September 2019 - FreeIPA-users - Fedora mailing-lists

Removal & clean up certificates from o=ipaca
by David Goudet 01 Oct '24

01 Oct '24

Hello all, I have to clean up lot of useless certificate in dirsrv database. Because of resubmit loop on Certmonger client, i have 99,9% of certificate in dirsrv database that are useless and not obsolete (expiration in 2020) (it represent ~85 000 certificates). These useless certificates produce some issues on FreeIPA: - decrease FreeIPA performances on CLI and GUI - increase the LDAP size - increase size and time of FreeIPA backup ... Is it possible to purge these certificates in dirsrv database and how? I found two branches in LDAP directory about these certificates: dn: cn=xxx,ou=ca,ou=requests,o=ipaca dn: cn=yyy,ou=certificateRepository,ou=ca,o=ipaca I can remove all requests and certificates entry from dirsrv database but how it is supported by PKI manager Dogtag (CRL, certificate generation, OCSP)? (This topic has already been discuss on https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost…) Thank you for you help -- David GOUDET LYRA NETWORK IT Operations service Tel : +33 (0)5 32 09 09 74 | Poste : 574

4 7

How to prevent non-admin users of FreeIPA from reading the list of users in the web interface?
by cdknight 16 Apr '24

16 Apr '24

When a user signs in to FreeIPA, I do not want them to be able to view the list of users in my LDAP server under the "Active users" link. I still want them to be able to administer self-service, so they can reset their password, add OTP tokens, etc. How would I go about doing this? The users will only be able to access the web interface, so it doesn't matter whether they can access it from other sources.

5 10

FreeIPA web session timeout
by Yuri Krysko 11 Jan '24

11 Jan '24

Hello, Could you please advise how to configure FreeIPA web UI user session timeout? Thanks, Yuri ________________________________ LEGAL DISCLAIMER: M.C. Dean, Inc. and its subsidiaries considers this e-mail and any files transmitted with it to be protected, proprietary or privileged information intended solely for the use of the named recipient(s). Any disclosure of this material or the information contained herein, in whole or in part, to anyone outside of the intended recipient or affiliates is strictly prohibited. M. C. Dean, Inc. accepts no liability for the content of this e-mail or for the consequences of any actions taken on the basis of the information contained in it, unless that information is subsequently confirmed in writing. Employees of M.C. Dean, Inc. are instructed not to infringe on any rights of the recipient; any such communication violates company policy. If you are not the intended recipient, any disclosure, copying, distribution, or action taken or omitted in reliance on this information is strictly prohibited by M.C. Dean, Inc.; please notify the sender immediately by return e-mail, delete this communication and destroy all copies.

4 4

Allow sysaccount to view its own entry
by Adam Bishop 10 Nov '23

10 Nov '23

I have a piece of software that tries to look up its own uid to check that LDAP is correctly configured. This check fails because the sysaccount cannot view anything under cn=etc,cn=sysaccounts. Is there an existing permission/privilege that I can use to allow it to read the sysaccounts tree (or better, just its own entry)? Many Thanks, Adam Bishop

4 3

kinit: KDC can't fulfill requested option while renewing credentials - which approach?
by Pieter Baele 20 Sep '23

20 Sep '23

I tried various approached to get Renewable tickets : modifying the kdc modifying krb5.conf using kadmin.local on every replica to modify the principal; which is not working - as designed (?)- in IPA What should I do to get a ticket with the correct R flag from IPA ? I don't think this is SSSD related (the service needing the renewable ticket this way is Apache Storm) Thanks a lot!

3 4

Do keytabs expire?
by Ronald Wimmer 07 Jun '23

07 Jun '23

Hi, today I found out that some entries in a keytab file seemed to have expired: Request ticket server HTTP/mwc.linux.mydomain.at(a)LINUX.MYDOMAIN.AT kvno 4 not found in keytab; keytab is likely out of date Fetching the keytab again with ipa-getkeytab fixed the problem. But why is this happening? Do keytab entries expire? I have not set any custom password or ticket policies. Regards, Ronald

4 13

ipa-replica-install -- cannot get past [26/41]: creating DS keytab
by Jonathon Jenkins 28 Mar '23

28 Mar '23

Greetings, I cannot get the ipa-replica-install to proceed past step 26/41 - creating DS keytab. I see the command that is to be run, and I can run that just fine before and after the ipa-replica-install command, and it creates the keytab. I am not sure how to proceed from here - the bug reports I see all pertain to earlier versions, and my files reflect those changes. I have also tried running this with all manner of password flags, which are correct, but still getting insufficient access rights. particulars: centos 7 3.10.0-957.1.3.el7.x86_64 ipa-server-4.6.4-10.el7.centos.x86_64 ipa-common-4.6.4-10.el7.centos.noarch ipa-server-common-4.6.4-10.el7.centos.noarch ipa-client-4.6.4-10.el7.centos.x86_64 ipa-server-dns-4.6.4-10.el7.centos.noarch ipa-client-common-4.6.4-10.el7.centos.noarch * Note: anonymized output below ipapython.ipautil: DEBUG stderr= ipalib.backend: DEBUG Created connection context.ldap2_139891568509776 ipaserver.install.service: DEBUG duration: 7 seconds ipaserver.install.service: DEBUG [26/41]: creating DS keytab [26/41]: creating DS keytab ipalib.frontend: DEBUG raw: service_add(u'ldap/<ipa-replica-host>@<domain>.NET', force=True, version=u'2.229') ipalib.frontend: DEBUG service_add(ipapython.kerberos.Principal('ldap/<ipa-replica-host>@<domain>.NET'), force=True, all=False, raw=False, version=u'2.229', no_members=False) ipalib.frontend: DEBUG raw: host_show(u'<ipa-replica-host>', version=u'2.229') ipalib.frontend: DEBUG host_show(u'<ipa-replica-host>', rights=False, all=False, raw=False, version=u'2.229', no_members=False) ipalib.install.sysrestore: DEBUG Backing up system configuration file '/etc/dirsrv/ds.keytab' ipalib.install.sysrestore: DEBUG -> Not backing up - '/etc/dirsrv/ds.keytab' doesn't exist ipapython.ipautil: DEBUG Starting external process ipapython.ipautil: DEBUG args=/usr/sbin/ipa-getkeytab -k /etc/dirsrv/ds.keytab -p ldap/<ipa-replica-host>@<domain>.NET -H ldaps://<ipa-replica-master> ipapython.ipautil: DEBUG Process finished, return code=9 ipapython.ipautil: DEBUG stdout= ipapython.ipautil: DEBUG stderr=Failed to parse result: Insufficient access rights Retrying with pre-4.0 keytab retrieval method... Failed to parse result: Insufficient access rights Failed to get keytab! Failed to get keytab ipaserver.install.service: DEBUG Traceback (most recent call last): File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 570, in start_creation run_step(full_msg, method) File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 560, in run_step method() File "/usr/lib/python2.7/site-packages/ipaserver/install/dsinstance.py", line 1308, in request_service_keytab super(DsInstance, self).request_service_keytab() File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 742, in request_service_keytab self.run_getkeytab(self.api.env.ldap_uri, self.keytab, self.principal) File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 732, in run_getkeytab ipautil.run(args, nolog=nolog) File "/usr/lib/python2.7/site-packages/ipapython/ipautil.py", line 562, in run raise CalledProcessError(p.returncode, arg_string, str(output)) CalledProcessError: Command '/usr/sbin/ipa-getkeytab -k /etc/dirsrv/ds.keytab -p ldap/<ipa-replica-host>@<domain>.NET -H ldaps://<ipa-replica-master>' returned non-zero exit status 9 ipaserver.install.service: DEBUG [error] CalledProcessError: Command '/usr/sbin/ipa-getkeytab -k /etc/dirsrv/ds.keytab -p ldap/<ipa-replica-host>@<domain>.NET -H ldaps://<ipa-replica-master>' returned non-zero exit status 9 [error] CalledProcessError: Command '/usr/sbin/ipa-getkeytab -k /etc/dirsrv/ds.keytab -p ldap/<ipa-replica-host>@<domain>.NET -H ldaps://<ipa-replica-master>' returned non-zero exit status 9 ipalib.backend: DEBUG Destroyed connection context.ldap2_139891548583120 ipalib.install.sysrestore: DEBUG Backing up system configuration file '/etc/ipa/default.conf' ipalib.install.sysrestore: DEBUG Saving Index File to '/var/lib/ipa/sysrestore/sysrestore.index' Your system may be partly configured. Run /usr/sbin/ipa-server-install --uninstall to clean up. ipapython.admintool: DEBUG File "/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 178, in execute return_value = self.run() File "/usr/lib/python2.7/site-packages/ipapython/install/cli.py", line 319, in run return cfgr.run() File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 364, in run return self.execute() File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 389, in execute for rval in self._executor(): File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 434, in __runner exc_handler(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 463, in _handle_execute_exception self._handle_exception(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 453, in _handle_exception six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 424, in __runner step() File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 421, in <lambda> step = lambda: next(self.__gen) File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from value = gen.send(prev_value) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 658, in _configure next(executor) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 434, in __runner exc_handler(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 463, in _handle_execute_exception self._handle_exception(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 521, in _handle_exception self.__parent._handle_exception(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 453, in _handle_exception six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 518, in _handle_exception super(ComponentBase, self)._handle_exception(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 453, in _handle_exception six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 424, in __runner step() File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 421, in <lambda> step = lambda: next(self.__gen) File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from value = gen.send(prev_value) File "/usr/lib/python2.7/site-packages/ipapython/install/common.py", line 65, in _install for unused in self._installer(self.parent): File "/usr/lib/python2.7/site-packages/ipaserver/install/server/__init__.py", line 622, in main replica_install(self) File "/usr/lib/python2.7/site-packages/ipaserver/install/server/replicainstall.py", line 406, in decorated func(installer) File "/usr/lib/python2.7/site-packages/ipaserver/install/server/replicainstall.py", line 1431, in install fstore=fstore) File "/usr/lib/python2.7/site-packages/ipaserver/install/server/replicainstall.py", line 113, in install_replica_ds setup_pkinit=not options.no_pkinit, File "/usr/lib/python2.7/site-packages/ipaserver/install/dsinstance.py", line 419, in create_replica self.start_creation(runtime=30) File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 570, in start_creation run_step(full_msg, method) File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 560, in run_step method() File "/usr/lib/python2.7/site-packages/ipaserver/install/dsinstance.py", line 1308, in request_service_keytab super(DsInstance, self).request_service_keytab() File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 742, in request_service_keytab self.run_getkeytab(self.api.env.ldap_uri, self.keytab, self.principal) File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 732, in run_getkeytab ipautil.run(args, nolog=nolog) File "/usr/lib/python2.7/site-packages/ipapython/ipautil.py", line 562, in run raise CalledProcessError(p.returncode, arg_string, str(output)) ipapython.admintool: DEBUG The ipa-replica-install command failed, exception: CalledProcessError: Command '/usr/sbin/ipa-getkeytab -k /etc/dirsrv/ds.keytab -p ldap/<ipa-replica-host>@<domain>.NET -H ldaps://<ipa-replica-master>' returned non-zero exit status 9 ipapython.admintool: ERROR Command '/usr/sbin/ipa-getkeytab -k /etc/dirsrv/ds.keytab -p ldap/<ipa-replica-host>@<domain>.NET -H ldaps://<ipa-replica-master>' returned non-zero exit status 9 ipapython.admintool: ERROR The ipa-replica-install command failed. See /var/log/ipareplica-install.log for more information

2 2

Problem running IPA client on IPv6 only connection
by William Muriithi 26 Jul '22

26 Jul '22

Hello, I have an IPA clients that has both IPv4 and IPv6 addresses. One of the IPA client is in the office and hence can reach the IPA server on both IPv4 and IPv6. However, the client outside the LAN can only reach the IPA server over IPv6. I was able to enroll the external client fine over IPv6 and from the logs, all clean. However, when I attempted to ssh, its not able to retreave the user from IPA. The client in the office works fine. I can also make for example LDAP queries and they work over IPv6 fine. It looks like kerberos is somehow however using IPv4. I reached this conclusion after taking a tcpdump when attempting to ssh to the server and the kerberos traffic from the client to IPA is on IPv4. What would I need to do on the IPA client for it to prefer IPv6? I am aware I could remove IPv4 address from DNS, but that would break any communication from IPv4 only systems. Any assistance would be appreaciated. [william@ansible ~]$ ssh root(a)mars.external.example.com Last login: Mon Jan 7 17:19:49 2019 from 65.98.193.94 [root@mars ~]# kinit admin kinit: Cannot contact any KDC for realm 'EXTERNAL.EXAMPLE.COM <http://external.example.com/>' while getting initial credentials [root@mars ~]# ldapsearch -x -b cn=ftp,cn=groups,cn=compat,dc=external,dc=example,dc=com | tail -n 4 result: 0 Success # numResponses: 2 # numEntries: 1 [root@mars ~]# cat /etc/resolv.conf search external.example.com nameserver 2607:4860:6000:a::5 [root@mars ~]# Regards, William

5 10

freeipa/certmonger for openvpn user certificates
by Patrick Spinler 28 Jun '22

28 Jun '22

Hi, I'm setting up an openvpn server and I'd like to use our already existing FreeIPA CA to issue user keys/certs for openvpn's use. Since our OpenVPN box is a freeipa client, I thought it'd be nice to use certmonger to issue and keep up to date these certs. Ergo, I've created a certificate profile: pat@apex-freeipa ~$ ipa certprofile-show --all OpenVPNUserCert dn: cn=OpenVPNUserCert,cn=certprofiles,cn=ca,dc=int,dc=apexmw,dc=com Profile ID: OpenVPNUserCert Profile description: OpenVPN User Certificates Store issued certificates: FALSE objectclass: ipacertprofile, top And also a CA acl. For experimentation (and working vs our test freeipa) I've left this as wide open as I can: [pat@apex-freeipa ~]$ ipa caacl-show --all OpenVPN_User_Certificate_ACL dn: ipaUniqueID=6dde33a6-7849-11e9-aa05-525400b52c7b,cn=caacls,cn=ca,dc=int,dc=apexmw,dc=com ACL name: OpenVPN_User_Certificate_ACL Enabled: TRUE CA category: all Profile category: all User category: all Host category: all Service category: all ipauniqueid: 6dde33a6-7849-11e9-aa05-525400b52c7b objectclass: ipaassociation, ipacaacl Then, on my openvpn server, I ask for a cert for use for one of my users (myself, in this case): root@apex-openvpn:~# ipa-getcert request -f /etc/openvpn/client/pat.crt -k /etc/openvpn/client/pat.key -r -N 'CN=pat,O=INT.APEXMW.COM' -K pat -g 4096 --profile OpenVPNUserCert New signing request "20190603014016" added. But, it fails due to an access err vs the 'userCertificate' attribute of my account: root@apex-openvpn:~# ipa-getcert list (...snippy snip excess...) Request ID '20190603014016': status: CA_REJECTED ca-error: Server at https://apex-freeipa.int.apexmw.com/ipa/xml denied our request, giving up: 2100 (RPC failed at server. Insufficient access: Insufficient 'write' privilege to the 'userCertificate' attribute of entry 'uid=pat,cn=users,cn=accounts,dc=int,dc=apexmw,dc=com'.). stuck: yes key pair storage: type=FILE,location='/etc/openvpn/client/pat.key' certificate: type=FILE,location='/etc/openvpn/client/pat.crt' CA: IPA issuer: subject: expires: unknown pre-save command: post-save command: track: yes auto-renew: yes If I look at the dirsrv log, here's the accesses I see for this request (trimmed off the date/time to make the lines a _little_ shorter): root@apex-freeipa slapd-INT-APEXMW-COM# grep conn=178 access | cut -d' ' -f3- conn=178 fd=114 slot=114 connection from 10.10.200.1 to 10.10.200.1 conn=178 op=0 BIND dn="" method=sasl version=3 mech=GSS-SPNEGO conn=178 op=0 RESULT err=0 tag=97 nentries=0 etime=0.0025554208 dn="fqdn=apex-openvpn.int.apexmw.com,cn=computers,cn=accounts,dc=int,dc=apexmw,dc=com" conn=178 op=1 SRCH base="cn=ipaconfig,cn=etc,dc=int,dc=apexmw,dc=com" scope=0 filter="(objectClass=*)" attrs=ALL conn=178 op=1 RESULT err=0 tag=101 nentries=1 etime=0.0001319554 conn=178 op=2 SRCH base="cn=masters,cn=ipa,cn=etc,dc=int,dc=apexmw,dc=com" scope=2 filter="(&(objectClass=ipaConfigObject)(cn=CA))" attrs=ALL conn=178 op=2 RESULT err=0 tag=101 nentries=1 etime=0.0000979573 conn=178 op=3 SRCH base="cn=masters,cn=ipa,cn=etc,dc=int,dc=apexmw,dc=com" scope=2 filter="(&(objectClass=ipaConfigObject)(cn=CA))" attrs=ALL conn=178 op=3 RESULT err=0 tag=101 nentries=1 etime=0.0000736730 conn=178 op=4 SRCH base="cn=cas,cn=ca,dc=int,dc=apexmw,dc=com" scope=2 filter="(&(objectClass=ipaca)(cn=ipa))" attrs="" conn=178 op=4 RESULT err=0 tag=101 nentries=1 etime=0.0000499142 conn=178 op=5 SRCH base="cn=ipa,cn=cas,cn=ca,dc=int,dc=apexmw,dc=com" scope=0 filter="(objectClass=*)" attrs="ipaCaId ipaCaSubjectDN cn ipaCaIssuerDN description" conn=178 op=5 RESULT err=0 tag=101 nentries=1 etime=0.0000482726 conn=178 op=6 SRCH base="cn=apex-freeipa.int.apexmw.com,cn=masters,cn=ipa,cn=etc,dc=int,dc=apexmw,dc=com" scope=2 filter="(&(objectClass=ipaConfigObject)(ipaConfigString=enabledService)(cn=CA))" attrs=ALL conn=178 op=6 RESULT err=0 tag=101 nentries=1 etime=0.0000950646 notes=U conn=178 op=7 SRCH base="cn=accounts,dc=int,dc=apexmw,dc=com" scope=2 filter="(&(objectClass=krbprincipalaux)(krbPrincipalName=pat(a)INT.APEXMW.COM))" attrs=ALL conn=178 op=7 RESULT err=0 tag=101 nentries=1 etime=0.0002747849 conn=178 op=8 EXT oid="1.3.6.1.4.1.4203.1.11.3" name="whoami-plugin" conn=178 op=8 RESULT err=0 tag=120 nentries=0 etime=0.0000135034 conn=178 op=9 SRCH base="cn=request certificate ignore caacl,cn=virtual operations,cn=etc,dc=int,dc=apexmw,dc=com" scope=0 filter="(objectClass=*)" attrs="objectClass" conn=178 op=9 RESULT err=0 tag=101 nentries=1 etime=0.0000932668 - entryLevelRights: none conn=178 op=10 SRCH base="uid=pat,cn=users,cn=accounts,dc=int,dc=apexmw,dc=com" scope=0 filter="(objectClass=*)" attrs="distinguishedName" conn=178 op=10 RESULT err=0 tag=101 nentries=1 etime=0.0000640289 conn=178 op=11 SRCH base="uid=pat,cn=users,cn=accounts,dc=int,dc=apexmw,dc=com" scope=0 filter="(objectClass=*)" attrs="telephoneNumber ipaSshPubKey uid krbCanonicalName ipatokenRadiusUserName ipaUserAuthType krbPrincipalExpiration homeDirectory nsAccountLock usercertificate;binary title loginShell uidNumber mail ipaCertMapData memberOf memberofindirect krbPrincipalName givenName gidNumber sn ou userClass ipatokenRadiusConfigLink" conn=178 op=11 RESULT err=0 tag=101 nentries=1 etime=0.0001401737 conn=178 op=12 SRCH base="dc=int,dc=apexmw,dc=com" scope=2 filter="(|(member=uid=pat,cn=users,cn=accounts,dc=int,dc=apexmw,dc=com)(memberUser=uid=pat,cn=users,cn=accounts,dc=int,dc=apexmw,dc=com)(memberHost=uid=pat,cn=users,cn=accounts,dc=int,dc=apexmw,dc=com))" attrs="" conn=178 op=12 RESULT err=0 tag=101 nentries=7 etime=0.0001492344 notes=P pr_idx=0 pr_cookie=-1 conn=178 op=13 SRCH base="uid=pat,cn=users,cn=accounts,dc=int,dc=apexmw,dc=com" scope=0 filter="(userPassword=*)" attrs="userPassword" conn=178 op=13 RESULT err=0 tag=101 nentries=1 etime=0.0000524838 conn=178 op=14 SRCH base="uid=pat,cn=users,cn=accounts,dc=int,dc=apexmw,dc=com" scope=0 filter="(krbPrincipalKey=*)" attrs="krbPrincipalKey" conn=178 op=14 RESULT err=0 tag=101 nentries=1 etime=0.0000597589 conn=178 op=15 SRCH base="ipaUniqueID=80b23b30-6a0c-11e9-baa3-525400b52c7b,cn=sudorules,cn=sudo,dc=int,dc=apexmw,dc=com" scope=0 filter="(objectClass=*)" attrs="cn" conn=178 op=15 RESULT err=0 tag=101 nentries=1 etime=0.0000379744 conn=178 op=16 SRCH base="ipaUniqueID=5fb3a640-705a-11e9-aa05-525400b52c7b,cn=hbac,dc=int,dc=apexmw,dc=com" scope=0 filter="(objectClass=*)" attrs="cn" conn=178 op=16 RESULT err=0 tag=101 nentries=1 etime=0.0000337904 conn=178 op=17 SRCH base="cn=caacls,cn=ca,dc=int,dc=apexmw,dc=com" scope=1 filter="(&(objectClass=ipaassociation)(objectClass=ipacaacl))" attrs="serviceCategory cn ipaMemberCertProfile ipaMemberCa ipaCertProfileCategory memberUser userCategory hostCategory memberHost ipaEnabledFlag ipaCaCategory memberService description" conn=178 op=17 RESULT err=0 tag=101 nentries=2 etime=0.0001647058 conn=178 op=18 EXT oid="1.3.6.1.4.1.4203.1.11.3" name="whoami-plugin" conn=178 op=18 RESULT err=0 tag=120 nentries=0 etime=0.0000138321 conn=178 op=19 SRCH base="uid=pat,cn=users,cn=accounts,dc=int,dc=apexmw,dc=com" scope=0 filter="(objectClass=*)" attrs="userCertificate" conn=178 op=19 RESULT err=0 tag=101 nentries=1 etime=0.0001475052 - entryLevelRights: none conn=178 op=20 UNBIND conn=178 op=20 fd=114 closed - U1 To begin with, I note that this session does a BIND with 'dn=""', right at the beginning, it's essentially an anonymous bind, yah? That operation near the end, here: op=17 SRCH base="cn=caacls,cn=ca,dc=int,dc=apexmw,dc=com" scope=1 filter="(&(objectClass=ipaassociation)(objectClass=ipacaacl))" seems like it might be kinda key. and indeed, if I attempt to run this by hand as an anonymous bind, I get no results: root@apex-freeipa slapd-INT-APEXMW-COM# ldapsearch -x -h localhost -b dc=int,dc=apexmw,dc=com -s sub "(|(objectClass=ipaassociation)(objectClass=ipacaacl))" # extended LDIF # # LDAPv3 # base <dc=int,dc=apexmw,dc=com> with scope subtree # filter: (|(objectClass=ipaassociation)(objectClass=ipacaacl)) # requesting: ALL # # search result search: 2 result: 0 Success # numResponses: 1 It's only if I run this as an _authenticated_ bind, that I can find my ACL: root@apex-freeipa slapd-INT-APEXMW-COM# ldapsearch -x -D "cn=Directory Manager" -W -h localhost -b dc=int,dc=apexmw,dc=com -s sub "(&(objectClass=ipaassociation)(objectClass=ipacaacl))" cn Enter LDAP Password: # extended LDIF # # LDAPv3 # base <dc=int,dc=apexmw,dc=com> with scope subtree # filter: (&(objectClass=ipaassociation)(objectClass=ipacaacl)) # requesting: cn # # c98b740c-6903-11e9-ad1b-525400b52c7b, caacls, ca, int.apexmw.com dn: ipaUniqueID=c98b740c-6903-11e9-ad1b-525400b52c7b,cn=caacls,cn=ca,dc=int,dc =apexmw,dc=com cn: hosts_services_caIPAserviceCert # 6dde33a6-7849-11e9-aa05-525400b52c7b, caacls, ca, int.apexmw.com dn: ipaUniqueID=6dde33a6-7849-11e9-aa05-525400b52c7b,cn=caacls,cn=ca,dc=int,dc =apexmw,dc=com cn: OpenVPN_User_Certificate_ACL # search result search: 2 result: 0 Success # numResponses: 3 # numEntries: 2 Is this (using certmonger to auto-issue signed certs/keys for my openvpn users) going to be essentially impossible to do, here? Do I need to go a more traditional route of creating a seperate keystore/certdb, issuing a CSR, and feeding that to FreeIPA to sign? Any advice appreciated, and thanks in advance, -- Pat

