January 2020 - FreeIPA-users - Fedora mailing-lists

Removal & clean up certificates from o=ipaca
by David Goudet 30 Sep '24

30 Sep '24

Hello all, I have to clean up lot of useless certificate in dirsrv database. Because of resubmit loop on Certmonger client, i have 99,9% of certificate in dirsrv database that are useless and not obsolete (expiration in 2020) (it represent ~85 000 certificates). These useless certificates produce some issues on FreeIPA: - decrease FreeIPA performances on CLI and GUI - increase the LDAP size - increase size and time of FreeIPA backup ... Is it possible to purge these certificates in dirsrv database and how? I found two branches in LDAP directory about these certificates: dn: cn=xxx,ou=ca,ou=requests,o=ipaca dn: cn=yyy,ou=certificateRepository,ou=ca,o=ipaca I can remove all requests and certificates entry from dirsrv database but how it is supported by PKI manager Dogtag (CRL, certificate generation, OCSP)? (This topic has already been discuss on https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost…) Thank you for you help -- David GOUDET LYRA NETWORK IT Operations service Tel : +33 (0)5 32 09 09 74 | Poste : 574

4 7

How to prevent non-admin users of FreeIPA from reading the list of users in the web interface?
by cdknight 16 Apr '24

16 Apr '24

When a user signs in to FreeIPA, I do not want them to be able to view the list of users in my LDAP server under the "Active users" link. I still want them to be able to administer self-service, so they can reset their password, add OTP tokens, etc. How would I go about doing this? The users will only be able to access the web interface, so it doesn't matter whether they can access it from other sources.

5 10

certmonger error on ubuntu
by Robson Francisco de Souza 07 Feb '24

07 Feb '24

Hello! I've been running FreeIPA 4.3.1 on Ubuntu 16.04 for almost two years and most certificates should expire within three weeks. As this deadline approaches, I noticed certmonger has been unable to renew certificates due to the error below. After googling for two days, I found this issue has been observed by many people before, mostly after expiration of the certificates, as in https://tinyurl.com/vajmocw Still, I couldn't find a solution to this problem. If it is impossible to fix this issue while using FreeIPA 4.3.1, I would like to: 1) Find a way to renew all certificates even if certmonger can't be fixed. This would allow me to postpone the solution to after the next OS and/or FreeIPA upgrade 2) Find out what version of FreeIPA I should upgrade to while the operating system remains Ubuntu 16.04 Any help would be appreciated! Thanks! Robson ======> Command: systemctl status certmonger Nov 17 20:53:08 ipa.cefapnet.icb.usp.br certmonger[3873125]: 2019-11-17 20:53:08 [3873125] Error 77 connecting to https://ipa.cefapnet.icb.usp.br:8443/ca/agent/ca/profileReview: Problem with the SSL CA cert (path? access rights?). Nov 17 21:10:13 ipa.cefapnet.icb.usp.br dogtag-ipa-ca-renew-agent-submit[3875188]: Forwarding request to dogtag-ipa-renew-agent Nov 17 21:10:13 ipa.cefapnet.icb.usp.br dogtag-ipa-ca-renew-agent-submit[3875188]: dogtag-ipa-renew-agent returned 3 Nov 17 21:10:13 ipa.cefapnet.icb.usp.br certmonger[3873125]: 2019-11-17 21:10:13 [3873125] Error 77 connecting to https://ipa.cefapnet.icb.usp.br:8443/ca/agent/ca/profileReview: Problem with the SSL CA cert (path? access rights?). Nov 17 21:25:20 ipa.cefapnet.icb.usp.br dogtag-ipa-ca-renew-agent-submit[3875738]: Forwarding request to dogtag-ipa-renew-agent Nov 17 21:25:20 ipa.cefapnet.icb.usp.br dogtag-ipa-ca-renew-agent-submit[3875738]: dogtag-ipa-renew-agent returned 3 Nov 17 21:25:21 ipa.cefapnet.icb.usp.br certmonger[3873125]: 2019-11-17 21:25:21 [3873125] Error 77 connecting to https://ipa.cefapnet.icb.usp.br:8443/ca/agent/ca/profileReview: Problem with the SSL CA cert (path? access rights?). Nov 17 21:25:31 ipa.cefapnet.icb.usp.br dogtag-ipa-ca-renew-agent-submit[3875766]: Forwarding request to dogtag-ipa-renew-agent Nov 17 21:25:31 ipa.cefapnet.icb.usp.br dogtag-ipa-ca-renew-agent-submit[3875766]: dogtag-ipa-renew-agent returned 3 Nov 17 21:25:31 ipa.cefapnet.icb.usp.br certmonger[3873125]: 2019-11-17 21:25:31 [3873125] Error 77 connecting to https://ipa.cefapnet.icb.usp.br:8443/ca/agent/ca/profileReview: Problem with the SSL CA cert (path? access rights?). -- Robson Francisco de Souza, PhD Laboratório de Estrutura e Evolução de Proteínas (LEEP/PSEL) Departamento de Microbiologia Instituto de Ciências Biomédicas Universidade de São Paulo Av. Prof. Lineu Prestes, 1374 - Ed. Biomédicas II - Sala 250 - 2o. andar Tel: 3091-0891 Cidade Universitária - CEP 05508-900 - São Paulo - SP - Brasil ---- Robson Francisco de Souza, PhD Protein Structure and Evolution Laboratory (LEEP/PSEL) Microbiology Departament Biomedical Sciences Institute University of Sao Paulo Av. Prof. Lineu Prestes, 1374 - Biomédicas II - Sala 250 Phone: 55-11-3091-0891 Cidade Universitária - ZIP 05508-900 - São Paulo - SP - Brazil

6 10

FreeIPA web session timeout
by Yuri Krysko 10 Jan '24

10 Jan '24

Hello, Could you please advise how to configure FreeIPA web UI user session timeout? Thanks, Yuri ________________________________ LEGAL DISCLAIMER: M.C. Dean, Inc. and its subsidiaries considers this e-mail and any files transmitted with it to be protected, proprietary or privileged information intended solely for the use of the named recipient(s). Any disclosure of this material or the information contained herein, in whole or in part, to anyone outside of the intended recipient or affiliates is strictly prohibited. M. C. Dean, Inc. accepts no liability for the content of this e-mail or for the consequences of any actions taken on the basis of the information contained in it, unless that information is subsequently confirmed in writing. Employees of M.C. Dean, Inc. are instructed not to infringe on any rights of the recipient; any such communication violates company policy. If you are not the intended recipient, any disclosure, copying, distribution, or action taken or omitted in reliance on this information is strictly prohibited by M.C. Dean, Inc.; please notify the sender immediately by return e-mail, delete this communication and destroy all copies.

4 4

Allow sysaccount to view its own entry
by Adam Bishop 09 Nov '23

09 Nov '23

I have a piece of software that tries to look up its own uid to check that LDAP is correctly configured. This check fails because the sysaccount cannot view anything under cn=etc,cn=sysaccounts. Is there an existing permission/privilege that I can use to allow it to read the sysaccounts tree (or better, just its own entry)? Many Thanks, Adam Bishop

4 3

kinit: KDC can't fulfill requested option while renewing credentials - which approach?
by Pieter Baele 19 Sep '23

19 Sep '23

I tried various approached to get Renewable tickets : modifying the kdc modifying krb5.conf using kadmin.local on every replica to modify the principal; which is not working - as designed (?)- in IPA What should I do to get a ticket with the correct R flag from IPA ? I don't think this is SSSD related (the service needing the renewable ticket this way is Apache Storm) Thanks a lot!

3 4

Do keytabs expire?
by Ronald Wimmer 07 Jun '23

07 Jun '23

Hi, today I found out that some entries in a keytab file seemed to have expired: Request ticket server HTTP/mwc.linux.mydomain.at(a)LINUX.MYDOMAIN.AT kvno 4 not found in keytab; keytab is likely out of date Fetching the keytab again with ipa-getkeytab fixed the problem. But why is this happening? Do keytab entries expire? I have not set any custom password or ticket policies. Regards, Ronald

4 13

ipa-replica-install -- cannot get past [26/41]: creating DS keytab
by Jonathon Jenkins 28 Mar '23

28 Mar '23

Greetings, I cannot get the ipa-replica-install to proceed past step 26/41 - creating DS keytab. I see the command that is to be run, and I can run that just fine before and after the ipa-replica-install command, and it creates the keytab. I am not sure how to proceed from here - the bug reports I see all pertain to earlier versions, and my files reflect those changes. I have also tried running this with all manner of password flags, which are correct, but still getting insufficient access rights. particulars: centos 7 3.10.0-957.1.3.el7.x86_64 ipa-server-4.6.4-10.el7.centos.x86_64 ipa-common-4.6.4-10.el7.centos.noarch ipa-server-common-4.6.4-10.el7.centos.noarch ipa-client-4.6.4-10.el7.centos.x86_64 ipa-server-dns-4.6.4-10.el7.centos.noarch ipa-client-common-4.6.4-10.el7.centos.noarch * Note: anonymized output below ipapython.ipautil: DEBUG stderr= ipalib.backend: DEBUG Created connection context.ldap2_139891568509776 ipaserver.install.service: DEBUG duration: 7 seconds ipaserver.install.service: DEBUG [26/41]: creating DS keytab [26/41]: creating DS keytab ipalib.frontend: DEBUG raw: service_add(u'ldap/<ipa-replica-host>@<domain>.NET', force=True, version=u'2.229') ipalib.frontend: DEBUG service_add(ipapython.kerberos.Principal('ldap/<ipa-replica-host>@<domain>.NET'), force=True, all=False, raw=False, version=u'2.229', no_members=False) ipalib.frontend: DEBUG raw: host_show(u'<ipa-replica-host>', version=u'2.229') ipalib.frontend: DEBUG host_show(u'<ipa-replica-host>', rights=False, all=False, raw=False, version=u'2.229', no_members=False) ipalib.install.sysrestore: DEBUG Backing up system configuration file '/etc/dirsrv/ds.keytab' ipalib.install.sysrestore: DEBUG -> Not backing up - '/etc/dirsrv/ds.keytab' doesn't exist ipapython.ipautil: DEBUG Starting external process ipapython.ipautil: DEBUG args=/usr/sbin/ipa-getkeytab -k /etc/dirsrv/ds.keytab -p ldap/<ipa-replica-host>@<domain>.NET -H ldaps://<ipa-replica-master> ipapython.ipautil: DEBUG Process finished, return code=9 ipapython.ipautil: DEBUG stdout= ipapython.ipautil: DEBUG stderr=Failed to parse result: Insufficient access rights Retrying with pre-4.0 keytab retrieval method... Failed to parse result: Insufficient access rights Failed to get keytab! Failed to get keytab ipaserver.install.service: DEBUG Traceback (most recent call last): File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 570, in start_creation run_step(full_msg, method) File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 560, in run_step method() File "/usr/lib/python2.7/site-packages/ipaserver/install/dsinstance.py", line 1308, in request_service_keytab super(DsInstance, self).request_service_keytab() File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 742, in request_service_keytab self.run_getkeytab(self.api.env.ldap_uri, self.keytab, self.principal) File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 732, in run_getkeytab ipautil.run(args, nolog=nolog) File "/usr/lib/python2.7/site-packages/ipapython/ipautil.py", line 562, in run raise CalledProcessError(p.returncode, arg_string, str(output)) CalledProcessError: Command '/usr/sbin/ipa-getkeytab -k /etc/dirsrv/ds.keytab -p ldap/<ipa-replica-host>@<domain>.NET -H ldaps://<ipa-replica-master>' returned non-zero exit status 9 ipaserver.install.service: DEBUG [error] CalledProcessError: Command '/usr/sbin/ipa-getkeytab -k /etc/dirsrv/ds.keytab -p ldap/<ipa-replica-host>@<domain>.NET -H ldaps://<ipa-replica-master>' returned non-zero exit status 9 [error] CalledProcessError: Command '/usr/sbin/ipa-getkeytab -k /etc/dirsrv/ds.keytab -p ldap/<ipa-replica-host>@<domain>.NET -H ldaps://<ipa-replica-master>' returned non-zero exit status 9 ipalib.backend: DEBUG Destroyed connection context.ldap2_139891548583120 ipalib.install.sysrestore: DEBUG Backing up system configuration file '/etc/ipa/default.conf' ipalib.install.sysrestore: DEBUG Saving Index File to '/var/lib/ipa/sysrestore/sysrestore.index' Your system may be partly configured. Run /usr/sbin/ipa-server-install --uninstall to clean up. ipapython.admintool: DEBUG File "/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 178, in execute return_value = self.run() File "/usr/lib/python2.7/site-packages/ipapython/install/cli.py", line 319, in run return cfgr.run() File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 364, in run return self.execute() File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 389, in execute for rval in self._executor(): File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 434, in __runner exc_handler(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 463, in _handle_execute_exception self._handle_exception(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 453, in _handle_exception six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 424, in __runner step() File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 421, in <lambda> step = lambda: next(self.__gen) File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from value = gen.send(prev_value) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 658, in _configure next(executor) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 434, in __runner exc_handler(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 463, in _handle_execute_exception self._handle_exception(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 521, in _handle_exception self.__parent._handle_exception(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 453, in _handle_exception six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 518, in _handle_exception super(ComponentBase, self)._handle_exception(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 453, in _handle_exception six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 424, in __runner step() File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 421, in <lambda> step = lambda: next(self.__gen) File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from value = gen.send(prev_value) File "/usr/lib/python2.7/site-packages/ipapython/install/common.py", line 65, in _install for unused in self._installer(self.parent): File "/usr/lib/python2.7/site-packages/ipaserver/install/server/__init__.py", line 622, in main replica_install(self) File "/usr/lib/python2.7/site-packages/ipaserver/install/server/replicainstall.py", line 406, in decorated func(installer) File "/usr/lib/python2.7/site-packages/ipaserver/install/server/replicainstall.py", line 1431, in install fstore=fstore) File "/usr/lib/python2.7/site-packages/ipaserver/install/server/replicainstall.py", line 113, in install_replica_ds setup_pkinit=not options.no_pkinit, File "/usr/lib/python2.7/site-packages/ipaserver/install/dsinstance.py", line 419, in create_replica self.start_creation(runtime=30) File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 570, in start_creation run_step(full_msg, method) File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 560, in run_step method() File "/usr/lib/python2.7/site-packages/ipaserver/install/dsinstance.py", line 1308, in request_service_keytab super(DsInstance, self).request_service_keytab() File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 742, in request_service_keytab self.run_getkeytab(self.api.env.ldap_uri, self.keytab, self.principal) File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 732, in run_getkeytab ipautil.run(args, nolog=nolog) File "/usr/lib/python2.7/site-packages/ipapython/ipautil.py", line 562, in run raise CalledProcessError(p.returncode, arg_string, str(output)) ipapython.admintool: DEBUG The ipa-replica-install command failed, exception: CalledProcessError: Command '/usr/sbin/ipa-getkeytab -k /etc/dirsrv/ds.keytab -p ldap/<ipa-replica-host>@<domain>.NET -H ldaps://<ipa-replica-master>' returned non-zero exit status 9 ipapython.admintool: ERROR Command '/usr/sbin/ipa-getkeytab -k /etc/dirsrv/ds.keytab -p ldap/<ipa-replica-host>@<domain>.NET -H ldaps://<ipa-replica-master>' returned non-zero exit status 9 ipapython.admintool: ERROR The ipa-replica-install command failed. See /var/log/ipareplica-install.log for more information

2 2

Problem running IPA client on IPv6 only connection
by William Muriithi 26 Jul '22

26 Jul '22

Hello, I have an IPA clients that has both IPv4 and IPv6 addresses. One of the IPA client is in the office and hence can reach the IPA server on both IPv4 and IPv6. However, the client outside the LAN can only reach the IPA server over IPv6. I was able to enroll the external client fine over IPv6 and from the logs, all clean. However, when I attempted to ssh, its not able to retreave the user from IPA. The client in the office works fine. I can also make for example LDAP queries and they work over IPv6 fine. It looks like kerberos is somehow however using IPv4. I reached this conclusion after taking a tcpdump when attempting to ssh to the server and the kerberos traffic from the client to IPA is on IPv4. What would I need to do on the IPA client for it to prefer IPv6? I am aware I could remove IPv4 address from DNS, but that would break any communication from IPv4 only systems. Any assistance would be appreaciated. [william@ansible ~]$ ssh root(a)mars.external.example.com Last login: Mon Jan 7 17:19:49 2019 from 65.98.193.94 [root@mars ~]# kinit admin kinit: Cannot contact any KDC for realm 'EXTERNAL.EXAMPLE.COM <http://external.example.com/>' while getting initial credentials [root@mars ~]# ldapsearch -x -b cn=ftp,cn=groups,cn=compat,dc=external,dc=example,dc=com | tail -n 4 result: 0 Success # numResponses: 2 # numEntries: 1 [root@mars ~]# cat /etc/resolv.conf search external.example.com nameserver 2607:4860:6000:a::5 [root@mars ~]# Regards, William

5 10

Could not login with AD user
by Ronald Wimmer 20 Jul '22

20 Jul '22

Today I was not able to log in with an AD user to an IPA client within a test setup. IPA users worked fine. DNS is managed externally. I figured out that the DNS-Record of that particular IPA client has not been created correctly. After having corrected the DNS entry and having dropped the SSSD cache on that client I could login with my AD user. Do you have an explanation for that or was it just a coincidence? Cheers, Ronald

4 13

freeipa/certmonger for openvpn user certificates
by Patrick Spinler 27 Jun '22

27 Jun '22

Hi, I'm setting up an openvpn server and I'd like to use our already existing FreeIPA CA to issue user keys/certs for openvpn's use. Since our OpenVPN box is a freeipa client, I thought it'd be nice to use certmonger to issue and keep up to date these certs. Ergo, I've created a certificate profile: pat@apex-freeipa ~$ ipa certprofile-show --all OpenVPNUserCert dn: cn=OpenVPNUserCert,cn=certprofiles,cn=ca,dc=int,dc=apexmw,dc=com Profile ID: OpenVPNUserCert Profile description: OpenVPN User Certificates Store issued certificates: FALSE objectclass: ipacertprofile, top And also a CA acl. For experimentation (and working vs our test freeipa) I've left this as wide open as I can: [pat@apex-freeipa ~]$ ipa caacl-show --all OpenVPN_User_Certificate_ACL dn: ipaUniqueID=6dde33a6-7849-11e9-aa05-525400b52c7b,cn=caacls,cn=ca,dc=int,dc=apexmw,dc=com ACL name: OpenVPN_User_Certificate_ACL Enabled: TRUE CA category: all Profile category: all User category: all Host category: all Service category: all ipauniqueid: 6dde33a6-7849-11e9-aa05-525400b52c7b objectclass: ipaassociation, ipacaacl Then, on my openvpn server, I ask for a cert for use for one of my users (myself, in this case): root@apex-openvpn:~# ipa-getcert request -f /etc/openvpn/client/pat.crt -k /etc/openvpn/client/pat.key -r -N 'CN=pat,O=INT.APEXMW.COM' -K pat -g 4096 --profile OpenVPNUserCert New signing request "20190603014016" added. But, it fails due to an access err vs the 'userCertificate' attribute of my account: root@apex-openvpn:~# ipa-getcert list (...snippy snip excess...) Request ID '20190603014016': status: CA_REJECTED ca-error: Server at https://apex-freeipa.int.apexmw.com/ipa/xml denied our request, giving up: 2100 (RPC failed at server. Insufficient access: Insufficient 'write' privilege to the 'userCertificate' attribute of entry 'uid=pat,cn=users,cn=accounts,dc=int,dc=apexmw,dc=com'.). stuck: yes key pair storage: type=FILE,location='/etc/openvpn/client/pat.key' certificate: type=FILE,location='/etc/openvpn/client/pat.crt' CA: IPA issuer: subject: expires: unknown pre-save command: post-save command: track: yes auto-renew: yes If I look at the dirsrv log, here's the accesses I see for this request (trimmed off the date/time to make the lines a _little_ shorter): root@apex-freeipa slapd-INT-APEXMW-COM# grep conn=178 access | cut -d' ' -f3- conn=178 fd=114 slot=114 connection from 10.10.200.1 to 10.10.200.1 conn=178 op=0 BIND dn="" method=sasl version=3 mech=GSS-SPNEGO conn=178 op=0 RESULT err=0 tag=97 nentries=0 etime=0.0025554208 dn="fqdn=apex-openvpn.int.apexmw.com,cn=computers,cn=accounts,dc=int,dc=apexmw,dc=com" conn=178 op=1 SRCH base="cn=ipaconfig,cn=etc,dc=int,dc=apexmw,dc=com" scope=0 filter="(objectClass=*)" attrs=ALL conn=178 op=1 RESULT err=0 tag=101 nentries=1 etime=0.0001319554 conn=178 op=2 SRCH base="cn=masters,cn=ipa,cn=etc,dc=int,dc=apexmw,dc=com" scope=2 filter="(&(objectClass=ipaConfigObject)(cn=CA))" attrs=ALL conn=178 op=2 RESULT err=0 tag=101 nentries=1 etime=0.0000979573 conn=178 op=3 SRCH base="cn=masters,cn=ipa,cn=etc,dc=int,dc=apexmw,dc=com" scope=2 filter="(&(objectClass=ipaConfigObject)(cn=CA))" attrs=ALL conn=178 op=3 RESULT err=0 tag=101 nentries=1 etime=0.0000736730 conn=178 op=4 SRCH base="cn=cas,cn=ca,dc=int,dc=apexmw,dc=com" scope=2 filter="(&(objectClass=ipaca)(cn=ipa))" attrs="" conn=178 op=4 RESULT err=0 tag=101 nentries=1 etime=0.0000499142 conn=178 op=5 SRCH base="cn=ipa,cn=cas,cn=ca,dc=int,dc=apexmw,dc=com" scope=0 filter="(objectClass=*)" attrs="ipaCaId ipaCaSubjectDN cn ipaCaIssuerDN description" conn=178 op=5 RESULT err=0 tag=101 nentries=1 etime=0.0000482726 conn=178 op=6 SRCH base="cn=apex-freeipa.int.apexmw.com,cn=masters,cn=ipa,cn=etc,dc=int,dc=apexmw,dc=com" scope=2 filter="(&(objectClass=ipaConfigObject)(ipaConfigString=enabledService)(cn=CA))" attrs=ALL conn=178 op=6 RESULT err=0 tag=101 nentries=1 etime=0.0000950646 notes=U conn=178 op=7 SRCH base="cn=accounts,dc=int,dc=apexmw,dc=com" scope=2 filter="(&(objectClass=krbprincipalaux)(krbPrincipalName=pat(a)INT.APEXMW.COM))" attrs=ALL conn=178 op=7 RESULT err=0 tag=101 nentries=1 etime=0.0002747849 conn=178 op=8 EXT oid="1.3.6.1.4.1.4203.1.11.3" name="whoami-plugin" conn=178 op=8 RESULT err=0 tag=120 nentries=0 etime=0.0000135034 conn=178 op=9 SRCH base="cn=request certificate ignore caacl,cn=virtual operations,cn=etc,dc=int,dc=apexmw,dc=com" scope=0 filter="(objectClass=*)" attrs="objectClass" conn=178 op=9 RESULT err=0 tag=101 nentries=1 etime=0.0000932668 - entryLevelRights: none conn=178 op=10 SRCH base="uid=pat,cn=users,cn=accounts,dc=int,dc=apexmw,dc=com" scope=0 filter="(objectClass=*)" attrs="distinguishedName" conn=178 op=10 RESULT err=0 tag=101 nentries=1 etime=0.0000640289 conn=178 op=11 SRCH base="uid=pat,cn=users,cn=accounts,dc=int,dc=apexmw,dc=com" scope=0 filter="(objectClass=*)" attrs="telephoneNumber ipaSshPubKey uid krbCanonicalName ipatokenRadiusUserName ipaUserAuthType krbPrincipalExpiration homeDirectory nsAccountLock usercertificate;binary title loginShell uidNumber mail ipaCertMapData memberOf memberofindirect krbPrincipalName givenName gidNumber sn ou userClass ipatokenRadiusConfigLink" conn=178 op=11 RESULT err=0 tag=101 nentries=1 etime=0.0001401737 conn=178 op=12 SRCH base="dc=int,dc=apexmw,dc=com" scope=2 filter="(|(member=uid=pat,cn=users,cn=accounts,dc=int,dc=apexmw,dc=com)(memberUser=uid=pat,cn=users,cn=accounts,dc=int,dc=apexmw,dc=com)(memberHost=uid=pat,cn=users,cn=accounts,dc=int,dc=apexmw,dc=com))" attrs="" conn=178 op=12 RESULT err=0 tag=101 nentries=7 etime=0.0001492344 notes=P pr_idx=0 pr_cookie=-1 conn=178 op=13 SRCH base="uid=pat,cn=users,cn=accounts,dc=int,dc=apexmw,dc=com" scope=0 filter="(userPassword=*)" attrs="userPassword" conn=178 op=13 RESULT err=0 tag=101 nentries=1 etime=0.0000524838 conn=178 op=14 SRCH base="uid=pat,cn=users,cn=accounts,dc=int,dc=apexmw,dc=com" scope=0 filter="(krbPrincipalKey=*)" attrs="krbPrincipalKey" conn=178 op=14 RESULT err=0 tag=101 nentries=1 etime=0.0000597589 conn=178 op=15 SRCH base="ipaUniqueID=80b23b30-6a0c-11e9-baa3-525400b52c7b,cn=sudorules,cn=sudo,dc=int,dc=apexmw,dc=com" scope=0 filter="(objectClass=*)" attrs="cn" conn=178 op=15 RESULT err=0 tag=101 nentries=1 etime=0.0000379744 conn=178 op=16 SRCH base="ipaUniqueID=5fb3a640-705a-11e9-aa05-525400b52c7b,cn=hbac,dc=int,dc=apexmw,dc=com" scope=0 filter="(objectClass=*)" attrs="cn" conn=178 op=16 RESULT err=0 tag=101 nentries=1 etime=0.0000337904 conn=178 op=17 SRCH base="cn=caacls,cn=ca,dc=int,dc=apexmw,dc=com" scope=1 filter="(&(objectClass=ipaassociation)(objectClass=ipacaacl))" attrs="serviceCategory cn ipaMemberCertProfile ipaMemberCa ipaCertProfileCategory memberUser userCategory hostCategory memberHost ipaEnabledFlag ipaCaCategory memberService description" conn=178 op=17 RESULT err=0 tag=101 nentries=2 etime=0.0001647058 conn=178 op=18 EXT oid="1.3.6.1.4.1.4203.1.11.3" name="whoami-plugin" conn=178 op=18 RESULT err=0 tag=120 nentries=0 etime=0.0000138321 conn=178 op=19 SRCH base="uid=pat,cn=users,cn=accounts,dc=int,dc=apexmw,dc=com" scope=0 filter="(objectClass=*)" attrs="userCertificate" conn=178 op=19 RESULT err=0 tag=101 nentries=1 etime=0.0001475052 - entryLevelRights: none conn=178 op=20 UNBIND conn=178 op=20 fd=114 closed - U1 To begin with, I note that this session does a BIND with 'dn=""', right at the beginning, it's essentially an anonymous bind, yah? That operation near the end, here: op=17 SRCH base="cn=caacls,cn=ca,dc=int,dc=apexmw,dc=com" scope=1 filter="(&(objectClass=ipaassociation)(objectClass=ipacaacl))" seems like it might be kinda key. and indeed, if I attempt to run this by hand as an anonymous bind, I get no results: root@apex-freeipa slapd-INT-APEXMW-COM# ldapsearch -x -h localhost -b dc=int,dc=apexmw,dc=com -s sub "(|(objectClass=ipaassociation)(objectClass=ipacaacl))" # extended LDIF # # LDAPv3 # base <dc=int,dc=apexmw,dc=com> with scope subtree # filter: (|(objectClass=ipaassociation)(objectClass=ipacaacl)) # requesting: ALL # # search result search: 2 result: 0 Success # numResponses: 1 It's only if I run this as an _authenticated_ bind, that I can find my ACL: root@apex-freeipa slapd-INT-APEXMW-COM# ldapsearch -x -D "cn=Directory Manager" -W -h localhost -b dc=int,dc=apexmw,dc=com -s sub "(&(objectClass=ipaassociation)(objectClass=ipacaacl))" cn Enter LDAP Password: # extended LDIF # # LDAPv3 # base <dc=int,dc=apexmw,dc=com> with scope subtree # filter: (&(objectClass=ipaassociation)(objectClass=ipacaacl)) # requesting: cn # # c98b740c-6903-11e9-ad1b-525400b52c7b, caacls, ca, int.apexmw.com dn: ipaUniqueID=c98b740c-6903-11e9-ad1b-525400b52c7b,cn=caacls,cn=ca,dc=int,dc =apexmw,dc=com cn: hosts_services_caIPAserviceCert # 6dde33a6-7849-11e9-aa05-525400b52c7b, caacls, ca, int.apexmw.com dn: ipaUniqueID=6dde33a6-7849-11e9-aa05-525400b52c7b,cn=caacls,cn=ca,dc=int,dc =apexmw,dc=com cn: OpenVPN_User_Certificate_ACL # search result search: 2 result: 0 Success # numResponses: 3 # numEntries: 2 Is this (using certmonger to auto-issue signed certs/keys for my openvpn users) going to be essentially impossible to do, here? Do I need to go a more traditional route of creating a seperate keystore/certdb, issuing a CSR, and feeding that to FreeIPA to sign? Any advice appreciated, and thanks in advance, -- Pat

4 6

Broken ipa replica
by Giulio Casella 08 May '22

08 May '22

Hi everyone, I'm stuck with a broken replica. I had a setup with two ipa server in replica (ipa-server-4.6.4 on CentOS 7.6), let's say "idc01" and "idc02". Due to heavy load idc01 crashed many times, and was not working anymore. So I tried to redo the replica again. At first I tried to "ipa-replica-manage re-initialize", with no success. Now I'm trying to redo from scratch the replica setup: on idc02 I removed the segments (ipa topologysegment-del, for both ca and domain suffix), on idc01 I removed everything (ipa-server-install --uninstall), then I joined domain (ipa-client-install), and everything is working so far. When doing "ipa-replica-install" on idc01 I get: [...] [28/41]: setting up initial replication Starting replication, please wait until this has completed. Update in progress, 22 seconds elapsed [ldap://idc02.my.dom.ain:389] reports: Update failed! Status: [Error (-11) connection error: Unknown connection error (-11) - Total update aborted] And on idc02 (the working server), in /var/log/dirsrv/slapd-MY-DOM-AIN/errors I find lines stating: [20/Mar/2019:09:28:06.545187923 +0100] - INFO - NSMMReplicationPlugin - repl5_tot_run - Beginning total update of replica "agmt="cn=meToidc01.my.dom.ain" (idc01:389)". [20/Mar/2019:09:28:26.528046160 +0100] - ERR - NSMMReplicationPlugin - perform_operation - agmt="cn=meToidc01.my.dom.ain" (idc01:389): Failed to send extended operation: LDAP error -1 (Can't contact LDAP server) [20/Mar/2019:09:28:26.530763939 +0100] - ERR - NSMMReplicationPlugin - repl5_tot_log_operation_failure - agmt="cn=meToidc01.my.dom.ain" (idc01:389): Received error -1 (Can't contact LDAP server): for total update operation [20/Mar/2019:09:28:26.532678072 +0100] - ERR - NSMMReplicationPlugin - release_replica - agmt="cn=meToidc01.my.dom.ain" (idc01:389): Unable to send endReplication extended operation (Can't contact LDAP server) [20/Mar/2019:09:28:26.534307539 +0100] - ERR - NSMMReplicationPlugin - repl5_tot_run - Total update failed for replica "agmt="cn=meToidc01.my.dom.ain" (idc01:389)", error (-11) [20/Mar/2019:09:28:26.561763168 +0100] - INFO - NSMMReplicationPlugin - bind_and_check_pwp - agmt="cn=meToidc01.my.dom.ain" (idc01:389): Replication bind with GSSAPI auth resumed [20/Mar/2019:09:28:26.582389258 +0100] - WARN - NSMMReplicationPlugin - repl5_inc_run - agmt="cn=meToidc01.my.dom.ain" (idc01:389): The remote replica has a different database generation ID than the local database. You may have to reinitialize the remote replica, or the local replica. It seems that idc02 remembers something about the old replica. Any hint? Thank you in advance, Giulio

5 10

IPA CA allow CSR SAN names in external domains
by Steve Dainard 14 Mar '22

14 Mar '22

Hello I have a RHEL7 IPA server installed as a subordinate CA. I'd like to be able to add SAN's for a different dns domain than exists in the IPA realm. The dns for 'otherdomain.com' is handled by active directory which my IPA server has a cross-forest trust with. ie: host: client1.ipadomain.com certificate: CN = client1.ipadomain.com, SAN = client1.ipadomain.com, servicename.otherdomain.com When I try to submit this CSR with 'ipa-getcert request' the IPA server denies with: "The service principal for subject alt name servicename.otherdomain.com in certificate request does not exist" It seems that the default CAACL enforces a profile named 'caIPAserviceCert', but I'm having some trouble determining what can be modified (or cloned and changed in a new profile) that would allow the CA to sign a CSR that contains *.ipadomain.com and *.otherdomain.com in the SAN. This is the only section in the profile that contains SAN: policyset.serverCertSet.12.constraint.class_id=noConstraintImpl policyset.serverCertSet.12.constraint.name=No Constraint policyset.serverCertSet.12.default.class_id=commonNameToSANDefaultImpl policyset.serverCertSet.12.default.name=Copy Common Name to Subject Alternative Name Thanks, Steve

3 3

freeipa with sudo and 2FA (OTP)
by John Ratliff 31 Jan '22

31 Jan '22

I'm trying to setup freeipa with OTP. I created a TOTP under my user in freeipa and updated my user to use 2FA (password + OTP). When I try to do sudo, it only asks for my password and it fails every time (presumably because it isn't getting the OTP first). I didn't see anything useful in the sss_sudo logs, even after adding debug_level = 6 in the config. What can I do to further troubleshoot this? Thanks.

