January 2020 - FreeIPA-users - Fedora mailing-lists

can't install replica
by Charles Hedrick 24 Jan '20

24 Jan '20

We are moving from Centos 7 to 8. I did a test on copies and it worked with 8.0. i made the mistake of doing it on the production servers under 8.1. It fails. I removed one server and recreated it as a replica. It worked fine. However the second one failed near the end of the process: Restart of krb5kdc.service complete Waiting up to 300 seconds to see our keys appear on host ldap://krb1.cs.rutgers.edu Starting new HTTPS connection (1): krb1.cs.rutgers.edu:443 https://krb1.cs.rutgers.edu:443 "GET /ipa/keys/dm/DMHash?type=kem&value=eyJhbGciOiJSU0EtT0FFUCIsImVuYyI6IkEyNTZDQkMtSFM1MTIiLCJraWQiOm51bGx9.KgdU3jtIIC3bRIoqToXzmZIl3QFUKqbrBbT0sBerqmR2YWNWQTEp8ABbTSHINOUhtgPubXhwaAsqPzXTee3urtrK6lmf9wJ6OkecdVPY1PS9sWhMNUz4gEJkR-vVM8bN6gfk4g2Lc8jq2o2LMFloNMgCqUQyeRuiec09NsjIvR8X18xYQfXJXvlhuz-d2OJW1CsKO6_T1z8O_vsxlZ-vAeB8j3dbZiXJOlzdcxYYqjMHY-IM4LroUzCVNXtHloiq28e6R-uVTX9O7ActEbiSy6UePgE76K0cWVl1kJyHFozEZChH1_rzCgP6zdhAf8QqPOdde_860nxIUmroRuECjA.gnnrHcTs9ucgqLntquJltw.GAWBOG_aMTgwzwxQqSIFrThgTTiqg3fM3POZWccCqqs3PiwJq5vW2S-tF9VsV1topXcRdlKb6fUOyjE6wrffJ5hYRyE1c3ocAlG3QTVC8QWRn7Ol_IfoVfW-hTe-cAhELcdIOIEand_BYjSTEO6rDXv83iXRFxwno9ZYYppF8bQY7EC1r_wW5xTdXftILCDmkJbhXmGPnlCQ2Ah9cG3qZAKNBRsvk400_kRQec-4LBKWGYYd0y56zd6-PpcVO6p72AldDF_YoeettzaaxbYyH0bRFt7y9aHH3GaD5BOkVp_ZgSHZWbWf8-2zB76f1OKrz6TktCfcb4_ChUZ6BZZ41MX6T06Xjp3ft6p5KzPfY_gUq0fKWWESHMLOEZg8fAl15l9ZwMiRmpd1PZW3oLVxF3rO94OM4H7_8WVehrcO3dAuAVA7_ykmIKv-WBWvjNHbsXXTyb76a2ka2WYuVxeKGMklEyQgOaMPJa7BqSOCiPljt7juTXAMGRupuDG62bP9PdFQkervv4p_9wvwpEZkuWPLlHqgzrdspgBbQoXkbcyiv9qf7oyB_xHQaoMxlwfvGwlNu8Go9t8oHJkalVdjxCPL-qG0GxKHuh0uFNYR0Z3uP545HkzVECv8uUkm08Jc.SCBVE0utvtniR8-8qAe02swg5GzDZxfN0O6JkKsWN2Y HTTP/1.1" 502 415 Your system may be partly configured. Run /usr/sbin/ipa-server-install --uninstall to clean up. File "/usr/lib/python3.6/site-packages/ipapython/admintool.py", line 179, in execute return_value = self.run() File "/usr/lib/python3.6/site-packages/ipapython/install/cli.py", line 340, in run return cfgr.run() File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 360, in run return self.execute() File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 386, in execute for rval in self._executor(): File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 431, in __runner exc_handler(exc_info) File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 460, in _handle_execute_exception self._handle_exception(exc_info) File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 450, in _handle_exception six.reraise(*exc_info) File "/usr/lib/python3.6/site-packages/six.py", line 693, in reraise raise value File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 421, in __runner step() File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 418, in <lambda> step = lambda: next(self.__gen) File "/usr/lib/python3.6/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from six.reraise(*exc_info) File "/usr/lib/python3.6/site-packages/six.py", line 693, in reraise raise value File "/usr/lib/python3.6/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from value = gen.send(prev_value) File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 655, in _configure next(executor) File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 431, in __runner exc_handler(exc_info) File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 460, in _handle_execute_exception self._handle_exception(exc_info) File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 518, in _handle_exception self.__parent._handle_exception(exc_info) File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 450, in _handle_exception six.reraise(*exc_info) File "/usr/lib/python3.6/site-packages/six.py", line 693, in reraise raise value File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 515, in _handle_exception super(ComponentBase, self)._handle_exception(exc_info) File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 450, in _handle_exception six.reraise(*exc_info) File "/usr/lib/python3.6/site-packages/six.py", line 693, in reraise raise value File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 421, in __runner step() File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 418, in <lambda> step = lambda: next(self.__gen) File "/usr/lib/python3.6/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from six.reraise(*exc_info) File "/usr/lib/python3.6/site-packages/six.py", line 693, in reraise raise value File "/usr/lib/python3.6/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from value = gen.send(prev_value) File "/usr/lib/python3.6/site-packages/ipapython/install/common.py", line 65, in _install for unused in self._installer(self.parent): File "/usr/lib/python3.6/site-packages/ipaserver/install/server/__init__.py", line 590, in main replica_install(self) File "/usr/lib/python3.6/site-packages/ipaserver/install/server/replicainstall.py", line 402, in decorated func(installer) File "/usr/lib/python3.6/site-packages/ipaserver/install/server/replicainstall.py", line 1298, in install custodia.import_dm_password() File "/usr/lib/python3.6/site-packages/ipaserver/install/custodiainstance.py", line 211, in import_dm_password cli.fetch_key('dm/DMHash') File "/usr/lib/python3.6/site-packages/ipaserver/secrets/client.py", line 120, in fetch_key r.raise_for_status() File "/usr/lib/python3.6/site-packages/requests/models.py", line 940, in raise_for_status raise HTTPError(http_error_msg, response=self) The ipa-replica-install command failed, exception: HTTPError: 502 Server Error: Proxy Error for url: https://krb1.cs.rutgers.edu/ipa/keys/dm/DMHash?xxxx 502 Server Error: Proxy Error for url: https://krb1.cs.rutgers.edu/ipa/keys/dm/DMHash?ccc At this point I’m pretty much stuck.

1 2

After install FreeIPA server - ipa: WARNING: Failed to read schema: [Errno 13] Permission denied...
by Bedrosian Baol 23 Jan '20

23 Jan '20

I tried to install the FreeIPA server as suggested here: https://computingforgeeks.com/install-and-configure-freeipa-server-on-ubunt… It seems to be all right: :~$ kinit admin ---- > Ok :~$ klist Ticket cache: KEYRING:persistent:1000:1000 Default principal: admin(a)TEST.BED Valid starting Expires Service principal 01/20/2020 10:50:10 01/21/2020 10:49:19 HTTP/master1.test.bed(a)TEST.BED 01/20/2020 10:49:24 01/21/2020 10:49:19 krbtgt/TEST.BED(a)TEST.BED but the command ipa-user-find return: :~$ ipa-user-find admin ipa: WARNING: Failed to read schema: [Errno 13] Permission denied: u'/home/bed/.cache/ipa/schema/1/84c19d36' ipa: WARNING: Failed to write schema: [Errno 13] Permission denied: '/home/bed/.cache/ipa/schema/1/84c19d36mC4GkY' ipa: WARNING: Failed to write server info: [Errno 13] Permission denied: u'/home/bed/.cache/ipa/servers/master1.test.bed' -------------- 1 user matched -------------- User login: admin Last name: Administrator Home directory: /home/admin Login shell: /bin/bash Principal alias: admin(a)TEST.BED UID: 1382000000 GID: 1382000000 Account disabled: False ---------------------------- Number of entries returned 1 ---------------------------- If I try to login with the web interface this is answer: "Login failed due to an unknown reason" (browser configured with certificate) The user "bed" is the sudoer user created during linux server installation, and is the only one at FreeIPA server install time Any advice? Thanks B-)

2 2

Remote Replica Setup
by Russ Long 23 Jan '20

23 Jan '20

I have a cluster of 1 master and 2 replica servers spread across Availablity Zones in one VPC in AWS. We have a couple remote, locked down VPCs that for security reasons do not have access to the rest of our infrastructure. For this reason, I want to place an IPA Replica in those remote VPCs. I was wondering what type of proxy I could place in front of the IPA Master to allow communication with these remote replicas on all required ports. I want to use a proxy to avoid having our IPA setup directly connected to the internet as would be required for the remote replicas to communicate.

1 0

FreeIPA installs without errors, but then the web interface is not available.
by Scott Reed 23 Jan '20

23 Jan '20

I install FreeIPA with my usual options, but when it's done the web interface is not available with the usual. Service status: [xadministrator@idm log]$ sudo systemctl enable tomcat.service -l [xadministrator@idm log]$ sudo systemctl start tomcat.service -l [xadministrator@idm log]$ sudo systemctl status tomcat.service -l \u25cf tomcat.service - Apache Tomcat Web Application Container Loaded: loaded (/usr/lib/systemd/system/tomcat.service; enabled; vendor preset: disabled) Active: inactive (dead) since Tue 2020-01-21 14:42:52 EST; 3s ago Process: 15192 ExecStart=/usr/libexec/tomcat/server start (code=exited, status=0/SUCCESS) Main PID: 15192 (code=exited, status=0/SUCCESS) Jan 21 14:42:52 idm.cs.xxxx server[15192]: Jan 21, 2020 2:42:52 PM org.apache.catalina.core.StandardService stopInternal Jan 21 14:42:52 idm.cs.xxxx server[15192]: INFO: Stopping service Catalina Jan 21 14:42:52 idm.cs.xxxx server[15192]: Jan 21, 2020 2:42:52 PM org.apache.coyote.AbstractProtocol stop Jan 21 14:42:52 idm.cs.xxxx server[15192]: INFO: Stopping ProtocolHandler ["http-bio-8080"] Jan 21 14:42:52 idm.cs.xxxx server[15192]: Jan 21, 2020 2:42:52 PM org.apache.coyote.AbstractProtocol destroy Jan 21 14:42:52 idm.cs.xxxx server[15192]: INFO: Destroying ProtocolHandler ["http-bio-8080"] Jan 21 14:42:52 idm.cs.xxxx server[15192]: Jan 21, 2020 2:42:52 PM org.apache.coyote.AbstractProtocol stop Jan 21 14:42:52 idm.cs.xxxx server[15192]: INFO: Stopping ProtocolHandler ["ajp-bio-8009"] Jan 21 14:42:52 idm.cs.xxxx server[15192]: Jan 21, 2020 2:42:52 PM org.apache.coyote.AbstractProtocol destroy Jan 21 14:42:52 idm.cs.xxxx server[15192]: INFO: Destroying ProtocolHandler ["ajp-bio-8009"] [xadministrator@idm log]$ [xadministrator@idm log]$ sudo systemctl status httpd -l [sudo] password for xadministrator: \u25cf httpd.service - The Apache HTTP Server Loaded: loaded (/usr/lib/systemd/system/httpd.service; disabled; vendor preset: disabled) Drop-In: /etc/systemd/system/httpd.service.d \u2514\u2500ipa.conf Active: active (running) since Tue 2020-01-21 14:18:35 EST; 1 day 2h ago Docs: man:httpd(8) man:apachectl(8) Main PID: 13471 (httpd) Status: "Total requests: 4; Current requests/sec: 0; Current traffic: 0 B/sec" Tasks: 61 CGroup: /system.slice/httpd.service \u251c\u250013471 /usr/sbin/httpd -DFOREGROUND \u251c\u250013472 /usr/libexec/nss_pcache 688130 off \u251c\u250013475 (wsgi:kdcproxy) -DFOREGROUND \u251c\u250013476 (wsgi:kdcproxy) -DFOREGROUND \u251c\u250013477 (wsgi:ipa) -DFOREGROUND \u251c\u250013478 (wsgi:ipa) -DFOREGROUND \u251c\u250013479 (wsgi:ipa) -DFOREGROUND \u251c\u250013480 (wsgi:ipa) -DFOREGROUND \u251c\u250013481 /usr/sbin/httpd -DFOREGROUND \u251c\u250013482 /usr/sbin/httpd -DFOREGROUND \u251c\u250013483 /usr/sbin/httpd -DFOREGROUND \u251c\u250013484 /usr/sbin/httpd -DFOREGROUND \u251c\u250013485 /usr/sbin/httpd -DFOREGROUND \u2514\u250013747 /usr/sbin/httpd -DFOREGROUND Jan 21 14:18:35 idm.cs.xxxx systemd[1]: Started The Apache HTTP Server. Jan 21 14:18:40 idm.cs.xxxx [13477]: GSSAPI client step 1 Jan 21 14:18:40 idm.cs.xxxx [13477]: GSSAPI client step 1 Jan 21 14:18:40 idm.cs.xxxx [13477]: GSSAPI client step 1 Jan 21 14:18:40 idm.cs.xxxx [13478]: GSSAPI client step 1 Jan 21 14:18:40 idm.cs.xxxx [13478]: GSSAPI client step 1 Jan 21 14:18:40 idm.cs.xxxx [13478]: GSSAPI client step 1 Jan 21 14:18:42 idm.cs.xxxx [13479]: GSSAPI client step 1 Jan 21 14:18:42 idm.cs.xxxx [13479]: GSSAPI client step 1 Jan 21 14:18:42 idm.cs.xxxx [13479]: GSSAPI client step 1 The url that I'm trying is: https://idm.cs.xxxx/ipa/ui/ Any help would be appreciated.

2 5

Re: Freeipa and squid
by Aditya 23 Jan '20

23 Jan '20

Hi, I am Aditya from India. I red your article on HYPERKITTY with reference to that I need your help to setup the acl environment as below. 1) I want an internet access with different rules - some group with full access, -some without social networks, ad some group without access to internet, 2) Can you please help me to perform above action in my network by using “ext_kerberos_ldap_group_acl” 3) Coz I am not aware about use of ext_kerberos_ldap_group_acl I am using centos as a IPA server and centos as squid proxy server and ubuntu 18 as client. Requesting you to please help. Regards, Aditya Pawar. 8976100089

1 0

External CA renewal and self-signed surprise
by Rob Foehl 22 Jan '20

22 Jan '20

Went to renew an externally-signed IPA CA certificate that was valid through today, and discovered that FreeIPA had decided to renew it with a self-signed cert a month ago, and had since reissued all other subsystem certs against that self-signed CA. After running through the ipa-cacert-manage renew dance and ipa-certupdate, the system store now contains the following certs, in this order: - old, now-expired IPA CA cert - old, soon-to-be-expired external CA root cert - self-signed IPA cert - new IPA CA cert - new external CA root cert There's also a chicken-and-egg problem with trying to renew anything, in that all new requests are signed with the self-signed IPA CA instead of the new intermediate IPA CA. How do I unravel this, and completely purge the self-signed cert from existence? Why did FreeIPA try to renew the intermediate CA cert on its own, and why did it succeed? (This is FreeIPA 4.7.2 on Fedora 29, which I'm stuck with until the CA chains are sorted out -- upgrading is still a manual replica replacement process, since ipa-server-upgrade and friends *still* insist on verifying a CA lifetime of >2 years, inexplicable behavior reported years ago...) -Rob

4 10

default ipa users seeing too much
by John Louis 21 Jan '20

21 Jan '20

Hi, when a new user is created, she is assigned to the default "ipausers" group. But she can: 1. see the list of all users, at https://server/ipa/ui/#/e/user/search 2. see all the details of any other users, at https://server/ipa/ui/#/e/user/details/another_user 3. for herself, she sees too many info that maybe nobody needs, such as "Car License", in her own landing page Is it possible to: A. prevent normal users to see 1. and 2. above B. customize to remove items not needed in 3. above ? I checked, looks like: A. even though we can configure some Roles, Privileges, Permissions, they are all system admins' elevated permissions. There is no way to remove permission from "ipausers". B. we can configure to disallow users to modify her "Car License" etc, BUT I found no way to not show that item in her landing page. I googled but can't find anything on the above. Would you help? Thanks!

3 3

IPA client as a Samba server?
by Amos 21 Jan '20

21 Jan '20

So, was told a RHEL IPA client (leveraging sssd) could not also be a Samba server (leveraging winbindd) because sssd and winbindd collide in terms of the Kerberos bindings. Our IPA servers are configured in "compat" mode in expectation of having to support a few Solaris systems. Could I configured this RHEL IPA client to instead use LDAP via the compat method and still be able to be a Samba server? Amos

2 1

upgrade from centos 8.0 -> 8.1 samba fails to start
by Rami Elias (TECH V) 21 Jan '20

21 Jan '20

Hello, i upgraded one of our replicas from Centos 8.0 -> Centos 8.1 IPA version error: data needs to be upgraded (expected version '4.8.0-11.module_el8.1.0+253+3b90c921', current version '4.7.1-11.module_el8.0.0+79+bbd20d7b') Automatically running upgrade, for details see /var/log/ipaupgrade.log Be patient, this may take a few minutes. Starting Directory Service Starting krb5kdc Service Starting kadmin Service Starting named Service Starting httpd Service Starting ipa-custodia Service Starting pki-tomcatd Service Starting smb Service Failed to start smb Service Shutting down Hint: You can use --ignore-service-failure option for forced start in case that a non-critical service failed Aborting ipactl now samba cant start anymore, the google results i found for this error where old and said its a ubuntu / debian problem because debian based derivates have their samba build with Heimdal Kerberos instead of MIT Kerberos: https://bugs.launchpad.net/ubuntu/+source/samba/+bug/1552249 Jan 21 16:05:57 ipa-web-test-c82.lx.domain.at smbd[49686]: [2020/01/21 16:05:57.203922, 0] ../../source3/passdb/pdb_interface.c:171(make_pdb_method_name) Jan 21 16:05:57 ipa-web-test-c82.lx.domain.at smbd[49686]: No builtin nor plugin backend for ipasam found Jan 21 16:05:57 ipa-web-test-c82.lx.domain.at systemd[1]: smb.service: Main process exited, code=exited, status=1/FAILURE Jan 21 16:05:57 ipa-web-test-c82.lx.domain.at systemd[1]: smb.service: Failed with result 'exit-code'. Jan 21 16:05:57 ipa-web-test-c82.lx.domain.at systemd[1]: Failed to start Samba SMB Daemon. is this maybe a bug? i attached the ipaupgrade.log https://mega.nz/#!MANSjQbL!HsNemqP5OGL5muoYvHvsaPwzaCDeoPkz5utY4J7wkIw the log was to big to send as attachment best regards, -- ÖAMTC I BAUMGASSE 129 I 1030 WIEN Elias Rami | Devops Engineer M +43 664 613 1346 elias.rami(a)oeamtc.at | www.oeamtc.at<http://www.oeamtc.at/> | ÖAMTC ZVR 7300335108 ________________________________ ÖAMTC Schutzbrief Der umfassende Schutz für Sie und Ihre Familie. Auf allen Reisen mit Auto, Bahn, Bus, Fahrrad, Schiff oder Flugzeug. In Österreich, Europa und rund ums Mittelmeer. www.oeamtc.at/schutzbrief<https://www.oeamtc.at/schutzbrief> ________________________________ Wichtiger Hinweis/Important Information: Dieses E-Mail samt Anlagen („E-Mail“) dient nur zur Information. Erklärungen via E-Mail sind nicht rechtsverbindlich, sondern bedürfen der schriftlichen Bestätigung samt firmenmäßiger/statutenmäßiger Unterfertigung durch Mitglieder der Geschäftsleitung in vertretungsbefugter Anzahl. Für die Richtigkeit oder Vollständigkeit der übermittelten Informationen/Daten, für Übermittlungsfehler, für fehlgeleitete E-Mails oder für einen verspäteten Empfang wird nicht gehaftet. Eigene elektronische Empfangs- oder Lesebestätigungen gelten nicht als Bestätigung für den Erhalt eines E-Mails. Der Inhalt dieses E-Mails ist vertraulich. Wenn Sie nicht der angegebene Adressat oder dessen Vertreter sind, informieren Sie bitte umgehend den Absender und löschen Sie dieses E-Mail von Ihrem System. Die unerlaubte Weitergabe oder Nutzung ist nicht gestattet. This e-mail and any attachment (“e-mail”) serves information purposes only. Statements via e-mail are not legally binding but require written confirmation including the signatures of the required number of managing directors under statutory provisions. We are not liable for the accuracy and sufficiency of the provided information/data, for any transmission error, misdirection, loss or delay of an e-mail. Electronic reading receipts are no confirmation for receipt of an e-mail. This e-mail is confidential. If you are not the addressee or his representative, please notify the sender immediately and delete this e-mail from your system. Any disclosure or use is prohibited. ________________________________

2 1

Two interfaces on FreeIPA server.. How?
by Tony Brian Albers 21 Jan '20

21 Jan '20

Ok guys, I have a FreeIPA server with 2 interfaces. The primary is for normal usage and is the one that FreeIPA is set up with with regards to hostname and services. The other one is on an administrative network. The Web UI works fine on the primary interface, but I can't really access it on the other interface. It's obvious that the services bind to the primary interface, but isn't it possible to access the UI on the other interface somehow? TIA /tony -- Tony Albers - Systems Architect - IT Development Royal Danish Library, Victor Albecks Vej 1, 8000 Aarhus C, Denmark Tel: +45 2566 2383 - CVR/SE: 2898 8842 - EAN: 5798000792142

