September 2019 - FreeIPA-users - Fedora mailing-lists

Re: Enabling more FreeIPA CA servers
by Fraser Tweedale 30 Sep '19

30 Sep '19

On Mon, Sep 30, 2019 at 08:19:15AM +0100, Stuart McRobert wrote: > Dear Fraser, > > Thanks, I've retained the CC but will probably need to join. > > > I think your idea to first try creating a CA replica on F28 before > > moving forward to F30 is a sensible thing to try. > > I will explore adding a F28 replica > > > One question though: are you on Domain Level 0 or 1? > > (`ipa domainlevel-get`). > > All four servers currently report: > > % ipa domainlevel-get > ----------------------- > Current domain level: 1 > ----------------------- > > This isn't something I've custom set, and earlier I thought the original > three servers were at level 0 with only the new F30 one at 1. > Thanks for confirming Stuart. This setting is not surprising and it is the value we want. I will try to find time to carry out some tests on f26 -> f30 replica creation later this week. Cheers, Fraser > Best wishes > > Stuart >

1 0

Configuring Windows 10 to use FreeIPA
by Joyce Babu 27 Sep '19

27 Sep '19

I followed the instructions for setting up Windows10 to use FreeIPA for authentication https://www.freeipa.org/page/Windows_authentication_against_FreeIPA After following the instruction, the default domain displayed on windows 10 login screen is EXAMPLE and EXAMPLE.COM. I am able to login by entering EXAMPLE.COM\user as the username. But when I enter the username without the leading domain name, login fails with 'Client not found in Kerberos database' error. Sep 27 17:17:58 ipa.example.org krb5kdc[419](info): AS_REQ (6 etypes {aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17), DEPRECATED:arcfour-hmac(23), DEPRECATED:arcfour-hmac-exp(24), (-135), DEPRECATED:des-cbc-md5(3)}) 192.168.0.185: CLIENT_NOT_FOUND: user@EXAMPLE for krbtgt/EXAMPLE@EXAMPLE, Client not found in Kerberos database Is it possible to change the default domain in windows login screen to EXAMPLE.COM from EXAMPLE? Thanks, Joyce Babu

2 1

getcert list status: NEED_CA issue
by Satish Patel 27 Sep '19

27 Sep '19

Few days ago my Master CA was messed up and getcert list was showing empty list (no cert to track) So i run following command to add certs manually: getcert start-tracking -d /etc/pki/pki-tomcat/alias -n 'ocspSigningCert cert-pki-ca' -P XXXXXXX getcert start-tracking -d /etc/pki/pki-tomcat/alias -n 'auditSigningCert cert-pki-ca' -P XXXXXXX getcert start-tracking -d /etc/pki/pki-tomcat/alias -n 'subsystemCert cert-pki-ca' -P XXXXXXX getcert start-tracking -d /etc/pki/pki-tomcat/alias -n 'Godaddy' -P XXXXXXX getcert start-tracking -d /etc/pki/pki-tomcat/alias -n 'Godaddy Intermediate' -P XXXXXXX And after that i am seeing this status (status: NEED_CA ) it should be MONITORING right? # getcert list Number of certificates and requests being tracked: 12. Request ID '20190915042927': status: NEED_CA stuck: yes key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert cert-pki-ca',token='NSS Certificate DB',pin set certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert cert-pki-ca',token='NSS Certificate DB' issuer: CN=Certificate Authority,O=example.com subject: CN=Certificate Authority,O=example.com expires: 2037-01-05 14:47:24 UTC key usage: digitalSignature,nonRepudiation,keyCertSign,cRLSign pre-save command: post-save command: track: yes auto-renew: yes Request ID '20190915043150': status: NEED_CA stuck: yes key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alaas',nickname='Server-Cert cert-pki-ca',token='NSS Certificate DB',pin set certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert cert-pki-ca',token='NSS Certificate DB' issuer: CN=Certificate Authority,O=example.com subject: CN=ldap-example-5-1.foo.example.com,O=example.com expires: 2020-11-17 18:30:29 UTC key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment eku: id-kp-serverAuth,id-kp-clientAuth pre-save command: post-save command: track: yes auto-renew: yes Request ID '20190915043212': status: NEED_CA stuck: yes key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert cert-pki-ca',token='NSS Certificate DB',pin set certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert cert-pki-ca',token='NSS Certificate DB' issuer: CN=Certificate Authority,O=example.com subject: CN=OCSP Subsystem,O=example.com expires: 2020-11-17 18:31:26 UTC eku: id-kp-OCSPSigning pre-save command: post-save command: track: yes auto-renew: yes