4 6

User in AD not found by IPA
by Marc Boorshtein 14 Oct '21

14 Oct '21

We added a new account to AD that has a domain trust with FreeIPA. This one user is having an issue where IPA can't find him. The user is in the same OU as other users that work fine. The user is unlocked (userAccountControl is 512) and the userprincipalname is set. When I try to add the user to an id view or an external group IPA gives me the error "trusted domain object not found" . Not really sure where to look next to figure out what's wrong. We see the user when we make LDAP calls to AD. Thanks Marc

4 14

Cannot add externally-signed IPA CA certificate
by Dmitry Perets 27 Aug '21

27 Aug '21

Hi, I am trying to configure FreeIPA as a SubCA, and the "RootCA" is self-made with openssl. So I've signed the FreeIPA's request with my self-signed "root ca" certificate, but it looks like FreeIPA doesn't like it: ipa-server-install --external-cert-file=/root/rootca/rootcacert.pem --external-cert-file=/root/rootca/certs/ipacert.pem <...skipped...> ipa.ipapython.install.cli.install_tool(CompatServerMasterInstall): ERROR CA certificate CN=RootCA,OU=PRJ,O=COMPANY,L=Bonn,C=DE in /root/rootca/rootcacert.pem, /root/rootca/certs/ipacert.pem is not valid: not a CA certificate ipa.ipapython.install.cli.install_tool(CompatServerMasterInstall): ERROR The ipa-server-install command failed. See /var/log/ipaserver-install.log for more information The subj above is my self-made root CA cert, so it looks like something is missing in it. But what...? Here is it below, it has the "Basic Constraint" set with CA:TRUE... What else is required, so that FreeIPA accepts it as a root CA? Should I add it somewhere first, before running the ipa-server-install? [root@ipa ~]# openssl x509 -text -noout -in /root/rootca/rootcacert.pem Certificate: Data: Version: 3 (0x2) Serial Number: 0 (0x0) Signature Algorithm: sha256WithRSAEncryption Issuer: C=DE, L=Bonn, O=COMPANY, OU=PRJ, CN=RootCA Validity Not Before: Oct 24 11:43:13 2018 GMT Not After : Oct 21 11:43:13 2028 GMT Subject: C=DE, L=Bonn, O=COMPANY, OU=PRJ, CN=RootCA Subject Public Key Info: Public Key Algorithm: rsaEncryption Public-Key: (4096 bit) Modulus: <...skipped...> Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Subject Key Identifier: B3:18:3B:CF:29:D2:A5:D4:AE:94:A5:42:65:A2:D8:12:7C:92:78:81 X509v3 Authority Key Identifier: keyid:B3:18:3B:CF:29:D2:A5:D4:AE:94:A5:42:65:A2:D8:12:7C:92:78:81 X509v3 Basic Constraints: CA:TRUE Signature Algorithm: sha256WithRSAEncryption <...skipped...> Thanks!!

2 2

Unable to install ipa client centos 7.5.1804 (Core)
by William Graboyes 16 Feb '21

16 Feb '21

Hello List, I have been searching around for the day and have found an answer for the error I am getting when I am trying to install the client on a brand new install: Version: ipa-client-4.5.4-10.el7.centos.3.x86_64 ipa-client-common-4.5.4-10.el7.centos.3.noarch The error is below (run as root, not via sudo): ipa-client-install Traceback (most recent call last): File "/sbin/ipa-client-install", line 22, in <module> from ipaclient.install import ipa_client_install File "/usr/lib/python2.7/site-packages/ipaclient/install/ipa_client_install.py", line 5, in <module> from ipaclient.install import client File "/usr/lib/python2.7/site-packages/ipaclient/install/client.py", line 34, in <module> from ipalib import api, errors, x509 File "/usr/lib/python2.7/site-packages/ipalib/x509.py", line 45, in <module> from pyasn1_modules import rfc2315, rfc2459 File "/usr/lib/python2.7/site-packages/pyasn1_modules/rfc2315.py", line 67, in <module> class DigestedData(univ.Sequence): File "/usr/lib/python2.7/site-packages/pyasn1_modules/rfc2315.py", line 72, in DigestedData namedtype.NamedType('digest', Digest) File "/usr/lib/python2.7/site-packages/pyasn1/type/namedtype.py", line 115, in __init__ self.__ambiguousTypes = 'terminal' not in kwargs and self.__computeAmbiguousTypes() or {} File "/usr/lib/python2.7/site-packages/pyasn1/type/namedtype.py", line 232, in __computeAmbiguousTypes ambigiousTypes[idx] = NamedTypes(*partialAmbigiousTypes, **dict(terminal=True)) File "/usr/lib/python2.7/site-packages/pyasn1/type/namedtype.py", line 114, in __init__ self.__tagToPosMap = self.__computeTagToPosMap() File "/usr/lib/python2.7/site-packages/pyasn1/type/namedtype.py", line 205, in __computeTagToPosMap for _tagSet in tagMap.presentTypes: AttributeError: 'property' object has no attribute 'presentTypes' Any help would be greatly appreciated. Thanks, Bill G.

3 2

FreeIPA, OSX, DockerDesktop
by james liu 14 Oct '20

14 Oct '20

PREP ==== git clone https://github.com/freeipa/freeipa-container.git cd freeipa-container mkdir /tmp/ipa-data docker run --name freeipa-server-container -ti -h ipa.example.test --read-only -v /tmp/ip-data :/data:Z freeipa-server --sysctl net.ipv6.conf.all.disable_ipv6=1 RESULT ====== tar: etc/sysconfig/selinux: Cannot utime: No such file or directory tar: Exiting with failure status due to previous errors QUESTION ========= I'm running DockerDesktop 2.0.4, OSX 10.13.6. Is there a set of commands that will work? Thanks

4 6

yum update problem
by Natxo Asenjo 02 Oct '20

02 Oct '20

hi, after patching our centos 7 hosts to the latest version today, one of the two replicas is having trouble. [root@kdc2 ~]# ipactl status Directory Service: RUNNING krb5kdc Service: STOPPED kadmin Service: STOPPED named Service: STOPPED httpd Service: RUNNING ipa-custodia Service: STOPPED ntpd Service: STOPPED pki-tomcatd Service: RUNNING smb Service: STOPPED winbind Service: STOPPED ipa-otpd Service: STOPPED ipa-dnskeysyncd Service: STOPPED ipa: INFO: The ipactl command was successful and after digging in the logs I come across this in /var/log/ipaupgrade.log: 2019-11-20T18:18:29Z DEBUG stderr= 2019-11-20T18:18:31Z INFO Certmonger certificate renewal configuration already up-to-date 2019-11-20T18:18:31Z INFO [Enable PKIX certificate path discovery and validation] 2019-11-20T18:18:31Z DEBUG Loading StateFile from '/var/lib/ipa/sysupgrade/sysupgrade.state' 2019-11-20T18:18:31Z INFO PKIX already enabled 2019-11-20T18:18:31Z INFO [Authorizing RA Agent to modify profiles] 2019-11-20T18:18:31Z INFO [Authorizing RA Agent to manage lightweight CAs] 2019-11-20T18:18:31Z INFO [Ensuring Lightweight CAs container exists in Dogtag database] 2019-11-20T18:18:31Z DEBUG Created connection context.ldap2_139740162547472 2019-11-20T18:18:31Z DEBUG flushing ldapi://%2fvar%2frun%2fslapd-L-DOMAIN-IT.socket from SchemaCache 2019-11-20T18:18:31Z DEBUG retrieving schema for SchemaCache url=ldapi://%2fvar%2frun%2fslapd-L-DOMAIN-IT.socket conn=<ldap.ldapobject.SimpleLDAPObject instance at 0x7f17cc24b638> 2019-11-20T18:18:31Z DEBUG Destroyed connection context.ldap2_139740162547472 2019-11-20T18:18:31Z INFO [Adding default OCSP URI configuration] 2019-11-20T18:18:31Z INFO [Ensuring CA is using LDAPProfileSubsystem] 2019-11-20T18:18:31Z INFO [Migrating certificate profiles to LDAP] 2019-11-20T18:18:31Z DEBUG Created connection context.ldap2_139740160021648 2019-11-20T18:18:31Z DEBUG flushing ldapi://%2fvar%2frun%2fslapd-L-DOMAIN-IT.socket from SchemaCache 2019-11-20T18:18:31Z DEBUG retrieving schema for SchemaCache url=ldapi://%2fvar%2frun%2fslapd-L-DOMAIN-IT.socket conn=<ldap.ldapobject.SimpleLDAPObject instance at 0x7f17cc289b00> 2019-11-20T18:18:31Z DEBUG Destroyed connection context.ldap2_139740160021648 2019-11-20T18:18:31Z DEBUG request GET https://kdc2.l.domain.it:8443/ca/rest/account/login 2019-11-20T18:18:31Z DEBUG request body '' 2019-11-20T18:18:31Z DEBUG response status 401 2019-11-20T18:18:31Z DEBUG response headers Server: Apache-Coyote/1.1 Cache-Control: private Expires: Thu, 01 Jan 1970 01:00:00 CET WWW-Authenticate: Basic realm="Certificate Authority" Content-Type: text/html;charset=utf-8 Content-Language: en Content-Length: 951 Date: Wed, 20 Nov 2019 18:18:31 GMT 2019-11-20T18:18:31Z DEBUG response body '<html><head><title>Apache Tomcat/7.0.76 - Error report</title><style></style> </head><body><h1>HTTP Status 401 - </h1><HR size="1" noshade="noshade"><p><b>type</b> Status report</p><p><b>message</b> <u></u></p><p><b>description</b> <u>This request requires HTTP authentication.</u></p><HR size="1" noshade="noshade"><h3>Apache Tomcat/7.0.76</h3></body></html>' 2019-11-20T18:18:31Z ERROR IPA server upgrade failed: Inspect /var/log/ipaupgrade.log and run command ipa-server-upgrade manually. 2019-11-20T18:18:31Z DEBUG File "/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 178, in execute return_value = self.run() File "/usr/lib/python2.7/site-packages/ipaserver/install/ipa_server_upgrade.py", line 54, in run server.upgrade() File "/usr/lib/python2.7/site-packages/ipaserver/install/server/upgrade.py", line 2146, in upgrade upgrade_configuration() File "/usr/lib/python2.7/site-packages/ipaserver/install/server/upgrade.py", line 2018, in upgrade_configuration ca_enable_ldap_profile_subsystem(ca) File "/usr/lib/python2.7/site-packages/ipaserver/install/server/upgrade.py", line 406, in ca_enable_ldap_profile_subsystem cainstance.migrate_profiles_to_ldap() File "/usr/lib/python2.7/site-packages/ipaserver/install/cainstance.py", line 2027, in migrate_profiles_to_ldap _create_dogtag_profile(profile_id, profile_data, overwrite=False) File "/usr/lib/python2.7/site-packages/ipaserver/install/cainstance.py", line 2033, in _create_dogtag_profile with api.Backend.ra_certprofile as profile_api: File "/usr/lib/python2.7/site-packages/ipaserver/plugins/dogtag.py", line 1315, in __enter__ raise errors.RemoteRetrieveError(reason=_('Failed to authenticate to CA REST API')) 2019-11-20T18:18:31Z DEBUG The ipa-server-upgrade command failed, exception: RemoteRetrieveError: Failed to authenticate to CA REST API 2019-11-20T18:18:31Z ERROR Unexpected error - see /var/log/ipaupgrade.log for details: RemoteRetrieveError: Failed to authenticate to CA REST API In this kdc I see these errors in getcert list: Request ID '20190220182014': status: MONITORING ca-error: Invalid cookie: u'' stuck: no key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert cert-pki-ca',token='NSS Certificate DB',pin set certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert cert-pki-ca',token='NSS Certificate DB' CA: dogtag-ipa-ca-renew-agent issuer: CN=Certificate Authority,O=L.DOMAIN.IT subject: CN=CA Audit,O=L.DOMAIN.IT expires: 2019-12-05 13:58:24 UTC key usage: digitalSignature,nonRepudiation pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "auditSigningCert cert-pki-ca" track: yes auto-renew: yes Request ID '20190220182015': status: MONITORING ca-error: Invalid cookie: u'' stuck: no key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert cert-pki-ca',token='NSS Certificate DB',pin set certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert cert-pki-ca',token='NSS Certificate DB' CA: dogtag-ipa-ca-renew-agent issuer: CN=Certificate Authority,O=L.DOMAIN.IT subject: CN=OCSP Subsystem,O=L.DOMAIN.IT expires: 2019-12-05 13:58:24 UTC key usage: digitalSignature,nonRepudiation,keyCertSign,cRLSign eku: id-kp-OCSPSigning pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "ocspSigningCert cert-pki-ca" track: yes auto-renew: yes Request ID '20190220182016': status: MONITORING ca-error: Invalid cookie: u'' stuck: no key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert cert-pki-ca',token='NSS Certificate DB',pin set certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert cert-pki-ca',token='NSS Certificate DB' CA: dogtag-ipa-ca-renew-agent issuer: CN=Certificate Authority,O=L.DOMAIN.IT subject: CN=CA Subsystem,O=L.DOMAIN.IT expires: 2019-12-05 13:58:24 UTC key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment eku: id-kp-serverAuth,id-kp-clientAuth pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "subsystemCert cert-pki-ca" track: yes auto-renew: yes Request ID '20190220182018': status: MONITORING ca-error: Invalid cookie: u'' stuck: no key pair storage: type=FILE,location='/var/lib/ipa/ra-agent.key' certificate: type=FILE,location='/var/lib/ipa/ra-agent.pem' CA: dogtag-ipa-ca-renew-agent issuer: CN=Certificate Authority,O=L.DOMAIN.IT subject: CN=IPA RA,O=L.DOMAIN.IT expires: 2019-12-05 13:58:44 UTC key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment eku: id-kp-serverAuth,id-kp-clientAuth pre-save command: /usr/libexec/ipa/certmonger/renew_ra_cert_pre post-save command: /usr/libexec/ipa/certmonger/renew_ra_cert track: yes auto-renew: yes Request ID '20190220182019': status: MONITORING ca-error: Server at " https://kdc2.l.domain.it:8443/ca/agent/ca/profileProcess" replied: 1: Invalid Credential. stuck: no key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert cert-pki-ca',token='NSS Certificate DB',pin set certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert cert-pki-ca',token='NSS Certificate DB' CA: dogtag-ipa-ca-renew-agent issuer: CN=Certificate Authority,O=L.DOMAIN.IT subject: CN=kdc2.l.domain.it,O=L.DOMAIN.IT expires: 2019-12-10 10:57:52 UTC key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment eku: id-kp-serverAuth,id-kp-clientAuth,id-kp-emailProtection pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "Server-Cert cert-pki-ca" track: yes auto-renew: yes I still have a working replica, so I could just reinstall and have a working set in a couple of minutes, but I would like to find out what has gone wrong. The systems are running ipa-server-4.6.5-11.el7.centos.3.x86_64 Any help welcome ;-) Thanks, -- Groeten, natxo

4 12

Replica not renewing IPA certificates
by Roderick Johnstone 02 Oct '20

02 Oct '20

Hi This is freeipa (ipa-server-4.6.5-11.el7_7.3.x86_64) on RHEL7 with freeipa's own internal CA. One of my ipa server replicas (host3) has not renewed its IPA system certificates and is now showing ca-error: Invalid cookie: u'' in the 'getcert list' output for certificates: "auditSigningCert cert-pki-ca", "ocspSigningCert cert-pki-ca", "subsystemCert cert-pki-ca", and the certificate in the file /var/lib/ipa/ra-agent.pem As far as I can see, the sequence of events has been as follows: host3 noticed the certificates needed renewing at 30 Jan 2020 05:37 and certmonger initiated a renewal. The state of those certificates went from MONITORING to CA_WORKING but the certificates were not renewed. The CA renewal master (host1) noticed its same set of certificates (plus "Server-Cert cert-pki-ca") needed renewing at 30 Jan 2020 07:28 and renewed them successfully. Another replica (host2) noticed that its certificates needed renewing at 30 Jan 2020 07:32 and renewed them successfully. At 30 Jan 13:37 on host3 the certificates needing to be renewed went from CA_WORKING back to MONITORING, but 'getcert list' now shows them with: ca-error: Invalid cookie: u'' and they still haven't renewed. I haven't seen certmonger attempt to try the renewal again on host3 (nothing from certmonger in /var/log/messages since 30 Jan 13:37). While I could try a getcert resubmit on host3 to force it to try again, I'd like to know if what I am seeing is the expected behaviour when a replica tried to renew certificates before the renewal master. How long should I have to wait till certmonger on host3 tries again? - I couldn't find any reference to how often certmonger tries the renewal. Rob Crittenden's freeipa-healthcheck script is now showing the following for host3: ERROR: ipahealthcheck.ipa.certs.IPARAAgent: RA agent description does not match 2;16;CN=Certificate Authority,O=EXAMPLE.COM;CN=IPA RA,O=EXAMPLE.COM in LDAP and 2;7;CN=Certificate Authority,O=EXAMPLE.COM;CN=IPA RA,O=EXAMPLE.COM expected ERROR: ipahealthcheck.ipa.certs.IPACertRevocation.20180926040924: Request for certificate failed, Certificate operation cannot be completed: EXCEPTION (Invalid Credential.) ERROR: ipahealthcheck.ipa.certs.IPACertRevocation.20180926040920: Request for certificate failed, Certificate operation cannot be completed: EXCEPTION (Invalid Credential.) ERROR: ipahealthcheck.ipa.certs.IPACertRevocation.20180926040921: Request for certificate failed, Certificate operation cannot be completed: EXCEPTION (Invalid Credential.) ERROR: ipahealthcheck.ipa.certs.IPACertRevocation.20180926040922: Request for certificate failed, Certificate operation cannot be completed: EXCEPTION (Invalid Credential.) ERROR: ipahealthcheck.ipa.certs.IPACertRevocation.20180926040923: Request for certificate failed, Certificate operation cannot be completed: EXCEPTION (Invalid Credential.) ERROR: ipahealthcheck.ipa.certs.IPACertRevocation.20180926040925: Request for certificate failed, Certificate operation cannot be completed: EXCEPTION (Invalid Credential.) ERROR: ipahealthcheck.ipa.certs.IPACertRevocation.20180926040927: Request for certificate failed, Certificate operation cannot be completed: EXCEPTION (Invalid Credential.) ERROR: ipahealthcheck.ipa.certs.IPACertRevocation.20180926040926: Request for certificate failed, Certificate operation cannot be completed: EXCEPTION (Invalid Credential.) ERROR: ipahealthcheck.ipa.certs.IPACertRevocation.20180831064406: Request for certificate failed, Certificate operation cannot be completed: EXCEPTION (Invalid Credential.) ERROR: ipahealthcheck.dogtag.ca.DogtagCertsConnectivityCheck: Request for certificate failed, Certificate operation cannot be completed: EXCEPTION (Invalid Credential.) Each of host1, host2 and host3 are showing serial number 16 in ldap using: ldapsearch -D "cn=directory manager" -W -b uid=ipara,ou=people,o=ipaca description At this stage I'm not sure whether this will resolve itself when certmonger tries to renew certificates again or whether I need to be more proactive. I'm happy to supply more logs as necessary. Thanks Roderick

3 3

ipa-replica-install failing
by Mitchell Smith 25 Aug '20

25 Aug '20

Hi list, I wanted to repost this issue with a more appropriate subject line, in case anyone has come across this issue before and has a work around. To provide some context, I have two FreeIPA instances running FreeIPA 4.3.1 on Ubuntu 16.04 LTS. I want to migrate to FreeIPA 4.5.4 running on CentOS 7. I have a way to migrate by dumping all the users out with ldapsearch and adding them to the new instance with ldapadd but it is a bit messy and will result in all users having to reset their password, as it won't let me add in already encrypted passwords. My initial thought was to add the new instance as a replica and then eventually retire the old one. I ran in to some problems with the ‘ipa-replica-install’ command though. I was able to join as a client no problem, but when I went to run ‘ipa-replica-install’ it failed while configuring the directory server component. [25/42]: restarting directory server [26/42]: creating DS keytab [27/42]: ignore time skew for initial replication [28/42]: setting up initial replication [error] DatabaseError: Server is unwilling to perform: modification of attribute nsds5replicareleasetimeout is not allowed in replica entry Your system may be partly configured. Run /usr/sbin/ipa-server-install --uninstall to clean up. I thought this might have something to do with differences between 4.3.1 and 4.5.4 but I wasn’t entirely sure. If there is a work around for this issue, it would be a significantly easier transition to the new FreeIPA instance. Cheers, Mitch

3 4

IPA healthcheck for older versions
by Rob Crittenden 24 Aug '20

24 Aug '20

Over the summer we announced the freeipa-healthcheck project which is designed to look at an IdM cluster and look for common problems so you can have some level of assurance that the system is running as it should. It was built against the IPA 4.8.x branch and originally released only for Fedora 29+. It is also included in the newly released RHEL 8.1.0. My curious nature led me to see if it would also work in in the IPA 4.6.x branch. It was a bit of a challenge backing down to Python 2 but I was able to get something working. I tested primarily on Fedora 27 but it should also work in RHEL/CentOS 7 (I smoke tested 7.8). I made an EPEL 7 build in COPR, https://copr.fedorainfracloud.org/coprs/rcritten/ipa-healthcheck/ Enable the repo and do: yum install freeipa-healthcheck Then run: ipa-healthcheck --failures-only Ideally there will be no output but an empty list []. Otherwise the output is JSON and hopefully has enough information to point you in the right direction. Feel free to ask if need help. False positives are always a possibility and many of the checks run independently so it's possible to get multiple issues from a single root problem. It's hard to predict all possible installations so some fine-tuning may be required. I'd recommend running it every now and then at least, like prior to updating IPA packages, creating a new master, etc, if not daily. It will, for example, warn of impending cert expiration. The more feedback I get on it the better and more useful I can make it. This is my own personal backport and is not officially supported by anyone but me. It's preferred to report issues on this mailing list. I'll see them and others may be able to chime in as well. rob

10 32

kinit -n asking for password on clients
by John Ratliff 13 Jul '20

13 Jul '20

When trying to do pkinit, if I do kinit -n on one of the IdM servers, it works fine. If I try on a client machine, it asks me for the password for WELLKNOWN/ANONYMOUS@REALM. I have the pkinit_anchors setup for the realm. As I'm trying to do anonymous pkinit, I think I don't need a client certificate. On the server, I get this: $ KRB5_TRACE="/dev/stderr" kinit -n [13061] 1518402857.924212: Getting initial credentials for WELLKNOWN/ANONYMOUS(a)IDM.EXAMPLE.COM [13061] 1518402857.929673: Sending request (200 bytes) to IDM.EXAMPLE.COM [13061] 1518402857.931830: Initiating TCP connection to stream 10.77.9.101:88 [13061] 1518402857.932241: Sending TCP request to stream 10.77.9.101:88 [13061] 1518402857.939162: Received answer (359 bytes) from stream 10.77.9.101:88 [13061] 1518402857.939180: Terminating TCP connection to stream 10.77.9.101:88 [13061] 1518402857.939284: Response was from master KDC [13061] 1518402857.939380: Received error from KDC: -1765328359/Additional pre-authentication required [13061] 1518402857.939474: Processing preauth types: 16, 15, 14, 136, 19, 147, 2, 133 [13061] 1518402857.939499: Selected etype info: etype aes256-cts, salt "IDM.EXAMPLE.COMWELLKNOWNANONYMOUS", params "" [13061] 1518402857.939509: Received cookie: MIT [13061] 1518402857.939563: Preauth module pkinit (147) (info) returned: 0/Success [13061] 1518402857.940352: PKINIT client computed kdc-req-body checksum 9/D98A0144E7E4ACC66B63EBCA98379AB9F055D143 [13061] 1518402857.940369: PKINIT client making DH request [13061] 1518402858.935: Preauth module pkinit (16) (real) returned: 0/Success [13061] 1518402858.956: Produced preauth for next request: 133, 16 [13061] 1518402858.994: Sending request (1408 bytes) to IDM.EXAMPLE.COM [13061] 1518402858.1091: Initiating TCP connection to stream 10.77.9.101:88 [13061] 1518402858.1187: Sending TCP request to stream 10.77.9.101:88 [13061] 1518402858.43063: Received answer (2880 bytes) from stream 10.77.9.101:88 [13061] 1518402858.43088: Terminating TCP connection to stream 10.77.9.101:88 [13061] 1518402858.43198: Response was from master KDC [13061] 1518402858.43258: Processing preauth types: 17, 19, 147 [13061] 1518402858.43273: Selected etype info: etype aes256-cts, salt "IDM.EXAMPLE.COMWELLKNOWNANONYMOUS", params "" [13061] 1518402858.43300: Preauth module pkinit (147) (info) returned: 0/Success [13061] 1518402858.44150: PKINIT client verified DH reply [13061] 1518402858.44189: PKINIT client found id-pkinit-san in KDC cert: krbtgt/IDM.EXAMPLE.COM(a)IDM.EXAMPLE.COM [13061] 1518402858.44199: PKINIT client matched KDC principal krbtgt/IDM.EXAMPLE.COM(a)IDM.EXAMPLE.COM against id-pkinit-san; no EKU check required [13061] 1518402858.62345: PKINIT client used KDF 2B06010502030602 to compute reply key aes256-cts/00E0 [13061] 1518402858.62395: Preauth module pkinit (17) (real) returned: 0/Success [13061] 1518402858.62402: Produced preauth for next request: (empty) [13061] 1518402858.62414: AS key determined by preauth: aes256-cts/00E0 [13061] 1518402858.62547: Decrypted AS reply; session key is: aes256-cts/96F0 [13061] 1518402858.62589: FAST negotiation: available [13061] 1518402858.62692: Initializing KEYRING:persistent:760400007:krb_ccache_f3PFEy1 with default princ WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS [13061] 1518402858.62770: Storing WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS -> krbtgt/IDM.EXAMPLE.COM(a)IDM.EXAMPLE.COM in KEYRING:persistent:760400007:krb_ccache_f3PFEy1 [13061] 1518402858.62846: Storing config in KEYRING:persistent:760400007:krb_ccache_f3PFEy1 for krbtgt/IDM.EXAMPLE.COM(a)IDM.EXAMPLE.COM: fast_avail: yes [13061] 1518402858.62878: Storing WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS -> krb5_ccache_conf_data/fast_avail/krbtgt\/IDM.EXAMPLE.COM\@IDM.EXAMPLE.COM@X-CACHECONF: in KEYRING:persistent:760400007:krb_ccache_f3PFEy1 [13061] 1518402858.62933: Storing config in KEYRING:persistent:760400007:krb_ccache_f3PFEy1 for krbtgt/IDM.EXAMPLE.COM(a)IDM.EXAMPLE.COM: pa_type: 16 [13061] 1518402858.62954: Storing WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS -> krb5_ccache_conf_data/pa_type/krbtgt\/IDM.EXAMPLE.COM\@IDM.EXAMPLE.COM@X-CACHECONF: in KEYRING:persistent:760400007:krb_ccache_f3PFEy1 But on the client, I get this: $ KRB5_TRACE="/dev/stderr" kinit -n [2941] 1518402820.155827: Getting initial credentials for WELLKNOWN/ANONYMOUS(a)IDM.EXAMPLE.COM [2941] 1518402820.156298: Sending request (200 bytes) to IDM.EXAMPLE.COM [2941] 1518402820.158723: Resolving hostname paine.example.com. [2941] 1518402820.159975: Resolving hostname phantom.example.com. [2941] 1518402820.160757: Resolving hostname paine.example.com. [2941] 1518402820.161411: Initiating TCP connection to stream 204.89.253.101:88 [2941] 1518402820.162065: Sending TCP request to stream 204.89.253.101:88 [2941] 1518402820.168495: Received answer (359 bytes) from stream 204.89.253.101:88 [2941] 1518402820.168532: Terminating TCP connection to stream 204.89.253.101:88 [2941] 1518402820.169917: Response was from master KDC [2941] 1518402820.169974: Received error from KDC: -1765328359/Additional pre-authentication required [2941] 1518402820.170029: Processing preauth types: 16, 15, 14, 136, 19, 147, 2, 133 [2941] 1518402820.170051: Selected etype info: etype aes256-cts, salt "IDM.EXAMPLE.COMWELLKNOWNANONYMOUS", params "" [2941] 1518402820.170062: Received cookie: MIT Password for WELLKNOWN/ANONYMOUS(a)IDM.EXAMPLE.COM: [2941] 1518402833.34612: Preauth module encrypted_timestamp (2) (real) returned: -1765328252/Password read interrupted kinit: Pre-authentication failed: Password read interrupted while getting initial credentials Suggestions on what I'm missing? Thanks.

3 3

automember hostgroup by account?
by Amos 14 Jun '20

14 Jun '20

Is it possible to have an automember rule to add a host to a hostgroup based on the account used with ipa-install-client? Amos

3 6

IPA and legacy systems
by Ronald Wimmer 27 May '20

27 May '20

What would be a good solution to add systems where the FQDN cannot be changed? Would it make sense to add a second DNS A Record in the IPA domain for each of these systems? Is there any experience on how to deal with such a situation? Thanks a lot in advance! Cheers, Ronald

5 17

Samba integration - access without Kerberos
by lejeczek 29 Apr '20

29 Apr '20

hi everybody. I see this subject might have been poked around many times, a couple times at least for sure. But, I thought I'll poke again and hopefully get some latest comments & thoughts on - how to make IPA's Samba allow password authentication to Win clients from outside of IPA/AD domains? Would there, by now, possibly be a semi-official (by IPA team) way of getting there, since the subject first came up a longer while ago? many thanks, L.

2 6

ipa: ERROR: CIFS server communication error: code "3221225506", message "{Access Denied} A process has requested access to an object but has not been granted those access rights." (both may be "None")
by Bernard Lheureux 20 Apr '20

20 Apr '20

Hi all, After a fresh install of FreeIPA 4.6.5-11.el7.centos.x86_64, fully updated from update repo on a CentOS7 x64 server, it appears that it is totally impossible to establish a trust with an AD running on local AD servers, we did it a few times ago with exactly the same distribution and had really no problem, we tried to completely reinstall the machine and the IPA wit always the same results, ipa: ERROR: CIFS server communication error: code "3221225506", message "{Access Denied} A process has requested access to an object but has not been granted those access rights." (both may be "None") Could someone point me to the direction to look for, because we are going nuts on this ? We found some tips in the /var/log/httpd/errors, but nothing seems to provide sufficient infos... [Wed Oct 02 12:54:57.868830 2019] [:error] [pid 2036] ipa: INFO: [jsonserver_session] admin(a)DOMAIN.INTRA: trust_add/1(u'domain.intra', trust_type=u'ad', realm_admin=u'admin', realm_passwd=u'********', bidirectional=True, version=u'2.231'): RemoteRetrieveError The IPA server and the AD servers are in the same VLan with no firewall between them samba version on the IPA server is the latest available: 4.9.1-6.el7.noarch Thanks for your help...

3 7

Allow AD users to manage FreeIPA
by White, David 27 Mar '20

27 Mar '20

I'm reviewing the documentation at https://www.freeipa.org/page/V4/Allow_AD_users_to_manage_FreeIPA, as I am hoping to allow members of certain AD groups to login to FreeIPA from the web GUI. Does this documentation only apply to the FreeIPA CLI, or does it also affect access to manage through the web GUI? Let's say we have an AD group named "engineers", and I want those engineers to have admin access over FreeIPA. If the above documentation only affects the CLI, that feels a little bit redundant, because we can of course easily create Sudo / Su rules to allow members of "engineers" to have control over the FreeIPA nodes using HBAC rules and such. (This is already done and working -- members of `engineers` already have CLI admin access over FreeIPA -- I now want them to have GUI admin access). I'm also a little bit confused why the documentation says to add a domain user to the AD "administrators" group (as an ID Override). That feels like a security risk, because I don't want the user to be considered an Active Directory administrator -- I only want the person (well, any members of the `engineers` group) to have admin access over FreeIPA. It sounds like this would have to be done on a user-by-user basis (and is not something we could apply to an entire AD group that already exists)? I ran: `id administrator(a)ad.domain.com` and verified that I do have stdout. But then I ran: `ipa group-show administrator(a)ad.domain.com` and stdout included: ipa: ERROR: administrator(a)ad.domain.com: group not found Is there any way to accomplish what I want? ----- David White Engineer II, Fiber Systems Engineering

3 8

Freeipa unicodepwd generator
by LUCAS GUILHERME DIEDRICH 26 Mar '20

26 Mar '20

Hello guys, is there any change for storing the password over freeipa it generate an password with the unicodepwd format? I'm still trying to replicate some users from freeipa to AD, i would like to mantain my Freeipa as the principal manager for users and groups. thanks.