3 3

Import Schema into FreeIPA
by Dirk Streubel 21 Jan '20

21 Jan '20

Hello List, maybe off topic, i don't know. I have two IPA Servers here, there are in Replication Mode and everything is working fine. Now i want to import a new schema into the IPA Servers. So, i put the new schema under /etc/dirsrv/slapd.../schema in one of my IPA Servers. I also make Chmod / Chown and "restorecon". After that, in the Cockpit 389 WebGUI i reload the schema files, with no error, and restart the IPA Service. Maybe this is to necessary? But i can't see the new schema on my second IPA Server. I have also tried "ipa-replica-manage re-initialize --from" .. So, do i have to install the new schema manually on the second IPA Server and reload the schema files or what is the best way to import a new schema into FreeIPA and replicate it to the second IPA Server? Regards Dirk

2 1

Strange krb5 issue
by Petar Kozić 21 Jan '20

21 Jan '20

Hi, I’m using my IPA server in docker. I’m using that server last more than 8-9 months for ssh login. Everything works well till few hours before. I can’t login to ssh and I get this strange error: [sssd[ldap_child[2171]]][2171]: Failed to initialize credentials using keytab [MEMORY:/etc/krb5.keytab]: Preauthentication failed. Unable to create GSSAPI-encrypted LDAP connection. Someone have idea how to solve this? Thank you. *—* *Petar Kozić*

4 8

Windows Client Integration
by Alexander Becker 21 Jan '20

21 Jan '20

Hi all, i am trying to configure Windows authentication against FreeIPA using this guide: https://www.freeipa.org/page/Windows_authentication_against_FreeIPA Everything worked so far. I added the local User the to "Remote Desktop User" group but it doesn't work with RDP. The Message says that the User is not in the Remote Desktop Group. Now what i could find out is, that the problem is that the following command was run on the IPA Server after the initial Installation of FreeIPA: ipa-adtrust-install --add-sids --netbios-name=EXAMPLE -a So if i understand that correctly, "--add-sids" assigns a SID identifier to all groups in FreeIPA. That's why the RDP ist not working, because the User is not mapped to the local Windows User. How can i make it work? 1. Is it possible to add the FreeIPA User/Group to the "Remote Desktop User" Group so that RDP works? Do i have to configure something in Samba or FreeIPA? 2. Can i somehow undo the Configuration that was done with "ipa-adtrust-install --add-sids"? Can i remove the assigned SIDs? Any help will be much appreciated. with regards, Alexander Becker

1 0

Slow login (CentOS 7.5, IPA 4.5.4)
by Detlev Habicht 21 Jan '20

21 Jan '20

Hello, we are using hosts with CentOS 7.5 - physical and virtual. And we have three IPA server. We are using Cadence CAD/EDA applications and we have a lot of simulations running. After a while we have two problems: - login is very slow - access of NFS mounted data and applications is slow This happens normally after two or more weeks. After a reboot everything is ok again. This problems occurs not on all hosts at the same time, so the other hosts are ok, when some hosts have this problems. Here i will ask for my login problem: Her comes a debug output from sssd: I am using "ssh hostname". #… (deleted) (Wed Jan 15 13:30:02 2020) [sssd[be[imsmx.intern]]] [sysdb_set_entry_attr] (0x0200): Entry [name=habicht(a)imsmx.intern,cn=users,cn=imsmx.intern,cn=sysdb] has set [ts_cache] attrs. (Wed Jan 15 13:30:02 2020) [sssd[be[imsmx.intern]]] [ldb] (0x4000): commit ldb transaction (nesting: 0) (Wed Jan 15 13:30:02 2020) [sssd[be[imsmx.intern]]] [check_wait_queue] (0x1000): Wait queue for user [habicht(a)imsmx.intern] is empty. (Wed Jan 15 13:30:02 2020) [sssd[be[imsmx.intern]]] [krb5_auth_queue_done] (0x1000): krb5_auth_queue request [0x55d411a08150] done. (Wed Jan 15 13:30:02 2020) [sssd[be[imsmx.intern]]] [dp_req_done] (0x0400): DP Request [PAM Preauth #28]: Request handler finished [0]: Success (Wed Jan 15 13:30:02 2020) [sssd[be[imsmx.intern]]] [_dp_req_recv] (0x0400): DP Request [PAM Preauth #28]: Receiving request data. (Wed Jan 15 13:30:02 2020) [sssd[be[imsmx.intern]]] [dp_req_destructor] (0x0400): DP Request [PAM Preauth #28]: Request removed. (Wed Jan 15 13:30:02 2020) [sssd[be[imsmx.intern]]] [dp_req_destructor] (0x0400): Number of active DP request: 0 (Wed Jan 15 13:30:02 2020) [sssd[be[imsmx.intern]]] [dp_method_enabled] (0x0400): Target selinux is not configured (Wed Jan 15 13:30:02 2020) [sssd[be[imsmx.intern]]] [dp_pam_reply] (0x1000): DP Request [PAM Preauth #28]: Sending result [0][imsmx.intern] ### ### Doing Return after entry of password - first debug output at first 30:37 ### (Wed Jan 15 13:30:37 2020) [sssd[be[imsmx.intern]]] [sbus_dispatch] (0x4000): dbus conn: 0x55d4119e04e0 (Wed Jan 15 13:30:37 2020) [sssd[be[imsmx.intern]]] [sbus_dispatch] (0x4000): Dispatching. (Wed Jan 15 13:30:37 2020) [sssd[be[imsmx.intern]]] [sbus_message_handler] (0x2000): Received SBUS method org.freedesktop.sssd.dataprovider.getAccountInfo on path /org/freedesktop/sssd/dataprovider (Wed Jan 15 13:30:37 2020) [sssd[be[imsmx.intern]]] [sbus_get_sender_id_send] (0x2000): Not a sysbus message, quit (Wed Jan 15 13:30:37 2020) [sssd[be[imsmx.intern]]] [dp_get_account_info_handler] (0x0200): Got request for [0x3][BE_REQ_INITGROUPS][name=habicht(a)imsmx.intern] (Wed Jan 15 13:30:37 2020) [sssd[be[imsmx.intern]]] [sss_domain_get_state] (0x1000): Domain imsmx.intern is Active (Wed Jan 15 13:30:37 2020) [sssd[be[imsmx.intern]]] [ldb] (0x4000): Added timed event "ltdb_callback": 0x55d4119fedf0 (Wed Jan 15 13:30:37 2020) [sssd[be[imsmx.intern]]] [ldb] (0x4000): Added timed event "ltdb_timeout": 0x55d4119f85b0 (Wed Jan 15 13:30:37 2020) [sssd[be[imsmx.intern]]] [ldb] (0x4000): Running timer event 0x55d4119fedf0 „ltdb_callback" #… (deleted) (Wed Jan 15 13:30:38 2020) [sssd[be[imsmx.intern]]] [hbac_evaluate] (0x0100): ALLOWED by rule [allow_all]. (Wed Jan 15 13:30:38 2020) [sssd[be[imsmx.intern]]] [hbac_evaluate] (0x0100): hbac_evaluate() >] (Wed Jan 15 13:30:38 2020) [sssd[be[imsmx.intern]]] [ipa_hbac_evaluate_rules] (0x0080): Access granted by HBAC rule [allow_all] (Wed Jan 15 13:30:38 2020) [sssd[be[imsmx.intern]]] [dp_req_done] (0x0400): DP Request [PAM Account #31]: Request handler finished [0]: Success (Wed Jan 15 13:30:38 2020) [sssd[be[imsmx.intern]]] [_dp_req_recv] (0x0400): DP Request [PAM Account #31]: Receiving request data. (Wed Jan 15 13:30:38 2020) [sssd[be[imsmx.intern]]] [dp_req_destructor] (0x0400): DP Request [PAM Account #31]: Request removed. (Wed Jan 15 13:30:38 2020) [sssd[be[imsmx.intern]]] [dp_req_destructor] (0x0400): Number of active DP request: 0 (Wed Jan 15 13:30:38 2020) [sssd[be[imsmx.intern]]] [dp_method_enabled] (0x0400): Target selinux is not configured (Wed Jan 15 13:30:38 2020) [sssd[be[imsmx.intern]]] [dp_pam_reply] (0x1000): DP Request [PAM Account #31]: Sending result [0][imsmx.intern] (Wed Jan 15 13:30:38 2020) [sssd[be[imsmx.intern]]] [sdap_process_result] (0x2000): Trace: sh[0x55d411a00330], connected[1], ops[(nil)], ldap[0x55d4119e4300] (Wed Jan 15 13:30:38 2020) [sssd[be[imsmx.intern]]] [sdap_process_result] (0x2000): Trace: end of ldap_result list ### ### Between last 30:38 and first 31:03 no debug output appears ### (Wed Jan 15 13:31:03 2020) [sssd[be[imsmx.intern]]] [sbus_dispatch] (0x4000): dbus conn: 0x55d4119e04e0 (Wed Jan 15 13:31:03 2020) [sssd[be[imsmx.intern]]] [sbus_dispatch] (0x4000): Dispatching. (Wed Jan 15 13:31:03 2020) [sssd[be[imsmx.intern]]] [sbus_message_handler] (0x2000): Received SBUS method org.freedesktop.sssd.dataprovider.getAccountInfo on path /org/freedesktop/sssd/dataprovider (Wed Jan 15 13:31:03 2020) [sssd[be[imsmx.intern]]] [sbus_get_sender_id_send] (0x2000): Not a sysbus message, quit (Wed Jan 15 13:31:03 2020) [sssd[be[imsmx.intern]]] [dp_get_account_info_handler] (0x0200): Got request for [0x3][BE_REQ_INITGROUPS][name=habicht(a)imsmx.intern] (Wed Jan 15 13:31:03 2020) [sssd[be[imsmx.intern]]] [sss_domain_get_state] (0x1000): Domain imsmx.intern is Active (Wed Jan 15 13:31:03 2020) [sssd[be[imsmx.intern]]] [ldb] (0x4000): Added timed event "ltdb_callback": 0x55d411a054c0 #… (deleted) (Wed Jan 15 13:31:03 2020) [sssd[be[imsmx.intern]]] [ldb] (0x4000): Running timer event 0x55d4119fedf0 "ltdb_callback" (Wed Jan 15 13:31:03 2020) [sssd[be[imsmx.intern]]] [ldb] (0x4000): Destroying timer event 0x55d411a0bee0 "ltdb_timeout" (Wed Jan 15 13:31:03 2020) [sssd[be[imsmx.intern]]] [ldb] (0x4000): Ending timer event 0x55d4119fedf0 "ltdb_callback" (Wed Jan 15 13:31:03 2020) [sssd[be[imsmx.intern]]] [ldb] (0x4000): Added timed event "ltdb_callback": 0x55d4119f85b0 (Wed Jan 15 13:31:03 2020) [sssd[be[imsmx.intern]]] [ldb] (0x4000): Added timed event "ltdb_timeout": 0x55d4119fedf0 (Wed Jan 15 13:31:03 2020) [sssd[be[imsmx.intern]]] [ldb] (0x4000): Running timer event 0x55d4119f85b0 "ltdb_callback" (Wed Jan 15 13:31:03 2020) [sssd[be[imsmx.intern]]] [ldb] (0x4000): Destroying timer event 0x55d4119fedf0 "ltdb_timeout" (Wed Jan 15 13:31:03 2020) [sssd[be[imsmx.intern]]] [ldb] (0x4000): Ending timer event 0x55d4119f85b0 "ltdb_callback" (Wed Jan 15 13:31:03 2020) [sssd[be[imsmx.intern]]] [ldb] (0x4000): start ldb transaction (nesting: 0) (Wed Jan 15 13:31:03 2020) [sssd[be[imsmx.intern]]] [ldb] (0x4000): commit ldb transaction (nesting: 0) (Wed Jan 15 13:31:03 2020) [sssd[be[imsmx.intern]]] [dp_req_done] (0x0400): DP Request [Account #35]: Request handler finished [0]: Success (Wed Jan 15 13:31:03 2020) [sssd[be[imsmx.intern]]] [_dp_req_recv] (0x0400): DP Request [Account #35]: Receiving request data. (Wed Jan 15 13:31:03 2020) [sssd[be[imsmx.intern]]] [dp_req_reply_list_success] (0x0400): DP Request [Account #35]: Finished. Success. (Wed Jan 15 13:31:03 2020) [sssd[be[imsmx.intern]]] [dp_req_reply_std] (0x1000): DP Request [Account #35]: Returning [Success]: 0,0,Success (Wed Jan 15 13:31:03 2020) [sssd[be[imsmx.intern]]] [dp_table_value_destructor] (0x0400): Removing [0:1:0x0001:1::imsmx.intern:name=nnn@imsmx.intern] from reply table (Wed Jan 15 13:31:03 2020) [sssd[be[imsmx.intern]]] [dp_req_destructor] (0x0400): DP Request [Account #35]: Request removed. (Wed Jan 15 13:31:03 2020) [sssd[be[imsmx.intern]]] [dp_req_destructor] (0x0400): Number of active DP request: 0 (Wed Jan 15 13:31:03 2020) [sssd[be[imsmx.intern]]] [sdap_process_result] (0x2000): Trace: sh[0x55d411a00330], connected[1], ops[(nil)], ldap[0x55d4119e4300] (Wed Jan 15 13:31:03 2020) [sssd[be[imsmx.intern]]] [sdap_process_result] (0x2000): Trace: end of ldap_result list ### ### Prompt appears ### Here i have to wait 59 seconds for a prompt. Sometimes it is longer. A look with tcpdump shows only traffic on LDAP-ports. With ipa commands or ldapsearch i have no problems. Any idea why my problem happens? Thank you for any help. Detlev -- Detlev | Institut fuer Mikroelektronische Systeme Habicht | D-30167 Hannover +49 511 76219662 habicht(a)ims.uni-hannover.de --------+-------- Handy +49 172 5415752 ---------------------------

1 1

freeipa failing to start after update
by Andrew Meyer 20 Jan '20

20 Jan '20

I am running CentOS 8.x and have updated to the latest version of IPA and CentOS 8. I rebooted after updating and am now getting the following: Jan 20 12:55:29 freeipa01 server[7889]: arguments used: stop Jan 20 12:55:30 freeipa01 systemd[1]: Stopping 389 Directory Server ZONE1-EXAMPLE-NET.... Jan 20 12:55:30 freeipa01 ns-slapd[7385]: [20/Jan/2020:12:55:30.169315691 -0600] - INFO - op_thread_cleanup - slapd shutting down - signaling operation threads - op stack size 2 max work q size 2 max work q stack size 2 Jan 20 12:55:30 freeipa01 ns-slapd[7385]: [20/Jan/2020:12:55:30.396008349 -0600] - INFO - slapd_daemon - slapd shutting down - closing down internal subsystems and plugins Jan 20 12:55:30 freeipa01 ns-slapd[7385]: [20/Jan/2020:12:55:30.456826998 -0600] - INFO - dblayer_pre_close - Waiting for 4 database threads to stop Jan 20 12:55:30 freeipa01 server[7889]: SEVERE: Could not contact [localhost:[8005]]. Tomcat may not be running. Jan 20 12:55:30 freeipa01 server[7889]: SEVERE: Catalina.stop: Jan 20 12:55:30 freeipa01 server[7889]: java.net.ConnectException: Connection refused (Connection refused) Jan 20 12:55:30 freeipa01 server[7889]: #011at java.net.PlainSocketImpl.socketConnect(Native Method) Jan 20 12:55:30 freeipa01 server[7889]: #011at java.net.AbstractPlainSocketImpl.doConnect(AbstractPlainSocketImpl.java:350) Jan 20 12:55:30 freeipa01 server[7889]: #011at java.net.AbstractPlainSocketImpl.connectToAddress(AbstractPlainSocketImpl.java:206) Jan 20 12:55:30 freeipa01 server[7889]: #011at java.net.AbstractPlainSocketImpl.connect(AbstractPlainSocketImpl.java:188) Jan 20 12:55:30 freeipa01 server[7889]: #011at java.net.SocksSocketImpl.connect(SocksSocketImpl.java:392) Jan 20 12:55:30 freeipa01 server[7889]: #011at java.net.Socket.connect(Socket.java:607) Jan 20 12:55:30 freeipa01 server[7889]: #011at java.net.Socket.connect(Socket.java:556) Jan 20 12:55:30 freeipa01 server[7889]: #011at java.net.Socket.<init>(Socket.java:452) Jan 20 12:55:30 freeipa01 server[7889]: #011at java.net.Socket.<init>(Socket.java:229) Jan 20 12:55:30 freeipa01 server[7889]: #011at org.apache.catalina.startup.Catalina.stopServer(Catalina.java:498) Jan 20 12:55:30 freeipa01 server[7889]: #011at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) Jan 20 12:55:30 freeipa01 server[7889]: #011at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) Jan 20 12:55:30 freeipa01 server[7889]: #011at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) Jan 20 12:55:30 freeipa01 server[7889]: #011at java.lang.reflect.Method.invoke(Method.java:498) Jan 20 12:55:30 freeipa01 server[7889]: #011at org.apache.catalina.startup.Bootstrap.stopServer(Bootstrap.java:403) Jan 20 12:55:30 freeipa01 server[7889]: #011at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:494) Jan 20 12:55:30 freeipa01 systemd[1]: pki-tomcatd(a)pki-tomcat.service: Control process exited, code=exited status=1 Jan 20 12:55:31 freeipa01 systemd[1]: pki-tomcatd(a)pki-tomcat.service: Failed with result 'exit-code'. Jan 20 12:55:31 freeipa01 systemd[1]: Stopped PKI Tomcat Server pki-tomcat. Jan 20 12:55:31 freeipa01 ns-slapd[7385]: [20/Jan/2020:12:55:31.401012956 -0600] - INFO - dblayer_pre_close - All database threads now stopped Jan 20 12:55:31 freeipa01 ns-slapd[7385]: [20/Jan/2020:12:55:31.477064258 -0600] - INFO - ldbm_back_instance_set_destructor - Set of instances destroyed Jan 20 12:55:31 freeipa01 ns-slapd[7385]: [20/Jan/2020:12:55:31.485527687 -0600] - INFO - connection_post_shutdown_cleanup - slapd shutting down - freed 2 work q stack objects - freed 2 op stack objects Jan 20 12:55:31 freeipa01 ns-slapd[7385]: [20/Jan/2020:12:55:31.491338592 -0600] - INFO - main - slapd stopped.

3 4

Option to allow single-label domains
by Ronald Wimmer 20 Jan '20

20 Jan '20

Is there a possibility to allow ipa-server-install for a single-label domain? I would like to use IPA at home and will definitely never connect it to an AD. Cheers, Ronald

