May 2020 - FreeIPA-users - Fedora mailing-lists

automember hostgroup by account?
by Amos 14 Jun '20

14 Jun '20

Is it possible to have an automember rule to add a host to a hostgroup based on the account used with ipa-install-client? Amos

3 6

Assisting users of frederik.lindenaar.nl with their password security
by Adam Roger 31 May '20

31 May '20

Hello there, I was using the password generator tool you mentioned on your page here: https://frederik.lindenaar.nl/2019/08/30/running-pivacyidea-with-freeipa.ht… While it does the job overall, I found another tool to be a better alternative. I thought other users might also appreciate it if you update your page. It is a clear and free: https://www.safetydetectives.com/password-meter/ It creates passwords from words, that should be easier to remember, which is why I use it. For example, the word "benediction" will be b=nedicT10n - super easy to remember (you need at least one password to remember as a master password, no?) In hope I helped back, Adam Roger

1 0

Deploying IPA on AWS
by William Muriithi 28 May '20

28 May '20

Hello everyone We want to move some of the systems for a co-location into AWS. IPA systems are some of our candidate servers. I have attempted to get this working by setting up a replica server in the cloud and attempting to setup replication - over VPN - and its not working. This is due to DNS issue on AWS being biased toward AWS DNS. If I use nmap, it verify I can reach port 53 (TCP and UDP) on the co-location from AWS, but if I do a dig against existing DNS, it doesn't seem to resolve. Have anyone gone through the exercise recently and managed to figure how to work around this limitation? Would be grateful if someone can share how the worked around this problem. Regards, William

3 5

IPA and legacy systems
by Ronald Wimmer 27 May '20

27 May '20

What would be a good solution to add systems where the FQDN cannot be changed? Would it make sense to add a second DNS A Record in the IPA domain for each of these systems? Is there any experience on how to deal with such a situation? Thanks a lot in advance! Cheers, Ronald

5 17

AD Trust question
by Monkey Bizness 27 May '20

27 May '20

Hi, I have an infrastructure with 2 ad clusters. AD 1 trusts AD 2 If I establish a one way trust between freeipa and AD1, users from AD2 can authenticate on feeipa clients right? based on https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/ht… id="-x-evo-selection-start-marker"> Thanks

2 4

AD users login and lookup fails with short name in Ubuntu16 freeipa-client
by Suchismita Panda 27 May '20

27 May '20

Hi, We are trying to configure our FreeIPA environment. We are using freeipa-client in both Ubuntu 18 and Ubuntu 16 servers. The FreeIPA server has one way trust to our AD. We have the domain name resolution order setup in the FreeIPA server. The AD users are able to ssh login to Ubuntu 18 fluently. But in Ubuntu 16, the AD user ssh login works only with domain name extension for AD users and fails with short name. Inside the Ubuntu 16 client, AD user lookup as well fails for short name, but works with domain name extension. Is there any extra configuration needed in sssd.conf other than the default configuration generated by freeipa-client? TIA