5 9

Re: Issues with certificates: X509: KEY_VALUES_MISMATCH
by Rob Crittenden 04 Mar '20

04 Mar '20

Dmitri Moudraninets wrote: > Hi Rob, > > I recovered the key file. Restarted FreeIPA and certmonger. Now issue > looks different: > image.png > > Subjects disappeared. If I click on a certificate 29 I see this: > cannot connect to > 'https://freeipa.corp.mydomain.de:443/ca/agent/ca/displayBySerial': > [Errno 13] Permission denied Set the same ownership/permissions on the key as you did the cert and run restorecon on it. rob > > пн, 25 нояб. 2019 г. в 13:58, Rob Crittenden <rcritten(a)redhat.com > <mailto:rcritten@redhat.com>>: > > Dmitri Moudraninets wrote: > > Hi Rob, > > > > > > > > I did the following: > > I removed original ra-agent.pem and ra-agent key > > and > > openssl x509 -in /root/debug.cert -out /var/lib/ipa/ra-agent.pem > > chown root:ipaapi /var/lib/ipa/ra-agent.pem > > chmod 0440 /var/lib/ipa/ra-agent.pem > > restorecon /var/lib/ipa/ra-agent.pem > > You removed the key!? I sure hope you have a backup of it. > > Put it back and I think that will resolve things. > > > > > Successfully restarted FreeIPA: > > Directory Service: RUNNING > > krb5kdc Service: RUNNING > > kadmin Service: RUNNING > > named Service: RUNNING > > httpd Service: RUNNING > > ipa-custodia Service: RUNNING > > ntpd Service: RUNNING > > pki-tomcatd Service: RUNNING > > smb Service: RUNNING > > winbind Service: RUNNING > > ipa-otpd Service: RUNNING > > ipa-dnskeysyncd Service: RUNNING > > ipa: INFO: The ipactl command was successful > > The agent cert is not required for the CA to operate. > > > Now GUI shows different error: > > cannot connect to > > 'https://freeipa.corp.mydomain.de:443/ca/agent/ca/displayBySerial': > > [Errno 2] No such file or directory > > > > > > [root@freeipa ~]# getcert list -f /var/lib/ipa/ra-agent.pem > > Number of certificates and requests being tracked: 16. > > Request ID '20180912151611': > > status: NEED_CSR > > stuck: no > > key pair storage: type=FILE,location='/var/lib/ipa/ra-agent.key' > > certificate: type=FILE,location='/var/lib/ipa/ra-agent.pem' > > CA: dogtag-ipa-ca-renew-agent > > issuer: CN=Certificate Authority,O=CORP.MYDOMAIN.DE > <http://CORP.MYDOMAIN.DE> > > <http://CORP.MYDOMAIN.DE> > > subject: CN=IPA RA,O=CORP.MYDOMAIN.DE <http://CORP.MYDOMAIN.DE> > <http://CORP.MYDOMAIN.DE> > > expires: 2019-11-25 15:32:12 UTC > > key usage: > digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment > > eku: id-kp-serverAuth,id-kp-clientAuth > > pre-save command: /usr/libexec/ipa/certmonger/renew_ra_cert_pre > > post-save command: /usr/libexec/ipa/certmonger/renew_ra_cert > > track: yes > > auto-renew: yes > > This shows that the certificate has the right subject now which is good > but you removed its private key so it won't work. > > rob > > > > > сб, 23 нояб. 2019 г. в 20:26, Rob Crittenden <rcritten(a)redhat.com > <mailto:rcritten@redhat.com> > > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com>>>: > > > > Dmitri Moudraninets wrote: > > > Hi Rob, > > > > > > ldapsearch -LLL -o ldif-wrap=no -x -D 'cn=directory manager' -W > > > -b uid=ipara,ou=People,o=ipaca usercertificate > > > > > > shows me the following: > > > > > > Issuer: O=CORP.MYDOMAIN.DE <http://CORP.MYDOMAIN.DE> > <http://CORP.MYDOMAIN.DE> > > <http://CORP.MYDOMAIN.DE>, > > > CN=Certificate Authority > > > Validity > > > Not Before: Dec 5 15:32:12 2017 GMT > > > Not After : *Nov 25 15:32:12 2019* GMT > > > > > > It's going to expire on Monday. Can it be a problem? > > > > You didn't provide the cert subject so I can't be sure this is > the right > > cert. If it contains CN = IPA RA then it is. > > > > And yes, it expires in two days. What you'd need to do is > restore it per > > my previous instruction into /var/lib/ipa/ra-agent.pem on the > renewal > > master (ipa config-show to see which one it is). > > > > Then run: > > > > # getcert resubmit -f /var/lib/ipa/ra-agent.pem > > > > That should renew the cert. > > > > On the other masters I'd run the same command and that may fix > things > > there as well. > > > > rob > > > > > I tried this command: > > > openssl x509 -text -in /var/lib/ipa/ra-agent.pem > > > > > > and it shows the following: > > > Certificate: > > > Data: > > > Version: 3 (0x2) > > > Serial Number: 28 (0x1c) > > > Signature Algorithm: sha256WithRSAEncryption > > > Issuer: O=CORP.MYDOMAIN.DE <http://CORP.MYDOMAIN.DE> > <http://CORP.MYDOMAIN.DE> > > <http://CORP.MYDOMAIN.DE>, > > > CN=Certificate Authority > > > Validity > > > Not Before: Oct 29 10:39:47 2019 GMT > > > Not After : Oct 29 09:39:47 2021 GMT > > > Subject: O=CORP.MYDOMAIN.DE > <http://CORP.MYDOMAIN.DE> <http://CORP.MYDOMAIN.DE>, CN=dmud > > > Subject Public Key Info: > > > Public Key Algorithm: rsaEncryption > > > Public-Key: (2048 bit) > > > Modulus: > > > > 00:ba:09:81:99:9b:17:99:07:5a:10:28:c8:7a:03: > > > ... > > > > 18:db:02:ce:b4:66:ce:5a:e9:12:af:d3:da:bf:f7: > > > 66:5f > > > Exponent: 65537 (0x10001) > > > X509v3 extensions: > > > X509v3 Authority Key Identifier: > > > keyid:D2:...70:BF > > > > > > X509v3 Subject Key Identifier: > > > DE:...:51:0A > > > X509v3 Subject Alternative Name: > > > email:dmud@corp.mydomain.de > <mailto:email%3Admud@corp.mydomain.de> > > <mailto:email%3Admud@corp.mydomain.de > <mailto:email%253Admud@corp.mydomain.de>> > > > <mailto:email%3Admud@corp.mydomain.de > <mailto:email%253Admud@corp.mydomain.de> > > <mailto:email%253Admud@corp.mydomain.de > <mailto:email%25253Admud@corp.mydomain.de>>> > > > Authority Information Access: > > > OCSP - > URI:http://ipa-ca.corp.mydomain.de/ca/ocsp > > > > > > > > > I did nothing to /var/lib/ipa/ra-agent.pem yet. > > > > > > > > > чт, 21 нояб. 2019 г. в 16:54, Rob Crittenden > <rcritten(a)redhat.com <mailto:rcritten@redhat.com> > > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com>> > > > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com> > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com>>>>: > > > > > > Dmitri Moudraninets wrote: > > > > Hi Rob, > > > > > > > > Yes both masters are failing the same way. Output > of openssl > > x509 > > > -noout > > > > -modulus -in /var/lib/ipa/ra-agent.pem is the same on both > > masters. > > > > Output of openssl rsa -noout -modulus -in > > /var/lib/ipa/ra-agent.key is > > > > also the same on both masters. But the output of the first > > command is > > > > not the same as the output of the second command. > > > > > > > > I can't remember that I troubleshoot any other > problems but we > > > tried to > > > > generate some personal certificates for some users. > Also we > > tried to > > > > generate certificates with key files for some of our > internal > > > services. > > > > We did that for the first time and it worked at the > end. Also I > > > changed > > > > the admin password not so long ago. > > > > > > > > > > > > Below you can find the output of the requested commands: > > > > > > > > > > > > [root@second_master ~]# getcert list -f > > /var/lib/ipa/ra-agent.pem > > > > Number of certificates and requests being tracked: 9. > > > > Request ID '20180912151730': > > > > status: MONITORING > > > > stuck: no > > > > key pair storage: > type=FILE,location='/var/lib/ipa/ra-agent.key' > > > > certificate: > type=FILE,location='/var/lib/ipa/ra-agent.pem' > > > > CA: dogtag-ipa-ca-renew-agent > > > > issuer: CN=Certificate Authority,O=CORP.MYDOMAIN.DE > <http://CORP.MYDOMAIN.DE> > > <http://CORP.MYDOMAIN.DE> > > > <http://CORP.MYDOMAIN.DE> > > > > <http://CORP.MYDOMAIN.DE> > > > > subject: CN=dmud,O=CORP.MYDOMAIN.DE > <http://CORP.MYDOMAIN.DE> > > <http://CORP.MYDOMAIN.DE> <http://CORP.MYDOMAIN.DE> > > > <http://CORP.MYDOMAIN.DE> > > > > *<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<< I see a username here. > > Does it have > > > > to be like that?* > > > > expires: 2021-10-29 09:39:47 UTC > > > > email: dmud(a)corp.mydomain.de > <mailto:dmud@corp.mydomain.de> <mailto:dmud@corp.mydomain.de > <mailto:dmud@corp.mydomain.de>> > > <mailto:dmud@corp.mydomain.de <mailto:dmud@corp.mydomain.de> > <mailto:dmud@corp.mydomain.de <mailto:dmud@corp.mydomain.de>>> > > > <mailto:dmud@corp.mydomain.de > <mailto:dmud@corp.mydomain.de> <mailto:dmud@corp.mydomain.de > <mailto:dmud@corp.mydomain.de>> > > <mailto:dmud@corp.mydomain.de <mailto:dmud@corp.mydomain.de> > <mailto:dmud@corp.mydomain.de <mailto:dmud@corp.mydomain.de>>>> > > > > key usage: > > > > digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment > > > > eku: id-kp-serverAuth,id-kp-clientAuth > > > > pre-save command: > /usr/libexec/ipa/certmonger/renew_ra_cert_pre > > > > post-save command: > /usr/libexec/ipa/certmonger/renew_ra_cert > > > > track: yes > > > > auto-renew: yes > > > > > > Right, someone overwrote the RA agent certificate. > > > > > > Look to see if the user entry in the CA has the right cert: > > > > > > $ ldapsearch -LLL -o ldif-wrap=no -x -D 'cn=directory > manager' > > -W -b > > > uid=ipara,ou=People,o=ipaca usercertificate > > > > > > Put the base64 value of the usercertificate attribute into a > > file and > > > add a prefix/suffix around it: > > > > > > -----BEGIN CERTIFICATE----- > > > MII....blah= > > > -----END CERTIFICATE----- > > > > > > $ openssl x509 -text -in /path/to/file > > > > > > If the Subject is O = CORP.MYDOMAIN.DE > <http://CORP.MYDOMAIN.DE> > > <http://CORP.MYDOMAIN.DE> <http://CORP.MYDOMAIN.DE>, CN > > > = IPA RA then that's a good > > > start. Also look at the expires date to be sure it is > still valid. > > > > > > Assuming that is ok then re-run the openssl modulus commands > > to ensure > > > they are the same. > > > > > > Assuming that too is ok then you have the proper, valid RA > > agent cert. > > > In that case I'd move the current file out of the way, who > > knows what it > > > is, then run: > > > > > > # openssl x509 -in /path/to/file -out > > /var/lib/ipa/ra-agent.pem (just to > > > properly format the agent cert) > > > # chown root:ipaapi /var/lib/ipa/ra-agent.pem > > > # chmod 0440 /var/lib/ipa/ra-agent.pem > > > # restorecon /var/lib/ipa/ra-agent.pem > > > > > > Then try something like: ipa cert-show 1 > > > > > > This will exercise the RA agent cert and as long as you > don't > > get an > > > error back things are working again. > > > > > > The cert is common among all masters so you can copy the > file > > to your > > > other master(s), ensuring proper ownership, permissions and > > SELinux > > > context. > > > > > > rob > > > > > > > > > > > > -- > > > WBR > > > Dmitry > > > > > > > > -- > > With best regards/Mit freundlichen Grüßen > > > > Moudraninets Dmitry, RHCSA > > http://www.linkedin.com/in/moudraninets > > http://www.xing.com/profile/Dmitry_Mudraninets > > > > -- > With best regards/Mit freundlichen Grüßen > > Moudraninets Dmitry, RHCSA > http://www.linkedin.com/in/moudraninets > http://www.xing.com/profile/Dmitry_Mudraninets

2 7

How to make ipa root certificate available system wide
by Kevin Vasko 02 Mar '20

02 Mar '20

Hello, I’m wanting to make our https servers use a trusted certificate within our LAN only. So for example if I have websrv1.ny.example.com when a user uses a machine that’s enrolled into our realm and they visit https://websrv1.ny.example.com they shouldn’t be prompted to accept the self signed certificate. I think I’m pretty close but I’m missing a small part. The ipa server is all setup and working. Hosts are enrolled to ipa and have the /etc/ipa/ca.crt. I have created a service for the http server in IPA. I have obtained a .key file and .crt file for my web server. Those keys for the web server are in the appropriate location and the web server is pointing at the certs correctly. On my clients when I go to the web servers URl I am no longer getting a “self signed cert” error message in the browser. That message has now changed to “unverified certificate authority”. Which basically indicates to me that the browser doesn’t know if this certificate authority should/can be trusted. If i go in the browser (firefox or chrome) in the certificate authority section and import the /etc/ipa/ca.crt i get no errors in the browser about it being unverified. So my question is, what am I missing to make the /etc/ipa/ca.crt file globally available for browsers to pick up the certificate automatically? when we enroll a host we simply do freeipa-install-client —domain=example.com —realm=EXAMPLE.COM —mkhomedir Accept the defaults, put in the password to enroll and that’s it. Is there something I’m missing? -Kevin

6 14

suggestion for password policy
by Charles Hedrick 06 Feb '20

06 Feb '20

The NIST recommendations for passwords say they don’t think character classes and expiration are useful. Instead, they recommend using a blacklist of known common passwords. There’s no way to implement this policy without writing your own plugin. It would be useful for IPA’s password policy to allow you to specify a database of forbidden passwords. We’ve done this using a plugin, but I’d rather not have to write C code to implement policy.

2 8

FreeIPA 4.8.1 on Fedora 31 (upgraded from F30) fails to start
by Wulf C. Krueger 05 Feb '20

05 Feb '20

Hello, my FreeIPA installation was working well on Fedora 30. After upgrading to F31, though, it fails to start: ---- # ipactl start IPA version error: data needs to be upgraded (expected version '4.8.1-4.fc31', current version '4.8.1-1.fc30') Automatically running upgrade, for details see /var/log/ipaupgrade.log Be patient, this may take a few minutes. Automatic upgrade failed: Update complete Upgrading the configuration of the IPA services [Verifying that root certificate is published] [Migrate CRL publish directory] CRL tree already moved IPA server upgrade failed: Inspect /var/log/ipaupgrade.log and run command ipa-server-upgrade manually. Unexpected error - see /var/log/ipaupgrade.log for details: CalledProcessError: CalledProcessError(Command ['/bin/systemctl', 'start', 'pki-tomcatd(a)pki-tomcat.service'] returned non-zero exit status 1: 'Job for pki-tomcatd(a)pki-tomcat.service failed because a timeout was exceeded.\nSee "systemctl status pki-tomcatd(a)pki-tomcat.service" and "journalctl -xe" for details.\n') The ipa-server-upgrade command failed. See /var/log/ipaupgrade.log for more information See the upgrade log for more details and/or run /usr/sbin/ipa-server-upgrade again Aborting ipactl ---- Logs: ipaupgrade.log: https://mailstation.de/ipa-logs/ipaupgrade.log pki-tomcatd@pki-tomcat log: https://mailstation.de/ipa-logs/pki-tomcatd@pki-tomcat.log pki-tomcat-ca-debug log: https://mailstation.de/ipa-logs/pki-tomcat-ca-debug.2019-11-02.log So it looks like the LDAP server isn't reachable but its log says it's running: https://mailstation.de/ipa-logs/dirsrv@MAILSTATION-DE.log There's nothing listening on ports 389 and 636, though. Help would be highly appreciated. Best regards, Wulf

6 24

pki-tomcat doesn't start, it can't update certificate
by Serge Barkov 04 Feb '20

04 Feb '20

I have a freeipa with two nodes. I have no problem with one of them but on the other one pki-tomcat can't start. ipacts starts with --ignore-service-failure and pki-tomcatd Service: STOPPED The first thing I found a certificate expired and I changed date back in time before expiration date. ipa-cacert-manage renew says ok but certificate for pki-tomcat doesn't work. getcert list shows all certificates are well but this one no: Request ID '20171110140549': status: CA_UNREACHABLE ca-error: Error 60 connecting to https://ipa0.domain.com:8443/ca/agent/ca/profileReview: Peer certificate cannot be authenticated with given CA certificates. stuck: no key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert cert-pki-ca',token='NSS Certificate DB',pin set certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert cert-pki-ca',token='NSS Certificate DB' CA: dogtag-ipa-renew-agent issuer: CN=Certificate Authority,O=DOMAIN.COM subject: CN=ipa0.domain.com,O=DOMAIN.COM expires: 2019-10-31 14:05:23 UTC key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment eku: id-kp-serverAuth,id-kp-clientAuth,id-kp-emailProtection pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "Server-Cert cert-pki-ca" track: yes auto-renew: yes [root@ipa0 pki-tomcat]# curl https://ipa0.domain.com:8443/ca/agent/ca/profileReview <!DOCTYPE html><html><head><title>Apache Tomcat/8.0.46 - Error report</title><style type="text/css">H1 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:22px;} H2 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:16px;} H3 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:14px;} BODY {font-family:Tahoma,Arial,sans-serif;color:black;background-color:white;} B {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;} P {font-family:Tahoma,Arial,sans-serif;background:white;color:black;font-size:12px;}A {color : black;}A.name {color : black;}.line {height: 1px; background-color: #525D76; border: none;}</style> </head><body><h1>HTTP Status 404 - /ca/agent/ca/profileReview</h1><div class="line"></div><p><b>type</b> Status report</p><p><b>message</b> <u>/ca/agent/ca/profileReview</u></p><p><b>description</b> <u>The requested resource is not available.</u></p><hr class="lin e"><h3>Apache Tomcat/8.0.46</h3></bod What can I do to make pki-tomcat work? How to repair the certificate?

3 13

shouldn't freeipa work by default?
by Harald Dunkel 04 Feb '20

04 Feb '20

Hi folks, *ipa help topics* gives me # ipa help topics ipa: ERROR: System encoding must be UTF-8, 'ANSI_X3.4-1968' is not supported. Set LC_ALL="C.UTF-8", or LC_ALL="" and LC_CTYPE="C.UTF-8". # env | egrep LANG\|LC # echo $? 1 Shouldn't the command line interface work by default? Why not silently assume UTF-8 and continue? Printing a warning might be OK. Regards Harri

2 2

files to omit from backup
by Charles Hedrick 03 Feb '20

03 Feb '20

We currently do rsync backups of our server. On an MIT server, you’d want to omit the stash file. But IPA doesn’t use that. Is there anything like that that should be omitted? I’m not sure just how freeipa bootstraps trust when it starts up.

3 2

Centos 7 after unroll and join to new server authorization doesn’t work
by Petar Kozić 31 Jan '20

31 Jan '20

Hi, I have one IPA server dirsrv001 and newone dirsrv002 dirsrv001 is old server from where I want to unroll my VPS’s and join to new server. I do some testing with Ubuntu VPS’s and that works perfect. I have problem with one Centos 7 server. I join client to dirsrv002 without problems but when I want to login I login over ssh but I can’t do sudo. Ask me for pass and than three times and that is. Sudo permission on IPA server is configured as well because works on other. If I run on that Centos client command: kinit my_username and when I enter pass everything is ok. If I check syslog, I get this error: [sssd[krb5_child[8541]]]: Key version is not available I found that is problem with /etc/krb5.keytab file. But I tried to unroll client, move that file and join again, problem was same. Please, does someone have some idea? *—* *Petar Kozić*

3 5

"finger" not working to match on names. What am I missing here?
by Russell Jones 30 Jan '20

30 Jan '20

Hi all, I have client machines bound to my FreeIPA domain correctly as best I can tell. I have noticed however that the "finger" command appears to not be matching on user's names anymore like it does with my older NIS clients. Finger appears to only work when passing it the actual username of a user, not their first or last names. /etc/nsswitch.conf is configured properly for user matching on the client. What am I missing? Thank you! passwd: files sss shadow: files sss group: files sss #initgroups: files sss #hosts: db files nisplus nis dns hosts: files mdns4_minimal [NOTFOUND=return] dns myhostname # Example - obey only what nisplus tells us... #services: nisplus [NOTFOUND=return] files #networks: nisplus [NOTFOUND=return] files #protocols: nisplus [NOTFOUND=return] files #rpc: nisplus [NOTFOUND=return] files #ethers: nisplus [NOTFOUND=return] files #netmasks: nisplus [NOTFOUND=return] files bootparams: nisplus [NOTFOUND=return] files ethers: files netmasks: files networks: files protocols: files rpc: files services: files sss netgroup: nisplus sss publickey: nisplus automount: files nisplus sss aliases: files nisplus sudoers: files sss

2 3

Retro Changelog errors
by Mark Lundie 30 Jan '20

30 Jan '20

Hi all, I've run into an issue with RetroCL (I think) on our IPA server. This is the sole master, there is no replication: # ipa-replica-manage list <ipa-hostname>: master The problem appeared during an attempted group rename, but every subsequent attempt to change results in the same error: [27/Jan/2020:11:29:49.590558266 +0000] - ERR - managed-entries-plugin - mep_rename_managed_entry - Unable to rename managed entry "cn=matstudio2016,cn=groups,cn=accounts,<domain>" to "cn=matstudio,cn=groups,cn=accounts,<domain>" (Already exists). [27/Jan/2020:11:29:49.897693314 +0000] - ERR - ldbm_back_modrdn - SLAPI_PLUGIN_BE_TXN_POST_MODRDN_FN plugin returned error but did not set SLAPI_RESULT_CODE [27/Jan/2020:13:23:16.986652546 +0000] - ERR - DSRetroclPlugin - write_replog_db - An error occured while adding change number 264303, dn = changenumber=264303,cn=changelog: Already exists. [27/Jan/2020:13:23:16.989427768 +0000] - ERR - DSRetroclPlugin - retrocl_postob - Operation failure [68] [27/Jan/2020:13:23:16.993607315 +0000] - ERR - managed-entries-plugin - mep_add_managed_entry - Unable to add managed entry "cn=materialsstudio,cn=groups,cn=accounts,<domain>" for origin entry "uid=materialsstudio,cn=users,cn=accounts,<domain>" (Already exists). [27/Jan/2020:13:23:16.998637893 +0000] - ERR - DSRetroclPlugin - write_replog_db - An error occured while adding change number 264303, dn = changenumber=264303,cn=changelog: Already exists. [27/Jan/2020:13:23:17.001620504 +0000] - ERR - DSRetroclPlugin - retrocl_postob - Operation failure [68] [27/Jan/2020:13:23:17.005510536 +0000] - ERR - managed-entries-plugin - mep_add_managed_entry - Unable to add managed entry "cn=materialsstudio,cn=groups,cn=accounts,<domain>" for origin entry "uid=materialsstudio,cn=users,cn=accounts,<domain>" (Already exists). [27/Jan/2020:13:23:55.016578895 +0000] - ERR - DSRetroclPlugin - write_replog_db - An error occured while adding change number 264302, dn = changenumber=264302,cn=changelog: Already exists. [27/Jan/2020:13:23:55.020029522 +0000] - ERR - DSRetroclPlugin - retrocl_postob - Operation failure [68] I note that the changenumber decreased by 1 as well. Unfortunately the access log has rotated several times since the change, so I can't extract anything from there. My colleague did have a record of the commands that were run: # ipa user-mod --rename=matstudio matstudio2016 # ipa user-mod --rename=matstudio2016 matstudio # ipa user-mod --rename=matstudio matstudio2016 There is no group-mod command, so I assume that the group rename attempt was ipa trying to rename the private group matstudio2016 to matstudio, which already existed: # ipa group-show matstudio2016 Group name: matstudio2016 Description: User private group for matstudio2016 GID: 99999 # ipa group-show matstudio Group name: matstudio Description: blanked GID: 11008 Member users: blanked I've tried to delete the groups, both via ipa and ldapmodify (tried to remove the mepManagedEntry objectclass and mepManagedBy attribute), but always encounter the changelog error. Alas there is no backup prior to this change from which to restore, so I am trying to fix things online. Thankfully authorisation and authentication is still working for now, but we can't add users, modify groups, etc. Incidentally, ipa user-show --all --raw returns nothing for either uid, but ldapsearch does. The old user (matstudio2016) and group (matstudio) were migrated at least once from the ipa database of older clusters, possibly twice. I've pulled out the pertinent entries from each record: # ldapsearch -Y GSSAPI uid=matstudio2016 # matstudio, users, accounts, <domain> dn: uid=matstudio,cn=users,cn=accounts,<domain> displayName: MatStudioAccount MatStudioAccount cn: MatStudioAccount MatStudioAccount krbCanonicalName: matstudio@<domain> uidNumber: 99999 gidNumber: 11008 krbPrincipalName: matstudio@<domain> givenName: MatStudioAccount homeDirectory: <path-to>/matstudio ipaUniqueID: 6e8f1900-b044-11e8-be99-00a1dafce440 mepManagedEntry: cn=matstudio2016,cn=groups,cn=accounts,<domain> memberOf: ipaUniqueID=b7b3447a-b02c-11e8-9fe1-00a1dafce440,cn=hbac,<domain> uid: matstudio # ldapsearch -Y GSSAPI uid=matstudio # matstudio, users, compat, <domain> dn: uid=matstudio,cn=users,cn=compat,<domain> objectClass: posixAccount objectClass: ipaOverrideTarget objectClass: top gecos: MatStudioAccount MatStudioAccount cn: MatStudioAccount MatStudioAccount uidNumber: 99999 gidNumber: 11008 loginShell: /bin/bash homeDirectory: <path-to>/matstudio ipaAnchorUUID:: OklQQTpwcmkuY3NmMy5hbGNlcy5uZXR3b3JrOjZlOGYxOTAwLWIwNDQtMTFlOC 1iZTk5LTAwYTFkYWZjZTQ0MA== uid: matstudio I'm scratching my head here; any suggestions will be most gratefully received! Thanks, Mark

1 2

Upgrade freeipa without CA
by Terry Soucy 29 Jan '20

29 Jan '20

Hi Everyone, I'm in the process of testing a CentOS 6 to CentOS 7 migration of our IPA servers (ipa-server-3.0.0 to ipa-server-4.6.5). I have successfully added a 4.6.5 IPA server to my 3.0.0 replicas in my testing environment, and replication is working fine. I have a few aci differences that I'm still weeding out, but no show stoppers. When we initially installed freeipa, we were planning on using the CA capabilities, but have never actually used it after the initial install. My question is, if we have never used it, can I simply just not worry about creating a CA replica, and then renew my certificates using an external CA after the migration is complete? Thanks in advance Terry -- Terry Soucy Systems Engineering Lead | Salesforce Mobile: +1.506.609.3247 <http://smart.salesforce.com/sig/tsoucy//ca_mb/default/link.html>

2 1

Multi-homed IPA Server. How to do it properly?
by Russell Jones 29 Jan '20

29 Jan '20

Hi all, I have ran into a bit of a surprise (for me anyway). After adding a second NIC to my FreeIPA server in order to provide IPA services for the same realm to a second network, I am unable to join clients to it and am getting the following error: 2020-01-29T19:15:55Z DEBUG stderr= 2020-01-29T19:15:55Z DEBUG trying to retrieve CA cert via LDAP from freeipa.cluster 2020-01-29T19:15:55Z DEBUG get_ca_certs_from_ldap() error: Insufficient access: SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Server krbtgt/CLUSTER@<original domain> not found in Kerberos database) 2020-01-29T19:15:55Z DEBUG Insufficient access: SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Server krbtgt/CLUSTER@<original domain> not found in Kerberos database) After doing quite a bit of Googling it appears that multi-homed IPA servers are not currently supported? I decided to try something and added the FQDN for the FreeIPA server to the client's /etc/hosts file, and pointed the FQDN to the secondary IP of the server, and that appears to have worked properly. The client install completed without any error via the second network. Is this the bandaid approach that is currently the best method of doing this? Is there a better way? Thanks for the insight!

1 0

Why does ipa-client-install put "_srv_, <freeipa master>" in the ipa_server line, and not just _srv_ by itself?
by Russell Jones 29 Jan '20

29 Jan '20

I'm running "ipa-client-install --force-join --no-nisdomain -U", and it auto discovers my freeipa servers, but places both _srv_ and the first server under the "ipa_server" line. This results in the first server being listed twice when running "sssctl domain-status". Is this expected behavior? Is this behavior that I actually want? Just trying to understand better. Thank you for any insight!

3 4

Update: Add "mkhomedir" after install
by Nicholas DeMarco 29 Jan '20

29 Jan '20

In Dec 2015, to effectively add the mkhomedir install option after configuration, Martin Štefany suggested <https://www.redhat.com/archives/freeipa-users/2015-December/msg00123.html> using authconfig. I'm not having success with authconfig. Is this still the process to add mkhomedir?

2 1

Multi site deployment strategy - Server vs Replica
by Daniel PC 29 Jan '20

29 Jan '20

Hello I'm building a cluster with 8 servers divided into 2 sites of 4 servers. I understand from the documentation that only the first server should be installed as a server, all others can be installed as replicas from the first one. Am I understanding this right? Is there some difference between a server and a replica from an operational point of view? Thank you

2 1

after recreating server, ipa: ERROR: No valid Negotiate header in server response
by Charles Hedrick 28 Jan '20

28 Jan '20

we just upgraded servers to centos 8.1, by dealing them and recreating them. On a few systems when I try to use the IPA command I get ipa: ERROR: No valid Negotiate header in server response This doesn’t happen on all hosts. The IPA command works fine on the server itself. Since it’s only on some hosts the obvious suspicion is that something is cached from the old server. Any idea what’s going on?

1 1

Re: [EXTERNAL] suggestion for password policy
by White, Daniel E. (GSFC-770.0)[NICS] 28 Jan '20

28 Jan '20

Would you be willing to share the code on, say, a github gist ? ______________________________________________________________________________________________ Daniel E. White daniel.e.white(a)nasa.gov<mailto:daniel.e.white@nasa.gov> NICS Linux Engineer NASA Goddard Space Flight Center 8800 Greenbelt Road Building 14, Room E175 Greenbelt, MD 20771 Office: (301) 286-6919 Mobile: (240) 513-5290 From: Charles Hedrick via FreeIPA-users <freeipa-users(a)lists.fedorahosted.org> Reply-To: FreeIPA users list <freeipa-users(a)lists.fedorahosted.org> Date: Tuesday, January 28, 2020 at 14:21 To: FreeIPA users list <freeipa-users(a)lists.fedorahosted.org> Cc: Charles Hedrick <hedrick(a)rutgers.edu> Subject: [EXTERNAL] [Freeipa-users] suggestion for password policy The NIST recommendations for passwords say they don’t think character classes and expiration are useful. Instead, they recommend using a blacklist of known common passwords. There’s no way to implement this policy without writing your own plugin. It would be useful for IPA’s password policy to allow you to specify a database of forbidden passwords. We’ve done this using a plugin, but I’d rather not have to write C code to implement policy.

1 0

"FreeIPA" server ipa-dnskeysyncd.service failed
by Navi Aujla 28 Jan '20

28 Jan '20

Named service is generating core dumps under /var/named and ipa-dnskeysyncd.service is failing. Jan 27 14:31:39 freeipa-03.prod.mcs.som.mob.nuance.com systemd[1]: ipa-dnskeysyncd.service failed. Jan 27 14:32:09 freeipa-03.prod.mcs.som.mob.nuance.com systemd[1]: Stopped IPA key daemon. Jan 27 14:32:09 freeipa-03.prod.mcs.som.mob.nuance.com systemd[1]: Started IPA key daemon. Jan 27 14:32:12 freeipa-03.prod.mcs.som.mob.nuance.com ipa-dnskeysyncd[16632]: ipa-dnskeysyncd: INFO LDAP bind... Jan 27 14:32:12 freeipa-03.prod.mcs.som.mob.nuance.com python2[16632]: GSSAPI client step 1 Jan 27 14:32:12 freeipa-03.prod.mcs.som.mob.nuance.com python2[16632]: GSSAPI client step 1 Jan 27 14:32:12 freeipa-03.prod.mcs.som.mob.nuance.com python2[16632]: GSSAPI client step 1 Jan 27 14:32:12 freeipa-03.prod.mcs.som.mob.nuance.com python2[16632]: GSSAPI client step 2 Jan 27 14:32:12 freeipa-03.prod.mcs.som.mob.nuance.com ipa-dnskeysyncd[16632]: ipa-dnskeysyncd: INFO Commencing sync process Jan 27 14:32:12 freeipa-03.prod.mcs.som.mob.nuance.com ipa-dnskeysyncd[16632]: ipaserver.dnssec.keysyncer: INFO Initial LDAP dump is done, sychronizing with ODS and BIND Jan 27 14:32:15 freeipa-03.prod.mcs.som.mob.nuance.com python2[16650]: GSSAPI client step 1 Jan 27 14:32:15 freeipa-03.prod.mcs.som.mob.nuance.com python2[16650]: GSSAPI client step 1 Jan 27 14:32:15 freeipa-03.prod.mcs.som.mob.nuance.com python2[16650]: GSSAPI client step 1 Jan 27 14:32:15 freeipa-03.prod.mcs.som.mob.nuance.com ipa-dnskeysyncd[16632]: Traceback (most recent call last): Jan 27 14:32:15 freeipa-03.prod.mcs.som.mob.nuance.com ipa-dnskeysyncd[16632]: File "/usr/libexec/ipa/ipa-dnskeysyncd", line 116, in <module> Jan 27 14:32:15 freeipa-03.prod.mcs.som.mob.nuance.com ipa-dnskeysyncd[16632]: while ldap_connection.syncrepl_poll(all=1, msgid=ldap_search): Jan 27 14:32:15 freeipa-03.prod.mcs.som.mob.nuance.com ipa-dnskeysyncd[16632]: File "/usr/lib64/python2.7/site-packages/ldap/syncrepl.py", line 405, in syncrepl_poll Jan 27 14:32:15 freeipa-03.prod.mcs.som.mob.nuance.com ipa-dnskeysyncd[16632]: self.syncrepl_refreshdone() Jan 27 14:32:15 freeipa-03.prod.mcs.som.mob.nuance.com ipa-dnskeysyncd[16632]: File "/usr/lib/python2.7/site-packages/ipaserver/dnssec/keysyncer.py", line 126, in syncrepl_refreshdone Jan 27 14:32:15 freeipa-03.prod.mcs.som.mob.nuance.com ipa-dnskeysyncd[16632]: self.hsm_replica_sync() Jan 27 14:32:15 freeipa-03.prod.mcs.som.mob.nuance.com ipa-dnskeysyncd[16632]: File "/usr/lib/python2.7/site-packages/ipaserver/dnssec/keysyncer.py", line 192, in hsm_replica_sync Jan 27 14:32:15 freeipa-03.prod.mcs.som.mob.nuance.com ipa-dnskeysyncd[16632]: ipautil.run([paths.IPA_DNSKEYSYNCD_REPLICA]) Jan 27 14:32:15 freeipa-03.prod.mcs.som.mob.nuance.com ipa-dnskeysyncd[16632]: File "/usr/lib/python2.7/site-packages/ipapython/ipautil.py", line 562, in run Jan 27 14:32:15 freeipa-03.prod.mcs.som.mob.nuance.com ipa-dnskeysyncd[16632]: raise CalledProcessError(p.returncode, arg_string, str(output)) Jan 27 14:32:15 freeipa-03.prod.mcs.som.mob.nuance.com ipa-dnskeysyncd[16632]: subprocess.CalledProcessError: Command '/usr/libexec/ipa/ipa-dnskeysync-replica' returned non-zero exit status 1 Jan 27 14:32:15 freeipa-03.prod.mcs.som.mob.nuance.com systemd[1]: ipa-dnskeysyncd.service: main process exited, code=exited, status=1/FAILURE Jan 27 14:32:15 freeipa-03.prod.mcs.som.mob.nuance.com systemd[1]: Unit ipa-dnskeysyncd.service entered failed state. Jan 27 14:32:15 freeipa-03.prod.mcs.som.mob.nuance.com systemd[1]: ipa-dnskeysyncd.service failed. I am not able find the cause, any pointers to troubleshoot and fix?