4 6

Broken ipa replica
by Giulio Casella 09 May '22

09 May '22

Hi everyone, I'm stuck with a broken replica. I had a setup with two ipa server in replica (ipa-server-4.6.4 on CentOS 7.6), let's say "idc01" and "idc02". Due to heavy load idc01 crashed many times, and was not working anymore. So I tried to redo the replica again. At first I tried to "ipa-replica-manage re-initialize", with no success. Now I'm trying to redo from scratch the replica setup: on idc02 I removed the segments (ipa topologysegment-del, for both ca and domain suffix), on idc01 I removed everything (ipa-server-install --uninstall), then I joined domain (ipa-client-install), and everything is working so far. When doing "ipa-replica-install" on idc01 I get: [...] [28/41]: setting up initial replication Starting replication, please wait until this has completed. Update in progress, 22 seconds elapsed [ldap://idc02.my.dom.ain:389] reports: Update failed! Status: [Error (-11) connection error: Unknown connection error (-11) - Total update aborted] And on idc02 (the working server), in /var/log/dirsrv/slapd-MY-DOM-AIN/errors I find lines stating: [20/Mar/2019:09:28:06.545187923 +0100] - INFO - NSMMReplicationPlugin - repl5_tot_run - Beginning total update of replica "agmt="cn=meToidc01.my.dom.ain" (idc01:389)". [20/Mar/2019:09:28:26.528046160 +0100] - ERR - NSMMReplicationPlugin - perform_operation - agmt="cn=meToidc01.my.dom.ain" (idc01:389): Failed to send extended operation: LDAP error -1 (Can't contact LDAP server) [20/Mar/2019:09:28:26.530763939 +0100] - ERR - NSMMReplicationPlugin - repl5_tot_log_operation_failure - agmt="cn=meToidc01.my.dom.ain" (idc01:389): Received error -1 (Can't contact LDAP server): for total update operation [20/Mar/2019:09:28:26.532678072 +0100] - ERR - NSMMReplicationPlugin - release_replica - agmt="cn=meToidc01.my.dom.ain" (idc01:389): Unable to send endReplication extended operation (Can't contact LDAP server) [20/Mar/2019:09:28:26.534307539 +0100] - ERR - NSMMReplicationPlugin - repl5_tot_run - Total update failed for replica "agmt="cn=meToidc01.my.dom.ain" (idc01:389)", error (-11) [20/Mar/2019:09:28:26.561763168 +0100] - INFO - NSMMReplicationPlugin - bind_and_check_pwp - agmt="cn=meToidc01.my.dom.ain" (idc01:389): Replication bind with GSSAPI auth resumed [20/Mar/2019:09:28:26.582389258 +0100] - WARN - NSMMReplicationPlugin - repl5_inc_run - agmt="cn=meToidc01.my.dom.ain" (idc01:389): The remote replica has a different database generation ID than the local database. You may have to reinitialize the remote replica, or the local replica. It seems that idc02 remembers something about the old replica. Any hint? Thank you in advance, Giulio

5 10

IPA CA allow CSR SAN names in external domains
by Steve Dainard 15 Mar '22

15 Mar '22

Hello I have a RHEL7 IPA server installed as a subordinate CA. I'd like to be able to add SAN's for a different dns domain than exists in the IPA realm. The dns for 'otherdomain.com' is handled by active directory which my IPA server has a cross-forest trust with. ie: host: client1.ipadomain.com certificate: CN = client1.ipadomain.com, SAN = client1.ipadomain.com, servicename.otherdomain.com When I try to submit this CSR with 'ipa-getcert request' the IPA server denies with: "The service principal for subject alt name servicename.otherdomain.com in certificate request does not exist" It seems that the default CAACL enforces a profile named 'caIPAserviceCert', but I'm having some trouble determining what can be modified (or cloned and changed in a new profile) that would allow the CA to sign a CSR that contains *.ipadomain.com and *.otherdomain.com in the SAN. This is the only section in the profile that contains SAN: policyset.serverCertSet.12.constraint.class_id=noConstraintImpl policyset.serverCertSet.12.constraint.name=No Constraint policyset.serverCertSet.12.default.class_id=commonNameToSANDefaultImpl policyset.serverCertSet.12.default.name=Copy Common Name to Subject Alternative Name Thanks, Steve

3 3

freeipa with sudo and 2FA (OTP)
by John Ratliff 31 Jan '22

31 Jan '22

I'm trying to setup freeipa with OTP. I created a TOTP under my user in freeipa and updated my user to use 2FA (password + OTP). When I try to do sudo, it only asks for my password and it fails every time (presumably because it isn't getting the OTP first). I didn't see anything useful in the sss_sudo logs, even after adding debug_level = 6 in the config. What can I do to further troubleshoot this? Thanks.

4 6

User in AD not found by IPA
by Marc Boorshtein 15 Oct '21

15 Oct '21

We added a new account to AD that has a domain trust with FreeIPA. This one user is having an issue where IPA can't find him. The user is in the same OU as other users that work fine. The user is unlocked (userAccountControl is 512) and the userprincipalname is set. When I try to add the user to an id view or an external group IPA gives me the error "trusted domain object not found" . Not really sure where to look next to figure out what's wrong. We see the user when we make LDAP calls to AD. Thanks Marc

4 14

Cannot add externally-signed IPA CA certificate
by Dmitry Perets 27 Aug '21

27 Aug '21

Hi, I am trying to configure FreeIPA as a SubCA, and the "RootCA" is self-made with openssl. So I've signed the FreeIPA's request with my self-signed "root ca" certificate, but it looks like FreeIPA doesn't like it: ipa-server-install --external-cert-file=/root/rootca/rootcacert.pem --external-cert-file=/root/rootca/certs/ipacert.pem <...skipped...> ipa.ipapython.install.cli.install_tool(CompatServerMasterInstall): ERROR CA certificate CN=RootCA,OU=PRJ,O=COMPANY,L=Bonn,C=DE in /root/rootca/rootcacert.pem, /root/rootca/certs/ipacert.pem is not valid: not a CA certificate ipa.ipapython.install.cli.install_tool(CompatServerMasterInstall): ERROR The ipa-server-install command failed. See /var/log/ipaserver-install.log for more information The subj above is my self-made root CA cert, so it looks like something is missing in it. But what...? Here is it below, it has the "Basic Constraint" set with CA:TRUE... What else is required, so that FreeIPA accepts it as a root CA? Should I add it somewhere first, before running the ipa-server-install? [root@ipa ~]# openssl x509 -text -noout -in /root/rootca/rootcacert.pem Certificate: Data: Version: 3 (0x2) Serial Number: 0 (0x0) Signature Algorithm: sha256WithRSAEncryption Issuer: C=DE, L=Bonn, O=COMPANY, OU=PRJ, CN=RootCA Validity Not Before: Oct 24 11:43:13 2018 GMT Not After : Oct 21 11:43:13 2028 GMT Subject: C=DE, L=Bonn, O=COMPANY, OU=PRJ, CN=RootCA Subject Public Key Info: Public Key Algorithm: rsaEncryption Public-Key: (4096 bit) Modulus: <...skipped...> Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Subject Key Identifier: B3:18:3B:CF:29:D2:A5:D4:AE:94:A5:42:65:A2:D8:12:7C:92:78:81 X509v3 Authority Key Identifier: keyid:B3:18:3B:CF:29:D2:A5:D4:AE:94:A5:42:65:A2:D8:12:7C:92:78:81 X509v3 Basic Constraints: CA:TRUE Signature Algorithm: sha256WithRSAEncryption <...skipped...> Thanks!!

2 2

Unable to install ipa client centos 7.5.1804 (Core)
by William Graboyes 17 Feb '21

17 Feb '21

Hello List, I have been searching around for the day and have found an answer for the error I am getting when I am trying to install the client on a brand new install: Version: ipa-client-4.5.4-10.el7.centos.3.x86_64 ipa-client-common-4.5.4-10.el7.centos.3.noarch The error is below (run as root, not via sudo): ipa-client-install Traceback (most recent call last): File "/sbin/ipa-client-install", line 22, in <module> from ipaclient.install import ipa_client_install File "/usr/lib/python2.7/site-packages/ipaclient/install/ipa_client_install.py", line 5, in <module> from ipaclient.install import client File "/usr/lib/python2.7/site-packages/ipaclient/install/client.py", line 34, in <module> from ipalib import api, errors, x509 File "/usr/lib/python2.7/site-packages/ipalib/x509.py", line 45, in <module> from pyasn1_modules import rfc2315, rfc2459 File "/usr/lib/python2.7/site-packages/pyasn1_modules/rfc2315.py", line 67, in <module> class DigestedData(univ.Sequence): File "/usr/lib/python2.7/site-packages/pyasn1_modules/rfc2315.py", line 72, in DigestedData namedtype.NamedType('digest', Digest) File "/usr/lib/python2.7/site-packages/pyasn1/type/namedtype.py", line 115, in __init__ self.__ambiguousTypes = 'terminal' not in kwargs and self.__computeAmbiguousTypes() or {} File "/usr/lib/python2.7/site-packages/pyasn1/type/namedtype.py", line 232, in __computeAmbiguousTypes ambigiousTypes[idx] = NamedTypes(*partialAmbigiousTypes, **dict(terminal=True)) File "/usr/lib/python2.7/site-packages/pyasn1/type/namedtype.py", line 114, in __init__ self.__tagToPosMap = self.__computeTagToPosMap() File "/usr/lib/python2.7/site-packages/pyasn1/type/namedtype.py", line 205, in __computeTagToPosMap for _tagSet in tagMap.presentTypes: AttributeError: 'property' object has no attribute 'presentTypes' Any help would be greatly appreciated. Thanks, Bill G.

3 2

FreeIPA, OSX, DockerDesktop
by james liu 15 Oct '20

15 Oct '20

PREP ==== git clone https://github.com/freeipa/freeipa-container.git cd freeipa-container mkdir /tmp/ipa-data docker run --name freeipa-server-container -ti -h ipa.example.test --read-only -v /tmp/ip-data :/data:Z freeipa-server --sysctl net.ipv6.conf.all.disable_ipv6=1 RESULT ====== tar: etc/sysconfig/selinux: Cannot utime: No such file or directory tar: Exiting with failure status due to previous errors QUESTION ========= I'm running DockerDesktop 2.0.4, OSX 10.13.6. Is there a set of commands that will work? Thanks

4 6

ipa-replica-install failing
by Mitchell Smith 25 Aug '20

25 Aug '20

Hi list, I wanted to repost this issue with a more appropriate subject line, in case anyone has come across this issue before and has a work around. To provide some context, I have two FreeIPA instances running FreeIPA 4.3.1 on Ubuntu 16.04 LTS. I want to migrate to FreeIPA 4.5.4 running on CentOS 7. I have a way to migrate by dumping all the users out with ldapsearch and adding them to the new instance with ldapadd but it is a bit messy and will result in all users having to reset their password, as it won't let me add in already encrypted passwords. My initial thought was to add the new instance as a replica and then eventually retire the old one. I ran in to some problems with the ‘ipa-replica-install’ command though. I was able to join as a client no problem, but when I went to run ‘ipa-replica-install’ it failed while configuring the directory server component. [25/42]: restarting directory server [26/42]: creating DS keytab [27/42]: ignore time skew for initial replication [28/42]: setting up initial replication [error] DatabaseError: Server is unwilling to perform: modification of attribute nsds5replicareleasetimeout is not allowed in replica entry Your system may be partly configured. Run /usr/sbin/ipa-server-install --uninstall to clean up. I thought this might have something to do with differences between 4.3.1 and 4.5.4 but I wasn’t entirely sure. If there is a work around for this issue, it would be a significantly easier transition to the new FreeIPA instance. Cheers, Mitch

3 4

kinit -n asking for password on clients
by John Ratliff 13 Jul '20

13 Jul '20

When trying to do pkinit, if I do kinit -n on one of the IdM servers, it works fine. If I try on a client machine, it asks me for the password for WELLKNOWN/ANONYMOUS@REALM. I have the pkinit_anchors setup for the realm. As I'm trying to do anonymous pkinit, I think I don't need a client certificate. On the server, I get this: $ KRB5_TRACE="/dev/stderr" kinit -n [13061] 1518402857.924212: Getting initial credentials for WELLKNOWN/ANONYMOUS(a)IDM.EXAMPLE.COM [13061] 1518402857.929673: Sending request (200 bytes) to IDM.EXAMPLE.COM [13061] 1518402857.931830: Initiating TCP connection to stream 10.77.9.101:88 [13061] 1518402857.932241: Sending TCP request to stream 10.77.9.101:88 [13061] 1518402857.939162: Received answer (359 bytes) from stream 10.77.9.101:88 [13061] 1518402857.939180: Terminating TCP connection to stream 10.77.9.101:88 [13061] 1518402857.939284: Response was from master KDC [13061] 1518402857.939380: Received error from KDC: -1765328359/Additional pre-authentication required [13061] 1518402857.939474: Processing preauth types: 16, 15, 14, 136, 19, 147, 2, 133 [13061] 1518402857.939499: Selected etype info: etype aes256-cts, salt "IDM.EXAMPLE.COMWELLKNOWNANONYMOUS", params "" [13061] 1518402857.939509: Received cookie: MIT [13061] 1518402857.939563: Preauth module pkinit (147) (info) returned: 0/Success [13061] 1518402857.940352: PKINIT client computed kdc-req-body checksum 9/D98A0144E7E4ACC66B63EBCA98379AB9F055D143 [13061] 1518402857.940369: PKINIT client making DH request [13061] 1518402858.935: Preauth module pkinit (16) (real) returned: 0/Success [13061] 1518402858.956: Produced preauth for next request: 133, 16 [13061] 1518402858.994: Sending request (1408 bytes) to IDM.EXAMPLE.COM [13061] 1518402858.1091: Initiating TCP connection to stream 10.77.9.101:88 [13061] 1518402858.1187: Sending TCP request to stream 10.77.9.101:88 [13061] 1518402858.43063: Received answer (2880 bytes) from stream 10.77.9.101:88 [13061] 1518402858.43088: Terminating TCP connection to stream 10.77.9.101:88 [13061] 1518402858.43198: Response was from master KDC [13061] 1518402858.43258: Processing preauth types: 17, 19, 147 [13061] 1518402858.43273: Selected etype info: etype aes256-cts, salt "IDM.EXAMPLE.COMWELLKNOWNANONYMOUS", params "" [13061] 1518402858.43300: Preauth module pkinit (147) (info) returned: 0/Success [13061] 1518402858.44150: PKINIT client verified DH reply [13061] 1518402858.44189: PKINIT client found id-pkinit-san in KDC cert: krbtgt/IDM.EXAMPLE.COM(a)IDM.EXAMPLE.COM [13061] 1518402858.44199: PKINIT client matched KDC principal krbtgt/IDM.EXAMPLE.COM(a)IDM.EXAMPLE.COM against id-pkinit-san; no EKU check required [13061] 1518402858.62345: PKINIT client used KDF 2B06010502030602 to compute reply key aes256-cts/00E0 [13061] 1518402858.62395: Preauth module pkinit (17) (real) returned: 0/Success [13061] 1518402858.62402: Produced preauth for next request: (empty) [13061] 1518402858.62414: AS key determined by preauth: aes256-cts/00E0 [13061] 1518402858.62547: Decrypted AS reply; session key is: aes256-cts/96F0 [13061] 1518402858.62589: FAST negotiation: available [13061] 1518402858.62692: Initializing KEYRING:persistent:760400007:krb_ccache_f3PFEy1 with default princ WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS [13061] 1518402858.62770: Storing WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS -> krbtgt/IDM.EXAMPLE.COM(a)IDM.EXAMPLE.COM in KEYRING:persistent:760400007:krb_ccache_f3PFEy1 [13061] 1518402858.62846: Storing config in KEYRING:persistent:760400007:krb_ccache_f3PFEy1 for krbtgt/IDM.EXAMPLE.COM(a)IDM.EXAMPLE.COM: fast_avail: yes [13061] 1518402858.62878: Storing WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS -> krb5_ccache_conf_data/fast_avail/krbtgt\/IDM.EXAMPLE.COM\@IDM.EXAMPLE.COM@X-CACHECONF: in KEYRING:persistent:760400007:krb_ccache_f3PFEy1 [13061] 1518402858.62933: Storing config in KEYRING:persistent:760400007:krb_ccache_f3PFEy1 for krbtgt/IDM.EXAMPLE.COM(a)IDM.EXAMPLE.COM: pa_type: 16 [13061] 1518402858.62954: Storing WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS -> krb5_ccache_conf_data/pa_type/krbtgt\/IDM.EXAMPLE.COM\@IDM.EXAMPLE.COM@X-CACHECONF: in KEYRING:persistent:760400007:krb_ccache_f3PFEy1 But on the client, I get this: $ KRB5_TRACE="/dev/stderr" kinit -n [2941] 1518402820.155827: Getting initial credentials for WELLKNOWN/ANONYMOUS(a)IDM.EXAMPLE.COM [2941] 1518402820.156298: Sending request (200 bytes) to IDM.EXAMPLE.COM [2941] 1518402820.158723: Resolving hostname paine.example.com. [2941] 1518402820.159975: Resolving hostname phantom.example.com. [2941] 1518402820.160757: Resolving hostname paine.example.com. [2941] 1518402820.161411: Initiating TCP connection to stream 204.89.253.101:88 [2941] 1518402820.162065: Sending TCP request to stream 204.89.253.101:88 [2941] 1518402820.168495: Received answer (359 bytes) from stream 204.89.253.101:88 [2941] 1518402820.168532: Terminating TCP connection to stream 204.89.253.101:88 [2941] 1518402820.169917: Response was from master KDC [2941] 1518402820.169974: Received error from KDC: -1765328359/Additional pre-authentication required [2941] 1518402820.170029: Processing preauth types: 16, 15, 14, 136, 19, 147, 2, 133 [2941] 1518402820.170051: Selected etype info: etype aes256-cts, salt "IDM.EXAMPLE.COMWELLKNOWNANONYMOUS", params "" [2941] 1518402820.170062: Received cookie: MIT Password for WELLKNOWN/ANONYMOUS(a)IDM.EXAMPLE.COM: [2941] 1518402833.34612: Preauth module encrypted_timestamp (2) (real) returned: -1765328252/Password read interrupted kinit: Pre-authentication failed: Password read interrupted while getting initial credentials Suggestions on what I'm missing? Thanks.

3 3

automember hostgroup by account?
by Amos 14 Jun '20

14 Jun '20

Is it possible to have an automember rule to add a host to a hostgroup based on the account used with ipa-install-client? Amos

3 6

IPA and legacy systems
by Ronald Wimmer 27 May '20

27 May '20

What would be a good solution to add systems where the FQDN cannot be changed? Would it make sense to add a second DNS A Record in the IPA domain for each of these systems? Is there any experience on how to deal with such a situation? Thanks a lot in advance! Cheers, Ronald

5 17

Force users to create OTP token on first login
by Russ Long 12 Oct '19

12 Oct '19

Is there a way to put a policy or something in place, so when users login for the first time, they are forced to create an OTP Token? We need to force OTP into the system as well as the servers that authenticate with it. Thanks!

1 2

IPA's Certs - country, state, organization ?
by lejeczek 11 Oct '19

11 Oct '19

hi guys, how to manage those? Why are these missing in "standard" IPA installations and how to get them in? many thanks, L.

2 9

Re: CA Master Confusion
by Florence Blanc-Renaud 04 Oct '19

04 Oct '19

On 8/6/19 9:21 PM, Auerbach, Steven via FreeIPA-users wrote: > As I work through understanding the current state of my CA mastering in this realm I am getting results I do not understand from these ipa commands (on the v4.6.4 server) and from the ldapsearch commands (on the v3.0.0 server): > On the v4.6.4 replica (ipa<3>): > $ sudo ipa config-show |grep 'CA renewal master' > [sudo] password for <user>: > $ > $ > > On the v3.0.0 (ipa<1>): > $ sudo ldapsearch -H ldap://$HOSTNAME -D 'cn=Directory Manager' -W -b 'cn=masters,cn=ipa,cn=etc,dc=fbog,dc=local' '(&(cn=CA)(ipaConfigString=caRenewalMaster))' dn > [sudo] password for <user>: > Enter LDAP Password: > # extended LDIF > # > # LDAPv3 > # base <cn=masters,cn=ipa,cn=etc,dc=<mydomain>,dc=local> with scope subtree > # filter: (&(cn=CA)(ipaConfigString=caRenewalMaster)) > # requesting: dn > # > > # search result > search: 2 > result: 0 Success > > # numResponses: 1 > Hi, the ipaConfigString=caRenewalMaster attribute was introduced in freeIPA 4.0 (please see [1] Howto/Promote_CA_to_Renewal_and_CRL_Master), hence I am not surprised that the search does not return anything. When the 3.0 server was installed, the attribute did not exist yet. When the 4.x replica was installed, the attribute was not added since the new replica wasn't CA master. As the attribute is not set at all, the ipa config-show command (internally using the same ldapsearch you did) is unable to find a CA master. If you want to move the CA master role to ipa3, just follow the steps in [1], making sure to apply the steps for the corresponding IPA version. Also please note that we do not recommend using versions 3.x and 4.x together over a long period of time. This is completely OK when you want to migrate but once you have ensured all the services are properly working, the 3.x master should be decommissioned. Please see [2]. HTH, flo [1] https://www.freeipa.org/page/Howto/Promote_CA_to_Renewal_and_CRL_Master [2] https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/ht… > > > Neither tells me anything. Is it possible that the original installation never had a CA master at all? This seems odd considering when I look for CA Master(s), on the v4.6.4 (ipa<3>) tells me: > > $ sudo ipa server-role-find --role 'CA server' > [sudo] password for <user>: > ---------------------- > 3 server roles matched > ---------------------- > Server name: ipa<2>.mydomain.local > Role name: CA server > Role status: absent > > Server name: ipa<1>.mydomain.local > Role name: CA server > Role status: enabled > > Server name: ipa<3>.mydomain.local > Role name: CA server > Role status: absent > ---------------------------- > Number of entries returned 3 > ---------------------------- > > And on the v3.0.0 (ipa<1>) I get: > > $ sudo ldapsearch -H ldap://$HOSTNAME -D 'cn=Directory Manager' -W -b 'cn=masters,cn=ipa,cn=etc,dc=<mydomain>,dc=local' '(&(cn=CA)(ipaConfigString=caServer))' dn > Enter LDAP Password: > # extended LDIF > # > # LDAPv3 > # base <cn=masters,cn=ipa,cn=etc,dc=fbog,dc=local> with scope subtree > # filter: (&(cn=CA)(ipaConfigString=caServer)) > # requesting: dn > # > > # search result > search: 2 > result: 0 Success > > # numResponses: 1 > > I know I am missing something basic and fundamental here. Is there a CA Master or not? If not, would I want to just enable the CA Master on the newest server (ipa<3>)? > > The way forward is not clear. > -Steven Auerbach > _______________________________________________ > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org > To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org > Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost… >

