March 2019 - FreeIPA-users - Fedora mailing-lists

User certs in the webUI
by Stephen Berg (Code 7309) 28 Mar '19

28 Mar '19

Just noticed that when I view a user in the web UI I cannot see their certificates. From a command line the certs show up just fine. I'm browsing with Firefox 66.0.2 on a RHEL 7.6 system, servers are on 4.6.4 and CentOS 7.5 or 7.6. I did try the latest google-chrome and it behaved the same. Used a windows desktop and firefox and the certs show up in the webUI just fine. What is it about browsers on Linux that keeps that field from showing up? -- Stephen Berg, IT Specialist, Oceanography Division, Code 7309 Naval Research Laboratory W: (228) 688-5738 DSN: (312) 823-5738 C: (228) 365-0162

2 2

User certs in the webUI
by Stephen Berg (Code 7309) 27 Mar '19

27 Mar '19

Just noticed that when I view a user in the web UI I cannot see their certificates. From a command line the certs show up just fine. I'm browsing with Firefox 66.0.2 on a RHEL 7.6 system, servers are on 4.6.4 and CentOS 7.5 or 7.6. I did try the latest google-chrome and it behaved the same. Used a windows desktop and firefox and the certs show up in the webUI just fine. What is it about browsers on Linux that keeps that field from showing up? -- Stephen Berg, IT Specialist, Oceanography Division, Code 7309 Naval Research Laboratory W: (228) 688-5738 DSN: (312) 823-5738 C: (228) 365-0162

1 0

Where does DNS server come from?
by Kat 27 Mar '19

27 Mar '19

Hi all, Another weird question to ponder. In a client, working perfectly, and DNS is defined in resolv.conf as the IPA master within the LOCATION (yes, using the location feature of IPA). If I try to upgrade this same client to a replica using ipa-replica-install it fails with ipaserver.install.server.replicainstall: ERROR Could not resolve hostname ipa-master.example.com using DNS. And here is the kicker - when you look at the log of the install you see that the reason it could noto resolve ipa-master.example.com is NOT because it was not defined, but because it was now attempting to use the IPA master running DNS from another location and it timed out because firewalls block DNS lookup across these locations (although the masters can talk to each other) So my question is - why does replica-install pass a different DNS server to do the lookup rather than what was in /etc/resolv.conf? It is like it is asking to the master - "Hey, why not give me a random DNS server I can use?" and not relying on defined LOCATIONS. BTW - location features work perfectly for everything else, and you do see the proper weighting to SRV records so clients are not trying to contact the wrong IPA master to work. This has me baffled and I am trying to understand how I can get ipa-replica-install to NOT use a random DNS server in another location. Any ideas? Thanks -K

2 3

Something amiss with my replication
by Bret Wortman 26 Mar '19

26 Mar '19

Looks like I've somehow managed to get my 3 IPA servers out of sync: [root@ipa3 ~]# ipa-replica-manage list ipa3.my.net: master ipa4.my.net: master ipa5.my.net: master [root@ipa3 ~]# ipa host-find solr14.my.net --------------- 0 hosts matched --------------- ---------------------------- Number of entries returned 0 ---------------------------- On ipa4: [root@ipa3 ~]# ipa host-find solr14.my.net --------------- 1 hosts matched --------------- Host name: solr14.my.net ---------------------------- Number of entries returned 1 ---------------------------- On ipa5: [root@ipa3 ~]# ipa host-find solr14.my.net --------------- 1 hosts matched --------------- Host name: solr14.my.net Principal name: host/solr14.my.net(a)MY.NET (mailto:host/solr14.my.net@MY.NET) : : ---------------------------- Number of entries returned 1 ---------------------------- So they've obviously stopped talking. What's the right way to get them back in sync and ensure that they don't drift again? Is there a replication entry that's "stuck" and causing this? Bret Wortman Founder, Damascus Products, LLC 855-644-2783 (tel:855-644-2783) | bret(a)wrapbuddies.co (mailto:bret@wrapbuddies.co) http://wrapbuddies.co/ 70 Main St. Suite 23 Warrenton, VA 20186