3 6

ipa-server-upgrade failed
by Winfried de Heiden 28 Jan '20

28 Jan '20

Hi all, Using CentOS Linux release 8.1.1911 and the Stream repositories, upgrading IPA fails: ( Upgrade ipa-server-common-4.8.0- 13.module_el8.1.0+265+e1e65be4.noarch @AppStream Upgraded ipa-server-common-4.8.0- 11.module_el8.1.0+253+3b90c921.noarch @@System ) Running ipa-server-upgrade manually will result in: [Upgrading CA schema] CA schema update complete (no changes) [Verifying that CA audit signing cert has 2 year validity] [Update certmonger certificate renewal configuration] Introspect error on :1.417:/org/fedorahosted/certmonger: dbus.exceptions.DBusException: org.freedesktop.DBus.Error.NoReply: Did not receive a reply. Possible causes include: the remote application did not send a reply, the message bus security policy blocked the reply, the reply timeout expired, or the network connection was broken. Any sugestions? Winfried

3 8

2FA using ssh keys + Free OTP
by Daniel PC 27 Jan '20

27 Jan '20

Hi Currently, I have 2FA implemented with password + FreeOTP as authentication methods. I wonder if possible to implement ssh pub+priv keys instead of a password as the first authentication factor. Has anyone implemented such thing? Thank you Daniel PC

2 1

DNS not starting after RH6 to CentOS6 migration
by Terry Soucy 27 Jan '20

27 Jan '20

I'm in the process of migrating my production IPA servers from RH6 to CentOS6. I have successfully completed this in our QA environments with very few issues, but it seems that our production environment wants to be difficult. After conversion to CentOS 6, dirsrv is functioning and replicating. A quick status check shows everything started up except memcached and named. Logs show this .. en2210s named 5366 - - sizing zone task pool based on 6 zones en2210s named 5366 - - /etc/named.conf:12: no forwarders seen; disabling forwarding en2210s named 5366 - - set up managed keys zone for view _default, file 'dynamic/managed-keys.bind' en2210s named 5366 - - GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Server krbtgt/SOCKET(a)SFMC.CO not found in Kerberos database) en2210s named 5366 - - bind to LDAP server failed: Local error en2210s named 5366 - - dynamic database 'ipa' configuration failed: failure en2210s named 5366 - - loading configuration: failure en2210s named 5366 - - exiting (due to fatal error) Had a quick check of the dns keytab, and the contents of /etc/named.keytab match what is currently in kerberos. The options in named.conf still matches what is on the other replicas. I've been hunting around for some answers in Google, but so far I'm not finding a lot of clues. Can someone lead my down a path here? Terry -- Terry Soucy Systems Engineering Lead | Salesforce Mobile: +1.506.609.3247 <http://smart.salesforce.com/sig/tsoucy//ca_mb/default/link.html>

2 2

can't install replica
by Charles Hedrick 24 Jan '20

24 Jan '20

We are moving from Centos 7 to 8. I did a test on copies and it worked with 8.0. i made the mistake of doing it on the production servers under 8.1. It fails. I removed one server and recreated it as a replica. It worked fine. However the second one failed near the end of the process: Restart of krb5kdc.service complete Waiting up to 300 seconds to see our keys appear on host ldap://krb1.cs.rutgers.edu Starting new HTTPS connection (1): krb1.cs.rutgers.edu:443 https://krb1.cs.rutgers.edu:443 "GET /ipa/keys/dm/DMHash?type=kem&value=eyJhbGciOiJSU0EtT0FFUCIsImVuYyI6IkEyNTZDQkMtSFM1MTIiLCJraWQiOm51bGx9.KgdU3jtIIC3bRIoqToXzmZIl3QFUKqbrBbT0sBerqmR2YWNWQTEp8ABbTSHINOUhtgPubXhwaAsqPzXTee3urtrK6lmf9wJ6OkecdVPY1PS9sWhMNUz4gEJkR-vVM8bN6gfk4g2Lc8jq2o2LMFloNMgCqUQyeRuiec09NsjIvR8X18xYQfXJXvlhuz-d2OJW1CsKO6_T1z8O_vsxlZ-vAeB8j3dbZiXJOlzdcxYYqjMHY-IM4LroUzCVNXtHloiq28e6R-uVTX9O7ActEbiSy6UePgE76K0cWVl1kJyHFozEZChH1_rzCgP6zdhAf8QqPOdde_860nxIUmroRuECjA.gnnrHcTs9ucgqLntquJltw.GAWBOG_aMTgwzwxQqSIFrThgTTiqg3fM3POZWccCqqs3PiwJq5vW2S-tF9VsV1topXcRdlKb6fUOyjE6wrffJ5hYRyE1c3ocAlG3QTVC8QWRn7Ol_IfoVfW-hTe-cAhELcdIOIEand_BYjSTEO6rDXv83iXRFxwno9ZYYppF8bQY7EC1r_wW5xTdXftILCDmkJbhXmGPnlCQ2Ah9cG3qZAKNBRsvk400_kRQec-4LBKWGYYd0y56zd6-PpcVO6p72AldDF_YoeettzaaxbYyH0bRFt7y9aHH3GaD5BOkVp_ZgSHZWbWf8-2zB76f1OKrz6TktCfcb4_ChUZ6BZZ41MX6T06Xjp3ft6p5KzPfY_gUq0fKWWESHMLOEZg8fAl15l9ZwMiRmpd1PZW3oLVxF3rO94OM4H7_8WVehrcO3dAuAVA7_ykmIKv-WBWvjNHbsXXTyb76a2ka2WYuVxeKGMklEyQgOaMPJa7BqSOCiPljt7juTXAMGRupuDG62bP9PdFQkervv4p_9wvwpEZkuWPLlHqgzrdspgBbQoXkbcyiv9qf7oyB_xHQaoMxlwfvGwlNu8Go9t8oHJkalVdjxCPL-qG0GxKHuh0uFNYR0Z3uP545HkzVECv8uUkm08Jc.SCBVE0utvtniR8-8qAe02swg5GzDZxfN0O6JkKsWN2Y HTTP/1.1" 502 415 Your system may be partly configured. Run /usr/sbin/ipa-server-install --uninstall to clean up. File "/usr/lib/python3.6/site-packages/ipapython/admintool.py", line 179, in execute return_value = self.run() File "/usr/lib/python3.6/site-packages/ipapython/install/cli.py", line 340, in run return cfgr.run() File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 360, in run return self.execute() File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 386, in execute for rval in self._executor(): File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 431, in __runner exc_handler(exc_info) File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 460, in _handle_execute_exception self._handle_exception(exc_info) File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 450, in _handle_exception six.reraise(*exc_info) File "/usr/lib/python3.6/site-packages/six.py", line 693, in reraise raise value File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 421, in __runner step() File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 418, in <lambda> step = lambda: next(self.__gen) File "/usr/lib/python3.6/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from six.reraise(*exc_info) File "/usr/lib/python3.6/site-packages/six.py", line 693, in reraise raise value File "/usr/lib/python3.6/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from value = gen.send(prev_value) File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 655, in _configure next(executor) File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 431, in __runner exc_handler(exc_info) File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 460, in _handle_execute_exception self._handle_exception(exc_info) File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 518, in _handle_exception self.__parent._handle_exception(exc_info) File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 450, in _handle_exception six.reraise(*exc_info) File "/usr/lib/python3.6/site-packages/six.py", line 693, in reraise raise value File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 515, in _handle_exception super(ComponentBase, self)._handle_exception(exc_info) File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 450, in _handle_exception six.reraise(*exc_info) File "/usr/lib/python3.6/site-packages/six.py", line 693, in reraise raise value File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 421, in __runner step() File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 418, in <lambda> step = lambda: next(self.__gen) File "/usr/lib/python3.6/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from six.reraise(*exc_info) File "/usr/lib/python3.6/site-packages/six.py", line 693, in reraise raise value File "/usr/lib/python3.6/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from value = gen.send(prev_value) File "/usr/lib/python3.6/site-packages/ipapython/install/common.py", line 65, in _install for unused in self._installer(self.parent): File "/usr/lib/python3.6/site-packages/ipaserver/install/server/__init__.py", line 590, in main replica_install(self) File "/usr/lib/python3.6/site-packages/ipaserver/install/server/replicainstall.py", line 402, in decorated func(installer) File "/usr/lib/python3.6/site-packages/ipaserver/install/server/replicainstall.py", line 1298, in install custodia.import_dm_password() File "/usr/lib/python3.6/site-packages/ipaserver/install/custodiainstance.py", line 211, in import_dm_password cli.fetch_key('dm/DMHash') File "/usr/lib/python3.6/site-packages/ipaserver/secrets/client.py", line 120, in fetch_key r.raise_for_status() File "/usr/lib/python3.6/site-packages/requests/models.py", line 940, in raise_for_status raise HTTPError(http_error_msg, response=self) The ipa-replica-install command failed, exception: HTTPError: 502 Server Error: Proxy Error for url: https://krb1.cs.rutgers.edu/ipa/keys/dm/DMHash?xxxx 502 Server Error: Proxy Error for url: https://krb1.cs.rutgers.edu/ipa/keys/dm/DMHash?ccc At this point I’m pretty much stuck.

1 2

After install FreeIPA server - ipa: WARNING: Failed to read schema: [Errno 13] Permission denied...
by Bedrosian Baol 23 Jan '20

23 Jan '20

I tried to install the FreeIPA server as suggested here: https://computingforgeeks.com/install-and-configure-freeipa-server-on-ubunt… It seems to be all right: :~$ kinit admin ---- > Ok :~$ klist Ticket cache: KEYRING:persistent:1000:1000 Default principal: admin(a)TEST.BED Valid starting Expires Service principal 01/20/2020 10:50:10 01/21/2020 10:49:19 HTTP/master1.test.bed(a)TEST.BED 01/20/2020 10:49:24 01/21/2020 10:49:19 krbtgt/TEST.BED(a)TEST.BED but the command ipa-user-find return: :~$ ipa-user-find admin ipa: WARNING: Failed to read schema: [Errno 13] Permission denied: u'/home/bed/.cache/ipa/schema/1/84c19d36' ipa: WARNING: Failed to write schema: [Errno 13] Permission denied: '/home/bed/.cache/ipa/schema/1/84c19d36mC4GkY' ipa: WARNING: Failed to write server info: [Errno 13] Permission denied: u'/home/bed/.cache/ipa/servers/master1.test.bed' -------------- 1 user matched -------------- User login: admin Last name: Administrator Home directory: /home/admin Login shell: /bin/bash Principal alias: admin(a)TEST.BED UID: 1382000000 GID: 1382000000 Account disabled: False ---------------------------- Number of entries returned 1 ---------------------------- If I try to login with the web interface this is answer: "Login failed due to an unknown reason" (browser configured with certificate) The user "bed" is the sudoer user created during linux server installation, and is the only one at FreeIPA server install time Any advice? Thanks B-)

2 2

Remote Replica Setup
by Russ Long 23 Jan '20

23 Jan '20

I have a cluster of 1 master and 2 replica servers spread across Availablity Zones in one VPC in AWS. We have a couple remote, locked down VPCs that for security reasons do not have access to the rest of our infrastructure. For this reason, I want to place an IPA Replica in those remote VPCs. I was wondering what type of proxy I could place in front of the IPA Master to allow communication with these remote replicas on all required ports. I want to use a proxy to avoid having our IPA setup directly connected to the internet as would be required for the remote replicas to communicate.

1 0

FreeIPA installs without errors, but then the web interface is not available.
by Scott Reed 23 Jan '20

23 Jan '20

I install FreeIPA with my usual options, but when it's done the web interface is not available with the usual. Service status: [xadministrator@idm log]$ sudo systemctl enable tomcat.service -l [xadministrator@idm log]$ sudo systemctl start tomcat.service -l [xadministrator@idm log]$ sudo systemctl status tomcat.service -l \u25cf tomcat.service - Apache Tomcat Web Application Container Loaded: loaded (/usr/lib/systemd/system/tomcat.service; enabled; vendor preset: disabled) Active: inactive (dead) since Tue 2020-01-21 14:42:52 EST; 3s ago Process: 15192 ExecStart=/usr/libexec/tomcat/server start (code=exited, status=0/SUCCESS) Main PID: 15192 (code=exited, status=0/SUCCESS) Jan 21 14:42:52 idm.cs.xxxx server[15192]: Jan 21, 2020 2:42:52 PM org.apache.catalina.core.StandardService stopInternal Jan 21 14:42:52 idm.cs.xxxx server[15192]: INFO: Stopping service Catalina Jan 21 14:42:52 idm.cs.xxxx server[15192]: Jan 21, 2020 2:42:52 PM org.apache.coyote.AbstractProtocol stop Jan 21 14:42:52 idm.cs.xxxx server[15192]: INFO: Stopping ProtocolHandler ["http-bio-8080"] Jan 21 14:42:52 idm.cs.xxxx server[15192]: Jan 21, 2020 2:42:52 PM org.apache.coyote.AbstractProtocol destroy Jan 21 14:42:52 idm.cs.xxxx server[15192]: INFO: Destroying ProtocolHandler ["http-bio-8080"] Jan 21 14:42:52 idm.cs.xxxx server[15192]: Jan 21, 2020 2:42:52 PM org.apache.coyote.AbstractProtocol stop Jan 21 14:42:52 idm.cs.xxxx server[15192]: INFO: Stopping ProtocolHandler ["ajp-bio-8009"] Jan 21 14:42:52 idm.cs.xxxx server[15192]: Jan 21, 2020 2:42:52 PM org.apache.coyote.AbstractProtocol destroy Jan 21 14:42:52 idm.cs.xxxx server[15192]: INFO: Destroying ProtocolHandler ["ajp-bio-8009"] [xadministrator@idm log]$ [xadministrator@idm log]$ sudo systemctl status httpd -l [sudo] password for xadministrator: \u25cf httpd.service - The Apache HTTP Server Loaded: loaded (/usr/lib/systemd/system/httpd.service; disabled; vendor preset: disabled) Drop-In: /etc/systemd/system/httpd.service.d \u2514\u2500ipa.conf Active: active (running) since Tue 2020-01-21 14:18:35 EST; 1 day 2h ago Docs: man:httpd(8) man:apachectl(8) Main PID: 13471 (httpd) Status: "Total requests: 4; Current requests/sec: 0; Current traffic: 0 B/sec" Tasks: 61 CGroup: /system.slice/httpd.service \u251c\u250013471 /usr/sbin/httpd -DFOREGROUND \u251c\u250013472 /usr/libexec/nss_pcache 688130 off \u251c\u250013475 (wsgi:kdcproxy) -DFOREGROUND \u251c\u250013476 (wsgi:kdcproxy) -DFOREGROUND \u251c\u250013477 (wsgi:ipa) -DFOREGROUND \u251c\u250013478 (wsgi:ipa) -DFOREGROUND \u251c\u250013479 (wsgi:ipa) -DFOREGROUND \u251c\u250013480 (wsgi:ipa) -DFOREGROUND \u251c\u250013481 /usr/sbin/httpd -DFOREGROUND \u251c\u250013482 /usr/sbin/httpd -DFOREGROUND \u251c\u250013483 /usr/sbin/httpd -DFOREGROUND \u251c\u250013484 /usr/sbin/httpd -DFOREGROUND \u251c\u250013485 /usr/sbin/httpd -DFOREGROUND \u2514\u250013747 /usr/sbin/httpd -DFOREGROUND Jan 21 14:18:35 idm.cs.xxxx systemd[1]: Started The Apache HTTP Server. Jan 21 14:18:40 idm.cs.xxxx [13477]: GSSAPI client step 1 Jan 21 14:18:40 idm.cs.xxxx [13477]: GSSAPI client step 1 Jan 21 14:18:40 idm.cs.xxxx [13477]: GSSAPI client step 1 Jan 21 14:18:40 idm.cs.xxxx [13478]: GSSAPI client step 1 Jan 21 14:18:40 idm.cs.xxxx [13478]: GSSAPI client step 1 Jan 21 14:18:40 idm.cs.xxxx [13478]: GSSAPI client step 1 Jan 21 14:18:42 idm.cs.xxxx [13479]: GSSAPI client step 1 Jan 21 14:18:42 idm.cs.xxxx [13479]: GSSAPI client step 1 Jan 21 14:18:42 idm.cs.xxxx [13479]: GSSAPI client step 1 The url that I'm trying is: https://idm.cs.xxxx/ipa/ui/ Any help would be appreciated.

2 5

Re: Freeipa and squid
by Aditya 23 Jan '20

23 Jan '20

Hi, I am Aditya from India. I red your article on HYPERKITTY with reference to that I need your help to setup the acl environment as below. 1) I want an internet access with different rules - some group with full access, -some without social networks, ad some group without access to internet, 2) Can you please help me to perform above action in my network by using “ext_kerberos_ldap_group_acl” 3) Coz I am not aware about use of ext_kerberos_ldap_group_acl I am using centos as a IPA server and centos as squid proxy server and ubuntu 18 as client. Requesting you to please help. Regards, Aditya Pawar. 8976100089

1 0

External CA renewal and self-signed surprise
by Rob Foehl 22 Jan '20

22 Jan '20

Went to renew an externally-signed IPA CA certificate that was valid through today, and discovered that FreeIPA had decided to renew it with a self-signed cert a month ago, and had since reissued all other subsystem certs against that self-signed CA. After running through the ipa-cacert-manage renew dance and ipa-certupdate, the system store now contains the following certs, in this order: - old, now-expired IPA CA cert - old, soon-to-be-expired external CA root cert - self-signed IPA cert - new IPA CA cert - new external CA root cert There's also a chicken-and-egg problem with trying to renew anything, in that all new requests are signed with the self-signed IPA CA instead of the new intermediate IPA CA. How do I unravel this, and completely purge the self-signed cert from existence? Why did FreeIPA try to renew the intermediate CA cert on its own, and why did it succeed? (This is FreeIPA 4.7.2 on Fedora 29, which I'm stuck with until the CA chains are sorted out -- upgrading is still a manual replica replacement process, since ipa-server-upgrade and friends *still* insist on verifying a CA lifetime of >2 years, inexplicable behavior reported years ago...) -Rob

4 10

default ipa users seeing too much
by John Louis 21 Jan '20

21 Jan '20

Hi, when a new user is created, she is assigned to the default "ipausers" group. But she can: 1. see the list of all users, at https://server/ipa/ui/#/e/user/search 2. see all the details of any other users, at https://server/ipa/ui/#/e/user/details/another_user 3. for herself, she sees too many info that maybe nobody needs, such as "Car License", in her own landing page Is it possible to: A. prevent normal users to see 1. and 2. above B. customize to remove items not needed in 3. above ? I checked, looks like: A. even though we can configure some Roles, Privileges, Permissions, they are all system admins' elevated permissions. There is no way to remove permission from "ipausers". B. we can configure to disallow users to modify her "Car License" etc, BUT I found no way to not show that item in her landing page. I googled but can't find anything on the above. Would you help? Thanks!

3 3

IPA client as a Samba server?
by Amos 21 Jan '20

21 Jan '20

So, was told a RHEL IPA client (leveraging sssd) could not also be a Samba server (leveraging winbindd) because sssd and winbindd collide in terms of the Kerberos bindings. Our IPA servers are configured in "compat" mode in expectation of having to support a few Solaris systems. Could I configured this RHEL IPA client to instead use LDAP via the compat method and still be able to be a Samba server? Amos

2 1

upgrade from centos 8.0 -> 8.1 samba fails to start
by Rami Elias (TECH V) 21 Jan '20

21 Jan '20

Hello, i upgraded one of our replicas from Centos 8.0 -> Centos 8.1 IPA version error: data needs to be upgraded (expected version '4.8.0-11.module_el8.1.0+253+3b90c921', current version '4.7.1-11.module_el8.0.0+79+bbd20d7b') Automatically running upgrade, for details see /var/log/ipaupgrade.log Be patient, this may take a few minutes. Starting Directory Service Starting krb5kdc Service Starting kadmin Service Starting named Service Starting httpd Service Starting ipa-custodia Service Starting pki-tomcatd Service Starting smb Service Failed to start smb Service Shutting down Hint: You can use --ignore-service-failure option for forced start in case that a non-critical service failed Aborting ipactl now samba cant start anymore, the google results i found for this error where old and said its a ubuntu / debian problem because debian based derivates have their samba build with Heimdal Kerberos instead of MIT Kerberos: https://bugs.launchpad.net/ubuntu/+source/samba/+bug/1552249 Jan 21 16:05:57 ipa-web-test-c82.lx.domain.at smbd[49686]: [2020/01/21 16:05:57.203922, 0] ../../source3/passdb/pdb_interface.c:171(make_pdb_method_name) Jan 21 16:05:57 ipa-web-test-c82.lx.domain.at smbd[49686]: No builtin nor plugin backend for ipasam found Jan 21 16:05:57 ipa-web-test-c82.lx.domain.at systemd[1]: smb.service: Main process exited, code=exited, status=1/FAILURE Jan 21 16:05:57 ipa-web-test-c82.lx.domain.at systemd[1]: smb.service: Failed with result 'exit-code'. Jan 21 16:05:57 ipa-web-test-c82.lx.domain.at systemd[1]: Failed to start Samba SMB Daemon. is this maybe a bug? i attached the ipaupgrade.log https://mega.nz/#!MANSjQbL!HsNemqP5OGL5muoYvHvsaPwzaCDeoPkz5utY4J7wkIw the log was to big to send as attachment best regards, -- ÖAMTC I BAUMGASSE 129 I 1030 WIEN Elias Rami | Devops Engineer M +43 664 613 1346 elias.rami(a)oeamtc.at | www.oeamtc.at<http://www.oeamtc.at/> | ÖAMTC ZVR 7300335108 ________________________________ ÖAMTC Schutzbrief Der umfassende Schutz für Sie und Ihre Familie. Auf allen Reisen mit Auto, Bahn, Bus, Fahrrad, Schiff oder Flugzeug. In Österreich, Europa und rund ums Mittelmeer. www.oeamtc.at/schutzbrief<https://www.oeamtc.at/schutzbrief> ________________________________ Wichtiger Hinweis/Important Information: Dieses E-Mail samt Anlagen („E-Mail“) dient nur zur Information. Erklärungen via E-Mail sind nicht rechtsverbindlich, sondern bedürfen der schriftlichen Bestätigung samt firmenmäßiger/statutenmäßiger Unterfertigung durch Mitglieder der Geschäftsleitung in vertretungsbefugter Anzahl. Für die Richtigkeit oder Vollständigkeit der übermittelten Informationen/Daten, für Übermittlungsfehler, für fehlgeleitete E-Mails oder für einen verspäteten Empfang wird nicht gehaftet. Eigene elektronische Empfangs- oder Lesebestätigungen gelten nicht als Bestätigung für den Erhalt eines E-Mails. Der Inhalt dieses E-Mails ist vertraulich. Wenn Sie nicht der angegebene Adressat oder dessen Vertreter sind, informieren Sie bitte umgehend den Absender und löschen Sie dieses E-Mail von Ihrem System. Die unerlaubte Weitergabe oder Nutzung ist nicht gestattet. This e-mail and any attachment (“e-mail”) serves information purposes only. Statements via e-mail are not legally binding but require written confirmation including the signatures of the required number of managing directors under statutory provisions. We are not liable for the accuracy and sufficiency of the provided information/data, for any transmission error, misdirection, loss or delay of an e-mail. Electronic reading receipts are no confirmation for receipt of an e-mail. This e-mail is confidential. If you are not the addressee or his representative, please notify the sender immediately and delete this e-mail from your system. Any disclosure or use is prohibited. ________________________________

2 1

Two interfaces on FreeIPA server.. How?
by Tony Brian Albers 21 Jan '20

21 Jan '20

Ok guys, I have a FreeIPA server with 2 interfaces. The primary is for normal usage and is the one that FreeIPA is set up with with regards to hostname and services. The other one is on an administrative network. The Web UI works fine on the primary interface, but I can't really access it on the other interface. It's obvious that the services bind to the primary interface, but isn't it possible to access the UI on the other interface somehow? TIA /tony -- Tony Albers - Systems Architect - IT Development Royal Danish Library, Victor Albecks Vej 1, 8000 Aarhus C, Denmark Tel: +45 2566 2383 - CVR/SE: 2898 8842 - EAN: 5798000792142

3 3

Import Schema into FreeIPA
by Dirk Streubel 21 Jan '20

21 Jan '20

Hello List, maybe off topic, i don't know. I have two IPA Servers here, there are in Replication Mode and everything is working fine. Now i want to import a new schema into the IPA Servers. So, i put the new schema under /etc/dirsrv/slapd.../schema in one of my IPA Servers. I also make Chmod / Chown and "restorecon". After that, in the Cockpit 389 WebGUI i reload the schema files, with no error, and restart the IPA Service. Maybe this is to necessary? But i can't see the new schema on my second IPA Server. I have also tried "ipa-replica-manage re-initialize --from" .. So, do i have to install the new schema manually on the second IPA Server and reload the schema files or what is the best way to import a new schema into FreeIPA and replicate it to the second IPA Server? Regards Dirk

2 1

Strange krb5 issue
by Petar Kozić 21 Jan '20

21 Jan '20

Hi, I’m using my IPA server in docker. I’m using that server last more than 8-9 months for ssh login. Everything works well till few hours before. I can’t login to ssh and I get this strange error: [sssd[ldap_child[2171]]][2171]: Failed to initialize credentials using keytab [MEMORY:/etc/krb5.keytab]: Preauthentication failed. Unable to create GSSAPI-encrypted LDAP connection. Someone have idea how to solve this? Thank you. *—* *Petar Kozić*

4 8

Windows Client Integration
by Alexander Becker 21 Jan '20

21 Jan '20

Hi all, i am trying to configure Windows authentication against FreeIPA using this guide: https://www.freeipa.org/page/Windows_authentication_against_FreeIPA Everything worked so far. I added the local User the to "Remote Desktop User" group but it doesn't work with RDP. The Message says that the User is not in the Remote Desktop Group. Now what i could find out is, that the problem is that the following command was run on the IPA Server after the initial Installation of FreeIPA: ipa-adtrust-install --add-sids --netbios-name=EXAMPLE -a So if i understand that correctly, "--add-sids" assigns a SID identifier to all groups in FreeIPA. That's why the RDP ist not working, because the User is not mapped to the local Windows User. How can i make it work? 1. Is it possible to add the FreeIPA User/Group to the "Remote Desktop User" Group so that RDP works? Do i have to configure something in Samba or FreeIPA? 2. Can i somehow undo the Configuration that was done with "ipa-adtrust-install --add-sids"? Can i remove the assigned SIDs? Any help will be much appreciated. with regards, Alexander Becker

1 0

Slow login (CentOS 7.5, IPA 4.5.4)
by Detlev Habicht 21 Jan '20

21 Jan '20

Hello, we are using hosts with CentOS 7.5 - physical and virtual. And we have three IPA server. We are using Cadence CAD/EDA applications and we have a lot of simulations running. After a while we have two problems: - login is very slow - access of NFS mounted data and applications is slow This happens normally after two or more weeks. After a reboot everything is ok again. This problems occurs not on all hosts at the same time, so the other hosts are ok, when some hosts have this problems. Here i will ask for my login problem: Her comes a debug output from sssd: I am using "ssh hostname". #… (deleted) (Wed Jan 15 13:30:02 2020) [sssd[be[imsmx.intern]]] [sysdb_set_entry_attr] (0x0200): Entry [name=habicht(a)imsmx.intern,cn=users,cn=imsmx.intern,cn=sysdb] has set [ts_cache] attrs. (Wed Jan 15 13:30:02 2020) [sssd[be[imsmx.intern]]] [ldb] (0x4000): commit ldb transaction (nesting: 0) (Wed Jan 15 13:30:02 2020) [sssd[be[imsmx.intern]]] [check_wait_queue] (0x1000): Wait queue for user [habicht(a)imsmx.intern] is empty. (Wed Jan 15 13:30:02 2020) [sssd[be[imsmx.intern]]] [krb5_auth_queue_done] (0x1000): krb5_auth_queue request [0x55d411a08150] done. (Wed Jan 15 13:30:02 2020) [sssd[be[imsmx.intern]]] [dp_req_done] (0x0400): DP Request [PAM Preauth #28]: Request handler finished [0]: Success (Wed Jan 15 13:30:02 2020) [sssd[be[imsmx.intern]]] [_dp_req_recv] (0x0400): DP Request [PAM Preauth #28]: Receiving request data. (Wed Jan 15 13:30:02 2020) [sssd[be[imsmx.intern]]] [dp_req_destructor] (0x0400): DP Request [PAM Preauth #28]: Request removed. (Wed Jan 15 13:30:02 2020) [sssd[be[imsmx.intern]]] [dp_req_destructor] (0x0400): Number of active DP request: 0 (Wed Jan 15 13:30:02 2020) [sssd[be[imsmx.intern]]] [dp_method_enabled] (0x0400): Target selinux is not configured (Wed Jan 15 13:30:02 2020) [sssd[be[imsmx.intern]]] [dp_pam_reply] (0x1000): DP Request [PAM Preauth #28]: Sending result [0][imsmx.intern] ### ### Doing Return after entry of password - first debug output at first 30:37 ### (Wed Jan 15 13:30:37 2020) [sssd[be[imsmx.intern]]] [sbus_dispatch] (0x4000): dbus conn: 0x55d4119e04e0 (Wed Jan 15 13:30:37 2020) [sssd[be[imsmx.intern]]] [sbus_dispatch] (0x4000): Dispatching. (Wed Jan 15 13:30:37 2020) [sssd[be[imsmx.intern]]] [sbus_message_handler] (0x2000): Received SBUS method org.freedesktop.sssd.dataprovider.getAccountInfo on path /org/freedesktop/sssd/dataprovider (Wed Jan 15 13:30:37 2020) [sssd[be[imsmx.intern]]] [sbus_get_sender_id_send] (0x2000): Not a sysbus message, quit (Wed Jan 15 13:30:37 2020) [sssd[be[imsmx.intern]]] [dp_get_account_info_handler] (0x0200): Got request for [0x3][BE_REQ_INITGROUPS][name=habicht(a)imsmx.intern] (Wed Jan 15 13:30:37 2020) [sssd[be[imsmx.intern]]] [sss_domain_get_state] (0x1000): Domain imsmx.intern is Active (Wed Jan 15 13:30:37 2020) [sssd[be[imsmx.intern]]] [ldb] (0x4000): Added timed event "ltdb_callback": 0x55d4119fedf0 (Wed Jan 15 13:30:37 2020) [sssd[be[imsmx.intern]]] [ldb] (0x4000): Added timed event "ltdb_timeout": 0x55d4119f85b0 (Wed Jan 15 13:30:37 2020) [sssd[be[imsmx.intern]]] [ldb] (0x4000): Running timer event 0x55d4119fedf0 „ltdb_callback" #… (deleted) (Wed Jan 15 13:30:38 2020) [sssd[be[imsmx.intern]]] [hbac_evaluate] (0x0100): ALLOWED by rule [allow_all]. (Wed Jan 15 13:30:38 2020) [sssd[be[imsmx.intern]]] [hbac_evaluate] (0x0100): hbac_evaluate() >] (Wed Jan 15 13:30:38 2020) [sssd[be[imsmx.intern]]] [ipa_hbac_evaluate_rules] (0x0080): Access granted by HBAC rule [allow_all] (Wed Jan 15 13:30:38 2020) [sssd[be[imsmx.intern]]] [dp_req_done] (0x0400): DP Request [PAM Account #31]: Request handler finished [0]: Success (Wed Jan 15 13:30:38 2020) [sssd[be[imsmx.intern]]] [_dp_req_recv] (0x0400): DP Request [PAM Account #31]: Receiving request data. (Wed Jan 15 13:30:38 2020) [sssd[be[imsmx.intern]]] [dp_req_destructor] (0x0400): DP Request [PAM Account #31]: Request removed. (Wed Jan 15 13:30:38 2020) [sssd[be[imsmx.intern]]] [dp_req_destructor] (0x0400): Number of active DP request: 0 (Wed Jan 15 13:30:38 2020) [sssd[be[imsmx.intern]]] [dp_method_enabled] (0x0400): Target selinux is not configured (Wed Jan 15 13:30:38 2020) [sssd[be[imsmx.intern]]] [dp_pam_reply] (0x1000): DP Request [PAM Account #31]: Sending result [0][imsmx.intern] (Wed Jan 15 13:30:38 2020) [sssd[be[imsmx.intern]]] [sdap_process_result] (0x2000): Trace: sh[0x55d411a00330], connected[1], ops[(nil)], ldap[0x55d4119e4300] (Wed Jan 15 13:30:38 2020) [sssd[be[imsmx.intern]]] [sdap_process_result] (0x2000): Trace: end of ldap_result list ### ### Between last 30:38 and first 31:03 no debug output appears ### (Wed Jan 15 13:31:03 2020) [sssd[be[imsmx.intern]]] [sbus_dispatch] (0x4000): dbus conn: 0x55d4119e04e0 (Wed Jan 15 13:31:03 2020) [sssd[be[imsmx.intern]]] [sbus_dispatch] (0x4000): Dispatching. (Wed Jan 15 13:31:03 2020) [sssd[be[imsmx.intern]]] [sbus_message_handler] (0x2000): Received SBUS method org.freedesktop.sssd.dataprovider.getAccountInfo on path /org/freedesktop/sssd/dataprovider (Wed Jan 15 13:31:03 2020) [sssd[be[imsmx.intern]]] [sbus_get_sender_id_send] (0x2000): Not a sysbus message, quit (Wed Jan 15 13:31:03 2020) [sssd[be[imsmx.intern]]] [dp_get_account_info_handler] (0x0200): Got request for [0x3][BE_REQ_INITGROUPS][name=habicht(a)imsmx.intern] (Wed Jan 15 13:31:03 2020) [sssd[be[imsmx.intern]]] [sss_domain_get_state] (0x1000): Domain imsmx.intern is Active (Wed Jan 15 13:31:03 2020) [sssd[be[imsmx.intern]]] [ldb] (0x4000): Added timed event "ltdb_callback": 0x55d411a054c0 #… (deleted) (Wed Jan 15 13:31:03 2020) [sssd[be[imsmx.intern]]] [ldb] (0x4000): Running timer event 0x55d4119fedf0 "ltdb_callback" (Wed Jan 15 13:31:03 2020) [sssd[be[imsmx.intern]]] [ldb] (0x4000): Destroying timer event 0x55d411a0bee0 "ltdb_timeout" (Wed Jan 15 13:31:03 2020) [sssd[be[imsmx.intern]]] [ldb] (0x4000): Ending timer event 0x55d4119fedf0 "ltdb_callback" (Wed Jan 15 13:31:03 2020) [sssd[be[imsmx.intern]]] [ldb] (0x4000): Added timed event "ltdb_callback": 0x55d4119f85b0 (Wed Jan 15 13:31:03 2020) [sssd[be[imsmx.intern]]] [ldb] (0x4000): Added timed event "ltdb_timeout": 0x55d4119fedf0 (Wed Jan 15 13:31:03 2020) [sssd[be[imsmx.intern]]] [ldb] (0x4000): Running timer event 0x55d4119f85b0 "ltdb_callback" (Wed Jan 15 13:31:03 2020) [sssd[be[imsmx.intern]]] [ldb] (0x4000): Destroying timer event 0x55d4119fedf0 "ltdb_timeout" (Wed Jan 15 13:31:03 2020) [sssd[be[imsmx.intern]]] [ldb] (0x4000): Ending timer event 0x55d4119f85b0 "ltdb_callback" (Wed Jan 15 13:31:03 2020) [sssd[be[imsmx.intern]]] [ldb] (0x4000): start ldb transaction (nesting: 0) (Wed Jan 15 13:31:03 2020) [sssd[be[imsmx.intern]]] [ldb] (0x4000): commit ldb transaction (nesting: 0) (Wed Jan 15 13:31:03 2020) [sssd[be[imsmx.intern]]] [dp_req_done] (0x0400): DP Request [Account #35]: Request handler finished [0]: Success (Wed Jan 15 13:31:03 2020) [sssd[be[imsmx.intern]]] [_dp_req_recv] (0x0400): DP Request [Account #35]: Receiving request data. (Wed Jan 15 13:31:03 2020) [sssd[be[imsmx.intern]]] [dp_req_reply_list_success] (0x0400): DP Request [Account #35]: Finished. Success. (Wed Jan 15 13:31:03 2020) [sssd[be[imsmx.intern]]] [dp_req_reply_std] (0x1000): DP Request [Account #35]: Returning [Success]: 0,0,Success (Wed Jan 15 13:31:03 2020) [sssd[be[imsmx.intern]]] [dp_table_value_destructor] (0x0400): Removing [0:1:0x0001:1::imsmx.intern:name=nnn@imsmx.intern] from reply table (Wed Jan 15 13:31:03 2020) [sssd[be[imsmx.intern]]] [dp_req_destructor] (0x0400): DP Request [Account #35]: Request removed. (Wed Jan 15 13:31:03 2020) [sssd[be[imsmx.intern]]] [dp_req_destructor] (0x0400): Number of active DP request: 0 (Wed Jan 15 13:31:03 2020) [sssd[be[imsmx.intern]]] [sdap_process_result] (0x2000): Trace: sh[0x55d411a00330], connected[1], ops[(nil)], ldap[0x55d4119e4300] (Wed Jan 15 13:31:03 2020) [sssd[be[imsmx.intern]]] [sdap_process_result] (0x2000): Trace: end of ldap_result list ### ### Prompt appears ### Here i have to wait 59 seconds for a prompt. Sometimes it is longer. A look with tcpdump shows only traffic on LDAP-ports. With ipa commands or ldapsearch i have no problems. Any idea why my problem happens? Thank you for any help. Detlev -- Detlev | Institut fuer Mikroelektronische Systeme Habicht | D-30167 Hannover +49 511 76219662 habicht(a)ims.uni-hannover.de --------+-------- Handy +49 172 5415752 ---------------------------

