March 2019 - FreeIPA-users - Fedora mailing-lists

Removal & clean up certificates from o=ipaca
by David Goudet 30 Sep '24

30 Sep '24

Hello all, I have to clean up lot of useless certificate in dirsrv database. Because of resubmit loop on Certmonger client, i have 99,9% of certificate in dirsrv database that are useless and not obsolete (expiration in 2020) (it represent ~85 000 certificates). These useless certificates produce some issues on FreeIPA: - decrease FreeIPA performances on CLI and GUI - increase the LDAP size - increase size and time of FreeIPA backup ... Is it possible to purge these certificates in dirsrv database and how? I found two branches in LDAP directory about these certificates: dn: cn=xxx,ou=ca,ou=requests,o=ipaca dn: cn=yyy,ou=certificateRepository,ou=ca,o=ipaca I can remove all requests and certificates entry from dirsrv database but how it is supported by PKI manager Dogtag (CRL, certificate generation, OCSP)? (This topic has already been discuss on https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost…) Thank you for you help -- David GOUDET LYRA NETWORK IT Operations service Tel : +33 (0)5 32 09 09 74 | Poste : 574

4 7

How to prevent non-admin users of FreeIPA from reading the list of users in the web interface?
by cdknight 16 Apr '24

16 Apr '24

When a user signs in to FreeIPA, I do not want them to be able to view the list of users in my LDAP server under the "Active users" link. I still want them to be able to administer self-service, so they can reset their password, add OTP tokens, etc. How would I go about doing this? The users will only be able to access the web interface, so it doesn't matter whether they can access it from other sources.

5 10

FreeIPA web session timeout
by Yuri Krysko 10 Jan '24

10 Jan '24

Hello, Could you please advise how to configure FreeIPA web UI user session timeout? Thanks, Yuri ________________________________ LEGAL DISCLAIMER: M.C. Dean, Inc. and its subsidiaries considers this e-mail and any files transmitted with it to be protected, proprietary or privileged information intended solely for the use of the named recipient(s). Any disclosure of this material or the information contained herein, in whole or in part, to anyone outside of the intended recipient or affiliates is strictly prohibited. M. C. Dean, Inc. accepts no liability for the content of this e-mail or for the consequences of any actions taken on the basis of the information contained in it, unless that information is subsequently confirmed in writing. Employees of M.C. Dean, Inc. are instructed not to infringe on any rights of the recipient; any such communication violates company policy. If you are not the intended recipient, any disclosure, copying, distribution, or action taken or omitted in reliance on this information is strictly prohibited by M.C. Dean, Inc.; please notify the sender immediately by return e-mail, delete this communication and destroy all copies.

4 4

Allow sysaccount to view its own entry
by Adam Bishop 09 Nov '23

09 Nov '23

I have a piece of software that tries to look up its own uid to check that LDAP is correctly configured. This check fails because the sysaccount cannot view anything under cn=etc,cn=sysaccounts. Is there an existing permission/privilege that I can use to allow it to read the sysaccounts tree (or better, just its own entry)? Many Thanks, Adam Bishop

4 3

kinit: KDC can't fulfill requested option while renewing credentials - which approach?
by Pieter Baele 19 Sep '23

19 Sep '23

I tried various approached to get Renewable tickets : modifying the kdc modifying krb5.conf using kadmin.local on every replica to modify the principal; which is not working - as designed (?)- in IPA What should I do to get a ticket with the correct R flag from IPA ? I don't think this is SSSD related (the service needing the renewable ticket this way is Apache Storm) Thanks a lot!

3 4

Do keytabs expire?
by Ronald Wimmer 07 Jun '23

07 Jun '23

Hi, today I found out that some entries in a keytab file seemed to have expired: Request ticket server HTTP/mwc.linux.mydomain.at(a)LINUX.MYDOMAIN.AT kvno 4 not found in keytab; keytab is likely out of date Fetching the keytab again with ipa-getkeytab fixed the problem. But why is this happening? Do keytab entries expire? I have not set any custom password or ticket policies. Regards, Ronald

4 13

ipa-replica-install -- cannot get past [26/41]: creating DS keytab
by Jonathon Jenkins 28 Mar '23

28 Mar '23

Greetings, I cannot get the ipa-replica-install to proceed past step 26/41 - creating DS keytab. I see the command that is to be run, and I can run that just fine before and after the ipa-replica-install command, and it creates the keytab. I am not sure how to proceed from here - the bug reports I see all pertain to earlier versions, and my files reflect those changes. I have also tried running this with all manner of password flags, which are correct, but still getting insufficient access rights. particulars: centos 7 3.10.0-957.1.3.el7.x86_64 ipa-server-4.6.4-10.el7.centos.x86_64 ipa-common-4.6.4-10.el7.centos.noarch ipa-server-common-4.6.4-10.el7.centos.noarch ipa-client-4.6.4-10.el7.centos.x86_64 ipa-server-dns-4.6.4-10.el7.centos.noarch ipa-client-common-4.6.4-10.el7.centos.noarch * Note: anonymized output below ipapython.ipautil: DEBUG stderr= ipalib.backend: DEBUG Created connection context.ldap2_139891568509776 ipaserver.install.service: DEBUG duration: 7 seconds ipaserver.install.service: DEBUG [26/41]: creating DS keytab [26/41]: creating DS keytab ipalib.frontend: DEBUG raw: service_add(u'ldap/<ipa-replica-host>@<domain>.NET', force=True, version=u'2.229') ipalib.frontend: DEBUG service_add(ipapython.kerberos.Principal('ldap/<ipa-replica-host>@<domain>.NET'), force=True, all=False, raw=False, version=u'2.229', no_members=False) ipalib.frontend: DEBUG raw: host_show(u'<ipa-replica-host>', version=u'2.229') ipalib.frontend: DEBUG host_show(u'<ipa-replica-host>', rights=False, all=False, raw=False, version=u'2.229', no_members=False) ipalib.install.sysrestore: DEBUG Backing up system configuration file '/etc/dirsrv/ds.keytab' ipalib.install.sysrestore: DEBUG -> Not backing up - '/etc/dirsrv/ds.keytab' doesn't exist ipapython.ipautil: DEBUG Starting external process ipapython.ipautil: DEBUG args=/usr/sbin/ipa-getkeytab -k /etc/dirsrv/ds.keytab -p ldap/<ipa-replica-host>@<domain>.NET -H ldaps://<ipa-replica-master> ipapython.ipautil: DEBUG Process finished, return code=9 ipapython.ipautil: DEBUG stdout= ipapython.ipautil: DEBUG stderr=Failed to parse result: Insufficient access rights Retrying with pre-4.0 keytab retrieval method... Failed to parse result: Insufficient access rights Failed to get keytab! Failed to get keytab ipaserver.install.service: DEBUG Traceback (most recent call last): File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 570, in start_creation run_step(full_msg, method) File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 560, in run_step method() File "/usr/lib/python2.7/site-packages/ipaserver/install/dsinstance.py", line 1308, in request_service_keytab super(DsInstance, self).request_service_keytab() File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 742, in request_service_keytab self.run_getkeytab(self.api.env.ldap_uri, self.keytab, self.principal) File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 732, in run_getkeytab ipautil.run(args, nolog=nolog) File "/usr/lib/python2.7/site-packages/ipapython/ipautil.py", line 562, in run raise CalledProcessError(p.returncode, arg_string, str(output)) CalledProcessError: Command '/usr/sbin/ipa-getkeytab -k /etc/dirsrv/ds.keytab -p ldap/<ipa-replica-host>@<domain>.NET -H ldaps://<ipa-replica-master>' returned non-zero exit status 9 ipaserver.install.service: DEBUG [error] CalledProcessError: Command '/usr/sbin/ipa-getkeytab -k /etc/dirsrv/ds.keytab -p ldap/<ipa-replica-host>@<domain>.NET -H ldaps://<ipa-replica-master>' returned non-zero exit status 9 [error] CalledProcessError: Command '/usr/sbin/ipa-getkeytab -k /etc/dirsrv/ds.keytab -p ldap/<ipa-replica-host>@<domain>.NET -H ldaps://<ipa-replica-master>' returned non-zero exit status 9 ipalib.backend: DEBUG Destroyed connection context.ldap2_139891548583120 ipalib.install.sysrestore: DEBUG Backing up system configuration file '/etc/ipa/default.conf' ipalib.install.sysrestore: DEBUG Saving Index File to '/var/lib/ipa/sysrestore/sysrestore.index' Your system may be partly configured. Run /usr/sbin/ipa-server-install --uninstall to clean up. ipapython.admintool: DEBUG File "/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 178, in execute return_value = self.run() File "/usr/lib/python2.7/site-packages/ipapython/install/cli.py", line 319, in run return cfgr.run() File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 364, in run return self.execute() File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 389, in execute for rval in self._executor(): File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 434, in __runner exc_handler(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 463, in _handle_execute_exception self._handle_exception(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 453, in _handle_exception six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 424, in __runner step() File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 421, in <lambda> step = lambda: next(self.__gen) File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from value = gen.send(prev_value) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 658, in _configure next(executor) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 434, in __runner exc_handler(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 463, in _handle_execute_exception self._handle_exception(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 521, in _handle_exception self.__parent._handle_exception(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 453, in _handle_exception six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 518, in _handle_exception super(ComponentBase, self)._handle_exception(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 453, in _handle_exception six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 424, in __runner step() File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 421, in <lambda> step = lambda: next(self.__gen) File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from value = gen.send(prev_value) File "/usr/lib/python2.7/site-packages/ipapython/install/common.py", line 65, in _install for unused in self._installer(self.parent): File "/usr/lib/python2.7/site-packages/ipaserver/install/server/__init__.py", line 622, in main replica_install(self) File "/usr/lib/python2.7/site-packages/ipaserver/install/server/replicainstall.py", line 406, in decorated func(installer) File "/usr/lib/python2.7/site-packages/ipaserver/install/server/replicainstall.py", line 1431, in install fstore=fstore) File "/usr/lib/python2.7/site-packages/ipaserver/install/server/replicainstall.py", line 113, in install_replica_ds setup_pkinit=not options.no_pkinit, File "/usr/lib/python2.7/site-packages/ipaserver/install/dsinstance.py", line 419, in create_replica self.start_creation(runtime=30) File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 570, in start_creation run_step(full_msg, method) File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 560, in run_step method() File "/usr/lib/python2.7/site-packages/ipaserver/install/dsinstance.py", line 1308, in request_service_keytab super(DsInstance, self).request_service_keytab() File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 742, in request_service_keytab self.run_getkeytab(self.api.env.ldap_uri, self.keytab, self.principal) File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 732, in run_getkeytab ipautil.run(args, nolog=nolog) File "/usr/lib/python2.7/site-packages/ipapython/ipautil.py", line 562, in run raise CalledProcessError(p.returncode, arg_string, str(output)) ipapython.admintool: DEBUG The ipa-replica-install command failed, exception: CalledProcessError: Command '/usr/sbin/ipa-getkeytab -k /etc/dirsrv/ds.keytab -p ldap/<ipa-replica-host>@<domain>.NET -H ldaps://<ipa-replica-master>' returned non-zero exit status 9 ipapython.admintool: ERROR Command '/usr/sbin/ipa-getkeytab -k /etc/dirsrv/ds.keytab -p ldap/<ipa-replica-host>@<domain>.NET -H ldaps://<ipa-replica-master>' returned non-zero exit status 9 ipapython.admintool: ERROR The ipa-replica-install command failed. See /var/log/ipareplica-install.log for more information

2 2

Problem running IPA client on IPv6 only connection
by William Muriithi 26 Jul '22

26 Jul '22

Hello, I have an IPA clients that has both IPv4 and IPv6 addresses. One of the IPA client is in the office and hence can reach the IPA server on both IPv4 and IPv6. However, the client outside the LAN can only reach the IPA server over IPv6. I was able to enroll the external client fine over IPv6 and from the logs, all clean. However, when I attempted to ssh, its not able to retreave the user from IPA. The client in the office works fine. I can also make for example LDAP queries and they work over IPv6 fine. It looks like kerberos is somehow however using IPv4. I reached this conclusion after taking a tcpdump when attempting to ssh to the server and the kerberos traffic from the client to IPA is on IPv4. What would I need to do on the IPA client for it to prefer IPv6? I am aware I could remove IPv4 address from DNS, but that would break any communication from IPv4 only systems. Any assistance would be appreaciated. [william@ansible ~]$ ssh root(a)mars.external.example.com Last login: Mon Jan 7 17:19:49 2019 from 65.98.193.94 [root@mars ~]# kinit admin kinit: Cannot contact any KDC for realm 'EXTERNAL.EXAMPLE.COM <http://external.example.com/>' while getting initial credentials [root@mars ~]# ldapsearch -x -b cn=ftp,cn=groups,cn=compat,dc=external,dc=example,dc=com | tail -n 4 result: 0 Success # numResponses: 2 # numEntries: 1 [root@mars ~]# cat /etc/resolv.conf search external.example.com nameserver 2607:4860:6000:a::5 [root@mars ~]# Regards, William