2 1

ipa vault: internal error, "Invalid Credential"
by Dmitry Perets 02 Oct '19

02 Oct '19

Hi, Pretty much any vault-related calls in one of my environments result in the internal error, although the call seems to (partially) succeed. For example: # ipa vault-add test --type standard ipa: ERROR: an internal error has occurred But the vault is created: # ipa vault-find --------------- 1 vault matched --------------- Vault name: test Type: standard Vault user: admin ---------------------------- Number of entries returned 1 ---------------------------- I'll get the same erorr if I try "ipa vault-del", "vault-archive" or "vault-retrieve". At the same time, the following is written in /var/log/messages: Sep 19 23:54:39 t-idm-ber800-1 server: Invalid Credential. Sep 19 23:54:39 t-idm-ber800-1 server: at com.netscape.cmscore.authentication.CertUserDBAuthentication.authenticate(CertUserDBAuthentication.java:174) Sep 19 23:54:39 t-idm-ber800-1 server: at com.netscape.cms.realm.PKIRealm.authenticate(PKIRealm.java:112) Sep 19 23:54:39 t-idm-ber800-1 server: at com.netscape.cms.tomcat.ProxyRealm.authenticate(ProxyRealm.java:85) Sep 19 23:54:39 t-idm-ber800-1 server: at org.apache.catalina.authenticator.SSLAuthenticator.authenticate(SSLAuthenticator.java:114) Sep 19 23:54:39 t-idm-ber800-1 server: at com.netscape.cms.tomcat.SSLAuthenticatorWithFallback.doSubAuthenticate(SSLAuthenticatorWithFallback.java:47) Sep 19 23:54:39 t-idm-ber800-1 server: at com.netscape.cms.tomcat.AbstractPKIAuthenticator.doAuthenticate(AbstractPKIAuthenticator.java:89) Sep 19 23:54:39 t-idm-ber800-1 server: at com.netscape.cms.tomcat.SSLAuthenticatorWithFallback.authenticate(SSLAuthenticatorWithFallback.java:59) Sep 19 23:54:39 t-idm-ber800-1 server: at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:578) Sep 19 23:54:39 t-idm-ber800-1 server: at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:169) Sep 19 23:54:39 t-idm-ber800-1 server: at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:103) Sep 19 23:54:39 t-idm-ber800-1 server: at org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:962) Sep 19 23:54:39 t-idm-ber800-1 server: at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:116) Sep 19 23:54:39 t-idm-ber800-1 server: at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:445) Sep 19 23:54:39 t-idm-ber800-1 server: at org.apache.coyote.ajp.AjpProcessor.process(AjpProcessor.java:190) Sep 19 23:54:39 t-idm-ber800-1 server: at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:637) Sep 19 23:54:39 t-idm-ber800-1 server: at org.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:316) Sep 19 23:54:39 t-idm-ber800-1 server: at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) Sep 19 23:54:39 t-idm-ber800-1 server: at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) Sep 19 23:54:39 t-idm-ber800-1 server: at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) Sep 19 23:54:39 t-idm-ber800-1 server: at java.lang.Thread.run(Thread.java:748) Any idea what could go wrong here....? Thanks. Info: ipa-server 4.6.4 on RHEL 7.6, and I am running these commands from the IPA server itself, on which CA and KRA are installed (in fact, it's the only active CA/KRA master in that environment). --- Regards, Dmitry Perets

3 5

Re: Enabling more FreeIPA CA servers
by Fraser Tweedale 02 Oct '19

02 Oct '19

Hi Stuart, Adding the freeipa-users@ mailing list for visibility. I'd have to work through your scenario to work out why it fails. But it may be some time before I get around to that. I think your idea to first try creating a CA replica on F28 before moving forward to F30 is a sensible thing to try. One question though: are you on Domain Level 0 or 1? (`ipa domainlevel-get`). Cheers, Fraser On Thu, Sep 26, 2019 at 07:35:58PM +0100, Stuart McRobert wrote: > Dear Fraser, > > I've read through lots of posts but I am uncertain about the best way > forward and wonder if I could seek your guidance? I just don't want to break > things. > > Currently we have three freeipa servers (1-3) on Fedora 26 (clearly need > updating) with ipa VERSION: 4.4.4, API_VERSION: 2.215 and one new Fedora 30 > server (#4) which I just started to add with VERSION: 4.8.1, API_VERSION: > 2.233. > > The reason for adding a new server before updating the others is the web > interface warning: > > Warning: Only One CA Server Detected > It is strongly recommended to keep the CA services installed on more than > one server > > which I fully understand is not good, but it doesn't offer to just fix it! > > I suspect server #4 may be too new, failing with both > > ipa-replica-install --setup-ca > > and > > ipa-ca-install > > in a very similar way, e.g. > > 2019-09-26T16:18:15Z ERROR Unable to log in as uid=admin-freeipa04.services.nsa.stats.ox.ac.uk,ou=people,o=ipaca on ldap://freeipa01.services.nsa.stats.ox.ac.uk:389 > 2019-09-26T16:18:15Z DEBUG Traceback (most recent call last): > File "/usr/lib/python3.7/site-packages/ipaserver/install/service.py", line 603, in start_creation > run_step(full_msg, method) > File "/usr/lib/python3.7/site-packages/ipaserver/install/service.py", line 589, in run_step > method() > File "/usr/lib/python3.7/site-packages/ipaserver/install/dogtaginstance.py", line 503, in setup_admin > self.admin_dn, master_conn > ipalib.errors.NotFound: uid=admin-freeipa04.services.nsa.stats.ox.ac.uk,ou=people,o=ipaca did not replicate to ldap://freeipa01.services.nsa.stats.ox.ac.uk:389 > > 2019-09-26T16:18:15Z DEBUG [error] NotFound: uid=admin-freeipa04.services.nsa.stats.ox.ac.uk,ou=people,o=ipaca did not replicate to ldap://freeipa01.services.nsa.stats.ox.ac.uk:389 > > > which I think others have also run into. > > Next thought was to confirm what we had: > > [root@freeipa01 ~]# ipa server-find > --------------------- > 4 IPA servers matched > --------------------- > Server name: freeipa01.services.nsa.stats.ox.ac.uk F26 > > Server name: freeipa02.services.nsa.stats.ox.ac.uk F26 > > Server name: freeipa03.services.nsa.stats.ox.ac.uk F26 > > Server name: freeipa04.services.nsa.stats.ox.ac.uk F30 > ---------------------------- > Number of entries returned 4 > ---------------------------- > [root@freeipa01 ~]# ipa server-role-find --role "CA server" > ---------------------- > 4 server roles matched > ---------------------- > Server name: freeipa01.services.nsa.stats.ox.ac.uk > Role name: CA server > Role status: enabled > > Server name: freeipa02.services.nsa.stats.ox.ac.uk > Role name: CA server > Role status: absent > > Server name: freeipa03.services.nsa.stats.ox.ac.uk > Role name: CA server > Role status: absent > > Server name: freeipa04.services.nsa.stats.ox.ac.uk > Role name: CA server > Role status: absent > ---------------------------- > Number of entries returned 4 > ---------------------------- > > > and then find out how to change the "Role status:" to enabled, starting on > freeipa02 but I am not sure how to achieve this, e.g. > > > [root@freeipa02 ~]# ipa-ca-install > CA is already installed on this host. > > true but doesn't really help. Sorry if this is very easy to do with a > command I have totally missed. > > Currently I know if freeipa01 fails, client logins also fail, and I assume > this is because it is the only CA server enabled. > > Work plan: > > 1. Enable more CA servers > > 2. Update Fedora 26 to 30, perhaps via 28 first if advised not to jump too > far at once, probably updating servers #2, then #3 and finally #1. > > 3. Add more servers for resiliency > > > Any idea how to get more CA servers enabled or any other suggestions? > > Many thanks > > Best wishes > > Stuart

3 4

Re: Enabling more FreeIPA CA servers
by Fraser Tweedale 30 Sep '19

30 Sep '19

On Mon, Sep 30, 2019 at 08:19:15AM +0100, Stuart McRobert wrote: > Dear Fraser, > > Thanks, I've retained the CC but will probably need to join. > > > I think your idea to first try creating a CA replica on F28 before > > moving forward to F30 is a sensible thing to try. > > I will explore adding a F28 replica > > > One question though: are you on Domain Level 0 or 1? > > (`ipa domainlevel-get`). > > All four servers currently report: > > % ipa domainlevel-get > ----------------------- > Current domain level: 1 > ----------------------- > > This isn't something I've custom set, and earlier I thought the original > three servers were at level 0 with only the new F30 one at 1. > Thanks for confirming Stuart. This setting is not surprising and it is the value we want. I will try to find time to carry out some tests on f26 -> f30 replica creation later this week. Cheers, Fraser > Best wishes > > Stuart >

1 0

Configuring Windows 10 to use FreeIPA
by Joyce Babu 28 Sep '19

28 Sep '19

I followed the instructions for setting up Windows10 to use FreeIPA for authentication https://www.freeipa.org/page/Windows_authentication_against_FreeIPA After following the instruction, the default domain displayed on windows 10 login screen is EXAMPLE and EXAMPLE.COM. I am able to login by entering EXAMPLE.COM\user as the username. But when I enter the username without the leading domain name, login fails with 'Client not found in Kerberos database' error. Sep 27 17:17:58 ipa.example.org krb5kdc[419](info): AS_REQ (6 etypes {aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17), DEPRECATED:arcfour-hmac(23), DEPRECATED:arcfour-hmac-exp(24), (-135), DEPRECATED:des-cbc-md5(3)}) 192.168.0.185: CLIENT_NOT_FOUND: user@EXAMPLE for krbtgt/EXAMPLE@EXAMPLE, Client not found in Kerberos database Is it possible to change the default domain in windows login screen to EXAMPLE.COM from EXAMPLE? Thanks, Joyce Babu

2 1

getcert list status: NEED_CA issue
by Satish Patel 28 Sep '19

28 Sep '19

Few days ago my Master CA was messed up and getcert list was showing empty list (no cert to track) So i run following command to add certs manually: getcert start-tracking -d /etc/pki/pki-tomcat/alias -n 'ocspSigningCert cert-pki-ca' -P XXXXXXX getcert start-tracking -d /etc/pki/pki-tomcat/alias -n 'auditSigningCert cert-pki-ca' -P XXXXXXX getcert start-tracking -d /etc/pki/pki-tomcat/alias -n 'subsystemCert cert-pki-ca' -P XXXXXXX getcert start-tracking -d /etc/pki/pki-tomcat/alias -n 'Godaddy' -P XXXXXXX getcert start-tracking -d /etc/pki/pki-tomcat/alias -n 'Godaddy Intermediate' -P XXXXXXX And after that i am seeing this status (status: NEED_CA ) it should be MONITORING right? # getcert list Number of certificates and requests being tracked: 12. Request ID '20190915042927': status: NEED_CA stuck: yes key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert cert-pki-ca',token='NSS Certificate DB',pin set certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert cert-pki-ca',token='NSS Certificate DB' issuer: CN=Certificate Authority,O=example.com subject: CN=Certificate Authority,O=example.com expires: 2037-01-05 14:47:24 UTC key usage: digitalSignature,nonRepudiation,keyCertSign,cRLSign pre-save command: post-save command: track: yes auto-renew: yes Request ID '20190915043150': status: NEED_CA stuck: yes key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alaas',nickname='Server-Cert cert-pki-ca',token='NSS Certificate DB',pin set certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert cert-pki-ca',token='NSS Certificate DB' issuer: CN=Certificate Authority,O=example.com subject: CN=ldap-example-5-1.foo.example.com,O=example.com expires: 2020-11-17 18:30:29 UTC key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment eku: id-kp-serverAuth,id-kp-clientAuth pre-save command: post-save command: track: yes auto-renew: yes Request ID '20190915043212': status: NEED_CA stuck: yes key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert cert-pki-ca',token='NSS Certificate DB',pin set certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert cert-pki-ca',token='NSS Certificate DB' issuer: CN=Certificate Authority,O=example.com subject: CN=OCSP Subsystem,O=example.com expires: 2020-11-17 18:31:26 UTC eku: id-kp-OCSPSigning pre-save command: post-save command: track: yes auto-renew: yes

3 26

inconsistency when reading server roles ?
by Eugène Adell 28 Sep '19

28 Sep '19

Hello, I am using freeipa 4.5.0.21 (full details below) and I noticed a weird behaviour. When getting informations about a server with a regular user, it won't show the server roles while these roles will be given when checking the server roles themselves. In this case the roles are of 'configured' status instead of 'enabled' (which is probably what would be expected). As it's not documented in the official Guide and I didn't find anything in the mail archive, I believe some clarification is needed. Should server roles be found through some commands but not others ? Is there any security issue of showing them always ? (user) # ipa server-show srv3.idm.local --all dn: cn=srv3.idm.local,cn=masters,cn=ipa,cn=etc,dc=idm,dc=local Server name: srv3.idm.local Enabled server roles: objectclass: top, nsContainer, ipaReplTopoManagedServer, ipaConfigObject, ipaSupportedDomainLevelConfig (user) # ipa server-role-show srv3.idm.local 'NTP server' Server name: srv3.idm.local Role name: NTP server Role status: configured (admin) # ipa server-show srv3.idm.local --all dn: cn=srv3.idm.local,cn=masters,cn=ipa,cn=etc,dc=idm,dc=local Server name: srv3.idm.local Managed suffixes: domain, ca Min domain level: 0 Max domain level: 1 Enabled server roles: CA server, DNS server, NTP server objectclass: top, nsContainer, ipaReplTopoManagedServer, ipaConfigObject, ipaSupportedDomainLevelConfig # yum info ipa-server -v Loading "fastestmirror" plugin Config time: 0.008 Yum version: 3.4.3 rpmdb time: 0.000 Setting up Package Sacks Loading mirror speeds from cached hostfile pkgsack time: 0.004 Installed Packages Name : ipa-server Arch : x86_64 Version : 4.5.0 Release : 21.el7.centos.2.2 Size : 1.0 M Repo : installed From repo : ipa Committer : Johnny Hughes <johnny(a)centos.org> Committime : Thu Oct 19 14:00:00 2017 Buildtime : Thu Oct 19 22:52:09 2017 Install time: Mon Sep 23 21:46:46 2019 Installed by: root <root> Changed by : System <unset> Summary : The IPA authentication server URL : http://www.freeipa.org/ Licence : GPLv3+ Description : IPA is an integrated solution to provide centrally managed Identity (users, : hosts, services), Authentication (SSO, 2FA), and Authorization : (host access control, SELinux user roles, services). The solution provides : features for further integration with Linux based clients (SUDO, automount) : and integration with Active Directory based infrastructures (Trusts). : If you are installing an IPA server, you need to install this package. # cat /etc/*release* CentOS Linux release 7.4.1708 (Core) Derived from Red Hat Enterprise Linux 7.4 (Source) NAME="CentOS Linux" VERSION="7 (Core)" ID="centos" ID_LIKE="rhel fedora" VERSION_ID="7" PRETTY_NAME="CentOS Linux 7 (Core)" ANSI_COLOR="0;31" CPE_NAME="cpe:/o:centos:centos:7" HOME_URL="https://www.centos.org/" BUG_REPORT_URL="https://bugs.centos.org/" CENTOS_MANTISBT_PROJECT="CentOS-7" CENTOS_MANTISBT_PROJECT_VERSION="7" REDHAT_SUPPORT_PRODUCT="centos" REDHAT_SUPPORT_PRODUCT_VERSION="7" CentOS Linux release 7.4.1708 (Core) CentOS Linux release 7.4.1708 (Core) cpe:/o:centos:centos:7 Best regards Eugene

2 2

Issues with Free IPA (Red Hat IDM). Sporadic lookup results. Different results in EL 6 and 7.
by Bob Jones 27 Sep '19

27 Sep '19

All, First the deets of the setup: 3 IDM servers on RHEL 7.7 ipa version VERSION: 4.6.5, API_VERSION: 2.231 sssd version 1.16.4 389 directory server version 1.3.9.1-10 Clients: EL7: ipa version 5.6.5, sssd version EL6: ipa version 3.0.0.51, sssd 1.13.3.60 Servers are setup in an AD trust ipa-ad-trust-posix. I have done the performance tweaks for sssd as described at https://jhrozek.wordpress.com/2015/08/19/performance-tuning-sssd-for-large-… and we use the accounts/groups in AD for login, authorization, and file ownership. There are 3 main issues we are having. 1. On ipa clients on EL 7 servers we are running into sporadic issues. If you totally clear the sssd cache and do an ls -la on let's say /home where there are 12 unique owners of directories usually between 8 to 10 of the UID numbers come back with the the user found, but you have to wait 1 to 5 minutes before the rest of the uids owning the other directories come back as found. 2. Also on ipa clients on EL 7 servers we are running into an issue where occasionally, at what seems like totally random times, AD users that normally can access a client suddenly can't. Someone will have to go in and clear the SSSD cache after which the user will once again be able to access the system. 3. There are some users that are just not visible on the EL 6 clients. On the IDM servers and on EL 7 clients the AD users are able to be found by id and the users can login. On EL 6 those AD users just do not resolve and cannot be seen. Anyway, we have had Red Hat support looking at problem 3 for almost 2 months now with no luck. We have been poking around at problems 1 and 2 but no eureka moments as of yet. I'm hoping someone else on this list has encountered these same issues and found a solution. I would greatly appreciate any insight and help that anyone could provide. Sincerely, — Bob Jones Lead Linux Services Engineer ITS ECP - Linux Services University of Virginia rwj5d(a)virginia.edu

3 5

Configuring Windows 10 to use FreeIPA
by Joyce Babu 27 Sep '19

27 Sep '19

I followed the instructions for setting up Windows10 to use FreeIPA for authentication https://www.freeipa.org/page/Windows_authentication_against_FreeIPA After following the instruction, the default domain displayed on windows 10 login screen is EXAMPLE and EXAMPLE.COM. I am able to login by entering EXAMPLE.COM\user as the username. But when I enter the username without the leading domain name, login fails with 'Client not found in Kerberos database' error. Sep 27 17:17:58 ipa.example.org krb5kdc[419](info): AS_REQ (6 etypes {aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17), DEPRECATED:arcfour-hmac(23), DEPRECATED:arcfour-hmac-exp(24), (-135), DEPRECATED:des-cbc-md5(3)}) 192.168.0.185: CLIENT_NOT_FOUND: user@EXAMPLE for krbtgt/EXAMPLE@EXAMPLE, Client not found in Kerberos database Is it possible to change the default domain in windows login screen to EXAMPLE.COM from EXAMPLE? Thanks, Joyce Babu

1 0

Terminating replication agreement
by Randy Morgan 27 Sep '19

27 Sep '19

I have a two year image of one of my IPA servers that I am trying to bring live. Unfortunately all of the certs except the CA are expired. I have attempted to follow the instructions for updating the certs, but it has failed to update them. After careful and extensive digging, I have found that the issue is two replication agreements from other IPA servers that have since been rebuilt. Because of the expired certs I can't login to the web UI, so I can't terminate the agreements that way, and the IPA commands fail. Is there a way to terminate these agreements manually by removing the references to the two servers? Randy Morgan -- Randy Morgan CSR Department of Chemistry/BioChemistry Brigham Young University

3 5

IPA integration with AD - trust issues and controversy
by Pieter Baele 26 Sep '19

26 Sep '19

Hi, We use an IPA domain for a large part of our internal servers. Our first one-way trust implementation was not properly working because of routing issues. Two-way trust in our environment is not possible, because normal users are limited. (we can resolve 'system/service' accounts without those limitations) After finding out about this limitation, we did again configure one-way trust. This time, we found about the registry / GPO solution to direct windows clients to the IPA KDC's. ( https://gpo.wiki/wiki/Kerberos.admx:Computer_Configuration#Define_host_name… ) And all is working properly... Last week we received a request from an external company that wants AD integration. They will manage their own set of RHEL servers for a specific project. I proposed they can use the IDM domain for feature-full integration with the AD domain. But.... there is some discussion going on.... our AD architect(s) calls the IPA integration with AD lacking. Their opinion is that windows clients should discover automatically when they need a IPA KDC Also, they find it a severe issue that everything is hidden after one SID (which is given permissions with the correct search scope) As such they can' t see/discover anything in the IPA domain (logically...) So the Windows / AD guys propose a direct integration using a keytab - without thinking about the requirements, and comparing with network devices or appliances I am not talking about realmd. What is the up-to-date opinion on SSSD realmd integration versus IDM integration? Or other options? What will the external company be losing in features? And which has most risks? But most of all: what can we do to make IPA domain<-> AD domain integration better? Sincerely, Pieter

1 0

How to archive this?
by Andreas Kucher 26 Sep '19

26 Sep '19

Hi There, i have a FreeIPA 4.6.4 Sever and two replica Servers up and running. So far so good. Now i want to connect my hosts to my Synology NAS running DSM 6.2.2. My first thougth was to use Kerberos and NFS4 but unfortunaly i did not figure out how to do this. Maybe you have a good tutorial? In the End i found this Page: https://frederik.lindenaar.nl/2019/07/14/integrating-synology-ds-with-freei… I think i will try to do this and just access the shares with "LDAP". My question is: if i want to install "ipa-adtrust-install" but it was not installed using yum (because i thougth i was no neccecarry) can i simple install it? Do i have to run it on the replicas as well? Maybe you can have a look at the Page of Frederik and share your thoughts about it? Thank you in advice Andy

1 0

Manually join machines in stateless environment
by Vinícius Ferrão 26 Sep '19

26 Sep '19

Hello, the subject of the message may sound a little bit strange, but let me explain what I’m trying to do. I have a machine with an provisioner (xCAT) that is able to boot and control different types of computer nodes. A stateless node is just a machine that boots over the network from a shared image on the server. What I’m trying to do? Join those stateless nodes to FreeIPA Server. To do this, I’m aware that I can’t just run freeipa-client-install on the image chroot, since it will not behave as expected. At this point xCAT (the provisioner) can create the DNS registers of the stateless nodes on FreeIPA integrated DNS (using TSIG keys). But I need to properly join the nodes to the server. There’s a way to manually register the nodes on the server? And about the users? How to enable them? Just Configure SSSD on the image and it should be fine? The certificates, client certificates and things like this? There’s something that I need to do? Automount? Any help is really appreciated. Thanks,

5 10

Re:
by Nazan CENGİZ 25 Sep '19

25 Sep '19

Hi, Who is the name of the community? Do you have an existing slack group? Thanks. [cid:imageb28ec2.PNG@d1da10fa.4cb398f7]<http://www.havelsan.com.tr> [cid:image8c8aa2.JPG@a93b5b5c.498f306c] Nazan CENGİZ AR-GE MÜHENDİSİ Mustafa Kemal Mahallesi 2120 Cad. No:39 06510 Çankaya Ankara TÜRKİYE [cid:image9f30dc.PNG@eaef3c98.49a0f6ac] +90 312 219 57 87 [cid:image2c5a21.PNG@c874ceae.4a8947a5] +90 312 219 57 97 [cid:imageb831d2.JPG@5f6f348c.44a74e32] YASAL UYARI: Bu elektronik posta işbu linki kullanarak ulaşabileceğiniz Koşul ve Şartlar dokümanına tabidir. <http://havelsan.com.tr/tr/news/e-posta-yasal-uyari> LEGAL NOTICE: This e-mail is subject to the Terms and Conditions document which can be accessed with this link. <http://havelsan.com.tr/tr/news/e-posta-yasal-uyari> [http://www.havelsan.com.tr/Library/images/mail/email.jpg] Lütfen gerekmedikçe bu sayfa ve eklerini yazdırmayınız / Please consider the environment before printing this email ________________________________ From: Nazan CENGİZ Sent: Wednesday, September 25, 2019 11:27:45 AM To: freeipa-users(a)lists.fedorahosted.org Subject: Hi all, Shall we create a Slack band? IRC is banned in our company. Would you mind?