1 1

freeipa failing to start after update
by Andrew Meyer 20 Jan '20

20 Jan '20

I am running CentOS 8.x and have updated to the latest version of IPA and CentOS 8. I rebooted after updating and am now getting the following: Jan 20 12:55:29 freeipa01 server[7889]: arguments used: stop Jan 20 12:55:30 freeipa01 systemd[1]: Stopping 389 Directory Server ZONE1-EXAMPLE-NET.... Jan 20 12:55:30 freeipa01 ns-slapd[7385]: [20/Jan/2020:12:55:30.169315691 -0600] - INFO - op_thread_cleanup - slapd shutting down - signaling operation threads - op stack size 2 max work q size 2 max work q stack size 2 Jan 20 12:55:30 freeipa01 ns-slapd[7385]: [20/Jan/2020:12:55:30.396008349 -0600] - INFO - slapd_daemon - slapd shutting down - closing down internal subsystems and plugins Jan 20 12:55:30 freeipa01 ns-slapd[7385]: [20/Jan/2020:12:55:30.456826998 -0600] - INFO - dblayer_pre_close - Waiting for 4 database threads to stop Jan 20 12:55:30 freeipa01 server[7889]: SEVERE: Could not contact [localhost:[8005]]. Tomcat may not be running. Jan 20 12:55:30 freeipa01 server[7889]: SEVERE: Catalina.stop: Jan 20 12:55:30 freeipa01 server[7889]: java.net.ConnectException: Connection refused (Connection refused) Jan 20 12:55:30 freeipa01 server[7889]: #011at java.net.PlainSocketImpl.socketConnect(Native Method) Jan 20 12:55:30 freeipa01 server[7889]: #011at java.net.AbstractPlainSocketImpl.doConnect(AbstractPlainSocketImpl.java:350) Jan 20 12:55:30 freeipa01 server[7889]: #011at java.net.AbstractPlainSocketImpl.connectToAddress(AbstractPlainSocketImpl.java:206) Jan 20 12:55:30 freeipa01 server[7889]: #011at java.net.AbstractPlainSocketImpl.connect(AbstractPlainSocketImpl.java:188) Jan 20 12:55:30 freeipa01 server[7889]: #011at java.net.SocksSocketImpl.connect(SocksSocketImpl.java:392) Jan 20 12:55:30 freeipa01 server[7889]: #011at java.net.Socket.connect(Socket.java:607) Jan 20 12:55:30 freeipa01 server[7889]: #011at java.net.Socket.connect(Socket.java:556) Jan 20 12:55:30 freeipa01 server[7889]: #011at java.net.Socket.<init>(Socket.java:452) Jan 20 12:55:30 freeipa01 server[7889]: #011at java.net.Socket.<init>(Socket.java:229) Jan 20 12:55:30 freeipa01 server[7889]: #011at org.apache.catalina.startup.Catalina.stopServer(Catalina.java:498) Jan 20 12:55:30 freeipa01 server[7889]: #011at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) Jan 20 12:55:30 freeipa01 server[7889]: #011at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) Jan 20 12:55:30 freeipa01 server[7889]: #011at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) Jan 20 12:55:30 freeipa01 server[7889]: #011at java.lang.reflect.Method.invoke(Method.java:498) Jan 20 12:55:30 freeipa01 server[7889]: #011at org.apache.catalina.startup.Bootstrap.stopServer(Bootstrap.java:403) Jan 20 12:55:30 freeipa01 server[7889]: #011at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:494) Jan 20 12:55:30 freeipa01 systemd[1]: pki-tomcatd(a)pki-tomcat.service: Control process exited, code=exited status=1 Jan 20 12:55:31 freeipa01 systemd[1]: pki-tomcatd(a)pki-tomcat.service: Failed with result 'exit-code'. Jan 20 12:55:31 freeipa01 systemd[1]: Stopped PKI Tomcat Server pki-tomcat. Jan 20 12:55:31 freeipa01 ns-slapd[7385]: [20/Jan/2020:12:55:31.401012956 -0600] - INFO - dblayer_pre_close - All database threads now stopped Jan 20 12:55:31 freeipa01 ns-slapd[7385]: [20/Jan/2020:12:55:31.477064258 -0600] - INFO - ldbm_back_instance_set_destructor - Set of instances destroyed Jan 20 12:55:31 freeipa01 ns-slapd[7385]: [20/Jan/2020:12:55:31.485527687 -0600] - INFO - connection_post_shutdown_cleanup - slapd shutting down - freed 2 work q stack objects - freed 2 op stack objects Jan 20 12:55:31 freeipa01 ns-slapd[7385]: [20/Jan/2020:12:55:31.491338592 -0600] - INFO - main - slapd stopped.

3 4

Option to allow single-label domains
by Ronald Wimmer 20 Jan '20

20 Jan '20

Is there a possibility to allow ipa-server-install for a single-label domain? I would like to use IPA at home and will definitely never connect it to an AD. Cheers, Ronald

2 2

Re: sudo rule doesn't work
by Florence Blanc-Renaud 20 Jan '20

20 Jan '20

On 1/18/20 11:37 AM, Elhamsadat Azarian wrote: > Hi dear Florence > Thanks of ur reply > I wasnt at office and today i chacked parameteres but i cant find them > in sssd.conf! > How can i check or set values of them? Hi, (adding back freeipa-users mailing list) All the parameters are described in the man page for sssd.conf or sssd-ldap. If they are not set in /etc/sssd/sssd.conf, then the default value applies. flo > > On Mon, 13 Jan 2020, 12:21 Florence Blanc-Renaud, <flo(a)redhat.com > <mailto:flo@redhat.com>> wrote: > > On 1/13/20 9:38 AM, Elhamsadat Azarian wrote: > > I did it but doesnt wotk > > I think my sudo rule doesnt place on my hosts!!! > > > Hi, > > the sudorules can be cached on the host. Please check the following > SSSD > parameters: > - entry_cache_sudo_timeout -- How many seconds should sudo consider > rules valid before asking the backend again > - ldap_sudo_smart_refresh_interval -- How many seconds SSSD has to wait > before executing a smart refresh of sudo rules (which downloads all > rules that have USN higher than the highest USN of cached rules). > - ldap_sudo_full_refresh_interval -- How many seconds SSSD will wait > between executing a full refresh of sudo rules (which downloads all > rules that are stored on the server). > > HTH, > flo > > > On Mon, 13 Jan 2020, 11:57 Florence Blanc-Renaud, <flo(a)redhat.com > <mailto:flo@redhat.com> > > <mailto:flo@redhat.com <mailto:flo@redhat.com>>> wrote: > > > > On 1/13/20 8:57 AM, Elhamsadat Azarian wrote: > > > Hi Florence > > > Thanks i replaced but it doest work! > > > > > Hi, > > can you also replace the "RunAs group categoray: all" attr > with "RunAs > > User category: all"? > > flo > > > > > On Mon, 13 Jan 2020, 11:18 Florence Blanc-Renaud, > <flo(a)redhat.com <mailto:flo@redhat.com> > > <mailto:flo@redhat.com <mailto:flo@redhat.com>> > > > <mailto:flo@redhat.com <mailto:flo@redhat.com> > <mailto:flo@redhat.com <mailto:flo@redhat.com>>>> wrote: > > > > > > On 1/12/20 12:26 PM, Elhamsadat Azarian via > FreeIPA-users wrote: > > > > Hi friends > > > > i define a SudoRule with this properties: > > > > > > > > rulename : rsyslog_rule > > > > Enabled : true > > > > RunAs group Category : All > > > > users :user-test > > > > hosts: ipacli-irvlt01.mydomain.com > <http://ipacli-irvlt01.mydomain.com> > > <http://ipacli-irvlt01.mydomain.com> > > > <http://ipacli-irvlt01.mydomain.com> > > > > sudo Deny Commands : sudo /usr/bin/systemctl > restart rsyslog > > > > > > > > now i login with "user-test" into "ipacli-irvlt01" > server > > and i > > > try to run " sudo /usr/bin/systemctl restart rsyslog" > command. i > > > expected to doesnt allow to run this command but no action > > happend > > > and i could run it!!! > > > > > > > > why my sudo rule doesnt work? > > > Hi, > > > > > > can you try to replace the "sudo deny commands": "sudo > > > /usr/bin/systemctl restart rsyslog" with > "/usr/bin/systemctl > > restart > > > rsyslog" ? > > > > > > thanks, > > > flo > > > > > > > > > > > > ---------------------------------------------------------- > > > > this is less /var/log/sssd/sssd_domain.log: > > > > (Sun Jan 12 13:59:01 2020) [sssd[be[lshs.dc]]] > > [orderly_shutdown] > > > (0x0010): SIGTERM: killing children > > > > > ---------------------------------------------------------- > > > > this is /var/log/sssd/sssd_sudo.log > > > > (Sun Jan 12 13:59:01 2020) [sssd[sudo]] > [orderly_shutdown] > > > (0x0010): SIGTERM: killing children > > > > > > > > > ---------------------------------------------------------- > > > > this is less /var/log/sudo_debug > > > > Jan 12 14:19:27 sudo[17370] /etc/sudoers:53 > CMNDALIAS ALIAS = > > > COMMAND , COMMAND ARG , COMMAND ARG > > > > Jan 12 14:19:27 sudo[17370] -> alias_add @ > ./alias.c:120 > > > > Jan 12 14:19:27 sudo[17370] -> rcstr_addref @ > ./rcstr.c:81 > > > > Jan 12 14:19:27 sudo[17370] <- rcstr_addref @ > ./rcstr.c:88 := > > > 0x55f2968e7714 > > > > Jan 12 14:19:27 sudo[17370] -> rbinsert @ > ./redblack.c:177 > > > > Jan 12 14:19:27 sudo[17370] -> alias_compare @ > ./alias.c:54 > > > > Jan 12 14:19:27 sudo[17370] <- alias_compare @ > > ./alias.c:62 := -13 > > > > Jan 12 14:19:27 sudo[17370] -> alias_compare @ > ./alias.c:54 > > > > Jan 12 14:19:27 sudo[17370] <- alias_compare @ > > ./alias.c:62 := -6 > > > > Jan 12 14:19:27 sudo[17370] -> alias_compare @ > ./alias.c:54 > > > > Jan 12 14:19:27 sudo[17370] <- alias_compare @ > > ./alias.c:62 := -6 > > > > Jan 12 14:19:27 sudo[17370] -> rotate_right @ > ./redblack.c:147 > > > > Jan 12 14:19:27 sudo[17370] <- rotate_right @ > ./redblack.c:163 > > > > Jan 12 14:19:27 sudo[17370] <- rbinsert @ > ./redblack.c:265 > > := 0 > > > > Jan 12 14:19:27 sudo[17370] <- alias_add @ > ./alias.c:143 > > := (null) > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ > > ./lbuf.c:159 > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ > ./lbuf.c:69 > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ > > ./lbuf.c:87 := true > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ > > ./lbuf.c:190 > > > := true > > > > Jan 12 14:19:27 sudo[17370] -> fill_txt @ > ./toke_util.c:52 > > > > Jan 12 14:19:27 sudo[17370] <- fill_txt @ > ./toke_util.c:80 > > := true > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ > > ./lbuf.c:159 > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ > ./lbuf.c:69 > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ > > ./lbuf.c:87 := true > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ > > ./lbuf.c:190 > > > := true > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ > > ./lbuf.c:159 > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ > ./lbuf.c:69 > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ > > ./lbuf.c:87 := true > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ > > ./lbuf.c:190 > > > := true > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ > > ./lbuf.c:159 > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ > ./lbuf.c:69 > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ > > ./lbuf.c:87 := true > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ > > ./lbuf.c:190 > > > := true > > > > Jan 12 14:19:27 sudo[17370] -> fill_cmnd @ > ./toke_util.c:103 > > > > Jan 12 14:19:27 sudo[17370] <- fill_cmnd @ > > ./toke_util.c:124 := true > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ > > ./lbuf.c:159 > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ > ./lbuf.c:69 > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ > > ./lbuf.c:87 := true > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ > > ./lbuf.c:190 > > > := true > > > > Jan 12 14:19:27 sudo[17370] -> fill_args @ > ./toke_util.c:132 > > > > Jan 12 14:19:27 sudo[17370] <- fill_args @ > > ./toke_util.c:162 := true > > > > Jan 12 14:19:27 sudo[17370] -> new_member @ gram.y:956 > > > > Jan 12 14:19:27 sudo[17370] <- new_member @ > gram.y:968 := > > > 0x55f2968ff550 > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ > > ./lbuf.c:159 > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ > ./lbuf.c:69 > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ > > ./lbuf.c:87 := true > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ > > ./lbuf.c:190 > > > := true > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ > > ./lbuf.c:159 > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ > ./lbuf.c:69 > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ > > ./lbuf.c:87 := true > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ > > ./lbuf.c:190 > > > := true > > > > Jan 12 14:19:27 sudo[17370] -> fill_cmnd @ > ./toke_util.c:103 > > > > Jan 12 14:19:27 sudo[17370] <- fill_cmnd @ > > ./toke_util.c:124 := true > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ > > ./lbuf.c:159 > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ > ./lbuf.c:69 > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ > > ./lbuf.c:87 := true > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ > > ./lbuf.c:190 > > > := true > > > > Jan 12 14:19:27 sudo[17370] -> fill_args @ > ./toke_util.c:132 > > > > Jan 12 14:19:27 sudo[17370] <- fill_args @ > > ./toke_util.c:162 := true > > > > Jan 12 14:19:27 sudo[17370] -> new_member @ gram.y:956 > > > > Jan 12 14:19:27 sudo[17370] <- new_member @ > gram.y:968 := > > > 0x55f2968ff650 > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ > > ./lbuf.c:159 > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ > ./lbuf.c:69 > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ > > ./lbuf.c:87 := true > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ > > ./lbuf.c:190 > > > := true > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ > > ./lbuf.c:159 > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ > ./lbuf.c:69 > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ > > ./lbuf.c:87 := true > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ > > ./lbuf.c:190 > > > := true > > > > Jan 12 14:19:27 sudo[17370] -> fill_cmnd @ > ./toke_util.c:103 > > > > Jan 12 14:19:27 sudo[17370] <- fill_cmnd @ > > ./toke_util.c:124 := true > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ > > ./lbuf.c:159 > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ > ./lbuf.c:69 > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ > > ./lbuf.c:87 := true > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ > > ./lbuf.c:190 > > > := true > > > > Jan 12 14:19:27 sudo[17370] -> fill_args @ > ./toke_util.c:132 > > > > Jan 12 14:19:27 sudo[17370] <- fill_args @ > > ./toke_util.c:162 := true > > > > Jan 12 14:19:27 sudo[17370] -> new_member @ gram.y:956 > > > > Jan 12 14:19:27 sudo[17370] <- new_member @ > gram.y:968 := > > > 0x55f2968ff750 > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ > > ./lbuf.c:159 > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ > ./lbuf.c:69 > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ > > ./lbuf.c:87 := true > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ > > ./lbuf.c:190 > > > := true > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ > > ./lbuf.c:159 > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ > ./lbuf.c:69 > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ > > ./lbuf.c:87 := true > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ > > ./lbuf.c:190 > > > := true > > > > Jan 12 14:19:27 sudo[17370] -> fill_cmnd @ > ./toke_util.c:103 > > > > Jan 12 14:19:27 sudo[17370] <- fill_cmnd @ > > ./toke_util.c:124 := true > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ > > ./lbuf.c:159 > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ > ./lbuf.c:69 > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ > > ./lbuf.c:87 := true > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ > > ./lbuf.c:190 > > > := true > > > > Jan 12 14:19:27 sudo[17370] -> fill_args @ > ./toke_util.c:132 > > > > Jan 12 14:19:27 sudo[17370] <- fill_args @ > > ./toke_util.c:162 := true > > > > Jan 12 14:19:27 sudo[17370] -> new_member @ gram.y:956 > > > > Jan 12 14:19:27 sudo[17370] <- new_member @ > gram.y:968 := > > > 0x55f2968ff850 > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ > > ./lbuf.c:159 > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ > ./lbuf.c:69 > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ > > ./lbuf.c:87 := true > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ > > ./lbuf.c:190 > > > := true > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ > > ./lbuf.c:159 > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ > ./lbuf.c:69 > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ > > ./lbuf.c:87 := true > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ > > ./lbuf.c:190 > > > := true > > > > Jan 12 14:19:27 sudo[17370] -> fill_cmnd @ > ./toke_util.c:103 > > > > Jan 12 14:19:27 sudo[17370] <- fill_cmnd @ > > ./toke_util.c:124 := true > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ > > ./lbuf.c:159 > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ > ./lbuf.c:69 > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ > > ./lbuf.c:87 := true > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ > > ./lbuf.c:190 > > > := true > > > > Jan 12 14:19:27 sudo[17370] -> fill_args @ > ./toke_util.c:132 > > > > Jan 12 14:19:27 sudo[17370] <- fill_args @ > > ./toke_util.c:162 := true > > > > Jan 12 14:19:27 sudo[17370] -> new_member @ gram.y:956 > > > > Jan 12 14:19:27 sudo[17370] <- new_member @ > gram.y:968 := > > > 0x55f2968ff950 > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ > > ./lbuf.c:159 > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ > ./lbuf.c:69 > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ > > ./lbuf.c:87 := true > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ > > ./lbuf.c:190 > > > := true > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ > > ./lbuf.c:159 > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ > ./lbuf.c:69 > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ > > ./lbuf.c:87 := true > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ > > ./lbuf.c:190 > > > := true > > > > Jan 12 14:19:27 sudo[17370] -> fill_cmnd @ > ./toke_util.c:103 > > > > Jan 12 14:19:27 sudo[17370] <- fill_cmnd @ > > ./toke_util.c:124 := true > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ > > ./lbuf.c:159 > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ > ./lbuf.c:69 > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ > > ./lbuf.c:87 := true > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ > > ./lbuf.c:190 > > > := true > > > > Jan 12 14:19:27 sudo[17370] -> fill_args @ > ./toke_util.c:132 > > > > Jan 12 14:19:27 sudo[17370] <- fill_args @ > > ./toke_util.c:162 := true > > > > Jan 12 14:19:27 sudo[17370] -> new_member @ gram.y:956 > > > > Jan 12 14:19:27 sudo[17370] <- new_member @ > gram.y:968 := > > > 0x55f2968ffa50 > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ > > ./lbuf.c:159 > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ > ./lbuf.c:69 > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ > > ./lbuf.c:87 := true > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ > > ./lbuf.c:190 > > > := true > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ > > ./lbuf.c:159 > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ > ./lbuf.c:69 > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ > > ./lbuf.c:87 := true > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ > > ./lbuf.c:190 > > > := true > > > > Jan 12 14:19:27 sudo[17370] -> fill_cmnd @ > ./toke_util.c:103 > > > > Jan 12 14:19:27 sudo[17370] <- fill_cmnd @ > > ./toke_util.c:124 := true > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ > > ./lbuf.c:159 > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ > ./lbuf.c:69 > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ > > ./lbuf.c:87 := true > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ > > ./lbuf.c:190 > > > := true > > > > Jan 12 14:19:27 sudo[17370] -> fill_args @ > ./toke_util.c:132 > > > > Jan 12 14:19:27 sudo[17370] <- fill_args @ > > ./toke_util.c:162 := true > > > > Jan 12 14:19:27 sudo[17370] -> new_member @ gram.y:956 > > > > Jan 12 14:19:27 sudo[17370] <- new_member @ > gram.y:968 := > > > 0x55f2968ffb50 > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ > > ./lbuf.c:159 > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ > ./lbuf.c:69 > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ > > ./lbuf.c:87 := true > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ > > ./lbuf.c:190 > > > := true > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ > > ./lbuf.c:159 > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ > ./lbuf.c:69 > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ > > ./lbuf.c:87 := true > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ > > ./lbuf.c:190 > > > := true > > > > Jan 12 14:19:27 sudo[17370] -> fill_cmnd @ > ./toke_util.c:103 > > > > Jan 12 14:19:27 sudo[17370] <- fill_cmnd @ > > ./toke_util.c:124 := true > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ > > ./lbuf.c:159 > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ > ./lbuf.c:69 > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ > > ./lbuf.c:87 := true > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ > > ./lbuf.c:190 > > > := true > > > > Jan 12 14:19:27 sudo[17370] -> fill_args @ > ./toke_util.c:132 > > > > Jan 12 14:19:27 sudo[17370] <- fill_args @ > > ./toke_util.c:162 := true > > > > Jan 12 14:19:27 sudo[17370] -> new_member @ gram.y:956 > > > > Jan 12 14:19:27 sudo[17370] <- new_member @ > gram.y:968 := > > > 0x55f2968ffc50 > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ > > ./lbuf.c:159 > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ > ./lbuf.c:69 > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ > > ./lbuf.c:87 := true > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ > > ./lbuf.c:190 > > > := true > > > > Jan 12 14:19:27 sudo[17370] /etc/sudoers:54 > CMNDALIAS ALIAS = > > > COMMAND ARG , COMMAND ARG , COMMAND ARG , COMMAND ARG , > > COMMAND ARG > > > , COMMAND ARG , COMMAND ARG , COMMAND ARG > > > > Jan 12 14:19:27 sudo[17370] -> alias_add @ > ./alias.c:120 > > > > Jan 12 14:19:27 sudo[17370] -> rcstr_addref @ > ./rcstr.c:81 > > > > Jan 12 14:19:27 sudo[17370] <- rcstr_addref @ > ./rcstr.c:88 := > > > 0x55f2968e7714 > > > > Jan 12 14:19:27 sudo[17370] -> rbinsert @ > ./redblack.c:177 > > > > Jan 12 14:19:27 sudo[17370] -> alias_compare @ > ./alias.c:54 > > > > Jan 12 14:19:27 sudo[17370] <- alias_compare @ > > ./alias.c:62 := 7 > > > > Jan 12 14:19:27 sudo[17370] -> alias_compare @ > ./alias.c:54 > > > > Jan 12 14:19:27 sudo[17370] <- alias_compare @ > > ./alias.c:62 := -3 > > > > Jan 12 14:19:27 sudo[17370] -> alias_compare @ > ./alias.c:54 > > > > Jan 12 14:19:27 sudo[17370] <- alias_compare @ > > ./alias.c:62 := -3 > > > > Jan 12 14:19:27 sudo[17370] <- rbinsert @ > ./redblack.c:265 > > := 0 > > > > Jan 12 14:19:27 sudo[17370] <- alias_add @ > ./alias.c:143 > > := (null) > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ > > ./lbuf.c:159 > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ > ./lbuf.c:69 > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ > > ./lbuf.c:87 := true > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ > > ./lbuf.c:190 > > > := true > > > > Jan 12 14:19:27 sudo[17370] -> fill_txt @ > ./toke_util.c:52 > > > > Jan 12 14:19:27 sudo[17370] <- fill_txt @ > ./toke_util.c:80 > > := true > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ > > ./lbuf.c:159 > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ > ./lbuf.c:69 > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ > > ./lbuf.c:87 := true > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ > > ./lbuf.c:190 > > > := true > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ > > ./lbuf.c:159 > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ > ./lbuf.c:69 > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ > > ./lbuf.c:87 := true > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ > > ./lbuf.c:190 > > > := true > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ > > ./lbuf.c:159 > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ > ./lbuf.c:69 > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ > > ./lbuf.c:87 := true > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ > > ./lbuf.c:190 > > > := true > > > > Jan 12 14:19:27 sudo[17370] -> fill_cmnd @ > ./toke_util.c:103 > > > > Jan 12 14:19:27 sudo[17370] <- fill_cmnd @ > > ./toke_util.c:124 := true > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ > > ./lbuf.c:159 > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ > ./lbuf.c:69 > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ > > ./lbuf.c:87 := true > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ > > ./lbuf.c:190 > > > := true > > > > Jan 12 14:19:27 sudo[17370] -> fill_args @ > ./toke_util.c:132 > > > > Jan 12 14:19:27 sudo[17370] <- fill_args @ > > ./toke_util.c:162 := true > > > > Jan 12 14:19:27 sudo[17370] -> new_member @ gram.y:956 > > > > Jan 12 14:19:27 sudo[17370] <- new_member @ > gram.y:968 := > > > 0x55f2968ffdd0 > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ > > ./lbuf.c:159 > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ > ./lbuf.c:69 > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ > > ./lbuf.c:87 := true > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ > > ./lbuf.c:190 > > > := true > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ > > ./lbuf.c:159 > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ > ./lbuf.c:69 > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ > > ./lbuf.c:87 := true > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ > > ./lbuf.c:190 > > > := true > > > > Jan 12 14:19:27 sudo[17370] -> fill_cmnd @ > ./toke_util.c:103 > > > > Jan 12 14:19:27 sudo[17370] <- fill_cmnd @ > > ./toke_util.c:124 := true > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ > > ./lbuf.c:159 > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ > ./lbuf.c:69 > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ > > ./lbuf.c:87 := true > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ > > ./lbuf.c:190 > > > := true > > > > Jan 12 14:19:27 sudo[17370] -> fill_args @ > ./toke_util.c:132 > > > > Jan 12 14:19:27 sudo[17370] <- fill_args @ > > ./toke_util.c:162 := true > > > > Jan 12 14:19:27 sudo[17370] -> new_member @ gram.y:956 > > > > Jan 12 14:19:27 sudo[17370] <- new_member @ > gram.y:968 := > > > 0x55f2968ffed0 > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ > > ./lbuf.c:159 > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ > ./lbuf.c:69 > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ > > ./lbuf.c:87 := true > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ > > ./lbuf.c:190 > > > := true > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ > > ./lbuf.c:159 > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ > ./lbuf.c:69 > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ > > ./lbuf.c:87 := true > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ > > ./lbuf.c:190 > > > := true > > > > Jan 12 14:19:27 sudo[17370] -> fill_cmnd @ > ./toke_util.c:103 > > > > Jan 12 14:19:27 sudo[17370] <- fill_cmnd @ > > ./toke_util.c:124 := true > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ > > ./lbuf.c:159 > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ > ./lbuf.c:69 > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ > > ./lbuf.c:87 := true > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ > > ./lbuf.c:190 > > > := true > > > > Jan 12 14:19:27 sudo[17370] -> fill_args @ > ./toke_util.c:132 > > > > Jan 12 14:19:27 sudo[17370] <- fill_args @ > > ./toke_util.c:162 := true > > > > Jan 12 14:19:27 sudo[17370] -> new_member @ gram.y:956 > > > > Jan 12 14:19:27 sudo[17370] <- new_member @ > gram.y:968 := > > > 0x55f2968fffd0 > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ > > ./lbuf.c:159 > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ > ./lbuf.c:69 > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ > > ./lbuf.c:87 := true > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ > > ./lbuf.c:190 > > > := true > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ > > ./lbuf.c:159 > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ > ./lbuf.c:69 > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ > > ./lbuf.c:87 := true > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ > > ./lbuf.c:190 > > > := true > > > > Jan 12 14:19:27 sudo[17370] -> fill_cmnd @ > ./toke_util.c:103 > > > > Jan 12 14:19:27 sudo[17370] <- fill_cmnd @ > > ./toke_util.c:124 := true > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ > > ./lbuf.c:159 > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ > ./lbuf.c:69 > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ > > ./lbuf.c:87 := true > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ > > ./lbuf.c:190 > > > := true > > > > Jan 12 14:19:27 sudo[17370] -> fill_args @ > ./toke_util.c:132 > > > > Jan 12 14:19:27 sudo[17370] <- fill_args @ > > ./toke_util.c:162 := true > > > > Jan 12 14:19:27 sudo[17370] -> new_member @ gram.y:956 > > > > Jan 12 14:19:27 sudo[17370] <- new_member @ > gram.y:968 := > > > 0x55f2969000d0 > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ > > ./lbuf.c:159 > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ > ./lbuf.c:69 > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ > > ./lbuf.c:87 := true > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ > > ./lbuf.c:190 > > > := true > > > > Jan 12 14:19:27 sudo[17370] /etc/sudoers:55 > CMNDALIAS ALIAS = > > > COMMAND ARG , COMMAND ARG , COMMAND ARG , COMMAND ARG > > > > Jan 12 14:19:27 sudo[17370] -> alias_add @ > ./alias.c:120 > > > > Jan 12 14:19:27 sudo[17370] -> rcstr_addref @ > ./rcstr.c:81 > > > > Jan 12 14:19:27 sudo[17370] <- rcstr_addref @ > ./rcstr.c:88 := > > > 0x55f2968e7714 > > > > Jan 12 14:19:27 sudo[17370] -> rbinsert @ > ./redblack.c:177 > > > > Jan 12 14:19:27 sudo[17370] -> alias_compare @ > ./alias.c:54 > > > > Jan 12 14:19:27 sudo[17370] <- alias_compare @ > > ./alias.c:62 := -10 > > > > Jan 12 14:19:27 sudo[17370] -> alias_compare @ > ./alias.c:54 > > > > Jan 12 14:19:27 sudo[17370] <- alias_compare @ > > ./alias.c:62 := -4 > > > > _______________________________________________ > > > > FreeIPA-users mailing list -- > > > freeipa-users(a)lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org> > > <mailto:freeipa-users@lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org>> > > > <mailto:freeipa-users@lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org> > > <mailto:freeipa-users@lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org>>> > > > > To unsubscribe send an email to > > > freeipa-users-leave(a)lists.fedorahosted.org > <mailto:freeipa-users-leave@lists.fedorahosted.org> > > <mailto:freeipa-users-leave@lists.fedorahosted.org > <mailto:freeipa-users-leave@lists.fedorahosted.org>> > > > <mailto:freeipa-users-leave@lists.fedorahosted.org > <mailto:freeipa-users-leave@lists.fedorahosted.org> > > <mailto:freeipa-users-leave@lists.fedorahosted.org > <mailto:freeipa-users-leave@lists.fedorahosted.org>>> > > > > Fedora Code of Conduct: > > > https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > > > > List Guidelines: > > > https://fedoraproject.org/wiki/Mailing_list_guidelines > > > > List Archives: > > > > > > https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost… > > > > > > > > > >