2 2

Re: sudo rule doesn't work
by Florence Blanc-Renaud 20 Jan '20

20 Jan '20

On 1/18/20 11:37 AM, Elhamsadat Azarian wrote: > Hi dear Florence > Thanks of ur reply > I wasnt at office and today i chacked parameteres but i cant find them > in sssd.conf! > How can i check or set values of them? Hi, (adding back freeipa-users mailing list) All the parameters are described in the man page for sssd.conf or sssd-ldap. If they are not set in /etc/sssd/sssd.conf, then the default value applies. flo > > On Mon, 13 Jan 2020, 12:21 Florence Blanc-Renaud, <flo(a)redhat.com > <mailto:flo@redhat.com>> wrote: > > On 1/13/20 9:38 AM, Elhamsadat Azarian wrote: > > I did it but doesnt wotk > > I think my sudo rule doesnt place on my hosts!!! > > > Hi, > > the sudorules can be cached on the host. Please check the following > SSSD > parameters: > - entry_cache_sudo_timeout -- How many seconds should sudo consider > rules valid before asking the backend again > - ldap_sudo_smart_refresh_interval -- How many seconds SSSD has to wait > before executing a smart refresh of sudo rules (which downloads all > rules that have USN higher than the highest USN of cached rules). > - ldap_sudo_full_refresh_interval -- How many seconds SSSD will wait > between executing a full refresh of sudo rules (which downloads all > rules that are stored on the server). > > HTH, > flo > > > On Mon, 13 Jan 2020, 11:57 Florence Blanc-Renaud, <flo(a)redhat.com > <mailto:flo@redhat.com> > > <mailto:flo@redhat.com <mailto:flo@redhat.com>>> wrote: > > > > On 1/13/20 8:57 AM, Elhamsadat Azarian wrote: > > > Hi Florence > > > Thanks i replaced but it doest work! > > > > > Hi, > > can you also replace the "RunAs group categoray: all" attr > with "RunAs > > User category: all"? > > flo > > > > > On Mon, 13 Jan 2020, 11:18 Florence Blanc-Renaud, > <flo(a)redhat.com <mailto:flo@redhat.com> > > <mailto:flo@redhat.com <mailto:flo@redhat.com>> > > > <mailto:flo@redhat.com <mailto:flo@redhat.com> > <mailto:flo@redhat.com <mailto:flo@redhat.com>>>> wrote: > > > > > > On 1/12/20 12:26 PM, Elhamsadat Azarian via > FreeIPA-users wrote: > > > > Hi friends > > > > i define a SudoRule with this properties: > > > > > > > > rulename : rsyslog_rule > > > > Enabled : true > > > > RunAs group Category : All > > > > users :user-test > > > > hosts: ipacli-irvlt01.mydomain.com > <http://ipacli-irvlt01.mydomain.com> > > <http://ipacli-irvlt01.mydomain.com> > > > <http://ipacli-irvlt01.mydomain.com> > > > > sudo Deny Commands : sudo /usr/bin/systemctl > restart rsyslog > > > > > > > > now i login with "user-test" into "ipacli-irvlt01" > server > > and i > > > try to run " sudo /usr/bin/systemctl restart rsyslog" > command. i > > > expected to doesnt allow to run this command but no action > > happend > > > and i could run it!!! > > > > > > > > why my sudo rule doesnt work? > > > Hi, > > > > > > can you try to replace the "sudo deny commands": "sudo > > > /usr/bin/systemctl restart rsyslog" with > "/usr/bin/systemctl > > restart > > > rsyslog" ? > > > > > > thanks, > > > flo > > > > > > > > > > > > ---------------------------------------------------------- > > > > this is less /var/log/sssd/sssd_domain.log: > > > > (Sun Jan 12 13:59:01 2020) [sssd[be[lshs.dc]]] > > [orderly_shutdown] > > > (0x0010): SIGTERM: killing children > > > > > ---------------------------------------------------------- > > > > this is /var/log/sssd/sssd_sudo.log > > > > (Sun Jan 12 13:59:01 2020) [sssd[sudo]] > [orderly_shutdown] > > > (0x0010): SIGTERM: killing children > > > > > > > > > ---------------------------------------------------------- > > > > this is less /var/log/sudo_debug > > > > Jan 12 14:19:27 sudo[17370] /etc/sudoers:53 > CMNDALIAS ALIAS = > > > COMMAND , COMMAND ARG , COMMAND ARG > > > > Jan 12 14:19:27 sudo[17370] -> alias_add @ > ./alias.c:120 > > > > Jan 12 14:19:27 sudo[17370] -> rcstr_addref @ > ./rcstr.c:81 > > > > Jan 12 14:19:27 sudo[17370] <- rcstr_addref @ > ./rcstr.c:88 := > > > 0x55f2968e7714 > > > > Jan 12 14:19:27 sudo[17370] -> rbinsert @ > ./redblack.c:177 > > > > Jan 12 14:19:27 sudo[17370] -> alias_compare @ > ./alias.c:54 > > > > Jan 12 14:19:27 sudo[17370] <- alias_compare @ > > ./alias.c:62 := -13 > > > > Jan 12 14:19:27 sudo[17370] -> alias_compare @ > ./alias.c:54 > > > > Jan 12 14:19:27 sudo[17370] <- alias_compare @ > > ./alias.c:62 := -6 > > > > Jan 12 14:19:27 sudo[17370] -> alias_compare @ > ./alias.c:54 > > > > Jan 12 14:19:27 sudo[17370] <- alias_compare @ > > ./alias.c:62 := -6 > > > > Jan 12 14:19:27 sudo[17370] -> rotate_right @ > ./redblack.c:147 > > > > Jan 12 14:19:27 sudo[17370] <- rotate_right @ > ./redblack.c:163 > > > > Jan 12 14:19:27 sudo[17370] <- rbinsert @ > ./redblack.c:265 > > := 0 > > > > Jan 12 14:19:27 sudo[17370] <- alias_add @ > ./alias.c:143 > > := (null) > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ > > ./lbuf.c:159 > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ > ./lbuf.c:69 > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ > > ./lbuf.c:87 := true > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ > > ./lbuf.c:190 > > > := true > > > > Jan 12 14:19:27 sudo[17370] -> fill_txt @ > ./toke_util.c:52 > > > > Jan 12 14:19:27 sudo[17370] <- fill_txt @ > ./toke_util.c:80 > > := true > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ > > ./lbuf.c:159 > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ > ./lbuf.c:69 > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ > > ./lbuf.c:87 := true > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ > > ./lbuf.c:190 > > > := true > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ > > ./lbuf.c:159 > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ > ./lbuf.c:69 > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ > > ./lbuf.c:87 := true > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ > > ./lbuf.c:190 > > > := true > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ > > ./lbuf.c:159 > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ > ./lbuf.c:69 > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ > > ./lbuf.c:87 := true > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ > > ./lbuf.c:190 > > > := true > > > > Jan 12 14:19:27 sudo[17370] -> fill_cmnd @ > ./toke_util.c:103 > > > > Jan 12 14:19:27 sudo[17370] <- fill_cmnd @ > > ./toke_util.c:124 := true > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ > > ./lbuf.c:159 > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ > ./lbuf.c:69 > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ > > ./lbuf.c:87 := true > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ > > ./lbuf.c:190 > > > := true > > > > Jan 12 14:19:27 sudo[17370] -> fill_args @ > ./toke_util.c:132 > > > > Jan 12 14:19:27 sudo[17370] <- fill_args @ > > ./toke_util.c:162 := true > > > > Jan 12 14:19:27 sudo[17370] -> new_member @ gram.y:956 > > > > Jan 12 14:19:27 sudo[17370] <- new_member @ > gram.y:968 := > > > 0x55f2968ff550 > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ > > ./lbuf.c:159 > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ > ./lbuf.c:69 > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ > > ./lbuf.c:87 := true > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ > > ./lbuf.c:190 > > > := true > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ > > ./lbuf.c:159 > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ > ./lbuf.c:69 > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ > > ./lbuf.c:87 := true > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ > > ./lbuf.c:190 > > > := true > > > > Jan 12 14:19:27 sudo[17370] -> fill_cmnd @ > ./toke_util.c:103 > > > > Jan 12 14:19:27 sudo[17370] <- fill_cmnd @ > > ./toke_util.c:124 := true > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ > > ./lbuf.c:159 > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ > ./lbuf.c:69 > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ > > ./lbuf.c:87 := true > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ > > ./lbuf.c:190 > > > := true > > > > Jan 12 14:19:27 sudo[17370] -> fill_args @ > ./toke_util.c:132 > > > > Jan 12 14:19:27 sudo[17370] <- fill_args @ > > ./toke_util.c:162 := true > > > > Jan 12 14:19:27 sudo[17370] -> new_member @ gram.y:956 > > > > Jan 12 14:19:27 sudo[17370] <- new_member @ > gram.y:968 := > > > 0x55f2968ff650 > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ > > ./lbuf.c:159 > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ > ./lbuf.c:69 > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ > > ./lbuf.c:87 := true > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ > > ./lbuf.c:190 > > > := true > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ > > ./lbuf.c:159 > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ > ./lbuf.c:69 > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ > > ./lbuf.c:87 := true > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ > > ./lbuf.c:190 > > > := true > > > > Jan 12 14:19:27 sudo[17370] -> fill_cmnd @ > ./toke_util.c:103 > > > > Jan 12 14:19:27 sudo[17370] <- fill_cmnd @ > > ./toke_util.c:124 := true > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ > > ./lbuf.c:159 > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ > ./lbuf.c:69 > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ > > ./lbuf.c:87 := true > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ > > ./lbuf.c:190 > > > := true > > > > Jan 12 14:19:27 sudo[17370] -> fill_args @ > ./toke_util.c:132 > > > > Jan 12 14:19:27 sudo[17370] <- fill_args @ > > ./toke_util.c:162 := true > > > > Jan 12 14:19:27 sudo[17370] -> new_member @ gram.y:956 > > > > Jan 12 14:19:27 sudo[17370] <- new_member @ > gram.y:968 := > > > 0x55f2968ff750 > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ > > ./lbuf.c:159 > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ > ./lbuf.c:69 > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ > > ./lbuf.c:87 := true > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ > > ./lbuf.c:190 > > > := true > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ > > ./lbuf.c:159 > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ > ./lbuf.c:69 > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ > > ./lbuf.c:87 := true > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ > > ./lbuf.c:190 > > > := true > > > > Jan 12 14:19:27 sudo[17370] -> fill_cmnd @ > ./toke_util.c:103 > > > > Jan 12 14:19:27 sudo[17370] <- fill_cmnd @ > > ./toke_util.c:124 := true > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ > > ./lbuf.c:159 > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ > ./lbuf.c:69 > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ > > ./lbuf.c:87 := true > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ > > ./lbuf.c:190 > > > := true > > > > Jan 12 14:19:27 sudo[17370] -> fill_args @ > ./toke_util.c:132 > > > > Jan 12 14:19:27 sudo[17370] <- fill_args @ > > ./toke_util.c:162 := true > > > > Jan 12 14:19:27 sudo[17370] -> new_member @ gram.y:956 > > > > Jan 12 14:19:27 sudo[17370] <- new_member @ > gram.y:968 := > > > 0x55f2968ff850 > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ > > ./lbuf.c:159 > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ > ./lbuf.c:69 > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ > > ./lbuf.c:87 := true > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ > > ./lbuf.c:190 > > > := true > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ > > ./lbuf.c:159 > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ > ./lbuf.c:69 > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ > > ./lbuf.c:87 := true > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ > > ./lbuf.c:190 > > > := true > > > > Jan 12 14:19:27 sudo[17370] -> fill_cmnd @ > ./toke_util.c:103 > > > > Jan 12 14:19:27 sudo[17370] <- fill_cmnd @ > > ./toke_util.c:124 := true > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ > > ./lbuf.c:159 > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ > ./lbuf.c:69 > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ > > ./lbuf.c:87 := true > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ > > ./lbuf.c:190 > > > := true > > > > Jan 12 14:19:27 sudo[17370] -> fill_args @ > ./toke_util.c:132 > > > > Jan 12 14:19:27 sudo[17370] <- fill_args @ > > ./toke_util.c:162 := true > > > > Jan 12 14:19:27 sudo[17370] -> new_member @ gram.y:956 > > > > Jan 12 14:19:27 sudo[17370] <- new_member @ > gram.y:968 := > > > 0x55f2968ff950 > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ > > ./lbuf.c:159 > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ > ./lbuf.c:69 > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ > > ./lbuf.c:87 := true > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ > > ./lbuf.c:190 > > > := true > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ > > ./lbuf.c:159 > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ > ./lbuf.c:69 > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ > > ./lbuf.c:87 := true > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ > > ./lbuf.c:190 > > > := true > > > > Jan 12 14:19:27 sudo[17370] -> fill_cmnd @ > ./toke_util.c:103 > > > > Jan 12 14:19:27 sudo[17370] <- fill_cmnd @ > > ./toke_util.c:124 := true > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ > > ./lbuf.c:159 > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ > ./lbuf.c:69 > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ > > ./lbuf.c:87 := true > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ > > ./lbuf.c:190 > > > := true > > > > Jan 12 14:19:27 sudo[17370] -> fill_args @ > ./toke_util.c:132 > > > > Jan 12 14:19:27 sudo[17370] <- fill_args @ > > ./toke_util.c:162 := true > > > > Jan 12 14:19:27 sudo[17370] -> new_member @ gram.y:956 > > > > Jan 12 14:19:27 sudo[17370] <- new_member @ > gram.y:968 := > > > 0x55f2968ffa50 > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ > > ./lbuf.c:159 > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ > ./lbuf.c:69 > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ > > ./lbuf.c:87 := true > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ > > ./lbuf.c:190 > > > := true > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ > > ./lbuf.c:159 > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ > ./lbuf.c:69 > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ > > ./lbuf.c:87 := true > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ > > ./lbuf.c:190 > > > := true > > > > Jan 12 14:19:27 sudo[17370] -> fill_cmnd @ > ./toke_util.c:103 > > > > Jan 12 14:19:27 sudo[17370] <- fill_cmnd @ > > ./toke_util.c:124 := true > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ > > ./lbuf.c:159 > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ > ./lbuf.c:69 > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ > > ./lbuf.c:87 := true > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ > > ./lbuf.c:190 > > > := true > > > > Jan 12 14:19:27 sudo[17370] -> fill_args @ > ./toke_util.c:132 > > > > Jan 12 14:19:27 sudo[17370] <- fill_args @ > > ./toke_util.c:162 := true > > > > Jan 12 14:19:27 sudo[17370] -> new_member @ gram.y:956 > > > > Jan 12 14:19:27 sudo[17370] <- new_member @ > gram.y:968 := > > > 0x55f2968ffb50 > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ > > ./lbuf.c:159 > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ > ./lbuf.c:69 > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ > > ./lbuf.c:87 := true > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ > > ./lbuf.c:190 > > > := true > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ > > ./lbuf.c:159 > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ > ./lbuf.c:69 > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ > > ./lbuf.c:87 := true > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ > > ./lbuf.c:190 > > > := true > > > > Jan 12 14:19:27 sudo[17370] -> fill_cmnd @ > ./toke_util.c:103 > > > > Jan 12 14:19:27 sudo[17370] <- fill_cmnd @ > > ./toke_util.c:124 := true > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ > > ./lbuf.c:159 > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ > ./lbuf.c:69 > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ > > ./lbuf.c:87 := true > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ > > ./lbuf.c:190 > > > := true > > > > Jan 12 14:19:27 sudo[17370] -> fill_args @ > ./toke_util.c:132 > > > > Jan 12 14:19:27 sudo[17370] <- fill_args @ > > ./toke_util.c:162 := true > > > > Jan 12 14:19:27 sudo[17370] -> new_member @ gram.y:956 > > > > Jan 12 14:19:27 sudo[17370] <- new_member @ > gram.y:968 := > > > 0x55f2968ffc50 > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ > > ./lbuf.c:159 > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ > ./lbuf.c:69 > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ > > ./lbuf.c:87 := true > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ > > ./lbuf.c:190 > > > := true > > > > Jan 12 14:19:27 sudo[17370] /etc/sudoers:54 > CMNDALIAS ALIAS = > > > COMMAND ARG , COMMAND ARG , COMMAND ARG , COMMAND ARG , > > COMMAND ARG > > > , COMMAND ARG , COMMAND ARG , COMMAND ARG > > > > Jan 12 14:19:27 sudo[17370] -> alias_add @ > ./alias.c:120 > > > > Jan 12 14:19:27 sudo[17370] -> rcstr_addref @ > ./rcstr.c:81 > > > > Jan 12 14:19:27 sudo[17370] <- rcstr_addref @ > ./rcstr.c:88 := > > > 0x55f2968e7714 > > > > Jan 12 14:19:27 sudo[17370] -> rbinsert @ > ./redblack.c:177 > > > > Jan 12 14:19:27 sudo[17370] -> alias_compare @ > ./alias.c:54 > > > > Jan 12 14:19:27 sudo[17370] <- alias_compare @ > > ./alias.c:62 := 7 > > > > Jan 12 14:19:27 sudo[17370] -> alias_compare @ > ./alias.c:54 > > > > Jan 12 14:19:27 sudo[17370] <- alias_compare @ > > ./alias.c:62 := -3 > > > > Jan 12 14:19:27 sudo[17370] -> alias_compare @ > ./alias.c:54 > > > > Jan 12 14:19:27 sudo[17370] <- alias_compare @ > > ./alias.c:62 := -3 > > > > Jan 12 14:19:27 sudo[17370] <- rbinsert @ > ./redblack.c:265 > > := 0 > > > > Jan 12 14:19:27 sudo[17370] <- alias_add @ > ./alias.c:143 > > := (null) > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ > > ./lbuf.c:159 > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ > ./lbuf.c:69 > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ > > ./lbuf.c:87 := true > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ > > ./lbuf.c:190 > > > := true > > > > Jan 12 14:19:27 sudo[17370] -> fill_txt @ > ./toke_util.c:52 > > > > Jan 12 14:19:27 sudo[17370] <- fill_txt @ > ./toke_util.c:80 > > := true > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ > > ./lbuf.c:159 > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ > ./lbuf.c:69 > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ > > ./lbuf.c:87 := true > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ > > ./lbuf.c:190 > > > := true > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ > > ./lbuf.c:159 > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ > ./lbuf.c:69 > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ > > ./lbuf.c:87 := true > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ > > ./lbuf.c:190 > > > := true > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ > > ./lbuf.c:159 > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ > ./lbuf.c:69 > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ > > ./lbuf.c:87 := true > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ > > ./lbuf.c:190 > > > := true > > > > Jan 12 14:19:27 sudo[17370] -> fill_cmnd @ > ./toke_util.c:103 > > > > Jan 12 14:19:27 sudo[17370] <- fill_cmnd @ > > ./toke_util.c:124 := true > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ > > ./lbuf.c:159 > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ > ./lbuf.c:69 > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ > > ./lbuf.c:87 := true > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ > > ./lbuf.c:190 > > > := true > > > > Jan 12 14:19:27 sudo[17370] -> fill_args @ > ./toke_util.c:132 > > > > Jan 12 14:19:27 sudo[17370] <- fill_args @ > > ./toke_util.c:162 := true > > > > Jan 12 14:19:27 sudo[17370] -> new_member @ gram.y:956 > > > > Jan 12 14:19:27 sudo[17370] <- new_member @ > gram.y:968 := > > > 0x55f2968ffdd0 > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ > > ./lbuf.c:159 > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ > ./lbuf.c:69 > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ > > ./lbuf.c:87 := true > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ > > ./lbuf.c:190 > > > := true > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ > > ./lbuf.c:159 > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ > ./lbuf.c:69 > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ > > ./lbuf.c:87 := true > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ > > ./lbuf.c:190 > > > := true > > > > Jan 12 14:19:27 sudo[17370] -> fill_cmnd @ > ./toke_util.c:103 > > > > Jan 12 14:19:27 sudo[17370] <- fill_cmnd @ > > ./toke_util.c:124 := true > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ > > ./lbuf.c:159 > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ > ./lbuf.c:69 > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ > > ./lbuf.c:87 := true > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ > > ./lbuf.c:190 > > > := true > > > > Jan 12 14:19:27 sudo[17370] -> fill_args @ > ./toke_util.c:132 > > > > Jan 12 14:19:27 sudo[17370] <- fill_args @ > > ./toke_util.c:162 := true > > > > Jan 12 14:19:27 sudo[17370] -> new_member @ gram.y:956 > > > > Jan 12 14:19:27 sudo[17370] <- new_member @ > gram.y:968 := > > > 0x55f2968ffed0 > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ > > ./lbuf.c:159 > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ > ./lbuf.c:69 > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ > > ./lbuf.c:87 := true > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ > > ./lbuf.c:190 > > > := true > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ > > ./lbuf.c:159 > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ > ./lbuf.c:69 > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ > > ./lbuf.c:87 := true > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ > > ./lbuf.c:190 > > > := true > > > > Jan 12 14:19:27 sudo[17370] -> fill_cmnd @ > ./toke_util.c:103 > > > > Jan 12 14:19:27 sudo[17370] <- fill_cmnd @ > > ./toke_util.c:124 := true > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ > > ./lbuf.c:159 > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ > ./lbuf.c:69 > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ > > ./lbuf.c:87 := true > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ > > ./lbuf.c:190 > > > := true > > > > Jan 12 14:19:27 sudo[17370] -> fill_args @ > ./toke_util.c:132 > > > > Jan 12 14:19:27 sudo[17370] <- fill_args @ > > ./toke_util.c:162 := true > > > > Jan 12 14:19:27 sudo[17370] -> new_member @ gram.y:956 > > > > Jan 12 14:19:27 sudo[17370] <- new_member @ > gram.y:968 := > > > 0x55f2968fffd0 > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ > > ./lbuf.c:159 > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ > ./lbuf.c:69 > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ > > ./lbuf.c:87 := true > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ > > ./lbuf.c:190 > > > := true > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ > > ./lbuf.c:159 > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ > ./lbuf.c:69 > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ > > ./lbuf.c:87 := true > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ > > ./lbuf.c:190 > > > := true > > > > Jan 12 14:19:27 sudo[17370] -> fill_cmnd @ > ./toke_util.c:103 > > > > Jan 12 14:19:27 sudo[17370] <- fill_cmnd @ > > ./toke_util.c:124 := true > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ > > ./lbuf.c:159 > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ > ./lbuf.c:69 > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ > > ./lbuf.c:87 := true > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ > > ./lbuf.c:190 > > > := true > > > > Jan 12 14:19:27 sudo[17370] -> fill_args @ > ./toke_util.c:132 > > > > Jan 12 14:19:27 sudo[17370] <- fill_args @ > > ./toke_util.c:162 := true > > > > Jan 12 14:19:27 sudo[17370] -> new_member @ gram.y:956 > > > > Jan 12 14:19:27 sudo[17370] <- new_member @ > gram.y:968 := > > > 0x55f2969000d0 > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ > > ./lbuf.c:159 > > > > Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ > ./lbuf.c:69 > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ > > ./lbuf.c:87 := true > > > > Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ > > ./lbuf.c:190 > > > := true > > > > Jan 12 14:19:27 sudo[17370] /etc/sudoers:55 > CMNDALIAS ALIAS = > > > COMMAND ARG , COMMAND ARG , COMMAND ARG , COMMAND ARG > > > > Jan 12 14:19:27 sudo[17370] -> alias_add @ > ./alias.c:120 > > > > Jan 12 14:19:27 sudo[17370] -> rcstr_addref @ > ./rcstr.c:81 > > > > Jan 12 14:19:27 sudo[17370] <- rcstr_addref @ > ./rcstr.c:88 := > > > 0x55f2968e7714 > > > > Jan 12 14:19:27 sudo[17370] -> rbinsert @ > ./redblack.c:177 > > > > Jan 12 14:19:27 sudo[17370] -> alias_compare @ > ./alias.c:54 > > > > Jan 12 14:19:27 sudo[17370] <- alias_compare @ > > ./alias.c:62 := -10 > > > > Jan 12 14:19:27 sudo[17370] -> alias_compare @ > ./alias.c:54 > > > > Jan 12 14:19:27 sudo[17370] <- alias_compare @ > > ./alias.c:62 := -4 > > > > _______________________________________________ > > > > FreeIPA-users mailing list -- > > > freeipa-users(a)lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org> > > <mailto:freeipa-users@lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org>> > > > <mailto:freeipa-users@lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org> > > <mailto:freeipa-users@lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org>>> > > > > To unsubscribe send an email to > > > freeipa-users-leave(a)lists.fedorahosted.org > <mailto:freeipa-users-leave@lists.fedorahosted.org> > > <mailto:freeipa-users-leave@lists.fedorahosted.org > <mailto:freeipa-users-leave@lists.fedorahosted.org>> > > > <mailto:freeipa-users-leave@lists.fedorahosted.org > <mailto:freeipa-users-leave@lists.fedorahosted.org> > > <mailto:freeipa-users-leave@lists.fedorahosted.org > <mailto:freeipa-users-leave@lists.fedorahosted.org>>> > > > > Fedora Code of Conduct: > > > https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > > > > List Guidelines: > > > https://fedoraproject.org/wiki/Mailing_list_guidelines > > > > List Archives: > > > > > > https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost… > > > > > > > > > >