5 10

Broken ipa replica
by Giulio Casella 08 May '22

08 May '22

Hi everyone, I'm stuck with a broken replica. I had a setup with two ipa server in replica (ipa-server-4.6.4 on CentOS 7.6), let's say "idc01" and "idc02". Due to heavy load idc01 crashed many times, and was not working anymore. So I tried to redo the replica again. At first I tried to "ipa-replica-manage re-initialize", with no success. Now I'm trying to redo from scratch the replica setup: on idc02 I removed the segments (ipa topologysegment-del, for both ca and domain suffix), on idc01 I removed everything (ipa-server-install --uninstall), then I joined domain (ipa-client-install), and everything is working so far. When doing "ipa-replica-install" on idc01 I get: [...] [28/41]: setting up initial replication Starting replication, please wait until this has completed. Update in progress, 22 seconds elapsed [ldap://idc02.my.dom.ain:389] reports: Update failed! Status: [Error (-11) connection error: Unknown connection error (-11) - Total update aborted] And on idc02 (the working server), in /var/log/dirsrv/slapd-MY-DOM-AIN/errors I find lines stating: [20/Mar/2019:09:28:06.545187923 +0100] - INFO - NSMMReplicationPlugin - repl5_tot_run - Beginning total update of replica "agmt="cn=meToidc01.my.dom.ain" (idc01:389)". [20/Mar/2019:09:28:26.528046160 +0100] - ERR - NSMMReplicationPlugin - perform_operation - agmt="cn=meToidc01.my.dom.ain" (idc01:389): Failed to send extended operation: LDAP error -1 (Can't contact LDAP server) [20/Mar/2019:09:28:26.530763939 +0100] - ERR - NSMMReplicationPlugin - repl5_tot_log_operation_failure - agmt="cn=meToidc01.my.dom.ain" (idc01:389): Received error -1 (Can't contact LDAP server): for total update operation [20/Mar/2019:09:28:26.532678072 +0100] - ERR - NSMMReplicationPlugin - release_replica - agmt="cn=meToidc01.my.dom.ain" (idc01:389): Unable to send endReplication extended operation (Can't contact LDAP server) [20/Mar/2019:09:28:26.534307539 +0100] - ERR - NSMMReplicationPlugin - repl5_tot_run - Total update failed for replica "agmt="cn=meToidc01.my.dom.ain" (idc01:389)", error (-11) [20/Mar/2019:09:28:26.561763168 +0100] - INFO - NSMMReplicationPlugin - bind_and_check_pwp - agmt="cn=meToidc01.my.dom.ain" (idc01:389): Replication bind with GSSAPI auth resumed [20/Mar/2019:09:28:26.582389258 +0100] - WARN - NSMMReplicationPlugin - repl5_inc_run - agmt="cn=meToidc01.my.dom.ain" (idc01:389): The remote replica has a different database generation ID than the local database. You may have to reinitialize the remote replica, or the local replica. It seems that idc02 remembers something about the old replica. Any hint? Thank you in advance, Giulio

5 10

IPA CA allow CSR SAN names in external domains
by Steve Dainard 14 Mar '22

14 Mar '22

Hello I have a RHEL7 IPA server installed as a subordinate CA. I'd like to be able to add SAN's for a different dns domain than exists in the IPA realm. The dns for 'otherdomain.com' is handled by active directory which my IPA server has a cross-forest trust with. ie: host: client1.ipadomain.com certificate: CN = client1.ipadomain.com, SAN = client1.ipadomain.com, servicename.otherdomain.com When I try to submit this CSR with 'ipa-getcert request' the IPA server denies with: "The service principal for subject alt name servicename.otherdomain.com in certificate request does not exist" It seems that the default CAACL enforces a profile named 'caIPAserviceCert', but I'm having some trouble determining what can be modified (or cloned and changed in a new profile) that would allow the CA to sign a CSR that contains *.ipadomain.com and *.otherdomain.com in the SAN. This is the only section in the profile that contains SAN: policyset.serverCertSet.12.constraint.class_id=noConstraintImpl policyset.serverCertSet.12.constraint.name=No Constraint policyset.serverCertSet.12.default.class_id=commonNameToSANDefaultImpl policyset.serverCertSet.12.default.name=Copy Common Name to Subject Alternative Name Thanks, Steve

3 3

freeipa with sudo and 2FA (OTP)
by John Ratliff 31 Jan '22

31 Jan '22

I'm trying to setup freeipa with OTP. I created a TOTP under my user in freeipa and updated my user to use 2FA (password + OTP). When I try to do sudo, it only asks for my password and it fails every time (presumably because it isn't getting the OTP first). I didn't see anything useful in the sss_sudo logs, even after adding debug_level = 6 in the config. What can I do to further troubleshoot this? Thanks.

4 6

Cannot add externally-signed IPA CA certificate
by Dmitry Perets 27 Aug '21

27 Aug '21

Hi, I am trying to configure FreeIPA as a SubCA, and the "RootCA" is self-made with openssl. So I've signed the FreeIPA's request with my self-signed "root ca" certificate, but it looks like FreeIPA doesn't like it: ipa-server-install --external-cert-file=/root/rootca/rootcacert.pem --external-cert-file=/root/rootca/certs/ipacert.pem <...skipped...> ipa.ipapython.install.cli.install_tool(CompatServerMasterInstall): ERROR CA certificate CN=RootCA,OU=PRJ,O=COMPANY,L=Bonn,C=DE in /root/rootca/rootcacert.pem, /root/rootca/certs/ipacert.pem is not valid: not a CA certificate ipa.ipapython.install.cli.install_tool(CompatServerMasterInstall): ERROR The ipa-server-install command failed. See /var/log/ipaserver-install.log for more information The subj above is my self-made root CA cert, so it looks like something is missing in it. But what...? Here is it below, it has the "Basic Constraint" set with CA:TRUE... What else is required, so that FreeIPA accepts it as a root CA? Should I add it somewhere first, before running the ipa-server-install? [root@ipa ~]# openssl x509 -text -noout -in /root/rootca/rootcacert.pem Certificate: Data: Version: 3 (0x2) Serial Number: 0 (0x0) Signature Algorithm: sha256WithRSAEncryption Issuer: C=DE, L=Bonn, O=COMPANY, OU=PRJ, CN=RootCA Validity Not Before: Oct 24 11:43:13 2018 GMT Not After : Oct 21 11:43:13 2028 GMT Subject: C=DE, L=Bonn, O=COMPANY, OU=PRJ, CN=RootCA Subject Public Key Info: Public Key Algorithm: rsaEncryption Public-Key: (4096 bit) Modulus: <...skipped...> Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Subject Key Identifier: B3:18:3B:CF:29:D2:A5:D4:AE:94:A5:42:65:A2:D8:12:7C:92:78:81 X509v3 Authority Key Identifier: keyid:B3:18:3B:CF:29:D2:A5:D4:AE:94:A5:42:65:A2:D8:12:7C:92:78:81 X509v3 Basic Constraints: CA:TRUE Signature Algorithm: sha256WithRSAEncryption <...skipped...> Thanks!!

2 2

Unable to install ipa client centos 7.5.1804 (Core)
by William Graboyes 16 Feb '21

16 Feb '21

Hello List, I have been searching around for the day and have found an answer for the error I am getting when I am trying to install the client on a brand new install: Version: ipa-client-4.5.4-10.el7.centos.3.x86_64 ipa-client-common-4.5.4-10.el7.centos.3.noarch The error is below (run as root, not via sudo): ipa-client-install Traceback (most recent call last): File "/sbin/ipa-client-install", line 22, in <module> from ipaclient.install import ipa_client_install File "/usr/lib/python2.7/site-packages/ipaclient/install/ipa_client_install.py", line 5, in <module> from ipaclient.install import client File "/usr/lib/python2.7/site-packages/ipaclient/install/client.py", line 34, in <module> from ipalib import api, errors, x509 File "/usr/lib/python2.7/site-packages/ipalib/x509.py", line 45, in <module> from pyasn1_modules import rfc2315, rfc2459 File "/usr/lib/python2.7/site-packages/pyasn1_modules/rfc2315.py", line 67, in <module> class DigestedData(univ.Sequence): File "/usr/lib/python2.7/site-packages/pyasn1_modules/rfc2315.py", line 72, in DigestedData namedtype.NamedType('digest', Digest) File "/usr/lib/python2.7/site-packages/pyasn1/type/namedtype.py", line 115, in __init__ self.__ambiguousTypes = 'terminal' not in kwargs and self.__computeAmbiguousTypes() or {} File "/usr/lib/python2.7/site-packages/pyasn1/type/namedtype.py", line 232, in __computeAmbiguousTypes ambigiousTypes[idx] = NamedTypes(*partialAmbigiousTypes, **dict(terminal=True)) File "/usr/lib/python2.7/site-packages/pyasn1/type/namedtype.py", line 114, in __init__ self.__tagToPosMap = self.__computeTagToPosMap() File "/usr/lib/python2.7/site-packages/pyasn1/type/namedtype.py", line 205, in __computeTagToPosMap for _tagSet in tagMap.presentTypes: AttributeError: 'property' object has no attribute 'presentTypes' Any help would be greatly appreciated. Thanks, Bill G.

3 2

ipa-replica-install failing
by Mitchell Smith 25 Aug '20

25 Aug '20

Hi list, I wanted to repost this issue with a more appropriate subject line, in case anyone has come across this issue before and has a work around. To provide some context, I have two FreeIPA instances running FreeIPA 4.3.1 on Ubuntu 16.04 LTS. I want to migrate to FreeIPA 4.5.4 running on CentOS 7. I have a way to migrate by dumping all the users out with ldapsearch and adding them to the new instance with ldapadd but it is a bit messy and will result in all users having to reset their password, as it won't let me add in already encrypted passwords. My initial thought was to add the new instance as a replica and then eventually retire the old one. I ran in to some problems with the ‘ipa-replica-install’ command though. I was able to join as a client no problem, but when I went to run ‘ipa-replica-install’ it failed while configuring the directory server component. [25/42]: restarting directory server [26/42]: creating DS keytab [27/42]: ignore time skew for initial replication [28/42]: setting up initial replication [error] DatabaseError: Server is unwilling to perform: modification of attribute nsds5replicareleasetimeout is not allowed in replica entry Your system may be partly configured. Run /usr/sbin/ipa-server-install --uninstall to clean up. I thought this might have something to do with differences between 4.3.1 and 4.5.4 but I wasn’t entirely sure. If there is a work around for this issue, it would be a significantly easier transition to the new FreeIPA instance. Cheers, Mitch