2 1

Re: log dispatching for IPA servers
by Nazan CENGİZ 24 Sep '19

24 Sep '19

Hi all, I wanted monitoring and centrilazed logging.For example ELK (elasticsearch,logstash,kibana) Stack.But I don't know config on FreeIPA server and client?Is there an auxiliary resource? https://github.com/mzamora9913/Collecting-Syslogs-from-FreeIPA-and-clients-… But I don't understanding. Could you please do yuou have a research or tutorial for FreeIPA centralized logging? Best Regards. [cid:image26938a.PNG@6241ef69.4c95962c]<http://www.havelsan.com.tr> [cid:imageeb5f50.JPG@bab4e531.4294e394] Nazan CENGİZ AR-GE MÜHENDİSİ Mustafa Kemal Mahallesi 2120 Cad. No:39 06510 Çankaya Ankara TÜRKİYE [cid:imageedbd3d.PNG@12352f47.48ba5869] +90 312 219 57 87 [cid:imagecff0c2.PNG@69e71500.4fa4bdd2] +90 312 219 57 97 [cid:image713a9c.JPG@cd67836a.4da60895] YASAL UYARI: Bu elektronik posta işbu linki kullanarak ulaşabileceğiniz Koşul ve Şartlar dokümanına tabidir. <http://havelsan.com.tr/tr/news/e-posta-yasal-uyari> LEGAL NOTICE: This e-mail is subject to the Terms and Conditions document which can be accessed with this link. <http://havelsan.com.tr/tr/news/e-posta-yasal-uyari> [http://www.havelsan.com.tr/Library/images/mail/email.jpg] Lütfen gerekmedikçe bu sayfa ve eklerini yazdırmayınız / Please consider the environment before printing this email ________________________________ From: Nazan CENGİZ Sent: Tuesday, September 24, 2019 1:08:15 PM To: Angus Clarke; freeipa-users(a)lists.fedorahosted.org Cc: Fraser Tweedale Subject: Re: [Freeipa-users] Re: log dispatching for IPA servers I wanted logging a IPA server and many IPA client.I also want to keep logging and monitoring at the interface. ________________________________ From: Angus Clarke <post(a)angusclarke.com> Sent: Tuesday, September 24, 2019 12:47:46 PM To: Nazan CENGİZ; freeipa-users(a)lists.fedorahosted.org Cc: Fraser Tweedale Subject: [Freeipa-users] Re: log dispatching for IPA servers Hi If you just want an audit trail of the FreeIPA server(s) API, then apache's ErrorLog directive catches all that. Regards Angus ________________________________ From: Fraser Tweedale via FreeIPA-users <freeipa-users(a)lists.fedorahosted.org> Sent: 24 September 2019 11:08 To: Nazan CENGİZ <nazancengiz(a)havelsan.com.tr>; freeipa-users(a)lists.fedorahosted.org <freeipa-users(a)lists.fedorahosted.org> Cc: Fraser Tweedale <ftweedal(a)redhat.com> Subject: [Freeipa-users] Re: log dispatching for IPA servers Hi Nazan, I'm not sure what are the best practices for log dispatching on IPA servers, or what is suitable for your customer's environment and requirement. I assume the customer is running RHEL and therefore wants the solution to only use supported components. Adding freeipa-users@ for a wider audience. Cheers, Fraser On Tue, Sep 24, 2019 at 07:50:14AM +0000, Nazan CENGİZ wrote: > Hi Fraser, > > > I working 5G project in Turkey. Redhat supported me for Openstack 13. > > > We install FreeIPA. We wanted log monitoring on FreeIPA server and clients.I think it should Kibana,Elasticsearch and fluentd. > > > I see https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fsysadmin.…. > > > But I don't know installing on FreeIPA server and clients.Where is installed fluentd on IPA server and clients? > > > I following https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.co… but It not answer the questions. > > > Could you please help me? > > > Best Regards, > > > Nazan. > > > [cid:image556c62.PNG@8bf41986.459c739a]<https://eur01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.havels…> [cid:imageb02311.JPG@73a7601e.418b1956] > Nazan CENGİZ > AR-GE MÜHENDİSİ > Mustafa Kemal Mahallesi 2120 Cad. No:39 06510 Çankaya Ankara TÜRKİYE > [cid:imagea8935c.PNG@9a2bfb11.4c8dd354] +90 312 219 57 87 [cid:image2cbf6d.PNG@6b6c6178.42ba3343] +90 312 219 57 97 > > > [cid:image67d26a.JPG@1a093bf4.45953fd9] > YASAL UYARI: Bu elektronik posta işbu linki kullanarak ulaşabileceğiniz Koşul ve Şartlar dokümanına tabidir. <https://eur01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fhavelsan.c…> > LEGAL NOTICE: This e-mail is subject to the Terms and Conditions document which can be accessed with this link. <https://eur01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fhavelsan.c…> > > [https://eur01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.havels…] Lütfen gerekmedikçe bu sayfa ve eklerini yazdırmayınız / Please consider the environment before printing this email > > _______________________________________________ FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org Fedora Code of Conduct: https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdocs.fedo… List Guidelines: https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Ffedorapro… List Archives: https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.fed…

1 0

Re: log dispatching for IPA servers
by Nazan CENGİZ 24 Sep '19

24 Sep '19

Hi all, I wanted monitoring and centrilazed logging.For example ELK (elasticsearch,logstash,kibana) Stack.But I don't know config on FreeIPA server and client?Is there an auxiliary resource? https://github.com/mzamora9913/Collecting-Syslogs-from-FreeIPA-and-clients-… But I don't understanding. Could you please do yuou have a research or tutorial for FreeIPA centralized logging? Best Regards. [cid:image347106.PNG@a5dcc7e9.409203b6]<http://www.havelsan.com.tr> [cid:image5fbf77.JPG@4f26cf2f.4ebbc4db] Nazan CENGİZ AR-GE MÜHENDİSİ Mustafa Kemal Mahallesi 2120 Cad. No:39 06510 Çankaya Ankara TÜRKİYE [cid:image48d16b.PNG@1d2efdd9.4ab00d7e] +90 312 219 57 87 [cid:image19c98b.PNG@1fe142d5.4abd5c1d] +90 312 219 57 97 [cid:image777429.JPG@2b5066da.489d3957] YASAL UYARI: Bu elektronik posta işbu linki kullanarak ulaşabileceğiniz Koşul ve Şartlar dokümanına tabidir. <http://havelsan.com.tr/tr/news/e-posta-yasal-uyari> LEGAL NOTICE: This e-mail is subject to the Terms and Conditions document which can be accessed with this link. <http://havelsan.com.tr/tr/news/e-posta-yasal-uyari> [http://www.havelsan.com.tr/Library/images/mail/email.jpg] Lütfen gerekmedikçe bu sayfa ve eklerini yazdırmayınız / Please consider the environment before printing this email ________________________________ From: Angus Clarke <post(a)angusclarke.com> Sent: Tuesday, September 24, 2019 12:47:46 PM To: Nazan CENGİZ; freeipa-users(a)lists.fedorahosted.org Cc: Fraser Tweedale Subject: [Freeipa-users] Re: log dispatching for IPA servers Hi If you just want an audit trail of the FreeIPA server(s) API, then apache's ErrorLog directive catches all that. Regards Angus ________________________________ From: Fraser Tweedale via FreeIPA-users <freeipa-users(a)lists.fedorahosted.org> Sent: 24 September 2019 11:08 To: Nazan CENGİZ <nazancengiz(a)havelsan.com.tr>; freeipa-users(a)lists.fedorahosted.org <freeipa-users(a)lists.fedorahosted.org> Cc: Fraser Tweedale <ftweedal(a)redhat.com> Subject: [Freeipa-users] Re: log dispatching for IPA servers Hi Nazan, I'm not sure what are the best practices for log dispatching on IPA servers, or what is suitable for your customer's environment and requirement. I assume the customer is running RHEL and therefore wants the solution to only use supported components. Adding freeipa-users@ for a wider audience. Cheers, Fraser On Tue, Sep 24, 2019 at 07:50:14AM +0000, Nazan CENGİZ wrote: > Hi Fraser, > > > I working 5G project in Turkey. Redhat supported me for Openstack 13. > > > We install FreeIPA. We wanted log monitoring on FreeIPA server and clients.I think it should Kibana,Elasticsearch and fluentd. > > > I see https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fsysadmin.…. > > > But I don't know installing on FreeIPA server and clients.Where is installed fluentd on IPA server and clients? > > > I following https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.co… but It not answer the questions. > > > Could you please help me? > > > Best Regards, > > > Nazan. > > > [cid:image556c62.PNG@8bf41986.459c739a]<https://eur01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.havels…> [cid:imageb02311.JPG@73a7601e.418b1956] > Nazan CENGİZ > AR-GE MÜHENDİSİ > Mustafa Kemal Mahallesi 2120 Cad. No:39 06510 Çankaya Ankara TÜRKİYE > [cid:imagea8935c.PNG@9a2bfb11.4c8dd354] +90 312 219 57 87 [cid:image2cbf6d.PNG@6b6c6178.42ba3343] +90 312 219 57 97 > > > [cid:image67d26a.JPG@1a093bf4.45953fd9] > YASAL UYARI: Bu elektronik posta işbu linki kullanarak ulaşabileceğiniz Koşul ve Şartlar dokümanına tabidir. <https://eur01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fhavelsan.c…> > LEGAL NOTICE: This e-mail is subject to the Terms and Conditions document which can be accessed with this link. <https://eur01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fhavelsan.c…> > > [https://eur01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.havels…] Lütfen gerekmedikçe bu sayfa ve eklerini yazdırmayınız / Please consider the environment before printing this email > > _______________________________________________ FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org Fedora Code of Conduct: https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdocs.fedo… List Guidelines: https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Ffedorapro… List Archives: https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.fed…

1 0

Re: log dispatching for IPA servers
by Fraser Tweedale 24 Sep '19

24 Sep '19

Hi Nazan, I'm not sure what are the best practices for log dispatching on IPA servers, or what is suitable for your customer's environment and requirement. I assume the customer is running RHEL and therefore wants the solution to only use supported components. Adding freeipa-users@ for a wider audience. Cheers, Fraser On Tue, Sep 24, 2019 at 07:50:14AM +0000, Nazan CENGİZ wrote: > Hi Fraser, > > > I working 5G project in Turkey. Redhat supported me for Openstack 13. > > > We install FreeIPA. We wanted log monitoring on FreeIPA server and clients.I think it should Kibana,Elasticsearch and fluentd. > > > I see https://sysadmin.miniconf.org/2018/lca2018-fraser_tweedale-user_session_rec…. > > > But I don't know installing on FreeIPA server and clients.Where is installed fluentd on IPA server and clients? > > > I following https://github.com/mzamora9913/Collecting-Syslogs-from-FreeIPA-and-clients-… but It not answer the questions. > > > Could you please help me? > > > Best Regards, > > > Nazan. > > > [cid:image556c62.PNG@8bf41986.459c739a]<http://www.havelsan.com.tr> [cid:imageb02311.JPG@73a7601e.418b1956] > Nazan CENGİZ > AR-GE MÜHENDİSİ > Mustafa Kemal Mahallesi 2120 Cad. No:39 06510 Çankaya Ankara TÜRKİYE > [cid:imagea8935c.PNG@9a2bfb11.4c8dd354] +90 312 219 57 87 [cid:image2cbf6d.PNG@6b6c6178.42ba3343] +90 312 219 57 97 > > > [cid:image67d26a.JPG@1a093bf4.45953fd9] > YASAL UYARI: Bu elektronik posta işbu linki kullanarak ulaşabileceğiniz Koşul ve Şartlar dokümanına tabidir. <http://havelsan.com.tr/tr/news/e-posta-yasal-uyari> > LEGAL NOTICE: This e-mail is subject to the Terms and Conditions document which can be accessed with this link. <http://havelsan.com.tr/tr/news/e-posta-yasal-uyari> > > [http://www.havelsan.com.tr/Library/images/mail/email.jpg] Lütfen gerekmedikçe bu sayfa ve eklerini yazdırmayınız / Please consider the environment before printing this email > >

2 1

hostgroups and netgroups
by Amos 22 Sep '19

22 Sep '19

Why is it that hostgroups and netgroups share the same name space? Amos

2 1

remove bad replica from list not working
by Satish Patel 20 Sep '19

20 Sep '19

I am trying to remove old and bad replica from list but somehow it didn't like what i am doing [root@ldap-master ~]# ipa-replica-manage list -v `hostname` ldap-1.example.com: replica last init status: None last init ended: 1970-01-01 00:00:00+00:00 last update status: Error (0) Replica acquired successfully: Incremental update succeeded last update ended: 2019-09-19 17:28:00+00:00 ldap-2.example.com: replica last init status: None last init ended: 1970-01-01 00:00:00+00:00 last update status: Error (0) Replica acquired successfully: Incremental update succeeded last update ended: 2019-09-19 17:28:00+00:00 ldap-3.example.com: replica last init status: None last init ended: 1970-01-01 00:00:00+00:00 last update status: Error (-1) Problem connecting to replica - LDAP error: Can't contact LDAP server (connection error) last update ended: 1970-01-01 00:00:00+00:00 I have tried following way but its still not removing from list [root@ldap-master ~]# ipa-replica-manage del ldap-3.example.com --force --cleanup ipa: INFO: Skipping replication agreement deletion check for suffix 'domain' ipa: INFO: Skipping replication agreement deletion check for suffix 'ca' ipa: WARNING: Forcing removal of ldap-3.example.com ipa: WARNING: Ignoring topology connectivity errors. ipa: WARNING: Ignoring these warnings and proceeding with removal ipa: WARNING: Failed to cleanup ldap-3.example.com DNS entries: DNS is not configured ipa: WARNING: You may need to manually remove them from the tree ipa: WARNING: Server has already been deleted ----------------------------------------------- Deleted IPA server "ldap-3.example.com" ----------------------------------------------- I can still this that replica in list [root@ldap-master ~]# ipa-replica-manage list -v `hostname` … … ldap-3.example.com: replica last init status: None last init ended: 1970-01-01 00:00:00+00:00 last update status: Error (-1) Problem connecting to replica - LDAP error: Can't contact LDAP server (connection error) last update ended: 1970-01-01 00:00:00+00:00

3 3

DNS server 10.0.3.10: query '. SOA': The DNS operation timed out after 10.001354217529297 seconds
by Mudassar Rana 20 Sep '19

20 Sep '19

Hi , I am trying to deploy ipa server as a docker container on kubernetes cluster . I have build the docker image & run below command . docker run --privileged --sysctl net.ipv6.conf.lo.disable_ipv6=0 --name freeipa-server -ti -h ipa.faas.example.lab freeipa-server-new:latest --setup-dns --allow-zone-overlap But facing issue DNS server 10.0.3.10: query '. SOA': The DNS operation timed out after 10.001354217529297 seconds On the host system , i run dig command to verify the forwarding issue . Please find the output below : ``` [root@svpod7mgmt002 ~]# dig @10.0.3.10 . SOA ; <<>> DiG 9.11.4-P2-RedHat-9.11.4-9.P2.el7 <<>> @10.0.3.10 . SOA ; (1 server found) ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 55981 ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 2 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4000 ;; QUESTION SECTION: ;. IN SOA ;; ANSWER SECTION: . 45023 IN SOA a.root-servers.net. nstld.verisign-grs.com. 2019091900 1800 900 604800 86400 ;; ADDITIONAL SECTION: a.root-servers.net. 29958 IN A 198.41.0.4 ;; Query time: 0 msec ;; SERVER: 10.0.3.10#53(10.0.3.10) ;; WHEN: Fri Sep 20 01:49:17 UTC 2019 ;; MSG SIZE rcvd: 120 ```

1 0

Vault: Cannot authenticate agent with certificate
by Peter Oliver 20 Sep '19

20 Sep '19

I have a CentOS 7 server running ipa-server-4.5.4, recently installed. I find that operations related to the vault feature fail. For example: > ipa -v vault-add test --type=standard ipa: INFO: trying https://ipa-01.example.com/ipa/session/json ipa: INFO: [try 1]: Forwarding 'vault_add_internal/1' to json server 'https://ipa-01.example.com/ipa/session/json' ipa: INFO: [try 1]: Forwarding 'vault_show/1' to json server 'https://ipa-01.example.com/ipa/session/json' ipa: INFO: [try 1]: Forwarding 'vaultconfig_show/1' to json server 'https://ipa-01.example.com/ipa/session/json' ipa: INFO: [try 1]: Forwarding 'vault_archive_internal/1' to json server 'https://ipa-01.example.com/ipa/session/json' ipa: ERROR: an internal error has occurred In /var/log/pki/pki-tomcat/kra/system I see the following message: 0.ajp-bio-127.0.0.1-8009-exec-15 - [02/Nov/2018:14:54:37 GMT] [6] [3] Cannot authenticate agent with certificate Serial 0x7 Subject DN CN=IPA RA,O=IPA.EXAMPLE.COM. Error: User not found In /var/log/pki/pki-tomcat/kra/debug is see the following messages: [02/Nov/2018:14:54:37][ajp-bio-127.0.0.1-8009-exec-16]: SessionContextInterceptor: SystemCertResource.getTransportCert() [02/Nov/2018:14:54:37][ajp-bio-127.0.0.1-8009-exec-16]: SessionContextInterceptor: Not authenticated. [02/Nov/2018:14:54:37][ajp-bio-127.0.0.1-8009-exec-16]: AuthMethodInterceptor: SystemCertResource.getTransportCert() [02/Nov/2018:14:54:37][ajp-bio-127.0.0.1-8009-exec-16]: AuthMethodInterceptor: mapping: default [02/Nov/2018:14:54:37][ajp-bio-127.0.0.1-8009-exec-16]: AuthMethodInterceptor: required auth methods: [*] [02/Nov/2018:14:54:37][ajp-bio-127.0.0.1-8009-exec-16]: AuthMethodInterceptor: anonymous access allowed [02/Nov/2018:14:54:37][ajp-bio-127.0.0.1-8009-exec-16]: ACLInterceptor: SystemCertResource.getTransportCert() [02/Nov/2018:14:54:37][ajp-bio-127.0.0.1-8009-exec-16]: ACLInterceptor.filter: no authorization required [02/Nov/2018:14:54:37][ajp-bio-127.0.0.1-8009-exec-16]: ACLInterceptor: No ACL mapping; authz not required. [02/Nov/2018:14:54:37][ajp-bio-127.0.0.1-8009-exec-16]: SignedAuditLogger: event AUTHZ [02/Nov/2018:14:54:37][ajp-bio-127.0.0.1-8009-exec-16]: MessageFormatInterceptor: SystemCertResource.getTransportCert() [02/Nov/2018:14:54:37][ajp-bio-127.0.0.1-8009-exec-16]: MessageFormatInterceptor: content-type: application/json [02/Nov/2018:14:54:37][ajp-bio-127.0.0.1-8009-exec-16]: MessageFormatInterceptor: accept: [application/json] [02/Nov/2018:14:54:37][ajp-bio-127.0.0.1-8009-exec-16]: MessageFormatInterceptor: request format: application/json [02/Nov/2018:14:54:37][ajp-bio-127.0.0.1-8009-exec-16]: MessageFormatInterceptor: response format: application/json [02/Nov/2018:14:54:37][ajp-bio-127.0.0.1-8009-exec-15]: PKIRealm: Authenticating certificate chain: [02/Nov/2018:14:54:37][ajp-bio-127.0.0.1-8009-exec-15]: PKIRealm.getAuditUserfromCert: certUID=CN=IPA RA, O=IPA.EXAMPLE.COM [02/Nov/2018:14:54:37][ajp-bio-127.0.0.1-8009-exec-15]: PKIRealm: CN=IPA RA, O=IPA.EXAMPLE.COM [02/Nov/2018:14:54:37][ajp-bio-127.0.0.1-8009-exec-15]: CertUserDBAuth: started [02/Nov/2018:14:54:37][ajp-bio-127.0.0.1-8009-exec-15]: CertUserDBAuth: Retrieving client certificate [02/Nov/2018:14:54:37][ajp-bio-127.0.0.1-8009-exec-15]: CertUserDBAuth: Got client certificate [02/Nov/2018:14:54:37][ajp-bio-127.0.0.1-8009-exec-15]: Authentication: client certificate found [02/Nov/2018:14:54:37][ajp-bio-127.0.0.1-8009-exec-15]: In LdapBoundConnFactory::getConn() [02/Nov/2018:14:54:37][ajp-bio-127.0.0.1-8009-exec-15]: masterConn is connected: true [02/Nov/2018:14:54:37][ajp-bio-127.0.0.1-8009-exec-15]: getConn: conn is connected true [02/Nov/2018:14:54:37][ajp-bio-127.0.0.1-8009-exec-15]: getConn: mNumConns now 2 [02/Nov/2018:14:54:37][ajp-bio-127.0.0.1-8009-exec-15]: returnConn: mNumConns now 3 [02/Nov/2018:14:54:37][ajp-bio-127.0.0.1-8009-exec-15]: CertUserDBAuthentication: cannot map certificate to any userUser not found [02/Nov/2018:14:54:37][ajp-bio-127.0.0.1-8009-exec-15]: SignedAuditLogger: event AUTH Any suggestions? Has something gone wrong with the setup? -- Peter Oliver

4 7

reinstall freeIPA server without loosing data
by Albert Szostkiewicz 20 Sep '19

20 Sep '19

I have an issue with my IPA server. Suddenly, after some recent system update, I am unable to log-in to web UI nor execute any command due to the 'unknown reason' and some "Unspecified GSS failure." I went through the suggested debugging process but no luck. I've seen similar issues in the past marked as a bug, but without clean solution rather than `updating to a newer version of ipa`. So I've filled bug report assuming that it could be a bug again. https://pagure.io/freeipa/issue/8065 Unfortunately, Devs might be too busy to look into that, so I was wondering if there is a way that I could re-install ipa-server without creating complete chaos and keeping all DNS/USER/HOSTS data? Any suggestions? Thanks!

4 6

services disabled by default on replicas ?
by danielle lampert 19 Sep '19

19 Sep '19

Hello, I'm running freeipa 4.5.0-20 on CentOS Linux release 7.4.1708 (Core) I've noticed that when rebooting my replica, things are not working anymore on this replica, as I can't get a kinit work for example. It seems that services are disabled by default and I wonder if this is normal ? Should we enable these services manually ? After restarting everything with an ipactl command, it then is working. Thanks in advance for your answers, below are my commands and their results. D.L. # kinit admin kinit: Cannot contact any KDC for realm 'IPB.RHCE.LOCAL' while getting initial credentials # systemctl status kadmin.service ● kadmin.service - Kerberos 5 Password-changing and Administration Loaded: loaded (/usr/lib/systemd/system/kadmin.service; disabled; vendor preset: disabled) Active: inactive (dead) # ipactl status Directory Service: RUNNING krb5kdc Service: STOPPED kadmin Service: STOPPED httpd Service: STOPPED ipa-custodia Service: STOPPED ntpd Service: STOPPED pki-tomcatd Service: STOPPED ipa-otpd Service: STOPPED ipa: INFO: The ipactl command was successful # ipactl restart Failed to get service list from file: Unknown error when retrieving list of services from file: [Errno 2] No such file or directory: '/var/run/ipa/services.list' Restarting Directory Service Restarting krb5kdc Service Restarting kadmin Service Restarting httpd Service Restarting ipa-custodia Service Restarting ntpd Service Restarting pki-tomcatd Service Restarting ipa-otpd Service ipa: INFO: The ipactl command was successful # kinit admin Password for admin(a)IPB.RHCE.LOCAL: # klist Ticket cache: KEYRING:persistent:0:0 Default principal: admin(a)IPB.RHCE.LOCAL Valid starting Expires Service principal 03/09/19 23:55:09 04/09/19 23:55:08 krbtgt/IPB.RHCE.LOCAL(a)IPB.RHCE.LOCAL

3 11

FreeIPA CA_REJECT issue during adding new replica
by Satish Patel 19 Sep '19

19 Sep '19

Folks, Stay with me while i explain my issue because its little complex, We had 2 working ldap running in datacenter-A for many months and life was good. Last year company decided to shutdown datacenter-A and migrate everything from there to new datacenter-B. This is what i did for migration, I have created two new LDAP server in Datacenter-B and run create replica from Datacenter-A ( but my bad luck we forgot to do --setup-ca option which create CA replica) In short we have no CA running in new datacenter-B Fun part start now. so finally few months back we shutdown datacenter-A and archived all data (LDAP was running in VMware so we archived vmdk), after 8 month we found our LDAP server running under load so we decided to create more replica and we found we have no CA master so we can't create replica. Damn it. We dig into datacenter-A archived and start ldap-ca-master start on new IP address we gave it same DNS name so it won't create any issue, when i start ldap-ca-master it started throwing error that some certs expired blah..blah.. so finally i renew them and this LDAP looks good now CA is also running. Hostname: ldap-ca-master (This is old datacenter LDAP with CA, awakened few days ago) ldap-b-1 (new datacenter LDAP without CA) ldap-b-2 (new datacenter LDAP without CA) Now i am trying to create new ldap-b-3 in new datacenter using ldap-b-1 as my master to create new replica and somehow i am getting following error RuntimeError: Certificate issuance failed (CA_REJECTED: Server at https://ldap-b-1.example.com/ipa/xml failed request, will retry: 4035 (RPC failed at server. Request failed with status 404: Non-2xx response from CA REST API: 404. ).) Installation failed. Rolling back changes. Unenrolling client from IPA server Unenrolling host failed: RPC failed at server. invalid 'hostname': An IPA master host cannot be deleted or disabled Question: 1. My all other ldap running 4.5.x but new replica is on 4.6 not sure that is the issue here or not? 2. I can see ldap-ca-master node isn't fully sync with ldap-b-1 and ldap-b-2 because i brought that machine in life after 8 month (do you think i should do force sync ldap-ca-master to sync with ldap-b-1 ?) 3. Should i use ldap-ca-master to create replica or i can pick any node to create replica? What are the options i have here to troubleshoot this issue?