1 0

WARNING Could not update DNS SSHFP records.
by Ron Blom 20 Jan '20

20 Jan '20

Hi, We have problems with client’s registering dns records at enrollment. Most of the time all works ok but about 10% of the machines don’t create the A records or the SHHFP records. Sometimes they don’t create both. In the ipaclient-install.log we see the following on machines that doesn’t create the records. In this example the creation of the A records succeeded but the creation of the SSHFP records failed with the following error: 2019-12-20T13:19:51Z INFO Adding SSH public key from /etc/ssh/ssh_host_rsa_key.pub 2019-12-20T13:19:51Z INFO Adding SSH public key from /etc/ssh/ssh_host_ecdsa_key.pub 2019-12-20T13:19:51Z INFO Adding SSH public key from /etc/ssh/ssh_host_ed25519_key.pub 2019-12-20T13:19:51Z INFO [try 1]: Forwarding 'host_mod' to json server 'https://freeipa-002.ipa.cloud/ipa/session/json' 2019-12-20T13:19:51Z DEBUG HTTP connection keep-alive (freeipa-002.ipa.cloud) 2019-12-20T13:19:51Z DEBUG received Set-Cookie (<type 'list'>)'['ipa_session=MagBearerToken=tR1VkWrpjmoNh7aZDYiPzXSwFlkhsp1ENg%2b5y8orMo9P7EkiLQXey11TH9wIgc2xJjJ2xdly2hFyi6v58o2HhzEeQBi%2fcR%2flZ7nwFv8VX3WxCSwS%2beDVSu7%2f%2fjsSB%2b1NzyVHTNe5jkJK9pGXL1nR7QMtNrV2gFY7RyFrJns50dEC%2fi5C%2fEn0BgZAE4aLAiThG4SW3iGc0bfOGy%2bDpAGE17XzB8G978uKpqqHGC9aFDmMmXVFCfpwHoIWoBtJctgy7y6Q97rJnpkjbe2heYMwLQFbDkrTRlrjSDfla0XXCNvd7in6zEu0MZloOXqyXHiu;path=/ipa;httponly;secure;']' 2019-12-20T13:19:51Z DEBUG storing cookie 'ipa_session=MagBearerToken=tR1VkWrpjmoNh7aZDYiPzXSwFlkhsp1ENg%2b5y8orMo9P7EkiLQXey11TH9wIgc2xJjJ2xdly2hFyi6v58o2HhzEeQBi%2fcR%2flZ7nwFv8VX3WxCSwS%2beDVSu7%2f%2fjsSB%2b1NzyVHTNe5jkJK9pGXL1nR7QMtNrV2gFY7RyFrJns50dEC%2fi5C%2fEn0BgZAE4aLAiThG4SW3iGc0bfOGy%2bDpAGE17XzB8G978uKpqqHGC9aFDmMmXVFCfpwHoIWoBtJctgy7y6Q97rJnpkjbe2heYMwLQFbDkrTRlrjSDfla0XXCNvd7in6zEu0MZloOXqyXHiu;' for principal host/adm-sdrn6419-2062.aal.ipa.cloud(a)RINIS.CLOUD 2019-12-20T13:19:51Z DEBUG Writing nsupdate commands to /etc/ipa/.dns_update.txt: 2019-12-20T13:19:51Z DEBUG debug update delete adm-sdrn6419-2062.aal.ipa.cloud. IN SSHFP show send update add adm-sdrn6419-2062.aal.ipa.cloud. 1200 IN SSHFP 1 1 6134C7CDE12FDDFA33A068A273941697928FBCD7 update add adm-sdrn6419-2062.aal.ipa.cloud. 1200 IN SSHFP 1 2 2F41772E6CAD9C328730BFCED0E27350A6C20DE8499E60158635ED8419BF2022 update add adm-sdrn6419-2062.aal.ipa.cloud. 1200 IN SSHFP 3 1 FFE99F20A5C32D857535D13425A7F85F3A63E198 update add adm-sdrn6419-2062.aal.ipa.cloud. 1200 IN SSHFP 3 2 D2C7FC741E834D4E1FE51B7867AFA2D34D0685C769D9019D98093E01C8312118 update add adm-sdrn6419-2062.aal.ipa.cloud. 1200 IN SSHFP 4 1 ED5416B39F419E4F631AB6C9A9CFC0139907232E update add adm-sdrn6419-2062.aal.ipa.cloud. 1200 IN SSHFP 4 2 7794DBAA391B2939476EDD3A0173162F9CD3BBE1E16B52754BB8C6B56DA26435 show send 2019-12-20T13:19:51Z DEBUG Starting external process 2019-12-20T13:19:51Z DEBUG args=/usr/bin/nsupdate -g /etc/ipa/.dns_update.txt 2019-12-20T13:19:51Z DEBUG Process finished, return code=1 2019-12-20T13:19:51Z DEBUG stdout=Outgoing update query: ;; ->>HEADER<<- opcode: UPDATE, status: NOERROR, id: 0 ;; flags:; ZONE: 0, PREREQ: 0, UPDATE: 0, ADDITIONAL: 0 ;; UPDATE SECTION: adm-sdrn6419-2062.aal.ipa.cloud. 0 ANY SSHFP Outgoing update query: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 22636 ;; flags:; QUESTION: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1 ;; QUESTION SECTION: ;3648384014.sig-freeipa-001.ipa.cloud. ANY TKEY ;; ADDITIONAL SECTION: 3648384014.sig-freeipa-001.ipa.cloud. 0 ANY TKEY gss-tsig. 1576847991 1576847991 3 NOERROR 677 YIICoQYJKoZIhvcSAQICAQBuggKQMIICjKADAgEFoQMCAQ6iBwMFACAA AACjggGCYYIBfjCCAXqgAwIBBaENGwtSSU5JUy5DTE9VRKIpMCegAwIB AaEgMB4bA0ROUxsXYWRtLWFhYS0wMDEucmluaXMuY2xvdWSjggE3MIIB M6ADAgESoQMCAQKiggElBIIBIWJzJaNElw4aQs2ZFHDopnUdH6vqowdG ojmiCBIpmgFjPsHEl98zY+UX6OqfF3ovB/uMAuCF1eq3spIRtPjb7hUO +lva9UtuvUJSV0pT9WI1B0ROZxzspkBQmZEYLRUCACxjW3Kw1F123ryy Ga4JJ4cROOFf1GtTdEW3CmIJLlyKqWXDFSQzgnqvP/acb0mQIr0Wid6P DJFaxYmm+uRHw5KBTg7hjeAQPFwgZxNdardv9hUvfhzElxtOK0Kj3ZDy 9lFdpemEtO+osfnwrwyX28xWGLZds/Gfpy0kfdihkUxT082eTWNftaE7 dX0LOb46j9sbMAFDbgHESCkXq5VFRBmtotnf3SRru/eBQFdbYq0/o/oY PCmaTJ4HSymhjbkrVVqkgfAwge2gAwIBEqKB5QSB4tPwDLt7qpKesLJg lGFXpoNqHOsGlFheQslzzkcWzjgoJDDRSJtjoaLgLFv0cITj+rr4dXcu tdMNESwRObXQofsbO9E0HYfZWijSDEIVJlXETm+x8ca4Qf938u3RHV/U +ZXmepZIBnMR4d70Vo+vz6CuXt0+HI0Dh6ot2whzX5g0MWHI0SfJElhO pgWN59uMUC4E8HtLzNEoWljX25acK3mi8ZBgq8iFihfObfEP0Xmx11NE Gru9QOiwMoxRUblws44U3sNOFRUgF9Ua3kKWXEfJ4wpPC3GwdMUajMkr V3wCXBc= 0 2019-12-20T13:19:51Z DEBUG stderr=Reply from SOA query: ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 13244 ;; flags: qr aa rd ra; QUESTION: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0 ;; QUESTION SECTION: ;adm-sdrn6419-2062.aal.ipa.cloud. IN SOA ;; AUTHORITY SECTION: aal.ipa.cloud. 0 IN SOA freeipa-001.ipa.cloud. hostmaster.aal.ipa.cloud. 1576848002 3600 60 1209600 60 Found zone name: aal.ipa.cloud The master is: freeipa-001.ipa.cloud start_gssrequest Found realm from ticket: RINIS.CLOUD send_gssrequest recvmsg reply from GSS-TSIG query ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 22636 ;; flags: qr ra; QUESTION: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0 ;; QUESTION SECTION: ;3648384014.sig-freeipa-001.ipa.cloud. ANY TKEY ;; ANSWER SECTION: 3648384014.sig-freeipa-001.ipa.cloud. 0 ANY TKEY gss-tsig. 0 0 3 BADNAME 0 0 dns_tkey_gssnegotiate: TKEY is unacceptable 2019-12-20T13:19:51Z DEBUG nsupdate failed: Command '/usr/bin/nsupdate -g /etc/ipa/.dns_update.txt' returned non-zero exit status 1 2019-12-20T13:19:51Z WARNING Could not update DNS SSHFP records. When I run the nsupdate command manually after enrollment it will succeed and add the missing records. any ideas?

3 2

Re: FreeIPA ipa-replica-install hangs on "No status yet" during the first replication
by Florence Blanc-Renaud 19 Jan '20

19 Jan '20

On 1/17/20 4:32 PM, Damien Bras via FreeIPA-users wrote: > Hi, > > During the installation of one of our FreeIPA replica (with > ipa-replica-install), the process hangs on "No status yet". > > Our domain is in domain level 1. > > It seems that the script is waiting for an attribute > nsds5ReplicaLastInitStatus. > > The master server is up & running and we want to have a multimaster > environment. > > We don't find any error related to the replication process in the log. > > The version installed: 4.6.5-11.0.1.el7_7.3 > > First, the ipa client is correctly installed on the server. Then we use > the comment ipa-replica-install to promote it as IPA server with: > > ipa-replica-install -U --principal admin --admin-password > $admin_password --domain domain.com --server server2.domain.com > --setup-ca --setup-dns --no-forwarders --forward-policy=first > --no-dnssec-validation --allow-zone-overlap > --reverse-zone=xx.xx.in-addr.arpa --mkhomedir --force-join > > In the ipareplica-install.log we just have this: > > … > > 2020-01-17T10:25:46Z DEBUG [28/41]: setting up initial replication > > 2020-01-17T10:25:46Z DEBUG retrieving schema for SchemaCache > url=ldapi://%2fvar%2frun%2fslapd-DOMAIN-COM.socket > conn=<ldap.ldapobject.SimpleLDAPObject instance at 0x7f2c94db6248> > > 2020-01-17T10:25:47Z DEBUG Destroyed connection > context.ldap2_139829518113296 > > 2020-01-17T10:25:47Z DEBUG Starting external process > > 2020-01-17T10:25:47Z DEBUG args=/bin/systemctl --system daemon-reload > > 2020-01-17T10:25:47Z DEBUG Process finished, return code=0 > > 2020-01-17T10:25:47Z DEBUG stdout= > > 2020-01-17T10:25:47Z DEBUG stderr= > > 2020-01-17T10:25:47Z DEBUG Starting external process > > 2020-01-17T10:25:47Z DEBUG args=/bin/systemctl restart > dirsrv(a)DOMAIN-COM.service > > 2020-01-17T10:25:53Z DEBUG Process finished, return code=0 > > 2020-01-17T10:25:53Z DEBUG stdout= > > 2020-01-17T10:25:53Z DEBUG stderr= > > 2020-01-17T10:25:53Z DEBUG Restart of > dirsrv(a)HS2-VDC-CORP-HOMESEND-COM.service complete > > 2020-01-17T10:25:53Z DEBUG Created connection context.ldap2_139829518113296 > > 2020-01-17T10:25:53Z DEBUG Fetching nsDS5ReplicaId from master [attempt 1/5] > > 2020-01-17T10:25:53Z DEBUG retrieving schema for SchemaCache > url=ldap://server2.domain.com:389 conn=<ldap.ldapobject.SimpleLDAPObject > instance at 0x7f2c95da8320> > > 2020-01-17T10:25:54Z DEBUG Successfully updated nsDS5ReplicaId. > > 2020-01-17T10:25:54Z DEBUG Add or update replica config > cn=replica,cn=dc\=domain\,dc\=com,cn=mapping tree,cn=config > > 2020-01-17T10:25:54Z DEBUG Added replica config > cn=replica,cn=dc\=domain\,dc\=com,cn=mapping tree,cn=config > > 2020-01-17T10:25:54Z DEBUG Add or update replica config > cn=replica,cn=dc\=domain\,dc\=com,cn=mapping tree,cn=config > > 2020-01-17T10:25:54Z DEBUG No update to > cn=replica,cn=dc\=domain\,dc\=com,cn=mapping tree,cn=config necessary > > 2020-01-17T10:25:54Z DEBUG Waiting for replication > (ldapi://%2fvar%2frun%2fslapd-DOMAIN-COM.socket) > cn=meToserver2.domain.com,cn=replica,cn=dc\=domain\,dc\=com,cn=mapping > tree,cn=config (objectclass=*) > > 2020-01-17T10:25:54Z DEBUG Entry found > [LDAPEntry(ipapython.dn.DN('cn=meToserver2.domain.com,cn=replica,cn=dc\=domain\,dc\=com,cn=mapping > tree,cn=config'), {u'nsds5replicaLastInitStart': ['19700101000000Z'], > u'nsds5replicaUpdateInProgress': ['FALSE'], u'cn': > ['meToserver2.domain.com'], u'objectClass': > ['nsds5replicationagreement', 'top'], u'nsds5replicaLastUpdateEnd': > ['19700101000000Z'], u'nsDS5ReplicaRoot': ['dc=domain,dc=com'], > u'nsDS5ReplicaHost': ['server2.domain.com'], > u'nsds5replicaLastUpdateStatus': ['Error (0) No replication sessions > started since server startup'], u'nsDS5ReplicaBindMethod': > ['SASL/GSSAPI'], u'nsds5ReplicaStripAttrs': ['modifiersName > modifyTimestamp internalModifiersName internalModifyTimestamp'], > u'nsds5replicaLastUpdateStart': ['19700101000000Z'], > u'nsDS5ReplicaPort': ['389'], u'nsDS5ReplicaTransportInfo': ['LDAP'], > u'description': ['me to server2.domain.com'], u'nsds5replicareapactive': > ['0'], u'nsds5replicaChangesSentSinceStartup': [''], > u'nsds5replicaTimeout': ['120'], u'nsDS5ReplicatedAttributeList': > ['(objectclass=*) $ EXCLUDE memberof idnssoaserial entryusn > krblastsuccessfulauth krblastfailedauth krbloginfailedcount'], > u'nsds5replicaLastInitEnd': ['19700101000000Z'], > u'nsDS5ReplicatedAttributeListTotal': ['(objectclass=*) $ EXCLUDE > entryusn krblastsuccessfulauth krblastfailedauth krbloginfailedcount']})] > Hi, can you also paste the lines that contain the install error? > On the live master, there is a strange behavior also: > > It seems the ldap is like in read only mode. For exemple, if I reset the > password of an account, I don’t have any error but nothing happened. > > I have also those errors on this server: > > Jan 17 16:27:57 hs2-man-idm-02 ns-slapd: [17/Jan/2020:16:27:57.102642397 > +0100] - ERR - csngen_adjust_time - Adjustment limit exceeded; value - > 2711289715, limit - 86400 Are your servers synchronized (either with ntpd or chronyd)? Maybe the time is different and prevents correct replication. flo > > Jan 17 16:27:57 hs2-man-idm-02 ns-slapd: [17/Jan/2020:16:27:57.110464100 > +0100] - WARN - NSMMReplicationPlugin - replica_generate_next_csn - > opcsn=5e21d27e000000050000 <= basecsn=ffbcd1f1522600040000, adjusted > opcsn=5e21d27e522700050000 > > But we don’t have any replication because no other servers: > > # ipa-replica-manage list > > server2.domain.com: master > > # ipa-replica-manage list-ruv > > Directory Manager password: > > Replica Update Vectors: > > server2.domain.com:389: 5 > > Certificate Server Replica Update Vectors: > > server2.domain.com:389: 6 > > # ipa topologysuffix-find > > --------------------------- > > 2 topology suffixes matched > > --------------------------- > > Suffix name: ca > > Managed LDAP suffix DN: o=ipaca > > Suffix name: domain > > Managed LDAP suffix DN: dc=domain,dc=com > > ---------------------------- > > Number of entries returned 2 > > ---------------------------- > > # ipa topologysegment-find > > Suffix name: domain > > ------------------ > > 0 segments matched > > ------------------ > > ---------------------------- > > Number of entries returned 0 > > ---------------------------- > > I really don’t know what happened here. Could you help us on that ? > > Best regards, > > Damien > > > _______________________________________________ > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org > To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org > Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost… >

2 1

kinit: Pre-authentication failed: Invalid argument while getting initial credentials
by John Louis 19 Jan '20

19 Jan '20

Hi, on CentOS 7 I installed Freeipa using "yum install ipa-server". Everything including client is on the same machine itself. All went well, I can now login to the web as "admin" and create user account etc. And "kinit admin", "kinit list" etc all worked as expected right after installation. But a couple days later, even though I can still login as "admin" web user, on the server ssh session I get the following (I replaced REALM name with "REALM" here): # kinit kinit: Client 'root@REALM' not found in Kerberos database while getting initial credentials # kinit admin kinit: Pre-authentication failed: Invalid argument while getting initial credentials # kinit list kinit: Client 'list@REALM' not found in Kerberos database while getting initial credentials # env KRB5_TRACE=/dev/stdout kinit admin 2>&1 [11612] 1578511115.54729: Getting initial credentials for admin@REALM [11612] 1578511115.54731: Sending unauthenticated request [11612] 1578511115.54732: Sending request (167 bytes) to REALM [11612] 1578511115.54733: Initiating TCP connection to stream 127.0.0.1:88 [11612] 1578511115.54734: Sending TCP request to stream 127.0.0.1:88 [11612] 1578511115.54735: Received answer (240 bytes) from stream 127.0.0.1:88 [11612] 1578511115.54736: Terminating TCP connection to stream 127.0.0.1:88 [11612] 1578511115.54737: Response was from master KDC [11612] 1578511115.54738: Received error from KDC: -1765328359/Additional pre-authentication required [11612] 1578511115.54741: Preauthenticating using KDC method data [11612] 1578511115.54742: Processing preauth types: PA-PK-AS-REQ (16), PA-PK-AS-REP_OLD (15), PA-PK-AS-REQ_OLD (14), PA-FX-FAST (136), PA-PKINIT-KX (147), PA-FX-COOKIE (133) [11612] 1578511115.54743: Received cookie: MIT [11612] 1578511115.54744: PKINIT client has no configured identity; giving up [11612] 1578511115.54745: Preauth module pkinit (147) (info) returned: 0/Success [11612] 1578511115.54746: PKINIT client has no configured identity; giving up [11612] 1578511115.54747: Preauth module pkinit (16) (real) returned: 22/Invalid argument [11612] 1578511115.54748: PKINIT client has no configured identity; giving up [11612] 1578511115.54749: Preauth module pkinit (14) (real) returned: 22/Invalid argument kinit: Pre-authentication failed: Invalid argument while getting initial credentials # klist -ek Keytab name: FILE:/etc/krb5.keytab KVNO Principal ---- -------------------------------------------------------------------------- 2 host/ipa.host.name@REALM (aes256-cts-hmac-sha1-96) 2 host/ipa.host.name@REALM (aes128-cts-hmac-sha1-96) 2 host/ipa.host.name@REALM (des3-cbc-sha1) 2 host/ipa.host.name@REALM (arcfour-hmac) 2 host/ipa.host.name@REALM (camellia128-cts-cmac) 2 host/ipa.host.name@REALM (camellia256-cts-cmac) So looks like I lost "admin" in kerboros? The only thing I think I did, is I have changed the server's time and hwclock time, by 9 minutes. Thanks!

4 16

Kerberized NFS Home directories
by Kristian Petersen 17 Jan '20

17 Jan '20

Hey all, I am trying to get kerberized NFS home directories working in Ubuntu 18.04 with the mapping info coming from IPA. I can get them to mount on login in a multi-user target (terminal only), but not a graphical one (using gdm for login). The messages I am seeing in the syslog seem to indicate that it is having issues communicating with the server hosting the NFS share and times out. That doesn't make sense though since it works to mount in the terminal like I would expect. -- Kristian Petersen System Administrator BYU Dept. of Chemistry and Biochemistry

3 4

Proxy LDAP queries to Active Directory
by White, David 17 Jan '20

17 Jan '20

Is there a way to proxy client LDAP requests to the upstream Active Directory that FreeIPA is configured to trust? I have AD, where users live. I have FreeIPA / RedHat IdM. And I have servers that are registered to FreeIPA. But I also have applications (such as Mediawiki, or Red Hat Satellite to name a few) that support LDAP authentication. I want to be able to use my AD credentials to login to Mediawiki or Satellite, but have the application bind to FreeIPA, instead of binding it to AD. Is this possible? I currently: Have successfully bound Mediawiki to FreeIPA, and I can login to Mediawiki using an account that is built locally instead of FreeIPA, but I cannot login to Mediawiki using my AD credentials. ----- David White Engineer II, Fiber Systems Engineering (423) 648-1500, Option 2 [/var/folders/7m/l5bzdbz14c9bkrwxvn2ffnjc0000gq/T/com.microsoft.Outlook/WebArchiveCopyPasteTempFiles/cidimage001.jpg(a)01D4B3F3.F5D81170]

2 4

FreeIPA ipa-replica-install hangs on "No status yet" during the first replication
by Damien Bras 17 Jan '20

17 Jan '20

Hi, During the installation of one of our FreeIPA replica (with ipa-replica-install), the process hangs on "No status yet". Our domain is in domain level 1. It seems that the script is waiting for an attribute nsds5ReplicaLastInitStatus. The master server is up & running and we want to have a multimaster environment. We don't find any error related to the replication process in the log. The version installed: 4.6.5-11.0.1.el7_7.3 First, the ipa client is correctly installed on the server. Then we use the comment ipa-replica-install to promote it as IPA server with: ipa-replica-install -U --principal admin --admin-password $admin_password --domain domain.com --server server2.domain.com --setup-ca --setup-dns --no-forwarders --forward-policy=first --no-dnssec-validation --allow-zone-overlap --reverse-zone=xx.xx.in-addr.arpa --mkhomedir --force-join In the ipareplica-install.log we just have this: … 2020-01-17T10:25:46Z DEBUG [28/41]: setting up initial replication 2020-01-17T10:25:46Z DEBUG retrieving schema for SchemaCache url=ldapi://%2fvar%2frun%2fslapd-DOMAIN-COM.socket conn=<ldap.ldapobject.SimpleLDAPObject instance at 0x7f2c94db6248> 2020-01-17T10:25:47Z DEBUG Destroyed connection context.ldap2_139829518113296 2020-01-17T10:25:47Z DEBUG Starting external process 2020-01-17T10:25:47Z DEBUG args=/bin/systemctl --system daemon-reload 2020-01-17T10:25:47Z DEBUG Process finished, return code=0 2020-01-17T10:25:47Z DEBUG stdout= 2020-01-17T10:25:47Z DEBUG stderr= 2020-01-17T10:25:47Z DEBUG Starting external process 2020-01-17T10:25:47Z DEBUG args=/bin/systemctl restart dirsrv(a)DOMAIN-COM.service 2020-01-17T10:25:53Z DEBUG Process finished, return code=0 2020-01-17T10:25:53Z DEBUG stdout= 2020-01-17T10:25:53Z DEBUG stderr= 2020-01-17T10:25:53Z DEBUG Restart of dirsrv(a)HS2-VDC-CORP-HOMESEND-COM.service complete 2020-01-17T10:25:53Z DEBUG Created connection context.ldap2_139829518113296 2020-01-17T10:25:53Z DEBUG Fetching nsDS5ReplicaId from master [attempt 1/5] 2020-01-17T10:25:53Z DEBUG retrieving schema for SchemaCache url=ldap://server2.domain.com:389 conn=<ldap.ldapobject.SimpleLDAPObject instance at 0x7f2c95da8320> 2020-01-17T10:25:54Z DEBUG Successfully updated nsDS5ReplicaId. 2020-01-17T10:25:54Z DEBUG Add or update replica config cn=replica,cn=dc\=domain\,dc\=com,cn=mapping tree,cn=config 2020-01-17T10:25:54Z DEBUG Added replica config cn=replica,cn=dc\=domain\,dc\=com,cn=mapping tree,cn=config 2020-01-17T10:25:54Z DEBUG Add or update replica config cn=replica,cn=dc\=domain\,dc\=com,cn=mapping tree,cn=config 2020-01-17T10:25:54Z DEBUG No update to cn=replica,cn=dc\=domain\,dc\=com,cn=mapping tree,cn=config necessary 2020-01-17T10:25:54Z DEBUG Waiting for replication (ldapi://%2fvar%2frun%2fslapd-DOMAIN-COM.socket) cn=meToserver2.domain.com,cn=replica,cn=dc\=domain\,dc\=com,cn=mapping tree,cn=config (objectclass=*) 2020-01-17T10:25:54Z DEBUG Entry found [LDAPEntry(ipapython.dn.DN('cn=meToserver2.domain.com,cn=replica,cn=dc\=domain\,dc\=com,cn=mapping tree,cn=config'), {u'nsds5replicaLastInitStart': ['19700101000000Z'], u'nsds5replicaUpdateInProgress': ['FALSE'], u'cn': ['meToserver2.domain.com'], u'objectClass': ['nsds5replicationagreement', 'top'], u'nsds5replicaLastUpdateEnd': ['19700101000000Z'], u'nsDS5ReplicaRoot': ['dc=domain,dc=com'], u'nsDS5ReplicaHost': ['server2.domain.com'], u'nsds5replicaLastUpdateStatus': ['Error (0) No replication sessions started since server startup'], u'nsDS5ReplicaBindMethod': ['SASL/GSSAPI'], u'nsds5ReplicaStripAttrs': ['modifiersName modifyTimestamp internalModifiersName internalModifyTimestamp'], u'nsds5replicaLastUpdateStart': ['19700101000000Z'], u'nsDS5ReplicaPort': ['389'], u'nsDS5ReplicaTransportInfo': ['LDAP'], u'description': ['me to server2.domain.com'], u'nsds5replicareapactive': ['0'], u'nsds5replicaChangesSentSinceStartup': [''], u'nsds5replicaTimeout': ['120'], u'nsDS5ReplicatedAttributeList': ['(objectclass=*) $ EXCLUDE memberof idnssoaserial entryusn krblastsuccessfulauth krblastfailedauth krbloginfailedcount'], u'nsds5replicaLastInitEnd': ['19700101000000Z'], u'nsDS5ReplicatedAttributeListTotal': ['(objectclass=*) $ EXCLUDE entryusn krblastsuccessfulauth krblastfailedauth krbloginfailedcount']})] On the live master, there is a strange behavior also: It seems the ldap is like in read only mode. For exemple, if I reset the password of an account, I don’t have any error but nothing happened. I have also those errors on this server: Jan 17 16:27:57 hs2-man-idm-02 ns-slapd: [17/Jan/2020:16:27:57.102642397 +0100] - ERR - csngen_adjust_time - Adjustment limit exceeded; value - 2711289715, limit - 86400 Jan 17 16:27:57 hs2-man-idm-02 ns-slapd: [17/Jan/2020:16:27:57.110464100 +0100] - WARN - NSMMReplicationPlugin - replica_generate_next_csn - opcsn=5e21d27e000000050000 <= basecsn=ffbcd1f1522600040000, adjusted opcsn=5e21d27e522700050000 But we don’t have any replication because no other servers: # ipa-replica-manage list server2.domain.com: master # ipa-replica-manage list-ruv Directory Manager password: Replica Update Vectors: server2.domain.com:389: 5 Certificate Server Replica Update Vectors: server2.domain.com:389: 6 # ipa topologysuffix-find --------------------------- 2 topology suffixes matched --------------------------- Suffix name: ca Managed LDAP suffix DN: o=ipaca Suffix name: domain Managed LDAP suffix DN: dc=domain,dc=com ---------------------------- Number of entries returned 2 ---------------------------- # ipa topologysegment-find Suffix name: domain ------------------ 0 segments matched ------------------ ---------------------------- Number of entries returned 0 ---------------------------- I really don’t know what happened here. Could you help us on that ? Best regards, Damien

1 0

Approval workflow
by Daniel PC 17 Jan '20

17 Jan '20

Hi all, Does anyone know if it is possible to implement an approval workflow to enable a user to access a host? My idea is, for a limited number of users, allow access only after receiving OK from a responsible. Thank you DPC

2 3

Certificate not found: auditSigningCert cert-pki-ca - Can't run pki-tomcatd Service
by Ferdinand Babas 17 Jan '20