3 8

Certificate renewal question
by Jeff Goddard 26 Mar '19

26 Mar '19

Hello everyone and thanks for providing the FreeIPA platform. I've got a situation where I have 4 FreeIPA peer servers, with 2 of them being CAs with replication configured. These are split into 2 physical locations with 1 CA per site. I was testing renewal of the "nickname='subsystemCert cert-pki-ca" certificate in one of my sites by issuing ipa-getcert resubmit -i [cert ID#]. Now this certificate seems to be stuck with a status of CA_Working. Since its been over 4 hours since I submitted the request I'm wondering if something went wrong and where I can begin looking to troubleshoot. I tried running ipa-certupdate to sync from the other CA master and it completed successfully. The original certificate was not expired and other than the "CA Working" status there are no apparent problems. The server is version 4.6.4 running on Centos 7.4. Do I have reason to be concerned or is this expected behavior? Thanks, Jeff

4 8

IPA 4.6.4 Error 32 Help Please
by Günther J. Niederwimmer 26 Mar '19

26 Mar '19

Hello, I found thousands of Errors in my "dirsrv Log" I mean after update to the last CentOS 7.6, or after I have to reinstall my secondary IPA Server ? What is the way to correct this mistake Problem? I have a second pair of IPA Server without this Problem and I can't say why this is now a Problem! The Errors are on the "oldest" Server, this Server is upgraded continuous from CentOS 7 to 7.6 Can any help or can say why I now have this Problem? The Log on the master/replica Server ipa.example.com I change the domain Name [16/Mar/2019:13:59:39.333399526 +0100] - ERR - slapi_ldap_bind - Error: could not bind id [cn=Replication Manager cloneAgreement1-ipa1.example.com-pki- tomcat,ou=csusers,cn=config] authentication mechanism [SIMPLE]: error 32 (No such object) [16/Mar/2019:14:04:39.497505189 +0100] - ERR - slapi_ldap_bind - Error: could not bind id [cn=Replication Manager cloneAgreement1-ipa1.example.com-pki- tomcat,ou=csusers,cn=config] authentication mechanism [SIMPLE]: error 32 (No such object) [16/Mar/2019:14:09:39.673523056 +0100] - ERR - slapi_ldap_bind - Error: could not bind id [cn=Replication Manager cloneAgreement1-ipa1.example.com-pki- tomcat,ou=csusers,cn=config] authentication mechanism [SIMPLE]: error 32 (No such object) [16/Mar/2019:14:14:39.457745480 +0100] - ERR - slapi_ldap_bind - Error: could not bind id [cn=Replication Manager cloneAgreement1-ipa1.example.com-pki- tomcat,ou=csusers,cn=config] authentication mechanism [SIMPLE]: error 32 (No such object) [16/Mar/2019:14:19:39.435129140 +0100] - ERR - slapi_ldap_bind - Error: could not bind id [cn=Replication Manager cloneAgreement1-ipa1.example.com-pki- tomcat,ou=csusers,cn=config] authentication mechanism [SIMPLE]: error 32 (No such object) [16/Mar/2019:14:24:39.460920984 +0100] - ERR - slapi_ldap_bind - Error: could not bind id [cn=Replication Manager cloneAgreement1-ipa1.example.com-pki- tomcat,ou=csusers,cn=config] authentication mechanism [SIMPLE]: error 32 (No such object) [16/Mar/2019:14:29:39.687580220 +0100] - ERR - slapi_ldap_bind - Error: could not bind id [cn=Replication Manager cloneAgreement1-ipa1.example.com-pki- tomcat,ou=csusers,cn=config] authentication mechanism [SIMPLE]: error 32 (No such object) Thank's for a answer, -- mit freundliche Grüßen / kind regards, Günther J. Niederwimmer