2 6

Certmonger managed certificate signed by sub-ca
by Ben Rawson 18 Sep '19

18 Sep '19

I'm having some trouble getting sub-ca signed certificates issued and managed by certmonger. The implementation here [https://www.freeipa.org/page/V4/Sub-CAs] describes how that should work. I see that the -X option can be passed to ipa-getcert to specify the issuer, but every time I create a request with -X specified I get an error. Steps to reproduce: 1. Create a new CA named "Test" through the FreeIPA web UI. 2. Run the following on a host enrolled in freeIPA: ipa-getcert request -k /root/test.key -f /root/test.crt -I "testrequest" -X "Test" 3. Run ipa-getcert list and receive the an error message: Request ID 'test': status: CA_REJECTED ca-error: Server at https://ipa02.yyy.com/ipa/xml failed request, will retry: 4035 (RPC failed at server. Request failed with status 500: Non-2xx response from CA REST API: 500. ). stuck: yes key pair storage: type=FILE,location='/root/test.key' certificate: type=FILE,location='/root/test.crt' CA: IPA issuer: subject: expires: unknown pre-save command: post-save command: track: yes auto-renew: yes Running FreeIPA 4.6.4 Thanks for the help!

2 6

Check users last login ? To auto disable in-active users ?
by Morgan Cox 17 Sep '19

17 Sep '19

HI. For PCI DSS compliance I need to be able to disable users not logged in for X amount of days (I think its 90). I was going to create a script which checks last login time (I have a similar one for expired passwords), however I cannot find a way of doing so.. I have searched for info and found I should be able to get the info from the krbLastSuccessfulAuth value using # ipa user-find --all --raw But that field is not there. Also seen I can use # ipa user-status user But the value always shows ' Last successful authentication: N/A' Also seen using ldapsearch # ldapsearch -x -D "cn=Directory Manager" -W uid=serviceuser And the value is also missing. Reading about this is seems the value is cancelled when using replicas - is that right ? How can I perform what I need to - i.e how to check last login time for a user from the IPA servers (not on a per ipa client basis) ? Or is there a different way to disable in-active users ?

2 2

ipa-kra-install fails: Failed to update number range.
by Dmitry Perets 13 Sep '19

13 Sep '19

Hi, I've created a new IPA replica. ipa-replica-install has completed successfully. ipa-ca-install has completed successfully as well. However, ipa-kra-install fails. In the terminal the fails right here: Configuring KRA server (pki-tomcatd). Estimated time: 2 minutes [1/11]: creating ACIs for admin [2/11]: creating installation admin user [3/11]: configuring KRA instance Failed to configure KRA instance: Command '/usr/sbin/pkispawn -s KRA -f /tmp/tmp0w3vD5' returned non-zero exit status 1 See the installation logs and the following files/directories for more information: /var/log/pki/pki-tomcat [error] RuntimeError: KRA configuration failed. This is in /var/log/pki/pki-tomcat/kra/debug: [12/Sep/2019:15:58:34][http-bio-8443-exec-1]: === Subsystem Configuration === [12/Sep/2019:15:58:34][http-bio-8443-exec-1]: SystemConfigService: validate clone URI: https://t-idm-nbg2-1.poc.customer.de:443 [12/Sep/2019:15:58:35][http-bio-8443-exec-1]: SystemConfigService: get configuration entries from master [12/Sep/2019:15:58:35][http-bio-8443-exec-1]: updateNumberRange start host=t-idm-nbg2-1.poc.customer.de adminPort=443 eePort=443 [12/Sep/2019:15:58:35][http-bio-8443-exec-1]: updateNumberRange content: {xmlOutput=[true], sessionID=[5319570421915120898], type=[request]} [12/Sep/2019:15:58:35][http-bio-8443-exec-1]: ConfigurationUtils: POST https://t-idm-nbg2-1.poc.customer.de:443/kra/admin/kra/updateNumberRange [12/Sep/2019:15:58:35][http-bio-8443-exec-1]: Server certificate: [12/Sep/2019:15:58:35][http-bio-8443-exec-1]: - subject: CN=t-idm-nbg2-1.poc.customer.de,O=poc.customer.de [12/Sep/2019:15:58:35][http-bio-8443-exec-1]: - issuer: CN=Certificate Authority,O=poc.customer.de [12/Sep/2019:15:58:35][http-bio-8443-exec-1]: content from admin interface =<?xml version="1.0" encoding="UTF-8" standalone="no"?><XMLResponse><Status>1</Status><Error>Error: Failed to update number range.</Error></XMLResponse> [12/Sep/2019:15:58:35][http-bio-8443-exec-1]: updateNumberRange(): status=1 java.io.IOException: Error: Failed to update number range. I must note that in this environment there were a lot of redeployments of IPA servers, replicating from one another, deleting the original masters etc. And right now I have about 10 IPA servers running, out of them 2 with working KRA (this was supposed to be the 3rd one). I found a similar issue with an explanation how the number ranges can get depleted, but I am not sure how I can manually resolve this (without killing the entire environment of course): https://pagure.io/freeipa/issue/7654 Could you guide me in the right direction please? ipa-server 4.6.4... --- Regards, Dmitry Perets

2 1

how do you update certs for kinit -n?
by Charles Hedrick 13 Sep '19

13 Sep '19

Recent versions of freeipa support kinit -n. However we need a file that has certificates from all the servers. We have three servers. Their certificates renew themselves automatically a few hours before expiration. But then we need to concatenate all of them and put them on all clients. It should be part of the ipa client, or may sssd to retrieve the updated certs. We depend upon kinit -n as part of the script for doing kinit for users for one-time passwords. I had written a hack that uses a random user with no abilities. Until we ca find a way to distribute certs whenever they change I’m going to return to the hack rather than kinit -n.

1 0

Resilience when accessing CA
by Dmitry Perets 12 Sep '19

12 Sep '19

Hi, In several scenarios when CA must be accessed, I face issues with the algorithm to select IPA server running CA. Wanted to check if there is an easy solution in place that I am missing... For example, if I run "ipa vault-retrieve" on IPA server that doesn't run CA/KRA, it will forward the request to another IPA server. But how will it choose one? From my tests, looks like the algorithm is: - If "ca_host" is defined in /etc/ipa/default.conf, use that IPA server - If it's not defined, fallback to LDAP lookup - query "cn=masters,cn=ipa,cn=etc,<base-dn>" for servers that have KRA and... choose the first result. So the problem is that neither of these two methods is redundant. If the chosen IPA server is down, it just fails, it doesn't try the others. Is there any solution for this? I thought it was specific to Vault access, but I discovered the same thing when I simply do "ipa host-disable" for some host. Seems that also in this case there is a need to access CA, so the IPA server applies the same algorithm as above - so it looks. And again, no redundancy. If it cannot reach the chosen IPA server, it won't try any other. Can you confirm that the algorighm is as described above? Or am I missing anything? Thanks. --- Regards, Dmitry Perets

2 2

ipausers unable to sudo
by Albert Szostkiewicz 11 Sep '19

11 Sep '19

Hi! I've reinstalled ipa-client on a workstation and for some reason now ipa users are not part of sudoers File `/etc/nsswitch.conf` contains `sudoers: files sss` File '/etc/sssd/sssd.conf' contains `[sssd] services = nss, pam, ssh, sudo, autofs` There is no 'sudo_provider' within sssd.conf I've tried to go through provided troubleshooting guide but even seeing discrepancies, I am not sure what should i do about it. Here are snippets of what troubleshooting was suggesting to look for: [sssd[sudo]] [sudosrv_fetch_rules] (0x0400): Returning 0 default options for [myipauser@home.mydomain.com@home.mydomain.com] [sssd[sudo]] [sudosrv_fetch_rules] (0x0400): Returning 0 rules for [myipauser@home.mydomain.com@home.mydomain.com] [sssd[sudo]] [sudosrv_query_cache] (0x0200): Searching sysdb with [(&(objectClass=sudoRule)(sudoUser=+*)(!(|(sudoUser=ALL)(sudoUser=myipauser@home.mydomain.com)(sudoUser=#1907400001)(sudoUser=%editors@home.mydomain.com)(sudoUser=%trust\20admins@home.mydomain.com)(sudoUser=%admins@home.mydomain.com)(sudoUser=%ipausers@home.mydomain.com)(sudoUser=%mymaingroup@home.mydomain.com)(sudoUser=%gogs_users@home.mydomain.com)(sudoUser=%admins@home.mydomain.com))))] # record 28 dn: name=su,cn=hbac_services,cn=custom,cn=home.mydomain.com,cn=sysdb # record 29 dn: name=myipauser(a)home.mydomain.com,cn=users,cn=home.mydomain.com,cn=sysdb [sdap_search_bases_ex_done] (0x0400): Receiving data from base [cn=sudo,dc=home,dc=mydomain,dc=com] [sssd[be[home.mydomain.com]]] [ipa_sudo_fetch_rules_done] (0x0040): Received 1 sudo rules [sysdb_sudo_store_rule] (0x0400): Adding sudo rule All [sssd[be[home.mydomain.com]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(&(objectClass=ipasudocmdgrp)(entryUSN>=24976))][cn=sudo,dc=home,dc=mydomain,dc=com]. I do not have '[sdap_sudo_refresh_load_done]' within sssd_$domain.log > ldapsearch -x -H ldap://ipaserver.home.mydomain.com -b dc=ipaserver,dc=home,dc=mydomain,dc=com '$filter' # extended LDIF # # LDAPv3 # base <dc=ipaserver,dc=home,dc=mydomain,dc=com> with scope subtree # filter: (objectclass=*) # requesting: $filter # # search result search: 2 result: 0 Success # numResponses: 1 > ldapsearch -x -D "cn=Directory Manager" -w "$password" -H ldap://ipaserver.home.mydomain.com -b dc=ipaserver,dc=home,dc=mydomain,dc=com '$filter' ldap_bind: Server is unwilling to perform (53) additional info: Unauthenticated binds are not allowed > ldapsearch -Y GSSAPI -H ldap://ipaserver.home.mydomain.com -b dc=ipaserver,dc=home,dc=mydomain,dc=com '$filter' SASL/GSSAPI authentication started SASL username: host/myworkstation.home.mydomain.com(a)HOME.MYDOMAIN.COM SASL SSF: 256 SASL data security layer installed. # extended LDIF # # LDAPv3 # base <dc=ipaserver,dc=home,dc=mydomain,dc=com> with scope subtree # filter: (objectclass=*) # requesting: $filter # # search result search: 4 result: 0 Success # numResponses: 1 sudo[411] -> sudo_parseln_v2 @ ./parseln.c:59 sudo[411] <- sudo_parseln_v2 @ ./parseln.c:129 := 0 sudo[411] <- sudo_sss_open @ ./sssd.c:628 := 0 sudo[411] Looking for cn=default sudo[411] Received 0 rule(s) Any help would be appreciated! Cheers!

3 5

Issues with config between FreeIPA and Dell EMC Unity NAS server
by Kevin Vasko 10 Sep '19

10 Sep '19

I’m trying to integrate the “NAS Server” on our Dell EMC Unity with our FreeIPA server so we can secure our NFS shares. Our FreeIPA server is run of the mill setup. We don’t have any special configuration. The Dell EMC Box NAS configuration settings is asking for the following. Realm: KDC Servers: Port: Base DN: Custom Principal: Custom Principal password: Keytab You can get a better visual from these screenshots. https://imgur.com/a/H6pWemL Info about the environment (I switched example.com from our regular domain but it’s a direct replacement). ny.example.com is my main domain/realm (e.g. NY.EXAMPLE.COM) My other domain is la.example.com. My KDC (IPA servers) are ipa.ny.example.com and ipa.la.example.com, they are replicas. The Dell EMC Unity NAS server I’m setting up will be nfssrv.la.example.com. So this is what I did. In FreeIPA I create a new host manually through the gui. Principle alias: nfssrv.la.example.com(a)NY.EXAMPLE.COM I then created a new service with that host through the gui nfs/nfssrv.la.example.com(a)NY.EXAMPLE.COM I then went into the freeIPA server and generated a keytab "ipa-getkeytab -s ipa.ny.example.com -p nfs/nfssrv.la.example.com(a)NY.EXAMPLE.COM -k /tmp/nfssrv.keytab -P <entered passwd>" The principal in the ipa-getkeytab command and the password I supplied to the ipa-getkeytab command is what I supplied in the Dell EMC Unity dialogs. However, when I do all of this, I keep getting errors in the Dell EMC Unity log stating “In the NAS server nfssrv.la.example.com, ONE LDAP server for Domain ny.example.com goes back from failure.” “LDAP client settings on NAS server nfssrv.la.example.com are not valid within domain ny.example.com”. So the questions I have are. 1) Am I generating the keytab appropriately? 2) Am I supplying the correct information to the “Specifiy Custom principal” “Principal” fields with the principal of the actual server? 3) The last thing I am unsure about is the “Retrieve Current Schema”. This schema was automatically generated. It states is for the Fedora Directory Service so I assumed that’s was correct since I’m using CentOS with FreeIPA. I haven’t changed anything in the scheme (at least that i’m aware of). Any way to validate this? If anyone can provide any advice/suggestions I would greatly appreciate it. The following is the “Current Schema” listed in the LDAP section. # ----------------------------------------------------------------------------- # This template was automatically generated by the EMC Nas server # - Adjustments could be required to fit your specific LDAP configuration. # - The following setup fits the Fedora Directory service schema. # Containers nss_base_passwd ou=people,dc=ny,dc=example,dc=com nss_base_group ou=group,dc=ny,dc=example,dc=com nss_base_hosts ou=hosts, dc=ny,dc=example,dc=com nss_base_netgroup ou=netgroup,dc=ny,dc=example,dc=com # - The parameter fast_search allows fast search encoding to boost performances with big LDAP repositories. # The parameter is set to 1 by default on this configuration,# Some issue could occurs on Microsoft Active Directory server. # If you encounter some issue on LDAP lookup, set the value of the parameter to 0 fast_search 1 -Kevin

3 7

Re: Cert Issue
by Rob Crittenden 10 Sep '19

10 Sep '19

Randy Morgan wrote: > On 9/9/2019 11:31 AM, Rob Crittenden wrote: >> Randy Morgan via FreeIPA-users wrote: >>> We have been working to solve an expired certificate issue in IPA. >>> There is an open ticket in Red Hat supportCASE 02438518. We have tried >>> many things but so far have had no luck getting the certs to update. >>> Currently the system is running RHEL 8.0 and IPA 4.7.1. >>> >>> pki-server cert-fix -n 'subsystemCert cert-pki-ca' -d >>> /var/lib/pki/pki-tomcat/alias/ -C /root/passwd -vvv >>> INFO: Loading instance: pki-tomcat >>> INFO: Loading instance registry: >>> /etc/sysconfig/pki/tomcat/pki-tomcat/pki-tomcat >>> INFO: Loading password config: /etc/pki/pki-tomcat/password.conf >>> INFO: Loading subsystem: ca >>> INFO: Loading subsystem config: /var/lib/pki/pki-tomcat/ca/conf/CS.cfg >>> INFO: Getting signing cert info for ca from CS.cfg >>> INFO: Getting signing cert info for ca from NSS database >>> INFO: Getting ocsp_signing cert info for ca from CS.cfg >>> INFO: Getting ocsp_signing cert info for ca from NSS database >>> INFO: Getting sslserver cert info for ca from CS.cfg >>> INFO: Getting sslserver cert info for ca from NSS database >>> INFO: Getting subsystem cert info for ca from CS.cfg >>> INFO: Getting subsystem cert info for ca from NSS database >>> INFO: Getting audit_signing cert info for ca from CS.cfg >>> INFO: Getting audit_signing cert info for ca from NSS database >>> INFO: Fixing the following certs: ['ca_ocsp_signing', 'sslserver', >>> 'subsystem', 'ca_audit_signing'] >>> INFO: Stopping the instance to proceed with system cert renewal >>> INFO: Selftests disabled for subsystems: ca >>> INFO: Getting sslserver cert info for ca from CS.cfg >>> INFO: Getting sslserver cert info for ca from NSS database >>> INFO: Trying to create a new temp cert for sslserver. >>> INFO: Generate temp SSL certificate >>> INFO: Getting sslserver cert info for ca from CS.cfg >>> INFO: Getting sslserver cert info for ca from NSS database >>> INFO: CSR for sslserver has been written to >>> /tmp/tmpg_738l5a/sslserver.csr >>> INFO: Getting signing cert info for ca from CS.cfg >>> INFO: Getting signing cert info for ca from NSS database >>> INFO: CA cert written to /tmp/tmpg_738l5a/ca_certificate.crt >>> INFO: AKI: 0x1D0F356A3E7A6968A231723231EB22DA5A01F542 >>> INFO: Temp cert for sslserver is available at >>> /etc/pki/pki-tomcat/certs/sslserver.crt. >>> INFO: Getting sslserver cert info for ca from CS.cfg >>> INFO: Getting sslserver cert info for ca from NSS database >>> INFO: Getting sslserver cert info for ca from CS.cfg >>> INFO: Getting sslserver cert info for ca from NSS database >>> INFO: Updating CS.cfg with the new certificate >>> INFO: Getting ocsp_signing cert info for ca from CS.cfg >>> INFO: Getting ocsp_signing cert info for ca from NSS database >>> INFO: Trying to setup a secure connection to CA subsystem. >>> INFO: Secure connection with CA is established. >>> INFO: Placing cert creation request for serial: 49 >>> Traceback (most recent call last): >>> File "/usr/lib/python3.6/site-packages/urllib3/connectionpool.py", >>> line 600, in urlopen >>> chunked=chunked) >>> File "/usr/lib/python3.6/site-packages/urllib3/connectionpool.py", >>> line 343, in _make_request >>> self._validate_conn(conn) >>> File "/usr/lib/python3.6/site-packages/urllib3/connectionpool.py", >>> line 849, in _validate_conn >>> conn.connect() >>> File "/usr/lib/python3.6/site-packages/urllib3/connection.py", >>> line 356, in connect >>> ssl_context=context) >>> File "/usr/lib/python3.6/site-packages/urllib3/util/ssl_.py", line >>> 350, in ssl_wrap_socket >>> context.load_cert_chain(certfile, keyfile) >>> ssl.SSLError: [X509: KEY_VALUES_MISMATCH] key values mismatch >>> (_ssl.c:3550) >>> >>> During handling of the above exception, another exception occurred: >>> >>> Traceback (most recent call last): >>> File "/usr/lib/python3.6/site-packages/requests/adapters.py", line >>> 449, in send >>> timeout=timeout >>> File "/usr/lib/python3.6/site-packages/urllib3/connectionpool.py", >>> line 638, in urlopen >>> _stacktrace=sys.exc_info()[2]) >>> File "/usr/lib/python3.6/site-packages/urllib3/util/retry.py", >>> line 398, in increment >>> raise MaxRetryError(_pool, url, error or ResponseError(cause)) >>> urllib3.exceptions.MaxRetryError: >>> HTTPSConnectionPool(host='ipa2.chem.byu.edu', port=8443): Max retries >>> exceeded with url: /ca/rest/certrequests/profiles/caManualRenewal >>> (Caused by SSLError(SSLError(185073780, '[X509: KEY_VALUES_MISMATCH] >>> key values mismatch (_ssl.c:3550)'),)) >>> >>> During handling of the above exception, another exception occurred: >>> >>> Traceback (most recent call last): >>> File "/usr/lib/python3.6/site-packages/pki/server/pkiserver.py", >>> line 119, in <module> >>> cli.execute(sys.argv) >>> File "/usr/lib/python3.6/site-packages/pki/server/pkiserver.py", >>> line 111, in execute >>> super(PKIServerCLI, self).execute(args) >>> File "/usr/lib/python3.6/site-packages/pki/cli/__init__.py", line >>> 204, in execute >>> module.execute(module_args) >>> File "/usr/lib/python3.6/site-packages/pki/cli/__init__.py", line >>> 204, in execute >>> module.execute(module_args) >>> File "/usr/lib/python3.6/site-packages/pki/server/cli/cert.py", >>> line 1154, in execute >>> renew=True) >>> File "/usr/lib/python3.6/site-packages/pki/server/__init__.py", >>> line 1709, in cert_create >>> PKIServer.renew_certificate(connection, new_cert_file, serial) >>> File "/usr/lib/python3.6/site-packages/pki/server/__init__.py", >>> line 202, in renew_certificate >>> ret = cert_client.enroll_cert(inputs=inputs, >>> profile_id='caManualRenewal') >>> File "/usr/lib/python3.6/site-packages/pki/__init__.py", line 442, >>> in handler >>> return fn_call(inst, *args, **kwargs) >>> File "/usr/lib/python3.6/site-packages/pki/cert.py", line 1011, in >>> enroll_cert >>> enroll_request = self.create_enrollment_request(profile_id, inputs) >>> File "/usr/lib/python3.6/site-packages/pki/__init__.py", line 442, >>> in handler >>> return fn_call(inst, *args, **kwargs) >>> File "/usr/lib/python3.6/site-packages/pki/cert.py", line 962, in >>> create_enrollment_request >>> enrollment_template = self.get_enrollment_template(profile_id) >>> File "/usr/lib/python3.6/site-packages/pki/__init__.py", line 442, >>> in handler >>> return fn_call(inst, *args, **kwargs) >>> File "/usr/lib/python3.6/site-packages/pki/cert.py", line 942, in >>> get_enrollment_template >>> r = self.connection.get(url, self.headers) >>> File "/usr/lib/python3.6/site-packages/pki/client.py", line 46, in >>> wrapper >>> return func(self, *args, **kwargs) >>> File "/usr/lib/python3.6/site-packages/pki/client.py", line 160, >>> in get >>> timeout=timeout, >>> File "/usr/lib/python3.6/site-packages/requests/sessions.py", line >>> 537, in get >>> return self.request('GET', url, **kwargs) >>> File "/usr/lib/python3.6/site-packages/requests/sessions.py", line >>> 524, in request >>> resp = self.send(prep, **send_kwargs) >>> File "/usr/lib/python3.6/site-packages/requests/sessions.py", line >>> 637, in send >>> r = adapter.send(request, **kwargs) >>> File "/usr/lib/python3.6/site-packages/requests/adapters.py", line >>> 514, in send >>> raise SSLError(e, request=request) >>> requests.exceptions.SSLError: >>> HTTPSConnectionPool(host='ipa2.chem.byu.edu', port=8443): Max retries >>> exceeded with url: /ca/rest/certrequests/profiles/caManualRenewal >>> (Caused by SSLError(SSLError(185073780, '[X509: KEY_VALUES_MISMATCH] >>> key values mismatch (_ssl.c:3550)'),)) >>> ERROR: HTTPSConnectionPool(host='ipa2.chem.byu.edu', port=8443): Max >>> retries exceeded with url: >>> /ca/rest/certrequests/profiles/caManualRenewal (Caused by >>> SSLError(SSLError(185073780, '[X509: KEY_VALUES_MISMATCH] key values >>> mismatch (_ssl.c:3550)'),)) >>> >>> [root@ipa2 ~]# echo "--Certificate:" && openssl x509 -noout -modulus -in >>> /var/lib/ipa/ra-agent.pem && echo "--Key:" && openssl rsa -noout >>> -modulus -in /var/lib/ipa/ra-agent.key >>> --Certificate: >>> Modulus=CBA68178847F53CC0D4A45871FEA7CCFD879D6423923DF75E557011E4C458BD5207ACBB4EAFC7A460C050878621E22406E7661105F7D8E7AF448AA1F0988C908F3173B77D87581BE7006ED09F76F0D4D736050088E986133DE851A0FB93A101AA77921CC24063A94E5076FD74D4D81139E7A2AAC61B86D07D424158CE56913ABB08C1CDBDAE35CE2D7BCEB9EF9D5A909FFF502A02E1E847DC44E8672A8889A65A721DC78FE70C24D9E12BB4E88D7AD0A49948E2BF40A22431731872ADFC3B81E368C655EB9B00DC37D04526EE2917445D2FAEBCF116821486FF088E500F12128A8D90309E8ED275CDD48E77BDE0E3358A6A81BD9DD2AD5AC6F68315C96FC50E9 >>> >>> --Key: >>> Modulus=CBA68178847F53CC0D4A45871FEA7CCFD879D6423923DF75E557011E4C458BD5207ACBB4EAFC7A460C050878621E22406E7661105F7D8E7AF448AA1F0988C908F3173B77D87581BE7006ED09F76F0D4D736050088E986133DE851A0FB93A101AA77921CC24063A94E5076FD74D4D81139E7A2AAC61B86D07D424158CE56913ABB08C1CDBDAE35CE2D7BCEB9EF9D5A909FFF502A02E1E847DC44E8672A8889A65A721DC78FE70C24D9E12BB4E88D7AD0A49948E2BF40A22431731872ADFC3B81E368C655EB9B00DC37D04526EE2917445D2FAEBCF116821486FF088E500F12128A8D90309E8ED275CDD48E77BDE0E3358A6A81BD9DD2AD5AC6F68315C96FC50E9 >>> >>> [root@ipa2 ~]# openssl rsa -noout -modulus -in /var/lib/ipa/ra-agent.key >>> | openssl md5 >>> (stdin)= 0915781edbe620c5791cda50f310c538 >>> [root@ipa2 ~]# openssl x509 -noout -modulus -in >>> /var/lib/ipa/ra-agent.pem | openssl md5 >>> (stdin)= 0915781edbe620c5791cda50f310c538 >>> >>> Looking at the cert and the key, they are a match and modulus also >>> matches. What I can't figure out is why I am seeing this error if the >>> key and cert match. Is it possible to have a timestamp issue, or is >>> there some other reason that I can't find. Any help would be greatly >>> appreciated. >> I'm not familiar with this command but based on the options you are >> passing you compared the wrong cert. You compared the RA agent cert and >> you asked to renew the subsystem cert. >> >> You might want to see what cert owns serial number 49. >> >> rob > > > The reason these are the two compared is that there are no other keys on > the server. Looking through the documentation seems to indicate that > all certs are generated from this key pair. Is that not correct, and if > it is not correct then where are the keys located for the other certs, I > have been unable to locate them anywhere on the server. The certs and keys are stored in the NSS database in /etc/pki/pki-tomcat/alias/ rob