3 26

inconsistency when reading server roles ?
by Eugène Adell 27 Sep '19

27 Sep '19

Hello, I am using freeipa 4.5.0.21 (full details below) and I noticed a weird behaviour. When getting informations about a server with a regular user, it won't show the server roles while these roles will be given when checking the server roles themselves. In this case the roles are of 'configured' status instead of 'enabled' (which is probably what would be expected). As it's not documented in the official Guide and I didn't find anything in the mail archive, I believe some clarification is needed. Should server roles be found through some commands but not others ? Is there any security issue of showing them always ? (user) # ipa server-show srv3.idm.local --all dn: cn=srv3.idm.local,cn=masters,cn=ipa,cn=etc,dc=idm,dc=local Server name: srv3.idm.local Enabled server roles: objectclass: top, nsContainer, ipaReplTopoManagedServer, ipaConfigObject, ipaSupportedDomainLevelConfig (user) # ipa server-role-show srv3.idm.local 'NTP server' Server name: srv3.idm.local Role name: NTP server Role status: configured (admin) # ipa server-show srv3.idm.local --all dn: cn=srv3.idm.local,cn=masters,cn=ipa,cn=etc,dc=idm,dc=local Server name: srv3.idm.local Managed suffixes: domain, ca Min domain level: 0 Max domain level: 1 Enabled server roles: CA server, DNS server, NTP server objectclass: top, nsContainer, ipaReplTopoManagedServer, ipaConfigObject, ipaSupportedDomainLevelConfig # yum info ipa-server -v Loading "fastestmirror" plugin Config time: 0.008 Yum version: 3.4.3 rpmdb time: 0.000 Setting up Package Sacks Loading mirror speeds from cached hostfile pkgsack time: 0.004 Installed Packages Name : ipa-server Arch : x86_64 Version : 4.5.0 Release : 21.el7.centos.2.2 Size : 1.0 M Repo : installed From repo : ipa Committer : Johnny Hughes <johnny(a)centos.org> Committime : Thu Oct 19 14:00:00 2017 Buildtime : Thu Oct 19 22:52:09 2017 Install time: Mon Sep 23 21:46:46 2019 Installed by: root <root> Changed by : System <unset> Summary : The IPA authentication server URL : http://www.freeipa.org/ Licence : GPLv3+ Description : IPA is an integrated solution to provide centrally managed Identity (users, : hosts, services), Authentication (SSO, 2FA), and Authorization : (host access control, SELinux user roles, services). The solution provides : features for further integration with Linux based clients (SUDO, automount) : and integration with Active Directory based infrastructures (Trusts). : If you are installing an IPA server, you need to install this package. # cat /etc/*release* CentOS Linux release 7.4.1708 (Core) Derived from Red Hat Enterprise Linux 7.4 (Source) NAME="CentOS Linux" VERSION="7 (Core)" ID="centos" ID_LIKE="rhel fedora" VERSION_ID="7" PRETTY_NAME="CentOS Linux 7 (Core)" ANSI_COLOR="0;31" CPE_NAME="cpe:/o:centos:centos:7" HOME_URL="https://www.centos.org/" BUG_REPORT_URL="https://bugs.centos.org/" CENTOS_MANTISBT_PROJECT="CentOS-7" CENTOS_MANTISBT_PROJECT_VERSION="7" REDHAT_SUPPORT_PRODUCT="centos" REDHAT_SUPPORT_PRODUCT_VERSION="7" CentOS Linux release 7.4.1708 (Core) CentOS Linux release 7.4.1708 (Core) cpe:/o:centos:centos:7 Best regards Eugene

2 2

Issues with Free IPA (Red Hat IDM). Sporadic lookup results. Different results in EL 6 and 7.
by Bob Jones 27 Sep '19

27 Sep '19

All, First the deets of the setup: 3 IDM servers on RHEL 7.7 ipa version VERSION: 4.6.5, API_VERSION: 2.231 sssd version 1.16.4 389 directory server version 1.3.9.1-10 Clients: EL7: ipa version 5.6.5, sssd version EL6: ipa version 3.0.0.51, sssd 1.13.3.60 Servers are setup in an AD trust ipa-ad-trust-posix. I have done the performance tweaks for sssd as described at https://jhrozek.wordpress.com/2015/08/19/performance-tuning-sssd-for-large-… and we use the accounts/groups in AD for login, authorization, and file ownership. There are 3 main issues we are having. 1. On ipa clients on EL 7 servers we are running into sporadic issues. If you totally clear the sssd cache and do an ls -la on let's say /home where there are 12 unique owners of directories usually between 8 to 10 of the UID numbers come back with the the user found, but you have to wait 1 to 5 minutes before the rest of the uids owning the other directories come back as found. 2. Also on ipa clients on EL 7 servers we are running into an issue where occasionally, at what seems like totally random times, AD users that normally can access a client suddenly can't. Someone will have to go in and clear the SSSD cache after which the user will once again be able to access the system. 3. There are some users that are just not visible on the EL 6 clients. On the IDM servers and on EL 7 clients the AD users are able to be found by id and the users can login. On EL 6 those AD users just do not resolve and cannot be seen. Anyway, we have had Red Hat support looking at problem 3 for almost 2 months now with no luck. We have been poking around at problems 1 and 2 but no eureka moments as of yet. I'm hoping someone else on this list has encountered these same issues and found a solution. I would greatly appreciate any insight and help that anyone could provide. Sincerely, — Bob Jones Lead Linux Services Engineer ITS ECP - Linux Services University of Virginia rwj5d(a)virginia.edu

3 5

Configuring Windows 10 to use FreeIPA
by Joyce Babu 27 Sep '19

27 Sep '19

I followed the instructions for setting up Windows10 to use FreeIPA for authentication https://www.freeipa.org/page/Windows_authentication_against_FreeIPA After following the instruction, the default domain displayed on windows 10 login screen is EXAMPLE and EXAMPLE.COM. I am able to login by entering EXAMPLE.COM\user as the username. But when I enter the username without the leading domain name, login fails with 'Client not found in Kerberos database' error. Sep 27 17:17:58 ipa.example.org krb5kdc[419](info): AS_REQ (6 etypes {aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17), DEPRECATED:arcfour-hmac(23), DEPRECATED:arcfour-hmac-exp(24), (-135), DEPRECATED:des-cbc-md5(3)}) 192.168.0.185: CLIENT_NOT_FOUND: user@EXAMPLE for krbtgt/EXAMPLE@EXAMPLE, Client not found in Kerberos database Is it possible to change the default domain in windows login screen to EXAMPLE.COM from EXAMPLE? Thanks, Joyce Babu

1 0

Terminating replication agreement
by Randy Morgan 26 Sep '19

26 Sep '19

I have a two year image of one of my IPA servers that I am trying to bring live. Unfortunately all of the certs except the CA are expired. I have attempted to follow the instructions for updating the certs, but it has failed to update them. After careful and extensive digging, I have found that the issue is two replication agreements from other IPA servers that have since been rebuilt. Because of the expired certs I can't login to the web UI, so I can't terminate the agreements that way, and the IPA commands fail. Is there a way to terminate these agreements manually by removing the references to the two servers? Randy Morgan -- Randy Morgan CSR Department of Chemistry/BioChemistry Brigham Young University

3 5

IPA integration with AD - trust issues and controversy
by Pieter Baele 26 Sep '19

