfs-server.ny.example.com and users mapping the NFS server on their clients from ny.example.com and ca.example.com. Users in ny.example.com show files owner:group just fine but users in ca.example.com everything on the nfs server shows nobody:nogroup or nobody: 4294967294 On the clients I’m seeing this issue on I see these error messages in the log. Oct 4 16:53:14 aiml1 nfsidmap[7867]: nss_getpwnam: name ‘user(a)ny.example.com' does not map into domain 'ca.example.com’ I did some googling and people are saying to add the domain to /etc/idmapd.conf but since I already have multiple domains (3 actually) I don’t see how this will work for all instances unless I can add multiple domains. I don’t see an obvious way to add multiple domains. Is there a clean way to handle this? -Kevin

3 7

Re: Enabling more FreeIPA CA servers
by Stuart McRobert 07 Oct '19

07 Oct '19

Dear Rob, > Well, all IPA masters are equals more or less. It would be sort of a > stigma to mark one as a replica forever, for the only reason that it > wasn't installed first. This would be particularly confusing if the > first master was removed. A good point thanks, in which case may I suggest for clarity simply revising my suggested name from ipa-ca-install-replica to ipa-ca-install-additional-master helping to indicate exactly what this will do, i.e. any other CA servers will be safe and not at risk from this. > It looks for the existence of /etc/pki/pki-tomcat/ca/CS.cfg. Which is indeed present on our second server. > My guess is someone tried to install a CA at some point in the past and > it failed and they just left it. The installer is not idempotent and > there is no CA-specific uninstall so the only way around it is to fully > uninstall the master and try again. Having had a look around, found the initial install from Sep 2016 (probably F24 release as I have the upgrade to F26 in there), and indeed I did miss out --setup-ca option at the very start. Meanwhile returning to CA on this our second server it does indeed appear to be partially installed, URL to server:8080/ca/admin/ca/getStatus reports This XML file does not appear to have any style information associated with it. The document tree is shown below. <XMLResponse> <State>1</State> <Type>CA</Type> <Status>running</Status> <Version>10.3.5-12.fc26</Version> </XMLResponse> The install log file is also there, starting with: 2018-09-28T06:40:20Z DEBUG /usr/sbin/ipa-ca-install was invoked with options: {'external_cert_files': None, 'skip_schema_check': False, 'external_ca_type': None, 'unattended': False, 'no_host_dns': False, 'ca_signing_algorithm': None, 'debug': False, 'external_ca': False, 'skip_conncheck': False},None With highlights including Connection from master to replica is OK. Still goes well Loading deployment configuration from /tmp/tmpIR6kRz. Installing CA into /var/lib/pki/pki-tomcat. Storing deployment configuration into /etc/sysconfig/pki/tomcat/pki-tomcat/ca/deployment.cfg. Importing certificates from /tmp/ca.p12: 2018-09-28T06:42:47Z DEBUG stderr= 2018-09-28T06:42:47Z DEBUG wait_for_open_ports: localhost [8080, 8443] timeout 300 2018-09-28T06:42:49Z DEBUG Waiting until the CA is running which seems to be the problem: 2018-09-28T06:42:54Z DEBUG The CA status is: check interrupted due to error: Retrieving CA status failed with status 500 2018-09-28T06:42:54Z DEBUG Waiting for CA to start... 2018-09-28T06:42:55Z DEBUG request POST URL left out 2018-09-28T06:42:55Z DEBUG request body '' 2018-09-28T06:42:55Z DEBUG response status 500 and ending after five minutes of trying this with: 2018-09-28T06:47:48Z DEBUG The CA status is: check interrupted due to error: Retrieving CA status failed with status 500 2018-09-28T06:47:48Z DEBUG Waiting for CA to start... 