1 0

Cert Issue
by Randy Morgan 10 Sep '19

10 Sep '19

We have been working to solve an expired certificate issue in IPA. There is an open ticket in Red Hat supportCASE 02438518. We have tried many things but so far have had no luck getting the certs to update. Currently the system is running RHEL 8.0 and IPA 4.7.1. pki-server cert-fix -n 'subsystemCert cert-pki-ca' -d /var/lib/pki/pki-tomcat/alias/ -C /root/passwd -vvv INFO: Loading instance: pki-tomcat INFO: Loading instance registry: /etc/sysconfig/pki/tomcat/pki-tomcat/pki-tomcat INFO: Loading password config: /etc/pki/pki-tomcat/password.conf INFO: Loading subsystem: ca INFO: Loading subsystem config: /var/lib/pki/pki-tomcat/ca/conf/CS.cfg INFO: Getting signing cert info for ca from CS.cfg INFO: Getting signing cert info for ca from NSS database INFO: Getting ocsp_signing cert info for ca from CS.cfg INFO: Getting ocsp_signing cert info for ca from NSS database INFO: Getting sslserver cert info for ca from CS.cfg INFO: Getting sslserver cert info for ca from NSS database INFO: Getting subsystem cert info for ca from CS.cfg INFO: Getting subsystem cert info for ca from NSS database INFO: Getting audit_signing cert info for ca from CS.cfg INFO: Getting audit_signing cert info for ca from NSS database INFO: Fixing the following certs: ['ca_ocsp_signing', 'sslserver', 'subsystem', 'ca_audit_signing'] INFO: Stopping the instance to proceed with system cert renewal INFO: Selftests disabled for subsystems: ca INFO: Getting sslserver cert info for ca from CS.cfg INFO: Getting sslserver cert info for ca from NSS database INFO: Trying to create a new temp cert for sslserver. INFO: Generate temp SSL certificate INFO: Getting sslserver cert info for ca from CS.cfg INFO: Getting sslserver cert info for ca from NSS database INFO: CSR for sslserver has been written to /tmp/tmpg_738l5a/sslserver.csr INFO: Getting signing cert info for ca from CS.cfg INFO: Getting signing cert info for ca from NSS database INFO: CA cert written to /tmp/tmpg_738l5a/ca_certificate.crt INFO: AKI: 0x1D0F356A3E7A6968A231723231EB22DA5A01F542 INFO: Temp cert for sslserver is available at /etc/pki/pki-tomcat/certs/sslserver.crt. INFO: Getting sslserver cert info for ca from CS.cfg INFO: Getting sslserver cert info for ca from NSS database INFO: Getting sslserver cert info for ca from CS.cfg INFO: Getting sslserver cert info for ca from NSS database INFO: Updating CS.cfg with the new certificate INFO: Getting ocsp_signing cert info for ca from CS.cfg INFO: Getting ocsp_signing cert info for ca from NSS database INFO: Trying to setup a secure connection to CA subsystem. INFO: Secure connection with CA is established. INFO: Placing cert creation request for serial: 49 Traceback (most recent call last): File "/usr/lib/python3.6/site-packages/urllib3/connectionpool.py", line 600, in urlopen chunked=chunked) File "/usr/lib/python3.6/site-packages/urllib3/connectionpool.py", line 343, in _make_request self._validate_conn(conn) File "/usr/lib/python3.6/site-packages/urllib3/connectionpool.py", line 849, in _validate_conn conn.connect() File "/usr/lib/python3.6/site-packages/urllib3/connection.py", line 356, in connect ssl_context=context) File "/usr/lib/python3.6/site-packages/urllib3/util/ssl_.py", line 350, in ssl_wrap_socket context.load_cert_chain(certfile, keyfile) ssl.SSLError: [X509: KEY_VALUES_MISMATCH] key values mismatch (_ssl.c:3550) During handling of the above exception, another exception occurred: Traceback (most recent call last): File "/usr/lib/python3.6/site-packages/requests/adapters.py", line 449, in send timeout=timeout File "/usr/lib/python3.6/site-packages/urllib3/connectionpool.py", line 638, in urlopen _stacktrace=sys.exc_info()[2]) File "/usr/lib/python3.6/site-packages/urllib3/util/retry.py", line 398, in increment raise MaxRetryError(_pool, url, error or ResponseError(cause)) urllib3.exceptions.MaxRetryError: HTTPSConnectionPool(host='ipa2.chem.byu.edu', port=8443): Max retries exceeded with url: /ca/rest/certrequests/profiles/caManualRenewal (Caused by SSLError(SSLError(185073780, '[X509: KEY_VALUES_MISMATCH] key values mismatch (_ssl.c:3550)'),)) During handling of the above exception, another exception occurred: Traceback (most recent call last): File "/usr/lib/python3.6/site-packages/pki/server/pkiserver.py", line 119, in <module> cli.execute(sys.argv) File "/usr/lib/python3.6/site-packages/pki/server/pkiserver.py", line 111, in execute super(PKIServerCLI, self).execute(args) File "/usr/lib/python3.6/site-packages/pki/cli/__init__.py", line 204, in execute module.execute(module_args) File "/usr/lib/python3.6/site-packages/pki/cli/__init__.py", line 204, in execute module.execute(module_args) File "/usr/lib/python3.6/site-packages/pki/server/cli/cert.py", line 1154, in execute renew=True) File "/usr/lib/python3.6/site-packages/pki/server/__init__.py", line 1709, in cert_create PKIServer.renew_certificate(connection, new_cert_file, serial) File "/usr/lib/python3.6/site-packages/pki/server/__init__.py", line 202, in renew_certificate ret = cert_client.enroll_cert(inputs=inputs, profile_id='caManualRenewal') File "/usr/lib/python3.6/site-packages/pki/__init__.py", line 442, in handler return fn_call(inst, *args, **kwargs) File "/usr/lib/python3.6/site-packages/pki/cert.py", line 1011, in enroll_cert enroll_request = self.create_enrollment_request(profile_id, inputs) File "/usr/lib/python3.6/site-packages/pki/__init__.py", line 442, in handler return fn_call(inst, *args, **kwargs) File "/usr/lib/python3.6/site-packages/pki/cert.py", line 962, in create_enrollment_request enrollment_template = self.get_enrollment_template(profile_id) File "/usr/lib/python3.6/site-packages/pki/__init__.py", line 442, in handler return fn_call(inst, *args, **kwargs) File "/usr/lib/python3.6/site-packages/pki/cert.py", line 942, in get_enrollment_template r = self.connection.get(url, self.headers) File "/usr/lib/python3.6/site-packages/pki/client.py", line 46, in wrapper return func(self, *args, **kwargs) File "/usr/lib/python3.6/site-packages/pki/client.py", line 160, in get timeout=timeout, File "/usr/lib/python3.6/site-packages/requests/sessions.py", line 537, in get return self.request('GET', url, **kwargs) File "/usr/lib/python3.6/site-packages/requests/sessions.py", line 524, in request resp = self.send(prep, **send_kwargs) File "/usr/lib/python3.6/site-packages/requests/sessions.py", line 637, in send r = adapter.send(request, **kwargs) File "/usr/lib/python3.6/site-packages/requests/adapters.py", line 514, in send raise SSLError(e, request=request) requests.exceptions.SSLError: HTTPSConnectionPool(host='ipa2.chem.byu.edu', port=8443): Max retries exceeded with url: /ca/rest/certrequests/profiles/caManualRenewal (Caused by SSLError(SSLError(185073780, '[X509: KEY_VALUES_MISMATCH] key values mismatch (_ssl.c:3550)'),)) ERROR: HTTPSConnectionPool(host='ipa2.chem.byu.edu', port=8443): Max retries exceeded with url: /ca/rest/certrequests/profiles/caManualRenewal (Caused by SSLError(SSLError(185073780, '[X509: KEY_VALUES_MISMATCH] key values mismatch (_ssl.c:3550)'),)) [root@ipa2 ~]# echo "--Certificate:" && openssl x509 -noout -modulus -in /var/lib/ipa/ra-agent.pem && echo "--Key:" && openssl rsa -noout -modulus -in /var/lib/ipa/ra-agent.key --Certificate: Modulus=CBA68178847F53CC0D4A45871FEA7CCFD879D6423923DF75E557011E4C458BD5207ACBB4EAFC7A460C050878621E22406E7661105F7D8E7AF448AA1F0988C908F3173B77D87581BE7006ED09F76F0D4D736050088E986133DE851A0FB93A101AA77921CC24063A94E5076FD74D4D81139E7A2AAC61B86D07D424158CE56913ABB08C1CDBDAE35CE2D7BCEB9EF9D5A909FFF502A02E1E847DC44E8672A8889A65A721DC78FE70C24D9E12BB4E88D7AD0A49948E2BF40A22431731872ADFC3B81E368C655EB9B00DC37D04526EE2917445D2FAEBCF116821486FF088E500F12128A8D90309E8ED275CDD48E77BDE0E3358A6A81BD9DD2AD5AC6F68315C96FC50E9 --Key: Modulus=CBA68178847F53CC0D4A45871FEA7CCFD879D6423923DF75E557011E4C458BD5207ACBB4EAFC7A460C050878621E22406E7661105F7D8E7AF448AA1F0988C908F3173B77D87581BE7006ED09F76F0D4D736050088E986133DE851A0FB93A101AA77921CC24063A94E5076FD74D4D81139E7A2AAC61B86D07D424158CE56913ABB08C1CDBDAE35CE2D7BCEB9EF9D5A909FFF502A02E1E847DC44E8672A8889A65A721DC78FE70C24D9E12BB4E88D7AD0A49948E2BF40A22431731872ADFC3B81E368C655EB9B00DC37D04526EE2917445D2FAEBCF116821486FF088E500F12128A8D90309E8ED275CDD48E77BDE0E3358A6A81BD9DD2AD5AC6F68315C96FC50E9 [root@ipa2 ~]# openssl rsa -noout -modulus -in /var/lib/ipa/ra-agent.key | openssl md5 (stdin)= 0915781edbe620c5791cda50f310c538 [root@ipa2 ~]# openssl x509 -noout -modulus -in /var/lib/ipa/ra-agent.pem | openssl md5 (stdin)= 0915781edbe620c5791cda50f310c538 Looking at the cert and the key, they are a match and modulus also matches. What I can't figure out is why I am seeing this error if the key and cert match. Is it possible to have a timestamp issue, or is there some other reason that I can't find. Any help would be greatly appreciated. Randy Morgan

2 1

NFS failure after upgrade
by Petros Triantafyllidis 07 Sep '19

07 Sep '19

Hi all, I have a setup with two servers running CenOS 7.6 which I updated recently to ipa-server-4.6.4-10.el7.centos.6.x86_64. The update apparently completed successfully and after that I went through the update of several clients (ipa-client-4.6.4-10.el7.centos.6.x86_64) some of which export kerberized nfs shares. However, after the upgrade, the nfs shares are not accessible neither by other clients nor by servers. I don't know if it's a coincidence, but I can access only shares exported by a non-upgraded client. When trying to mount by hand from server (:fidias) with admin credentials I receive: [root@fidias]# mount -t nfs4 -o sec=krb5 medusa:/export/teras /teras mount.nfs4: access denied by server while mounting medusa:/export/teras [root@fidias]# ipa-getkeytab -r -s fidias.geo.auth.gr -p nfs/medusa.geo.auth.gr -k medusa-nfs.keytab Failed to parse result: Insufficient access rights Failed to get keytab [root@fidias]# KRB5_TRACE=/dev/stderr kinit -k -t /etc/krb5.keytab nfs/medusa.geo.auth.gr [26055] 1567693076.930983: Resolving unique ccache of type KEYRING [26055] 1567693076.930984: Getting initial credentials for nfs/medusa.geo.auth.gr(a)GEO.SS.LAN [26055] 1567693076.930985: Looked up etypes in keytab: (empty) [26055] 1567693076.930986: Getting initial credentials for nfs/medusa.geo.auth.gr(a)GEO.SS.LAN [26055] 1567693076.930987: Looked up etypes in keytab: (empty) kinit: Keytab contains no suitable keys for nfs/medusa.geo.auth.gr(a)GEO.SS.LAN while getting initial credentials How can this be fixed? Thanks in advance, Petros -- Dr. TRIANTAFYLLIDIS PETROS Aristotle University - Department of Geophysics, POBox 112, 54124 Thessaloniki,GREECE-TEL:+30-2310998585,FAX:2310991403