26 Sep '19

Hi, We use an IPA domain for a large part of our internal servers. Our first one-way trust implementation was not properly working because of routing issues. Two-way trust in our environment is not possible, because normal users are limited. (we can resolve 'system/service' accounts without those limitations) After finding out about this limitation, we did again configure one-way trust. This time, we found about the registry / GPO solution to direct windows clients to the IPA KDC's. ( https://gpo.wiki/wiki/Kerberos.admx:Computer_Configuration#Define_host_name… ) And all is working properly... Last week we received a request from an external company that wants AD integration. They will manage their own set of RHEL servers for a specific project. I proposed they can use the IDM domain for feature-full integration with the AD domain. But.... there is some discussion going on.... our AD architect(s) calls the IPA integration with AD lacking. Their opinion is that windows clients should discover automatically when they need a IPA KDC Also, they find it a severe issue that everything is hidden after one SID (which is given permissions with the correct search scope) As such they can' t see/discover anything in the IPA domain (logically...) So the Windows / AD guys propose a direct integration using a keytab - without thinking about the requirements, and comparing with network devices or appliances I am not talking about realmd. What is the up-to-date opinion on SSSD realmd integration versus IDM integration? Or other options? What will the external company be losing in features? And which has most risks? But most of all: what can we do to make IPA domain<-> AD domain integration better? Sincerely, Pieter

1 0

How to archive this?
by Andreas Kucher 26 Sep '19

26 Sep '19

Hi There, i have a FreeIPA 4.6.4 Sever and two replica Servers up and running. So far so good. Now i want to connect my hosts to my Synology NAS running DSM 6.2.2. My first thougth was to use Kerberos and NFS4 but unfortunaly i did not figure out how to do this. Maybe you have a good tutorial? In the End i found this Page: https://frederik.lindenaar.nl/2019/07/14/integrating-synology-ds-with-freei… I think i will try to do this and just access the shares with "LDAP". My question is: if i want to install "ipa-adtrust-install" but it was not installed using yum (because i thougth i was no neccecarry) can i simple install it? Do i have to run it on the replicas as well? Maybe you can have a look at the Page of Frederik and share your thoughts about it? Thank you in advice Andy

1 0

Manually join machines in stateless environment
by Vinícius Ferrão 26 Sep '19

26 Sep '19

Hello, the subject of the message may sound a little bit strange, but let me explain what I’m trying to do. I have a machine with an provisioner (xCAT) that is able to boot and control different types of computer nodes. A stateless node is just a machine that boots over the network from a shared image on the server. What I’m trying to do? Join those stateless nodes to FreeIPA Server. To do this, I’m aware that I can’t just run freeipa-client-install on the image chroot, since it will not behave as expected. At this point xCAT (the provisioner) can create the DNS registers of the stateless nodes on FreeIPA integrated DNS (using TSIG keys). But I need to properly join the nodes to the server. There’s a way to manually register the nodes on the server? And about the users? How to enable them? Just Configure SSSD on the image and it should be fine? The certificates, client certificates and things like this? There’s something that I need to do? Automount? Any help is really appreciated. Thanks,

5 10

Re:
by Nazan CENGİZ 25 Sep '19

25 Sep '19

Hi, Who is the name of the community? Do you have an existing slack group? Thanks. [cid:imageb28ec2.PNG@d1da10fa.4cb398f7]<http://www.havelsan.com.tr> [cid:image8c8aa2.JPG@a93b5b5c.498f306c] Nazan CENGİZ AR-GE MÜHENDİSİ Mustafa Kemal Mahallesi 2120 Cad. No:39 06510 Çankaya Ankara TÜRKİYE [cid:image9f30dc.PNG@eaef3c98.49a0f6ac] +90 312 219 57 87 [cid:image2c5a21.PNG@c874ceae.4a8947a5] +90 312 219 57 97 [cid:imageb831d2.JPG@5f6f348c.44a74e32] YASAL UYARI: Bu elektronik posta işbu linki kullanarak ulaşabileceğiniz Koşul ve Şartlar dokümanına tabidir. <http://havelsan.com.tr/tr/news/e-posta-yasal-uyari> LEGAL NOTICE: This e-mail is subject to the Terms and Conditions document which can be accessed with this link. <http://havelsan.com.tr/tr/news/e-posta-yasal-uyari> [http://www.havelsan.com.tr/Library/images/mail/email.jpg] Lütfen gerekmedikçe bu sayfa ve eklerini yazdırmayınız / Please consider the environment before printing this email ________________________________ From: Nazan CENGİZ Sent: Wednesday, September 25, 2019 11:27:45 AM To: freeipa-users(a)lists.fedorahosted.org Subject: Hi all, Shall we create a Slack band? IRC is banned in our company. Would you mind?