2 3

New DNS records not populating
by Andrew Meyer 27 May '20

27 May '20

I recently had a server that didn't get added to DNS but was joined to FreeIPA system. I just went backto fix it. I tried removing the host rebooting and re-adding it to the FreeIPA system. After doing this new DNS records did not get added. I went back to manually add the DNS records (A,SSHFP) and was successful however when I try to ssh to the server I get this: [andrew.meyer@jump01 ~]$ ssh pihole01.loc.example.com sss_ssh_knownhostsproxy: Could not resolve hostname pihole01.loc.example.com kex_exchange_identification: Connection closed by remote host [andrew.meyer@jump01 ~]$ But when I try to run a dig against the records added none of the them come back. [andrew.meyer@jump01 ~]$ dig pihole01.loc.example.com ; <<>> DiG 9.11.4-P2-RedHat-9.11.4-26.P2.el8 <<>> pihole01.loc.example.com ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 2980 ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4096 ; COOKIE: 05879881b6a519f543d896f85ecd7e4235ba486f22821495 (good) ;; QUESTION SECTION: ;pihole01.loc.example.com. IN A ;; AUTHORITY SECTION: loc.example.com. 3600 IN SOA freeipa001.loc.example.com. hostmaster.loc.example.com. 1590523365 3600 900 1209600 3600 ;; Query time: 0 msec ;; SERVER: 10.150.10.12#53(10.150.10.12) ;; WHEN: Tue May 26 15:38:26 CDT 2020 ;; MSG SIZE rcvd: 141 [andrew.meyer@jump01 ~]$ [andrew.meyer@jump01 ~]$ dig pihole01.loc.example.com A ; <<>> DiG 9.11.4-P2-RedHat-9.11.4-26.P2.el8 <<>> pihole01.loc.example.com A ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 24317 ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4096 ; COOKIE: da22b671a9a042aa3acbb8d95ecd71177b0f9a24a87f4651 (good) ;; QUESTION SECTION: ;pihole01.loc.example.com. IN A ;; AUTHORITY SECTION: loc.example.com. 3600 IN SOA freeipa001.loc.example.com. hostmaster.loc.example.com. 1590520949 3600 900 1209600 3600 ;; Query time: 0 msec ;; SERVER: 10.150.10.12#53(10.150.10.12) ;; WHEN: Tue May 26 14:42:15 CDT 2020 ;; MSG SIZE rcvd: 141 [andrew.meyer@jump01 ~]$ Here are the logs from bind on the freeipa server: 26-May-2020 15:27:24.686 validating asm-fedora.example.local/A: bad cache hit (local/DS) 26-May-2020 15:27:24.687 broken trust chain resolving 'asm-fedora.example.local/A/IN': 10.150.10.40#53 26-May-2020 15:27:24.729 no valid RRSIG resolving 'asm-fedora/DS/IN': 10.150.10.40#53 26-May-2020 15:27:24.729 no valid DS resolving 'asm-fedora/A/IN': 10.150.10.40#53 26-May-2020 15:28:00.622 validating asm-fedora.example.local/A: bad cache hit (local/DS) 26-May-2020 15:28:00.622 broken trust chain resolving 'asm-fedora.example.local/A/IN': 10.150.10.40#53 26-May-2020 15:28:00.636 validating asm-fedora/A: bad cache hit (asm-fedora/DS) 26-May-2020 15:28:00.636 broken trust chain resolving 'asm-fedora/A/IN': 10.150.10.40#53 26-May-2020 15:28:03.868 validating asm-fedora.example.local/A: bad cache hit (local/DS) 26-May-2020 15:28:03.869 broken trust chain resolving 'asm-fedora.example.local/A/IN': 10.150.10.40#53 26-May-2020 15:28:03.886 validating asm-fedora/A: bad cache hit (asm-fedora/DS) 26-May-2020 15:28:03.886 broken trust chain resolving 'asm-fedora/A/IN': 10.150.10.40#53 26-May-2020 15:28:08.154 validating gold-ev-g2.ocsp.swisssign.net/CNAME: no valid signature found 26-May-2020 15:28:08.223 validating gold-ev-g2.ocsp.swisssign.net/CNAME: no valid signature found 26-May-2020 15:28:08.280 validating ocsp.swisssign.net/A: no valid signature found 26-May-2020 15:28:08.349 validating swisssign.net/SOA: no valid signature found 26-May-2020 15:28:08.350 validating ocsp.swisssign.net/NSEC: no valid signature found 26-May-2020 15:28:11.556 insecurity proof failed resolving 'incoming.telemetry.mozilla.org/A/IN': 10.150.10.40#53 26-May-2020 15:28:11.556 insecurity proof failed resolving 'incoming.telemetry.mozilla.org/AAAA/IN': 10.150.10.40#53 26-May-2020 15:28:12.683 insecurity proof failed resolving 'snippets.cdn.mozilla.net/A/IN': 10.150.10.40#53 26-May-2020 15:28:12.683 insecurity proof failed resolving 'snippets.cdn.mozilla.net/AAAA/IN': 10.150.10.40#53 26-May-2020 15:28:26.783 validating gold-server-g2.ocsp.swisssign.net/CNAME: no valid signature found 26-May-2020 15:28:26.897 validating gold-server-g2.ocsp.swisssign.net/CNAME: no valid signature found 26-May-2020 15:28:47.512 insecurity proof failed resolving 'consent.cookiebot.com/A/IN': 10.150.10.40#53 26-May-2020 15:28:47.512 insecurity proof failed resolving 'consent.cookiebot.com/AAAA/IN': 10.150.10.40#53 26-May-2020 15:29:45.969 validating vrty.org.example.local/A: bad cache hit (local/DS) 26-May-2020 15:29:45.969 broken trust chain resolving 'vrty.org.example.local/A/IN': 10.150.10.40#53 26-May-2020 15:34:26.510 no valid RRSIG resolving 'local/DS/IN': 10.150.10.40#53 26-May-2020 15:34:26.510 no valid DS resolving 'vrty.org.example.local/A/IN': 10.150.10.40#53 26-May-2020 15:39:28.026 validating vrty.org.example.local/A: bad cache hit (local/DS) 26-May-2020 15:39:28.026 broken trust chain resolving 'vrty.org.example.local/A/IN': 10.150.10.40#53 26-May-2020 15:40:21.352 validating librenms.example.local/A: bad cache hit (local/DS) 26-May-2020 15:40:21.352 broken trust chain resolving 'librenms.example.local/A/IN': 10.150.10.40#53 26-May-2020 15:40:21.370 validating grocy01.example.local/A: bad cache hit (local/DS) 26-May-2020 15:40:21.370 broken trust chain resolving 'grocy01.example.local/A/IN': 10.150.10.40#53 26-May-2020 15:40:21.392 validating grocy01.example.local/MX: bad cache hit (local/DS) 26-May-2020 15:40:21.392 broken trust chain resolving 'grocy01.example.local/MX/IN': 10.150.10.40#53 26-May-2020 15:40:21.393 validating librenms.example.local/MX: bad cache hit (local/DS) 26-May-2020 15:40:21.393 broken trust chain resolving 'librenms.example.local/MX/IN': 10.150.10.40#53 26-May-2020 15:44:27.810 no valid RRSIG resolving 'local/DS/IN': 10.150.10.40#53 26-May-2020 15:44:27.810 no valid DS resolving 'vrty.org.example.local/A/IN': 10.150.10.40#53 26-May-2020 15:46:40.756 validating pihole01.loc.example.com.example.local/AAAA: bad cache hit (local/DS) 26-May-2020 15:46:40.756 broken trust chain resolving 'pihole01.loc.example.com.example.local/AAAA/IN': 10.150.10.40#53 26-May-2020 15:46:40.760 validating pihole01.loc.example.com.example.local/A: bad cache hit (local/DS) 26-May-2020 15:46:40.760 broken trust chain resolving 'pihole01.loc.example.com.example.local/A/IN': 10.150.10.40#53 26-May-2020 15:48:52.134 insecurity proof failed resolving 'collection-endpoint-prod.herokuapp.com/A/IN': 10.150.10.40#53 26-May-2020 15:49:31.721 validating vrty.org.example.local/A: bad cache hit (local/DS) 26-May-2020 15:49:31.721 broken trust chain resolving 'vrty.org.example.local/A/IN': 10.150.10.40#53 [root@freeipa001 data]#