3 4

kinit -n asking for password on clients
by John Ratliff 13 Jul '20

13 Jul '20

When trying to do pkinit, if I do kinit -n on one of the IdM servers, it works fine. If I try on a client machine, it asks me for the password for WELLKNOWN/ANONYMOUS@REALM. I have the pkinit_anchors setup for the realm. As I'm trying to do anonymous pkinit, I think I don't need a client certificate. On the server, I get this: $ KRB5_TRACE="/dev/stderr" kinit -n [13061] 1518402857.924212: Getting initial credentials for WELLKNOWN/ANONYMOUS(a)IDM.EXAMPLE.COM [13061] 1518402857.929673: Sending request (200 bytes) to IDM.EXAMPLE.COM [13061] 1518402857.931830: Initiating TCP connection to stream 10.77.9.101:88 [13061] 1518402857.932241: Sending TCP request to stream 10.77.9.101:88 [13061] 1518402857.939162: Received answer (359 bytes) from stream 10.77.9.101:88 [13061] 1518402857.939180: Terminating TCP connection to stream 10.77.9.101:88 [13061] 1518402857.939284: Response was from master KDC [13061] 1518402857.939380: Received error from KDC: -1765328359/Additional pre-authentication required [13061] 1518402857.939474: Processing preauth types: 16, 15, 14, 136, 19, 147, 2, 133 [13061] 1518402857.939499: Selected etype info: etype aes256-cts, salt "IDM.EXAMPLE.COMWELLKNOWNANONYMOUS", params "" [13061] 1518402857.939509: Received cookie: MIT [13061] 1518402857.939563: Preauth module pkinit (147) (info) returned: 0/Success [13061] 1518402857.940352: PKINIT client computed kdc-req-body checksum 9/D98A0144E7E4ACC66B63EBCA98379AB9F055D143 [13061] 1518402857.940369: PKINIT client making DH request [13061] 1518402858.935: Preauth module pkinit (16) (real) returned: 0/Success [13061] 1518402858.956: Produced preauth for next request: 133, 16 [13061] 1518402858.994: Sending request (1408 bytes) to IDM.EXAMPLE.COM [13061] 1518402858.1091: Initiating TCP connection to stream 10.77.9.101:88 [13061] 1518402858.1187: Sending TCP request to stream 10.77.9.101:88 [13061] 1518402858.43063: Received answer (2880 bytes) from stream 10.77.9.101:88 [13061] 1518402858.43088: Terminating TCP connection to stream 10.77.9.101:88 [13061] 1518402858.43198: Response was from master KDC [13061] 1518402858.43258: Processing preauth types: 17, 19, 147 [13061] 1518402858.43273: Selected etype info: etype aes256-cts, salt "IDM.EXAMPLE.COMWELLKNOWNANONYMOUS", params "" [13061] 1518402858.43300: Preauth module pkinit (147) (info) returned: 0/Success [13061] 1518402858.44150: PKINIT client verified DH reply [13061] 1518402858.44189: PKINIT client found id-pkinit-san in KDC cert: krbtgt/IDM.EXAMPLE.COM(a)IDM.EXAMPLE.COM [13061] 1518402858.44199: PKINIT client matched KDC principal krbtgt/IDM.EXAMPLE.COM(a)IDM.EXAMPLE.COM against id-pkinit-san; no EKU check required [13061] 1518402858.62345: PKINIT client used KDF 2B06010502030602 to compute reply key aes256-cts/00E0 [13061] 1518402858.62395: Preauth module pkinit (17) (real) returned: 0/Success [13061] 1518402858.62402: Produced preauth for next request: (empty) [13061] 1518402858.62414: AS key determined by preauth: aes256-cts/00E0 [13061] 1518402858.62547: Decrypted AS reply; session key is: aes256-cts/96F0 [13061] 1518402858.62589: FAST negotiation: available [13061] 1518402858.62692: Initializing KEYRING:persistent:760400007:krb_ccache_f3PFEy1 with default princ WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS [13061] 1518402858.62770: Storing WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS -> krbtgt/IDM.EXAMPLE.COM(a)IDM.EXAMPLE.COM in KEYRING:persistent:760400007:krb_ccache_f3PFEy1 [13061] 1518402858.62846: Storing config in KEYRING:persistent:760400007:krb_ccache_f3PFEy1 for krbtgt/IDM.EXAMPLE.COM(a)IDM.EXAMPLE.COM: fast_avail: yes [13061] 1518402858.62878: Storing WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS -> krb5_ccache_conf_data/fast_avail/krbtgt\/IDM.EXAMPLE.COM\@IDM.EXAMPLE.COM@X-CACHECONF: in KEYRING:persistent:760400007:krb_ccache_f3PFEy1 [13061] 1518402858.62933: Storing config in KEYRING:persistent:760400007:krb_ccache_f3PFEy1 for krbtgt/IDM.EXAMPLE.COM(a)IDM.EXAMPLE.COM: pa_type: 16 [13061] 1518402858.62954: Storing WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS -> krb5_ccache_conf_data/pa_type/krbtgt\/IDM.EXAMPLE.COM\@IDM.EXAMPLE.COM@X-CACHECONF: in KEYRING:persistent:760400007:krb_ccache_f3PFEy1 But on the client, I get this: $ KRB5_TRACE="/dev/stderr" kinit -n [2941] 1518402820.155827: Getting initial credentials for WELLKNOWN/ANONYMOUS(a)IDM.EXAMPLE.COM [2941] 1518402820.156298: Sending request (200 bytes) to IDM.EXAMPLE.COM [2941] 1518402820.158723: Resolving hostname paine.example.com. [2941] 1518402820.159975: Resolving hostname phantom.example.com. [2941] 1518402820.160757: Resolving hostname paine.example.com. [2941] 1518402820.161411: Initiating TCP connection to stream 204.89.253.101:88 [2941] 1518402820.162065: Sending TCP request to stream 204.89.253.101:88 [2941] 1518402820.168495: Received answer (359 bytes) from stream 204.89.253.101:88 [2941] 1518402820.168532: Terminating TCP connection to stream 204.89.253.101:88 [2941] 1518402820.169917: Response was from master KDC [2941] 1518402820.169974: Received error from KDC: -1765328359/Additional pre-authentication required [2941] 1518402820.170029: Processing preauth types: 16, 15, 14, 136, 19, 147, 2, 133 [2941] 1518402820.170051: Selected etype info: etype aes256-cts, salt "IDM.EXAMPLE.COMWELLKNOWNANONYMOUS", params "" [2941] 1518402820.170062: Received cookie: MIT Password for WELLKNOWN/ANONYMOUS(a)IDM.EXAMPLE.COM: [2941] 1518402833.34612: Preauth module encrypted_timestamp (2) (real) returned: -1765328252/Password read interrupted kinit: Pre-authentication failed: Password read interrupted while getting initial credentials Suggestions on what I'm missing? Thanks.

3 3

IPA and legacy systems
by Ronald Wimmer 27 May '20

27 May '20

What would be a good solution to add systems where the FQDN cannot be changed? Would it make sense to add a second DNS A Record in the IPA domain for each of these systems? Is there any experience on how to deal with such a situation? Thanks a lot in advance! Cheers, Ronald

5 17

Vault: Cannot authenticate agent with certificate
by Peter Oliver 19 Sep '19

19 Sep '19

I have a CentOS 7 server running ipa-server-4.5.4, recently installed. I find that operations related to the vault feature fail. For example: > ipa -v vault-add test --type=standard ipa: INFO: trying https://ipa-01.example.com/ipa/session/json ipa: INFO: [try 1]: Forwarding 'vault_add_internal/1' to json server 'https://ipa-01.example.com/ipa/session/json' ipa: INFO: [try 1]: Forwarding 'vault_show/1' to json server 'https://ipa-01.example.com/ipa/session/json' ipa: INFO: [try 1]: Forwarding 'vaultconfig_show/1' to json server 'https://ipa-01.example.com/ipa/session/json' ipa: INFO: [try 1]: Forwarding 'vault_archive_internal/1' to json server 'https://ipa-01.example.com/ipa/session/json' ipa: ERROR: an internal error has occurred In /var/log/pki/pki-tomcat/kra/system I see the following message: 0.ajp-bio-127.0.0.1-8009-exec-15 - [02/Nov/2018:14:54:37 GMT] [6] [3] Cannot authenticate agent with certificate Serial 0x7 Subject DN CN=IPA RA,O=IPA.EXAMPLE.COM. Error: User not found In /var/log/pki/pki-tomcat/kra/debug is see the following messages: [02/Nov/2018:14:54:37][ajp-bio-127.0.0.1-8009-exec-16]: SessionContextInterceptor: SystemCertResource.getTransportCert() [02/Nov/2018:14:54:37][ajp-bio-127.0.0.1-8009-exec-16]: SessionContextInterceptor: Not authenticated. [02/Nov/2018:14:54:37][ajp-bio-127.0.0.1-8009-exec-16]: AuthMethodInterceptor: SystemCertResource.getTransportCert() [02/Nov/2018:14:54:37][ajp-bio-127.0.0.1-8009-exec-16]: AuthMethodInterceptor: mapping: default [02/Nov/2018:14:54:37][ajp-bio-127.0.0.1-8009-exec-16]: AuthMethodInterceptor: required auth methods: [*] [02/Nov/2018:14:54:37][ajp-bio-127.0.0.1-8009-exec-16]: AuthMethodInterceptor: anonymous access allowed [02/Nov/2018:14:54:37][ajp-bio-127.0.0.1-8009-exec-16]: ACLInterceptor: SystemCertResource.getTransportCert() [02/Nov/2018:14:54:37][ajp-bio-127.0.0.1-8009-exec-16]: ACLInterceptor.filter: no authorization required [02/Nov/2018:14:54:37][ajp-bio-127.0.0.1-8009-exec-16]: ACLInterceptor: No ACL mapping; authz not required. [02/Nov/2018:14:54:37][ajp-bio-127.0.0.1-8009-exec-16]: SignedAuditLogger: event AUTHZ [02/Nov/2018:14:54:37][ajp-bio-127.0.0.1-8009-exec-16]: MessageFormatInterceptor: SystemCertResource.getTransportCert() [02/Nov/2018:14:54:37][ajp-bio-127.0.0.1-8009-exec-16]: MessageFormatInterceptor: content-type: application/json [02/Nov/2018:14:54:37][ajp-bio-127.0.0.1-8009-exec-16]: MessageFormatInterceptor: accept: [application/json] [02/Nov/2018:14:54:37][ajp-bio-127.0.0.1-8009-exec-16]: MessageFormatInterceptor: request format: application/json [02/Nov/2018:14:54:37][ajp-bio-127.0.0.1-8009-exec-16]: MessageFormatInterceptor: response format: application/json [02/Nov/2018:14:54:37][ajp-bio-127.0.0.1-8009-exec-15]: PKIRealm: Authenticating certificate chain: [02/Nov/2018:14:54:37][ajp-bio-127.0.0.1-8009-exec-15]: PKIRealm.getAuditUserfromCert: certUID=CN=IPA RA, O=IPA.EXAMPLE.COM [02/Nov/2018:14:54:37][ajp-bio-127.0.0.1-8009-exec-15]: PKIRealm: CN=IPA RA, O=IPA.EXAMPLE.COM [02/Nov/2018:14:54:37][ajp-bio-127.0.0.1-8009-exec-15]: CertUserDBAuth: started [02/Nov/2018:14:54:37][ajp-bio-127.0.0.1-8009-exec-15]: CertUserDBAuth: Retrieving client certificate [02/Nov/2018:14:54:37][ajp-bio-127.0.0.1-8009-exec-15]: CertUserDBAuth: Got client certificate [02/Nov/2018:14:54:37][ajp-bio-127.0.0.1-8009-exec-15]: Authentication: client certificate found [02/Nov/2018:14:54:37][ajp-bio-127.0.0.1-8009-exec-15]: In LdapBoundConnFactory::getConn() [02/Nov/2018:14:54:37][ajp-bio-127.0.0.1-8009-exec-15]: masterConn is connected: true [02/Nov/2018:14:54:37][ajp-bio-127.0.0.1-8009-exec-15]: getConn: conn is connected true [02/Nov/2018:14:54:37][ajp-bio-127.0.0.1-8009-exec-15]: getConn: mNumConns now 2 [02/Nov/2018:14:54:37][ajp-bio-127.0.0.1-8009-exec-15]: returnConn: mNumConns now 3 [02/Nov/2018:14:54:37][ajp-bio-127.0.0.1-8009-exec-15]: CertUserDBAuthentication: cannot map certificate to any userUser not found [02/Nov/2018:14:54:37][ajp-bio-127.0.0.1-8009-exec-15]: SignedAuditLogger: event AUTH Any suggestions? Has something gone wrong with the setup? -- Peter Oliver

4 7

FreeIPA v4.5.0 install lost topology suffixes
by Gavin Williams 19 Aug '19

19 Aug '19

Afternoon all I’ve got a slightly strange one with one of our FreeIPA clusters, whereby the topology suffixes appear to have disappeared. From what I can see, this is causing replication issues between the hosts, which is causing us issues with bootstrapping new clients against FreeIPA. I’m not aware of any config changes that have happened on the FreeIPA hosts that could have caused this issue, so am a bit stumped atm. Is someone able to advise next steps on how to investigate the cause and correct the configuration? Regards Gavin

4 4

DNS A Record Disappears after IPA Server reboot
by Mariusz Stolarczyk 26 Jul '19

26 Jul '19

Hi all, Whenever I have to reboot my IPA server I loose one of my IPA client's DNS A Record. Curiously all of the IPA client related SSHFP records are intact as well as the reverse lookup record. The only thing that was slightly different about this client is at some point the IP address was changed. I did however change the IP address on a different client with no problems. Thanks, -Mark