2 1

Re: log dispatching for IPA servers
by Nazan CENGİZ 24 Sep '19

24 Sep '19

Hi all, I wanted monitoring and centrilazed logging.For example ELK (elasticsearch,logstash,kibana) Stack.But I don't know config on FreeIPA server and client?Is there an auxiliary resource? https://github.com/mzamora9913/Collecting-Syslogs-from-FreeIPA-and-clients-… But I don't understanding. Could you please do yuou have a research or tutorial for FreeIPA centralized logging? Best Regards. [cid:image26938a.PNG@6241ef69.4c95962c]<http://www.havelsan.com.tr> [cid:imageeb5f50.JPG@bab4e531.4294e394] Nazan CENGİZ AR-GE MÜHENDİSİ Mustafa Kemal Mahallesi 2120 Cad. No:39 06510 Çankaya Ankara TÜRKİYE [cid:imageedbd3d.PNG@12352f47.48ba5869] +90 312 219 57 87 [cid:imagecff0c2.PNG@69e71500.4fa4bdd2] +90 312 219 57 97 [cid:image713a9c.JPG@cd67836a.4da60895] YASAL UYARI: Bu elektronik posta işbu linki kullanarak ulaşabileceğiniz Koşul ve Şartlar dokümanına tabidir. <http://havelsan.com.tr/tr/news/e-posta-yasal-uyari> LEGAL NOTICE: This e-mail is subject to the Terms and Conditions document which can be accessed with this link. <http://havelsan.com.tr/tr/news/e-posta-yasal-uyari> [http://www.havelsan.com.tr/Library/images/mail/email.jpg] Lütfen gerekmedikçe bu sayfa ve eklerini yazdırmayınız / Please consider the environment before printing this email ________________________________ From: Nazan CENGİZ Sent: Tuesday, September 24, 2019 1:08:15 PM To: Angus Clarke; freeipa-users(a)lists.fedorahosted.org Cc: Fraser Tweedale Subject: Re: [Freeipa-users] Re: log dispatching for IPA servers I wanted logging a IPA server and many IPA client.I also want to keep logging and monitoring at the interface. ________________________________ From: Angus Clarke <post(a)angusclarke.com> Sent: Tuesday, September 24, 2019 12:47:46 PM To: Nazan CENGİZ; freeipa-users(a)lists.fedorahosted.org Cc: Fraser Tweedale Subject: [Freeipa-users] Re: log dispatching for IPA servers Hi If you just want an audit trail of the FreeIPA server(s) API, then apache's ErrorLog directive catches all that. Regards Angus ________________________________ From: Fraser Tweedale via FreeIPA-users <freeipa-users(a)lists.fedorahosted.org> Sent: 24 September 2019 11:08 To: Nazan CENGİZ <nazancengiz(a)havelsan.com.tr>; freeipa-users(a)lists.fedorahosted.org <freeipa-users(a)lists.fedorahosted.org> Cc: Fraser Tweedale <ftweedal(a)redhat.com> Subject: [Freeipa-users] Re: log dispatching for IPA servers Hi Nazan, I'm not sure what are the best practices for log dispatching on IPA servers, or what is suitable for your customer's environment and requirement. I assume the customer is running RHEL and therefore wants the solution to only use supported components. Adding freeipa-users@ for a wider audience. Cheers, Fraser On Tue, Sep 24, 2019 at 07:50:14AM +0000, Nazan CENGİZ wrote: > Hi Fraser, > > > I working 5G project in Turkey. Redhat supported me for Openstack 13. > > > We install FreeIPA. We wanted log monitoring on FreeIPA server and clients.I think it should Kibana,Elasticsearch and fluentd. > > > I see https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fsysadmin.…. > > > But I don't know installing on FreeIPA server and clients.Where is installed fluentd on IPA server and clients? > > > I following https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.co… but It not answer the questions. > > > Could you please help me? > > > Best Regards, > > > Nazan. > > > [cid:image556c62.PNG@8bf41986.459c739a]<https://eur01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.havels…> [cid:imageb02311.JPG@73a7601e.418b1956] > Nazan CENGİZ > AR-GE MÜHENDİSİ > Mustafa Kemal Mahallesi 2120 Cad. No:39 06510 Çankaya Ankara TÜRKİYE > [cid:imagea8935c.PNG@9a2bfb11.4c8dd354] +90 312 219 57 87 [cid:image2cbf6d.PNG@6b6c6178.42ba3343] +90 312 219 57 97 > > > [cid:image67d26a.JPG@1a093bf4.45953fd9] > YASAL UYARI: Bu elektronik posta işbu linki kullanarak ulaşabileceğiniz Koşul ve Şartlar dokümanına tabidir. <https://eur01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fhavelsan.c…> > LEGAL NOTICE: This e-mail is subject to the Terms and Conditions document which can be accessed with this link. <https://eur01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fhavelsan.c…> > > [https://eur01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.havels…] Lütfen gerekmedikçe bu sayfa ve eklerini yazdırmayınız / Please consider the environment before printing this email > > _______________________________________________ FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org Fedora Code of Conduct: https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdocs.fedo… List Guidelines: https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Ffedorapro… List Archives: https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.fed…

1 0

Re: log dispatching for IPA servers
by Nazan CENGİZ 24 Sep '19

24 Sep '19

Hi all, I wanted monitoring and centrilazed logging.For example ELK (elasticsearch,logstash,kibana) Stack.But I don't know config on FreeIPA server and client?Is there an auxiliary resource? https://github.com/mzamora9913/Collecting-Syslogs-from-FreeIPA-and-clients-… But I don't understanding. Could you please do yuou have a research or tutorial for FreeIPA centralized logging? Best Regards. [cid:image347106.PNG@a5dcc7e9.409203b6]<http://www.havelsan.com.tr> [cid:image5fbf77.JPG@4f26cf2f.4ebbc4db] Nazan CENGİZ AR-GE MÜHENDİSİ Mustafa Kemal Mahallesi 2120 Cad. No:39 06510 Çankaya Ankara TÜRKİYE [cid:image48d16b.PNG@1d2efdd9.4ab00d7e] +90 312 219 57 87 [cid:image19c98b.PNG@1fe142d5.4abd5c1d] +90 312 219 57 97 [cid:image777429.JPG@2b5066da.489d3957] YASAL UYARI: Bu elektronik posta işbu linki kullanarak ulaşabileceğiniz Koşul ve Şartlar dokümanına tabidir. <http://havelsan.com.tr/tr/news/e-posta-yasal-uyari> LEGAL NOTICE: This e-mail is subject to the Terms and Conditions document which can be accessed with this link. <http://havelsan.com.tr/tr/news/e-posta-yasal-uyari> [http://www.havelsan.com.tr/Library/images/mail/email.jpg] Lütfen gerekmedikçe bu sayfa ve eklerini yazdırmayınız / Please consider the environment before printing this email ________________________________ From: Angus Clarke <post(a)angusclarke.com> Sent: Tuesday, September 24, 2019 12:47:46 PM To: Nazan CENGİZ; freeipa-users(a)lists.fedorahosted.org Cc: Fraser Tweedale Subject: [Freeipa-users] Re: log dispatching for IPA servers Hi If you just want an audit trail of the FreeIPA server(s) API, then apache's ErrorLog directive catches all that. Regards Angus ________________________________ From: Fraser Tweedale via FreeIPA-users <freeipa-users(a)lists.fedorahosted.org> Sent: 24 September 2019 11:08 To: Nazan CENGİZ <nazancengiz(a)havelsan.com.tr>; freeipa-users(a)lists.fedorahosted.org <freeipa-users(a)lists.fedorahosted.org> Cc: Fraser Tweedale <ftweedal(a)redhat.com> Subject: [Freeipa-users] Re: log dispatching for IPA servers Hi Nazan, I'm not sure what are the best practices for log dispatching on IPA servers, or what is suitable for your customer's environment and requirement. I assume the customer is running RHEL and therefore wants the solution to only use supported components. Adding freeipa-users@ for a wider audience. Cheers, Fraser On Tue, Sep 24, 2019 at 07:50:14AM +0000, Nazan CENGİZ wrote: > Hi Fraser, > > > I working 5G project in Turkey. Redhat supported me for Openstack 13. > > > We install FreeIPA. We wanted log monitoring on FreeIPA server and clients.I think it should Kibana,Elasticsearch and fluentd. > > > I see https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fsysadmin.…. > > > But I don't know installing on FreeIPA server and clients.Where is installed fluentd on IPA server and clients? > > > I following https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.co… but It not answer the questions. > > > Could you please help me? > > > Best Regards, > > > Nazan. > > > [cid:image556c62.PNG@8bf41986.459c739a]<https://eur01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.havels…> [cid:imageb02311.JPG@73a7601e.418b1956] > Nazan CENGİZ > AR-GE MÜHENDİSİ > Mustafa Kemal Mahallesi 2120 Cad. No:39 06510 Çankaya Ankara TÜRKİYE > [cid:imagea8935c.PNG@9a2bfb11.4c8dd354] +90 312 219 57 87 [cid:image2cbf6d.PNG@6b6c6178.42ba3343] +90 312 219 57 97 > > > [cid:image67d26a.JPG@1a093bf4.45953fd9] > YASAL UYARI: Bu elektronik posta işbu linki kullanarak ulaşabileceğiniz Koşul ve Şartlar dokümanına tabidir. <https://eur01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fhavelsan.c…> > LEGAL NOTICE: This e-mail is subject to the Terms and Conditions document which can be accessed with this link. <https://eur01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fhavelsan.c…> > > [https://eur01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.havels…] Lütfen gerekmedikçe bu sayfa ve eklerini yazdırmayınız / Please consider the environment before printing this email > > _______________________________________________ FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org Fedora Code of Conduct: https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdocs.fedo… List Guidelines: https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Ffedorapro… List Archives: https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.fed…

