Adding subjectAltName when the certificate is signed
by Radosław Kujawa
Hi list.
Is it possible to add email subjectAltName to a certificate when it is
being signed by the IPA?
My use case is that I have CSRs generated by the users. The tool used to
generate the CSR does not allow to add me to include an email
subjectAltName. The problem is that private key is held on the external
device, so I am not easily able to manipulate the CSR using openssl.
I already have a specific certificate profile added to IPA, used for
this process. But I am not sure if it is possible to enforce adding SAN
with user's email address when signing the certificate. I'd be grateful
for any hints.
Best regards,
Radoslaw
1 year, 7 months
FreeIPA, OSX, DockerDesktop
by james liu
PREP
====
git clone https://github.com/freeipa/freeipa-container.git
cd freeipa-container
mkdir /tmp/ipa-data
docker run --name freeipa-server-container -ti -h ipa.example.test --read-only -v /tmp/ip-data :/data:Z freeipa-server --sysctl net.ipv6.conf.all.disable_ipv6=1
RESULT
======
tar: etc/sysconfig/selinux: Cannot utime: No such file or directory
tar: Exiting with failure status due to previous errors
QUESTION
=========
I'm running DockerDesktop 2.0.4, OSX 10.13.6.
Is there a set of commands that will work?
Thanks
1 year, 7 months
How to use the forms based login interface to give IPA admin access to selected federated users?
by Chris Dagdigian
Hi folks,
I've got a three-node replicating FreeIPA cluster running in AWS with a
one-way trust to an Active Directory domain.
Things work well with respect to user overrides and RBAC rules affecting
client machines but I can't for the life of me figure out the order of
operations for allowing a couple of external AD users to have admin
access to the FreeIPA webUI itself.
There are 3 AD users I'd like to give WebUI admin access to.
So far I've tried the standard stuff I've used for non-IPA clients:
1) make group "corp_admins_external" populated with external
"username(a)domain.com" identities
2) Make group "corp_admins_posix" populated with the
corp_admins_external group
3) Added corp_admins_posix group to the admin group
Best I've been able to do so far is give myself login access to just the
user self-service page and even then that failed until
oddjob-mkhomedir() was running and enabled under authconfig
Is there a guide or a documentation set specific to granting admin
access to the webUI for forms-based login users?
Thanks!
Chris
1 year, 7 months
Announcing SSSD 2.4.0
by Pavel Březina
# SSSD 2.4.0
The SSSD team is proud to announce the release of version 2.4.0 of the
System Security Services Daemon. The tarball can be downloaded from:
https://github.com/SSSD/sssd/releases/tag/sssd-2_4_0
See the full release notes at:
https://sssd.io/docs/users/relnotes/notes_2_4_0
RPM packages will be made available for Fedora shortly.
## Feedback
Please provide comments, bugs and other feedback via the sssd-devel
or sssd-users mailing lists:
https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
https://lists.fedorahosted.org/mailman/listinfo/sssd-users
## Highlights
- `libnss` support was dropped, SSSD now supports only `openssl`
cryptography
### New features
- Session recording can now exclude specific users or groups when
`scope` is set to `all` (see `exclude_users` and `exclude_groups` options)
- Active Directory provider now sends CLDAP pings over UDP protocol to
Domain Controllers in parallel to determine site and forest to speed up
server discovery
### Packaging changes
- python2 bindings are disable by default, use `--with-python2-bindings`
to build it
### Documentation Changes
- Default value of `client_idle_timeout` changed from 60 to 300 seconds
for KCM, this allows more time for user interaction (e.g. during `kinit`)
- Added `exclude_users` and `exclude_groups` option to
`session_recording` section, this allows to exclude user or groups from
session recording when `scope` is set to `all`
- Added `ldap_library_debug_level` option to enable debug messages from
`libldap`
- Added `dyndns_auth_ptr` to set authentication mechanism for PTR DNS
records update
- Added `ad_allow_remote_domain_local_groups` to be compatible with
other solutions
1 year, 7 months
Re: Stop/Disable Apache on IdM servers
by Rob Crittenden
Angus Clarke via FreeIPA-users wrote:
> Hello
>
> We have a single mesh of FreeIPA servers in several different locations,
> we capture logs (apache ErrorLog directive) to a log server in each of
> those locations. When auditors ask us questions we have to trawl log
> servers from all locations as our IdM administrators might have used any
> of the IdM servers to make changes.
>
> To limit that access to one site, I am considering stopping and
> disabling apache on all IdM servers at other sites and just wanted to
> check there are no unintended consequences in that action.
>
> I'm not looking for enforcement, merely a means of persuading the team
> to use the web interface or command line tools at one site.
It's completely untested so if something went wrong you'd be pretty far
out on the ledge.
You're purposely creating a single-point-of-failure. You'd need to work
out some system to transition the web server to another server.