3 5

Replication issues, 3 servers not talking
by Bret Wortman 26 Mar '19

26 Mar '19

I've got 3 IPA servers, with replication agreements between the 3 as follows: [root@ipa3 ~]# ipa-replica-manage list ipa3.my.net: master ipa4.my.net: master ipa5.my.net: master [root@ipa3 ~]# ipa-replica-manage list ipa3.my.net (https://link.getmailspring.com/link/174919A3-6460-44D7-9328-2DE64BCCCDF6@ge…) ipa4.my.net: (https://link.getmailspring.com/link/174919A3-6460-44D7-9328-2DE64BCCCDF6@ge…) replica ipa5.my.net: (https://link.getmailspring.com/link/174919A3-6460-44D7-9328-2DE64BCCCDF6@ge…) replica [root@ipa3 ~]# ipa-replica-manage list ipa4.my.net (https://link.getmailspring.com/link/174919A3-6460-44D7-9328-2DE64BCCCDF6@ge…) ipa3.my.net: (https://link.getmailspring.com/link/174919A3-6460-44D7-9328-2DE64BCCCDF6@ge…) replica [root@ipa3 ~]# ipa host-find solr14.my.net (https://link.getmailspring.com/link/174919A3-6460-44D7-9328-2DE64BCCCDF6@ge…) --------------- 0 hosts matched --------------- ---------------------------- Number of entries returned 0 ---------------------------- [root@ipa4 ~]# ipa host-find solr14.my.net (https://link.getmailspring.com/link/174919A3-6460-44D7-9328-2DE64BCCCDF6@ge…) --------------- 1 hosts matched --------------- Host name: solr14.my.net ---------------------------- Number of entries returned 1 ---------------------------- [root@ipa5 ~]# ipa host-find solr14.my.net (https://link.getmailspring.com/link/174919A3-6460-44D7-9328-2DE64BCCCDF6@ge…) --------------- 1 hosts matched --------------- Host name: solr14.my.net (https://link.getmailspring.com/link/174919A3-6460-44D7-9328-2DE64BCCCDF6@ge…) Principal name: host/solr14.my.net(a)MY.NET (https://link.getmailspring.com/link/174919A3-6460-44D7-9328-2DE64BCCCDF6@ge…) : : ---------------------------- Number of entries returned 1 ---------------------------- So obviously something's gone awry. Did I somehow cause this? How can I prevent it in the future and how do I best go about getting 3 servers that agree with each other (short of picking one and re-replicating it to the others via re-initialize)? Bret Wortman Founder, Damascus Products, LLC 855-644-2783 (tel:855-644-2783) | bret(a)wrapbuddies.co (https://link.getmailspring.com/link/174919A3-6460-44D7-9328-2DE64BCCCDF6@ge…) http://wrapbuddies.co/ (https://link.getmailspring.com/link/174919A3-6460-44D7-9328-2DE64BCCCDF6@ge…) 70 Main St. Suite 23 Warrenton, VA 20186

1 0

Peer's certificate issuer has been marked as not trusted by the user
by Chris Mohler 25 Mar '19