1 0

Re: log dispatching for IPA servers
by Fraser Tweedale 24 Sep '19

24 Sep '19

Hi Nazan, I'm not sure what are the best practices for log dispatching on IPA servers, or what is suitable for your customer's environment and requirement. I assume the customer is running RHEL and therefore wants the solution to only use supported components. Adding freeipa-users@ for a wider audience. Cheers, Fraser On Tue, Sep 24, 2019 at 07:50:14AM +0000, Nazan CENGİZ wrote: > Hi Fraser, > > > I working 5G project in Turkey. Redhat supported me for Openstack 13. > > > We install FreeIPA. We wanted log monitoring on FreeIPA server and clients.I think it should Kibana,Elasticsearch and fluentd. > > > I see https://sysadmin.miniconf.org/2018/lca2018-fraser_tweedale-user_session_rec…. > > > But I don't know installing on FreeIPA server and clients.Where is installed fluentd on IPA server and clients? > > > I following https://github.com/mzamora9913/Collecting-Syslogs-from-FreeIPA-and-clients-… but It not answer the questions. > > > Could you please help me? > > > Best Regards, > > > Nazan. > > > [cid:image556c62.PNG@8bf41986.459c739a]<http://www.havelsan.com.tr> [cid:imageb02311.JPG@73a7601e.418b1956] > Nazan CENGİZ > AR-GE MÜHENDİSİ > Mustafa Kemal Mahallesi 2120 Cad. No:39 06510 Çankaya Ankara TÜRKİYE > [cid:imagea8935c.PNG@9a2bfb11.4c8dd354] +90 312 219 57 87 [cid:image2cbf6d.PNG@6b6c6178.42ba3343] +90 312 219 57 97 > > > [cid:image67d26a.JPG@1a093bf4.45953fd9] > YASAL UYARI: Bu elektronik posta işbu linki kullanarak ulaşabileceğiniz Koşul ve Şartlar dokümanına tabidir. <http://havelsan.com.tr/tr/news/e-posta-yasal-uyari> > LEGAL NOTICE: This e-mail is subject to the Terms and Conditions document which can be accessed with this link. <http://havelsan.com.tr/tr/news/e-posta-yasal-uyari> > > [http://www.havelsan.com.tr/Library/images/mail/email.jpg] Lütfen gerekmedikçe bu sayfa ve eklerini yazdırmayınız / Please consider the environment before printing this email > >

2 1

hostgroups and netgroups
by Amos 22 Sep '19

22 Sep '19

Why is it that hostgroups and netgroups share the same name space? Amos

2 1

remove bad replica from list not working
by Satish Patel 20 Sep '19

20 Sep '19

I am trying to remove old and bad replica from list but somehow it didn't like what i am doing [root@ldap-master ~]# ipa-replica-manage list -v `hostname` ldap-1.example.com: replica last init status: None last init ended: 1970-01-01 00:00:00+00:00 last update status: Error (0) Replica acquired successfully: Incremental update succeeded last update ended: 2019-09-19 17:28:00+00:00 ldap-2.example.com: replica last init status: None last init ended: 1970-01-01 00:00:00+00:00 last update status: Error (0) Replica acquired successfully: Incremental update succeeded last update ended: 2019-09-19 17:28:00+00:00 ldap-3.example.com: replica last init status: None last init ended: 1970-01-01 00:00:00+00:00 last update status: Error (-1) Problem connecting to replica - LDAP error: Can't contact LDAP server (connection error) last update ended: 1970-01-01 00:00:00+00:00 I have tried following way but its still not removing from list [root@ldap-master ~]# ipa-replica-manage del ldap-3.example.com --force --cleanup ipa: INFO: Skipping replication agreement deletion check for suffix 'domain' ipa: INFO: Skipping replication agreement deletion check for suffix 'ca' ipa: WARNING: Forcing removal of ldap-3.example.com ipa: WARNING: Ignoring topology connectivity errors. ipa: WARNING: Ignoring these warnings and proceeding with removal ipa: WARNING: Failed to cleanup ldap-3.example.com DNS entries: DNS is not configured ipa: WARNING: You may need to manually remove them from the tree ipa: WARNING: Server has already been deleted ----------------------------------------------- Deleted IPA server "ldap-3.example.com" ----------------------------------------------- I can still this that replica in list [root@ldap-master ~]# ipa-replica-manage list -v `hostname` … … ldap-3.example.com: replica last init status: None last init ended: 1970-01-01 00:00:00+00:00 last update status: Error (-1) Problem connecting to replica - LDAP error: Can't contact LDAP server (connection error) last update ended: 1970-01-01 00:00:00+00:00