2018-09-28T06:47:49Z DEBUG Traceback (most recent call last): File "/usr/lib/python2.7/site-packages/ipaserver/install/dogtaginstance.py", line 194, in start_instance self.start('pki-tomcat') File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 346, in start self.service.start(instance_name, capture_output=capture_output, wait=wait) File "/usr/lib/python2.7/site-packages/ipaplatform/redhat/services.py", line 218, in start self.wait_until_running() File "/usr/lib/python2.7/site-packages/ipaplatform/redhat/services.py", line 212, in wait_until_running raise RuntimeError('CA did not start in %ss' % timeout) RuntimeError: CA did not start in 300.0s 2018-09-28T06:47:49Z CRITICAL Failed to restart the Dogtag instance.See the installation log for details. 2018-09-28T06:47:49Z DEBUG duration: 302 seconds 2018-09-28T06:47:49Z DEBUG [16/26]: importing CA chain to RA certificate database 2018-09-28T06:47:49Z DEBUG Loading Index file from '/var/lib/ipa/sysrestore/sysrestore.index' 2018-09-28T06:47:49Z DEBUG Starting external process 2018-09-28T06:47:49Z DEBUG args=/usr/bin/certutil -d /etc/httpd/alias -L 2018-09-28T06:47:49Z DEBUG Process finished, return code=0 2018-09-28T06:47:49Z DEBUG stdout= Certificate Nickname Trust Attributes SSL,S/MIME,JAR/XPI .................. IPA CA CT,C,C ipaCert u,u,u Server-Cert u,u,u 2018-09-28T06:47:49Z DEBUG stderr= 2018-09-28T06:47:49Z DEBUG Traceback (most recent call last): File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 449, in start_creation run_step(full_msg, method) File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 439, in run_step method() File "/usr/lib/python2.7/site-packages/ipaserver/install/cainstance.py", line 836, in __import_ca_chain chain = self.__get_ca_chain() File "/usr/lib/python2.7/site-packages/ipaserver/install/cainstance.py", line 829, in __get_ca_chain raise RuntimeError("Unable to retrieve CA chain: %s" % str(e)) RuntimeError: Unable to retrieve CA chain: request failed with HTTP status 500 2018-09-28T06:47:49Z DEBUG [error] RuntimeError: Unable to retrieve CA chain: request failed with HTTP status 500 2018-09-28T06:47:49Z DEBUG File "/usr/lib/python2.7/site-packages/ipaserver/install/installutils.py", line 808, in run_script return_value = main_function() File "/usr/sbin/ipa-ca-install", line 300, in main promote(safe_options, options, filename) File "/usr/sbin/ipa-ca-install", line 272, in promote install_replica(safe_options, options, filename) File "/usr/sbin/ipa-ca-install", line 197, in install_replica ca_cert_bundle=ca_data) File "/usr/lib/python2.7/site-packages/ipaserver/install/cainstance.py", line 1393, in configure_replica self.start_creation(runtime=210) File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 449, in start_creation run_step(full_msg, method) File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 439, in run_step method() File "/usr/lib/python2.7/site-packages/ipaserver/install/cainstance.py", line 836, in __import_ca_chain chain = self.__get_ca_chain() File "/usr/lib/python2.7/site-packages/ipaserver/install/cainstance.py", line 829, in __get_ca_chain raise RuntimeError("Unable to retrieve CA chain: %s" % str(e)) 2018-09-28T06:47:49Z DEBUG The ipa-ca-install command failed, exception: RuntimeError: Unable to retrieve CA chain: request failed with HTTP status 500 A couple of questions: + Is there any way now to recover from this set back on our second server without risking the single CA server and get it fully operational? + The third server, also F26, does not appear to have ever had CA installed ls -la /etc/pki/pki-tomcat/ ls: cannot access '/etc/pki/pki-tomcat/': No such file or directory But as the second server failed to install, would it be safe to try here on the third, again without risking the single CA server? + Or is there a better way forward to getting more CA servers operational before going on to attempt an upgrade, say to F28 then to F30 across all the servers? Thanks Best wishes Stuart