3 3

freeipa-server failied to instal - Debian
by Milos Cuculovic 19 Jul '19

19 Jul '19

I am trying to install after an uninstall the freeipa-server package on Debian, which is now failing. I normally removed all packages and config files, something seems to still cause issues. The installation output is as follows, after running apt install freeipa-server (I^m first extracting main warning and failure lines I identified). ————— Warning: found usr.sbin.sssd in /etc/apparmor.d/force-complain, forcing complain mode Warning failed to create cache: usr.sbin.sssd ————— Failed to preset unit: Unit file /etc/systemd/system/bind9.service is masked. /usr/bin/deb-systemd-helper: error: systemctl preset failed on bind9.service: No such file or directory ————— ob for krb5-kdc.service failed because the control process exited with error code. See "systemctl status krb5-kdc.service" and "journalctl -xe" for details. invoke-rc.d: initscript krb5-kdc, action "start" failed. ● krb5-kdc.service - Kerberos 5 Key Distribution Center Loaded: loaded (/lib/systemd/system/krb5-kdc.service; enabled; vendor preset: enabled) Drop-In: /lib/systemd/system/krb5-kdc.service.d └─slapd-before-kdc.conf Active: failed (Result: exit-code) since Mon 2018-10-15 14:24:00 CEST; 16ms ago Process: 17099 ExecStart=/usr/sbin/krb5kdc -P /var/run/krb5-kdc.pid $DAEMON_ARGS (code=exited, status=1/FAILURE) Oct 15 14:24:00 freeipa.mdpi.com systemd[1]: Starting Kerberos 5 Key Distribution Center... Oct 15 14:24:00 freeipa.mdpi.com krb5kdc[17099]: Couldn't open log file /var/log/krb5kdc.log: Read-only file system Oct 15 14:24:00 freeipa.mdpi.com krb5kdc[17099]: Server error - while fetching master key K/M for realm IPA.MDPI.COM Oct 15 14:24:00 freeipa.mdpi.com krb5kdc[17099]: krb5kdc: cannot initialize realm IPA.MDPI.COM - see log file for details Oct 15 14:24:00 freeipa.mdpi.com systemd[1]: krb5-kdc.service: Control process exited, code=exited status=1 Oct 15 14:24:00 freeipa.mdpi.com systemd[1]: krb5-kdc.service: Failed with result 'exit-code'. Oct 15 14:24:00 freeipa.mdpi.com systemd[1]: Failed to start Kerberos 5 Key Distribution Center. ————— pki-tomcatd-nuxwdog.target is a disabled or a static unit, not starting it. Job for pki-tomcatd.service failed because the control process exited with error code. See "systemctl status pki-tomcatd.service" and "journalctl -xe" for details. invoke-rc.d: initscript pki-tomcatd, action "start" failed. ● pki-tomcatd.service - LSB: Start pki-tomcatd at boot time Loaded: loaded (/etc/init.d/pki-tomcatd; generated) Active: failed (Result: exit-code) since Mon 2018-10-15 14:24:03 CEST; 17ms ago Docs: man:systemd-sysv-generator(8) Process: 17421 ExecStart=/etc/init.d/pki-tomcatd start (code=exited, status=1/FAILURE) Oct 15 14:24:03 freeipa.mdpi.com systemd[1]: Starting LSB: Start pki-tomcatd at boot time... Oct 15 14:24:03 freeipa.mdpi.com pki-tomcatd[17421]: /usr/share/pki/scripts/config: line 41: break: only meaningful in a `for', `while', or `until' loop Oct 15 14:24:03 freeipa.mdpi.com pki-tomcatd[17421]: ERROR: No 'tomcat' instances installed! Oct 15 14:24:03 freeipa.mdpi.com systemd[1]: pki-tomcatd.service: Control process exited, code=exited status=1 Oct 15 14:24:03 freeipa.mdpi.com systemd[1]: pki-tomcatd.service: Failed with result 'exit-code'. Oct 15 14:24:03 freeipa.mdpi.com systemd[1]: Failed to start LSB: Start pki-tomcatd at boot time. ————— Setting up freeipa-server (4.7.0~pre1+git20180411-2ubuntu2) ... dpkg: error processing package freeipa-server (--configure): installed freeipa-server package post-installation script subprocess returned error exit status 1 dpkg: dependency problems prevent configuration of freeipa-server-dns: freeipa-server-dns depends on freeipa-server (>= 4.7.0~pre1+git20180411-2ubuntu2); however: Package freeipa-server is not configured yet. dpkg: error processing package freeipa-server-dns (--configure): dependency problems - leaving unconfigured Processing triggers for libc-bin (2.27-3ubuntu1) ... Processing triggers for dbus (1.12.2-1ubuntu1) ... No apport report written because the error message indicates its a followup error from a previous failure. Processing triggers for oddjob (0.34.3-4) ... Errors were encountered while processing: freeipa-server freeipa-server-dns E: Sub-process /usr/bin/dpkg returned an error code (1) ————— FULL OUTPUT: Setting up libsymkey-jni (10.6.0-1ubuntu2) ... Setting up python-dnspython (1.15.0-1) ... Setting up libxcb-present0:amd64 (1.13-1) ... Setting up libslf4j-java (1.7.25-3) ... Setting up libglvnd0:amd64 (1.0.0-2ubuntu2.2) ... Setting up oddjob (0.34.3-4) ... Setting up libxinerama1:amd64 (2:1.1.3-1) ... Setting up libplexus-classworlds-java (2.5.2-2) ... Processing triggers for ufw (0.35-5) ... Setting up libxcb-dri2-0:amd64 (1.13-1) ... Setting up libsss-idmap0 (1.16.1-1ubuntu1) ... Setting up libhttp-parser2.7.1:amd64 (2.7.1-2) ... Setting up libxcb-dri3-0:amd64 (1.13-1) ... Setting up libxcb-glx0:amd64 (1.13-1) ... Setting up libcommons-io-java (2.6-2) ... Setting up libstax-java (1.2.0-4) ... Setting up libargs4j-java (2.33-1) ... Setting up python-urllib3 (1.22-1) ... Setting up libapache2-mod-lookup-identity (1.0.0-1) ... apache2_invoke: Enable module lookup_identity Setting up libpath-utils1:amd64 (0.6.1-1) ... Setting up libjettison-java (1.4.0-1) ... Setting up libsocket-getaddrinfo-perl (0.22-3) ... Setting up libknopflerfish-osgi-framework-java (6.1.1-2) ... Setting up libperl4-corelibs-perl (0.004-1) ... Setting up libsss-nss-idmap0 (1.16.1-1ubuntu1) ... Setting up libnfsidmap2:amd64 (0.25-5.1) ... Setting up python-usb (1.0.0-1) ... Setting up libxdamage1:amd64 (1:1.1.4-3) ... Setting up libhawtjni-runtime-java (1.15-2) ... Setting up libhttpcore-java (4.4.9-1) ... Setting up libjackson2-core-java (2.9.4-1) ... Setting up ieee-data (20180204.1) ... Setting up libjsr311-api-java (1.1.1-1) ... Setting up python-yubico (1.3.2-1) ... Setting up libyaml-snake-java (1.20-1) ... Setting up libxfixes3:amd64 (1:5.0.3-1) ... Setting up oddjob-mkhomedir (0.34.3-4) ... Processing triggers for ureadahead (0.100.0-20) ... Setting up libdrm-amdgpu1:amd64 (2.4.91-2) ... Setting up libllvm6.0:amd64 (1:6.0-1ubuntu2) ... Setting up chrony (3.2-4ubuntu4.2) ... Setting up libisorelax-java (20041111-10) ... Setting up python-openssl (17.5.0-1ubuntu1) ... Setting up libplexus-cipher-java (1.7-3) ... Setting up python-ply (3.11-1) ... Setting up python-kdcproxy (0.3.2-5) ... Setting up python-netaddr (0.7.19-1) ... Setting up python-jwcrypto (0.4.2-1) ... Setting up libatspi2.0-0:amd64 (2.28.0-1) ... Setting up libdtd-parser-java (1.2~svn20110404-1) ... Setting up libsvrcore0:amd64 (1:4.1.2+dfsg1-3) ... Setting up at-spi2-core (2.28.0-1) ... Setting up libsss-certmap0 (1.16.1-1ubuntu1) ... Setting up libxshmfence1:amd64 (1.3-1) ... Setting up libjaxb-api-java (2.2.9-1) ... Setting up krb5-pkinit:amd64 (1.16-2build1) ... Setting up libstax2-api-java (3.1.1-1) ... Setting up python-certifi (2018.1.18-2) ... Setting up libstax-ex-java (1.7.8-1) ... Setting up libipa-hbac0 (1.16.1-1ubuntu1) ... Setting up dogtag-pki-server-theme (10.6.0-1ubuntu2) ... Setting up libplexus-interpolation-java (1.24-1) ... Setting up libnl-route-3-200:amd64 (3.2.29-0ubuntu3) ... Setting up libglapi-mesa:amd64 (18.0.5-0ubuntu0~18.04.1) ... Setting up fonts-open-sans (1.11-1) ... Setting up python-sss (1.16.1-1ubuntu1) ... Setting up libplexus-component-annotations-java (1.7.1-7) ... Setting up python-pkg-resources (39.0.1-2) ... Setting up freeipa-common (4.7.0~pre1+git20180411-2ubuntu2) ... Setting up opendnssec-common (1:2.1.3-0.2build1) ... Setting up libmaven-shared-utils-java (3.1.0-2) ... Setting up python-pyasn1-modules (0.2.1-0.2) ... Setting up libdhash1:amd64 (0.6.1-1) ... Setting up python-nss (1.0.0-1build3) ... Setting up python-markupsafe (1.0-1build1) ... Setting up fonts-font-awesome (4.7.0~dfsg-3) ... Setting up python-netifaces (0.10.4-0.1build4) ... Setting up libjackson2-annotations-java (2.9.4-1) ... Setting up libldns2:amd64 (1.7.0-3ubuntu4) ... Setting up sqlite3 (3.22.0-1) ... Setting up libjoda-time-java (2.9.9-1) ... Setting up libplexus-utils2-java (3.0.24-3) ... Setting up libjackson2-dataformat-cbor (2.7.8-3) ... Setting up libcollection4:amd64 (0.6.1-1) ... Setting up libwagon-provider-api-java (3.0.0-2) ... Setting up libxcb-sync1:amd64 (1.13-1) ... Setting up libjsr305-java (0.1~+svn49-10) ... Setting up python-dateutil (2.6.1-1) ... Setting up ldap-utils (2.4.45+dfsg-1ubuntu1) ... Setting up libatk1.0-data (2.28.1-1) ... Setting up libjackson2-databind-java (2.9.5-1) ... Setting up libjackson2-dataformat-yaml (2.8.10-3) ... Setting up libx11-xcb1:amd64 (2:1.6.4-3ubuntu0.1) ... Setting up libnetaddr-ip-perl (4.079+dfsg-1build2) ... Setting up python-gi (3.26.1-2) ... Setting up libmozilla-ldap-perl (1.5.3-2build4) ... Setting up libservlet3.1-java (8.5.30-1ubuntu1.4) ... Setting up libjboss-jdeparser2-java (2.0.2-1) ... Setting up libjavassist-java (1:3.21.0-2) ... Setting up p11-kit-modules:amd64 (0.23.9-2) ... Setting up libnss-sss:amd64 (1.16.1-1ubuntu1) ... Setting up softhsm2-common (2.2.0-3.1build1) ... Setting up libhsm-bin (1:2.1.3-0.2build1) ... Setting up python3-sss (1.16.1-1ubuntu1) ... Setting up libjackson2-module-jaxb-annotations-java (2.8.10-2) ... Setting up libxmlrpc-core-c3 (1.33.14-8build1) ... Setting up libxxf86dga1:amd64 (2:1.1.4-1) ... Processing triggers for libc-bin (2.27-3ubuntu1) ... Setting up libjackson-json-java (1.9.2-9) ... Setting up python-bs4 (4.6.0-1) ... Setting up python-selinux (2.7-2build2) ... Setting up libgeronimo-interceptor-3.0-spec-java (1.0.1-4fakesync) ... Setting up libmaven-resolver-java (1.1.0-3) ... Setting up libsocket6-perl (0.27-1build2) ... Setting up libnsspem:amd64 (1.0.3-0ubuntu2) ... Setting up 389-ds-base-libs (1.3.7.10-1ubuntu1) ... Setting up libplexus-utils-java (1:1.5.15-5) ... Setting up libnss3-tools (2:3.35-2ubuntu2) ... Setting up python-libipa-hbac (1.16.1-1ubuntu1) ... Setting up libnuxwdog0 (1.0.3-4) ... Setting up libjackson2-dataformat-xml-java (2.9.4-1) ... Setting up libcommons-compress-java (1.13-2) ... Setting up libatk1.0-0:amd64 (2.28.1-1) ... Setting up libcommons-lang3-java (3.5-2ubuntu1) ... Setting up libjaxen-java (1.1.6-3) ... Setting up libwebpmux3:amd64 (0.6.1-2) ... Setting up libsnappy1v5:amd64 (1.1.7-1) ... Setting up libjansi-native-java (1.7-1) ... Setting up python-systemd (234-1build1) ... Processing triggers for systemd (237-3ubuntu10.3) ... Setting up libpwquality-common (1.4.0-2) ... Setting up augeas-lenses (1.10.1-2) ... Setting up python-lxml:amd64 (4.2.1-1) ... Setting up libatk-bridge2.0-0:amd64 (2.26.2-1) ... Setting up libjaxrs-api-java (2.1-1) ... Setting up libice6:amd64 (2:1.0.9-2) ... Setting up libasm-java (6.0-1) ... Setting up libfontenc1:amd64 (1:1.1.3-1) ... Setting up libxcomposite1:amd64 (1:0.4.4-2) ... Setting up libcrack2:amd64 (2.9.2-5build1) ... Setting up python-olefile (0.45.1-1) ... Setting up libwebpdemux2:amd64 (0.6.1-2) ... Setting up libxcb-shape0:amd64 (1.13-1) ... Setting up libpciaccess0:amd64 (0.14-1) ... Setting up libstreambuffer-java (1.5.4-1) ... Setting up libxv1:amd64 (2:1.0.11-1) ... Processing triggers for man-db (2.8.3-2) ... Setting up libatinject-jsr330-api-java (1.0+ds1-5) ... Setting up libjboss-logging-tools-java (2.1.0-2) ... Setting up libbasicobjects0:amd64 (0.6.1-1) ... Setting up libmaven-parent-java (27-2) ... Setting up python3-ply (3.11-1) ... Setting up libdrm-radeon1:amd64 (2.4.91-2) ... Setting up libref-array1:amd64 (0.6.1-1) ... Processing triggers for dbus (1.12.2-1ubuntu1) ... Setting up libxxf86vm1:amd64 (1:1.1.4-1) ... Setting up libdrm-nouveau2:amd64 (2.4.91-2) ... Setting up libxft2:amd64 (2.3.2-1) ... Setting up python-dbus (1.2.6-1) ... Setting up libcommons-codec-java (1.11-1) ... Setting up libjss-java (4.4.3-1) ... Setting up libjackson2-dataformat-smile (2.7.8-3) ... Setting up slapi-nis (0.56.1-1build1) ... Setting up libcommons-lang-java (2.6-8) ... Setting up libcurl3-nss:amd64 (7.58.0-2ubuntu3.3) ... Setting up python-pil:amd64 (5.1.0-1) ... Setting up libcommons-httpclient-java (3.1-14) ... Setting up libaopalliance-java (20070526-6) ... Setting up libc-ares2:amd64 (1.14.0-1) ... Setting up libjs-dojo-core (1.11.0+dfsg-1) ... Setting up python-webencodings (0.5-2) ... Setting up libgeronimo-annotation-1.3-spec-java (1.0-1) ... Setting up libdbi-perl (1.640-1) ... Setting up libjboss-logging-java (3.3.2-1) ... Setting up libsss-sudo (1.16.1-1ubuntu1) ... Checking NSS setup... Setting up libxrandr2:amd64 (2:1.5.1-1) ... Setting up librelaxng-datatype-java (1.0+ds1-3) ... Setting up libcommons-cli-java (1.4-1) ... Setting up libini-config5:amd64 (0.6.1-1) ... Setting up libplexus-sec-dispatcher-java (1.4-3) ... Setting up sssd-common (1.16.1-1ubuntu1) ... Warning: found usr.sbin.sssd in /etc/apparmor.d/force-complain, forcing complain mode Warning failed to create cache: usr.sbin.sssd sssd-secrets.service is a disabled or a static unit not running, not starting it. Setting up python-ldap (3.0.0-1) ... Setting up 389-ds-base (1.3.7.10-1ubuntu1) ... dirsrv-snmp.service is a disabled or a static unit, not starting it. dirsrv.target is a disabled or a static unit, not starting it. Setting up bind9utils (1:9.11.3+dfsg-1ubuntu1.2) ... Setting up libdom4j-java (2.1.0-2) ... Setting up python-setuptools (39.0.1-2) ... Setting up libsm6:amd64 (2:1.2.2-1) ... Setting up libplexus-io-java (3.0.0-1) ... Setting up libscannotation-java (1.0.2+svn20110812-3) ... Setting up libsymkey-java (10.6.0-1ubuntu2) ... Setting up python-libsss-nss-idmap (1.16.1-1ubuntu1) ... Setting up sssd-krb5-common (1.16.1-1ubuntu1) ... Setting up python-chardet (3.0.4-1) ... Setting up libdbd-sqlite3-perl (1.56-1) ... Setting up python-pycparser (2.18-2) ... Setting up libnuxwdog-java (1.0.3-4) ... Setting up libjs-dojo-dijit (1.11.0+dfsg-1) ... Setting up libsofthsm2 (2.2.0-3.1build1) ... Setting up libcglib-java (3.2.6-2) ... Setting up opendnssec-signer (1:2.1.3-0.2build1) ... Setting up python-jinja2 (2.10-1) ... Setting up libtomcatjss-java (7.3.0~rc-1) ... Setting up cracklib-runtime (2.9.2-5build1) ... Setting up libjs-dojo-dojox (1.11.0+dfsg-1) ... Setting up libsnappy-jni (1.1.4-1) ... Setting up libldap-java (4.19+dfsg1-1) ... Setting up libjansi-java (1.16-1) ... Setting up p11-kit (0.23.9-2) ... Setting up libaugeas0:amd64 (1.10.1-2) ... Setting up libxsom-java (2.3.0-3) ... Setting up bind9 (1:9.11.3+dfsg-1ubuntu1.2) ... Failed to preset unit: Unit file /etc/systemd/system/bind9.service is masked. /usr/bin/deb-systemd-helper: error: systemctl preset failed on bind9.service: No such file or directory bind9-pkcs11.service is a disabled or a static unit not running, not starting it. bind9-resolvconf.service is a disabled or a static unit not running, not starting it. Setting up libguava-java (19.0-1) ... Setting up python-qrcode (5.3-1) ... update-alternatives: using /usr/bin/python2-qr to provide /usr/bin/qr (qr) in auto mode Setting up sssd-ad-common (1.16.1-1ubuntu1) ... Setting up libfastinfoset-java (1.2.12-3) ... Setting up velocity (1.7-5) ... Setting up sssd-krb5 (1.16.1-1ubuntu1) ... Setting up libmsv-java (2009.1+dfsg1-5) ... Setting up sssd-ldap (1.16.1-1ubuntu1) ... Setting up sssd-proxy (1.16.1-1ubuntu1) ... Setting up libcdi-api-java (1.2-2) ... Setting up libpwquality1:amd64 (1.4.0-2) ... Setting up libdrm-intel1:amd64 (2.4.91-2) ... Setting up python-augeas (0.5.0-1) ... Setting up sssd-dbus (1.16.1-1ubuntu1) ... Setting up certmonger (0.79.5-3ubuntu1) ... Setting up libsnappy-java (1.1.4-1) ... Setting up libplexus-archiver-java (3.5-2) ... Setting up libhttpclient-java (4.5.5-1) ... Setting up softhsm2 (2.2.0-3.1build1) ... Setting up bind9-dyndb-ldap (11.1-3ubuntu1) ... Setting up librngom-java (2.3.0-3) ... Setting up python-cffi (1.11.5-1) ... Setting up libxt6:amd64 (1:1.1.5-1) ... Setting up python-requests (2.18.4-2) ... Setting up python-ipalib (4.7.0~pre1+git20180411-2ubuntu2) ... Setting up libsisu-guice-java (4.2.0-1) ... Setting up python-html5lib (0.999999999-1) ... Setting up libsisu-ioc-java (2.3.0-11) ... Setting up opendnssec-enforcer-sqlite3 (1:2.1.3-0.2build1) ... Setting up sssd-ad (1.16.1-1ubuntu1) ... Setting up python-custodia (0.5.0-3) ... Setting up libpam-pwquality:amd64 (1.4.0-2) ... Setting up libguice-java (4.0-4) ... Setting up pki-base (10.6.0-1ubuntu2) ... Setting up sssd-ipa (1.16.1-1ubuntu1) ... Setting up sssd (1.16.1-1ubuntu1) ... Setting up libgl1-mesa-dri:amd64 (18.0.5-0ubuntu0~18.04.1) ... Setting up libpam-sss:amd64 (1.16.1-1ubuntu1) ... Setting up libwoodstox-java (1:4.1.3-1) ... Setting up libxmu6:amd64 (2:1.1.2-2) ... Setting up libjackson2-jaxrs-providers-java (2.9.4-1) ... Setting up python-ipaclient (4.7.0~pre1+git20180411-2ubuntu2) ... Setting up opendnssec-enforcer (1:2.1.3-0.2build1) ... Setting up libsisu-inject-java (0.3.2-2) ... Setting up pki-tools (10.6.0-1ubuntu2) ... Setting up libglx-mesa0:amd64 (18.0.5-0ubuntu0~18.04.1) ... Setting up opendnssec (1:2.1.3-0.2build1) ... Setting up libxaw7:amd64 (2:1.0.13-1) ... Setting up custodia (0.5.0-3) ... Setting up freeipa-client (4.7.0~pre1+git20180411-2ubuntu2) ... Setting up libsisu-plexus-java (0.3.3-3) ... Setting up libglx0:amd64 (1.0.0-2ubuntu2.2) ... Setting up libmaven3-core-java (3.5.2-2) ... Setting up libmaven-shared-io-java (3.0.0-3) ... Setting up libgl1:amd64 (1.0.0-2ubuntu2.2) ... Setting up libmaven-file-management-java (3.0.0-1) ... Setting up x11-utils (7.7+3build1) ... Setting up libgl1-mesa-glx:amd64 (18.0.5-0ubuntu0~18.04.1) ... Setting up libatk-wrapper-java (0.33.3-20ubuntu0.1) ... Setting up libatk-wrapper-java-jni:amd64 (0.33.3-20ubuntu0.1) ... Setting up libistack-commons-java (3.0.6-1) ... Setting up libcodemodel-java (2.6+jaxb2.3.0-3) ... Setting up libtxw2-java (2.3.0-3) ... Setting up libverto-libevent1:amd64 (0.2.4-2.1ubuntu3) ... Setting up libverto1:amd64 (0.2.4-2.1ubuntu3) ... Setting up libjaxb-java (2.3.0-3) ... Setting up gssproxy (0.8.0-1) ... Setting up libresteasy3.0-java (3.0.19-2) ... Setting up krb5-kdc (1.16-2build1) ... Job for krb5-kdc.service failed because the control process exited with error code. See "systemctl status krb5-kdc.service" and "journalctl -xe" for details. invoke-rc.d: initscript krb5-kdc, action "start" failed. ● krb5-kdc.service - Kerberos 5 Key Distribution Center Loaded: loaded (/lib/systemd/system/krb5-kdc.service; enabled; vendor preset: enabled) Drop-In: /lib/systemd/system/krb5-kdc.service.d └─slapd-before-kdc.conf Active: failed (Result: exit-code) since Mon 2018-10-15 14:24:00 CEST; 16ms ago Process: 17099 ExecStart=/usr/sbin/krb5kdc -P /var/run/krb5-kdc.pid $DAEMON_ARGS (code=exited, status=1/FAILURE) Oct 15 14:24:00 freeipa.mdpi.com systemd[1]: Starting Kerberos 5 Key Distribution Center... Oct 15 14:24:00 freeipa.mdpi.com krb5kdc[17099]: Couldn't open log file /var/log/krb5kdc.log: Read-only file system Oct 15 14:24:00 freeipa.mdpi.com krb5kdc[17099]: Server error - while fetching master key K/M for realm IPA.MDPI.COM Oct 15 14:24:00 freeipa.mdpi.com krb5kdc[17099]: krb5kdc: cannot initialize realm IPA.MDPI.COM - see log file for details Oct 15 14:24:00 freeipa.mdpi.com systemd[1]: krb5-kdc.service: Control process exited, code=exited status=1 Oct 15 14:24:00 freeipa.mdpi.com systemd[1]: krb5-kdc.service: Failed with result 'exit-code'. Oct 15 14:24:00 freeipa.mdpi.com systemd[1]: Failed to start Kerberos 5 Key Distribution Center. Setting up libkrad0:amd64 (1.16-2build1) ... Setting up krb5-kdc-ldap (1.16-2build1) ... Setting up krb5-admin-server (1.16-2build1) ... Setting up pki-base-java (10.6.0-1ubuntu2) ... Setting up krb5-otp:amd64 (1.16-2build1) ... Setting up pki-server (10.6.0-1ubuntu2) ... pki-tomcatd-nuxwdog.target is a disabled or a static unit, not starting it. Job for pki-tomcatd.service failed because the control process exited with error code. See "systemctl status pki-tomcatd.service" and "journalctl -xe" for details. invoke-rc.d: initscript pki-tomcatd, action "start" failed. ● pki-tomcatd.service - LSB: Start pki-tomcatd at boot time Loaded: loaded (/etc/init.d/pki-tomcatd; generated) Active: failed (Result: exit-code) since Mon 2018-10-15 14:24:03 CEST; 17ms ago Docs: man:systemd-sysv-generator(8) Process: 17421 ExecStart=/etc/init.d/pki-tomcatd start (code=exited, status=1/FAILURE) Oct 15 14:24:03 freeipa.mdpi.com systemd[1]: Starting LSB: Start pki-tomcatd at boot time... Oct 15 14:24:03 freeipa.mdpi.com pki-tomcatd[17421]: /usr/share/pki/scripts/config: line 41: break: only meaningful in a `for', `while', or `until' loop Oct 15 14:24:03 freeipa.mdpi.com pki-tomcatd[17421]: ERROR: No 'tomcat' instances installed! Oct 15 14:24:03 freeipa.mdpi.com systemd[1]: pki-tomcatd.service: Control process exited, code=exited status=1 Oct 15 14:24:03 freeipa.mdpi.com systemd[1]: pki-tomcatd.service: Failed with result 'exit-code'. Oct 15 14:24:03 freeipa.mdpi.com systemd[1]: Failed to start LSB: Start pki-tomcatd at boot time. pki-tomcatd start failed because no instance has been configured yet Setting up python-ipaserver (4.7.0~pre1+git20180411-2ubuntu2) ... Setting up pki-kra (10.6.0-1ubuntu2) ... Setting up pki-ca (10.6.0-1ubuntu2) ... Setting up freeipa-server (4.7.0~pre1+git20180411-2ubuntu2) ... dpkg: error processing package freeipa-server (--configure): installed freeipa-server package post-installation script subprocess returned error exit status 1 dpkg: dependency problems prevent configuration of freeipa-server-dns: freeipa-server-dns depends on freeipa-server (>= 4.7.0~pre1+git20180411-2ubuntu2); however: Package freeipa-server is not configured yet. dpkg: error processing package freeipa-server-dns (--configure): dependency problems - leaving unconfigured Processing triggers for libc-bin (2.27-3ubuntu1) ... Processing triggers for dbus (1.12.2-1ubuntu1) ... No apport report written because the error message indicates its a followup error from a previous failure. Processing triggers for oddjob (0.34.3-4) ... Errors were encountered while processing: freeipa-server freeipa-server-dns E: Sub-process /usr/bin/dpkg returned an error code (1) Thank you! Milos