2 2

subCA OCSP on IPA Replica
by David Etchen 06 Sep '19

06 Sep '19

Hi Guys, I have a 2 host basic IPA setup both IPA servers are running dns & ca. I'm running on Centos 7.6 using freeipa version 4.6.4 & dogtag version 10.5.9 I've made a subCA called vpnca and a certificate policy and all this is working fine with the exception of OCSP on the 2nd IPA box. The original master works fine and issues OCSP responses for certifcates issued by the vpnca (subCA) however the replica IPA box fails to respond. I've had a look through the logs and found in the /var/log/pki/pki-tomcat/ca/debug log an error on the 2nd box when doing an OCSP request against it for a certificate issued by the subCA. I should note here that OCSP requests for certificates issued by the main IPA CA work fine it's only for ones issued by the subCA on the replica that seem to be broken. I have also spotted the 2nd IPA server complaining that is can't get caSigningCert [04/Sep/2019:13:24:01][KeyRetrieverRunner-dd4ea812-c044-41c0-93bf-ec376c732c93]: Running ExternalProcessKeyRetriever [04/Sep/2019:13:24:01][KeyRetrieverRunner-dd4ea812-c044-41c0-93bf-ec376c732c93]: About to execute command: [/usr/libexec/ipa/ipa-pki-retrieve-key, caSigningCert cert-pki-ca dd4ea812-c044-41c0-93bf-ec376c732c93, man-fb-ipa-01.testhost.com] [04/Sep/2019:13:24:02][KeyRetrieverRunner-dd4ea812-c044-41c0-93bf-ec376c732c93]: Failed to retrieve key from any host. [04/Sep/2019:13:24:02][KeyRetrieverRunner-dd4ea812-c044-41c0-93bf-ec376c732c93]: KeyRetriever did not return a result. [04/Sep/2019:13:24:02][KeyRetrieverRunner-dd4ea812-c044-41c0-93bf-ec376c732c93]: Retrying in 1946 seconds I'm presuming this is the reason OCSP is failing as it can't sign the response for the subCA? Does anyone know if this is a known issue or if there is something I need to modify to get the OCSP working on the replica host? Any help would be greatly appreciated Thanks Dave See logs below. 2nd IPA Replica (Broken) /var/log/pki/pki-tomcat/ca/debug [04/Sep/2019:12:25:13][ajp-bio-127.0.0.1-8009-exec-1]: CMSServlet:service() uri = /ca/ocsp [04/Sep/2019:12:25:13][ajp-bio-127.0.0.1-8009-exec-1]: CMSServlet: caOCSP start to service. [04/Sep/2019:12:25:13][ajp-bio-127.0.0.1-8009-exec-1]: IP: 10.128.164.2 [04/Sep/2019:12:25:13][ajp-bio-127.0.0.1-8009-exec-1]: CMSServlet: no authMgrName [04/Sep/2019:12:25:13][ajp-bio-127.0.0.1-8009-exec-1]: CMSServlet.authorize(DirAclAuthz) [04/Sep/2019:12:25:13][ajp-bio-127.0.0.1-8009-exec-1]: CMSServlet: in auditSubjectID [04/Sep/2019:12:25:13][ajp-bio-127.0.0.1-8009-exec-1]: CMSServlet: auditSubjectID auditContext {locale=en_GB, ipAddress=10.128.164.2} [04/Sep/2019:12:25:13][ajp-bio-127.0.0.1-8009-exec-1]: CMSServlet auditSubjectID: subjectID: null [04/Sep/2019:12:25:13][ajp-bio-127.0.0.1-8009-exec-1]: CMSServlet: in auditGroupID [04/Sep/2019:12:25:13][ajp-bio-127.0.0.1-8009-exec-1]: CMSServlet: auditGroupID auditContext {locale=en_GB, ipAddress=10.128.164.2} [04/Sep/2019:12:25:13][ajp-bio-127.0.0.1-8009-exec-1]: CMSServlet auditGroupID: groupID: null [04/Sep/2019:12:25:13][ajp-bio-127.0.0.1-8009-exec-1]: In LdapBoundConnFactory::getConn() [04/Sep/2019:12:25:13][ajp-bio-127.0.0.1-8009-exec-1]: masterConn is connected: true [04/Sep/2019:12:25:13][ajp-bio-127.0.0.1-8009-exec-1]: getConn: conn is connected true [04/Sep/2019:12:25:13][ajp-bio-127.0.0.1-8009-exec-1]: getConn: mNumConns now 2 [04/Sep/2019:12:25:13][ajp-bio-127.0.0.1-8009-exec-1]: returnConn: mNumConns now 3 [04/Sep/2019:12:25:13][ajp-bio-127.0.0.1-8009-exec-1]: AAclAuthz.checkPermission(certServer.ee.request.ocsp, submit) [04/Sep/2019:12:25:13][ajp-bio-127.0.0.1-8009-exec-1]: checkAllowEntries(): expressions: ipaddress=".*" [04/Sep/2019:12:25:13][ajp-bio-127.0.0.1-8009-exec-1]: evaluating expressions: ipaddress=".*" [04/Sep/2019:12:25:13][ajp-bio-127.0.0.1-8009-exec-1]: evaluated expression: ipaddress=".*" to be true [04/Sep/2019:12:25:13][ajp-bio-127.0.0.1-8009-exec-1]: DirAclAuthz: authorization passed [04/Sep/2019:12:25:13][ajp-bio-127.0.0.1-8009-exec-1]: SignedAuditLogger: event AUTHZ [04/Sep/2019:12:25:13][ajp-bio-127.0.0.1-8009-exec-1]: OCSPServlet: Servlet Path: /ocsp [04/Sep/2019:12:25:13][ajp-bio-127.0.0.1-8009-exec-1]: OCSPServlet: RequestURI: /ca/ocsp [04/Sep/2019:12:25:13][ajp-bio-127.0.0.1-8009-exec-1]: OCSPServlet: PathInfo: null [04/Sep/2019:12:25:13][ajp-bio-127.0.0.1-8009-exec-1]: OCSPServlet: HTTP method: POST [04/Sep/2019:12:25:13][ajp-bio-127.0.0.1-8009-exec-1]: OCSPServlet: processing POST request [04/Sep/2019:12:25:13][ajp-bio-127.0.0.1-8009-exec-1]: OCSPServlet: decoding request [04/Sep/2019:12:25:13][ajp-bio-127.0.0.1-8009-exec-1]: OCSPServlet: validating request [04/Sep/2019:12:25:13][ajp-bio-127.0.0.1-8009-exec-1]: In LdapBoundConnFactory::getConn() [04/Sep/2019:12:25:13][ajp-bio-127.0.0.1-8009-exec-1]: masterConn is connected: true [04/Sep/2019:12:25:13][ajp-bio-127.0.0.1-8009-exec-1]: getConn: conn is connected true [04/Sep/2019:12:25:13][ajp-bio-127.0.0.1-8009-exec-1]: getConn: mNumConns now 2 [04/Sep/2019:12:25:14][ajp-bio-127.0.0.1-8009-exec-1]: returnConn: mNumConns now 3 [04/Sep/2019:12:25:14][ajp-bio-127.0.0.1-8009-exec-1]: In LdapBoundConnFactory::getConn() [04/Sep/2019:12:25:14][ajp-bio-127.0.0.1-8009-exec-1]: masterConn is connected: true [04/Sep/2019:12:25:14][ajp-bio-127.0.0.1-8009-exec-1]: getConn: conn is connected true [04/Sep/2019:12:25:14][ajp-bio-127.0.0.1-8009-exec-1]: getConn: mNumConns now 2 [04/Sep/2019:12:25:14][ajp-bio-127.0.0.1-8009-exec-1]: returnConn: mNumConns now 3 [04/Sep/2019:12:25:14][ajp-bio-127.0.0.1-8009-exec-1]: CertificateAuthority: validating OCSP request [04/Sep/2019:12:25:14][ajp-bio-127.0.0.1-8009-exec-1]: CertificateAuthority: processing request for cert 0x1b [04/Sep/2019:12:25:14][ajp-bio-127.0.0.1-8009-exec-1]: In LdapBoundConnFactory::getConn() [04/Sep/2019:12:25:14][ajp-bio-127.0.0.1-8009-exec-1]: masterConn is connected: true [04/Sep/2019:12:25:14][ajp-bio-127.0.0.1-8009-exec-1]: getConn: conn is connected true [04/Sep/2019:12:25:14][ajp-bio-127.0.0.1-8009-exec-1]: getConn: mNumConns now 2 [04/Sep/2019:12:25:14][ajp-bio-127.0.0.1-8009-exec-1]: returnConn: mNumConns now 3 java.lang.NullPointerException at com.netscape.ca.CertificateAuthority.getResponderIDByName(CertificateAuthority.java:2340) at com.netscape.ca.CertificateAuthority.validate(CertificateAuthority.java:2473) at com.netscape.ca.CertificateAuthority.validate(CertificateAuthority.java:2428) at com.netscape.cms.servlet.ocsp.OCSPServlet.process(OCSPServlet.java:222) at com.netscape.cms.servlet.base.CMSServlet.service(CMSServlet.java:493) at javax.servlet.http.HttpServlet.service(HttpServlet.java:731) at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.lang.reflect.Method.invoke(Method.java:498) at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:288) at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:285) at java.security.AccessController.doPrivileged(Native Method) at javax.security.auth.Subject.doAsPrivileged(Subject.java:549) at org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:320) at org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:175) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:297) at org.apache.catalina.core.ApplicationFilterChain.access$000(ApplicationFilterChain.java:55) at org.apache.catalina.core.ApplicationFilterChain$1.run(ApplicationFilterChain.java:191) at org.apache.catalina.core.ApplicationFilterChain$1.run(ApplicationFilterChain.java:187) at java.security.AccessController.doPrivileged(Native Method) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:186) at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52) at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.lang.reflect.Method.invoke(Method.java:498) at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:288) at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:285) at java.security.AccessController.doPrivileged(Native Method) at javax.security.auth.Subject.doAsPrivileged(Subject.java:549) at org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:320) at org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:260) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:237) at org.apache.catalina.core.ApplicationFilterChain.access$000(ApplicationFilterChain.java:55) at org.apache.catalina.core.ApplicationFilterChain$1.run(ApplicationFilterChain.java:191) at org.apache.catalina.core.ApplicationFilterChain$1.run(ApplicationFilterChain.java:187) at java.security.AccessController.doPrivileged(Native Method) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:186) at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:218) at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:110) at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:506) at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:169) at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:103) at org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:962) at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:116) at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:445) at org.apache.coyote.ajp.AjpProcessor.process(AjpProcessor.java:190) at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:637) at org.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:316) at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) at java.lang.Thread.run(Thread.java:748) [04/Sep/2019:12:25:14][ajp-bio-127.0.0.1-8009-exec-1]: CMSServlet: in auditSubjectID [04/Sep/2019:12:25:14][ajp-bio-127.0.0.1-8009-exec-1]: CMSServlet: auditSubjectID auditContext {locale=en_GB, ipAddress=10.128.164.2} [04/Sep/2019:12:25:14][ajp-bio-127.0.0.1-8009-exec-1]: CMSServlet auditSubjectID: subjectID: null [04/Sep/2019:12:25:14][ajp-bio-127.0.0.1-8009-exec-1]: SignedAuditLogger: event OCSP_GENERATION [04/Sep/2019:12:25:14][ajp-bio-127.0.0.1-8009-exec-1]: OCSPServlet: response is null [04/Sep/2019:12:25:14][ajp-bio-127.0.0.1-8009-exec-1]: CMSServlet.java: renderTemplate [04/Sep/2019:12:25:14][ajp-bio-127.0.0.1-8009-exec-1]: CMSServlet: curDate=Wed Sep 04 12:25:14 BST 2019 id=caOCSP time=213 If I look at 1st IPA server which is working I see 1st IPA Master (Working) /var/log/pki/pki-tomcat/ca/debug [04/Sep/2019:13:22:06][ajp-bio-127.0.0.1-8009-exec-15]: CMSServlet:service() uri = /ca/ocsp [04/Sep/2019:13:22:06][ajp-bio-127.0.0.1-8009-exec-15]: CMSServlet: caOCSP start to service. [04/Sep/2019:13:22:06][ajp-bio-127.0.0.1-8009-exec-15]: IP: 10.128.167.2 [04/Sep/2019:13:22:06][ajp-bio-127.0.0.1-8009-exec-15]: CMSServlet: no authMgrName [04/Sep/2019:13:22:06][ajp-bio-127.0.0.1-8009-exec-15]: CMSServlet.authorize(DirAclAuthz) [04/Sep/2019:13:22:06][ajp-bio-127.0.0.1-8009-exec-15]: CMSServlet: in auditSubjectID [04/Sep/2019:13:22:06][ajp-bio-127.0.0.1-8009-exec-15]: CMSServlet: auditSubjectID auditContext {locale=en_GB, ipAddress=10.128.167.2} [04/Sep/2019:13:22:06][ajp-bio-127.0.0.1-8009-exec-15]: CMSServlet auditSubjectID: subjectID: null [04/Sep/2019:13:22:06][ajp-bio-127.0.0.1-8009-exec-15]: CMSServlet: in auditGroupID [04/Sep/2019:13:22:06][ajp-bio-127.0.0.1-8009-exec-15]: CMSServlet: auditGroupID auditContext {locale=en_GB, ipAddress=10.128.167.2} [04/Sep/2019:13:22:06][ajp-bio-127.0.0.1-8009-exec-15]: CMSServlet auditGroupID: groupID: null [04/Sep/2019:13:22:06][ajp-bio-127.0.0.1-8009-exec-15]: In LdapBoundConnFactory::getConn() [04/Sep/2019:13:22:06][ajp-bio-127.0.0.1-8009-exec-15]: masterConn is connected: true [04/Sep/2019:13:22:06][ajp-bio-127.0.0.1-8009-exec-15]: getConn: conn is connected true [04/Sep/2019:13:22:06][ajp-bio-127.0.0.1-8009-exec-15]: getConn: mNumConns now 2 [04/Sep/2019:13:22:06][ajp-bio-127.0.0.1-8009-exec-15]: returnConn: mNumConns now 3 [04/Sep/2019:13:22:06][ajp-bio-127.0.0.1-8009-exec-15]: AAclAuthz.checkPermission(certServer.ee.request.ocsp, submit) [04/Sep/2019:13:22:06][ajp-bio-127.0.0.1-8009-exec-15]: checkAllowEntries(): expressions: ipaddress=".*" [04/Sep/2019:13:22:06][ajp-bio-127.0.0.1-8009-exec-15]: evaluating expressions: ipaddress=".*" [04/Sep/2019:13:22:06][ajp-bio-127.0.0.1-8009-exec-15]: evaluated expression: ipaddress=".*" to be true [04/Sep/2019:13:22:06][ajp-bio-127.0.0.1-8009-exec-15]: DirAclAuthz: authorization passed [04/Sep/2019:13:22:06][ajp-bio-127.0.0.1-8009-exec-15]: SignedAuditLogger: event AUTHZ [04/Sep/2019:13:22:06][ajp-bio-127.0.0.1-8009-exec-15]: OCSPServlet: Servlet Path: /ocsp [04/Sep/2019:13:22:06][ajp-bio-127.0.0.1-8009-exec-15]: OCSPServlet: RequestURI: /ca/ocsp [04/Sep/2019:13:22:06][ajp-bio-127.0.0.1-8009-exec-15]: OCSPServlet: PathInfo: null [04/Sep/2019:13:22:06][ajp-bio-127.0.0.1-8009-exec-15]: OCSPServlet: HTTP method: POST [04/Sep/2019:13:22:06][ajp-bio-127.0.0.1-8009-exec-15]: OCSPServlet: processing POST request [04/Sep/2019:13:22:06][ajp-bio-127.0.0.1-8009-exec-15]: OCSPServlet: decoding request [04/Sep/2019:13:22:06][ajp-bio-127.0.0.1-8009-exec-15]: OCSPServlet: validating request [04/Sep/2019:13:22:06][ajp-bio-127.0.0.1-8009-exec-15]: In LdapBoundConnFactory::getConn() [04/Sep/2019:13:22:06][ajp-bio-127.0.0.1-8009-exec-15]: masterConn is connected: true [04/Sep/2019:13:22:06][ajp-bio-127.0.0.1-8009-exec-15]: getConn: conn is connected true [04/Sep/2019:13:22:06][ajp-bio-127.0.0.1-8009-exec-15]: getConn: mNumConns now 4 [04/Sep/2019:13:22:06][ajp-bio-127.0.0.1-8009-exec-15]: returnConn: mNumConns now 5 [04/Sep/2019:13:22:06][ajp-bio-127.0.0.1-8009-exec-15]: In LdapBoundConnFactory::getConn() [04/Sep/2019:13:22:06][ajp-bio-127.0.0.1-8009-exec-15]: masterConn is connected: true [04/Sep/2019:13:22:06][ajp-bio-127.0.0.1-8009-exec-15]: getConn: conn is connected true [04/Sep/2019:13:22:06][ajp-bio-127.0.0.1-8009-exec-15]: getConn: mNumConns now 4 [04/Sep/2019:13:22:06][ajp-bio-127.0.0.1-8009-exec-15]: returnConn: mNumConns now 5 [04/Sep/2019:13:22:06][ajp-bio-127.0.0.1-8009-exec-15]: CertificateAuthority: validating OCSP request [04/Sep/2019:13:22:06][ajp-bio-127.0.0.1-8009-exec-15]: CertificateAuthority: processing request for cert 0x1b [04/Sep/2019:13:22:06][ajp-bio-127.0.0.1-8009-exec-15]: In LdapBoundConnFactory::getConn() [04/Sep/2019:13:22:06][ajp-bio-127.0.0.1-8009-exec-15]: masterConn is connected: true [04/Sep/2019:13:22:06][ajp-bio-127.0.0.1-8009-exec-15]: getConn: conn is connected true [04/Sep/2019:13:22:06][ajp-bio-127.0.0.1-8009-exec-15]: getConn: mNumConns now 4 [04/Sep/2019:13:22:06][ajp-bio-127.0.0.1-8009-exec-15]: returnConn: mNumConns now 5 [04/Sep/2019:13:22:06][ajp-bio-127.0.0.1-8009-exec-15]: adding signature [04/Sep/2019:13:22:06][ajp-bio-127.0.0.1-8009-exec-15]: Getting algorithm context for SHA256withRSA RSASignatureWithSHA256Digest [04/Sep/2019:13:22:06][ajp-bio-127.0.0.1-8009-exec-15]: Signing Certificate [04/Sep/2019:13:22:06][ajp-bio-127.0.0.1-8009-exec-15]: CMSServlet: in auditSubjectID [04/Sep/2019:13:22:06][ajp-bio-127.0.0.1-8009-exec-15]: CMSServlet: auditSubjectID auditContext {locale=en_GB, ipAddress=10.128.167.2} [04/Sep/2019:13:22:06][ajp-bio-127.0.0.1-8009-exec-15]: CMSServlet auditSubjectID: subjectID: null [04/Sep/2019:13:22:06][ajp-bio-127.0.0.1-8009-exec-15]: SignedAuditLogger: event OCSP_GENERATION [04/Sep/2019:13:22:06][ajp-bio-127.0.0.1-8009-exec-15]: OCSPServlet: OCSP Request: [04/Sep/2019:13:22:06][ajp-bio-127.0.0.1-8009-exec-15]: OCSPServlet: MGwwaqADAgEAMD4wPDA6MAkGBSsOAwIaBQAEFK377uGJz9Owh8lyIT07pU1YHAEs^M BBTDA9mf27XJPVL0EOy+SaFKAxCZhAIBG6IjMCEwHwYJKwYBBQUHMAECBBIEEJMj^M ZAn0Vjd91e0eZdmHXyo=^M [04/Sep/2019:13:22:06][ajp-bio-127.0.0.1-8009-exec-15]: Serial Number: 27 [04/Sep/2019:13:22:06][ajp-bio-127.0.0.1-8009-exec-15]: OCSPServlet: OCSP Response Size: [04/Sep/2019:13:22:06][ajp-bio-127.0.0.1-8009-exec-15]: OCSPServlet: 2364 [04/Sep/2019:13:22:06][ajp-bio-127.0.0.1-8009-exec-15]: OCSPServlet: OCSP Response Data: **SNIP**

2 8

Problems joining an Ubuntu client to IPA server and using AD Credentials
by Jokinen Eemeli 06 Sep '19

06 Sep '19

Hi! I have a problem I could use help on resolving: We have a working IPA Cluster and I try to join in with Ubuntu 16.04 freeipa-client. Everything seems to go smoothly, it creates config files that look just right. However when I try to login with SSH using AD Credentials I've joined the IPA with I can't login and auth.log gives me an error -- Sep 5 15:46:29 testcomputer2 sshd[1907]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=<ip> user=<user>@<ad.domain> Sep 5 15:46:29 testcomputer2 sshd[1907]: pam_sss(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=<ip> user=<user>@<ad.domain> Sep 5 15:46:29 testcomputer2 sshd[1907]: pam_sss(sshd:auth): received for user <user>@<ad.domain>: 4 (System error) Sep 5 15:46:31 testcomputer2 sshd[1907]: Failed password for <user>@<ad.domain> from <ip> port 42416 ssh2 -- Couldn't find anything solid but then I turned on debug levels and looked into krb5_child.log. Our ipadomain is ipa.company.domain but for some reason it tries to find the username from company.domain and of course it can't find the username there. -- (Thu Sep 5 15:46:29 2019) [[sssd[krb5_child[1909]]]] [tgt_req_child] (0x1000): Attempting to get a TGT (Thu Sep 5 15:46:29 2019) [[sssd[krb5_child[1909]]]] [get_and_save_tgt] (0x0400): Attempting kinit for realm [<company.domain>] (Thu Sep 5 15:46:29 2019) [[sssd[krb5_child[1909]]]] [sss_child_krb5_trace_cb] (0x4000): [1909] 1567687589.927017: Getting initial credentials for <user>@<company.domain> (Thu Sep 5 15:46:29 2019) [[sssd[krb5_child[1909]]]] [sss_child_krb5_trace_cb] (0x4000): [1909] 1567687589.927076: FAST armor ccache: MEMORY:/var/lib/sss/db/fast_ccache_<ipa.company.domain> (Thu Sep 5 15:46:29 2019) [[sssd[krb5_child[1909]]]] [sss_child_krb5_trace_cb] (0x4000): [1909] 1567687589.927109: Retrieving host/testcomputer2.<ipa.company.domain>@<ipa.company.domain> -> krb5_ccache_conf_data/fast_avail/krbtgt\/<company.domain>\@<company.domain>@X-CACHECONF: from MEMORY:/var/lib/sss/db/fast_ccache_<ipa.company.domain> with result: -1765328243/Matching credential not found (Thu Sep 5 15:46:29 2019) [[sssd[krb5_child[1909]]]] [sss_child_krb5_trace_cb] (0x4000): [1909] 1567687589.927151: Sending request (172 bytes) to <company.domain> (Thu Sep 5 15:46:29 2019) [[sssd[krb5_child[1909]]]] [sss_child_krb5_trace_cb] (0x4000): [1909] 1567687589.938377: Retrying AS request with master KDC (Thu Sep 5 15:46:29 2019) [[sssd[krb5_child[1909]]]] [sss_child_krb5_trace_cb] (0x4000): [1909] 1567687589.938418: Getting initial credentials for <user>@<company.domain> (Thu Sep 5 15:46:29 2019) [[sssd[krb5_child[1909]]]] [sss_child_krb5_trace_cb] (0x4000): [1909] 1567687589.938442: FAST armor ccache: MEMORY:/var/lib/sss/db/fast_ccache_<ipa.company.domain> (Thu Sep 5 15:46:29 2019) [[sssd[krb5_child[1909]]]] [sss_child_krb5_trace_cb] (0x4000): [1909] 1567687589.938467: Retrieving host/testcomputer2.<ipa.company.domain>@<ipa.company.domain> -> krb5_ccache_conf_data/fast_avail/krbtgt\/<company.domain>\@<company.domain>@X-CACHECONF: from MEMORY:/var/lib/sss/db/fast_ccache_<ipa.company.domain> with result: -1765328243/Matching credential not found (Thu Sep 5 15:46:29 2019) [[sssd[krb5_child[1909]]]] [sss_child_krb5_trace_cb] (0x4000): [1909] 1567687589.938511: Sending request (172 bytes) to <company.domain> (master) (Thu Sep 5 15:46:29 2019) [[sssd[krb5_child[1909]]]] [get_and_save_tgt] (0x0020): 1232: [-1765328230][Cannot find KDC for realm "<company.domain>"] (Thu Sep 5 15:46:29 2019) [[sssd[krb5_child[1909]]]] [map_krb5_error] (0x0020): 1301: [-1765328230][Cannot find KDC for realm "<company.domain>"] (Thu Sep 5 15:46:29 2019) [[sssd[krb5_child[1909]]]] [k5c_send_data] (0x0200): Received error code 1432158209 (Thu Sep 5 15:46:29 2019) [[sssd[krb5_child[1909]]]] [pack_response_packet] (0x2000): response packet size: [4] (Thu Sep 5 15:46:29 2019) [[sssd[krb5_child[1909]]]] [k5c_send_data] (0x4000): Response sent. (Thu Sep 5 15:46:29 2019) [[sssd[krb5_child[1909]]]] [main] (0x0400): krb5_child completed successfully -- Seems like it converts ad.domain to company.domain and not to ipa.company.domain for some reason. But like I said the configuration on /var/lib/sss/pubconf/krb5.include.d seems legit. -- [domain_realm] .<ad.domain> = <AD.DOMAIN> <ad.domain> = <AD.DOMAIN> [capaths] <AD.DOMAIN> = { <IPA.COMPANY.DOMAIN> = <AD.DOMAIN> } <IPA.COMPANY.DOMAIN> = { <AD.DOMAIN> = <AD.DOMAIN> } -- Any ideas why it's dropping the subdomain out? Eemeli

2 8

Certmonger managed certificate signed by sub-ca
by Ben Rawson 06 Sep '19

06 Sep '19

I'm having some trouble getting sub-ca signed certificates issued and managed by certmonger. The implementation here [https://www.freeipa.org/page/V4/Sub-CAs] describes how that should work. I see that the -X option can be passed to ipa-getcert to specify the issuer, but every time I create a request with -X specified I get an error. Steps to reproduce: 1. Create a new CA named "Test" through the FreeIPA web UI. 2. Run the following on a host enrolled in freeIPA: ipa-getcert request -k /root/test.key -f /root/test.crt -I "testrequest" -X "Test" 3. Run ipa-getcert list and receive the an error message: Request ID 'test': status: CA_REJECTED ca-error: Server at https://ipa02.mgmt.crosschx.com/ipa/xml failed request, will retry: 4035 (RPC failed at server. Request failed with status 500: Non-2xx response from CA REST API: 500. ). stuck: yes key pair storage: type=FILE,location='/root/test.key' certificate: type=FILE,location='/root/test.crt' CA: IPA issuer: subject: expires: unknown pre-save command: post-save command: track: yes auto-renew: yes Running FreeIPA 4.6.4 Thanks for the help!

1 0

KrbException: Identifier doesn't match expected value (906)
by lune voo 06 Sep '19

06 Sep '19

Hello everyone. I am using a old version of IPA (3.0) on a RHEL6.6. (I know it is old ^_^). I send you this mail because I had a problem during the night during the execution of a spark job. The error which occured was the following : 19/09/05 03:06:01 INFO Client: Application report for <MYAPPLICATION> (state: FINISHED) 19/09/05 03:06:01 INFO Client: client token: N/A diagnostics: N/A ApplicationMaster host: <APPMASTERIP> ApplicationMaster RPC port: 0 queue: <QUEUE> start time: 1567040464637 final status: SUCCEEDED tracking URL: http://<RM_HOST>:<RM_PORT>/proxy/<MYAPPLICATION2>/ user: <myuser> Exception in thread "main" java.io.IOException: Login failure for <myuser> from keytab <LOCAL_PATH_FOR_KEYTAB>/<myuser>.headless.keytab: javax.security.auth.login.LoginException: Generic error (description in e-text) (60) - HANDLE_AUTHDATA at org.apache.hadoop.security.UserGroupInformation.loginUserFromKeytabAndReturnUGI(UserGroupInformation.java:1351) at org.apache.spark.deploy.yarn.Client.cleanupStagingDir(Client.scala:210) at org.apache.spark.deploy.yarn.Client.monitorApplication(Client.scala:1204) at org.apache.spark.deploy.yarn.Client.run(Client.scala:1258) at org.apache.spark.deploy.yarn.Client$.main(Client.scala:1307) at org.apache.spark.deploy.yarn.Client.main(Client.scala) at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.lang.reflect.Method.invoke(Method.java:498) at org.apache.spark.deploy.SparkSubmit$.org$apache$spark$deploy$SparkSubmit$$runMain(SparkSubmit.scala:751) at org.apache.spark.deploy.SparkSubmit$.doRunMain$1(SparkSubmit.scala:187) at org.apache.spark.deploy.SparkSubmit$.submit(SparkSubmit.scala:212) at org.apache.spark.deploy.SparkSubmit$.main(SparkSubmit.scala:126) at org.apache.spark.deploy.SparkSubmit.main(SparkSubmit.scala) Caused by: javax.security.auth.login.LoginException: Generic error (description in e-text) (60) - HANDLE_AUTHDATA at com.sun.security.auth.module.Krb5LoginModule.attemptAuthentication(Krb5LoginModule.java:804) at com.sun.security.auth.module.Krb5LoginModule.login(Krb5LoginModule.java:617) at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.lang.reflect.Method.invoke(Method.java:498) at javax.security.auth.login.LoginContext.invoke(LoginContext.java:755) at javax.security.auth.login.LoginContext.access$000(LoginContext.java:195) at javax.security.auth.login.LoginContext$4.run(LoginContext.java:682) at javax.security.auth.login.LoginContext$4.run(LoginContext.java:680) at java.security.AccessController.doPrivileged(Native Method) at javax.security.auth.login.LoginContext.invokePriv(LoginContext.java:680) at javax.security.auth.login.LoginContext.login(LoginContext.java:587) at org.apache.hadoop.security.UserGroupInformation.loginUserFromKeytabAndReturnUGI(UserGroupInformation.java:1340) ... 14 more Caused by: KrbException: Generic error (description in e-text) (60) - HANDLE_AUTHDATA at sun.security.krb5.KrbAsRep.<init>(KrbAsRep.java:82) at sun.security.krb5.KrbAsReqBuilder.send(KrbAsReqBuilder.java:316) at sun.security.krb5.KrbAsReqBuilder.action(KrbAsReqBuilder.java:361) at com.sun.security.auth.module.Krb5LoginModule.attemptAuthentication(Krb5LoginModule.java:776) ... 27 more Caused by: KrbException: Identifier doesn't match expected value (906) at sun.security.krb5.internal.KDCRep.init(KDCRep.java:140) at sun.security.krb5.internal.ASRep.init(ASRep.java:64) at sun.security.krb5.internal.ASRep.<init>(ASRep.java:59) at sun.security.krb5.KrbAsRep.<init>(KrbAsRep.java:60) ... 30 more 19/09/05 03:06:01 INFO ShutdownHookManager: Shutdown hook called The error occurred after the end of a spark job in fact. I was wondering if this kind of error means something for you ? I checked on google and saw the problem could come : 1. from the krb5.conf file 2. from the keytab 3. from the fact that the login of <myuser> is mispelled during the TGT step 4. from the encryption between the client and the server As a note at the beginning of the job, there is a kinit performed on this host and the kinit is OK. So I checked the krb5.conf and it is OK. I checked the keytab file and it is OK. I was wondering if I could see maybe more information on the client side. Do you know where are located the logs on the client side please ? Do you know which logs I could check on server side please ? Best regards. Lune.

1 1

Unable to add external domain global groups
by Martijn Bakkes 05 Sep '19

05 Sep '19

We have a one way trust set up on our IPA with our AD. ( IPA trusting AD ). I am able to add domain local groups as external member is an IPA group. However, when I try to add a domain global group I receive the error: invalid 'trusted domain object': no trusted domain matched the specified flat name Has anybody run in to this issue. I can only find this error referenced in cases where the trust wasn't working.

3 20

Re: kadmin service fails to start
by Mike Conner 04 Sep '19

04 Sep '19

Thanks for the reply. I ran `nestat -tulpn` after restarting the rpcbind service and did not see anything listening on 749. Unfortunately, I didn't think to run it before I restarted the rpcbind service. Is it possible kadmin think the port is in use even after rpcbind has moved off it?