3 3

DNS server 10.0.3.10: query '. SOA': The DNS operation timed out after 10.001354217529297 seconds
by Mudassar Rana 19 Sep '19

19 Sep '19

Hi , I am trying to deploy ipa server as a docker container on kubernetes cluster . I have build the docker image & run below command . docker run --privileged --sysctl net.ipv6.conf.lo.disable_ipv6=0 --name freeipa-server -ti -h ipa.faas.example.lab freeipa-server-new:latest --setup-dns --allow-zone-overlap But facing issue DNS server 10.0.3.10: query '. SOA': The DNS operation timed out after 10.001354217529297 seconds On the host system , i run dig command to verify the forwarding issue . Please find the output below : ``` [root@svpod7mgmt002 ~]# dig @10.0.3.10 . SOA ; <<>> DiG 9.11.4-P2-RedHat-9.11.4-9.P2.el7 <<>> @10.0.3.10 . SOA ; (1 server found) ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 55981 ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 2 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4000 ;; QUESTION SECTION: ;. IN SOA ;; ANSWER SECTION: . 45023 IN SOA a.root-servers.net. nstld.verisign-grs.com. 2019091900 1800 900 604800 86400 ;; ADDITIONAL SECTION: a.root-servers.net. 29958 IN A 198.41.0.4 ;; Query time: 0 msec ;; SERVER: 10.0.3.10#53(10.0.3.10) ;; WHEN: Fri Sep 20 01:49:17 UTC 2019 ;; MSG SIZE rcvd: 120 ```

1 0

Vault: Cannot authenticate agent with certificate
by Peter Oliver 19 Sep '19

19 Sep '19

I have a CentOS 7 server running ipa-server-4.5.4, recently installed. I find that operations related to the vault feature fail. For example: > ipa -v vault-add test --type=standard ipa: INFO: trying https://ipa-01.example.com/ipa/session/json ipa: INFO: [try 1]: Forwarding 'vault_add_internal/1' to json server 'https://ipa-01.example.com/ipa/session/json' ipa: INFO: [try 1]: Forwarding 'vault_show/1' to json server 'https://ipa-01.example.com/ipa/session/json' ipa: INFO: [try 1]: Forwarding 'vaultconfig_show/1' to json server 'https://ipa-01.example.com/ipa/session/json' ipa: INFO: [try 1]: Forwarding 'vault_archive_internal/1' to json server 'https://ipa-01.example.com/ipa/session/json' ipa: ERROR: an internal error has occurred In /var/log/pki/pki-tomcat/kra/system I see the following message: 0.ajp-bio-127.0.0.1-8009-exec-15 - [02/Nov/2018:14:54:37 GMT] [6] [3] Cannot authenticate agent with certificate Serial 0x7 Subject DN CN=IPA RA,O=IPA.EXAMPLE.COM. Error: User not found In /var/log/pki/pki-tomcat/kra/debug is see the following messages: [02/Nov/2018:14:54:37][ajp-bio-127.0.0.1-8009-exec-16]: SessionContextInterceptor: SystemCertResource.getTransportCert() [02/Nov/2018:14:54:37][ajp-bio-127.0.0.1-8009-exec-16]: SessionContextInterceptor: Not authenticated. [02/Nov/2018:14:54:37][ajp-bio-127.0.0.1-8009-exec-16]: AuthMethodInterceptor: SystemCertResource.getTransportCert() [02/Nov/2018:14:54:37][ajp-bio-127.0.0.1-8009-exec-16]: AuthMethodInterceptor: mapping: default [02/Nov/2018:14:54:37][ajp-bio-127.0.0.1-8009-exec-16]: AuthMethodInterceptor: required auth methods: [*] [02/Nov/2018:14:54:37][ajp-bio-127.0.0.1-8009-exec-16]: AuthMethodInterceptor: anonymous access allowed [02/Nov/2018:14:54:37][ajp-bio-127.0.0.1-8009-exec-16]: ACLInterceptor: SystemCertResource.getTransportCert() [02/Nov/2018:14:54:37][ajp-bio-127.0.0.1-8009-exec-16]: ACLInterceptor.filter: no authorization required [02/Nov/2018:14:54:37][ajp-bio-127.0.0.1-8009-exec-16]: ACLInterceptor: No ACL mapping; authz not required. [02/Nov/2018:14:54:37][ajp-bio-127.0.0.1-8009-exec-16]: SignedAuditLogger: event AUTHZ [02/Nov/2018:14:54:37][ajp-bio-127.0.0.1-8009-exec-16]: MessageFormatInterceptor: SystemCertResource.getTransportCert() [02/Nov/2018:14:54:37][ajp-bio-127.0.0.1-8009-exec-16]: MessageFormatInterceptor: content-type: application/json [02/Nov/2018:14:54:37][ajp-bio-127.0.0.1-8009-exec-16]: MessageFormatInterceptor: accept: [application/json] [02/Nov/2018:14:54:37][ajp-bio-127.0.0.1-8009-exec-16]: MessageFormatInterceptor: request format: application/json [02/Nov/2018:14:54:37][ajp-bio-127.0.0.1-8009-exec-16]: MessageFormatInterceptor: response format: application/json [02/Nov/2018:14:54:37][ajp-bio-127.0.0.1-8009-exec-15]: PKIRealm: Authenticating certificate chain: [02/Nov/2018:14:54:37][ajp-bio-127.0.0.1-8009-exec-15]: PKIRealm.getAuditUserfromCert: certUID=CN=IPA RA, O=IPA.EXAMPLE.COM [02/Nov/2018:14:54:37][ajp-bio-127.0.0.1-8009-exec-15]: PKIRealm: CN=IPA RA, O=IPA.EXAMPLE.COM [02/Nov/2018:14:54:37][ajp-bio-127.0.0.1-8009-exec-15]: CertUserDBAuth: started [02/Nov/2018:14:54:37][ajp-bio-127.0.0.1-8009-exec-15]: CertUserDBAuth: Retrieving client certificate [02/Nov/2018:14:54:37][ajp-bio-127.0.0.1-8009-exec-15]: CertUserDBAuth: Got client certificate [02/Nov/2018:14:54:37][ajp-bio-127.0.0.1-8009-exec-15]: Authentication: client certificate found [02/Nov/2018:14:54:37][ajp-bio-127.0.0.1-8009-exec-15]: In LdapBoundConnFactory::getConn() [02/Nov/2018:14:54:37][ajp-bio-127.0.0.1-8009-exec-15]: masterConn is connected: true [02/Nov/2018:14:54:37][ajp-bio-127.0.0.1-8009-exec-15]: getConn: conn is connected true [02/Nov/2018:14:54:37][ajp-bio-127.0.0.1-8009-exec-15]: getConn: mNumConns now 2 [02/Nov/2018:14:54:37][ajp-bio-127.0.0.1-8009-exec-15]: returnConn: mNumConns now 3 [02/Nov/2018:14:54:37][ajp-bio-127.0.0.1-8009-exec-15]: CertUserDBAuthentication: cannot map certificate to any userUser not found [02/Nov/2018:14:54:37][ajp-bio-127.0.0.1-8009-exec-15]: SignedAuditLogger: event AUTH Any suggestions? Has something gone wrong with the setup? -- Peter Oliver