3 6

IPA users and local groups question
by Jeff Goddard 11 Jun '19

11 Jun '19

First off thanks to everyone who makes FreeIPA. Its an awesome product that we love. We're working at breaking our application up into micro services and using docker containers and deployment automation. As part of this I have a deploy user in IPA and a rundeck server that performs tasks as this user. However, we need this user to be part of the local docker hosts "docker" group. Is this something I have to do manually per host? Is it possible to create a docker IPA group that will substitute for the local docker group and do it all in IPA? Our IPA version is 4.4. The servers are Centos 7.2 and the clients are ubuntu 16.04 LTS. Thanks for the insight, references and help, Jeff

5 6

zabbix for monitoring FreeIPA server?
by Tony Brian Albers 24 May '19

24 May '19

Hi guys, Anyone got this working? And if so, how did you do it? I know I can monitor the components separately, but if you know of anything that can do it easier I'd be happy to know about it. /tony -- -- Tony Albers Systems administrator, IT-development Royal Danish Library, Victor Albecks Vej 1, 8000 Aarhus C, Denmark. Tel: +45 2566 2383 / +45 8946 2316

3 3

ipa-getkeytab: PrincipalName not found
by Harald Dunkel 26 Apr '19

26 Apr '19

Hi folks, maybe I missed something, but shouldn't admin have sufficient privileges to run # ipa-client-install --hostname stretch1.vs.example.de --no-ssh --no-sshd --no-nisdomain --no-sudo --no-ntp --no-dns-sshfp # reboot : : # kinit admin # ipa-getkeytab -s ipa1.example.de -p HTTP/stretch1.vs.example.de -k /etc/apache2/apache2.keytab ? ipa-getkeytab failed with Failed to parse result: PrincipalName not found. I would have expected it to create the principal on the fly. "admin" was created at freeipa install time on the first server, AFAIR. It is member of the "admins" and "trust admins" groups. I am concerned that I corrupted something. Every helpful comment is highly appreciated. Harri

3 5

different security policy for login(password+otp) and screenlock (password only) for workstation
by Jelle de Jong 09 Apr '19

09 Apr '19

Hello everybody, I am looking for a way to have different authentication policy for a freeia-client logout and screenlock on linux workstations. When a user logs in I want to use my password+otp (this is working)! When a user locks it screen I want to be able unlock it with only the password. When a user logs out and back in then it needs to use the password+otp again. I am aware of the security implications for this. How can I configure this policy? Kind regards, Jelle de Jong