2 1

subCA OCSP on IPA Replica
by David Etchen 04 Sep '19

04 Sep '19

Hi Guys, I have a 2 host basic IPA setup both IPA servers are running dns & ca. I'm running on Centos 7.6 using freeipa version 4.6.4 & dogtag version 10.5.9 I've made a subCA called vpnca and a certificate policy and all this is working fine with the exception of OCSP on the 2nd IPA box. The original master works fine and issues OCSP responses for certifcates issued by the vpnca (subCA) however the replica IPA box fails to respond. I've had a look through the logs and found in the /var/log/pki/pki-tomcat/ca/debug log an error on the 2nd box when doing an OCSP request against it for a certificate issued by the subCA. I should note here that OCSP requests for certificates issued by the main IPA CA work fine it's only for ones issued by the subCA on the replica that seem to be broken. I have also spotted the 2nd IPA server complaining that is can't get caSigningCert [04/Sep/2019:13:24:01][KeyRetrieverRunner-dd4ea812-c044-41c0-93bf-ec376c732c93]: Running ExternalProcessKeyRetriever [04/Sep/2019:13:24:01][KeyRetrieverRunner-dd4ea812-c044-41c0-93bf-ec376c732c93]: About to execute command: [/usr/libexec/ipa/ipa-pki-retrieve-key, caSigningCert cert-pki-ca dd4ea812-c044-41c0-93bf-ec376c732c93, man-fb-ipa-01.testhost.com] [04/Sep/2019:13:24:02][KeyRetrieverRunner-dd4ea812-c044-41c0-93bf-ec376c732c93]: Failed to retrieve key from any host. [04/Sep/2019:13:24:02][KeyRetrieverRunner-dd4ea812-c044-41c0-93bf-ec376c732c93]: KeyRetriever did not return a result. [04/Sep/2019:13:24:02][KeyRetrieverRunner-dd4ea812-c044-41c0-93bf-ec376c732c93]: Retrying in 1946 seconds I'm presuming this is the reason OCSP is failing as it can't sign the response for the subCA? Does anyone know if this is a known issue or if there is something I need to modify to get the OCSP working on the replica host? Any help would be greatly appreciated Thanks Dave See logs below. 2nd IPA Replica (Broken) /var/log/pki/pki-tomcat/ca/debug [04/Sep/2019:12:25:13][ajp-bio-127.0.0.1-8009-exec-1]: CMSServlet:service() uri = /ca/ocsp [04/Sep/2019:12:25:13][ajp-bio-127.0.0.1-8009-exec-1]: CMSServlet: caOCSP start to service. [04/Sep/2019:12:25:13][ajp-bio-127.0.0.1-8009-exec-1]: IP: 10.128.164.2 [04/Sep/2019:12:25:13][ajp-bio-127.0.0.1-8009-exec-1]: CMSServlet: no authMgrName [04/Sep/2019:12:25:13][ajp-bio-127.0.0.1-8009-exec-1]: CMSServlet.authorize(DirAclAuthz) [04/Sep/2019:12:25:13][ajp-bio-127.0.0.1-8009-exec-1]: CMSServlet: in auditSubjectID [04/Sep/2019:12:25:13][ajp-bio-127.0.0.1-8009-exec-1]: CMSServlet: auditSubjectID auditContext {locale=en_GB, ipAddress=10.128.164.2} [04/Sep/2019:12:25:13][ajp-bio-127.0.0.1-8009-exec-1]: CMSServlet auditSubjectID: subjectID: null [04/Sep/2019:12:25:13][ajp-bio-127.0.0.1-8009-exec-1]: CMSServlet: in auditGroupID [04/Sep/2019:12:25:13][ajp-bio-127.0.0.1-8009-exec-1]: CMSServlet: auditGroupID auditContext {locale=en_GB, ipAddress=10.128.164.2} [04/Sep/2019:12:25:13][ajp-bio-127.0.0.1-8009-exec-1]: CMSServlet auditGroupID: groupID: null [04/Sep/2019:12:25:13][ajp-bio-127.0.0.1-8009-exec-1]: In LdapBoundConnFactory::getConn() [04/Sep/2019:12:25:13][ajp-bio-127.0.0.1-8009-exec-1]: masterConn is connected: true [04/Sep/2019:12:25:13][ajp-bio-127.0.0.1-8009-exec-1]: getConn: conn is connected true [04/Sep/2019:12:25:13][ajp-bio-127.0.0.1-8009-exec-1]: getConn: mNumConns now 2 [04/Sep/2019:12:25:13][ajp-bio-127.0.0.1-8009-exec-1]: returnConn: mNumConns now 3 [04/Sep/2019:12:25:13][ajp-bio-127.0.0.1-8009-exec-1]: AAclAuthz.checkPermission(certServer.ee.request.ocsp, submit) [04/Sep/2019:12:25:13][ajp-bio-127.0.0.1-8009-exec-1]: checkAllowEntries(): expressions: ipaddress=".*" [04/Sep/2019:12:25:13][ajp-bio-127.0.0.1-8009-exec-1]: evaluating expressions: ipaddress=".*" [04/Sep/2019:12:25:13][ajp-bio-127.0.0.1-8009-exec-1]: evaluated expression: ipaddress=".*" to be true [04/Sep/2019:12:25:13][ajp-bio-127.0.0.1-8009-exec-1]: DirAclAuthz: authorization passed [04/Sep/2019:12:25:13][ajp-bio-127.0.0.1-8009-exec-1]: SignedAuditLogger: event AUTHZ [04/Sep/2019:12:25:13][ajp-bio-127.0.0.1-8009-exec-1]: OCSPServlet: Servlet Path: /ocsp [04/Sep/2019:12:25:13][ajp-bio-127.0.0.1-8009-exec-1]: OCSPServlet: RequestURI: /ca/ocsp [04/Sep/2019:12:25:13][ajp-bio-127.0.0.1-8009-exec-1]: OCSPServlet: PathInfo: null [04/Sep/2019:12:25:13][ajp-bio-127.0.0.1-8009-exec-1]: OCSPServlet: HTTP method: POST [04/Sep/2019:12:25:13][ajp-bio-127.0.0.1-8009-exec-1]: OCSPServlet: processing POST request [04/Sep/2019:12:25:13][ajp-bio-127.0.0.1-8009-exec-1]: OCSPServlet: decoding request [04/Sep/2019:12:25:13][ajp-bio-127.0.0.1-8009-exec-1]: OCSPServlet: validating request [04/Sep/2019:12:25:13][ajp-bio-127.0.0.1-8009-exec-1]: In LdapBoundConnFactory::getConn() [04/Sep/2019:12:25:13][ajp-bio-127.0.0.1-8009-exec-1]: masterConn is connected: true [04/Sep/2019:12:25:13][ajp-bio-127.0.0.1-8009-exec-1]: getConn: conn is connected true [04/Sep/2019:12:25:13][ajp-bio-127.0.0.1-8009-exec-1]: getConn: mNumConns now 2 [04/Sep/2019:12:25:14][ajp-bio-127.0.0.1-8009-exec-1]: returnConn: mNumConns now 3 [04/Sep/2019:12:25:14][ajp-bio-127.0.0.1-8009-exec-1]: In LdapBoundConnFactory::getConn() [04/Sep/2019:12:25:14][ajp-bio-127.0.0.1-8009-exec-1]: masterConn is connected: true [04/Sep/2019:12:25:14][ajp-bio-127.0.0.1-8009-exec-1]: getConn: conn is connected true [04/Sep/2019:12:25:14][ajp-bio-127.0.0.1-8009-exec-1]: getConn: mNumConns now 2 [04/Sep/2019:12:25:14][ajp-bio-127.0.0.1-8009-exec-1]: returnConn: mNumConns now 3 [04/Sep/2019:12:25:14][ajp-bio-127.0.0.1-8009-exec-1]: CertificateAuthority: validating OCSP request [04/Sep/2019:12:25:14][ajp-bio-127.0.0.1-8009-exec-1]: CertificateAuthority: processing request for cert 0x1b [04/Sep/2019:12:25:14][ajp-bio-127.0.0.1-8009-exec-1]: In LdapBoundConnFactory::getConn() [04/Sep/2019:12:25:14][ajp-bio-127.0.0.1-8009-exec-1]: masterConn is connected: true [04/Sep/2019:12:25:14][ajp-bio-127.0.0.1-8009-exec-1]: getConn: conn is connected true [04/Sep/2019:12:25:14][ajp-bio-127.0.0.1-8009-exec-1]: getConn: mNumConns now 2 [04/Sep/2019:12:25:14][ajp-bio-127.0.0.1-8009-exec-1]: returnConn: mNumConns now 3 java.lang.NullPointerException at com.netscape.ca.CertificateAuthority.getResponderIDByName(CertificateAuthority.java:2340) at com.netscape.ca.CertificateAuthority.validate(CertificateAuthority.java:2473) at com.netscape.ca.CertificateAuthority.validate(CertificateAuthority.java:2428) at com.netscape.cms.servlet.ocsp.OCSPServlet.process(OCSPServlet.java:222) at com.netscape.cms.servlet.base.CMSServlet.service(CMSServlet.java:493) at javax.servlet.http.HttpServlet.service(HttpServlet.java:731) at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.lang.reflect.Method.invoke(Method.java:498) at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:288) at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:285) at java.security.AccessController.doPrivileged(Native Method) at javax.security.auth.Subject.doAsPrivileged(Subject.java:549) at org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:320) at org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:175) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:297) at org.apache.catalina.core.ApplicationFilterChain.access$000(ApplicationFilterChain.java:55) at org.apache.catalina.core.ApplicationFilterChain$1.run(ApplicationFilterChain.java:191) at org.apache.catalina.core.ApplicationFilterChain$1.run(ApplicationFilterChain.java:187) at java.security.AccessController.doPrivileged(Native Method) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:186) at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52) at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.lang.reflect.Method.invoke(Method.java:498) at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:288) at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:285) at java.security.AccessController.doPrivileged(Native Method) at javax.security.auth.Subject.doAsPrivileged(Subject.java:549) at org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:320) at org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:260) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:237) at org.apache.catalina.core.ApplicationFilterChain.access$000(ApplicationFilterChain.java:55) at org.apache.catalina.core.ApplicationFilterChain$1.run(ApplicationFilterChain.java:191) at org.apache.catalina.core.ApplicationFilterChain$1.run(ApplicationFilterChain.java:187) at java.security.AccessController.doPrivileged(Native Method) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:186) at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:218) at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:110) at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:506) at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:169) at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:103) at org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:962) at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:116) at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:445) at org.apache.coyote.ajp.AjpProcessor.process(AjpProcessor.java:190) at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:637) at org.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:316) at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) at java.lang.Thread.run(Thread.java:748) [04/Sep/2019:12:25:14][ajp-bio-127.0.0.1-8009-exec-1]: CMSServlet: in auditSubjectID [04/Sep/2019:12:25:14][ajp-bio-127.0.0.1-8009-exec-1]: CMSServlet: auditSubjectID auditContext {locale=en_GB, ipAddress=10.128.164.2} [04/Sep/2019:12:25:14][ajp-bio-127.0.0.1-8009-exec-1]: CMSServlet auditSubjectID: subjectID: null [04/Sep/2019:12:25:14][ajp-bio-127.0.0.1-8009-exec-1]: SignedAuditLogger: event OCSP_GENERATION [04/Sep/2019:12:25:14][ajp-bio-127.0.0.1-8009-exec-1]: OCSPServlet: response is null [04/Sep/2019:12:25:14][ajp-bio-127.0.0.1-8009-exec-1]: CMSServlet.java: renderTemplate [04/Sep/2019:12:25:14][ajp-bio-127.0.0.1-8009-exec-1]: CMSServlet: curDate=Wed Sep 04 12:25:14 BST 2019 id=caOCSP time=213 If I look at 1st IPA server which is working I see 1st IPA Master (Working) /var/log/pki/pki-tomcat/ca/debug [04/Sep/2019:13:22:06][ajp-bio-127.0.0.1-8009-exec-15]: CMSServlet:service() uri = /ca/ocsp [04/Sep/2019:13:22:06][ajp-bio-127.0.0.1-8009-exec-15]: CMSServlet: caOCSP start to service. [04/Sep/2019:13:22:06][ajp-bio-127.0.0.1-8009-exec-15]: IP: 10.128.167.2 [04/Sep/2019:13:22:06][ajp-bio-127.0.0.1-8009-exec-15]: CMSServlet: no authMgrName [04/Sep/2019:13:22:06][ajp-bio-127.0.0.1-8009-exec-15]: CMSServlet.authorize(DirAclAuthz) [04/Sep/2019:13:22:06][ajp-bio-127.0.0.1-8009-exec-15]: CMSServlet: in auditSubjectID [04/Sep/2019:13:22:06][ajp-bio-127.0.0.1-8009-exec-15]: CMSServlet: auditSubjectID auditContext {locale=en_GB, ipAddress=10.128.167.2} [04/Sep/2019:13:22:06][ajp-bio-127.0.0.1-8009-exec-15]: CMSServlet auditSubjectID: subjectID: null [04/Sep/2019:13:22:06][ajp-bio-127.0.0.1-8009-exec-15]: CMSServlet: in auditGroupID [04/Sep/2019:13:22:06][ajp-bio-127.0.0.1-8009-exec-15]: CMSServlet: auditGroupID auditContext {locale=en_GB, ipAddress=10.128.167.2} [04/Sep/2019:13:22:06][ajp-bio-127.0.0.1-8009-exec-15]: CMSServlet auditGroupID: groupID: null [04/Sep/2019:13:22:06][ajp-bio-127.0.0.1-8009-exec-15]: In LdapBoundConnFactory::getConn() [04/Sep/2019:13:22:06][ajp-bio-127.0.0.1-8009-exec-15]: masterConn is connected: true [04/Sep/2019:13:22:06][ajp-bio-127.0.0.1-8009-exec-15]: getConn: conn is connected true [04/Sep/2019:13:22:06][ajp-bio-127.0.0.1-8009-exec-15]: getConn: mNumConns now 2 [04/Sep/2019:13:22:06][ajp-bio-127.0.0.1-8009-exec-15]: returnConn: mNumConns now 3 [04/Sep/2019:13:22:06][ajp-bio-127.0.0.1-8009-exec-15]: AAclAuthz.checkPermission(certServer.ee.request.ocsp, submit) [04/Sep/2019:13:22:06][ajp-bio-127.0.0.1-8009-exec-15]: checkAllowEntries(): expressions: ipaddress=".*" [04/Sep/2019:13:22:06][ajp-bio-127.0.0.1-8009-exec-15]: evaluating expressions: ipaddress=".*" [04/Sep/2019:13:22:06][ajp-bio-127.0.0.1-8009-exec-15]: evaluated expression: ipaddress=".*" to be true [04/Sep/2019:13:22:06][ajp-bio-127.0.0.1-8009-exec-15]: DirAclAuthz: authorization passed [04/Sep/2019:13:22:06][ajp-bio-127.0.0.1-8009-exec-15]: SignedAuditLogger: event AUTHZ [04/Sep/2019:13:22:06][ajp-bio-127.0.0.1-8009-exec-15]: OCSPServlet: Servlet Path: /ocsp [04/Sep/2019:13:22:06][ajp-bio-127.0.0.1-8009-exec-15]: OCSPServlet: RequestURI: /ca/ocsp [04/Sep/2019:13:22:06][ajp-bio-127.0.0.1-8009-exec-15]: OCSPServlet: PathInfo: null [04/Sep/2019:13:22:06][ajp-bio-127.0.0.1-8009-exec-15]: OCSPServlet: HTTP method: POST [04/Sep/2019:13:22:06][ajp-bio-127.0.0.1-8009-exec-15]: OCSPServlet: processing POST request [04/Sep/2019:13:22:06][ajp-bio-127.0.0.1-8009-exec-15]: OCSPServlet: decoding request [04/Sep/2019:13:22:06][ajp-bio-127.0.0.1-8009-exec-15]: OCSPServlet: validating request [04/Sep/2019:13:22:06][ajp-bio-127.0.0.1-8009-exec-15]: In LdapBoundConnFactory::getConn() [04/Sep/2019:13:22:06][ajp-bio-127.0.0.1-8009-exec-15]: masterConn is connected: true [04/Sep/2019:13:22:06][ajp-bio-127.0.0.1-8009-exec-15]: getConn: conn is connected true [04/Sep/2019:13:22:06][ajp-bio-127.0.0.1-8009-exec-15]: getConn: mNumConns now 4 [04/Sep/2019:13:22:06][ajp-bio-127.0.0.1-8009-exec-15]: returnConn: mNumConns now 5 [04/Sep/2019:13:22:06][ajp-bio-127.0.0.1-8009-exec-15]: In LdapBoundConnFactory::getConn() [04/Sep/2019:13:22:06][ajp-bio-127.0.0.1-8009-exec-15]: masterConn is connected: true [04/Sep/2019:13:22:06][ajp-bio-127.0.0.1-8009-exec-15]: getConn: conn is connected true [04/Sep/2019:13:22:06][ajp-bio-127.0.0.1-8009-exec-15]: getConn: mNumConns now 4 [04/Sep/2019:13:22:06][ajp-bio-127.0.0.1-8009-exec-15]: returnConn: mNumConns now 5 [04/Sep/2019:13:22:06][ajp-bio-127.0.0.1-8009-exec-15]: CertificateAuthority: validating OCSP request [04/Sep/2019:13:22:06][ajp-bio-127.0.0.1-8009-exec-15]: CertificateAuthority: processing request for cert 0x1b [04/Sep/2019:13:22:06][ajp-bio-127.0.0.1-8009-exec-15]: In LdapBoundConnFactory::getConn() [04/Sep/2019:13:22:06][ajp-bio-127.0.0.1-8009-exec-15]: masterConn is connected: true [04/Sep/2019:13:22:06][ajp-bio-127.0.0.1-8009-exec-15]: getConn: conn is connected true [04/Sep/2019:13:22:06][ajp-bio-127.0.0.1-8009-exec-15]: getConn: mNumConns now 4 [04/Sep/2019:13:22:06][ajp-bio-127.0.0.1-8009-exec-15]: returnConn: mNumConns now 5 [04/Sep/2019:13:22:06][ajp-bio-127.0.0.1-8009-exec-15]: adding signature [04/Sep/2019:13:22:06][ajp-bio-127.0.0.1-8009-exec-15]: Getting algorithm context for SHA256withRSA RSASignatureWithSHA256Digest [04/Sep/2019:13:22:06][ajp-bio-127.0.0.1-8009-exec-15]: Signing Certificate [04/Sep/2019:13:22:06][ajp-bio-127.0.0.1-8009-exec-15]: CMSServlet: in auditSubjectID [04/Sep/2019:13:22:06][ajp-bio-127.0.0.1-8009-exec-15]: CMSServlet: auditSubjectID auditContext {locale=en_GB, ipAddress=10.128.167.2} [04/Sep/2019:13:22:06][ajp-bio-127.0.0.1-8009-exec-15]: CMSServlet auditSubjectID: subjectID: null [04/Sep/2019:13:22:06][ajp-bio-127.0.0.1-8009-exec-15]: SignedAuditLogger: event OCSP_GENERATION [04/Sep/2019:13:22:06][ajp-bio-127.0.0.1-8009-exec-15]: OCSPServlet: OCSP Request: [04/Sep/2019:13:22:06][ajp-bio-127.0.0.1-8009-exec-15]: OCSPServlet: MGwwaqADAgEAMD4wPDA6MAkGBSsOAwIaBQAEFK377uGJz9Owh8lyIT07pU1YHAEs^M BBTDA9mf27XJPVL0EOy+SaFKAxCZhAIBG6IjMCEwHwYJKwYBBQUHMAECBBIEEJMj^M ZAn0Vjd91e0eZdmHXyo=^M [04/Sep/2019:13:22:06][ajp-bio-127.0.0.1-8009-exec-15]: Serial Number: 27 [04/Sep/2019:13:22:06][ajp-bio-127.0.0.1-8009-exec-15]: OCSPServlet: OCSP Response Size: [04/Sep/2019:13:22:06][ajp-bio-127.0.0.1-8009-exec-15]: OCSPServlet: 2364 [04/Sep/2019:13:22:06][ajp-bio-127.0.0.1-8009-exec-15]: OCSPServlet: OCSP Response Data: **SNIP**

1 0

kadmin service fails to start
by Mike Conner 04 Sep '19

04 Sep '19

I've had a FreeIPA installation running without issues until today directory services went down and when I attempt to restart services using `ipactl restart` the kadmin service fails to start. I've been digging through logs and searching for answers but haven't found anything that makes sense to me. The only change I introduced (that I'm aware of) was that I upgraded ipa-server on the replica a week or two ago. Master is running IPA 4.5 and replica is running IPA 4.6. Any help with troubleshooting would be greatly appreciated. -Mike

2 3

ldapsearch for AD users via FreeIPA
by Tom K. 03 Sep '19

03 Sep '19

Hey All, I've been following this post to refine an ldapsearch query in an attempt to return a list of AD users via IPA: https://www.redhat.com/archives/freeipa-users/2017-February/msg00300.html But haven't had luck yet. What I've tried so far: LDAPTLS_CACERT=/etc/ipa/ca.crt ldapsearch -H ldaps://idmipa03.mws.mds.xyz:636 -D "uid=admin,cn=users,cn=accounts,dc=mws,dc=mds,dc=xyz" -w "<SECRET>" -b "dc=mws,dc=mds,dc=xyz" -v "(&(objectClass=posixAccount)(uid=*))" |grep dn: [root@idmipa03 ~]# cat ad-lookup.update dn:cn=users,cn=Schema Compatibility,cn=plugins,cn=config add:schema-compat-lookup-nsswitch: user dn:cn=groups,cn=Schema Compatibility,cn=plugins,cn=config add:schema-compat-lookup-nsswitch: group [root@idmipa03 ~]# [root@idmipa03 ~]# [root@idmipa03 ~]# ipa-compat-manage status Directory Manager password: Plugin Enabled [root@idmipa03 ~]# [root@idmipa03 ~]# [root@idmipa03 ~]# ipa-ldap-updater ad-lookup.update Update complete, no data were modified The ipa-ldap-updater command was successful [root@idmipa03 ~]# Still I don't get a list of AD users. Did not use --enable-compat on installation of the IPA servers. What am I missing? -- Thx, TK.

2 2

'ipa-ca' DNS record - where used?
by Dmitry Perets 03 Sep '19

03 Sep '19

Hi, I know of one usage - all the IPA ansible modules (ipa_*) query for 'ipa-ca' record to find the IPA server. But for other cases - looks like IPA clients mostly rely on entries like '_kerberos.*' and '_ldap.*'... What other functionality uses 'ipa-ca' record? Thanks. --- Regards, Dmitry Perets

3 3

spake_preauth_groups
by Rob Verduijn 03 Sep '19

03 Sep '19

Hello, I found out that running ipa on rhel8 in the file /etc/krb5.conf.d/freeipa the setting [libdefaults] spake_preauth_groups=edwards25519 prevents ad domain account users from logging in to the ipa server running on rhel8 according to this site it's protection against dictionary attacks https://web.mit.edu/kerberos/krb5-latest/doc/admin/spake.html commenting those two lines and restarting the sssd service allows the ad domain users to login to the rhel8 systems however, this means I lose the extra protection against dictionary attacks. Is there a way to have both ? ( login for ad users on rhel8 and dictionary attack protection ) Cheers Rob

2 2

NFS Errors
by Tobi Berninger 03 Sep '19

03 Sep '19

Hello, sadly we had a power shortage (a transformer exploded in the building next to us....) and all server shutted down immediately - i started them again. now we have some strange errors: First only two clients werent able to access their nfs home - two days latter all clients cant access them... I first check the date but it is synced all over the system and not the problem. then i discovered an error in the logs that the callback ip wasnt right, fixed that too... still cant get access to the nfs server - only the one share that is accessiable for all users is mounted. Keytabes was renewed on NFSserver as on the clients. the krb5 logs dont show any real clue... I use virtualized Centos Based Server (Up to Date): IpaServer NFSServer BackupNFSServer Any ideas? Thanks

2 1

Can login with non-existing user
by Ronald Wimmer 02 Sep '19

02 Sep '19

I have managed to login to an IPA client with a non-existing user. My AD user is z123456(a)addomain.mydomain.at and I have created a similar user called i123456(a)ipadomain.mydomain.at. What happened now is that I could log in with the i-User and what I get to see after logging in is this: [i123456@addomain.mydomain.at@as12314 ~]$ id uid=1246600007(i123456(a)addomain.mydomain.at) gid=1246600007(i123456(a)addomain.mydomain.at) groups=1246600007(i123456@addomain.mydomain.at),1246600016(my-ad-group@ipadomain.mydomain.at) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 [i123456@addomain.mydomain.at@as12314 ~]$ whoami i123456(a)addomain.mydomain.at The user i123456(a)addomain.mydomain.at does NOT exist. addomain is set as default domain in the client's sssd.conf. What is wrong here? Are things just displayed wrong or could it be more? Which files do you need in order to analyze this issue? Cheers, Ronald

2 9

2025

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users September 2019