1 0

WARNING Could not update DNS SSHFP records.
by Ron Blom 20 Jan '20

20 Jan '20

Hi, We have problems with client’s registering dns records at enrollment. Most of the time all works ok but about 10% of the machines don’t create the A records or the SHHFP records. Sometimes they don’t create both. In the ipaclient-install.log we see the following on machines that doesn’t create the records. In this example the creation of the A records succeeded but the creation of the SSHFP records failed with the following error: 2019-12-20T13:19:51Z INFO Adding SSH public key from /etc/ssh/ssh_host_rsa_key.pub 2019-12-20T13:19:51Z INFO Adding SSH public key from /etc/ssh/ssh_host_ecdsa_key.pub 2019-12-20T13:19:51Z INFO Adding SSH public key from /etc/ssh/ssh_host_ed25519_key.pub 2019-12-20T13:19:51Z INFO [try 1]: Forwarding 'host_mod' to json server 'https://freeipa-002.ipa.cloud/ipa/session/json' 2019-12-20T13:19:51Z DEBUG HTTP connection keep-alive (freeipa-002.ipa.cloud) 2019-12-20T13:19:51Z DEBUG received Set-Cookie (<type 'list'>)'['ipa_session=MagBearerToken=tR1VkWrpjmoNh7aZDYiPzXSwFlkhsp1ENg%2b5y8orMo9P7EkiLQXey11TH9wIgc2xJjJ2xdly2hFyi6v58o2HhzEeQBi%2fcR%2flZ7nwFv8VX3WxCSwS%2beDVSu7%2f%2fjsSB%2b1NzyVHTNe5jkJK9pGXL1nR7QMtNrV2gFY7RyFrJns50dEC%2fi5C%2fEn0BgZAE4aLAiThG4SW3iGc0bfOGy%2bDpAGE17XzB8G978uKpqqHGC9aFDmMmXVFCfpwHoIWoBtJctgy7y6Q97rJnpkjbe2heYMwLQFbDkrTRlrjSDfla0XXCNvd7in6zEu0MZloOXqyXHiu;path=/ipa;httponly;secure;']' 2019-12-20T13:19:51Z DEBUG storing cookie 'ipa_session=MagBearerToken=tR1VkWrpjmoNh7aZDYiPzXSwFlkhsp1ENg%2b5y8orMo9P7EkiLQXey11TH9wIgc2xJjJ2xdly2hFyi6v58o2HhzEeQBi%2fcR%2flZ7nwFv8VX3WxCSwS%2beDVSu7%2f%2fjsSB%2b1NzyVHTNe5jkJK9pGXL1nR7QMtNrV2gFY7RyFrJns50dEC%2fi5C%2fEn0BgZAE4aLAiThG4SW3iGc0bfOGy%2bDpAGE17XzB8G978uKpqqHGC9aFDmMmXVFCfpwHoIWoBtJctgy7y6Q97rJnpkjbe2heYMwLQFbDkrTRlrjSDfla0XXCNvd7in6zEu0MZloOXqyXHiu;' for principal host/adm-sdrn6419-2062.aal.ipa.cloud(a)RINIS.CLOUD 2019-12-20T13:19:51Z DEBUG Writing nsupdate commands to /etc/ipa/.dns_update.txt: 2019-12-20T13:19:51Z DEBUG debug update delete adm-sdrn6419-2062.aal.ipa.cloud. IN SSHFP show send update add adm-sdrn6419-2062.aal.ipa.cloud. 1200 IN SSHFP 1 1 6134C7CDE12FDDFA33A068A273941697928FBCD7 update add adm-sdrn6419-2062.aal.ipa.cloud. 1200 IN SSHFP 1 2 2F41772E6CAD9C328730BFCED0E27350A6C20DE8499E60158635ED8419BF2022 update add adm-sdrn6419-2062.aal.ipa.cloud. 1200 IN SSHFP 3 1 FFE99F20A5C32D857535D13425A7F85F3A63E198 update add adm-sdrn6419-2062.aal.ipa.cloud. 1200 IN SSHFP 3 2 D2C7FC741E834D4E1FE51B7867AFA2D34D0685C769D9019D98093E01C8312118 update add adm-sdrn6419-2062.aal.ipa.cloud. 1200 IN SSHFP 4 1 ED5416B39F419E4F631AB6C9A9CFC0139907232E update add adm-sdrn6419-2062.aal.ipa.cloud. 1200 IN SSHFP 4 2 7794DBAA391B2939476EDD3A0173162F9CD3BBE1E16B52754BB8C6B56DA26435 show send 2019-12-20T13:19:51Z DEBUG Starting external process 2019-12-20T13:19:51Z DEBUG args=/usr/bin/nsupdate -g /etc/ipa/.dns_update.txt 2019-12-20T13:19:51Z DEBUG Process finished, return code=1 2019-12-20T13:19:51Z DEBUG stdout=Outgoing update query: ;; ->>HEADER<<- opcode: UPDATE, status: NOERROR, id: 0 ;; flags:; ZONE: 0, PREREQ: 0, UPDATE: 0, ADDITIONAL: 0 ;; UPDATE SECTION: adm-sdrn6419-2062.aal.ipa.cloud. 0 ANY SSHFP Outgoing update query: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 22636 ;; flags:; QUESTION: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1 ;; QUESTION SECTION: ;3648384014.sig-freeipa-001.ipa.cloud. ANY TKEY ;; ADDITIONAL SECTION: 3648384014.sig-freeipa-001.ipa.cloud. 0 ANY TKEY gss-tsig. 1576847991 1576847991 3 NOERROR 677 YIICoQYJKoZIhvcSAQICAQBuggKQMIICjKADAgEFoQMCAQ6iBwMFACAA AACjggGCYYIBfjCCAXqgAwIBBaENGwtSSU5JUy5DTE9VRKIpMCegAwIB AaEgMB4bA0ROUxsXYWRtLWFhYS0wMDEucmluaXMuY2xvdWSjggE3MIIB M6ADAgESoQMCAQKiggElBIIBIWJzJaNElw4aQs2ZFHDopnUdH6vqowdG ojmiCBIpmgFjPsHEl98zY+UX6OqfF3ovB/uMAuCF1eq3spIRtPjb7hUO +lva9UtuvUJSV0pT9WI1B0ROZxzspkBQmZEYLRUCACxjW3Kw1F123ryy Ga4JJ4cROOFf1GtTdEW3CmIJLlyKqWXDFSQzgnqvP/acb0mQIr0Wid6P DJFaxYmm+uRHw5KBTg7hjeAQPFwgZxNdardv9hUvfhzElxtOK0Kj3ZDy 9lFdpemEtO+osfnwrwyX28xWGLZds/Gfpy0kfdihkUxT082eTWNftaE7 dX0LOb46j9sbMAFDbgHESCkXq5VFRBmtotnf3SRru/eBQFdbYq0/o/oY PCmaTJ4HSymhjbkrVVqkgfAwge2gAwIBEqKB5QSB4tPwDLt7qpKesLJg lGFXpoNqHOsGlFheQslzzkcWzjgoJDDRSJtjoaLgLFv0cITj+rr4dXcu tdMNESwRObXQofsbO9E0HYfZWijSDEIVJlXETm+x8ca4Qf938u3RHV/U +ZXmepZIBnMR4d70Vo+vz6CuXt0+HI0Dh6ot2whzX5g0MWHI0SfJElhO pgWN59uMUC4E8HtLzNEoWljX25acK3mi8ZBgq8iFihfObfEP0Xmx11NE Gru9QOiwMoxRUblws44U3sNOFRUgF9Ua3kKWXEfJ4wpPC3GwdMUajMkr V3wCXBc= 0 2019-12-20T13:19:51Z DEBUG stderr=Reply from SOA query: ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 13244 ;; flags: qr aa rd ra; QUESTION: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0 ;; QUESTION SECTION: ;adm-sdrn6419-2062.aal.ipa.cloud. IN SOA ;; AUTHORITY SECTION: aal.ipa.cloud. 0 IN SOA freeipa-001.ipa.cloud. hostmaster.aal.ipa.cloud. 1576848002 3600 60 1209600 60 Found zone name: aal.ipa.cloud The master is: freeipa-001.ipa.cloud start_gssrequest Found realm from ticket: RINIS.CLOUD send_gssrequest recvmsg reply from GSS-TSIG query ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 22636 ;; flags: qr ra; QUESTION: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0 ;; QUESTION SECTION: ;3648384014.sig-freeipa-001.ipa.cloud. ANY TKEY ;; ANSWER SECTION: 3648384014.sig-freeipa-001.ipa.cloud. 0 ANY TKEY gss-tsig. 0 0 3 BADNAME 0 0 dns_tkey_gssnegotiate: TKEY is unacceptable 2019-12-20T13:19:51Z DEBUG nsupdate failed: Command '/usr/bin/nsupdate -g /etc/ipa/.dns_update.txt' returned non-zero exit status 1 2019-12-20T13:19:51Z WARNING Could not update DNS SSHFP records. When I run the nsupdate command manually after enrollment it will succeed and add the missing records. any ideas?

3 2

Re: FreeIPA ipa-replica-install hangs on "No status yet" during the first replication
by Florence Blanc-Renaud 19 Jan '20

19 Jan '20

On 1/17/20 4:32 PM, Damien Bras via FreeIPA-users wrote: > Hi, > > During the installation of one of our FreeIPA replica (with > ipa-replica-install), the process hangs on "No status yet". > > Our domain is in domain level 1. > > It seems that the script is waiting for an attribute > nsds5ReplicaLastInitStatus. > > The master server is up & running and we want to have a multimaster > environment. > > We don't find any error related to the replication process in the log. > > The version installed: 4.6.5-11.0.1.el7_7.3 > > First, the ipa client is correctly installed on the server. Then we use > the comment ipa-replica-install to promote it as IPA server with: > > ipa-replica-install -U --principal admin --admin-password > $admin_password --domain domain.com --server server2.domain.com > --setup-ca --setup-dns --no-forwarders --forward-policy=first > --no-dnssec-validation --allow-zone-overlap > --reverse-zone=xx.xx.in-addr.arpa --mkhomedir --force-join > > In the ipareplica-install.log we just have this: > > … > > 2020-01-17T10:25:46Z DEBUG [28/41]: setting up initial replication > > 2020-01-17T10:25:46Z DEBUG retrieving schema for SchemaCache > url=ldapi://%2fvar%2frun%2fslapd-DOMAIN-COM.socket > conn=<ldap.ldapobject.SimpleLDAPObject instance at 0x7f2c94db6248> > > 2020-01-17T10:25:47Z DEBUG Destroyed connection > context.ldap2_139829518113296 > > 2020-01-17T10:25:47Z DEBUG Starting external process > > 2020-01-17T10:25:47Z DEBUG args=/bin/systemctl --system daemon-reload > > 2020-01-17T10:25:47Z DEBUG Process finished, return code=0 > > 2020-01-17T10:25:47Z DEBUG stdout= > > 2020-01-17T10:25:47Z DEBUG stderr= > > 2020-01-17T10:25:47Z DEBUG Starting external process > > 2020-01-17T10:25:47Z DEBUG args=/bin/systemctl restart > dirsrv(a)DOMAIN-COM.service > > 2020-01-17T10:25:53Z DEBUG Process finished, return code=0 > > 2020-01-17T10:25:53Z DEBUG stdout= > > 2020-01-17T10:25:53Z DEBUG stderr= > > 2020-01-17T10:25:53Z DEBUG Restart of > dirsrv(a)HS2-VDC-CORP-HOMESEND-COM.service complete > > 2020-01-17T10:25:53Z DEBUG Created connection context.ldap2_139829518113296 > > 2020-01-17T10:25:53Z DEBUG Fetching nsDS5ReplicaId from master [attempt 1/5] > > 2020-01-17T10:25:53Z DEBUG retrieving schema for SchemaCache > url=ldap://server2.domain.com:389 conn=<ldap.ldapobject.SimpleLDAPObject > instance at 0x7f2c95da8320> > > 2020-01-17T10:25:54Z DEBUG Successfully updated nsDS5ReplicaId. > > 2020-01-17T10:25:54Z DEBUG Add or update replica config > cn=replica,cn=dc\=domain\,dc\=com,cn=mapping tree,cn=config > > 2020-01-17T10:25:54Z DEBUG Added replica config > cn=replica,cn=dc\=domain\,dc\=com,cn=mapping tree,cn=config > > 2020-01-17T10:25:54Z DEBUG Add or update replica config > cn=replica,cn=dc\=domain\,dc\=com,cn=mapping tree,cn=config > > 2020-01-17T10:25:54Z DEBUG No update to > cn=replica,cn=dc\=domain\,dc\=com,cn=mapping tree,cn=config necessary > > 2020-01-17T10:25:54Z DEBUG Waiting for replication > (ldapi://%2fvar%2frun%2fslapd-DOMAIN-COM.socket) > cn=meToserver2.domain.com,cn=replica,cn=dc\=domain\,dc\=com,cn=mapping > tree,cn=config (objectclass=*) > > 2020-01-17T10:25:54Z DEBUG Entry found > [LDAPEntry(ipapython.dn.DN('cn=meToserver2.domain.com,cn=replica,cn=dc\=domain\,dc\=com,cn=mapping > tree,cn=config'), {u'nsds5replicaLastInitStart': ['19700101000000Z'], > u'nsds5replicaUpdateInProgress': ['FALSE'], u'cn': > ['meToserver2.domain.com'], u'objectClass': > ['nsds5replicationagreement', 'top'], u'nsds5replicaLastUpdateEnd': > ['19700101000000Z'], u'nsDS5ReplicaRoot': ['dc=domain,dc=com'], > u'nsDS5ReplicaHost': ['server2.domain.com'], > u'nsds5replicaLastUpdateStatus': ['Error (0) No replication sessions > started since server startup'], u'nsDS5ReplicaBindMethod': > ['SASL/GSSAPI'], u'nsds5ReplicaStripAttrs': ['modifiersName > modifyTimestamp internalModifiersName internalModifyTimestamp'], > u'nsds5replicaLastUpdateStart': ['19700101000000Z'], > u'nsDS5ReplicaPort': ['389'], u'nsDS5ReplicaTransportInfo': ['LDAP'], > u'description': ['me to server2.domain.com'], u'nsds5replicareapactive': > ['0'], u'nsds5replicaChangesSentSinceStartup': [''], > u'nsds5replicaTimeout': ['120'], u'nsDS5ReplicatedAttributeList': > ['(objectclass=*) $ EXCLUDE memberof idnssoaserial entryusn > krblastsuccessfulauth krblastfailedauth krbloginfailedcount'], > u'nsds5replicaLastInitEnd': ['19700101000000Z'], > u'nsDS5ReplicatedAttributeListTotal': ['(objectclass=*) $ EXCLUDE > entryusn krblastsuccessfulauth krblastfailedauth krbloginfailedcount']})] > Hi, can you also paste the lines that contain the install error? > On the live master, there is a strange behavior also: > > It seems the ldap is like in read only mode. For exemple, if I reset the > password of an account, I don’t have any error but nothing happened. > > I have also those errors on this server: > > Jan 17 16:27:57 hs2-man-idm-02 ns-slapd: [17/Jan/2020:16:27:57.102642397 > +0100] - ERR - csngen_adjust_time - Adjustment limit exceeded; value - > 2711289715, limit - 86400 Are your servers synchronized (either with ntpd or chronyd)? Maybe the time is different and prevents correct replication. flo > > Jan 17 16:27:57 hs2-man-idm-02 ns-slapd: [17/Jan/2020:16:27:57.110464100 > +0100] - WARN - NSMMReplicationPlugin - replica_generate_next_csn - > opcsn=5e21d27e000000050000 <= basecsn=ffbcd1f1522600040000, adjusted > opcsn=5e21d27e522700050000 > > But we don’t have any replication because no other servers: > > # ipa-replica-manage list > > server2.domain.com: master > > # ipa-replica-manage list-ruv > > Directory Manager password: > > Replica Update Vectors: > > server2.domain.com:389: 5 > > Certificate Server Replica Update Vectors: > > server2.domain.com:389: 6 > > # ipa topologysuffix-find > > --------------------------- > > 2 topology suffixes matched > > --------------------------- > > Suffix name: ca > > Managed LDAP suffix DN: o=ipaca > > Suffix name: domain > > Managed LDAP suffix DN: dc=domain,dc=com > > ---------------------------- > > Number of entries returned 2 > > ---------------------------- > > # ipa topologysegment-find > > Suffix name: domain > > ------------------ > > 0 segments matched > > ------------------ > > ---------------------------- > > Number of entries returned 0 > > ---------------------------- > > I really don’t know what happened here. Could you help us on that ? > > Best regards, > > Damien > > > _______________________________________________ > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org > To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org > Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost… >

2 1

kinit: Pre-authentication failed: Invalid argument while getting initial credentials
by John Louis 19 Jan '20

19 Jan '20

Hi, on CentOS 7 I installed Freeipa using "yum install ipa-server". Everything including client is on the same machine itself. All went well, I can now login to the web as "admin" and create user account etc. And "kinit admin", "kinit list" etc all worked as expected right after installation. But a couple days later, even though I can still login as "admin" web user, on the server ssh session I get the following (I replaced REALM name with "REALM" here): # kinit kinit: Client 'root@REALM' not found in Kerberos database while getting initial credentials # kinit admin kinit: Pre-authentication failed: Invalid argument while getting initial credentials # kinit list kinit: Client 'list@REALM' not found in Kerberos database while getting initial credentials # env KRB5_TRACE=/dev/stdout kinit admin 2>&1 [11612] 1578511115.54729: Getting initial credentials for admin@REALM [11612] 1578511115.54731: Sending unauthenticated request [11612] 1578511115.54732: Sending request (167 bytes) to REALM [11612] 1578511115.54733: Initiating TCP connection to stream 127.0.0.1:88 [11612] 1578511115.54734: Sending TCP request to stream 127.0.0.1:88 [11612] 1578511115.54735: Received answer (240 bytes) from stream 127.0.0.1:88 [11612] 1578511115.54736: Terminating TCP connection to stream 127.0.0.1:88 [11612] 1578511115.54737: Response was from master KDC [11612] 1578511115.54738: Received error from KDC: -1765328359/Additional pre-authentication required [11612] 1578511115.54741: Preauthenticating using KDC method data [11612] 1578511115.54742: Processing preauth types: PA-PK-AS-REQ (16), PA-PK-AS-REP_OLD (15), PA-PK-AS-REQ_OLD (14), PA-FX-FAST (136), PA-PKINIT-KX (147), PA-FX-COOKIE (133) [11612] 1578511115.54743: Received cookie: MIT [11612] 1578511115.54744: PKINIT client has no configured identity; giving up [11612] 1578511115.54745: Preauth module pkinit (147) (info) returned: 0/Success [11612] 1578511115.54746: PKINIT client has no configured identity; giving up [11612] 1578511115.54747: Preauth module pkinit (16) (real) returned: 22/Invalid argument [11612] 1578511115.54748: PKINIT client has no configured identity; giving up [11612] 1578511115.54749: Preauth module pkinit (14) (real) returned: 22/Invalid argument kinit: Pre-authentication failed: Invalid argument while getting initial credentials # klist -ek Keytab name: FILE:/etc/krb5.keytab KVNO Principal ---- -------------------------------------------------------------------------- 2 host/ipa.host.name@REALM (aes256-cts-hmac-sha1-96) 2 host/ipa.host.name@REALM (aes128-cts-hmac-sha1-96) 2 host/ipa.host.name@REALM (des3-cbc-sha1) 2 host/ipa.host.name@REALM (arcfour-hmac) 2 host/ipa.host.name@REALM (camellia128-cts-cmac) 2 host/ipa.host.name@REALM (camellia256-cts-cmac) So looks like I lost "admin" in kerboros? The only thing I think I did, is I have changed the server's time and hwclock time, by 9 minutes. Thanks!