4 7

reinstall freeIPA server without loosing data
by Albert Szostkiewicz 19 Sep '19

19 Sep '19

I have an issue with my IPA server. Suddenly, after some recent system update, I am unable to log-in to web UI nor execute any command due to the 'unknown reason' and some "Unspecified GSS failure." I went through the suggested debugging process but no luck. I've seen similar issues in the past marked as a bug, but without clean solution rather than `updating to a newer version of ipa`. So I've filled bug report assuming that it could be a bug again. https://pagure.io/freeipa/issue/8065 Unfortunately, Devs might be too busy to look into that, so I was wondering if there is a way that I could re-install ipa-server without creating complete chaos and keeping all DNS/USER/HOSTS data? Any suggestions? Thanks!

4 6

services disabled by default on replicas ?
by danielle lampert 18 Sep '19

18 Sep '19

Hello, I'm running freeipa 4.5.0-20 on CentOS Linux release 7.4.1708 (Core) I've noticed that when rebooting my replica, things are not working anymore on this replica, as I can't get a kinit work for example. It seems that services are disabled by default and I wonder if this is normal ? Should we enable these services manually ? After restarting everything with an ipactl command, it then is working. Thanks in advance for your answers, below are my commands and their results. D.L. # kinit admin kinit: Cannot contact any KDC for realm 'IPB.RHCE.LOCAL' while getting initial credentials # systemctl status kadmin.service ● kadmin.service - Kerberos 5 Password-changing and Administration Loaded: loaded (/usr/lib/systemd/system/kadmin.service; disabled; vendor preset: disabled) Active: inactive (dead) # ipactl status Directory Service: RUNNING krb5kdc Service: STOPPED kadmin Service: STOPPED httpd Service: STOPPED ipa-custodia Service: STOPPED ntpd Service: STOPPED pki-tomcatd Service: STOPPED ipa-otpd Service: STOPPED ipa: INFO: The ipactl command was successful # ipactl restart Failed to get service list from file: Unknown error when retrieving list of services from file: [Errno 2] No such file or directory: '/var/run/ipa/services.list' Restarting Directory Service Restarting krb5kdc Service Restarting kadmin Service Restarting httpd Service Restarting ipa-custodia Service Restarting ntpd Service Restarting pki-tomcatd Service Restarting ipa-otpd Service ipa: INFO: The ipactl command was successful # kinit admin Password for admin(a)IPB.RHCE.LOCAL: # klist Ticket cache: KEYRING:persistent:0:0 Default principal: admin(a)IPB.RHCE.LOCAL Valid starting Expires Service principal 03/09/19 23:55:09 04/09/19 23:55:08 krbtgt/IPB.RHCE.LOCAL(a)IPB.RHCE.LOCAL

3 11

FreeIPA CA_REJECT issue during adding new replica
by Satish Patel 18 Sep '19

18 Sep '19

Folks, Stay with me while i explain my issue because its little complex, We had 2 working ldap running in datacenter-A for many months and life was good. Last year company decided to shutdown datacenter-A and migrate everything from there to new datacenter-B. This is what i did for migration, I have created two new LDAP server in Datacenter-B and run create replica from Datacenter-A ( but my bad luck we forgot to do --setup-ca option which create CA replica) In short we have no CA running in new datacenter-B Fun part start now. so finally few months back we shutdown datacenter-A and archived all data (LDAP was running in VMware so we archived vmdk), after 8 month we found our LDAP server running under load so we decided to create more replica and we found we have no CA master so we can't create replica. Damn it. We dig into datacenter-A archived and start ldap-ca-master start on new IP address we gave it same DNS name so it won't create any issue, when i start ldap-ca-master it started throwing error that some certs expired blah..blah.. so finally i renew them and this LDAP looks good now CA is also running. Hostname: ldap-ca-master (This is old datacenter LDAP with CA, awakened few days ago) ldap-b-1 (new datacenter LDAP without CA) ldap-b-2 (new datacenter LDAP without CA) Now i am trying to create new ldap-b-3 in new datacenter using ldap-b-1 as my master to create new replica and somehow i am getting following error RuntimeError: Certificate issuance failed (CA_REJECTED: Server at https://ldap-b-1.example.com/ipa/xml failed request, will retry: 4035 (RPC failed at server. Request failed with status 404: Non-2xx response from CA REST API: 404. ).) Installation failed. Rolling back changes. Unenrolling client from IPA server Unenrolling host failed: RPC failed at server. invalid 'hostname': An IPA master host cannot be deleted or disabled Question: 1. My all other ldap running 4.5.x but new replica is on 4.6 not sure that is the issue here or not? 2. I can see ldap-ca-master node isn't fully sync with ldap-b-1 and ldap-b-2 because i brought that machine in life after 8 month (do you think i should do force sync ldap-ca-master to sync with ldap-b-1 ?) 3. Should i use ldap-ca-master to create replica or i can pick any node to create replica? What are the options i have here to troubleshoot this issue?