17 Jan '20

Hi All, I've been trying to work through this issue but can't find the magic formula to get it working so I'm turning to the community for help. We are currently running VERSION: 4.4.0, API_VERSION: 2.213 in a 4 node multi master environment and the steps listed below were performed on the IPA CA renewal master. Please let me know if any additional information is needed regarding the environment. As background we had expired certificates (both /etc/httpd/alias and /etc/pki/pki-tomcat/alias) which were renewed by setting the date in the past and restarting certmonger. Now on the IPA CA renewal master all certs have valid 'expires' dates and have a status of MONITORING. Note that the other nodes still have expired certs. On the IPA CA renewal master when I start up the pki-tomcatd(a)pki-tomcat.service with the default CS.cfg and password.conf file I get the following error: Internal Database Error encountered: Could not connect to LDAP server host francolin.local port 636 Error netscape.ldap.LDAPException: Authentication failed (48) So I changed the CS.cfg file to use Basic Auth and added the directory-manager-password to password.conf, restarted pki-tomcatd(a)pki-tomcat.service and now I get the following: /var/log/messages Jan 6 10:54:30 francolin systemd: Started PKI Tomcat Server pki-tomcat. Jan 6 10:54:30 francolin server: Java virtual machine used: /usr/lib/jvm/jre-1.8.0-openjdk/bin/java Jan 6 10:54:30 francolin server: classpath used: /usr/share/tomcat/bin/bootstrap.jar:/usr/share/tomcat/bin/tomcat-juli.jar:/usr/share/java/commons-daemon.jar Jan 6 10:54:30 francolin server: main class used: org.apache.catalina.startup.Bootstrap Jan 6 10:54:30 francolin server: flags used: -DRESTEASY_LIB=/usr/share/java/resteasy-base -Djava.library.path=/usr/lib64/nuxwdog-jni Jan 6 10:54:30 francolin server: options used: -Dcatalina.base=/var/lib/pki/pki-tomcat -Dcatalina.home=/usr/share/tomcat -Djava.endorsed.dirs= -Djava.io.tmpdir=/var/lib/pki/pki-tomcat/temp -Djava.util.logging.config.file=/var/lib/pki/pki-tomcat/conf/logging.properties -Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager -Djava.security.manager -Djava.security.policy==/var/lib/pki/pki-tomcat/conf/catalina.policy Jan 6 10:54:30 francolin server: arguments used: start Jan 6 10:54:30 francolin server: WARNING: Problem with JAR file [/usr/share/pki/server/common/lib/symkey.jar], exists: [false], canRead: [false] Jan 6 10:54:31 francolin server: WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'enableOCSP' to 'false' did not find a matching property. Jan 6 10:54:31 francolin server: WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'ocspResponderURL' to 'http://francolin.local:9080/ca/ocsp' did not find a matching property. Jan 6 10:54:31 francolin server: WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'ocspResponderCertNickname' to 'ocspSigningCert cert-pki-ca' did not find a matching property. Jan 6 10:54:31 francolin server: WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'ocspCacheSize' to '1000' did not find a matching property. Jan 6 10:54:31 francolin server: WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'ocspMinCacheEntryDuration' to '60' did not find a matching property. Jan 6 10:54:31 francolin server: WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'ocspMaxCacheEntryDuration' to '120' did not find a matching property. Jan 6 10:54:31 francolin server: WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'ocspTimeout' to '10' did not find a matching property. Jan 6 10:54:31 francolin server: WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'strictCiphers' to 'true' did not find a matching property. Jan 6 10:54:31 francolin server: WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'sslOptions' to 'ssl2=false,ssl3=false,tls=true' did not find a matching property. Jan 6 10:54:31 francolin server: WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'ssl2Ciphers' to '-SSL2_RC4_128_WITH_MD5,-SSL2_RC4_128_EXPORT40_WITH_MD5,-SSL2_RC2_128_CBC_WITH_MD5,-SSL2_RC2_128_CBC_EXPORT40_WITH_MD5,-SSL2_DES_64_CBC_WITH_MD5,-SSL2_DES_192_EDE3_CBC_WITH_MD5' did not find a matching property. Jan 6 10:54:31 francolin server: WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'ssl3Ciphers' to '-SSL3_FORTEZZA_DMS_WITH_NULL_SHA,-SSL3_FORTEZZA_DMS_WITH_RC4_128_SHA,+SSL3_RSA_WITH_RC4_128_SHA,-SSL3_RSA_EXPORT_WITH_RC4_40_MD5,+SSL3_RSA_WITH_3DES_EDE_CBC_SHA,-SSL3_RSA_WITH_DES_CBC_SHA,-SSL3_RSA_EXPORT_WITH_RC2_CBC_40_MD5,-SSL3_FORTEZZA_DMS_WITH_FORTEZZA_CBC_SHA,-SSL_RSA_FIPS_WITH_DES_CBC_SHA,+SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA,-SSL3_RSA_WITH_NULL_MD5,-TLS_RSA_EXPORT1024_WITH_RC4_56_SHA,-TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA,+TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA' did not find a matching property. Jan 6 10:54:31 francolin server: WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'tlsCiphers' to '-TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA,-TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA,+TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA,+TLS_ECDH_RSA_WITH_AES_128_CBC_SHA,+TLS_ECDH_RSA_WITH_AES_256_CBC_SHA,-TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA,+TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,+TLS_RSA_WITH_3DES_EDE_CBC_SHA,+TLS_RSA_WITH_AES_128_CBC_SHA,+TLS_RSA_WITH_AES_256_CBC_SHA,+TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA,+TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,-TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,-TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,-TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,+TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA,+TLS_DHE_DSS_WITH_AES_128_CBC_SHA,+TLS_DHE_DSS_WITH_AES_256_CBC_SHA,+TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA,+TLS_DHE_RSA_WITH_AES_128_CBC_SHA,+TLS_DHE_RSA_WITH_AES_256_CBC_SHA' did not find a matching property. Jan 6 10:54:31 francolin server: WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'sslVersionRangeStream' to 'tls1_0:tls1_2' did not find a matching property. Jan 6 10:54:31 francolin server: WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'sslVersionRangeDatagram' to 'tls1_1:tls1_2' did not find a matching property. Jan 6 10:54:31 francolin server: WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'sslRangeCiphers' to '-TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA,-TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA,-TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA,-TLS_ECDH_RSA_WITH_AES_128_CBC_SHA,-TLS_ECDH_RSA_WITH_AES_256_CBC_SHA,-TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA,-TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,-TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA,-TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,-TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,-TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,-TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,-TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA,-TLS_DHE_DSS_WITH_AES_128_CBC_SHA,-TLS_DHE_DSS_WITH_AES_256_CBC_SHA,-TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA,-TLS_DHE_RSA_WITH_AES_128_CBC_SHA,-TLS_DHE_RSA_WITH_AES_256_CBC_SHA,-TLS_DHE_RSA_WITH_AES_128_CBC_SHA256,-TLS_DHE_RSA_WITH_AES_256_CBC_SHA256,-TLS_DHE_RSA_WITH_AES_128_GCM_SHA256,-TLS_DHE_DSS_WITH_AES_128_GCM_SHA256,-TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,-TLS_ECDHE_RSA_WITH_AES_128_CB C_SHA256,-TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,-TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,-TLS_RSA_WITH_AES_128_CBC_SHA256,-TLS_RSA_WITH_AES_256_CBC_SHA256,-TLS_RSA_WITH_AES_128_GCM_SHA256,+TLS_RSA_WITH_3DES_EDE_CBC_SHA,+TLS_RSA_WITH_AES_128_CBC_SHA,+TLS_RSA_WITH_AES_256_CBC_SHA' did not find a matching property. Jan 6 10:54:31 francolin server: WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'serverCertNickFile' to '/var/lib/pki/pki-tomcat/conf/serverCertNick.conf' did not find a matching property. Jan 6 10:54:31 francolin server: WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'passwordFile' to '/var/lib/pki/pki-tomcat/conf/password.conf' did not find a matching property. Jan 6 10:54:31 francolin server: WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'passwordClass' to 'org.apache.tomcat.util.net.jss.PlainPasswordFile' did not find a matching property. Jan 6 10:54:31 francolin server: WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'certdbDir' to '/var/lib/pki/pki-tomcat/alias' did not find a matching property. Jan 6 10:54:31 francolin server: WARNING: [SetPropertiesRule]{Server/Service/Engine/Host} Setting property 'xmlValidation' to 'false' did not find a matching property. Jan 6 10:54:31 francolin server: WARNING: [SetPropertiesRule]{Server/Service/Engine/Host} Setting property 'xmlNamespaceAware' to 'false' did not find a matching property. Jan 6 10:54:31 francolin server: PKIListener: org.apache.catalina.core.StandardServer[before_init] Jan 6 10:54:31 francolin server: PKIListener: org.apache.catalina.core.StandardServer[after_init] Jan 6 10:54:31 francolin server: PKIListener: org.apache.catalina.core.StandardServer[before_start] Jan 6 10:54:31 francolin server: PKIListener: org.apache.catalina.core.StandardServer[configure_start] Jan 6 10:54:31 francolin server: PKIListener: org.apache.catalina.core.StandardServer[start] Jan 6 10:54:31 francolin server: SSLAuthenticatorWithFallback: Creating SSL authenticator with fallback Jan 6 10:54:31 francolin server: SSLAuthenticatorWithFallback: Setting container Jan 6 10:54:32 francolin server: SSLAuthenticatorWithFallback: Initializing authenticators Jan 6 10:54:32 francolin server: SSLAuthenticatorWithFallback: Starting authenticators Jan 6 10:54:33 francolin server: CMSEngine.initializePasswordStore() begins Jan 6 10:54:33 francolin server: CMSEngine.initializePasswordStore(): tag=internaldb Jan 6 10:54:33 francolin server: testLDAPConnection connecting to francolin.local:389 Jan 6 10:54:33 francolin server: CMSEngine.initializePasswordStore(): tag=replicationdb Jan 6 10:54:33 francolin server: testLDAPConnection connecting to francolin.local:389 Jan 6 10:54:33 francolin server: testLDAPConnection: The specified user cn=Replication Manager masterAgreement1-francolin.local-pki-tomcat,cn=config does not exist Jan 6 10:54:33 francolin server: CMSEngine: init(): password test execution failed for replicationdbwith NO_SUCH_USER. This may not be a latest instance. Ignoring .. Jan 6 10:54:34 francolin server: SelfTestSubsystem: Disabling "ca" subsystem due to selftest failure. Jan 6 10:54:34 francolin server: ----------------------- Jan 6 10:54:34 francolin server: Disabled "ca" subsystem Jan 6 10:54:34 francolin server: ----------------------- Jan 6 10:54:34 francolin server: Subsystem ID: ca Jan 6 10:54:34 francolin server: Instance ID: pki-tomcat Jan 6 10:54:34 francolin server: Enabled: False Jan 6 10:54:34 francolin server: Invalid class name repositorytop Jan 6 10:54:35 francolin server: Invalid class name repositorytop Jan 6 10:54:35 francolin server: at com.netscape.cmscore.dbs.DBRegistry.createObject(DBRegistry.java:485) Jan 6 10:54:35 francolin server: at com.netscape.cmscore.dbs.DBSSession.read(DBSSession.java:167) Jan 6 10:54:35 francolin server: at com.netscape.cmscore.dbs.DBSSession.read(DBSSession.java:137) Jan 6 10:54:35 francolin server: at com.netscape.cmscore.dbs.Repository.getSerialNumber(Repository.java:125) Jan 6 10:54:35 francolin server: at com.netscape.cmscore.dbs.Repository.initCache(Repository.java:244) Jan 6 10:54:35 francolin server: at com.netscape.cmscore.dbs.Repository.checkRanges(Repository.java:460) Jan 6 10:54:35 francolin server: at com.netscape.cmscore.apps.CMSEngine.startup(CMSEngine.java:1374) Jan 6 10:54:35 francolin server: at com.netscape.certsrv.apps.CMS.startup(CMS.java:201) Jan 6 10:54:35 francolin server: at com.netscape.certsrv.apps.CMS.start(CMS.java:1622) Jan 6 10:54:35 francolin server: at com.netscape.cms.servlet.base.CMSStartServlet.init(CMSStartServlet.java:114) Jan 6 10:54:35 francolin server: at javax.servlet.GenericServlet.init(GenericServlet.java:158) Jan 6 10:54:35 francolin server: at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) Jan 6 10:54:35 francolin server: at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) Jan 6 10:54:35 francolin server: at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) Jan 6 10:54:35 francolin server: at java.lang.reflect.Method.invoke(Method.java:498) Jan 6 10:54:35 francolin server: at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:288) Jan 6 10:54:35 francolin server: at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:285) Jan 6 10:54:35 francolin server: at java.security.AccessController.doPrivileged(Native Method) Jan 6 10:54:35 francolin server: at javax.security.auth.Subject.doAsPrivileged(Subject.java:549) Jan 6 10:54:35 francolin server: at org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:320) Jan 6 10:54:35 francolin server: at org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:175) Jan 6 10:54:35 francolin server: at org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:124) Jan 6 10:54:35 francolin server: at org.apache.catalina.core.StandardWrapper.initServlet(StandardWrapper.java:1270) Jan 6 10:54:35 francolin server: at org.apache.catalina.core.StandardWrapper.loadServlet(StandardWrapper.java:1195) Jan 6 10:54:35 francolin server: at org.apache.catalina.core.StandardWrapper.load(StandardWrapper.java:1085) Jan 6 10:54:35 francolin server: at org.apache.catalina.core.StandardContext.loadOnStartup(StandardContext.java:5318) Jan 6 10:54:35 francolin server: at org.apache.catalina.core.StandardContext.startInternal(StandardContext.java:5610) Jan 6 10:54:35 francolin server: at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:147) Jan 6 10:54:35 francolin server: at org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.java:899) Jan 6 10:54:35 francolin server: at org.apache.catalina.core.ContainerBase.access$000(ContainerBase.java:133) Jan 6 10:54:35 francolin server: at org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(ContainerBase.java:156) Jan 6 10:54:35 francolin server: at org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(ContainerBase.java:145) Jan 6 10:54:35 francolin server: at java.security.AccessController.doPrivileged(Native Method) Jan 6 10:54:35 francolin server: at org.apache.catalina.core.ContainerBase.addChild(ContainerBase.java:873) Jan 6 10:54:35 francolin server: at org.apache.catalina.core.StandardHost.addChild(StandardHost.java:652) Jan 6 10:54:35 francolin server: at org.apache.catalina.startup.HostConfig.deployDescriptor(HostConfig.java:679) Jan 6 10:54:35 francolin server: at org.apache.catalina.startup.HostConfig$DeployDescriptor.run(HostConfig.java:1966) Jan 6 10:54:35 francolin server: at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511) Jan 6 10:54:35 francolin server: at java.util.concurrent.FutureTask.run(FutureTask.java:266) Jan 6 10:54:35 francolin server: at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) Jan 6 10:54:35 francolin server: at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) Jan 6 10:54:35 francolin server: at java.lang.Thread.run(Thread.java:748) Jan 6 10:54:36 francolin server: PKIListener: org.apache.catalina.core.StandardServer[after_start] Jan 6 10:54:36 francolin server: PKIListener: Subsystem CA is disabled. Jan 6 10:54:36 francolin server: PKIListener: Check /var/log/pki/pki-tomcat/ca/selftests.log for possible errors. Jan 6 10:54:36 francolin server: PKIListener: To enable the subsystem: Jan 6 10:54:36 francolin server: PKIListener: pki-server subsystem-enable -i pki-tomcat ca Jan 6 10:54:47 francolin server: SSLAuthenticatorWithFallback: Stopping authenticators Jan 6 10:54:47 francolin server: SEVERE: The web application [/ca] appears to have started a thread named [LDAPConnThread-3 ldaps://francolin.local:389] but has failed to stop it. This is very likely to create a memory leak. Jan 6 10:54:47 francolin server: SEVERE: The web application [/ca] appears to have started a thread named [LDAPConnThread-7 ldaps://francolin.local:389] but has failed to stop it. This is very likely to create a memory leak. Jan 6 10:54:47 francolin server: SEVERE: The web application [/ca] appears to have started a thread named [authorityMonitor] but has failed to stop it. This is very likely to create a memory leak. Jan 6 10:54:47 francolin server: SEVERE: The web application [/ca] appears to have started a thread named [LDAPConnThread-9 ldaps://francolin.local:389] but has failed to stop it. This is very likely to create a memory leak. Jan 6 10:54:47 francolin server: SEVERE: The web application [/ca] appears to have started a thread named [profileChangeMonitor] but has failed to stop it. This is very likely to create a memory leak. Jan 6 10:54:47 francolin server: SSLAuthenticatorWithFallback: Setting container /var/log/pki/pki-tomcat/ca/selftests.log 0.localhost-startStop-2 - [06/Jan/2020:10:56:29 HST] [20] [1] SelfTestSubsystem: Initializing self test plugins: 0.localhost-startStop-2 - [06/Jan/2020:10:56:29 HST] [20] [1] SelfTestSubsystem: loading all self test plugin logger parameters 0.localhost-startStop-2 - [06/Jan/2020:10:56:29 HST] [20] [1] SelfTestSubsystem: loading all self test plugin instances 0.localhost-startStop-2 - [06/Jan/2020:10:56:29 HST] [20] [1] SelfTestSubsystem: loading all self test plugin instance parameters 0.localhost-startStop-2 - [06/Jan/2020:10:56:29 HST] [20] [1] SelfTestSubsystem: loading self test plugins in on-demand order 0.localhost-startStop-2 - [06/Jan/2020:10:56:29 HST] [20] [1] SelfTestSubsystem: loading self test plugins in startup order 0.localhost-startStop-2 - [06/Jan/2020:10:56:29 HST] [20] [1] SelfTestSubsystem: Self test plugins have been successfully loaded! 0.localhost-startStop-2 - [06/Jan/2020:10:56:29 HST] [20] [1] SelfTestSubsystem: Running self test plugins specified to be executed at startup: 0.localhost-startStop-2 - [06/Jan/2020:10:56:29 HST] [20] [1] CAPresence: CA is present 0.localhost-startStop-2 - [06/Jan/2020:10:56:29 HST] [20] [1] SystemCertsVerification: system certs verification failure: Certificate not found: auditSigningCert cert-pki-ca 0.localhost-startStop-2 - [06/Jan/2020:10:56:29 HST] [20] [1] SelfTestSubsystem: The CRITICAL self test plugin called selftests.container.instance.SystemCertsVerification running at startup FAILED! I can also confirm that the 'auditSigningCert cert-pka-ca' isn't there when I run certutil -L -d /etc/pki/pki-tomcat/alias/. The output is listed below: Certificate Nickname Trust Attributes SSL,S/MIME,JAR/XPI subsystemCert cert-pki-ca ,, Server-Cert cert-pki-ca u,u,u caSigningCert cert-pki-ca CTu,Cu,Cu ocspSigningCert cert-pki-ca u,u,u The 'auditSigningCert cert-pka-ca' shows up on the other nodes however: auditSigningCert cert-pki-ca u,u,Pu Let me know if there is more information that is needed. This one is baffling me. Thanks, Ferdinand

2 11

Integrated DNS - best solution to unique domain
by Daniel PC 17 Jan '20

17 Jan '20

Hi, Red Hat strongly recommends IdM-integrated DNS for basic usage within the IdM deployment but at the same time declares "It does not support some of the advanced DNS features" and must be used only for IdM purposes. I have a DNS for a domain that resolves names to Linux hostnames, VIPs, application names, databases scan, and more. From my understanding, IdM must resolve DNS only for hostnames. Other services should be delegated to a true DNS server. I understand that it's not normal the use of two DNS for one domain, but in my case how can I build my DNS system? Any advice? Thank you DC

5 5

Re: Where is the "Audit" in IPA?
by Charles Hedrick 16 Jan '20

16 Jan '20

I’ve thought about this a bit more. I think it would be useful if log entries showing changes could be routed differently by syslog. The simplest would be to use a different log level, e.g. NOTICE, where other things are INFO. Another approach would be to put a specific tag in the try, e.g. AUDIT. On Jan 15, 2020, at 5:20 PM, Angus Clarke <post(a)angusclarke.com<mailto:post@angusclarke.com>> wrote: Yeah, to find what I'm looking for I keep a list of grep examples, as auditors generally ask for the same things! I modify httpd.conf to send ErrorLog messages to syslog and then use syslog to send those to a server with cheap storage to keep a long history. Regards Angus ________________________________ From: Charles Hedrick <hedrick(a)rutgers.edu<mailto:hedrick@rutgers.edu>> Sent: 15 January 2020 22:54 To: FreeIPA users list <freeipa-users(a)lists.fedorahosted.org<mailto:freeipa-users@lists.fedorahosted.org>> Cc: Ryan Slominski <ryans(a)jlab.org<mailto:ryans@jlab.org>>; Angus Clarke <post(a)angusclarke.com<mailto:post@angusclarke.com>> Subject: Re: [Freeipa-users] Where is the "Audit" in IPA? This looks pretty reasonable. Unfortunately it intermixed lots of info. The files grow rapidly enough that it’s probably not practical to keep them for a long time. It might not be hard to pull out just the things that make changes. On Jan 15, 2020, at 4:47 PM, Angus Clarke via FreeIPA-users <freeipa-users(a)lists.fedorahosted.org<mailto:freeipa-users@lists.fedorahosted.org>> wrote: Just a note from a fellow user ... Changes made through the API are logged via apache's ErrorLog directive, I've been using this to some degree of success to answer 3rd party audit queries. However it does miss things like "which groups was this user a member of when they were deleted" though ... The facilities you are asking about sound excellent Ryan! Regards Angus ________________________________ From: Ryan Slominski via FreeIPA-users <freeipa-users(a)lists.fedorahosted.org<mailto:freeipa-users@lists.fedorahosted.org>> Sent: 15 January 2020 20:28 To: freeipa-users(a)lists.fedorahosted.org<mailto:freeipa-users@lists.fedorahosted.org> <freeipa-users(a)lists.fedorahosted.org<mailto:freeipa-users@lists.fedorahosted.org>> Cc: Ryan Slominski <ryans(a)jlab.org<mailto:ryans@jlab.org>> Subject: [Freeipa-users] Where is the "Audit" in IPA? Hi FreeIPA dudes, What is the status of audit in IPA? Specifically, is there an easy way to determine what was the group membership of a particular group was at a particular point in time, say last October? I noticed there is an audit log file (disabled by default), but that is going to be a not-so-easy way to try to re-construct group membership at a point in time in the past. I was hoping to just navigate to a "history" tab on the GUI, but no such luck. Is this on anyone's todo list? I also noticed a "Centralized Logging" webpage that suggest setting up an ELK stack, but that doesn't quite provide snapshots of group membership. What about the ability to subscribe to changes (as opposed to poll them)? I suppose the replication features could be used somehow, but those are also polling based? Would be nice to configure simple callbacks (perhaps HTTP post) when things change. I believe this is called a webhook. Any support for this kind of notification system? Thanks, Ryan _______________________________________________ FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org<mailto:freeipa-users@lists.fedorahosted.org> To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org<mailto:freeipa-users-leave@lists.fedorahosted.org> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/<https://nam03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdocs.fedo…> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines<https://nam03.safelinks.protection.outlook.com/?url=https%3A%2F%2Ffedorapro…> List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost…<https://nam03.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.fed…> _______________________________________________ FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org<mailto:freeipa-users@lists.fedorahosted.org> To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org<mailto:freeipa-users-leave@lists.fedorahosted.org> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/<https://nam03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdocs.fedo…> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines<https://nam03.safelinks.protection.outlook.com/?url=https%3A%2F%2Ffedorapro…> List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost…<https://nam03.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.fed…>

1 0

Question about ipa group-add-member
by White, Daniel E. (GSFC-770.0)[NICS] 16 Jan '20

16 Jan '20

Adding multiple users to one group is documented, but the other way around seems to be missing. Is there a way to add one user to multiple groups with one command ? If not, I can deal with it.

2 2

Legacy client in compat tree - multiple entries?
by S Toulmonde 16 Jan '20

16 Jan '20

Hello IPA gurus, I have a legacy client (Solaris) that I want to migrate to a IPA (RHEL IPA 4.6.5). Currently, it's being served by an ODSEE server for ldap. So first I want to test if I can connect with a user in IPA, then I'll try with an external (AD client). But I have the following issue: User I try to login with: seb # Legacy (Solaris) Client: Jan 14 15:46:34 vs4b7 sshd[45644]: [ID 293258 auth.warning] libsldap: Status: 7 Mesg: Too many entries are returned for seb So it seems that I have several users in the compat tree with uid=seb... # IPA server serving Legacy client: [root@el6982 sssd]# ldapsearch -Y GSSAPI -b 'cn=users,cn=compat,dc=dev,dc=ipa,dc=bc' '(&(objectClass=posixaccount)(uid=seb))' # seb, users, compat, dev.ipa.bc dn: uid=seb,cn=users,cn=compat,dc=dev,dc=ipa,dc=bc objectClass: posixAccount objectClass: top gecos:: U8OpYmFzdGllbiBUb3VsbW9uZGUgKGxvY2FsIElQQSk= cn:: U8OpYmFzdGllbiBUb3VsbW9uZGUgKGxvY2FsIElQQSk= uidNumber: 1856200001 gidNumber: 1856200001 loginShell: /bin/bash homeDirectory: /home/seb uid: seb(a)dev.ipa.bc uid: seb # seb, users, compat, dev.ipa.bc dn: uid=seb,cn=users,cn=compat,dc=dev,dc=ipa,dc=bc objectClass: posixAccount objectClass: ipaOverrideTarget objectClass: top gecos:: U8OpYmFzdGllbiBUb3VsbW9uZGU= cn:: U8OpYmFzdGllbiBUb3VsbW9uZGU= uidNumber: 1856200001 gidNumber: 1856200001 loginShell: /bin/bash homeDirectory: /home/seb ipaAnchorUUID:: OklQQTpkZXYuaXBhLmJjOmRmMmQyNjdjLWFjN2MtMTFlOS1iYTMyLTAwNTA1NjllMjc5OQ== uid: seb # search result search: 4 result: 0 Success # numResponses: 3 # numEntries: 2 # LDAP config for legacy client: (vs4b7:/var/adm)# ldapclient list NS_LDAP_FILE_VERSION= 2.0 NS_LDAP_BINDDN= uid=solaris10,cn=sysaccounts,cn=etc,dc=dev,dc=ipa,dc=bc NS_LDAP_BINDPASSWD= {NS1}c537f4abc1a7c4e477a5ca0ca15c7bdc7a83d9 NS_LDAP_SERVERS= el6982.dev.ipa.bc NS_LDAP_SEARCH_BASEDN= dc=dev,dc=ipa,dc=bc NS_LDAP_AUTH= simple NS_LDAP_SEARCH_REF= TRUE NS_LDAP_SEARCH_SCOPE= sub NS_LDAP_SEARCH_TIME= 15 NS_LDAP_CACHETTL= 0 NS_LDAP_PROFILE= solaris10 NS_LDAP_CREDENTIAL_LEVEL= proxy NS_LDAP_SERVICE_SEARCH_DESC= passwd:cn=users,cn=compat,dc=dev,dc=ipa,dc=bc NS_LDAP_SERVICE_SEARCH_DESC= group:cn=groups,cn=compat,dc=dev,dc=ipa,dc=bc NS_LDAP_BIND_TIME= 5 NS_LDAP_OBJECTCLASSMAP= shadow:shadowAccount=posixAccount I wonder why do I have two entries in the compat tree? One if objectClass: ipaOverrideTarget and the other isn't... I restarted sssd and IPA to clear the compat tree, but it pops back up again. Any idea? Thanks!

2 2

Server-Cert cert-pki-ca was expired and wasn't renewed automatically
by luckydog xf 16 Jan '20

16 Jan '20

Hi, I have 2 nodes of IPA system. The 'Server-Cert cert-pki-ca' of master node was expired unexpectedly. Based on https://ftweedal.fedorapeople.org/ipa-cert-renewal-deep-dive.pdf, this cert is for HTTS( pki-tomcat), AKA Dogtag website. As it was expired, Dogtag is OOS, either. Right now, those services are not running, --- pki-tomcatd Service: STOPPED ipa-otpd Service: STOPPED ipa-dnskeysyncd Service: STOPPED --- This is /var/log/pki/pki-tomcat/ca/selftests.log --------------------- 0.localhost-startStop-1 - [25/Dec/2019:16:16:54 HKT] [20] [1] CAPresence: CA is present 0.localhost-startStop-1 - [25/Dec/2019:16:16:54 HKT] [20] [1] SystemCertsVerification: system certs verification failure: Certificate Server-Cert cert-pki-ca is invalid: Invalid certificate: (-8181) Peers Certificate has expired. 0.localhost-startStop-1 - [25/Dec/2019:16:16:54 HKT] [20] [1] SelfTestSubsystem: The CRITICAL self test plugin called selftests.container.instance.SystemCertsVerification running at startup FAILED! ----------------- And /var/log/pki/pki-tomcat/ca/debug ------------ [25/Dec/2019:17:07:53][localhost-startStop-1]: CertUtils: verifySystemCertByNickname(Server-Cert cert-pki-ca, SSLServer) [25/Dec/2019:17:07:53][localhost-startStop-1]: CertUtils: verifySystemCertByNickname(): calling verifyCertificate(Server-Cert cert-pki-ca, true, SSLServer) [25/Dec/2019:17:07:53][localhost-startStop-1]: CertUtils: verifySystemCertByNickname() failed: java.lang.Exception: Certificate Server-Cert cert-pki-ca is invalid: Invalid certificate: (-8181) Peer's Certificate has expired. [25/Dec/2019:17:07:53][localhost-startStop-1]: CertUtils: verifySystemCertsByTag() failed: java.lang.Exception: Certificate Server-Cert cert-pki-ca is invalid: Invalid certificate: (-8181) Peer's Certificate has expired. ----------------- Output from certutil: ------- Issuer: "CN=Certificate Authority,O=IPA.PTHL.HK" Validity: Not Before: Tue Nov 21 08:43:11 2017 Not After : Mon Nov 11 08:43:11 2019 Subject: "CN=ipa.ipa.pthl.hk,O=IPA.PTHL.HK" ---------- This certificate was expired, so here comes the point, 1. Why ipa cert-mon did monitor and renew it? So weired. getcert list | grep tomcat -i does not return this certificate. 2. How to fix it? it's renewal master by 'ipa config-show | grep 'IPA CA renewal master' 1) I reset the clock during the valid period, and restart services. it failed. 2) I plan to renew or recreate a Server-Cert since my CA is still valid, but I'm not sure it's doable and don't know how. Not sure it's a bug or not, my slave node is good, both are running freeipa v4.6.4. Thanks a lot.

5 25

Re: Where is the "Audit" in IPA?
by Charles Hedrick 15 Jan '20

15 Jan '20

This looks pretty reasonable. Unfortunately it intermixed lots of info. The files grow rapidly enough that it’s probably not practical to keep them for a long time. It might not be hard to pull out just the things that make changes. On Jan 15, 2020, at 4:47 PM, Angus Clarke via FreeIPA-users <freeipa-users(a)lists.fedorahosted.org<mailto:freeipa-users@lists.fedorahosted.org>> wrote: Just a note from a fellow user ... Changes made through the API are logged via apache's ErrorLog directive, I've been using this to some degree of success to answer 3rd party audit queries. However it does miss things like "which groups was this user a member of when they were deleted" though ... The facilities you are asking about sound excellent Ryan! Regards Angus ________________________________ From: Ryan Slominski via FreeIPA-users <freeipa-users(a)lists.fedorahosted.org<mailto:freeipa-users@lists.fedorahosted.org>> Sent: 15 January 2020 20:28 To: freeipa-users(a)lists.fedorahosted.org<mailto:freeipa-users@lists.fedorahosted.org> <freeipa-users(a)lists.fedorahosted.org<mailto:freeipa-users@lists.fedorahosted.org>> Cc: Ryan Slominski <ryans(a)jlab.org<mailto:ryans@jlab.org>> Subject: [Freeipa-users] Where is the "Audit" in IPA? Hi FreeIPA dudes, What is the status of audit in IPA? Specifically, is there an easy way to determine what was the group membership of a particular group was at a particular point in time, say last October? I noticed there is an audit log file (disabled by default), but that is going to be a not-so-easy way to try to re-construct group membership at a point in time in the past. I was hoping to just navigate to a "history" tab on the GUI, but no such luck. Is this on anyone's todo list? I also noticed a "Centralized Logging" webpage that suggest setting up an ELK stack, but that doesn't quite provide snapshots of group membership. What about the ability to subscribe to changes (as opposed to poll them)? I suppose the replication features could be used somehow, but those are also polling based? Would be nice to configure simple callbacks (perhaps HTTP post) when things change. I believe this is called a webhook. Any support for this kind of notification system? Thanks, Ryan _______________________________________________ FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org<mailto:freeipa-users@lists.fedorahosted.org> To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org<mailto:freeipa-users-leave@lists.fedorahosted.org> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost… _______________________________________________ FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org<mailto:freeipa-users@lists.fedorahosted.org> To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org<mailto:freeipa-users-leave@lists.fedorahosted.org> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost…

2 1

Where is the "Audit" in IPA?
by Ryan Slominski 15 Jan '20

15 Jan '20

Hi FreeIPA dudes, What is the status of audit in IPA? Specifically, is there an easy way to determine what was the group membership of a particular group was at a particular point in time, say last October? I noticed there is an audit log file (disabled by default), but that is going to be a not-so-easy way to try to re-construct group membership at a point in time in the past. I was hoping to just navigate to a "history" tab on the GUI, but no such luck. Is this on anyone's todo list? I also noticed a "Centralized Logging" webpage that suggest setting up an ELK stack, but that doesn't quite provide snapshots of group membership. What about the ability to subscribe to changes (as opposed to poll them)? I suppose the replication features could be used somehow, but those are also polling based? Would be nice to configure simple callbacks (perhaps HTTP post) when things change. I believe this is called a webhook. Any support for this kind of notification system? Thanks, Ryan

3 2

can't access the web interface of freeIPA
by cyrine stambouli 15 Jan '20

15 Jan '20

Hello, I have a problem to access the freeIPA interface, well I have installed freeIPA in centos 7 server, the iinstallation was well done without any errors , but i am not able to access web interface , do you have any idea to fix that ? [root@ipa]# ipactl status Directory Service: RUNNING krb5kdc Service: RUNNING kadmin Service: RUNNING named Service: RUNNING httpd Service: RUNNING ipa-custodia Service: RUNNING ntpd Service: RUNNING pki-tomcatd Service: RUNNING ipa-otpd Service: RUNNING ipa-dnskeysyncd Service: RUNNING ipa: INFO: The ipactl command was successful

5 12

Troubles accessing kerberized website
by Ronald Wimmer 14 Jan '20

14 Jan '20

Today I am confronted with an interesting situation. A Kerberos protected website partially stopped working the way it was. I am asked to enter my Kerberos credentials manually. (If I do the site works as expected.) The interesting thing about this issue is that this only happens if I try to access that particular website from a linux client. If I access the same site from a Windows client Kerberos auth is done automatically. The second interesting thing is that another website configured exactly the same way does work without any issues. (Yes I do use the same user on Windows and Linux and I do have a valid TGT.) What could possibly be the problem? Where should I take a closer look? Cheers, Ronald

2 5

Adding Hosts that are not ipa-clients ?
by White, Daniel E. (GSFC-770.0)[NICS] 14 Jan '20

14 Jan '20

I am considering the Host Based Access Control features to help manage things in our infrastructure that cannot be ipa-clients - like network hardware (switches, routers) With the understanding that my servers do not run the DNS, can I create such hosts to use in host groups and HBAC rules ? ______________________________________________________________________________________________

2 2

Disable SSLv3 and RC4 ciphers on ipa-server 3.0.0
by Terry Soucy 14 Jan '20

14 Jan '20

We are running FreeIPA 3.0.0 on CentOS 6 (directly from the OS repository). I am having trouble disabling SSL3 and RC4 ciphers on port 9443 (pki-cad) ipa-server-3.0.0 tomcat6-6.0.24 I've been modifying /etc/pki-ca/server.xml with little success. What am I missing? I've been banging my head on this for the past week. <Connector name="Agent" port="9443" protocol="HTTP/1.1" SSLEnabled="true" sslEnabledProtocols="TLSv1,TLSv1.1,TLSv1.2" scheme="https" secure="true" maxHttpHeaderSize="8192" acceptCount="100" maxThreads="150" minSpareThreads="25" maxSpareThreads="75" enableLookups="false" disableUploadTimeout="true" SSLImplementation="org.apache.tomcat.util.net.jss.JSSImplementation" enableOCSP="false" ocspResponderURL="http://ipa001.local:9080/ca/ocsp" ocspResponderCertNickname="ocspSigningCert cert-pki-ca" ocspCacheSize="1000" ocspMinCacheEntryDuration="60" ocspMaxCacheEntryDuration="120" ocspTimeout="10" clientAuth="true" sslOptions="ssl2=false,ssl3=false,tls=true" tls3Ciphers="-SSL3_FORTEZZA_DMS_WITH_NULL_SHA,-SSL3_FORTEZZA_DMS_WITH_RC4_128_SHA,-SSL3_RSA_WITH_RC4_128_SHA,-SSL3_RSA_EXPORT_WITH_RC4_40_MD5,-SSL3_RSA_WITH_3DES_EDE_CBC_SHA,-SSL3_RSA_WITH_DES_CBC_SHA,-SSL3_RSA_EXPORT_WITH_RC2_CBC_40_MD5,-SSL3_FORTEZZA_DMS_WITH_FORTEZZA_CBC_SHA,-SSL_RSA_FIPS_WITH_DES_CBC_SHA,-SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA,-SSL3_RSA_WITH_NULL_MD5,-TLS_RSA_EXPORT1024_WITH_RC4_56_SHA,-TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA,+TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,-EDH-RSA-DES-CBC3-SHA,-DES-CBC3-SHA" sslVersionRangeStream="tls1_1:tls1_2" sslVersionRangeDatagram="tls1_1:tls1_2" sslRangeCiphers="-TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA,-TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA,+TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA,+TLS_ECDH_RSA_WITH_AES_128_CBC_SHA,+TLS_ECDH_RSA_WITH_AES_256_CBC_SHA,-TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA,+TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,+TLS_RSA_WITH_3DES_EDE_CBC_SHA,+TLS_RSA_WITH_AES_128_CBC_SHA,+TLS_RSA_WITH_AES_256_CBC_SHA,+TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA,+TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,-TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,-TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,-TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,+TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA,+TLS_DHE_DSS_WITH_AES_128_CBC_SHA,+TLS_DHE_DSS_WITH_AES_256_CBC_SHA,+TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA,+TLS_DHE_RSA_WITH_AES_128_CBC_SHA,+TLS_DHE_RSA_WITH_AES_256_CBC_SHA,+TLS_DHE_RSA_WITH_AES_128_CBC_SHA256,+TLS_DHE_RSA_WITH_AES_256_CBC_SHA256,+TLS_RSA_WITH_AES_128_CBC_SHA256,+TLS_RSA_WITH_AES_256_CBC_SHA256,+TLS_RSA_WITH_AES_128_GCM_SHA256,+TLS_DHE_RSA_WITH_AES_128_GCM_SHA256,+TLS_DHE_DSS_WITH_AES_128_GCM_SHA256,+TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,+TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,+TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,+TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256,+TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,+TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256" serverCertNickFile="/var/lib/pki-ca/conf/serverCertNick.conf" passwordFile="/var/lib/pki-ca/conf/password.conf" passwordClass="org.apache.tomcat.util.net.jss.PlainPasswordFile" certdbDir="/var/lib/pki-ca/alias" /> -- Terry Soucy Systems Engineering Lead | Salesforce Mobile: +1.506.609.3247 <http://smart.salesforce.com/sig/tsoucy//ca_mb/default/link.html>

4 6

FreeIPA/PKI CA/KRA Subsystem Certificate Renewal Failure (not yet expired)
by Anthony Joseph Messina 13 Jan '20

13 Jan '20

I am running into trouble with certmonger renewal of KRA subsystem certs on the renewal master, and CA/KRA subsystem certs on the replica. Any help is appreciated as my renewal window ends in 8 days. This is Fedora 31 with freeipa-server-4.8.4-2.fc31.x86_64 on both master and replica. These systems have been upgraded using the recommended method of creating new replicas since 4.6.3. ## The renewal master... The cert is renewed, but the ca-error below is concerning (the same for "CN=KRA Transport Certificate" and "CN=KRA Storage Certificate") Request ID '20191117031707': status: MONITORING ca-error: Server at "http://ipa482a.example.com:8080/ca/ee/ca/profileSubmit" replied: Missing credential: sessionID stuck: no key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert cert-pki-kra',token='NSS Certificate DB',pin set certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert cert-pki-kra',token='NSS Certificate DB' CA: dogtag-ipa-ca-renew-agent issuer: CN=Certificate Authority,O=EXAMPLE.COM subject: CN=KRA Audit,O=EXAMPLE.COM expires: 2022-01-01 12:37:19 CST key usage: digitalSignature,nonRepudiation ## The replica... The cert is not renewed and the ca-error is different. Request ID '20191117040017': status: MONITORING ca-error: Invalid cookie: '' stuck: no key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert cert-pki-kra',token='NSS Certificate DB',pin set certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert cert-pki-kra',token='NSS Certificate DB' CA: dogtag-ipa-ca-renew-agent issuer: CN=Certificate Authority,O=MESSINET.COM subject: CN=KRA Audit,O=MESSINET.COM expires: 2020-01-21 20:22:24 CST key usage: digitalSignature,nonRepudiation pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "auditSigningCert cert-pki-kra" track: yes auto-renew: yes ## The pki-tomcat debug log on the renewal master... 2020-01-12 15:03:21 [http-nio-8080-exec-13] SEVERE: CAProcessor: authentication error: Missing credential: sessionID Missing credential: sessionID at com.netscape.cms.servlet.common.AuthCredentials.set(AuthCredentials.java:57) at com.netscape.cms.servlet.processors.CAProcessor.authenticate(CAProcessor.java:416) at com.netscape.cms.servlet.processors.CAProcessor.authenticate(CAProcessor.java:471) at com.netscape.cms.servlet.cert.EnrollmentProcessor.processEnrollment(EnrollmentProcessor.java:179) at com.netscape.cms.servlet.cert.EnrollmentProcessor.processEnrollment(EnrollmentProcessor.java:98) at com.netscape.cms.servlet.profile.ProfileSubmitServlet.processEnrollment(ProfileSubmitServlet.java:242) at com.netscape.cms.servlet.profile.ProfileSubmitServlet.process(ProfileSubmitServlet.java:128) at com.netscape.cms.servlet.base.CMSServlet.service(CMSServlet.java:496) at javax.servlet.http.HttpServlet.service(HttpServlet.java:741) at sun.reflect.GeneratedMethodAccessor43.invoke(Unknown Source) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.lang.reflect.Method.invoke(Method.java:498) at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:282) at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:279) at java.security.AccessController.doPrivileged(Native Method) at javax.security.auth.Subject.doAsPrivileged(Subject.java:549) at org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:314) at org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:170) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:225) at org.apache.catalina.core.ApplicationFilterChain.access$000(ApplicationFilterChain.java:47) at org.apache.catalina.core.ApplicationFilterChain$1.run(ApplicationFilterChain.java:149) at org.apache.catalina.core.ApplicationFilterChain$1.run(ApplicationFilterChain.java:145) at java.security.AccessController.doPrivileged(Native Method) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:144) at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:53) at sun.reflect.GeneratedMethodAccessor44.invoke(Unknown Source) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.lang.reflect.Method.invoke(Method.java:498) at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:282) at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:279) at java.security.AccessController.doPrivileged(Native Method) at javax.security.auth.Subject.doAsPrivileged(Subject.java:549) at org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:314) at org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:253) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:191) at org.apache.catalina.core.ApplicationFilterChain.access$000(ApplicationFilterChain.java:47) at org.apache.catalina.core.ApplicationFilterChain$1.run(ApplicationFilterChain.java:149) at org.apache.catalina.core.ApplicationFilterChain$1.run(ApplicationFilterChain.java:145) at java.security.AccessController.doPrivileged(Native Method) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:144) at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:202) at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:96) at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:541) at com.netscape.cms.tomcat.ExternalAuthenticationValve.invoke(ExternalAuthenticationValve.java:82) at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:139) at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:92) at org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:678) at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:74) at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:343) at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:367) at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:65) at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:860) at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1598) at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49) at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) at java.lang.Thread.run(Thread.java:748) 2020-01-12 15:03:21 [http-nio-8080-exec-13] SEVERE: ProfileSubmitServlet: authentication error in processing request: Missing credential: sessionID Missing credential: sessionID at com.netscape.cms.servlet.common.AuthCredentials.set(AuthCredentials.java:57) at com.netscape.cms.servlet.processors.CAProcessor.authenticate(CAProcessor.java:416) at com.netscape.cms.servlet.processors.CAProcessor.authenticate(CAProcessor.java:471) at com.netscape.cms.servlet.cert.EnrollmentProcessor.processEnrollment(EnrollmentProcessor.java:179) at com.netscape.cms.servlet.cert.EnrollmentProcessor.processEnrollment(EnrollmentProcessor.java:98) at com.netscape.cms.servlet.profile.ProfileSubmitServlet.processEnrollment(ProfileSubmitServlet.java:242) at com.netscape.cms.servlet.profile.ProfileSubmitServlet.process(ProfileSubmitServlet.java:128) at com.netscape.cms.servlet.base.CMSServlet.service(CMSServlet.java:496) at javax.servlet.http.HttpServlet.service(HttpServlet.java:741) at sun.reflect.GeneratedMethodAccessor43.invoke(Unknown Source) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.lang.reflect.Method.invoke(Method.java:498) at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:282) at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:279) at java.security.AccessController.doPrivileged(Native Method) at javax.security.auth.Subject.doAsPrivileged(Subject.java:549) at org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:314) at org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:170) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:225) at org.apache.catalina.core.ApplicationFilterChain.access$000(ApplicationFilterChain.java:47) at org.apache.catalina.core.ApplicationFilterChain$1.run(ApplicationFilterChain.java:149) at org.apache.catalina.core.ApplicationFilterChain$1.run(ApplicationFilterChain.java:145) at java.security.AccessController.doPrivileged(Native Method) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:144) at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:53) at sun.reflect.GeneratedMethodAccessor44.invoke(Unknown Source) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.lang.reflect.Method.invoke(Method.java:498) at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:282) at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:279) at java.security.AccessController.doPrivileged(Native Method) at javax.security.auth.Subject.doAsPrivileged(Subject.java:549) at org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:314) at org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:253) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:191) at org.apache.catalina.core.ApplicationFilterChain.access$000(ApplicationFilterChain.java:47) at org.apache.catalina.core.ApplicationFilterChain$1.run(ApplicationFilterChain.java:149) at org.apache.catalina.core.ApplicationFilterChain$1.run(ApplicationFilterChain.java:145) at java.security.AccessController.doPrivileged(Native Method) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:144) at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:202) at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:96) at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:541) at com.netscape.cms.tomcat.ExternalAuthenticationValve.invoke(ExternalAuthenticationValve.java:82) at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:139) at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:92) at org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:678) at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:74) at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:343) at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:367) at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:65) at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:860) at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1598) at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49) at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) at java.lang.Thread.run(Thread.java:748) -- Anthony - https://messinet.com F9B6 560E 68EA 037D 8C3D D1C9 FF31 3BDB D9D8 99B6