4 16

Kerberized NFS Home directories
by Kristian Petersen 17 Jan '20

17 Jan '20

Hey all, I am trying to get kerberized NFS home directories working in Ubuntu 18.04 with the mapping info coming from IPA. I can get them to mount on login in a multi-user target (terminal only), but not a graphical one (using gdm for login). The messages I am seeing in the syslog seem to indicate that it is having issues communicating with the server hosting the NFS share and times out. That doesn't make sense though since it works to mount in the terminal like I would expect. -- Kristian Petersen System Administrator BYU Dept. of Chemistry and Biochemistry

3 4

Proxy LDAP queries to Active Directory
by White, David 17 Jan '20

17 Jan '20

Is there a way to proxy client LDAP requests to the upstream Active Directory that FreeIPA is configured to trust? I have AD, where users live. I have FreeIPA / RedHat IdM. And I have servers that are registered to FreeIPA. But I also have applications (such as Mediawiki, or Red Hat Satellite to name a few) that support LDAP authentication. I want to be able to use my AD credentials to login to Mediawiki or Satellite, but have the application bind to FreeIPA, instead of binding it to AD. Is this possible? I currently: Have successfully bound Mediawiki to FreeIPA, and I can login to Mediawiki using an account that is built locally instead of FreeIPA, but I cannot login to Mediawiki using my AD credentials. ----- David White Engineer II, Fiber Systems Engineering (423) 648-1500, Option 2 [/var/folders/7m/l5bzdbz14c9bkrwxvn2ffnjc0000gq/T/com.microsoft.Outlook/WebArchiveCopyPasteTempFiles/cidimage001.jpg(a)01D4B3F3.F5D81170]

2 4

FreeIPA ipa-replica-install hangs on "No status yet" during the first replication
by Damien Bras 17 Jan '20

17 Jan '20

Hi, During the installation of one of our FreeIPA replica (with ipa-replica-install), the process hangs on "No status yet". Our domain is in domain level 1. It seems that the script is waiting for an attribute nsds5ReplicaLastInitStatus. The master server is up & running and we want to have a multimaster environment. We don't find any error related to the replication process in the log. The version installed: 4.6.5-11.0.1.el7_7.3 First, the ipa client is correctly installed on the server. Then we use the comment ipa-replica-install to promote it as IPA server with: ipa-replica-install -U --principal admin --admin-password $admin_password --domain domain.com --server server2.domain.com --setup-ca --setup-dns --no-forwarders --forward-policy=first --no-dnssec-validation --allow-zone-overlap --reverse-zone=xx.xx.in-addr.arpa --mkhomedir --force-join In the ipareplica-install.log we just have this: … 2020-01-17T10:25:46Z DEBUG [28/41]: setting up initial replication 2020-01-17T10:25:46Z DEBUG retrieving schema for SchemaCache url=ldapi://%2fvar%2frun%2fslapd-DOMAIN-COM.socket conn=<ldap.ldapobject.SimpleLDAPObject instance at 0x7f2c94db6248> 2020-01-17T10:25:47Z DEBUG Destroyed connection context.ldap2_139829518113296 2020-01-17T10:25:47Z DEBUG Starting external process 2020-01-17T10:25:47Z DEBUG args=/bin/systemctl --system daemon-reload 2020-01-17T10:25:47Z DEBUG Process finished, return code=0 2020-01-17T10:25:47Z DEBUG stdout= 2020-01-17T10:25:47Z DEBUG stderr= 2020-01-17T10:25:47Z DEBUG Starting external process 2020-01-17T10:25:47Z DEBUG args=/bin/systemctl restart dirsrv(a)DOMAIN-COM.service 2020-01-17T10:25:53Z DEBUG Process finished, return code=0 2020-01-17T10:25:53Z DEBUG stdout= 2020-01-17T10:25:53Z DEBUG stderr= 2020-01-17T10:25:53Z DEBUG Restart of dirsrv(a)HS2-VDC-CORP-HOMESEND-COM.service complete 2020-01-17T10:25:53Z DEBUG Created connection context.ldap2_139829518113296 2020-01-17T10:25:53Z DEBUG Fetching nsDS5ReplicaId from master [attempt 1/5] 2020-01-17T10:25:53Z DEBUG retrieving schema for SchemaCache url=ldap://server2.domain.com:389 conn=<ldap.ldapobject.SimpleLDAPObject instance at 0x7f2c95da8320> 2020-01-17T10:25:54Z DEBUG Successfully updated nsDS5ReplicaId. 2020-01-17T10:25:54Z DEBUG Add or update replica config cn=replica,cn=dc\=domain\,dc\=com,cn=mapping tree,cn=config 2020-01-17T10:25:54Z DEBUG Added replica config cn=replica,cn=dc\=domain\,dc\=com,cn=mapping tree,cn=config 2020-01-17T10:25:54Z DEBUG Add or update replica config cn=replica,cn=dc\=domain\,dc\=com,cn=mapping tree,cn=config 2020-01-17T10:25:54Z DEBUG No update to cn=replica,cn=dc\=domain\,dc\=com,cn=mapping tree,cn=config necessary 2020-01-17T10:25:54Z DEBUG Waiting for replication (ldapi://%2fvar%2frun%2fslapd-DOMAIN-COM.socket) cn=meToserver2.domain.com,cn=replica,cn=dc\=domain\,dc\=com,cn=mapping tree,cn=config (objectclass=*) 2020-01-17T10:25:54Z DEBUG Entry found [LDAPEntry(ipapython.dn.DN('cn=meToserver2.domain.com,cn=replica,cn=dc\=domain\,dc\=com,cn=mapping tree,cn=config'), {u'nsds5replicaLastInitStart': ['19700101000000Z'], u'nsds5replicaUpdateInProgress': ['FALSE'], u'cn': ['meToserver2.domain.com'], u'objectClass': ['nsds5replicationagreement', 'top'], u'nsds5replicaLastUpdateEnd': ['19700101000000Z'], u'nsDS5ReplicaRoot': ['dc=domain,dc=com'], u'nsDS5ReplicaHost': ['server2.domain.com'], u'nsds5replicaLastUpdateStatus': ['Error (0) No replication sessions started since server startup'], u'nsDS5ReplicaBindMethod': ['SASL/GSSAPI'], u'nsds5ReplicaStripAttrs': ['modifiersName modifyTimestamp internalModifiersName internalModifyTimestamp'], u'nsds5replicaLastUpdateStart': ['19700101000000Z'], u'nsDS5ReplicaPort': ['389'], u'nsDS5ReplicaTransportInfo': ['LDAP'], u'description': ['me to server2.domain.com'], u'nsds5replicareapactive': ['0'], u'nsds5replicaChangesSentSinceStartup': [''], u'nsds5replicaTimeout': ['120'], u'nsDS5ReplicatedAttributeList': ['(objectclass=*) $ EXCLUDE memberof idnssoaserial entryusn krblastsuccessfulauth krblastfailedauth krbloginfailedcount'], u'nsds5replicaLastInitEnd': ['19700101000000Z'], u'nsDS5ReplicatedAttributeListTotal': ['(objectclass=*) $ EXCLUDE entryusn krblastsuccessfulauth krblastfailedauth krbloginfailedcount']})] On the live master, there is a strange behavior also: It seems the ldap is like in read only mode. For exemple, if I reset the password of an account, I don’t have any error but nothing happened. I have also those errors on this server: Jan 17 16:27:57 hs2-man-idm-02 ns-slapd: [17/Jan/2020:16:27:57.102642397 +0100] - ERR - csngen_adjust_time - Adjustment limit exceeded; value - 2711289715, limit - 86400 Jan 17 16:27:57 hs2-man-idm-02 ns-slapd: [17/Jan/2020:16:27:57.110464100 +0100] - WARN - NSMMReplicationPlugin - replica_generate_next_csn - opcsn=5e21d27e000000050000 <= basecsn=ffbcd1f1522600040000, adjusted opcsn=5e21d27e522700050000 But we don’t have any replication because no other servers: # ipa-replica-manage list server2.domain.com: master # ipa-replica-manage list-ruv Directory Manager password: Replica Update Vectors: server2.domain.com:389: 5 Certificate Server Replica Update Vectors: server2.domain.com:389: 6 # ipa topologysuffix-find --------------------------- 2 topology suffixes matched --------------------------- Suffix name: ca Managed LDAP suffix DN: o=ipaca Suffix name: domain Managed LDAP suffix DN: dc=domain,dc=com ---------------------------- Number of entries returned 2 ---------------------------- # ipa topologysegment-find Suffix name: domain ------------------ 0 segments matched ------------------ ---------------------------- Number of entries returned 0 ---------------------------- I really don’t know what happened here. Could you help us on that ? Best regards, Damien

1 0

Approval workflow
by Daniel PC 17 Jan '20

17 Jan '20

Hi all, Does anyone know if it is possible to implement an approval workflow to enable a user to access a host? My idea is, for a limited number of users, allow access only after receiving OK from a responsible. Thank you DPC

2 3

Certificate not found: auditSigningCert cert-pki-ca - Can't run pki-tomcatd Service
by Ferdinand Babas 17 Jan '20

17 Jan '20

Hi All, I've been trying to work through this issue but can't find the magic formula to get it working so I'm turning to the community for help. We are currently running VERSION: 4.4.0, API_VERSION: 2.213 in a 4 node multi master environment and the steps listed below were performed on the IPA CA renewal master. Please let me know if any additional information is needed regarding the environment. As background we had expired certificates (both /etc/httpd/alias and /etc/pki/pki-tomcat/alias) which were renewed by setting the date in the past and restarting certmonger. Now on the IPA CA renewal master all certs have valid 'expires' dates and have a status of MONITORING. Note that the other nodes still have expired certs. On the IPA CA renewal master when I start up the pki-tomcatd(a)pki-tomcat.service with the default CS.cfg and password.conf file I get the following error: Internal Database Error encountered: Could not connect to LDAP server host francolin.local port 636 Error netscape.ldap.LDAPException: Authentication failed (48) So I changed the CS.cfg file to use Basic Auth and added the directory-manager-password to password.conf, restarted pki-tomcatd(a)pki-tomcat.service and now I get the following: /var/log/messages Jan 6 10:54:30 francolin systemd: Started PKI Tomcat Server pki-tomcat. Jan 6 10:54:30 francolin server: Java virtual machine used: /usr/lib/jvm/jre-1.8.0-openjdk/bin/java Jan 6 10:54:30 francolin server: classpath used: /usr/share/tomcat/bin/bootstrap.jar:/usr/share/tomcat/bin/tomcat-juli.jar:/usr/share/java/commons-daemon.jar Jan 6 10:54:30 francolin server: main class used: org.apache.catalina.startup.Bootstrap Jan 6 10:54:30 francolin server: flags used: -DRESTEASY_LIB=/usr/share/java/resteasy-base -Djava.library.path=/usr/lib64/nuxwdog-jni Jan 6 10:54:30 francolin server: options used: -Dcatalina.base=/var/lib/pki/pki-tomcat -Dcatalina.home=/usr/share/tomcat -Djava.endorsed.dirs= -Djava.io.tmpdir=/var/lib/pki/pki-tomcat/temp -Djava.util.logging.config.file=/var/lib/pki/pki-tomcat/conf/logging.properties -Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager -Djava.security.manager -Djava.security.policy==/var/lib/pki/pki-tomcat/conf/catalina.policy Jan 6 10:54:30 francolin server: arguments used: start Jan 6 10:54:30 francolin server: WARNING: Problem with JAR file [/usr/share/pki/server/common/lib/symkey.jar], exists: [false], canRead: [false] Jan 6 10:54:31 francolin server: WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'enableOCSP' to 'false' did not find a matching property. Jan 6 10:54:31 francolin server: WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'ocspResponderURL' to 'http://francolin.local:9080/ca/ocsp' did not find a matching property. Jan 6 10:54:31 francolin server: WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'ocspResponderCertNickname' to 'ocspSigningCert cert-pki-ca' did not find a matching property. Jan 6 10:54:31 francolin server: WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'ocspCacheSize' to '1000' did not find a matching property. Jan 6 10:54:31 francolin server: WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'ocspMinCacheEntryDuration' to '60' did not find a matching property. Jan 6 10:54:31 francolin server: WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'ocspMaxCacheEntryDuration' to '120' did not find a matching property. Jan 6 10:54:31 francolin server: WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'ocspTimeout' to '10' did not find a matching property. Jan 6 10:54:31 francolin server: WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'strictCiphers' to 'true' did not find a matching property. Jan 6 10:54:31 francolin server: WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'sslOptions' to 'ssl2=false,ssl3=false,tls=true' did not find a matching property. Jan 6 10:54:31 francolin server: WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'ssl2Ciphers' to '-SSL2_RC4_128_WITH_MD5,-SSL2_RC4_128_EXPORT40_WITH_MD5,-SSL2_RC2_128_CBC_WITH_MD5,-SSL2_RC2_128_CBC_EXPORT40_WITH_MD5,-SSL2_DES_64_CBC_WITH_MD5,-SSL2_DES_192_EDE3_CBC_WITH_MD5' did not find a matching property. Jan 6 10:54:31 francolin server: WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'ssl3Ciphers' to '-SSL3_FORTEZZA_DMS_WITH_NULL_SHA,-SSL3_FORTEZZA_DMS_WITH_RC4_128_SHA,+SSL3_RSA_WITH_RC4_128_SHA,-SSL3_RSA_EXPORT_WITH_RC4_40_MD5,+SSL3_RSA_WITH_3DES_EDE_CBC_SHA,-SSL3_RSA_WITH_DES_CBC_SHA,-SSL3_RSA_EXPORT_WITH_RC2_CBC_40_MD5,-SSL3_FORTEZZA_DMS_WITH_FORTEZZA_CBC_SHA,-SSL_RSA_FIPS_WITH_DES_CBC_SHA,+SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA,-SSL3_RSA_WITH_NULL_MD5,-TLS_RSA_EXPORT1024_WITH_RC4_56_SHA,-TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA,+TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA' did not find a matching property. Jan 6 10:54:31 francolin server: WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'tlsCiphers' to '-TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA,-TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA,+TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA,+TLS_ECDH_RSA_WITH_AES_128_CBC_SHA,+TLS_ECDH_RSA_WITH_AES_256_CBC_SHA,-TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA,+TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,+TLS_RSA_WITH_3DES_EDE_CBC_SHA,+TLS_RSA_WITH_AES_128_CBC_SHA,+TLS_RSA_WITH_AES_256_CBC_SHA,+TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA,+TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,-TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,-TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,-TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,+TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA,+TLS_DHE_DSS_WITH_AES_128_CBC_SHA,+TLS_DHE_DSS_WITH_AES_256_CBC_SHA,+TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA,+TLS_DHE_RSA_WITH_AES_128_CBC_SHA,+TLS_DHE_RSA_WITH_AES_256_CBC_SHA' did not find a matching property. Jan 6 10:54:31 francolin server: WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'sslVersionRangeStream' to 'tls1_0:tls1_2' did not find a matching property. Jan 6 10:54:31 francolin server: WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'sslVersionRangeDatagram' to 'tls1_1:tls1_2' did not find a matching property. Jan 6 10:54:31 francolin server: WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'sslRangeCiphers' to '-TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA,-TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA,-TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA,-TLS_ECDH_RSA_WITH_AES_128_CBC_SHA,-TLS_ECDH_RSA_WITH_AES_256_CBC_SHA,-TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA,-TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,-TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA,-TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,-TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,-TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,-TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,-TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA,-TLS_DHE_DSS_WITH_AES_128_CBC_SHA,-TLS_DHE_DSS_WITH_AES_256_CBC_SHA,-TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA,-TLS_DHE_RSA_WITH_AES_128_CBC_SHA,-TLS_DHE_RSA_WITH_AES_256_CBC_SHA,-TLS_DHE_RSA_WITH_AES_128_CBC_SHA256,-TLS_DHE_RSA_WITH_AES_256_CBC_SHA256,-TLS_DHE_RSA_WITH_AES_128_GCM_SHA256,-TLS_DHE_DSS_WITH_AES_128_GCM_SHA256,-TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,-TLS_ECDHE_RSA_WITH_AES_128_CB C_SHA256,-TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,-TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,-TLS_RSA_WITH_AES_128_CBC_SHA256,-TLS_RSA_WITH_AES_256_CBC_SHA256,-TLS_RSA_WITH_AES_128_GCM_SHA256,+TLS_RSA_WITH_3DES_EDE_CBC_SHA,+TLS_RSA_WITH_AES_128_CBC_SHA,+TLS_RSA_WITH_AES_256_CBC_SHA' did not find a matching property. Jan 6 10:54:31 francolin server: WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'serverCertNickFile' to '/var/lib/pki/pki-tomcat/conf/serverCertNick.conf' did not find a matching property. Jan 6 10:54:31 francolin server: WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'passwordFile' to '/var/lib/pki/pki-tomcat/conf/password.conf' did not find a matching property. Jan 6 10:54:31 francolin server: WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'passwordClass' to 'org.apache.tomcat.util.net.jss.PlainPasswordFile' did not find a matching property. Jan 6 10:54:31 francolin server: WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'certdbDir' to '/var/lib/pki/pki-tomcat/alias' did not find a matching property. Jan 6 10:54:31 francolin server: WARNING: [SetPropertiesRule]{Server/Service/Engine/Host} Setting property 'xmlValidation' to 'false' did not find a matching property. Jan 6 10:54:31 francolin server: WARNING: [SetPropertiesRule]{Server/Service/Engine/Host} Setting property 'xmlNamespaceAware' to 'false' did not find a matching property. Jan 6 10:54:31 francolin server: PKIListener: org.apache.catalina.core.StandardServer[before_init] Jan 6 10:54:31 francolin server: PKIListener: org.apache.catalina.core.StandardServer[after_init] Jan 6 10:54:31 francolin server: PKIListener: org.apache.catalina.core.StandardServer[before_start] Jan 6 10:54:31 francolin server: PKIListener: org.apache.catalina.core.StandardServer[configure_start] Jan 6 10:54:31 francolin server: PKIListener: org.apache.catalina.core.StandardServer[start] Jan 6 10:54:31 francolin server: SSLAuthenticatorWithFallback: Creating SSL authenticator with fallback Jan 6 10:54:31 francolin server: SSLAuthenticatorWithFallback: Setting container Jan 6 10:54:32 francolin server: SSLAuthenticatorWithFallback: Initializing authenticators Jan 6 10:54:32 francolin server: SSLAuthenticatorWithFallback: Starting authenticators Jan 6 10:54:33 francolin server: CMSEngine.initializePasswordStore() begins Jan 6 10:54:33 francolin server: CMSEngine.initializePasswordStore(): tag=internaldb Jan 6 10:54:33 francolin server: testLDAPConnection connecting to francolin.local:389 Jan 6 10:54:33 francolin server: CMSEngine.initializePasswordStore(): tag=replicationdb Jan 6 10:54:33 francolin server: testLDAPConnection connecting to francolin.local:389 Jan 6 10:54:33 francolin server: testLDAPConnection: The specified user cn=Replication Manager masterAgreement1-francolin.local-pki-tomcat,cn=config does not exist Jan 6 10:54:33 francolin server: CMSEngine: init(): password test execution failed for replicationdbwith NO_SUCH_USER. This may not be a latest instance. Ignoring .. Jan 6 10:54:34 francolin server: SelfTestSubsystem: Disabling "ca" subsystem due to selftest failure. Jan 6 10:54:34 francolin server: ----------------------- Jan 6 10:54:34 francolin server: Disabled "ca" subsystem Jan 6 10:54:34 francolin server: ----------------------- Jan 6 10:54:34 francolin server: Subsystem ID: ca Jan 6 10:54:34 francolin server: Instance ID: pki-tomcat Jan 6 10:54:34 francolin server: Enabled: False Jan 6 10:54:34 francolin server: Invalid class name repositorytop Jan 6 10:54:35 francolin server: Invalid class name repositorytop Jan 6 10:54:35 francolin server: at com.netscape.cmscore.dbs.DBRegistry.createObject(DBRegistry.java:485) Jan 6 10:54:35 francolin server: at com.netscape.cmscore.dbs.DBSSession.read(DBSSession.java:167) Jan 6 10:54:35 francolin server: at com.netscape.cmscore.dbs.DBSSession.read(DBSSession.java:137) Jan 6 10:54:35 francolin server: at com.netscape.cmscore.dbs.Repository.getSerialNumber(Repository.java:125) Jan 6 10:54:35 francolin server: at com.netscape.cmscore.dbs.Repository.initCache(Repository.java:244) Jan 6 10:54:35 francolin server: at com.netscape.cmscore.dbs.Repository.checkRanges(Repository.java:460) Jan 6 10:54:35 francolin server: at com.netscape.cmscore.apps.CMSEngine.startup(CMSEngine.java:1374) Jan 6 10:54:35 francolin server: at com.netscape.certsrv.apps.CMS.startup(CMS.java:201) Jan 6 10:54:35 francolin server: at com.netscape.certsrv.apps.CMS.start(CMS.java:1622) Jan 6 10:54:35 francolin server: at com.netscape.cms.servlet.base.CMSStartServlet.init(CMSStartServlet.java:114) Jan 6 10:54:35 francolin server: at javax.servlet.GenericServlet.init(GenericServlet.java:158) Jan 6 10:54:35 francolin server: at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) Jan 6 10:54:35 francolin server: at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) Jan 6 10:54:35 francolin server: at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) Jan 6 10:54:35 francolin server: at java.lang.reflect.Method.invoke(Method.java:498) Jan 6 10:54:35 francolin server: at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:288) Jan 6 10:54:35 francolin server: at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:285) Jan 6 10:54:35 francolin server: at java.security.AccessController.doPrivileged(Native Method) Jan 6 10:54:35 francolin server: at javax.security.auth.Subject.doAsPrivileged(Subject.java:549) Jan 6 10:54:35 francolin server: at org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:320) Jan 6 10:54:35 francolin server: at org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:175) Jan 6 10:54:35 francolin server: at org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:124) Jan 6 10:54:35 francolin server: at org.apache.catalina.core.StandardWrapper.initServlet(StandardWrapper.java:1270) Jan 6 10:54:35 francolin server: at org.apache.catalina.core.StandardWrapper.loadServlet(StandardWrapper.java:1195) Jan 6 10:54:35 francolin server: at org.apache.catalina.core.StandardWrapper.load(StandardWrapper.java:1085) Jan 6 10:54:35 francolin server: at org.apache.catalina.core.StandardContext.loadOnStartup(StandardContext.java:5318) Jan 6 10:54:35 francolin server: at org.apache.catalina.core.StandardContext.startInternal(StandardContext.java:5610) Jan 6 10:54:35 francolin server: at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:147) Jan 6 10:54:35 francolin server: at org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.java:899) Jan 6 10:54:35 francolin server: at org.apache.catalina.core.ContainerBase.access$000(ContainerBase.java:133) Jan 6 10:54:35 francolin server: at org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(ContainerBase.java:156) Jan 6 10:54:35 francolin server: at org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(ContainerBase.java:145) Jan 6 10:54:35 francolin server: at java.security.AccessController.doPrivileged(Native Method) Jan 6 10:54:35 francolin server: at org.apache.catalina.core.ContainerBase.addChild(ContainerBase.java:873) Jan 6 10:54:35 francolin server: at org.apache.catalina.core.StandardHost.addChild(StandardHost.java:652) Jan 6 10:54:35 francolin server: at org.apache.catalina.startup.HostConfig.deployDescriptor(HostConfig.java:679) Jan 6 10:54:35 francolin server: at org.apache.catalina.startup.HostConfig$DeployDescriptor.run(HostConfig.java:1966) Jan 6 10:54:35 francolin server: at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511) Jan 6 10:54:35 francolin server: at java.util.concurrent.FutureTask.run(FutureTask.java:266) Jan 6 10:54:35 francolin server: at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) Jan 6 10:54:35 francolin server: at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) Jan 6 10:54:35 francolin server: at java.lang.Thread.run(Thread.java:748) Jan 6 10:54:36 francolin server: PKIListener: org.apache.catalina.core.StandardServer[after_start] Jan 6 10:54:36 francolin server: PKIListener: Subsystem CA is disabled. Jan 6 10:54:36 francolin server: PKIListener: Check /var/log/pki/pki-tomcat/ca/selftests.log for possible errors. Jan 6 10:54:36 francolin server: PKIListener: To enable the subsystem: Jan 6 10:54:36 francolin server: PKIListener: pki-server subsystem-enable -i pki-tomcat ca Jan 6 10:54:47 francolin server: SSLAuthenticatorWithFallback: Stopping authenticators Jan 6 10:54:47 francolin server: SEVERE: The web application [/ca] appears to have started a thread named [LDAPConnThread-3 ldaps://francolin.local:389] but has failed to stop it. This is very likely to create a memory leak. Jan 6 10:54:47 francolin server: SEVERE: The web application [/ca] appears to have started a thread named [LDAPConnThread-7 ldaps://francolin.local:389] but has failed to stop it. This is very likely to create a memory leak. Jan 6 10:54:47 francolin server: SEVERE: The web application [/ca] appears to have started a thread named [authorityMonitor] but has failed to stop it. This is very likely to create a memory leak. Jan 6 10:54:47 francolin server: SEVERE: The web application [/ca] appears to have started a thread named [LDAPConnThread-9 ldaps://francolin.local:389] but has failed to stop it. This is very likely to create a memory leak. Jan 6 10:54:47 francolin server: SEVERE: The web application [/ca] appears to have started a thread named [profileChangeMonitor] but has failed to stop it. This is very likely to create a memory leak. Jan 6 10:54:47 francolin server: SSLAuthenticatorWithFallback: Setting container /var/log/pki/pki-tomcat/ca/selftests.log 0.localhost-startStop-2 - [06/Jan/2020:10:56:29 HST] [20] [1] SelfTestSubsystem: Initializing self test plugins: 0.localhost-startStop-2 - [06/Jan/2020:10:56:29 HST] [20] [1] SelfTestSubsystem: loading all self test plugin logger parameters 0.localhost-startStop-2 - [06/Jan/2020:10:56:29 HST] [20] [1] SelfTestSubsystem: loading all self test plugin instances 0.localhost-startStop-2 - [06/Jan/2020:10:56:29 HST] [20] [1] SelfTestSubsystem: loading all self test plugin instance parameters 0.localhost-startStop-2 - [06/Jan/2020:10:56:29 HST] [20] [1] SelfTestSubsystem: loading self test plugins in on-demand order 0.localhost-startStop-2 - [06/Jan/2020:10:56:29 HST] [20] [1] SelfTestSubsystem: loading self test plugins in startup order 0.localhost-startStop-2 - [06/Jan/2020:10:56:29 HST] [20] [1] SelfTestSubsystem: Self test plugins have been successfully loaded! 0.localhost-startStop-2 - [06/Jan/2020:10:56:29 HST] [20] [1] SelfTestSubsystem: Running self test plugins specified to be executed at startup: 0.localhost-startStop-2 - [06/Jan/2020:10:56:29 HST] [20] [1] CAPresence: CA is present 0.localhost-startStop-2 - [06/Jan/2020:10:56:29 HST] [20] [1] SystemCertsVerification: system certs verification failure: Certificate not found: auditSigningCert cert-pki-ca 0.localhost-startStop-2 - [06/Jan/2020:10:56:29 HST] [20] [1] SelfTestSubsystem: The CRITICAL self test plugin called selftests.container.instance.SystemCertsVerification running at startup FAILED! I can also confirm that the 'auditSigningCert cert-pka-ca' isn't there when I run certutil -L -d /etc/pki/pki-tomcat/alias/. The output is listed below: Certificate Nickname Trust Attributes SSL,S/MIME,JAR/XPI subsystemCert cert-pki-ca ,, Server-Cert cert-pki-ca u,u,u caSigningCert cert-pki-ca CTu,Cu,Cu ocspSigningCert cert-pki-ca u,u,u The 'auditSigningCert cert-pka-ca' shows up on the other nodes however: auditSigningCert cert-pki-ca u,u,Pu Let me know if there is more information that is needed. This one is baffling me. Thanks, Ferdinand