1 0

Re: Enabling more FreeIPA CA servers
by Stuart McRobert 07 Oct '19

07 Oct '19

Dear Rob, Earlier you commented: > You can run ipa-ca-install at any time to add a CA to an existing > master. Indeed, however if I may suggest it might be useful to also have an alias ipa-ca-install-replica to clearly indicate it is safe to use this command and it will *not* end up replacing your current (possibly only) active CA. Experienced admins may know this couldn't happen, but others may not. I read and searched for examples first, but one tends to be rather cautious especially once you realise you only have a single CA installed. Alas in my case I see > [root@freeipa02 ~]# ipa-ca-install > CA is already installed on this host. yet ipa server-role-find --role "CA server" indicates for this server it has status absent, which ties up with other warnings about there only being one. > Server name: freeipa02... > Role name: CA server > Role status: absent I've not worked out why yet. Wondered if it might be installed but not enabled, and if so, would it have up to date information. Puzzled. Dear Satish, > All i would say please run multiple CA servers in your ldap > infrastructure, otherwise you will be in very big trouble like i was > in... Thanks and sorry to hear about the trouble you experienced, clearly I would like to avoid this happening here too. When I installed the FreeIPA servers a few years' ago I honestly didn't realise the CA hadn't been replicated along with everything else. Then in a newer version I happened to notice the warning via the web interface, only one CA server, although it might be useful to also include how to fix such an omission with the warning. As soon as I (and more experienced experts reading) can work out how to get CA replication operational in this case, I will sleep easier. I have already noticed the significant impact to services when freeipa01, our complete server, is even briefly down, which really wasn't my intention. Thanks to all. Best wishes Stuart

2 1

Re: Remove stale server entry from LDAP
by Rob Crittenden 04 Oct '19

04 Oct '19

Angus Clarke via FreeIPA-users wrote: > Hi all > > After decommissioning 2 IPA servers some time back (reduced from 8 to 6) > I recently noticed that one of the decommissioned servers still appears > when issuing commands like "ipa server-find." It only appears on 2 of > the existing servers, not the other 4. > > "ipa server-del" and "ipa-replica-manage del" both report "server not > found" for the decomm'ed server entry, when issued on any of the 6 IPA > servers. > > So I suspect I have some stale LDAP entry left behind from the > decommission process (I forget exactly what process I followed, it was > over a year ago) and was thinking about deleting that entry from LDAP. > > Not having much familiarity with LDAP, I found a post here from the > venerable Rob which tells me how to find such entries (with a bit of > fumbling with grep!) and indeed I see the entry on the 2 IPA servers but > not the other 4. > https://www.redhat.com/archives/freeipa-users/2015-December/msg00089.html > > > [root@ipa6 ~]# ldapsearch -Y GSSAPI -b cn=computers,cn=accounts,dc=dom > "krbprincipalkey=*" dn 2>/dev/null | grep ipa7.example.dom > # ipa7.example.dom + 9554ab01-42e811e8-a6dce53f-3a18cb6e, computers, acc > dn: fqdn=ipa7.example.dom+nsuniqueid=9554ab01-42e811e8-a6dce53f-3a18cb6 This is a replication conflict entry. You can use ldapdelete or ldapmodify to remove it. rob

1 0

Remove stale server entry from LDAP
by Angus Clarke 04 Oct '19

04 Oct '19

Hi all After decommissioning 2 IPA servers some time back (reduced from 8 to 6) I recently noticed that one of the decommissioned servers still appears when issuing commands like "ipa server-find." It only appears on 2 of the existing servers, not the other 4. "ipa server-del" and "ipa-replica-manage del" both report "server not found" for the decomm'ed server entry, when issued on any of the 6 IPA servers. So I suspect I have some stale LDAP entry left behind from the decommission process (I forget exactly what process I followed, it was over a year ago) and was thinking about deleting that entry from LDAP. Not having much familiarity with LDAP, I found a post here from the venerable Rob which tells me how to find such entries (with a bit of fumbling with grep!) and indeed I see the entry on the 2 IPA servers but not the other 4. https://www.redhat.com/archives/freeipa-users/2015-December/msg00089.html [root@ipa6 ~]# ldapsearch -Y GSSAPI -b cn=computers,cn=accounts,dc=dom "krbprincipalkey=*" dn 2>/dev/null | grep ipa7.example.dom # ipa7.example.dom + 9554ab01-42e811e8-a6dce53f-3a18cb6e, computers, acc dn: fqdn=ipa7.example.dom+nsuniqueid=9554ab01-42e811e8-a6dce53f-3a18cb6 Assuming this is the right thing to do, I could do with some advice on how to delete this entry from the 2 LDAP servers. Thanks in advance Angus

1 0

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users October 2019