1 0

API logout
by Peter Tselios 25 May '20

25 May '20

Hello, How do I perform a "session logout" in the API? I am using the ansible's URI module and so far I tried a few different options, like for example this: - name: Logout from IdM API uri: url: "https://{{ ipa_master }}/ipa/session/json" headers: Content-type: "application/json" Accept: "application/json" Referer: "https://{{ ipa_master }}/ipa" Cookie: "{{ ipa_session }}" method: POST body_format: json body: | { "id": 0, "method": "session_logout/1", "params": [ { "version": "{{ ipa_api_version | default('2.231') }}" } ] } which gives me the following error: message: 'Invalid JSON-RPC request: params must contain [args, options]' I also tried to simply visit the /ipa/session/session_logout, or the /ipa/session_logout. Both options gave me a 404. So, how do I "logout"?

2 1

centos with automount maps from ipa AND files
by Klaus Vink Slott 25 May '20

25 May '20

Hi I am trying to mix files based automount entries with some entries from IPA. I found that in order to make this work on Centos clients I must place files before sss in nsswitch. After this discovery I just made my ansible setup ensure this. grep automount /etc/nsswitch.conf #automount: files nisplus sss automount: files sss Now moving to Centos 8 I found warnings in nsswitch, not to edit it directly, so I revisited this oddity. I found that according to Redhat(1) authselect should not be used anyway, when IPA is in charge. But the setup made by ipa-client-automount also had the same problem: sss before files. Actually, I dont mind which one is consulted first, I have no mixed maps. But to me it seems that when sss is consulted first, auto.master is not used at all. Is this a in my setup or in Centos/Redhat - or am I missing something? (1)https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/… -- Regards Klaus

2 3

Reverse DNS zones with AD Trust
by Vinícius Ferrão 24 May '20

24 May '20

Hello, I would like to know how to handle reverse DNS zones when AD trust is enabled. I do have separate domains for AD and IPA as required, but the reverse zones are mixed, since the hosts are on the same network, which is common. In this scenario where should the reverse DNS zone be hosted? On the AD side? On IPA? How to make this work without breaking dynamic DNS updates for the PTR zones? Should any of them keep the zones as slaves? There’s some older discussions here on the list but without continuity and I don’t know the results, like this one: https://www.redhat.com/archives/freeipa-users/2015-June/msg00555.html In this old thread, the recommendation was to move the reverse zone to IPA and make some grants on BIND to allow Dynamic DNS updates. But is this still the case? There’s any oficial guidance in this issue? This scenario is supported or I must have separate networks, even with VLANs and IP addresses, for *nix and Windows clients? Thanks,

2 3

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users May 2020