2 11

Integrated DNS - best solution to unique domain
by Daniel PC 17 Jan '20

17 Jan '20

Hi, Red Hat strongly recommends IdM-integrated DNS for basic usage within the IdM deployment but at the same time declares "It does not support some of the advanced DNS features" and must be used only for IdM purposes. I have a DNS for a domain that resolves names to Linux hostnames, VIPs, application names, databases scan, and more. From my understanding, IdM must resolve DNS only for hostnames. Other services should be delegated to a true DNS server. I understand that it's not normal the use of two DNS for one domain, but in my case how can I build my DNS system? Any advice? Thank you DC

5 5

Re: Where is the "Audit" in IPA?
by Charles Hedrick 16 Jan '20

16 Jan '20

I’ve thought about this a bit more. I think it would be useful if log entries showing changes could be routed differently by syslog. The simplest would be to use a different log level, e.g. NOTICE, where other things are INFO. Another approach would be to put a specific tag in the try, e.g. AUDIT. On Jan 15, 2020, at 5:20 PM, Angus Clarke <post(a)angusclarke.com<mailto:post@angusclarke.com>> wrote: Yeah, to find what I'm looking for I keep a list of grep examples, as auditors generally ask for the same things! I modify httpd.conf to send ErrorLog messages to syslog and then use syslog to send those to a server with cheap storage to keep a long history. Regards Angus ________________________________ From: Charles Hedrick <hedrick(a)rutgers.edu<mailto:hedrick@rutgers.edu>> Sent: 15 January 2020 22:54 To: FreeIPA users list <freeipa-users(a)lists.fedorahosted.org<mailto:freeipa-users@lists.fedorahosted.org>> Cc: Ryan Slominski <ryans(a)jlab.org<mailto:ryans@jlab.org>>; Angus Clarke <post(a)angusclarke.com<mailto:post@angusclarke.com>> Subject: Re: [Freeipa-users] Where is the "Audit" in IPA? This looks pretty reasonable. Unfortunately it intermixed lots of info. The files grow rapidly enough that it’s probably not practical to keep them for a long time. It might not be hard to pull out just the things that make changes. On Jan 15, 2020, at 4:47 PM, Angus Clarke via FreeIPA-users <freeipa-users(a)lists.fedorahosted.org<mailto:freeipa-users@lists.fedorahosted.org>> wrote: Just a note from a fellow user ... Changes made through the API are logged via apache's ErrorLog directive, I've been using this to some degree of success to answer 3rd party audit queries. However it does miss things like "which groups was this user a member of when they were deleted" though ... The facilities you are asking about sound excellent Ryan! Regards Angus ________________________________ From: Ryan Slominski via FreeIPA-users <freeipa-users(a)lists.fedorahosted.org<mailto:freeipa-users@lists.fedorahosted.org>> Sent: 15 January 2020 20:28 To: freeipa-users(a)lists.fedorahosted.org<mailto:freeipa-users@lists.fedorahosted.org> <freeipa-users(a)lists.fedorahosted.org<mailto:freeipa-users@lists.fedorahosted.org>> Cc: Ryan Slominski <ryans(a)jlab.org<mailto:ryans@jlab.org>> Subject: [Freeipa-users] Where is the "Audit" in IPA? Hi FreeIPA dudes, What is the status of audit in IPA? Specifically, is there an easy way to determine what was the group membership of a particular group was at a particular point in time, say last October? I noticed there is an audit log file (disabled by default), but that is going to be a not-so-easy way to try to re-construct group membership at a point in time in the past. I was hoping to just navigate to a "history" tab on the GUI, but no such luck. Is this on anyone's todo list? I also noticed a "Centralized Logging" webpage that suggest setting up an ELK stack, but that doesn't quite provide snapshots of group membership. What about the ability to subscribe to changes (as opposed to poll them)? I suppose the replication features could be used somehow, but those are also polling based? Would be nice to configure simple callbacks (perhaps HTTP post) when things change. I believe this is called a webhook. Any support for this kind of notification system? Thanks, Ryan _______________________________________________ FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org<mailto:freeipa-users@lists.fedorahosted.org> To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org<mailto:freeipa-users-leave@lists.fedorahosted.org> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/<https://nam03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdocs.fedo…> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines<https://nam03.safelinks.protection.outlook.com/?url=https%3A%2F%2Ffedorapro…> List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost…<https://nam03.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.fed…> _______________________________________________ FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org<mailto:freeipa-users@lists.fedorahosted.org> To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org<mailto:freeipa-users-leave@lists.fedorahosted.org> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/<https://nam03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdocs.fedo…> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines<https://nam03.safelinks.protection.outlook.com/?url=https%3A%2F%2Ffedorapro…> List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost…<https://nam03.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.fed…>

1 0

Question about ipa group-add-member
by White, Daniel E. (GSFC-770.0)[NICS] 16 Jan '20

16 Jan '20

Adding multiple users to one group is documented, but the other way around seems to be missing. Is there a way to add one user to multiple groups with one command ? If not, I can deal with it.

2 2

Legacy client in compat tree - multiple entries?
by S Toulmonde 16 Jan '20

16 Jan '20

Hello IPA gurus, I have a legacy client (Solaris) that I want to migrate to a IPA (RHEL IPA 4.6.5). Currently, it's being served by an ODSEE server for ldap. So first I want to test if I can connect with a user in IPA, then I'll try with an external (AD client). But I have the following issue: User I try to login with: seb # Legacy (Solaris) Client: Jan 14 15:46:34 vs4b7 sshd[45644]: [ID 293258 auth.warning] libsldap: Status: 7 Mesg: Too many entries are returned for seb So it seems that I have several users in the compat tree with uid=seb... # IPA server serving Legacy client: [root@el6982 sssd]# ldapsearch -Y GSSAPI -b 'cn=users,cn=compat,dc=dev,dc=ipa,dc=bc' '(&(objectClass=posixaccount)(uid=seb))' # seb, users, compat, dev.ipa.bc dn: uid=seb,cn=users,cn=compat,dc=dev,dc=ipa,dc=bc objectClass: posixAccount objectClass: top gecos:: U8OpYmFzdGllbiBUb3VsbW9uZGUgKGxvY2FsIElQQSk= cn:: U8OpYmFzdGllbiBUb3VsbW9uZGUgKGxvY2FsIElQQSk= uidNumber: 1856200001 gidNumber: 1856200001 loginShell: /bin/bash homeDirectory: /home/seb uid: seb(a)dev.ipa.bc uid: seb # seb, users, compat, dev.ipa.bc dn: uid=seb,cn=users,cn=compat,dc=dev,dc=ipa,dc=bc objectClass: posixAccount objectClass: ipaOverrideTarget objectClass: top gecos:: U8OpYmFzdGllbiBUb3VsbW9uZGU= cn:: U8OpYmFzdGllbiBUb3VsbW9uZGU= uidNumber: 1856200001 gidNumber: 1856200001 loginShell: /bin/bash homeDirectory: /home/seb ipaAnchorUUID:: OklQQTpkZXYuaXBhLmJjOmRmMmQyNjdjLWFjN2MtMTFlOS1iYTMyLTAwNTA1NjllMjc5OQ== uid: seb # search result search: 4 result: 0 Success # numResponses: 3 # numEntries: 2 # LDAP config for legacy client: (vs4b7:/var/adm)# ldapclient list NS_LDAP_FILE_VERSION= 2.0 NS_LDAP_BINDDN= uid=solaris10,cn=sysaccounts,cn=etc,dc=dev,dc=ipa,dc=bc NS_LDAP_BINDPASSWD= {NS1}c537f4abc1a7c4e477a5ca0ca15c7bdc7a83d9 NS_LDAP_SERVERS= el6982.dev.ipa.bc NS_LDAP_SEARCH_BASEDN= dc=dev,dc=ipa,dc=bc NS_LDAP_AUTH= simple NS_LDAP_SEARCH_REF= TRUE NS_LDAP_SEARCH_SCOPE= sub NS_LDAP_SEARCH_TIME= 15 NS_LDAP_CACHETTL= 0 NS_LDAP_PROFILE= solaris10 NS_LDAP_CREDENTIAL_LEVEL= proxy NS_LDAP_SERVICE_SEARCH_DESC= passwd:cn=users,cn=compat,dc=dev,dc=ipa,dc=bc NS_LDAP_SERVICE_SEARCH_DESC= group:cn=groups,cn=compat,dc=dev,dc=ipa,dc=bc NS_LDAP_BIND_TIME= 5 NS_LDAP_OBJECTCLASSMAP= shadow:shadowAccount=posixAccount I wonder why do I have two entries in the compat tree? One if objectClass: ipaOverrideTarget and the other isn't... I restarted sssd and IPA to clear the compat tree, but it pops back up again. Any idea? Thanks!

2 2

Server-Cert cert-pki-ca was expired and wasn't renewed automatically
by luckydog xf 16 Jan '20

16 Jan '20

Hi, I have 2 nodes of IPA system. The 'Server-Cert cert-pki-ca' of master node was expired unexpectedly. Based on https://ftweedal.fedorapeople.org/ipa-cert-renewal-deep-dive.pdf, this cert is for HTTS( pki-tomcat), AKA Dogtag website. As it was expired, Dogtag is OOS, either. Right now, those services are not running, --- pki-tomcatd Service: STOPPED ipa-otpd Service: STOPPED ipa-dnskeysyncd Service: STOPPED --- This is /var/log/pki/pki-tomcat/ca/selftests.log --------------------- 0.localhost-startStop-1 - [25/Dec/2019:16:16:54 HKT] [20] [1] CAPresence: CA is present 0.localhost-startStop-1 - [25/Dec/2019:16:16:54 HKT] [20] [1] SystemCertsVerification: system certs verification failure: Certificate Server-Cert cert-pki-ca is invalid: Invalid certificate: (-8181) Peers Certificate has expired. 0.localhost-startStop-1 - [25/Dec/2019:16:16:54 HKT] [20] [1] SelfTestSubsystem: The CRITICAL self test plugin called selftests.container.instance.SystemCertsVerification running at startup FAILED! ----------------- And /var/log/pki/pki-tomcat/ca/debug ------------ [25/Dec/2019:17:07:53][localhost-startStop-1]: CertUtils: verifySystemCertByNickname(Server-Cert cert-pki-ca, SSLServer) [25/Dec/2019:17:07:53][localhost-startStop-1]: CertUtils: verifySystemCertByNickname(): calling verifyCertificate(Server-Cert cert-pki-ca, true, SSLServer) [25/Dec/2019:17:07:53][localhost-startStop-1]: CertUtils: verifySystemCertByNickname() failed: java.lang.Exception: Certificate Server-Cert cert-pki-ca is invalid: Invalid certificate: (-8181) Peer's Certificate has expired. [25/Dec/2019:17:07:53][localhost-startStop-1]: CertUtils: verifySystemCertsByTag() failed: java.lang.Exception: Certificate Server-Cert cert-pki-ca is invalid: Invalid certificate: (-8181) Peer's Certificate has expired. ----------------- Output from certutil: ------- Issuer: "CN=Certificate Authority,O=IPA.PTHL.HK" Validity: Not Before: Tue Nov 21 08:43:11 2017 Not After : Mon Nov 11 08:43:11 2019 Subject: "CN=ipa.ipa.pthl.hk,O=IPA.PTHL.HK" ---------- This certificate was expired, so here comes the point, 1. Why ipa cert-mon did monitor and renew it? So weired. getcert list | grep tomcat -i does not return this certificate. 2. How to fix it? it's renewal master by 'ipa config-show | grep 'IPA CA renewal master' 1) I reset the clock during the valid period, and restart services. it failed. 2) I plan to renew or recreate a Server-Cert since my CA is still valid, but I'm not sure it's doable and don't know how. Not sure it's a bug or not, my slave node is good, both are running freeipa v4.6.4. Thanks a lot.

5 25

Re: Where is the "Audit" in IPA?
by Charles Hedrick 15 Jan '20

15 Jan '20

This looks pretty reasonable. Unfortunately it intermixed lots of info. The files grow rapidly enough that it’s probably not practical to keep them for a long time. It might not be hard to pull out just the things that make changes. On Jan 15, 2020, at 4:47 PM, Angus Clarke via FreeIPA-users <freeipa-users(a)lists.fedorahosted.org<mailto:freeipa-users@lists.fedorahosted.org>> wrote: Just a note from a fellow user ... Changes made through the API are logged via apache's ErrorLog directive, I've been using this to some degree of success to answer 3rd party audit queries. However it does miss things like "which groups was this user a member of when they were deleted" though ... The facilities you are asking about sound excellent Ryan! Regards Angus ________________________________ From: Ryan Slominski via FreeIPA-users <freeipa-users(a)lists.fedorahosted.org<mailto:freeipa-users@lists.fedorahosted.org>> Sent: 15 January 2020 20:28 To: freeipa-users(a)lists.fedorahosted.org<mailto:freeipa-users@lists.fedorahosted.org> <freeipa-users(a)lists.fedorahosted.org<mailto:freeipa-users@lists.fedorahosted.org>> Cc: Ryan Slominski <ryans(a)jlab.org<mailto:ryans@jlab.org>> Subject: [Freeipa-users] Where is the "Audit" in IPA? Hi FreeIPA dudes, What is the status of audit in IPA? Specifically, is there an easy way to determine what was the group membership of a particular group was at a particular point in time, say last October? I noticed there is an audit log file (disabled by default), but that is going to be a not-so-easy way to try to re-construct group membership at a point in time in the past. I was hoping to just navigate to a "history" tab on the GUI, but no such luck. Is this on anyone's todo list? I also noticed a "Centralized Logging" webpage that suggest setting up an ELK stack, but that doesn't quite provide snapshots of group membership. What about the ability to subscribe to changes (as opposed to poll them)? I suppose the replication features could be used somehow, but those are also polling based? Would be nice to configure simple callbacks (perhaps HTTP post) when things change. I believe this is called a webhook. Any support for this kind of notification system? Thanks, Ryan _______________________________________________ FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org<mailto:freeipa-users@lists.fedorahosted.org> To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org<mailto:freeipa-users-leave@lists.fedorahosted.org> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost… _______________________________________________ FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org<mailto:freeipa-users@lists.fedorahosted.org> To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org<mailto:freeipa-users-leave@lists.fedorahosted.org> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost…

2 1

Where is the "Audit" in IPA?
by Ryan Slominski 15 Jan '20

15 Jan '20

Hi FreeIPA dudes, What is the status of audit in IPA? Specifically, is there an easy way to determine what was the group membership of a particular group was at a particular point in time, say last October? I noticed there is an audit log file (disabled by default), but that is going to be a not-so-easy way to try to re-construct group membership at a point in time in the past. I was hoping to just navigate to a "history" tab on the GUI, but no such luck. Is this on anyone's todo list? I also noticed a "Centralized Logging" webpage that suggest setting up an ELK stack, but that doesn't quite provide snapshots of group membership. What about the ability to subscribe to changes (as opposed to poll them)? I suppose the replication features could be used somehow, but those are also polling based? Would be nice to configure simple callbacks (perhaps HTTP post) when things change. I believe this is called a webhook. Any support for this kind of notification system? Thanks, Ryan

3 2

can't access the web interface of freeIPA
by cyrine stambouli 15 Jan '20

15 Jan '20

Hello, I have a problem to access the freeIPA interface, well I have installed freeIPA in centos 7 server, the iinstallation was well done without any errors , but i am not able to access web interface , do you have any idea to fix that ? [root@ipa]# ipactl status Directory Service: RUNNING krb5kdc Service: RUNNING kadmin Service: RUNNING named Service: RUNNING httpd Service: RUNNING ipa-custodia Service: RUNNING ntpd Service: RUNNING pki-tomcatd Service: RUNNING ipa-otpd Service: RUNNING ipa-dnskeysyncd Service: RUNNING ipa: INFO: The ipactl command was successful

5 12

Troubles accessing kerberized website
by Ronald Wimmer 14 Jan '20

14 Jan '20

Today I am confronted with an interesting situation. A Kerberos protected website partially stopped working the way it was. I am asked to enter my Kerberos credentials manually. (If I do the site works as expected.) The interesting thing about this issue is that this only happens if I try to access that particular website from a linux client. If I access the same site from a Windows client Kerberos auth is done automatically. The second interesting thing is that another website configured exactly the same way does work without any issues. (Yes I do use the same user on Windows and Linux and I do have a valid TGT.) What could possibly be the problem? Where should I take a closer look? Cheers, Ronald

2 5

Adding Hosts that are not ipa-clients ?
by White, Daniel E. (GSFC-770.0)[NICS] 14 Jan '20

14 Jan '20

I am considering the Host Based Access Control features to help manage things in our infrastructure that cannot be ipa-clients - like network hardware (switches, routers) With the understanding that my servers do not run the DNS, can I create such hosts to use in host groups and HBAC rules ? ______________________________________________________________________________________________