The chosen server would need to run a CA, otherwise it will try to find
one and fail at connecting since the CA connect is proxied through Apache.
Establishing a new CA would likewise almost certainly be problematic.
The ipa-ca CNAME is used so clients can use OCSP. You'd have to manually
limit this value to only the available web server. Same with CRL.
Running other administrative commands on those hosts would fail
miserably (ipa-certupdate, ipa-cacert-manage for sure).
I'm not certain if ipa-server-upgrade which is also run at package
installation needs local API access. IPA servers make certain
assumptions about what basic services are available.
So this could well be the kind of thing that seems to work, you relax
and forget about it, then all heck breaks loose.
Either way, masking/stopping the service wouldn't really work since it
is managed via ipactl. You'd have to mark the service as disabled in
IPA, and I'm not sure you can do that to an IPA service so you'd
probably have to do it manually using ldapmodify.
rob
1 year, 7 months
permanent service account keys for kerberos NFS share
by Kevin Vasko
Hello,
We have an application that does some data processing on our NFS server. Users typically just ssh into a box which then has a kerberos key generated for them, which allows them access the NFS share and run the script.
We are wanting to set this up in a more automated fashion. Such as running the script in the background as a service. However, after a few days the kerberos keys become invalid killing access to the NFS share and the data.
Is there a way to generate some account/keys that will have permanent access for service level stuff like this?
-Kevin
1 year, 7 months
slapd-IPA-MYDOMAIN-COM missing configuration.
by Albert Szostkiewicz
Hi!
My dirsrv(a)IPA-MYDOMAIN-COM.service on IPA server fails to start due to missing configuration. How can I re-create one ?
journalctl:
ds_systemd_ask_password_acl[10117]: grep: /etc/dirsrv/slapd-IPA-MYDOMAIN-COM/dse.ldif: No such file or directory
ns-slapd[10122]: INFO - dse_check_file - The config /etc/dirsrv/slapd-IPA-MYDOMAIN-COM/dse.ldif can not be accessed. Attempting restore ... (reason: 0)
ns-slapd[10122]: INFO - dse_check_file - The backup /etc/dirsrv/slapd-IPA-MYDOMAIN-COM/dse.ldif.bak can not be accessed. Check it exists and permissions.
ns-slapd[10122]: ERR - slapd_bootstrap_config - No valid configurations can be accessed! You must restore /etc/dirsrv/slapd-IPA-MYDOMAIN-COM/dse.ldif from ba>
ns-slapd[10122]: EMERG - main - The configuration files in directory /etc/dirsrv/slapd-IPA-MYDOMAIN-COM could not be read or were not found. Please refer to>
systemd[1]: dirsrv(a)IPA-MYDOMAIN-COM.service: Main process exited, code=exited, status=1/FAILURE
systemd[1]: dirsrv(a)IPA-MYDOMAIN-COM.service: Failed with result 'exit-code'.
systemd[1]: Failed to start 389 Directory Server IPA-MYDOMAIN-COM..
-- Subject: Unit dirsrv(a)IPA-MYDOMAIN-COM.service has failed
$ ls /etc/dirsrv/
drwxr-xr-x 2 root root 82 Nov 13 2019 config
-rw------- 1 dirsrv dirsrv 570 Sep 18 2019 ds.keytab
drwxr-xr-x 2 root root 25 Nov 13 2019 schema
drwxr-x--- 4 dirsrv dirsrv 4096 Oct 7 21:26 slapd-HOME-MYDOMAIN-COM
drwxr-x--- 2 dirsrv dirsrv 37 Sep 18 2019 slapd-HOME-MYDOMAIN-COM.removed
drwxr-x--- 2 dirsrv dirsrv 37 Feb 18 2019 slapd-IPA-MYDOMAIN-COM.removed
There is one ".removed" - not sure why and if i can maybe re-use it ?
Cheers!
1 year, 7 months
Stop/Disable Apache on IdM servers
by Angus Clarke
Hello
We have a single mesh of FreeIPA servers in several different locations, we capture logs (apache ErrorLog directive) to a log server in each of those locations. When auditors ask us questions we have to trawl log servers from all locations as our IdM administrators might have used any of the IdM servers to make changes.
To limit that access to one site, I am considering stopping and disabling apache on all IdM servers at other sites and just wanted to check there are no unintended consequences in that action.
I'm not looking for enforcement, merely a means of persuading the team to use the web interface or command line tools at one site.
Thanks!
Angus
1 year, 7 months
pki-tomcat wont start; LDAP auth failure
by Arjen Heidinga
Hello all!
Since sime time my pki-tomcat deamon can't connect to the LDAP., ging me
an error (below). The root-CA was expired in the meantime, I fixed it
with some hack-n-slashwork. I am not sure what credentials (none, client
cert?) are used to connect.
Does anyone have pointers? Hope I have not snipped too much log.