2 6

Certmonger managed certificate signed by sub-ca
by Ben Rawson 18 Sep '19

18 Sep '19

I'm having some trouble getting sub-ca signed certificates issued and managed by certmonger. The implementation here [https://www.freeipa.org/page/V4/Sub-CAs] describes how that should work. I see that the -X option can be passed to ipa-getcert to specify the issuer, but every time I create a request with -X specified I get an error. Steps to reproduce: 1. Create a new CA named "Test" through the FreeIPA web UI. 2. Run the following on a host enrolled in freeIPA: ipa-getcert request -k /root/test.key -f /root/test.crt -I "testrequest" -X "Test" 3. Run ipa-getcert list and receive the an error message: Request ID 'test': status: CA_REJECTED ca-error: Server at https://ipa02.yyy.com/ipa/xml failed request, will retry: 4035 (RPC failed at server. Request failed with status 500: Non-2xx response from CA REST API: 500. ). stuck: yes key pair storage: type=FILE,location='/root/test.key' certificate: type=FILE,location='/root/test.crt' CA: IPA issuer: subject: expires: unknown pre-save command: post-save command: track: yes auto-renew: yes Running FreeIPA 4.6.4 Thanks for the help!

2 6

Check users last login ? To auto disable in-active users ?
by Morgan Cox 17 Sep '19

17 Sep '19

HI. For PCI DSS compliance I need to be able to disable users not logged in for X amount of days (I think its 90). I was going to create a script which checks last login time (I have a similar one for expired passwords), however I cannot find a way of doing so.. I have searched for info and found I should be able to get the info from the krbLastSuccessfulAuth value using # ipa user-find --all --raw But that field is not there. Also seen I can use # ipa user-status user But the value always shows ' Last successful authentication: N/A' Also seen using ldapsearch # ldapsearch -x -D "cn=Directory Manager" -W uid=serviceuser And the value is also missing. Reading about this is seems the value is cancelled when using replicas - is that right ? How can I perform what I need to - i.e how to check last login time for a user from the IPA servers (not on a per ipa client basis) ? Or is there a different way to disable in-active users ?

2 2

ipa-kra-install fails: Failed to update number range.
by Dmitry Perets 12 Sep '19

12 Sep '19

Hi, I've created a new IPA replica. ipa-replica-install has completed successfully. ipa-ca-install has completed successfully as well. However, ipa-kra-install fails. In the terminal the fails right here: Configuring KRA server (pki-tomcatd). Estimated time: 2 minutes [1/11]: creating ACIs for admin [2/11]: creating installation admin user [3/11]: configuring KRA instance Failed to configure KRA instance: Command '/usr/sbin/pkispawn -s KRA -f /tmp/tmp0w3vD5' returned non-zero exit status 1 See the installation logs and the following files/directories for more information: /var/log/pki/pki-tomcat [error] RuntimeError: KRA configuration failed. This is in /var/log/pki/pki-tomcat/kra/debug: [12/Sep/2019:15:58:34][http-bio-8443-exec-1]: === Subsystem Configuration === [12/Sep/2019:15:58:34][http-bio-8443-exec-1]: SystemConfigService: validate clone URI: https://t-idm-nbg2-1.poc.customer.de:443 [12/Sep/2019:15:58:35][http-bio-8443-exec-1]: SystemConfigService: get configuration entries from master [12/Sep/2019:15:58:35][http-bio-8443-exec-1]: updateNumberRange start host=t-idm-nbg2-1.poc.customer.de adminPort=443 eePort=443 [12/Sep/2019:15:58:35][http-bio-8443-exec-1]: updateNumberRange content: {xmlOutput=[true], sessionID=[5319570421915120898], type=[request]} [12/Sep/2019:15:58:35][http-bio-8443-exec-1]: ConfigurationUtils: POST https://t-idm-nbg2-1.poc.customer.de:443/kra/admin/kra/updateNumberRange [12/Sep/2019:15:58:35][http-bio-8443-exec-1]: Server certificate: [12/Sep/2019:15:58:35][http-bio-8443-exec-1]: - subject: CN=t-idm-nbg2-1.poc.customer.de,O=poc.customer.de [12/Sep/2019:15:58:35][http-bio-8443-exec-1]: - issuer: CN=Certificate Authority,O=poc.customer.de [12/Sep/2019:15:58:35][http-bio-8443-exec-1]: content from admin interface =<?xml version="1.0" encoding="UTF-8" standalone="no"?><XMLResponse><Status>1</Status><Error>Error: Failed to update number range.</Error></XMLResponse> [12/Sep/2019:15:58:35][http-bio-8443-exec-1]: updateNumberRange(): status=1 java.io.IOException: Error: Failed to update number range. I must note that in this environment there were a lot of redeployments of IPA servers, replicating from one another, deleting the original masters etc. And right now I have about 10 IPA servers running, out of them 2 with working KRA (this was supposed to be the 3rd one). I found a similar issue with an explanation how the number ranges can get depleted, but I am not sure how I can manually resolve this (without killing the entire environment of course): https://pagure.io/freeipa/issue/7654 Could you guide me in the right direction please? ipa-server 4.6.4... --- Regards, Dmitry Perets

2 1

how do you update certs for kinit -n?
by Charles Hedrick 12 Sep '19

12 Sep '19

Recent versions of freeipa support kinit -n. However we need a file that has certificates from all the servers. We have three servers. Their certificates renew themselves automatically a few hours before expiration. But then we need to concatenate all of them and put them on all clients. It should be part of the ipa client, or may sssd to retrieve the updated certs. We depend upon kinit -n as part of the script for doing kinit for users for one-time passwords. I had written a hack that uses a random user with no abilities. Until we ca find a way to distribute certs whenever they change I’m going to return to the hack rather than kinit -n.

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users September 2019