25 Mar '19

Hi Freeipa-users, I've done some more troubleshooting on my own and I'm still having issues related to this. https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost… I've got all my certificates tracking but I'm stuck and can't get two of them to renew. Request ID '20181230160145': status: CA_UNREACHABLE ca-error: Error 7 connecting to http://ipa1.cs.oberlin.edu:8080/ca/ee/ca/profileSubmit: Couldn't connect to server. stuck: no key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert cert-pki-ca',token='NSS Certificate DB',pin set certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert cert-pki-ca',token='NSS Certificate DB' CA: dogtag-ipa-ca-renew-agent issuer: CN=Certificate Authority,O=CS.OBERLIN.EDU subject: CN=CA Audit,O=CS.OBERLIN.EDU expires: 2018-12-31 13:28:03 UTC key usage: digitalSignature,nonRepudiation pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "auditSigningCert cert-pki-ca" track: yes auto-renew: yes Request ID '20181230160146': status: CA_UNREACHABLE ca-error: Error 7 connecting to http://ipa1.cs.oberlin.edu:8080/ca/ee/ca/profileSubmit: Couldn't connect to server. stuck: no key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert cert-pki-ca',token='NSS Certificate DB',pin set certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert cert-pki-ca',token='NSS Certificate DB' CA: dogtag-ipa-ca-renew-agent issuer: CN=Certificate Authority,O=CS.OBERLIN.EDU subject: CN=OCSP Subsystem,O=CS.OBERLIN.EDU expires: 2018-12-31 13:26:43 UTC eku: id-kp-OCSPSigning pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "ocspSigningCert cert-pki-ca" track: yes auto-renew: yes I've already set the date back to Dec 30 of 2018 and tried "service certmonger restart" It doesn't work for these two. As far as I can tell I can't renew these because I can't contact the CA renewal master running on the localhost. I'm inferring that from "ca-error: Error 7 connecting to http://ipa1.cs.oberlin.edu:8080/ca/ee/ca/profileSubmit: Couldn't connect to server." Also I verified that the I'm working on the Renewal master: [root@ipa1 ca]# ipa config-show| grep "IPA CA renewal master" IPA CA renewal master: ipa1.cs.oberlin.edu I think the main cause of this is because I can't get the pki-tomcatd Service started [root@ipa1 ca]# ipactl status Directory Service: RUNNING krb5kdc Service: RUNNING kadmin Service: RUNNING httpd Service: RUNNING ipa-custodia Service: RUNNING ntpd Service: STOPPED pki-tomcatd Service: STOPPED ipa-otpd Service: STOPPED ipa: INFO: The ipactl command was successful When I look at /var/log/pki/pki-tomcat/ca/debug I get the following error: Internal Database Error encountered: Could not connect to LDAP server host ipa1.cs.oberlin.edu port 636 Error netscape.ldap.LDAPException: Unable to create socket: org.mozilla.jss.ssl.SSLSocketException: org.mozilla.jss.ssl.SSLSocketException: SSL_ForceHandshake failed: (-8172) Peer's certificate issuer has been marked as not trusted by the user. (-1) I'm not using 3rd party SSL's and never have. I'm trying to start pki tomcat with this command: # systemctl start pki-tomcatd(a)pki-tomcat.service any suggestions?

1 1

ipanthHash and Synchronization with Active directory
by mustafa taha 25 Mar '19

25 Mar '19

Hi i have integrated a FreeIPA domian with an Active Directory domain by synchronization . but my problem is that when i add user to AD , its sync user data and password to FreeIPA. but when i update the user password , the FreeIPA hadn't generated ipantHash attribute until i ran ipa-adtrust-install for each new user and change the user password again. so is there a way to make the FreeIPA to generate ipantHash attribute for the new users without run ipa-adtrusrt-install for each user addition in AD ?

3 2

the old 406 error
by Kat 24 Mar '19

24 Mar '19

Hi all, So I was searching around, still trying to find an answer, but sadly it seems to never have been solved. I found a repeat of the exact same error I have been seeing, and because of it, unable to add any new replicas -- https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost… If you look at that, it was 2017. No one ever responded with any help. I posted the exact same problem this year and nada as well. I love IPA, but am stuck with being able to expand the usage. Sure I have a RedHat support contract, but even response there has been non-existent to solve this problem, is anyone able to provide any help or am I stuck and need to move away from RHEL and IPA? :-( Done configuring the web interface (httpd). Configuring ipa-otpd [1/2]: starting ipa-otpd [2/2]: configuring ipa-otpd to start on boot Done configuring ipa-otpd. Configuring ipa-custodia [1/4]: Generating ipa-custodia config file [2/4]: Generating ipa-custodia keys [3/4]: starting ipa-custodia [4/4]: configuring ipa-custodia to start on boot Done configuring ipa-custodia. Your system may be partly configured. Run /usr/sbin/ipa-server-install --uninstall to clean up. *ipapython.admintool: ERROR 406 Client Error: Failed to validate message: No recipient matched the provided key["Failed: [ValueError('Decryption failed.',)]"]* ipapython.admintool: ERROR The ipa-replica-install command failed. See /var/log/ipareplica-install.log for more information

2 2

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users March 2019