Thanks,
Arjen Heidinga
freeipa-server-common-4.8.9-2.fc32.noarch
2020-10-08 12:46:35 [main] FINEST: Getting internaldb.doCloning=true
2020-10-08 12:46:35 [main] FINE: LdapBoundConnFactory: doCloning: true
2020-10-08 12:46:35 [main] FINE: LdapBoundConnFactory: mininum: 3
2020-10-08 12:46:35 [main] FINE: LdapBoundConnFactory: maximum: 15
2020-10-08 12:46:35 [main] FINE: LdapBoundConnFactory: host:
starkey.platypusnet.org
2020-10-08 12:46:35 [main] FINE: LdapBoundConnFactory: port: 636
2020-10-08 12:46:35 [main] FINE: LdapBoundConnFactory: secure: true
2020-10-08 12:46:35 [main] FINE: LdapBoundConnFactory: authentication: 2
2020-10-08 12:46:35 [main] FINE: LdapBoundConnFactory: makeConnection(true)
2020-10-08 12:46:35 [main] FINEST: Getting
internaldb.ldapauth.clientCertNickname=subsystemCert cert-pki-ca
2020-10-08 12:46:35 [main] FINEST: Property tcp.keepAlive not found
2020-10-08 12:46:35 [main] FINEST: Getting tcp.keepAlive=true
2020-10-08 12:46:35 [main] FINE: TCP Keep-Alive: true
2020-10-08 12:46:35 [main] FINE: LdapBoundConnection: Connecting to
starkey.platypusnet.org:636 with client cert auth
2020-10-08 12:46:35 [main] FINE:
ldapconn/PKISocketFactory.makeSSLSocket: begins
2020-10-08 12:46:35 [main] FINE: SSLClientCertificateSelectionCB:
Setting desired cert nickname to: subsystemCert cert-pki-ca
2020-10-08 12:46:35 [main] FINE: LdapJssSSLSocket: set client auth cert
nickname subsystemCert cert-pki-ca
2020-10-08 12:46:35 [main] FINE: SSLClientCertificatSelectionCB: Entering!
2020-10-08 12:46:35 [main] FINE: Candidate cert: Server-Cert cert-pki-ca
2020-10-08 12:46:35 [main] FINE: Candidate cert: caSigningCert cert-pki-ca
2020-10-08 12:46:35 [main] FINE: SSLClientCertificateSelectionCB:
returning: null
2020-10-08 12:46:35 [main] FINE:
PKIClientSocketListener.handshakeCompleted: begins
2020-10-08 12:46:35 [main] FINE: Handshake completed:
2020-10-08 12:46:35 [main] FINE: - client: 192.168.124.201
2020-10-08 12:46:35 [main] FINE: - server: 192.168.124.201
2020-10-08 12:46:35 [main] FINE: - subject: SYSTEM
2020-10-08 12:46:35 [main] FINE: SignedAuditLogger: event
CLIENT_ACCESS_SESSION_ESTABLISH
2020-10-08 12:46:35 [main] FINE: LogFile: event type not selected:
CLIENT_ACCESS_SESSION_ESTABLISH
2020-10-08 12:46:35 [main] FINE:
PKIClientSocketListener.handshakeCompleted:
CS_CLIENT_ACCESS_SESSION_ESTABLISH_SUCCESS
2020-10-08 12:46:35 [main] FINE:
PKIClientSocketListener.handshakeCompleted: clientIP=192.168.124.201
serverIP=192.168.124.201 serverPort=31746
2020-10-08 12:46:35 [main] FINE: SSL handshake happened
2020-10-08 12:46:35 [main] SEVERE: LdapBoundConnFactory: Unable to
connect to LDAP server: Authentication failed
netscape.ldap.LDAPException: Authentication failed (48)
at
netscape.ldap.LDAPSaslBind.checkForSASLBindCompletion(Unknown Source)
at netscape.ldap.LDAPSaslBind.bind(Unknown Source)
at netscape.ldap.LDAPSaslBind.bind(Unknown Source)
at netscape.ldap.LDAPConnection.authenticate(Unknown Source)
at netscape.ldap.LDAPConnection.authenticate(Unknown Source)
at netscape.ldap.LDAPConnection.checkClientAuth(Unknown Source)
at netscape.ldap.LDAPConnection.connect(Unknown Source)
at netscape.ldap.LDAPConnection.connect(Unknown Source)
at netscape.ldap.LDAPConnection.connect(Unknown Source)
at
com.netscape.cmscore.ldapconn.LdapBoundConnection.<init>(LdapBoundConnection.java:105)
at
com.netscape.cmscore.ldapconn.LdapBoundConnFactory.makeConnection(LdapBoundConnFactory.java:285)
at
com.netscape.cmscore.ldapconn.LdapBoundConnFactory.init(LdapBoundConnFactory.java:261)
1 year, 7 months