2 2

Disable SSLv3 and RC4 ciphers on ipa-server 3.0.0
by Terry Soucy 14 Jan '20

14 Jan '20

We are running FreeIPA 3.0.0 on CentOS 6 (directly from the OS repository). I am having trouble disabling SSL3 and RC4 ciphers on port 9443 (pki-cad) ipa-server-3.0.0 tomcat6-6.0.24 I've been modifying /etc/pki-ca/server.xml with little success. What am I missing? I've been banging my head on this for the past week. <Connector name="Agent" port="9443" protocol="HTTP/1.1" SSLEnabled="true" sslEnabledProtocols="TLSv1,TLSv1.1,TLSv1.2" scheme="https" secure="true" maxHttpHeaderSize="8192" acceptCount="100" maxThreads="150" minSpareThreads="25" maxSpareThreads="75" enableLookups="false" disableUploadTimeout="true" SSLImplementation="org.apache.tomcat.util.net.jss.JSSImplementation" enableOCSP="false" ocspResponderURL="http://ipa001.local:9080/ca/ocsp" ocspResponderCertNickname="ocspSigningCert cert-pki-ca" ocspCacheSize="1000" ocspMinCacheEntryDuration="60" ocspMaxCacheEntryDuration="120" ocspTimeout="10" clientAuth="true" sslOptions="ssl2=false,ssl3=false,tls=true" tls3Ciphers="-SSL3_FORTEZZA_DMS_WITH_NULL_SHA,-SSL3_FORTEZZA_DMS_WITH_RC4_128_SHA,-SSL3_RSA_WITH_RC4_128_SHA,-SSL3_RSA_EXPORT_WITH_RC4_40_MD5,-SSL3_RSA_WITH_3DES_EDE_CBC_SHA,-SSL3_RSA_WITH_DES_CBC_SHA,-SSL3_RSA_EXPORT_WITH_RC2_CBC_40_MD5,-SSL3_FORTEZZA_DMS_WITH_FORTEZZA_CBC_SHA,-SSL_RSA_FIPS_WITH_DES_CBC_SHA,-SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA,-SSL3_RSA_WITH_NULL_MD5,-TLS_RSA_EXPORT1024_WITH_RC4_56_SHA,-TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA,+TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,-EDH-RSA-DES-CBC3-SHA,-DES-CBC3-SHA" sslVersionRangeStream="tls1_1:tls1_2" sslVersionRangeDatagram="tls1_1:tls1_2" sslRangeCiphers="-TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA,-TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA,+TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA,+TLS_ECDH_RSA_WITH_AES_128_CBC_SHA,+TLS_ECDH_RSA_WITH_AES_256_CBC_SHA,-TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA,+TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,+TLS_RSA_WITH_3DES_EDE_CBC_SHA,+TLS_RSA_WITH_AES_128_CBC_SHA,+TLS_RSA_WITH_AES_256_CBC_SHA,+TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA,+TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,-TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,-TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,-TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,+TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA,+TLS_DHE_DSS_WITH_AES_128_CBC_SHA,+TLS_DHE_DSS_WITH_AES_256_CBC_SHA,+TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA,+TLS_DHE_RSA_WITH_AES_128_CBC_SHA,+TLS_DHE_RSA_WITH_AES_256_CBC_SHA,+TLS_DHE_RSA_WITH_AES_128_CBC_SHA256,+TLS_DHE_RSA_WITH_AES_256_CBC_SHA256,+TLS_RSA_WITH_AES_128_CBC_SHA256,+TLS_RSA_WITH_AES_256_CBC_SHA256,+TLS_RSA_WITH_AES_128_GCM_SHA256,+TLS_DHE_RSA_WITH_AES_128_GCM_SHA256,+TLS_DHE_DSS_WITH_AES_128_GCM_SHA256,+TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,+TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,+TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,+TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256,+TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,+TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256" serverCertNickFile="/var/lib/pki-ca/conf/serverCertNick.conf" passwordFile="/var/lib/pki-ca/conf/password.conf" passwordClass="org.apache.tomcat.util.net.jss.PlainPasswordFile" certdbDir="/var/lib/pki-ca/alias" /> -- Terry Soucy Systems Engineering Lead | Salesforce Mobile: +1.506.609.3247 <http://smart.salesforce.com/sig/tsoucy//ca_mb/default/link.html>

4 6

FreeIPA/PKI CA/KRA Subsystem Certificate Renewal Failure (not yet expired)
by Anthony Joseph Messina 13 Jan '20

13 Jan '20

I am running into trouble with certmonger renewal of KRA subsystem certs on the renewal master, and CA/KRA subsystem certs on the replica. Any help is appreciated as my renewal window ends in 8 days. This is Fedora 31 with freeipa-server-4.8.4-2.fc31.x86_64 on both master and replica. These systems have been upgraded using the recommended method of creating new replicas since 4.6.3. ## The renewal master... The cert is renewed, but the ca-error below is concerning (the same for "CN=KRA Transport Certificate" and "CN=KRA Storage Certificate") Request ID '20191117031707': status: MONITORING ca-error: Server at "http://ipa482a.example.com:8080/ca/ee/ca/profileSubmit" replied: Missing credential: sessionID stuck: no key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert cert-pki-kra',token='NSS Certificate DB',pin set certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert cert-pki-kra',token='NSS Certificate DB' CA: dogtag-ipa-ca-renew-agent issuer: CN=Certificate Authority,O=EXAMPLE.COM subject: CN=KRA Audit,O=EXAMPLE.COM expires: 2022-01-01 12:37:19 CST key usage: digitalSignature,nonRepudiation ## The replica... The cert is not renewed and the ca-error is different. Request ID '20191117040017': status: MONITORING ca-error: Invalid cookie: '' stuck: no key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert cert-pki-kra',token='NSS Certificate DB',pin set certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert cert-pki-kra',token='NSS Certificate DB' CA: dogtag-ipa-ca-renew-agent issuer: CN=Certificate Authority,O=MESSINET.COM subject: CN=KRA Audit,O=MESSINET.COM expires: 2020-01-21 20:22:24 CST key usage: digitalSignature,nonRepudiation pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "auditSigningCert cert-pki-kra" track: yes auto-renew: yes ## The pki-tomcat debug log on the renewal master... 2020-01-12 15:03:21 [http-nio-8080-exec-13] SEVERE: CAProcessor: authentication error: Missing credential: sessionID Missing credential: sessionID at com.netscape.cms.servlet.common.AuthCredentials.set(AuthCredentials.java:57) at com.netscape.cms.servlet.processors.CAProcessor.authenticate(CAProcessor.java:416) at com.netscape.cms.servlet.processors.CAProcessor.authenticate(CAProcessor.java:471) at com.netscape.cms.servlet.cert.EnrollmentProcessor.processEnrollment(EnrollmentProcessor.java:179) at com.netscape.cms.servlet.cert.EnrollmentProcessor.processEnrollment(EnrollmentProcessor.java:98) at com.netscape.cms.servlet.profile.ProfileSubmitServlet.processEnrollment(ProfileSubmitServlet.java:242) at com.netscape.cms.servlet.profile.ProfileSubmitServlet.process(ProfileSubmitServlet.java:128) at com.netscape.cms.servlet.base.CMSServlet.service(CMSServlet.java:496) at javax.servlet.http.HttpServlet.service(HttpServlet.java:741) at sun.reflect.GeneratedMethodAccessor43.invoke(Unknown Source) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.lang.reflect.Method.invoke(Method.java:498) at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:282) at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:279) at java.security.AccessController.doPrivileged(Native Method) at javax.security.auth.Subject.doAsPrivileged(Subject.java:549) at org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:314) at org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:170) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:225) at org.apache.catalina.core.ApplicationFilterChain.access$000(ApplicationFilterChain.java:47) at org.apache.catalina.core.ApplicationFilterChain$1.run(ApplicationFilterChain.java:149) at org.apache.catalina.core.ApplicationFilterChain$1.run(ApplicationFilterChain.java:145) at java.security.AccessController.doPrivileged(Native Method) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:144) at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:53) at sun.reflect.GeneratedMethodAccessor44.invoke(Unknown Source) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.lang.reflect.Method.invoke(Method.java:498) at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:282) at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:279) at java.security.AccessController.doPrivileged(Native Method) at javax.security.auth.Subject.doAsPrivileged(Subject.java:549) at org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:314) at org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:253) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:191) at org.apache.catalina.core.ApplicationFilterChain.access$000(ApplicationFilterChain.java:47) at org.apache.catalina.core.ApplicationFilterChain$1.run(ApplicationFilterChain.java:149) at org.apache.catalina.core.ApplicationFilterChain$1.run(ApplicationFilterChain.java:145) at java.security.AccessController.doPrivileged(Native Method) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:144) at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:202) at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:96) at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:541) at com.netscape.cms.tomcat.ExternalAuthenticationValve.invoke(ExternalAuthenticationValve.java:82) at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:139) at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:92) at org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:678) at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:74) at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:343) at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:367) at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:65) at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:860) at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1598) at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49) at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) at java.lang.Thread.run(Thread.java:748) 2020-01-12 15:03:21 [http-nio-8080-exec-13] SEVERE: ProfileSubmitServlet: authentication error in processing request: Missing credential: sessionID Missing credential: sessionID at com.netscape.cms.servlet.common.AuthCredentials.set(AuthCredentials.java:57) at com.netscape.cms.servlet.processors.CAProcessor.authenticate(CAProcessor.java:416) at com.netscape.cms.servlet.processors.CAProcessor.authenticate(CAProcessor.java:471) at com.netscape.cms.servlet.cert.EnrollmentProcessor.processEnrollment(EnrollmentProcessor.java:179) at com.netscape.cms.servlet.cert.EnrollmentProcessor.processEnrollment(EnrollmentProcessor.java:98) at com.netscape.cms.servlet.profile.ProfileSubmitServlet.processEnrollment(ProfileSubmitServlet.java:242) at com.netscape.cms.servlet.profile.ProfileSubmitServlet.process(ProfileSubmitServlet.java:128) at com.netscape.cms.servlet.base.CMSServlet.service(CMSServlet.java:496) at javax.servlet.http.HttpServlet.service(HttpServlet.java:741) at sun.reflect.GeneratedMethodAccessor43.invoke(Unknown Source) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.lang.reflect.Method.invoke(Method.java:498) at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:282) at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:279) at java.security.AccessController.doPrivileged(Native Method) at javax.security.auth.Subject.doAsPrivileged(Subject.java:549) at org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:314) at org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:170) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:225) at org.apache.catalina.core.ApplicationFilterChain.access$000(ApplicationFilterChain.java:47) at org.apache.catalina.core.ApplicationFilterChain$1.run(ApplicationFilterChain.java:149) at org.apache.catalina.core.ApplicationFilterChain$1.run(ApplicationFilterChain.java:145) at java.security.AccessController.doPrivileged(Native Method) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:144) at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:53) at sun.reflect.GeneratedMethodAccessor44.invoke(Unknown Source) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.lang.reflect.Method.invoke(Method.java:498) at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:282) at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:279) at java.security.AccessController.doPrivileged(Native Method) at javax.security.auth.Subject.doAsPrivileged(Subject.java:549) at org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:314) at org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:253) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:191) at org.apache.catalina.core.ApplicationFilterChain.access$000(ApplicationFilterChain.java:47) at org.apache.catalina.core.ApplicationFilterChain$1.run(ApplicationFilterChain.java:149) at org.apache.catalina.core.ApplicationFilterChain$1.run(ApplicationFilterChain.java:145) at java.security.AccessController.doPrivileged(Native Method) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:144) at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:202) at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:96) at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:541) at com.netscape.cms.tomcat.ExternalAuthenticationValve.invoke(ExternalAuthenticationValve.java:82) at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:139) at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:92) at org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:678) at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:74) at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:343) at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:367) at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:65) at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:860) at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1598) at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49) at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) at java.lang.Thread.run(Thread.java:748) -- Anthony - https://messinet.com F9B6 560E 68EA 037D 8C3D D1C9 FF31 3BDB D9D8 99B6

2 2

Problem adding a RHEL 8.1 client
by SOLER SANGUESA Miguel 13 Jan '20

13 Jan '20

Hello, I'm trying to add a RHEL 8.1 client with the following spec: OS: RHEL 8.1 (Ootpa) IPA: ipa-client-4.8.0-10 SSSD: sssd-2.2.0-19.el8.x86_64 My IDM server has: OS: RHEL 7.7 (Maipo) IPA: ipa-server-4.6.5-11.el7_7.3 SSSD: sssd-1.16.4-21.el7_7.1 When I try to add the client using "ipa-client-install" I get the error: This program will set up IPA client. Version 4.8.0 Discovery was successful! Do you want to configure chrony with NTP server or pool address? [no]: Client hostname: client01.svc.domain.org Realm: IPA.DOMAIN.ORG DNS Domain: ipa.domain.org IPA Server: icidmpdc1.ipa.domain.org BaseDN: dc=ipa,dc=domain,dc=org Continue to configure the system with these values? [no]: yes Synchronizing time Configuration of chrony was changed by installer. Attempting to sync time with chronyc. Time synchronization was successful. Successfully retrieved CA cert Subject: CN=Certificate Authority,O=IPA.DOMAIN.ORG Issuer: CN=Certificate Authority,O=IPA.DOMAIN.ORG Valid From: 2016-03-04 15:13:38 Valid Until: 2036-03-04 15:13:38 Joining realm failed: Unable to initialize STARTTLS session Failed to bind to server! Retrying with pre-4.0 keytab retrieval method... Unable to initialize STARTTLS session Failed to bind to server! Failed to get keytab child exited with 9 Installation failed. Rolling back changes. Disabling client Kerberos and LDAP configurations Restoring client configuration files nslcd daemon is not installed, skip configuration Client uninstall complete. The ipa-client-install command failed. See /var/log/ipaclient-install.log for more information The entire debug log is attached. It fails doing the "join". It doesn't happened when I add a client with RHEL 7.X, also I think it was also working with RHEL 8.0. Can anyone please, let me know why it is not working? Thanks & Regards.