2 2

Problem adding a RHEL 8.1 client
by SOLER SANGUESA Miguel 13 Jan '20

13 Jan '20

Hello, I'm trying to add a RHEL 8.1 client with the following spec: OS: RHEL 8.1 (Ootpa) IPA: ipa-client-4.8.0-10 SSSD: sssd-2.2.0-19.el8.x86_64 My IDM server has: OS: RHEL 7.7 (Maipo) IPA: ipa-server-4.6.5-11.el7_7.3 SSSD: sssd-1.16.4-21.el7_7.1 When I try to add the client using "ipa-client-install" I get the error: This program will set up IPA client. Version 4.8.0 Discovery was successful! Do you want to configure chrony with NTP server or pool address? [no]: Client hostname: client01.svc.domain.org Realm: IPA.DOMAIN.ORG DNS Domain: ipa.domain.org IPA Server: icidmpdc1.ipa.domain.org BaseDN: dc=ipa,dc=domain,dc=org Continue to configure the system with these values? [no]: yes Synchronizing time Configuration of chrony was changed by installer. Attempting to sync time with chronyc. Time synchronization was successful. Successfully retrieved CA cert Subject: CN=Certificate Authority,O=IPA.DOMAIN.ORG Issuer: CN=Certificate Authority,O=IPA.DOMAIN.ORG Valid From: 2016-03-04 15:13:38 Valid Until: 2036-03-04 15:13:38 Joining realm failed: Unable to initialize STARTTLS session Failed to bind to server! Retrying with pre-4.0 keytab retrieval method... Unable to initialize STARTTLS session Failed to bind to server! Failed to get keytab child exited with 9 Installation failed. Rolling back changes. Disabling client Kerberos and LDAP configurations Restoring client configuration files nslcd daemon is not installed, skip configuration Client uninstall complete. The ipa-client-install command failed. See /var/log/ipaclient-install.log for more information The entire debug log is attached. It fails doing the "join". It doesn't happened when I add a client with RHEL 7.X, also I think it was also working with RHEL 8.0. Can anyone please, let me know why it is not working? Thanks & Regards.

3 12

sudo rule doesn't work
by Elhamsadat Azarian 13 Jan '20

13 Jan '20

Hi friends i define a SudoRule with this properties: rulename : rsyslog_rule Enabled : true RunAs group Category : All users :user-test hosts: ipacli-irvlt01.mydomain.com sudo Deny Commands : sudo /usr/bin/systemctl restart rsyslog now i login with "user-test" into "ipacli-irvlt01" server and i try to run " sudo /usr/bin/systemctl restart rsyslog" command. i expected to doesnt allow to run this command but no action happend and i could run it!!! why my sudo rule doesnt work? ---------------------------------------------------------- this is less /var/log/sssd/sssd_domain.log: (Sun Jan 12 13:59:01 2020) [sssd[be[lshs.dc]]] [orderly_shutdown] (0x0010): SIGTERM: killing children ---------------------------------------------------------- this is /var/log/sssd/sssd_sudo.log (Sun Jan 12 13:59:01 2020) [sssd[sudo]] [orderly_shutdown] (0x0010): SIGTERM: killing children ---------------------------------------------------------- this is less /var/log/sudo_debug Jan 12 14:19:27 sudo[17370] /etc/sudoers:53 CMNDALIAS ALIAS = COMMAND , COMMAND ARG , COMMAND ARG Jan 12 14:19:27 sudo[17370] -> alias_add @ ./alias.c:120 Jan 12 14:19:27 sudo[17370] -> rcstr_addref @ ./rcstr.c:81 Jan 12 14:19:27 sudo[17370] <- rcstr_addref @ ./rcstr.c:88 := 0x55f2968e7714 Jan 12 14:19:27 sudo[17370] -> rbinsert @ ./redblack.c:177 Jan 12 14:19:27 sudo[17370] -> alias_compare @ ./alias.c:54 Jan 12 14:19:27 sudo[17370] <- alias_compare @ ./alias.c:62 := -13 Jan 12 14:19:27 sudo[17370] -> alias_compare @ ./alias.c:54 Jan 12 14:19:27 sudo[17370] <- alias_compare @ ./alias.c:62 := -6 Jan 12 14:19:27 sudo[17370] -> alias_compare @ ./alias.c:54 Jan 12 14:19:27 sudo[17370] <- alias_compare @ ./alias.c:62 := -6 Jan 12 14:19:27 sudo[17370] -> rotate_right @ ./redblack.c:147 Jan 12 14:19:27 sudo[17370] <- rotate_right @ ./redblack.c:163 Jan 12 14:19:27 sudo[17370] <- rbinsert @ ./redblack.c:265 := 0 Jan 12 14:19:27 sudo[17370] <- alias_add @ ./alias.c:143 := (null) Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ ./lbuf.c:159 Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ ./lbuf.c:69 Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ ./lbuf.c:87 := true Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ ./lbuf.c:190 := true Jan 12 14:19:27 sudo[17370] -> fill_txt @ ./toke_util.c:52 Jan 12 14:19:27 sudo[17370] <- fill_txt @ ./toke_util.c:80 := true Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ ./lbuf.c:159 Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ ./lbuf.c:69 Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ ./lbuf.c:87 := true Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ ./lbuf.c:190 := true Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ ./lbuf.c:159 Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ ./lbuf.c:69 Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ ./lbuf.c:87 := true Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ ./lbuf.c:190 := true Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ ./lbuf.c:159 Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ ./lbuf.c:69 Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ ./lbuf.c:87 := true Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ ./lbuf.c:190 := true Jan 12 14:19:27 sudo[17370] -> fill_cmnd @ ./toke_util.c:103 Jan 12 14:19:27 sudo[17370] <- fill_cmnd @ ./toke_util.c:124 := true Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ ./lbuf.c:159 Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ ./lbuf.c:69 Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ ./lbuf.c:87 := true Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ ./lbuf.c:190 := true Jan 12 14:19:27 sudo[17370] -> fill_args @ ./toke_util.c:132 Jan 12 14:19:27 sudo[17370] <- fill_args @ ./toke_util.c:162 := true Jan 12 14:19:27 sudo[17370] -> new_member @ gram.y:956 Jan 12 14:19:27 sudo[17370] <- new_member @ gram.y:968 := 0x55f2968ff550 Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ ./lbuf.c:159 Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ ./lbuf.c:69 Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ ./lbuf.c:87 := true Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ ./lbuf.c:190 := true Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ ./lbuf.c:159 Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ ./lbuf.c:69 Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ ./lbuf.c:87 := true Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ ./lbuf.c:190 := true Jan 12 14:19:27 sudo[17370] -> fill_cmnd @ ./toke_util.c:103 Jan 12 14:19:27 sudo[17370] <- fill_cmnd @ ./toke_util.c:124 := true Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ ./lbuf.c:159 Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ ./lbuf.c:69 Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ ./lbuf.c:87 := true Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ ./lbuf.c:190 := true Jan 12 14:19:27 sudo[17370] -> fill_args @ ./toke_util.c:132 Jan 12 14:19:27 sudo[17370] <- fill_args @ ./toke_util.c:162 := true Jan 12 14:19:27 sudo[17370] -> new_member @ gram.y:956 Jan 12 14:19:27 sudo[17370] <- new_member @ gram.y:968 := 0x55f2968ff650 Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ ./lbuf.c:159 Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ ./lbuf.c:69 Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ ./lbuf.c:87 := true Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ ./lbuf.c:190 := true Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ ./lbuf.c:159 Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ ./lbuf.c:69 Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ ./lbuf.c:87 := true Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ ./lbuf.c:190 := true Jan 12 14:19:27 sudo[17370] -> fill_cmnd @ ./toke_util.c:103 Jan 12 14:19:27 sudo[17370] <- fill_cmnd @ ./toke_util.c:124 := true Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ ./lbuf.c:159 Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ ./lbuf.c:69 Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ ./lbuf.c:87 := true Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ ./lbuf.c:190 := true Jan 12 14:19:27 sudo[17370] -> fill_args @ ./toke_util.c:132 Jan 12 14:19:27 sudo[17370] <- fill_args @ ./toke_util.c:162 := true Jan 12 14:19:27 sudo[17370] -> new_member @ gram.y:956 Jan 12 14:19:27 sudo[17370] <- new_member @ gram.y:968 := 0x55f2968ff750 Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ ./lbuf.c:159 Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ ./lbuf.c:69 Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ ./lbuf.c:87 := true Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ ./lbuf.c:190 := true Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ ./lbuf.c:159 Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ ./lbuf.c:69 Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ ./lbuf.c:87 := true Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ ./lbuf.c:190 := true Jan 12 14:19:27 sudo[17370] -> fill_cmnd @ ./toke_util.c:103 Jan 12 14:19:27 sudo[17370] <- fill_cmnd @ ./toke_util.c:124 := true Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ ./lbuf.c:159 Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ ./lbuf.c:69 Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ ./lbuf.c:87 := true Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ ./lbuf.c:190 := true Jan 12 14:19:27 sudo[17370] -> fill_args @ ./toke_util.c:132 Jan 12 14:19:27 sudo[17370] <- fill_args @ ./toke_util.c:162 := true Jan 12 14:19:27 sudo[17370] -> new_member @ gram.y:956 Jan 12 14:19:27 sudo[17370] <- new_member @ gram.y:968 := 0x55f2968ff850 Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ ./lbuf.c:159 Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ ./lbuf.c:69 Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ ./lbuf.c:87 := true Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ ./lbuf.c:190 := true Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ ./lbuf.c:159 Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ ./lbuf.c:69 Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ ./lbuf.c:87 := true Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ ./lbuf.c:190 := true Jan 12 14:19:27 sudo[17370] -> fill_cmnd @ ./toke_util.c:103 Jan 12 14:19:27 sudo[17370] <- fill_cmnd @ ./toke_util.c:124 := true Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ ./lbuf.c:159 Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ ./lbuf.c:69 Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ ./lbuf.c:87 := true Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ ./lbuf.c:190 := true Jan 12 14:19:27 sudo[17370] -> fill_args @ ./toke_util.c:132 Jan 12 14:19:27 sudo[17370] <- fill_args @ ./toke_util.c:162 := true Jan 12 14:19:27 sudo[17370] -> new_member @ gram.y:956 Jan 12 14:19:27 sudo[17370] <- new_member @ gram.y:968 := 0x55f2968ff950 Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ ./lbuf.c:159 Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ ./lbuf.c:69 Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ ./lbuf.c:87 := true Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ ./lbuf.c:190 := true Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ ./lbuf.c:159 Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ ./lbuf.c:69 Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ ./lbuf.c:87 := true Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ ./lbuf.c:190 := true Jan 12 14:19:27 sudo[17370] -> fill_cmnd @ ./toke_util.c:103 Jan 12 14:19:27 sudo[17370] <- fill_cmnd @ ./toke_util.c:124 := true Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ ./lbuf.c:159 Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ ./lbuf.c:69 Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ ./lbuf.c:87 := true Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ ./lbuf.c:190 := true Jan 12 14:19:27 sudo[17370] -> fill_args @ ./toke_util.c:132 Jan 12 14:19:27 sudo[17370] <- fill_args @ ./toke_util.c:162 := true Jan 12 14:19:27 sudo[17370] -> new_member @ gram.y:956 Jan 12 14:19:27 sudo[17370] <- new_member @ gram.y:968 := 0x55f2968ffa50 Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ ./lbuf.c:159 Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ ./lbuf.c:69 Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ ./lbuf.c:87 := true Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ ./lbuf.c:190 := true Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ ./lbuf.c:159 Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ ./lbuf.c:69 Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ ./lbuf.c:87 := true Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ ./lbuf.c:190 := true Jan 12 14:19:27 sudo[17370] -> fill_cmnd @ ./toke_util.c:103 Jan 12 14:19:27 sudo[17370] <- fill_cmnd @ ./toke_util.c:124 := true Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ ./lbuf.c:159 Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ ./lbuf.c:69 Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ ./lbuf.c:87 := true Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ ./lbuf.c:190 := true Jan 12 14:19:27 sudo[17370] -> fill_args @ ./toke_util.c:132 Jan 12 14:19:27 sudo[17370] <- fill_args @ ./toke_util.c:162 := true Jan 12 14:19:27 sudo[17370] -> new_member @ gram.y:956 Jan 12 14:19:27 sudo[17370] <- new_member @ gram.y:968 := 0x55f2968ffb50 Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ ./lbuf.c:159 Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ ./lbuf.c:69 Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ ./lbuf.c:87 := true Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ ./lbuf.c:190 := true Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ ./lbuf.c:159 Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ ./lbuf.c:69 Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ ./lbuf.c:87 := true Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ ./lbuf.c:190 := true Jan 12 14:19:27 sudo[17370] -> fill_cmnd @ ./toke_util.c:103 Jan 12 14:19:27 sudo[17370] <- fill_cmnd @ ./toke_util.c:124 := true Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ ./lbuf.c:159 Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ ./lbuf.c:69 Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ ./lbuf.c:87 := true Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ ./lbuf.c:190 := true Jan 12 14:19:27 sudo[17370] -> fill_args @ ./toke_util.c:132 Jan 12 14:19:27 sudo[17370] <- fill_args @ ./toke_util.c:162 := true Jan 12 14:19:27 sudo[17370] -> new_member @ gram.y:956 Jan 12 14:19:27 sudo[17370] <- new_member @ gram.y:968 := 0x55f2968ffc50 Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ ./lbuf.c:159 Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ ./lbuf.c:69 Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ ./lbuf.c:87 := true Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ ./lbuf.c:190 := true Jan 12 14:19:27 sudo[17370] /etc/sudoers:54 CMNDALIAS ALIAS = COMMAND ARG , COMMAND ARG , COMMAND ARG , COMMAND ARG , COMMAND ARG , COMMAND ARG , COMMAND ARG , COMMAND ARG Jan 12 14:19:27 sudo[17370] -> alias_add @ ./alias.c:120 Jan 12 14:19:27 sudo[17370] -> rcstr_addref @ ./rcstr.c:81 Jan 12 14:19:27 sudo[17370] <- rcstr_addref @ ./rcstr.c:88 := 0x55f2968e7714 Jan 12 14:19:27 sudo[17370] -> rbinsert @ ./redblack.c:177 Jan 12 14:19:27 sudo[17370] -> alias_compare @ ./alias.c:54 Jan 12 14:19:27 sudo[17370] <- alias_compare @ ./alias.c:62 := 7 Jan 12 14:19:27 sudo[17370] -> alias_compare @ ./alias.c:54 Jan 12 14:19:27 sudo[17370] <- alias_compare @ ./alias.c:62 := -3 Jan 12 14:19:27 sudo[17370] -> alias_compare @ ./alias.c:54 Jan 12 14:19:27 sudo[17370] <- alias_compare @ ./alias.c:62 := -3 Jan 12 14:19:27 sudo[17370] <- rbinsert @ ./redblack.c:265 := 0 Jan 12 14:19:27 sudo[17370] <- alias_add @ ./alias.c:143 := (null) Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ ./lbuf.c:159 Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ ./lbuf.c:69 Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ ./lbuf.c:87 := true Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ ./lbuf.c:190 := true Jan 12 14:19:27 sudo[17370] -> fill_txt @ ./toke_util.c:52 Jan 12 14:19:27 sudo[17370] <- fill_txt @ ./toke_util.c:80 := true Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ ./lbuf.c:159 Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ ./lbuf.c:69 Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ ./lbuf.c:87 := true Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ ./lbuf.c:190 := true Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ ./lbuf.c:159 Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ ./lbuf.c:69 Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ ./lbuf.c:87 := true Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ ./lbuf.c:190 := true Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ ./lbuf.c:159 Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ ./lbuf.c:69 Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ ./lbuf.c:87 := true Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ ./lbuf.c:190 := true Jan 12 14:19:27 sudo[17370] -> fill_cmnd @ ./toke_util.c:103 Jan 12 14:19:27 sudo[17370] <- fill_cmnd @ ./toke_util.c:124 := true Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ ./lbuf.c:159 Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ ./lbuf.c:69 Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ ./lbuf.c:87 := true Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ ./lbuf.c:190 := true Jan 12 14:19:27 sudo[17370] -> fill_args @ ./toke_util.c:132 Jan 12 14:19:27 sudo[17370] <- fill_args @ ./toke_util.c:162 := true Jan 12 14:19:27 sudo[17370] -> new_member @ gram.y:956 Jan 12 14:19:27 sudo[17370] <- new_member @ gram.y:968 := 0x55f2968ffdd0 Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ ./lbuf.c:159 Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ ./lbuf.c:69 Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ ./lbuf.c:87 := true Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ ./lbuf.c:190 := true Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ ./lbuf.c:159 Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ ./lbuf.c:69 Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ ./lbuf.c:87 := true Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ ./lbuf.c:190 := true Jan 12 14:19:27 sudo[17370] -> fill_cmnd @ ./toke_util.c:103 Jan 12 14:19:27 sudo[17370] <- fill_cmnd @ ./toke_util.c:124 := true Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ ./lbuf.c:159 Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ ./lbuf.c:69 Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ ./lbuf.c:87 := true Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ ./lbuf.c:190 := true Jan 12 14:19:27 sudo[17370] -> fill_args @ ./toke_util.c:132 Jan 12 14:19:27 sudo[17370] <- fill_args @ ./toke_util.c:162 := true Jan 12 14:19:27 sudo[17370] -> new_member @ gram.y:956 Jan 12 14:19:27 sudo[17370] <- new_member @ gram.y:968 := 0x55f2968ffed0 Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ ./lbuf.c:159 Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ ./lbuf.c:69 Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ ./lbuf.c:87 := true Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ ./lbuf.c:190 := true Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ ./lbuf.c:159 Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ ./lbuf.c:69 Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ ./lbuf.c:87 := true Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ ./lbuf.c:190 := true Jan 12 14:19:27 sudo[17370] -> fill_cmnd @ ./toke_util.c:103 Jan 12 14:19:27 sudo[17370] <- fill_cmnd @ ./toke_util.c:124 := true Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ ./lbuf.c:159 Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ ./lbuf.c:69 Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ ./lbuf.c:87 := true Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ ./lbuf.c:190 := true Jan 12 14:19:27 sudo[17370] -> fill_args @ ./toke_util.c:132 Jan 12 14:19:27 sudo[17370] <- fill_args @ ./toke_util.c:162 := true Jan 12 14:19:27 sudo[17370] -> new_member @ gram.y:956 Jan 12 14:19:27 sudo[17370] <- new_member @ gram.y:968 := 0x55f2968fffd0 Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ ./lbuf.c:159 Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ ./lbuf.c:69 Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ ./lbuf.c:87 := true Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ ./lbuf.c:190 := true Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ ./lbuf.c:159 Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ ./lbuf.c:69 Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ ./lbuf.c:87 := true Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ ./lbuf.c:190 := true Jan 12 14:19:27 sudo[17370] -> fill_cmnd @ ./toke_util.c:103 Jan 12 14:19:27 sudo[17370] <- fill_cmnd @ ./toke_util.c:124 := true Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ ./lbuf.c:159 Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ ./lbuf.c:69 Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ ./lbuf.c:87 := true Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ ./lbuf.c:190 := true Jan 12 14:19:27 sudo[17370] -> fill_args @ ./toke_util.c:132 Jan 12 14:19:27 sudo[17370] <- fill_args @ ./toke_util.c:162 := true Jan 12 14:19:27 sudo[17370] -> new_member @ gram.y:956 Jan 12 14:19:27 sudo[17370] <- new_member @ gram.y:968 := 0x55f2969000d0 Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ ./lbuf.c:159 Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ ./lbuf.c:69 Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ ./lbuf.c:87 := true Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ ./lbuf.c:190 := true Jan 12 14:19:27 sudo[17370] /etc/sudoers:55 CMNDALIAS ALIAS = COMMAND ARG , COMMAND ARG , COMMAND ARG , COMMAND ARG Jan 12 14:19:27 sudo[17370] -> alias_add @ ./alias.c:120 Jan 12 14:19:27 sudo[17370] -> rcstr_addref @ ./rcstr.c:81 Jan 12 14:19:27 sudo[17370] <- rcstr_addref @ ./rcstr.c:88 := 0x55f2968e7714 Jan 12 14:19:27 sudo[17370] -> rbinsert @ ./redblack.c:177 Jan 12 14:19:27 sudo[17370] -> alias_compare @ ./alias.c:54 Jan 12 14:19:27 sudo[17370] <- alias_compare @ ./alias.c:62 := -10 Jan 12 14:19:27 sudo[17370] -> alias_compare @ ./alias.c:54 Jan 12 14:19:27 sudo[17370] <- alias_compare @ ./alias.c:62 := -4

2 1

Updating time servers
by Tania Hagan 10 Jan '20

10 Jan '20

Hello, I have recently removed and added a new freeipa replica server and have noticed that the chrony.conf still has the old server listed and the new ones are not listed. How do I ensure that the freeipa-client/chrony is pointing to the correct time servers. e.g. server <freeipa-server> iburst. I have attempted reading the documentation but cannot find any useful. Server: CentOs Linux release 8.0.1905 FreeIPA version: 4.7.1 Thank You, Tania

2 1

SSH key authentication fails on some nodes (Server refused our key)
by Jeff Vincent 09 Jan '20

09 Jan '20

Most of our FreeIPA client nodes are Ubuntu 14, 16 and some 18. We have a fair number where I am unable to use SSH authentication because the server refuses the key. The same user/key works fine on other nodes. I have checked to the best of my knowledge the files and compared them to a node that works and can't find any differences. /etc/nsswitch.conf /etc/sssd/sssd.conf I don't understand the nuances of FreeIPA to know where else to look. Can anyone suggest what else I can look at to troubleshoot what is going on? Every user experiences this on different nodes. Thanks!

3 3

centos 7.6 or 8.0?
by Charles Hedrick 09 Jan '20

09 Jan '20

We have a limited time period when I would prefer to do major changes. I had expected to update our Centos 7.6 to 8 during January. Unfortunately it appears that there have been no updates to 8, pending 8.1 and 8.1 is waiting for a surprising mount of time. I have a test 8.0 installation, and it works, but obviously it isn’t under any load. Would you feel safer with 7.6 or 8.0?

1 0

Re: DNS discovery / locations
by Alexander Bokovoy 09 Jan '20

09 Jan '20

On to, 09 tammi 2020, Angus Clarke via FreeIPA-users wrote: >Hello > >Not sure if this is more a generic DNS question or not ... > >We run FreeIPA 4.6.4 on a RHEL7.6 clone, we do not use FreeIPA DNS and >we currently do not use DNS discovery. I have read this: >https://www.freeipa.org/page/Howto/IPA_locations<https://www.freeipa.org/page/Howto/IPA_locations#Advanced_configuration> >and am comfortable configuring split view DNS records. > > >As we depoy more sites. I am looking to move to using DNS discovery, >however we use site specific DNS domains (rightly or wrongly with a >private TLD ... cross that bridge when we come to it ...) such as: > >site1.blah >site2.blah > >which is different from the given example of example.com being used >across all sites. > > >Our Realm Domain is blah - I have put the location based DNS records >immediately under .blah. > >In testing, I see ipa clients initially query DNS for SRV records under >site1.blah - when that fails the clients then perform a second DNS >query for SRV records under .blah - which works and my test outcome is >good - the setup works! > >Is it safe for me to assume that this process will remain the same for >future IDM client versions? My concern is that if future versions >neglect the second-attempt DNS discovery lookup (under .blah) then my >setup will break. There are no plans to change this behavior. At worst, you can add SRV records to siteX.blah directly. -- / Alexander Bokovoy Sr. Principal Software Engineer Security / Identity Management Engineering Red Hat Limited, Finland

1 0

DNS discovery / locations
by Angus Clarke 09 Jan '20

09 Jan '20

Hello Not sure if this is more a generic DNS question or not ... We run FreeIPA 4.6.4 on a RHEL7.6 clone, we do not use FreeIPA DNS and we currently do not use DNS discovery. I have read this: https://www.freeipa.org/page/Howto/IPA_locations<https://www.freeipa.org/page/Howto/IPA_locations#Advanced_configuration> and am comfortable configuring split view DNS records. As we depoy more sites. I am looking to move to using DNS discovery, however we use site specific DNS domains (rightly or wrongly with a private TLD ... cross that bridge when we come to it ...) such as: site1.blah site2.blah which is different from the given example of example.com being used across all sites. Our Realm Domain is blah - I have put the location based DNS records immediately under .blah. In testing, I see ipa clients initially query DNS for SRV records under site1.blah - when that fails the clients then perform a second DNS query for SRV records under .blah - which works and my test outcome is good - the setup works! Is it safe for me to assume that this process will remain the same for future IDM client versions? My concern is that if future versions neglect the second-attempt DNS discovery lookup (under .blah) then my setup will break. Thanks for any pointers Angus

1 0

Replica install Error ?
by Günther J. Niederwimmer 03 Jan '20

03 Jan '20

Hello, this is a new installed Server CentOS 7.7 but it is not possible to configure this for IPA replica I have this Error ipapython.admintool: ERROR [0:0:6]+[128:32:0] not in asn1Spec: GeneralName(componentType=NamedTypes(NamedType('rfc822Name', IA5String(tagSet=TagSet((), Tag(tagClass=128, tagFormat=0, tagId=1)))), NamedType('dNSName', IA5String(tagSet=TagSet((), Tag(tagClass=128, tagFormat=0, tagId=2)))), NamedType('directoryName', Name(componentType=NamedTypes(NamedType('', RDNSequence())), tagSet=TagSet((), Tag(tagClass=128, tagFormat=0, tagId=4)))), NamedType('uniformResourceIdentifier', IA5String(tagSet=TagSet((), Tag(tagClass=128, tagFormat=0, tagId=6)))), NamedType('iPAddress', OctetString(tagSet=TagSet((), Tag(tagClass=128, tagFormat=0, tagId=7)))), NamedType('registeredID', ObjectIdentifier('<no value>')))) ipapython.admintool: ERROR The ipa-replica-install command failed. See / var/log/ipareplica-install.log for more information I install before ipa-client-install, this is working but afterward for the replica i Have this Problem? firewall Ports are open. -- mit freundlichen Grüßen / best regards Günther J. Niederwimmer

2 13

Re: krbpasswordexpiration field gone from "ipa user-show" ?
by Igor Stets 03 Jan '20

03 Jan '20

We use ipa-server-4.6.4-10.el7.centos.6.x86_64 and update expiration check script: # userpw_expiry_datetime=$(/usr/bin/ipa user-show ${user} --all | grep krbpasswordexpiration | awk '{print $2}' | cut -c 1-14) userpw_expiry_datetime=$(/usr/bin/ipa user-show ${user} --all | grep -i "password expiration:" | awk '{print $4}' | cut -c 1-14) This is work for me. Regards. Igor S.

1 0

How to allow users to manage their own certs
by Michael Plemmons 03 Jan '20

03 Jan '20

We have a need where we want to allow a user to submit their own CSR to generate their own SSL certificate and to be able to download their own certificate. I get the following error: Insufficient access: Principal 'testplem(a)MGMT.EXAMPLE.COM' is not permitted to use CA 'ipa' with profile 'IECUserRoles' for certificate issuance. Here are the permissions I have setup. * Create a new Privilege called SelfService * Add the following permissions to the SelfService Privilege * Request Certificate (FreeIPA builtin permission) * Retrieve Certificates from the CA (FreeIPA builtin permission) * UserSelfSerivceCertificate (custom permission) * ReadCAProfile (custom permission) * ReadIPACA (custom permission) * Create Role called SelfService * Attach the SelfService Privilege to this Role * I then attach that Role to a test user. I am sure I am missing other permissions but I am not sure what. If there is already documentation that explains how to do this I am happy to reference that. If not, what else am I missing. ============ dn: cn=UserSelfSerivceCertificate,cn=permissions,cn=pbac,dc=mgmt,dc=example,dc=com member: cn=SelfService,cn=privileges,cn=pbac,dc=mgmt,dc=example,dc=com ipaPermRight: read ipaPermRight: search ipaPermRight: compare ipaPermRight: write ipaPermRight: add ipaPermTargetFilter: (objectclass=posixaccount) ipaPermBindRuleType: permission ipaPermissionType: SYSTEM ipaPermissionType: V2 cn: UserSelfSerivceCertificate objectClass: top objectClass: groupofnames objectClass: ipapermission objectClass: ipapermissionv2 ipaPermLocation: cn=users,cn=accounts,dc=mgmt,dc=example,dc=com ipaPermIncludedAttr: usercertificate ============ dn: cn=ReadCAProfile,cn=permissions,cn=pbac,dc=mgmt,dc=example,dc=com member: cn=SelfService,cn=privileges,cn=pbac,dc=mgmt,dc=example,dc=com ipaPermBindRuleType: permission ipaPermTarget: cn=IECUserRoles,cn=certprofiles,cn=ca,dc=mgmt,dc=example,dc=co m ipaPermRight: read ipaPermRight: search ipaPermTargetFilter: (objectclass=ipacertprofile) ipaPermissionType: SYSTEM ipaPermissionType: V2 cn: ReadCAProfile objectClass: top objectClass: groupofnames objectClass: ipapermission objectClass: ipapermissionv2 ipaPermLocation: cn=certprofiles,cn=ca,dc=mgmt,dc=example,dc=com ipaPermIncludedAttr: cn ipaPermIncludedAttr: description ipaPermIncludedAttr: ipacertprofilestoreissued ipaPermIncludedAttr: objectclass ============ dn: cn=ReadIPACA,cn=permissions,cn=pbac,dc=mgmt,dc=example,dc=com member: cn=SelfService,cn=privileges,cn=pbac,dc=mgmt,dc=example,dc=com ipaPermTarget: cn=ipa,cn=cas,cn=ca,dc=mgmt,dc=example,dc=com ipaPermRight: read ipaPermRight: search ipaPermRight: compare ipaPermTargetFilter: (objectclass=ipaca) ipaPermBindRuleType: permission ipaPermissionType: SYSTEM ipaPermissionType: V2 cn: ReadIPACA objectClass: top objectClass: groupofnames objectClass: ipapermission objectClass: ipapermissionv2 ipaPermLocation: cn=cas,cn=ca,dc=mgmt,dc=example,dc=com ipaPermIncludedAttr: cn ipaPermIncludedAttr: description ipaPermIncludedAttr: ipacaid ipaPermIncludedAttr: ipacaissuerdn ipaPermIncludedAttr: ipacasubjectdn ipaPermIncludedAttr: objectclass Thank you for any insight you are able to provide. -- *Mike Plemmons * Senior Infrastructure Engineer 614-427-2411 <https://oliveai.com/> 99 E. Main Street Columbus, OH 43215 oliveai.com Meet Olive, Your Newest Employee <https://youtu.be/9Vf84z9KA6Y>

2 2

IPA server rebooted after freeze, now services can't authenticate with ldap
by Kristian Petersen 02 Jan '20

02 Jan '20

My primary IPA server has failed. I was running a python script against IPA doing some user management when everything when unresponsive. I couldn't even get in at a console to check what was going on. I ended up rebooting it. After doing so, dirsrv wouldn't start because dse.ldif was missing. I have copied this file over from a replica IPA server, so dirsrv starts now. However, it seems that other services are unable to connect to LDAP properly. DNS isn't resolving when querying the primary even though ipactl shows named is running. smb and winbind won't start and it appears to be a problem with connecting to LDAP. Is there a way to check the integrity of my LDAP database? Or should I try to copy the LDAP database form my working replica to the primary? -- Kristian Petersen System Administrator BYU Dept. of Chemistry and Biochemistry

2 2

2025

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users January 2020