5 9

Re: freeIPA Host certs
by Rob Crittenden 08 Apr '19

08 Apr '19

You've been asked multiple times to keep the list on all replies. This is so others can benefit or perhaps chime in with additional suggestions. Azim Siddiqui wrote: > Hi Rob, > > I tried running getcert command, but it's not listing anything. ( Do I > need to run this command on IPA server or other Jenkins, Git server ? ) I'd try on all of them. Who knows what the previous admin did. It is no big loss if you can't find one. > And also I couldn't able to find the private key. You need to look in the configuration for those individual services. They have to refer to some key and cert in order for TLS to work at all. > Can I generate a new private key ? If yes then, can you please tell me > the commands to run? You don't need to maintain the current private key even if you find it. If you don't find certmonger tracking then assuming the machine(s) are IPA clients you can use ipa-getcert to request and track the certificate. This should do renewal as well. I wrote up a generic how to get a cert for a web server a few months ago, https://rcritten.wordpress.com/2018/11/26/how-do-i-get-a-certificate-for-my… rob > > Thanks & Regards, > Azeem > > > > > > On Fri, 22 Mar 2019 at 16:02, Rob Crittenden <rcritten(a)redhat.com > <mailto:rcritten@redhat.com>> wrote: > > Azim Siddiqui via FreeIPA-users wrote: > > Hi Rob, > > > > Thank you for your email. > > > > So here's the thing, We have a total of five servers in our > environment. > > FreeIPA is installed on one of the servers. And the other servers have > > Tomcat, Jenkins, Git and Haprxy running on the servers. So when i am > > trying to access URL's for this application, for example- Git or > > Jenkins, It is showing Site is not secured. So basically the > certificate > > has been expired. And also I can see the certificates are from IPA. > > > > So now I am looking for a way to renew or create new certs for my > > current expired certs, which are from IPA. So that my URLs will be > secured. > > It's been more than a month, But I am not finding a correct process > > for this. > > > > P.s :- The currently expired certs were created by a System admin, who > > is not working for us now. > > Ok so /etc/pki/nssdb is not what you want. > > Look to see how those services are configured to find where their > certificate(s) are on the filesystem. > > Run getcert list as root to see if the certs were originally requested > using certmonger (I'm guessing not since you say they are expired). > > Once you find the cert files you might also find the original CSR. If > not you can pretty easily generate a new one using the private key you > find. Submit that to IPA using ipa cert_request and that should resolve > things for you. > > rob > > > > > Thanks & Regards, > > Azeem > > > > On Fri, 22 Mar 2019 at 08:50, Rob Crittenden <rcritten(a)redhat.com > <mailto:rcritten@redhat.com> > > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com>>> wrote: > > > > Azim Siddiqui via FreeIPA-users wrote: > > > Hi Florence, > > > > > > I want to extract the private key and certificate to a PEM > file. > > > I am talking about the nssdb which is located in /etc/pki path. > > > > > > Content of nssdb :- > > > certutil -L -d /etc/pki/nssdb/ > > > > > > Certificate Nickname > Trust > > > Attributes > > > > > > SSL,S/MIME,JAR/XPI > > > > > > IPA.CLEAR-MARKETS.COM <http://IPA.CLEAR-MARKETS.COM> > <http://IPA.CLEAR-MARKETS.COM> > > <http://IPA.CLEAR-MARKETS.COM> IPA CA > > > CT,C,C > > > > > > > > > Is this the correct directory to extract the private key and > > > certificate? Will it work if I extract the private key from > nssdb and > > > renew the certificate? > > > > The threading for this is a bit off so I can't follow the > reasoning for > > this. > > > > There is no private key in that directory, only the CA public > > certificate. If you need that in PEM it is likely already on > the machine > > in /etc/ipa/ca.crt. > > > > What is your ultimate goal here? > > > > rob > > > > > > > > Thanks & Regards, > > > Azeem > > > > > > > > > On Thu, 21 Mar 2019 at 05:00, Florence Blanc-Renaud > > <flo(a)redhat.com <mailto:flo@redhat.com> <mailto:flo@redhat.com > <mailto:flo@redhat.com>> > > > <mailto:flo@redhat.com <mailto:flo@redhat.com> > <mailto:flo@redhat.com <mailto:flo@redhat.com>>>> wrote: > > > > > > On 3/19/19 7:07 PM, Azim Siddiqui wrote: > > > > Hi, > > > > > > > > I was wondering is there any way, I can extract the > private > > key and > > > > certificate from nssdb directory? Bcoz the one key i > have is not > > > > matching to the certifficate. > > > > > > > Hi > > > I am insisting, but please keep freeipa-users in copy. > > > > > > What do you mean by "extract"? Do you want to remove the key > > from the > > > nssdb? or transform it into another format? > > > To remove a private key from a nssdb, use the certutil > command > > with -F > > > option. You can find the full format in the man page > certutil(1). > > > > > > If you want to create a PKCS12 file containing the > private key and > > > certificate: > > > pk12util -o keys.p12 -n $alias -d $NSSDB > > > > > > If you want a PEM file containing the private key: > > > pk12util -o keys.p12 -n $alias -d $NSSDB > > > openssl pkcs12 -in keys.p12 -out cert.key -nodes > > > > > > If you want a PEM file containing the cert: > > > certutil -L -d $NSSDB -n $alias -a -o cert.pem > > > > > > But first of all, which NSSDB directory are you working > with? > > A NSSDB > > > can contain multiple keys and certificates, and also > certificates > > > without matching private keys. Can you show the content of > > your NSSDB? > > > certutil -L -d $NSSDB > > > certutil -K -d $NSSDB > > > > > > flo > > > > Thanks, > > > > Azeem > > > > > > > > On Tue, 19 Mar 2019 at 13:01, Florence Blanc-Renaud > > > <flo(a)redhat.com <mailto:flo@redhat.com> > <mailto:flo@redhat.com <mailto:flo@redhat.com>> > <mailto:flo@redhat.com <mailto:flo@redhat.com> > > <mailto:flo@redhat.com <mailto:flo@redhat.com>>> > > > > <mailto:flo@redhat.com <mailto:flo@redhat.com> > <mailto:flo@redhat.com <mailto:flo@redhat.com>> > > <mailto:flo@redhat.com <mailto:flo@redhat.com> > <mailto:flo@redhat.com <mailto:flo@redhat.com>>>>> wrote: > > > > > > > > On 3/19/19 4:18 PM, Azim Siddiqui wrote: > > > > > Hi Florence, > > > > > > > > > > Thanks for the info. I will check for the > > ipa cert-find command > > > > and will > > > > > send you the output. Actually, when I am trying to > > do $ kinit > > > > admin it > > > > > is asking for a password. And I am not sure > about the > > > password, as I > > > > > said it was set by the previous system admin. > > > > > > > > > Hi > > > > (re-adding freeipa-users in cc) > > > > > > > > if you do kinit -kt /etc/krb5.keytab you should also > > have enough > > > > permissions to perform ipa cert-find. > > > > > > > > > And also I can see there is nssdb directory on the > > server. > > > Do you > > > > by any > > > > > chance know, what is that for? > > > > There are many nssdb directories on a FreeIPA system. > > For instance > > > > /etc/ipa/nssdb is the NSS database used by the ipa * > > commands. It > > > > contains the certificates of the trusted certificate > > > authorities. You > > > > can find more information re. NSS databases in the man > > page for > > > > certutil(1). > > > > > > > > > > > > > > If I have the private key on the server, how can I > > renew the > > > > certificate > > > > > signed by IPA. can you please provide me the steps. > > > > If you have the private key in $NSSDB database you > just need > > > to follow > > > > the steps provided in my first email > > > > > > > > > > (https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost…) > > > > > > > > flo > > > > > > > > > > thanks & Regards, > > > > > Azeem > > > > > > > > > > On Tue, 19 Mar 2019 at 04:57, Florence Blanc-Renaud > > > > <flo(a)redhat.com <mailto:flo@redhat.com> > <mailto:flo@redhat.com <mailto:flo@redhat.com>> > > <mailto:flo@redhat.com <mailto:flo@redhat.com> > <mailto:flo@redhat.com <mailto:flo@redhat.com>>> > > <mailto:flo@redhat.com <mailto:flo@redhat.com> > <mailto:flo@redhat.com <mailto:flo@redhat.com>> > > > <mailto:flo@redhat.com <mailto:flo@redhat.com> > <mailto:flo@redhat.com <mailto:flo@redhat.com>>>> > > > > > <mailto:flo@redhat.com <mailto:flo@redhat.com> > <mailto:flo@redhat.com <mailto:flo@redhat.com>> > > <mailto:flo@redhat.com <mailto:flo@redhat.com> > <mailto:flo@redhat.com <mailto:flo@redhat.com>>> > > > <mailto:flo@redhat.com <mailto:flo@redhat.com> > <mailto:flo@redhat.com <mailto:flo@redhat.com>> > > <mailto:flo@redhat.com <mailto:flo@redhat.com> > <mailto:flo@redhat.com <mailto:flo@redhat.com>>>>>> wrote: > > > > > > > > > > On 3/18/19 7:50 PM, Azim Siddiqui wrote: > > > > > > Hi Florence, > > > > > > > > > > > > Thanks for your reply. > > > > > > I am referring to the applications. For > > example, we have > > > > > > Apache,haproxy,jenkins,git which uses > certs signed > > > by IPA. And > > > > > now when > > > > > > I am browsing these applications urls. It is > > > showing, this > > > > site > > > > > is not > > > > > > secured. > > > > > > And originally, This cert were created > by a system > > > admin, > > > > who is not > > > > > > working with us now. So its getting hard > for me to > > > figure out, > > > > > how can I > > > > > > create or renew the certs. > > > > > > > > > > > > And I don't see any files ssl.conf or > nss.conf in > > > the server. > > > > > > The output for getcert list command > shows this :- > > > > > > getcert list > > > > > > Number of certificates and requests being > > tracked: 0. > > > > > > > > > > > > > > > > > > I just want to create a crt and key file > signed by > > > IPA. So > > > > that I > > > > > can > > > > > > use it for the browsers. > > > > > Hi, > > > > > > > > > > please keep the users mailing list in cc, > so that > > everyone > > > > can get > > > > > involved/see the resolution. > > > > > > > > > > It is difficult to provide advice with so few > > information. > > > > Can you > > > > > start > > > > > by checking which certificates were already > issued by > > > > FreeIPA, and > > > > > we'll > > > > > see if they are expired? > > > > > > > > > > $ kinit admin > > > > > $ ipa cert-find > > > > > > > > > > With the full output and based on the subject > > you'll be > > > able to > > > > > identify > > > > > the host or service certs that you are > using for your > > > > applications. For > > > > > each of these certs, run > > > > > $ kinit admin > > > > > $ ipa cert-show <serial number> > > > > > and the output will show if the cert is expired > > (check the > > > > Not After > > > > > field). > > > > > > > > > > For an expired cert, you will be able to renew > > the cert if > > > > you still > > > > > have the private key. The private key location > > can be found > > > > by checking > > > > > the configuration of your applications. > > > > > For instance apache on rhel or fedora > stores its > > config in > > > > > /etc/httpd/conf/httpd.conf, which by default > > loads the > > > modules in > > > > > conf.modules.d/*.conf and the config files in > > > conf.d/*.conf. > > > > > > > > > > flo > > > > > > > > > > > > Thanks, > > > > > > Azeem > > > > > > > > > > > > > > > > > > On Mon, 18 Mar 2019 at 05:30, Florence > > Blanc-Renaud > > > > > <flo(a)redhat.com <mailto:flo@redhat.com> > <mailto:flo@redhat.com <mailto:flo@redhat.com>> > > <mailto:flo@redhat.com <mailto:flo@redhat.com> > <mailto:flo@redhat.com <mailto:flo@redhat.com>>> > > > <mailto:flo@redhat.com <mailto:flo@redhat.com> > <mailto:flo@redhat.com <mailto:flo@redhat.com>> > > <mailto:flo@redhat.com <mailto:flo@redhat.com> > <mailto:flo@redhat.com <mailto:flo@redhat.com>>>> > > > > <mailto:flo@redhat.com <mailto:flo@redhat.com> > <mailto:flo@redhat.com <mailto:flo@redhat.com>> > > <mailto:flo@redhat.com <mailto:flo@redhat.com> > <mailto:flo@redhat.com <mailto:flo@redhat.com>>> > > > <mailto:flo@redhat.com <mailto:flo@redhat.com> > <mailto:flo@redhat.com <mailto:flo@redhat.com>> > > <mailto:flo@redhat.com <mailto:flo@redhat.com> > <mailto:flo@redhat.com <mailto:flo@redhat.com>>>>> > > > > > > <mailto:flo@redhat.com > <mailto:flo@redhat.com> <mailto:flo@redhat.com <mailto:flo@redhat.com>> > > <mailto:flo@redhat.com <mailto:flo@redhat.com> > <mailto:flo@redhat.com <mailto:flo@redhat.com>>> > > > <mailto:flo@redhat.com <mailto:flo@redhat.com> > <mailto:flo@redhat.com <mailto:flo@redhat.com>> > > <mailto:flo@redhat.com <mailto:flo@redhat.com> > <mailto:flo@redhat.com <mailto:flo@redhat.com>>>> > > > > <mailto:flo@redhat.com <mailto:flo@redhat.com> > <mailto:flo@redhat.com <mailto:flo@redhat.com>> > > <mailto:flo@redhat.com <mailto:flo@redhat.com> > <mailto:flo@redhat.com <mailto:flo@redhat.com>>> > > > <mailto:flo@redhat.com <mailto:flo@redhat.com> > <mailto:flo@redhat.com <mailto:flo@redhat.com>> > > <mailto:flo@redhat.com <mailto:flo@redhat.com> > <mailto:flo@redhat.com <mailto:flo@redhat.com>>>>>>> wrote: > > > > > > > > > > > > On 3/15/19 8:16 PM, Azim Siddiqui wrote: > > > > > > > Hi Florence, > > > > > > > > > > > > > > Hope you are doing good. I tried the > > way you > > > said. But > > > > > still, it is > > > > > > > showing certificate is expired. > > > > > > > > > > > > > > Let me be more clear about it. > > > > > > > > > > > > > > We have apache running with an > expired > > > certificate > > > > which is > > > > > > signed by > > > > > > > FreeIPA. Now I want to renew or > create > > a new > > > > certificate. > > > > > So can you > > > > > > > please tell me how can I renew or > > create a new > > > > certificate > > > > > signed by > > > > > > > Freeipa. > > > > > > > As whenever I am going to the Apache > > URL from the > > > > browser, > > > > > it is > > > > > > showing > > > > > > > site is not secured. > > > > > > > > > > > > > > Thanks & Regards, > > > > > > > Azeem > > > > > > > > > > > > > Hi, > > > > > > > > > > > > (re-adding freeipa-users in CC). > > > > > > Can you first confirm that you are > > referring to > > > a cert for > > > > > the apache > > > > > > server *not running on one of the > FreeIPA > > masters*? > > > > > > > > > > > > Then please explain how you originally > > obtained the > > > > > certificate. Also > > > > > > include the following information: > > > > > > - relevant apache configuration (if > using > > > mod_ssl, then > > > > > > /etc/httpd/conf.d/ssl.conf or if using > > mod_nss, > > > > > > /etc/httpd/conf.d/nss.conf). > > > > > > - output of getcert list on the host > > running apache > > > > > > > > > > > > flo > > > > > > > > > > > > > On Wed, 19 Dec 2018 at 14:04, > Florence > > > Blanc-Renaud > > > > > > <flo(a)redhat.com > <mailto:flo@redhat.com> <mailto:flo@redhat.com <mailto:flo@redhat.com>> > > <mailto:flo@redhat.com <mailto:flo@redhat.com> > <mailto:flo@redhat.com <mailto:flo@redhat.com>>> > > > <mailto:flo@redhat.com <mailto:flo@redhat.com> > <mailto:flo@redhat.com <mailto:flo@redhat.com>> > > <mailto:flo@redhat.com <mailto:flo@redhat.com> > <mailto:flo@redhat.com <mailto:flo@redhat.com>>>> > > > > <mailto:flo@redhat.com <mailto:flo@redhat.com> > <mailto:flo@redhat.com <mailto:flo@redhat.com>> > > <mailto:flo@redhat.com <mailto:flo@redhat.com> > <mailto:flo@redhat.com <mailto:flo@redhat.com>>> > > > <mailto:flo@redhat.com <mailto:flo@redhat.com> > <mailto:flo@redhat.com <mailto:flo@redhat.com>> > > <mailto:flo@redhat.com <mailto:flo@redhat.com> > <mailto:flo@redhat.com <mailto:flo@redhat.com>>>>> > > > > > <mailto:flo@redhat.com > <mailto:flo@redhat.com> <mailto:flo@redhat.com <mailto:flo@redhat.com>> > > <mailto:flo@redhat.com <mailto:flo@redhat.com> > <mailto:flo@redhat.com <mailto:flo@redhat.com>>> > > > <mailto:flo@redhat.com <mailto:flo@redhat.com> > <mailto:flo@redhat.com <mailto:flo@redhat.com>> > > <mailto:flo@redhat.com <mailto:flo@redhat.com> > <mailto:flo@redhat.com <mailto:flo@redhat.com>>>> > > > > <mailto:flo@redhat.com <mailto:flo@redhat.com> > <mailto:flo@redhat.com <mailto:flo@redhat.com>> > > <mailto:flo@redhat.com <mailto:flo@redhat.com> > <mailto:flo@redhat.com <mailto:flo@redhat.com>>> > > > <mailto:flo@redhat.com <mailto:flo@redhat.com> > <mailto:flo@redhat.com <mailto:flo@redhat.com>> > > <mailto:flo@redhat.com <mailto:flo@redhat.com> > <mailto:flo@redhat.com <mailto:flo@redhat.com>>>>>> > > > > > > > <mailto:flo@redhat.com > <mailto:flo@redhat.com> > > <mailto:flo@redhat.com <mailto:flo@redhat.com>> > > > <mailto:flo@redhat.com <mailto:flo@redhat.com> > <mailto:flo@redhat.com <mailto:flo@redhat.com>>> > > <mailto:flo@redhat.com <mailto:flo@redhat.com> > <mailto:flo@redhat.com <mailto:flo@redhat.com>> > > <mailto:flo@redhat.com <mailto:flo@redhat.com> > <mailto:flo@redhat.com <mailto:flo@redhat.com>>>> > > > > <mailto:flo@redhat.com <mailto:flo@redhat.com> > <mailto:flo@redhat.com <mailto:flo@redhat.com>> > > <mailto:flo@redhat.com <mailto:flo@redhat.com> > <mailto:flo@redhat.com <mailto:flo@redhat.com>>> > > > <mailto:flo@redhat.com <mailto:flo@redhat.com> > <mailto:flo@redhat.com <mailto:flo@redhat.com>> > > <mailto:flo@redhat.com <mailto:flo@redhat.com> > <mailto:flo@redhat.com <mailto:flo@redhat.com>>>>> > > > > > <mailto:flo@redhat.com > <mailto:flo@redhat.com> <mailto:flo@redhat.com <mailto:flo@redhat.com>> > > <mailto:flo@redhat.com <mailto:flo@redhat.com> > <mailto:flo@redhat.com <mailto:flo@redhat.com>>> > > > <mailto:flo@redhat.com <mailto:flo@redhat.com> > <mailto:flo@redhat.com <mailto:flo@redhat.com>> > > <mailto:flo@redhat.com <mailto:flo@redhat.com> > <mailto:flo@redhat.com <mailto:flo@redhat.com>>>> > > > > <mailto:flo@redhat.com <mailto:flo@redhat.com> > <mailto:flo@redhat.com <mailto:flo@redhat.com>> > > <mailto:flo@redhat.com <mailto:flo@redhat.com> > <mailto:flo@redhat.com <mailto:flo@redhat.com>>> > > > <mailto:flo@redhat.com <mailto:flo@redhat.com> > <mailto:flo@redhat.com <mailto:flo@redhat.com>> > > <mailto:flo@redhat.com <mailto:flo@redhat.com> > <mailto:flo@redhat.com <mailto:flo@redhat.com>>>>>>>> wrote: > > > > > > > > > > > > > > On 12/13/18 4:04 PM, Azim > Siddiqui via > > > > FreeIPA-users > > > > > wrote: > > > > > > > > Hello, > > > > > > > > > > > > > > > > Hope you are doing good. I > have > > a question > > > > regarding > > > > > > freeIPA host > > > > > > > > certificates. > > > > > > > > We are using FreeIPA as > our LDAP. We > > > have some > > > > > > certificates for > > > > > > > hosts ex > > > > > > > > :- http/uat.com > <http://uat.com> <http://uat.com> > > <http://uat.com> > > > <http://uat.com> > > > > <http://uat.com> <http://uat.com> > > > > > <http://uat.com> > > > > > > <http://uat.com>. > > > > > > > > And we deploying the certs in > > Haproxy > > > in PEM > > > > format. > > > > > > > > But the certificates for this > > host has > > > been > > > > expired. > > > > > > > > Can you please let me know > in detail > > > how to > > > > renew > > > > > my expired > > > > > > > > certificates for the hosts. > > Please provide > > > > me the > > > > > commands > > > > > > and steps. > > > > > > > > > > > > > > > Hi, > > > > > > > > > > > > > > from your description I > understand that > > > you are > > > > > referring to > > > > > > > certificates delivered by IPA CA > > for one > > > of the > > > > > IPA-enrolled > > > > > > hosts, but > > > > > > > not the master's Server-Cert used > > for IPA > > > Web GUI. > > > > > > > > > > > > > > In this case, how did you > obtain the > > > > certificate? If > > > > > you used > > > > > > a method > > > > > > > similar to what is described in > > this wiki > > > [1], the > > > > > certificate > > > > > > > should be > > > > > > > monitored by certmonger and > > automatically > > > renewed. > > > > > > > > > > > > > > If you followed instead this wiki > > [2], the > > > > certificate > > > > > is not > > > > > > > tracked by > > > > > > > certmonger and needs to be > manually > > renewed. > > > > You need > > > > > to do the > > > > > > > following, assuming that the cert > > is in a NSS > > > > database > > > > > $NSSDB > > > > > > on the > > > > > > > IPA > > > > > > > client: > > > > > > > - find the key nickname > > > > > > > # certutil -K -d $NSSDB > > > > > > > certutil: Checking token "NSS > > Certificate DB" > > > > in slot "NSS > > > > > > User Private > > > > > > > Key and Certificate Services" > > > > > > > Enter Password or Pin for "NSS > > > Certificate DB": > > > > > > > < 0> rsa > > > > > 7c0646606b33ab683ee4d1790719ebc4154db0f6 NSS > > > > > > > Certificate > > > > > > > DB:Server-Cert > > > > > > > (note the key nickname for > the next > > command) > > > > > > > > > > > > > > - create a new certificate > request > > that will > > > > re-use the > > > > > > existing key > > > > > > > (replace DOMAIN.COM > <http://DOMAIN.COM> > > <http://DOMAIN.COM> <http://DOMAIN.COM> > > > <http://DOMAIN.COM> > > > > <http://DOMAIN.COM> > > > > > <http://DOMAIN.COM> <http://DOMAIN.COM> > > > > > > with your IPA domain, in > > > > > > > uppercase): > > > > > > > # certutil -R -d $NSSDB -k "NSS > > Certificate > > > > > DB:Server-Cert" -s > > > > > > > cn=`hostname,O=DOMAIN.COM > <http://DOMAIN.COM> > > <http://DOMAIN.COM> > > > <http://DOMAIN.COM> <http://DOMAIN.COM> > > > > <http://DOMAIN.COM> > > > > > <http://DOMAIN.COM> > > > > > > <http://DOMAIN.COM>" -a -o /tmp/cert.csr > > > > > > > Enter Password or Pin for "NSS > > > Certificate DB": > > > > > > > > > > > > > > - request a certificate using > the new > > > > certificate request > > > > > > > # kinit admin > > > > > > > # ipa cert-request > > > --principal=HTTP/`hostname` > > > > > /tmp/web.csr > > > > > > > (the output will display a Serial > > Number that > > > > needs to be > > > > > > noted for the > > > > > > > next command) > > > > > > > > > > > > > > - remove the previous cert > from the NSS > > > database: > > > > > > > # certutil -D -d $NSSDB -n > Server-Cert > > > > > > > > > > > > > > - export the certificate to a > file, > > then > > > import the > > > > > > certificate in the > > > > > > > NSS database: > > > > > > > # ipa cert-show $SERIAL_NUMBER > > > > --out=/tmp/server.crt > > > > > > > # certutil -A -d $NSSDB -n > > Server-Cert -t > > > u,u,u -i > > > > > > /tmp/server.crt > > > > > > > > > > > > > > HTH, > > > > > > > flo > > > > > > > > > > > > > > [1] > > > > > > > > > > > > > > > > > > > > > > > > > > > > https://www.freeipa.org/page/PKI#Automated_certificate_requests_with_Certmo… > > > > > > > [2] > > > > > > > https://www.freeipa.org/page/PKI#Manual_certificate_requests > > > > > > > > > > > > > > > FreeIPA, version: 4.2.0 > > > > > > > > > > > > > > > > Thanks & Regards, > > > > > > > > Azeem > > > > > > > > > > > > > > > > > > > > > > > > > > > _______________________________________________ > > > > > > > > FreeIPA-users mailing list -- > > > > > > > > freeipa-users(a)lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org> > > <mailto:freeipa-users@lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org>> > > > <mailto:freeipa-users@lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org> > > <mailto:freeipa-users@lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org>>> > > > > <mailto:freeipa-users@lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org> > > <mailto:freeipa-users@lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org>> > > > <mailto:freeipa-users@lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org> > > <mailto:freeipa-users@lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org>>>> > > > > > > <mailto:freeipa-users@lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org> > > <mailto:freeipa-users@lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org>> > > > <mailto:freeipa-users@lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org> > > <mailto:freeipa-users@lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org>>> > > > > <mailto:freeipa-users@lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org> > > <mailto:freeipa-users@lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org>> > > > <mailto:freeipa-users@lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org> > > <mailto:freeipa-users@lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org>>>>> > > > > > > > > <mailto:freeipa-users@lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org> > > <mailto:freeipa-users@lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org>> > > > <mailto:freeipa-users@lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org> > > <mailto:freeipa-users@lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org>>> > > > > <mailto:freeipa-users@lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org> > > <mailto:freeipa-users@lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org>> > > > <mailto:freeipa-users@lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org> > > <mailto:freeipa-users@lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org>>>> > > > > > > <mailto:freeipa-users@lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org> > > <mailto:freeipa-users@lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org>> > > > <mailto:freeipa-users@lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org> > > <mailto:freeipa-users@lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org>>> > > > > <mailto:freeipa-users@lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org> > > <mailto:freeipa-users@lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org>> > > > <mailto:freeipa-users@lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org> > > <mailto:freeipa-users@lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org>>>>>> > > > > > > > > > > <mailto:freeipa-users@lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org> > > <mailto:freeipa-users@lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org>> > > > <mailto:freeipa-users@lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org> > > <mailto:freeipa-users@lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org>>> > > > > <mailto:freeipa-users@lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org> > > <mailto:freeipa-users@lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org>> > > > <mailto:freeipa-users@lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org> > > <mailto:freeipa-users@lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org>>>> > > > > > > <mailto:freeipa-users@lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org> > > <mailto:freeipa-users@lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org>> > > > <mailto:freeipa-users@lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org> > > <mailto:freeipa-users@lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org>>> > > > > <mailto:freeipa-users@lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org> > > <mailto:freeipa-users@lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org>> > > > <mailto:freeipa-users@lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org> > > <mailto:freeipa-users@lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org>>>>> > > > > > > > > <mailto:freeipa-users@lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org> > > <mailto:freeipa-users@lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org>> > > > <mailto:freeipa-users@lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org> > > <mailto:freeipa-users@lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org>>> > > > > <mailto:freeipa-users@lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org> > > <mailto:freeipa-users@lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org>> > > > <mailto:freeipa-users@lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org> > > <mailto:freeipa-users@lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org>>>> > > > > > > <mailto:freeipa-users@lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org> > > <mailto:freeipa-users@lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org>> > > > <mailto:freeipa-users@lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org> > > <mailto:freeipa-users@lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org>>> > > > > <mailto:freeipa-users@lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org> > > <mailto:freeipa-users@lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org>> > > > <mailto:freeipa-users@lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org> > > <mailto:freeipa-users@lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org>>>>>>> > > > > > > > > To unsubscribe send an > email to > > > > > > > > > freeipa-users-leave(a)lists.fedorahosted.org > <mailto:freeipa-users-leave@lists.fedorahosted.org> > > <mailto:freeipa-users-leave@lists.fedorahosted.org > <mailto:freeipa-users-leave@lists.fedorahosted.org>> > > > <mailto:freeipa-users-leave@lists.fedorahosted.org > <mailto:freeipa-users-leave@lists.fedorahosted.org> > > <mailto:freeipa-users-leave@lists.fedorahosted.org > <mailto:freeipa-users-leave@lists.fedorahosted.org>>> > > > > <mailto:freeipa-users-leave@lists.fedorahosted.org > <mailto:freeipa-users-leave@lists.fedorahosted.org> > > <mailto:freeipa-users-leave@lists.fedorahosted.org > <mailto:freeipa-users-leave@lists.fedorahosted.org>> > > > <mailto:freeipa-users-leave@lists.fedorahosted.org > <mailto:freeipa-users-leave@lists.fedorahosted.org> > > <mailto:freeipa-users-leave@lists.fedorahosted.org > <mailto:freeipa-users-leave@lists.fedorahosted.org>>>> > > > > > > > <mailto:freeipa-users-leave@lists.fedorahosted.org > <mailto:freeipa-users-leave@lists.fedorahosted.org> > > <mailto:freeipa-users-leave@lists.fedorahosted.org > <mailto:freeipa-users-leave@lists.fedorahosted.org>> > > > <mailto:freeipa-users-leave@lists.fedorahosted.org > <mailto:freeipa-users-leave@lists.fedorahosted.org> > > <mailto:freeipa-users-leave@lists.fedorahosted.org > <mailto:freeipa-users-leave@lists.fedorahosted.org>>> > > > > <mailto:freeipa-users-leave@lists.fedorahosted.org > <mailto:freeipa-users-leave@lists.fedorahosted.org> > > <mailto:freeipa-users-leave@lists.fedorahosted.org > <mailto:freeipa-users-leave@lists.fedorahosted.org>> > > > <mailto:freeipa-users-leave@lists.fedorahosted.org > <mailto:freeipa-users-leave@lists.fedorahosted.org> > > <mailto:freeipa-users-leave@lists.fedorahosted.org > <mailto:freeipa-users-leave@lists.fedorahosted.org>>>>> > > > > > > > > > <mailto:freeipa-users-leave@lists.fedorahosted.org > <mailto:freeipa-users-leave@lists.fedorahosted.org> > > <mailto:freeipa-users-leave@lists.fedorahosted.org > <mailto:freeipa-users-leave@lists.fedorahosted.org>> > > > <mailto:freeipa-users-leave@lists.fedorahosted.org > <mailto:freeipa-users-leave@lists.fedorahosted.org> > > <mailto:freeipa-users-leave@lists.fedorahosted.org > <mailto:freeipa-users-leave@lists.fedorahosted.org>>> > > > > <mailto:freeipa-users-leave@lists.fedorahosted.org > <mailto:freeipa-users-leave@lists.fedorahosted.org> > > <mailto:freeipa-users-leave@lists.fedorahosted.org > <mailto:freeipa-users-leave@lists.fedorahosted.org>> > > > <mailto:freeipa-users-leave@lists.fedorahosted.org > <mailto:freeipa-users-leave@lists.fedorahosted.org> > > <mailto:freeipa-users-leave@lists.fedorahosted.org > <mailto:freeipa-users-leave@lists.fedorahosted.org>>>> > > > > > > > <mailto:freeipa-users-leave@lists.fedorahosted.org > <mailto:freeipa-users-leave@lists.fedorahosted.org> > > <mailto:freeipa-users-leave@lists.fedorahosted.org > <mailto:freeipa-users-leave@lists.fedorahosted.org>> > > > <mailto:freeipa-users-leave@lists.fedorahosted.org > <mailto:freeipa-users-leave@lists.fedorahosted.org> > > <mailto:freeipa-users-leave@lists.fedorahosted.org > <mailto:freeipa-users-leave@lists.fedorahosted.org>>> > > > > <mailto:freeipa-users-leave@lists.fedorahosted.org > <mailto:freeipa-users-leave@lists.fedorahosted.org> > > <mailto:freeipa-users-leave@lists.fedorahosted.org > <mailto:freeipa-users-leave@lists.fedorahosted.org>> > > > <mailto:freeipa-users-leave@lists.fedorahosted.org > <mailto:freeipa-users-leave@lists.fedorahosted.org> > > <mailto:freeipa-users-leave@lists.fedorahosted.org > <mailto:freeipa-users-leave@lists.fedorahosted.org>>>>>> > > > > > > > > > > > > <mailto:freeipa-users-leave@lists.fedorahosted.org > <mailto:freeipa-users-leave@lists.fedorahosted.org> > > <mailto:freeipa-users-leave@lists.fedorahosted.org > <mailto:freeipa-users-leave@lists.fedorahosted.org>> > > > <mailto:freeipa-users-leave@lists.fedorahosted.org > <mailto:freeipa-users-leave@lists.fedorahosted.org> > > <mailto:freeipa-users-leave@lists.fedorahosted.org > <mailto:freeipa-users-leave@lists.fedorahosted.org>>> > > > > <mailto:freeipa-users-leave@lists.fedorahosted.org > <mailto:freeipa-users-leave@lists.fedorahosted.org> > > <mailto:freeipa-users-leave@lists.fedorahosted.org > <mailto:freeipa-users-leave@lists.fedorahosted.org>> > > > <mailto:freeipa-users-leave@lists.fedorahosted.org > <mailto:freeipa-users-leave@lists.fedorahosted.org> > > <mailto:freeipa-users-leave@lists.fedorahosted.org > <mailto:freeipa-users-leave@lists.fedorahosted.org>>>> > > > > > > > <mailto:freeipa-users-leave@lists.fedorahosted.org > <mailto:freeipa-users-leave@lists.fedorahosted.org> > > <mailto:freeipa-users-leave@lists.fedorahosted.org > <mailto:freeipa-users-leave@lists.fedorahosted.org>> > > > <mailto:freeipa-users-leave@lists.fedorahosted.org > <mailto:freeipa-users-leave@lists.fedorahosted.org> > > <mailto:freeipa-users-leave@lists.fedorahosted.org > <mailto:freeipa-users-leave@lists.fedorahosted.org>>> > > > > <mailto:freeipa-users-leave@lists.fedorahosted.org > <mailto:freeipa-users-leave@lists.fedorahosted.org> > > <mailto:freeipa-users-leave@lists.fedorahosted.org > <mailto:freeipa-users-leave@lists.fedorahosted.org>> > > > <mailto:freeipa-users-leave@lists.fedorahosted.org > <mailto:freeipa-users-leave@lists.fedorahosted.org> > > <mailto:freeipa-users-leave@lists.fedorahosted.org > <mailto:freeipa-users-leave@lists.fedorahosted.org>>>>> > > > > > > > > > <mailto:freeipa-users-leave@lists.fedorahosted.org > <mailto:freeipa-users-leave@lists.fedorahosted.org> > > <mailto:freeipa-users-leave@lists.fedorahosted.org > <mailto:freeipa-users-leave@lists.fedorahosted.org>> > > > <mailto:freeipa-users-leave@lists.fedorahosted.org > <mailto:freeipa-users-leave@lists.fedorahosted.org> > > <mailto:freeipa-users-leave@lists.fedorahosted.org > <mailto:freeipa-users-leave@lists.fedorahosted.org>>> > > > > <mailto:freeipa-users-leave@lists.fedorahosted.org > <mailto:freeipa-users-leave@lists.fedorahosted.org> > > <mailto:freeipa-users-leave@lists.fedorahosted.org > <mailto:freeipa-users-leave@lists.fedorahosted.org>> > > > <mailto:freeipa-users-leave@lists.fedorahosted.org > <mailto:freeipa-users-leave@lists.fedorahosted.org> > > <mailto:freeipa-users-leave@lists.fedorahosted.org > <mailto:freeipa-users-leave@lists.fedorahosted.org>>>> > > > > > > > <mailto:freeipa-users-leave@lists.fedorahosted.org > <mailto:freeipa-users-leave@lists.fedorahosted.org> > > <mailto:freeipa-users-leave@lists.fedorahosted.org > <mailto:freeipa-users-leave@lists.fedorahosted.org>> > > > <mailto:freeipa-users-leave@lists.fedorahosted.org > <mailto:freeipa-users-leave@lists.fedorahosted.org> > > <mailto:freeipa-users-leave@lists.fedorahosted.org > <mailto:freeipa-users-leave@lists.fedorahosted.org>>> > > > > <mailto:freeipa-users-leave@lists.fedorahosted.org > <mailto:freeipa-users-leave@lists.fedorahosted.org> > > <mailto:freeipa-users-leave@lists.fedorahosted.org > <mailto:freeipa-users-leave@lists.fedorahosted.org>> > > > <mailto:freeipa-users-leave@lists.fedorahosted.org > <mailto:freeipa-users-leave@lists.fedorahosted.org> > > <mailto:freeipa-users-leave@lists.fedorahosted.org > <mailto:freeipa-users-leave@lists.fedorahosted.org>>>>>>> > > > > > > > > Fedora Code of Conduct: > > > > > > https://getfedora.org/code-of-conduct.html > > > > > > > > List Guidelines: > > > > > > > > > > https://fedoraproject.org/wiki/Mailing_list_guidelines > > > > > > > > List Archives: > > > > > > > > > > > > > > > > > > > > > > > > > > > > https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost… > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > _______________________________________________ > > > FreeIPA-users mailing list -- > freeipa-users(a)lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org> > > <mailto:freeipa-users@lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org>> > > > To unsubscribe send an email to > > freeipa-users-leave(a)lists.fedorahosted.org > <mailto:freeipa-users-leave@lists.fedorahosted.org> > > <mailto:freeipa-users-leave@lists.fedorahosted.org > <mailto:freeipa-users-leave@lists.fedorahosted.org>> > > > Fedora Code of Conduct: > https://getfedora.org/code-of-conduct.html > > > List Guidelines: > > https://fedoraproject.org/wiki/Mailing_list_guidelines > > > List Archives: > > > https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost… > > > > > > > > > > > _______________________________________________ > > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org> > > To unsubscribe send an email to > freeipa-users-leave(a)lists.fedorahosted.org > <mailto:freeipa-users-leave@lists.fedorahosted.org> > > Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html > > List Guidelines: > https://fedoraproject.org/wiki/Mailing_list_guidelines > > List Archives: > https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost… > > >

2 3

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users March 2019