3 12

sudo rule doesn't work
by Elhamsadat Azarian 13 Jan '20

13 Jan '20

Hi friends i define a SudoRule with this properties: rulename : rsyslog_rule Enabled : true RunAs group Category : All users :user-test hosts: ipacli-irvlt01.mydomain.com sudo Deny Commands : sudo /usr/bin/systemctl restart rsyslog now i login with "user-test" into "ipacli-irvlt01" server and i try to run " sudo /usr/bin/systemctl restart rsyslog" command. i expected to doesnt allow to run this command but no action happend and i could run it!!! why my sudo rule doesnt work? ---------------------------------------------------------- this is less /var/log/sssd/sssd_domain.log: (Sun Jan 12 13:59:01 2020) [sssd[be[lshs.dc]]] [orderly_shutdown] (0x0010): SIGTERM: killing children ---------------------------------------------------------- this is /var/log/sssd/sssd_sudo.log (Sun Jan 12 13:59:01 2020) [sssd[sudo]] [orderly_shutdown] (0x0010): SIGTERM: killing children ---------------------------------------------------------- this is less /var/log/sudo_debug Jan 12 14:19:27 sudo[17370] /etc/sudoers:53 CMNDALIAS ALIAS = COMMAND , COMMAND ARG , COMMAND ARG Jan 12 14:19:27 sudo[17370] -> alias_add @ ./alias.c:120 Jan 12 14:19:27 sudo[17370] -> rcstr_addref @ ./rcstr.c:81 Jan 12 14:19:27 sudo[17370] <- rcstr_addref @ ./rcstr.c:88 := 0x55f2968e7714 Jan 12 14:19:27 sudo[17370] -> rbinsert @ ./redblack.c:177 Jan 12 14:19:27 sudo[17370] -> alias_compare @ ./alias.c:54 Jan 12 14:19:27 sudo[17370] <- alias_compare @ ./alias.c:62 := -13 Jan 12 14:19:27 sudo[17370] -> alias_compare @ ./alias.c:54 Jan 12 14:19:27 sudo[17370] <- alias_compare @ ./alias.c:62 := -6 Jan 12 14:19:27 sudo[17370] -> alias_compare @ ./alias.c:54 Jan 12 14:19:27 sudo[17370] <- alias_compare @ ./alias.c:62 := -6 Jan 12 14:19:27 sudo[17370] -> rotate_right @ ./redblack.c:147 Jan 12 14:19:27 sudo[17370] <- rotate_right @ ./redblack.c:163 Jan 12 14:19:27 sudo[17370] <- rbinsert @ ./redblack.c:265 := 0 Jan 12 14:19:27 sudo[17370] <- alias_add @ ./alias.c:143 := (null) Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ ./lbuf.c:159 Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ ./lbuf.c:69 Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ ./lbuf.c:87 := true Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ ./lbuf.c:190 := true Jan 12 14:19:27 sudo[17370] -> fill_txt @ ./toke_util.c:52 Jan 12 14:19:27 sudo[17370] <- fill_txt @ ./toke_util.c:80 := true Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ ./lbuf.c:159 Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ ./lbuf.c:69 Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ ./lbuf.c:87 := true Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ ./lbuf.c:190 := true Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ ./lbuf.c:159 Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ ./lbuf.c:69 Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ ./lbuf.c:87 := true Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ ./lbuf.c:190 := true Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ ./lbuf.c:159 Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ ./lbuf.c:69 Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ ./lbuf.c:87 := true Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ ./lbuf.c:190 := true Jan 12 14:19:27 sudo[17370] -> fill_cmnd @ ./toke_util.c:103 Jan 12 14:19:27 sudo[17370] <- fill_cmnd @ ./toke_util.c:124 := true Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ ./lbuf.c:159 Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ ./lbuf.c:69 Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ ./lbuf.c:87 := true Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ ./lbuf.c:190 := true Jan 12 14:19:27 sudo[17370] -> fill_args @ ./toke_util.c:132 Jan 12 14:19:27 sudo[17370] <- fill_args @ ./toke_util.c:162 := true Jan 12 14:19:27 sudo[17370] -> new_member @ gram.y:956 Jan 12 14:19:27 sudo[17370] <- new_member @ gram.y:968 := 0x55f2968ff550 Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ ./lbuf.c:159 Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ ./lbuf.c:69 Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ ./lbuf.c:87 := true Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ ./lbuf.c:190 := true Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ ./lbuf.c:159 Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ ./lbuf.c:69 Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ ./lbuf.c:87 := true Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ ./lbuf.c:190 := true Jan 12 14:19:27 sudo[17370] -> fill_cmnd @ ./toke_util.c:103 Jan 12 14:19:27 sudo[17370] <- fill_cmnd @ ./toke_util.c:124 := true Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ ./lbuf.c:159 Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ ./lbuf.c:69 Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ ./lbuf.c:87 := true Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ ./lbuf.c:190 := true Jan 12 14:19:27 sudo[17370] -> fill_args @ ./toke_util.c:132 Jan 12 14:19:27 sudo[17370] <- fill_args @ ./toke_util.c:162 := true Jan 12 14:19:27 sudo[17370] -> new_member @ gram.y:956 Jan 12 14:19:27 sudo[17370] <- new_member @ gram.y:968 := 0x55f2968ff650 Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ ./lbuf.c:159 Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ ./lbuf.c:69 Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ ./lbuf.c:87 := true Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ ./lbuf.c:190 := true Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ ./lbuf.c:159 Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ ./lbuf.c:69 Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ ./lbuf.c:87 := true Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ ./lbuf.c:190 := true Jan 12 14:19:27 sudo[17370] -> fill_cmnd @ ./toke_util.c:103 Jan 12 14:19:27 sudo[17370] <- fill_cmnd @ ./toke_util.c:124 := true Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ ./lbuf.c:159 Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ ./lbuf.c:69 Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ ./lbuf.c:87 := true Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ ./lbuf.c:190 := true Jan 12 14:19:27 sudo[17370] -> fill_args @ ./toke_util.c:132 Jan 12 14:19:27 sudo[17370] <- fill_args @ ./toke_util.c:162 := true Jan 12 14:19:27 sudo[17370] -> new_member @ gram.y:956 Jan 12 14:19:27 sudo[17370] <- new_member @ gram.y:968 := 0x55f2968ff750 Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ ./lbuf.c:159 Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ ./lbuf.c:69 Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ ./lbuf.c:87 := true Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ ./lbuf.c:190 := true Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ ./lbuf.c:159 Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ ./lbuf.c:69 Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ ./lbuf.c:87 := true Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ ./lbuf.c:190 := true Jan 12 14:19:27 sudo[17370] -> fill_cmnd @ ./toke_util.c:103 Jan 12 14:19:27 sudo[17370] <- fill_cmnd @ ./toke_util.c:124 := true Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ ./lbuf.c:159 Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ ./lbuf.c:69 Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ ./lbuf.c:87 := true Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ ./lbuf.c:190 := true Jan 12 14:19:27 sudo[17370] -> fill_args @ ./toke_util.c:132 Jan 12 14:19:27 sudo[17370] <- fill_args @ ./toke_util.c:162 := true Jan 12 14:19:27 sudo[17370] -> new_member @ gram.y:956 Jan 12 14:19:27 sudo[17370] <- new_member @ gram.y:968 := 0x55f2968ff850 Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ ./lbuf.c:159 Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ ./lbuf.c:69 Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ ./lbuf.c:87 := true Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ ./lbuf.c:190 := true Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ ./lbuf.c:159 Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ ./lbuf.c:69 Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ ./lbuf.c:87 := true Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ ./lbuf.c:190 := true Jan 12 14:19:27 sudo[17370] -> fill_cmnd @ ./toke_util.c:103 Jan 12 14:19:27 sudo[17370] <- fill_cmnd @ ./toke_util.c:124 := true Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ ./lbuf.c:159 Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ ./lbuf.c:69 Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ ./lbuf.c:87 := true Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ ./lbuf.c:190 := true Jan 12 14:19:27 sudo[17370] -> fill_args @ ./toke_util.c:132 Jan 12 14:19:27 sudo[17370] <- fill_args @ ./toke_util.c:162 := true Jan 12 14:19:27 sudo[17370] -> new_member @ gram.y:956 Jan 12 14:19:27 sudo[17370] <- new_member @ gram.y:968 := 0x55f2968ff950 Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ ./lbuf.c:159 Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ ./lbuf.c:69 Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ ./lbuf.c:87 := true Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ ./lbuf.c:190 := true Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ ./lbuf.c:159 Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ ./lbuf.c:69 Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ ./lbuf.c:87 := true Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ ./lbuf.c:190 := true Jan 12 14:19:27 sudo[17370] -> fill_cmnd @ ./toke_util.c:103 Jan 12 14:19:27 sudo[17370] <- fill_cmnd @ ./toke_util.c:124 := true Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ ./lbuf.c:159 Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ ./lbuf.c:69 Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ ./lbuf.c:87 := true Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ ./lbuf.c:190 := true Jan 12 14:19:27 sudo[17370] -> fill_args @ ./toke_util.c:132 Jan 12 14:19:27 sudo[17370] <- fill_args @ ./toke_util.c:162 := true Jan 12 14:19:27 sudo[17370] -> new_member @ gram.y:956 Jan 12 14:19:27 sudo[17370] <- new_member @ gram.y:968 := 0x55f2968ffa50 Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ ./lbuf.c:159 Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ ./lbuf.c:69 Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ ./lbuf.c:87 := true Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ ./lbuf.c:190 := true Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ ./lbuf.c:159 Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ ./lbuf.c:69 Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ ./lbuf.c:87 := true Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ ./lbuf.c:190 := true Jan 12 14:19:27 sudo[17370] -> fill_cmnd @ ./toke_util.c:103 Jan 12 14:19:27 sudo[17370] <- fill_cmnd @ ./toke_util.c:124 := true Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ ./lbuf.c:159 Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ ./lbuf.c:69 Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ ./lbuf.c:87 := true Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ ./lbuf.c:190 := true Jan 12 14:19:27 sudo[17370] -> fill_args @ ./toke_util.c:132 Jan 12 14:19:27 sudo[17370] <- fill_args @ ./toke_util.c:162 := true Jan 12 14:19:27 sudo[17370] -> new_member @ gram.y:956 Jan 12 14:19:27 sudo[17370] <- new_member @ gram.y:968 := 0x55f2968ffb50 Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ ./lbuf.c:159 Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ ./lbuf.c:69 Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ ./lbuf.c:87 := true Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ ./lbuf.c:190 := true Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ ./lbuf.c:159 Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ ./lbuf.c:69 Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ ./lbuf.c:87 := true Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ ./lbuf.c:190 := true Jan 12 14:19:27 sudo[17370] -> fill_cmnd @ ./toke_util.c:103 Jan 12 14:19:27 sudo[17370] <- fill_cmnd @ ./toke_util.c:124 := true Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ ./lbuf.c:159 Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ ./lbuf.c:69 Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ ./lbuf.c:87 := true Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ ./lbuf.c:190 := true Jan 12 14:19:27 sudo[17370] -> fill_args @ ./toke_util.c:132 Jan 12 14:19:27 sudo[17370] <- fill_args @ ./toke_util.c:162 := true Jan 12 14:19:27 sudo[17370] -> new_member @ gram.y:956 Jan 12 14:19:27 sudo[17370] <- new_member @ gram.y:968 := 0x55f2968ffc50 Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ ./lbuf.c:159 Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ ./lbuf.c:69 Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ ./lbuf.c:87 := true Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ ./lbuf.c:190 := true Jan 12 14:19:27 sudo[17370] /etc/sudoers:54 CMNDALIAS ALIAS = COMMAND ARG , COMMAND ARG , COMMAND ARG , COMMAND ARG , COMMAND ARG , COMMAND ARG , COMMAND ARG , COMMAND ARG Jan 12 14:19:27 sudo[17370] -> alias_add @ ./alias.c:120 Jan 12 14:19:27 sudo[17370] -> rcstr_addref @ ./rcstr.c:81 Jan 12 14:19:27 sudo[17370] <- rcstr_addref @ ./rcstr.c:88 := 0x55f2968e7714 Jan 12 14:19:27 sudo[17370] -> rbinsert @ ./redblack.c:177 Jan 12 14:19:27 sudo[17370] -> alias_compare @ ./alias.c:54 Jan 12 14:19:27 sudo[17370] <- alias_compare @ ./alias.c:62 := 7 Jan 12 14:19:27 sudo[17370] -> alias_compare @ ./alias.c:54 Jan 12 14:19:27 sudo[17370] <- alias_compare @ ./alias.c:62 := -3 Jan 12 14:19:27 sudo[17370] -> alias_compare @ ./alias.c:54 Jan 12 14:19:27 sudo[17370] <- alias_compare @ ./alias.c:62 := -3 Jan 12 14:19:27 sudo[17370] <- rbinsert @ ./redblack.c:265 := 0 Jan 12 14:19:27 sudo[17370] <- alias_add @ ./alias.c:143 := (null) Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ ./lbuf.c:159 Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ ./lbuf.c:69 Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ ./lbuf.c:87 := true Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ ./lbuf.c:190 := true Jan 12 14:19:27 sudo[17370] -> fill_txt @ ./toke_util.c:52 Jan 12 14:19:27 sudo[17370] <- fill_txt @ ./toke_util.c:80 := true Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ ./lbuf.c:159 Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ ./lbuf.c:69 Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ ./lbuf.c:87 := true Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ ./lbuf.c:190 := true Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ ./lbuf.c:159 Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ ./lbuf.c:69 Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ ./lbuf.c:87 := true Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ ./lbuf.c:190 := true Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ ./lbuf.c:159 Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ ./lbuf.c:69 Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ ./lbuf.c:87 := true Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ ./lbuf.c:190 := true Jan 12 14:19:27 sudo[17370] -> fill_cmnd @ ./toke_util.c:103 Jan 12 14:19:27 sudo[17370] <- fill_cmnd @ ./toke_util.c:124 := true Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ ./lbuf.c:159 Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ ./lbuf.c:69 Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ ./lbuf.c:87 := true Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ ./lbuf.c:190 := true Jan 12 14:19:27 sudo[17370] -> fill_args @ ./toke_util.c:132 Jan 12 14:19:27 sudo[17370] <- fill_args @ ./toke_util.c:162 := true Jan 12 14:19:27 sudo[17370] -> new_member @ gram.y:956 Jan 12 14:19:27 sudo[17370] <- new_member @ gram.y:968 := 0x55f2968ffdd0 Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ ./lbuf.c:159 Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ ./lbuf.c:69 Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ ./lbuf.c:87 := true Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ ./lbuf.c:190 := true Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ ./lbuf.c:159 Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ ./lbuf.c:69 Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ ./lbuf.c:87 := true Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ ./lbuf.c:190 := true Jan 12 14:19:27 sudo[17370] -> fill_cmnd @ ./toke_util.c:103 Jan 12 14:19:27 sudo[17370] <- fill_cmnd @ ./toke_util.c:124 := true Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ ./lbuf.c:159 Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ ./lbuf.c:69 Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ ./lbuf.c:87 := true Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ ./lbuf.c:190 := true Jan 12 14:19:27 sudo[17370] -> fill_args @ ./toke_util.c:132 Jan 12 14:19:27 sudo[17370] <- fill_args @ ./toke_util.c:162 := true Jan 12 14:19:27 sudo[17370] -> new_member @ gram.y:956 Jan 12 14:19:27 sudo[17370] <- new_member @ gram.y:968 := 0x55f2968ffed0 Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ ./lbuf.c:159 Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ ./lbuf.c:69 Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ ./lbuf.c:87 := true Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ ./lbuf.c:190 := true Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ ./lbuf.c:159 Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ ./lbuf.c:69 Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ ./lbuf.c:87 := true Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ ./lbuf.c:190 := true Jan 12 14:19:27 sudo[17370] -> fill_cmnd @ ./toke_util.c:103 Jan 12 14:19:27 sudo[17370] <- fill_cmnd @ ./toke_util.c:124 := true Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ ./lbuf.c:159 Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ ./lbuf.c:69 Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ ./lbuf.c:87 := true Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ ./lbuf.c:190 := true Jan 12 14:19:27 sudo[17370] -> fill_args @ ./toke_util.c:132 Jan 12 14:19:27 sudo[17370] <- fill_args @ ./toke_util.c:162 := true Jan 12 14:19:27 sudo[17370] -> new_member @ gram.y:956 Jan 12 14:19:27 sudo[17370] <- new_member @ gram.y:968 := 0x55f2968fffd0 Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ ./lbuf.c:159 Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ ./lbuf.c:69 Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ ./lbuf.c:87 := true Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ ./lbuf.c:190 := true Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ ./lbuf.c:159 Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ ./lbuf.c:69 Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ ./lbuf.c:87 := true Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ ./lbuf.c:190 := true Jan 12 14:19:27 sudo[17370] -> fill_cmnd @ ./toke_util.c:103 Jan 12 14:19:27 sudo[17370] <- fill_cmnd @ ./toke_util.c:124 := true Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ ./lbuf.c:159 Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ ./lbuf.c:69 Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ ./lbuf.c:87 := true Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ ./lbuf.c:190 := true Jan 12 14:19:27 sudo[17370] -> fill_args @ ./toke_util.c:132 Jan 12 14:19:27 sudo[17370] <- fill_args @ ./toke_util.c:162 := true Jan 12 14:19:27 sudo[17370] -> new_member @ gram.y:956 Jan 12 14:19:27 sudo[17370] <- new_member @ gram.y:968 := 0x55f2969000d0 Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_append_v1 @ ./lbuf.c:159 Jan 12 14:19:27 sudo[17370] -> sudo_lbuf_expand @ ./lbuf.c:69 Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_expand @ ./lbuf.c:87 := true Jan 12 14:19:27 sudo[17370] <- sudo_lbuf_append_v1 @ ./lbuf.c:190 := true Jan 12 14:19:27 sudo[17370] /etc/sudoers:55 CMNDALIAS ALIAS = COMMAND ARG , COMMAND ARG , COMMAND ARG , COMMAND ARG Jan 12 14:19:27 sudo[17370] -> alias_add @ ./alias.c:120 Jan 12 14:19:27 sudo[17370] -> rcstr_addref @ ./rcstr.c:81 Jan 12 14:19:27 sudo[17370] <- rcstr_addref @ ./rcstr.c:88 := 0x55f2968e7714 Jan 12 14:19:27 sudo[17370] -> rbinsert @ ./redblack.c:177 Jan 12 14:19:27 sudo[17370] -> alias_compare @ ./alias.c:54 Jan 12 14:19:27 sudo[17370] <- alias_compare @ ./alias.c:62 := -10 Jan 12 14:19:27 sudo[17370] -> alias_compare @ ./alias.c:54 Jan 12 14:19:27 sudo[17370] <- alias_compare @ ./alias.c:62 := -4

2 1

Updating time servers
by Tania Hagan 10 Jan '20

10 Jan '20

Hello, I have recently removed and added a new freeipa replica server and have noticed that the chrony.conf still has the old server listed and the new ones are not listed. How do I ensure that the freeipa-client/chrony is pointing to the correct time servers. e.g. server <freeipa-server> iburst. I have attempted reading the documentation but cannot find any useful. Server: CentOs Linux release 8.0.1905 FreeIPA version: 4.7.1 Thank You, Tania

2 1

SSH key authentication fails on some nodes (Server refused our key)
by Jeff Vincent 09 Jan '20

09 Jan '20

Most of our FreeIPA client nodes are Ubuntu 14, 16 and some 18. We have a fair number where I am unable to use SSH authentication because the server refuses the key. The same user/key works fine on other nodes. I have checked to the best of my knowledge the files and compared them to a node that works and can't find any differences. /etc/nsswitch.conf /etc/sssd/sssd.conf I don't understand the nuances of FreeIPA to know where else to look. Can anyone suggest what else I can look at to troubleshoot what is going on? Every user experiences this on different nodes. Thanks!

3 3

centos 7.6 or 8.0?
by Charles Hedrick 09 Jan '20

09 Jan '20

We have a limited time period when I would prefer to do major changes. I had expected to update our Centos 7.6 to 8 during January. Unfortunately it appears that there have been no updates to 8, pending 8.1 and 8.1 is waiting for a surprising mount of time. I have a test 8.0 installation, and it works, but obviously it isn’t under any load. Would you feel safer with 7.6 or 8.0?

1 0

Re: DNS discovery / locations
by Alexander Bokovoy 09 Jan '20

09 Jan '20

On to, 09 tammi 2020, Angus Clarke via FreeIPA-users wrote: >Hello > >Not sure if this is more a generic DNS question or not ... > >We run FreeIPA 4.6.4 on a RHEL7.6 clone, we do not use FreeIPA DNS and >we currently do not use DNS discovery. I have read this: >https://www.freeipa.org/page/Howto/IPA_locations<https://www.freeipa.org/page/Howto/IPA_locations#Advanced_configuration> >and am comfortable configuring split view DNS records. > > >As we depoy more sites. I am looking to move to using DNS discovery, >however we use site specific DNS domains (rightly or wrongly with a >private TLD ... cross that bridge when we come to it ...) such as: > >site1.blah >site2.blah > >which is different from the given example of example.com being used >across all sites. > > >Our Realm Domain is blah - I have put the location based DNS records >immediately under .blah. > >In testing, I see ipa clients initially query DNS for SRV records under >site1.blah - when that fails the clients then perform a second DNS >query for SRV records under .blah - which works and my test outcome is >good - the setup works! > >Is it safe for me to assume that this process will remain the same for >future IDM client versions? My concern is that if future versions >neglect the second-attempt DNS discovery lookup (under .blah) then my >setup will break. There are no plans to change this behavior. At worst, you can add SRV records to siteX.blah directly. -- / Alexander Bokovoy Sr. Principal Software Engineer Security / Identity Management Engineering Red Hat Limited, Finland

1 0

DNS discovery / locations
by Angus Clarke 09 Jan '20

09 Jan '20

Hello Not sure if this is more a generic DNS question or not ... We run FreeIPA 4.6.4 on a RHEL7.6 clone, we do not use FreeIPA DNS and we currently do not use DNS discovery. I have read this: https://www.freeipa.org/page/Howto/IPA_locations<https://www.freeipa.org/page/Howto/IPA_locations#Advanced_configuration> and am comfortable configuring split view DNS records. As we depoy more sites. I am looking to move to using DNS discovery, however we use site specific DNS domains (rightly or wrongly with a private TLD ... cross that bridge when we come to it ...) such as: site1.blah site2.blah which is different from the given example of example.com being used across all sites. Our Realm Domain is blah - I have put the location based DNS records immediately under .blah. In testing, I see ipa clients initially query DNS for SRV records under site1.blah - when that fails the clients then perform a second DNS query for SRV records under .blah - which works and my test outcome is good - the setup works! Is it safe for me to assume that this process will remain the same for future IDM client versions? My concern is that if future versions neglect the second-attempt DNS discovery lookup (under .blah) then my setup will break. Thanks for any pointers Angus

1 0

Replica install Error ?
by Günther J. Niederwimmer 03 Jan '20

03 Jan '20

Hello, this is a new installed Server CentOS 7.7 but it is not possible to configure this for IPA replica I have this Error ipapython.admintool: ERROR [0:0:6]+[128:32:0] not in asn1Spec: GeneralName(componentType=NamedTypes(NamedType('rfc822Name', IA5String(tagSet=TagSet((), Tag(tagClass=128, tagFormat=0, tagId=1)))), NamedType('dNSName', IA5String(tagSet=TagSet((), Tag(tagClass=128, tagFormat=0, tagId=2)))), NamedType('directoryName', Name(componentType=NamedTypes(NamedType('', RDNSequence())), tagSet=TagSet((), Tag(tagClass=128, tagFormat=0, tagId=4)))), NamedType('uniformResourceIdentifier', IA5String(tagSet=TagSet((), Tag(tagClass=128, tagFormat=0, tagId=6)))), NamedType('iPAddress', OctetString(tagSet=TagSet((), Tag(tagClass=128, tagFormat=0, tagId=7)))), NamedType('registeredID', ObjectIdentifier('<no value>')))) ipapython.admintool: ERROR The ipa-replica-install command failed. See / var/log/ipareplica-install.log for more information I install before ipa-client-install, this is working but afterward for the replica i Have this Problem? firewall Ports are open. -- mit freundlichen Grüßen / best regards Günther J. Niederwimmer

2 13

Re: krbpasswordexpiration field gone from "ipa user-show" ?
by Igor Stets 03 Jan '20

03 Jan '20

We use ipa-server-4.6.4-10.el7.centos.6.x86_64 and update expiration check script: # userpw_expiry_datetime=$(/usr/bin/ipa user-show ${user} --all | grep krbpasswordexpiration | awk '{print $2}' | cut -c 1-14) userpw_expiry_datetime=$(/usr/bin/ipa user-show ${user} --all | grep -i "password expiration:" | awk '{print $4}' | cut -c 1-14) This is work for me. Regards. Igor S.

1 0

How to allow users to manage their own certs
by Michael Plemmons 03 Jan '20

03 Jan '20

We have a need where we want to allow a user to submit their own CSR to generate their own SSL certificate and to be able to download their own certificate. I get the following error: Insufficient access: Principal 'testplem(a)MGMT.EXAMPLE.COM' is not permitted to use CA 'ipa' with profile 'IECUserRoles' for certificate issuance. Here are the permissions I have setup. * Create a new Privilege called SelfService * Add the following permissions to the SelfService Privilege * Request Certificate (FreeIPA builtin permission) * Retrieve Certificates from the CA (FreeIPA builtin permission) * UserSelfSerivceCertificate (custom permission) * ReadCAProfile (custom permission) * ReadIPACA (custom permission) * Create Role called SelfService * Attach the SelfService Privilege to this Role * I then attach that Role to a test user. I am sure I am missing other permissions but I am not sure what. If there is already documentation that explains how to do this I am happy to reference that. If not, what else am I missing. ============ dn: cn=UserSelfSerivceCertificate,cn=permissions,cn=pbac,dc=mgmt,dc=example,dc=com member: cn=SelfService,cn=privileges,cn=pbac,dc=mgmt,dc=example,dc=com ipaPermRight: read ipaPermRight: search ipaPermRight: compare ipaPermRight: write ipaPermRight: add ipaPermTargetFilter: (objectclass=posixaccount) ipaPermBindRuleType: permission ipaPermissionType: SYSTEM ipaPermissionType: V2 cn: UserSelfSerivceCertificate objectClass: top objectClass: groupofnames objectClass: ipapermission objectClass: ipapermissionv2 ipaPermLocation: cn=users,cn=accounts,dc=mgmt,dc=example,dc=com ipaPermIncludedAttr: usercertificate ============ dn: cn=ReadCAProfile,cn=permissions,cn=pbac,dc=mgmt,dc=example,dc=com member: cn=SelfService,cn=privileges,cn=pbac,dc=mgmt,dc=example,dc=com ipaPermBindRuleType: permission ipaPermTarget: cn=IECUserRoles,cn=certprofiles,cn=ca,dc=mgmt,dc=example,dc=co m ipaPermRight: read ipaPermRight: search ipaPermTargetFilter: (objectclass=ipacertprofile) ipaPermissionType: SYSTEM ipaPermissionType: V2 cn: ReadCAProfile objectClass: top objectClass: groupofnames objectClass: ipapermission objectClass: ipapermissionv2 ipaPermLocation: cn=certprofiles,cn=ca,dc=mgmt,dc=example,dc=com ipaPermIncludedAttr: cn ipaPermIncludedAttr: description ipaPermIncludedAttr: ipacertprofilestoreissued ipaPermIncludedAttr: objectclass ============ dn: cn=ReadIPACA,cn=permissions,cn=pbac,dc=mgmt,dc=example,dc=com member: cn=SelfService,cn=privileges,cn=pbac,dc=mgmt,dc=example,dc=com ipaPermTarget: cn=ipa,cn=cas,cn=ca,dc=mgmt,dc=example,dc=com ipaPermRight: read ipaPermRight: search ipaPermRight: compare ipaPermTargetFilter: (objectclass=ipaca) ipaPermBindRuleType: permission ipaPermissionType: SYSTEM ipaPermissionType: V2 cn: ReadIPACA objectClass: top objectClass: groupofnames objectClass: ipapermission objectClass: ipapermissionv2 ipaPermLocation: cn=cas,cn=ca,dc=mgmt,dc=example,dc=com ipaPermIncludedAttr: cn ipaPermIncludedAttr: description ipaPermIncludedAttr: ipacaid ipaPermIncludedAttr: ipacaissuerdn ipaPermIncludedAttr: ipacasubjectdn ipaPermIncludedAttr: objectclass Thank you for any insight you are able to provide. -- *Mike Plemmons * Senior Infrastructure Engineer 614-427-2411 <https://oliveai.com/> 99 E. Main Street Columbus, OH 43215 oliveai.com Meet Olive, Your Newest Employee <https://youtu.be/9Vf84z9KA6Y>

2 2

IPA server rebooted after freeze, now services can't authenticate with ldap
by Kristian Petersen 02 Jan '20

02 Jan '20

My primary IPA server has failed. I was running a python script against IPA doing some user management when everything when unresponsive. I couldn't even get in at a console to check what was going on. I ended up rebooting it. After doing so, dirsrv wouldn't start because dse.ldif was missing. I have copied this file over from a replica IPA server, so dirsrv starts now. However, it seems that other services are unable to connect to LDAP properly. DNS isn't resolving when querying the primary even though ipactl shows named is running. smb and winbind won't start and it appears to be a problem with connecting to LDAP. Is there a way to check the integrity of my LDAP database? Or should I try to copy the LDAP database form my working replica to the primary? -- Kristian Petersen System Administrator BYU Dept. of Chemistry and Biochemistry

2 2

2025

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users January 2020