September 2021 - FreeIPA-users - Fedora mailing-lists

Adding SAML2 & OIDC
by Ciro Iriarte 26 Sep '21

26 Sep '21

Hello, I'm looking forward to add 2FA, SAML2 & OIDC interfaces to my authentication services running on FreeIPA. Are there any recommended integrations?. I'm thinking about implementing Authelia or Keycloak. My main concern is the first forced password change & following password expirations (should not be able to proceed without changing password and yet be able to change it). Would pretty much prefer "self service" by the end user. Regards, CI.-

2 3

FreeIPA LDAP Apache Basic Auth
by Thorsten Johannsen 26 Sep '21

26 Sep '21

Hi, I'm pulling my hair with FreeIPA and Apache BasicAuth LDAP. I have an application behind an Apache reverse Proxy that I want to "protect" with LDAP Authentification. This is the (redacted) apache configuration: -------------------------------------------------------------------------------------- <VirtualHost *:443> ServerName acme.server.org ProxyRequests Off ProxyPreserveHost On # Auth changes in 2.4 - see http://httpd.apache.org/docs/2.4/upgrading.html#run-time <Proxy *> #Require all granted </Proxy> <Location /admin> Order Deny,Allow Deny from all Allow from 10.66.38.0/24 </Location> ProxyPass / http://INTSERVER:1234/ ProxyPassReverse / http://INTSERVER:1234/ Loglevel ldap_module:debug Loglevel auth_basic:debug Loglevel authz_core:debug <Location /> Options Indexes FollowSymlinks AuthType Basic AuthBasicProvider ldap AuthName "ACME AUTHENTICATION" AuthLDAPURL ldap://ipa2.internal.lan/cn=users,cn=accounts,dc=internal,dc=lan?uid?sub AuthLDAPBindDN uid=s_ldapquery,cn=sysaccounts,cn=etc,dc=internal,dc=lan AuthLDAPBindPassword XXXXXXXXXXXXXXXXXXXXX Require valid-user </Location> SSLCertificateFile /etc/letsencrypt/live/XXXX/cert.pem SSLCertificateKeyFile /etc/letsencrypt/live/XXXX/privkey.pem Include /etc/letsencrypt/options-ssl-apache.conf SSLCertificateChainFile /etc/letsencrypt/live/XXXX/chain.pem </VirtualHost> -------------------------------------------------------------------------------------- The Bind-User "s_ldapquery" is working fine, passwords tripple checked and used with other LDAP integrations. When authenticating, apache logs show: [Sat Sep 25 18:40:25.891588 2021] [authz_core:debug] [pid 414] mod_authz_core.c(809): [client 1.2.3.4:52628] AH01626: authorization result of Require valid-user : denied (no authenticated user yet) [Sat Sep 25 18:40:25.891683 2021] [authz_core:debug] [pid 414] mod_authz_core.c(809): [client 1.2.3.4:52628] AH01626: authorization result of <RequireAny>: denied (no authenticated user yet) [Sat Sep 25 18:40:35.786942 2021] [authz_core:debug] [pid 413] mod_authz_core.c(809): [client 1.2.3.4:52629] AH01626: authorization result of Require valid-user : denied (no authenticated user yet) [Sat Sep 25 18:40:35.787025 2021] [authz_core:debug] [pid 413] mod_authz_core.c(809): [client 1.2.3.4:52629] AH01626: authorization result of <RequireAny>: denied (no authenticated user yet) [Sat Sep 25 18:40:36.028473 2021] [ldap:debug] [pid 413] util_ldap.c(379): AH01278: LDAP: Setting referrals to On. [Sat Sep 25 18:40:36.210906 2021] [authz_core:debug] [pid 413] mod_authz_core.c(809): [client 1.2.3.4:52629] AH01626: authorization result of Require valid-user : granted [Sat Sep 25 18:40:36.210987 2021] [authz_core:debug] [pid 413] mod_authz_core.c(809): [client 1.2.3.4:52629] AH01626: authorization result of <RequireAny>: granted [Sat Sep 25 18:40:36.300669 2021] [authz_core:debug] [pid 413] mod_authz_core.c(809): [client 1.2.3.4:52629] AH01626: authorization result of Require valid-user : denied (no authenticated user yet), referer: https://acme.server.org/ [Sat Sep 25 18:40:36.300749 2021] [authz_core:debug] [pid 413] mod_authz_core.c(809): [client 1.2.3.4:52629] AH01626: authorization result of <RequireAny>: denied (no authenticated user yet), referer: https://acme.server.org/ There is a "granted" in between, but it does not work. Then authentication itself seems to work, though, because if I specify the wrong password, the logs lines change to: [Sat Sep 25 18:43:43.542566 2021] [authz_core:debug] [pid 432] mod_authz_core.c(809): [client 1.2.3.4:52678] AH01626: authorization result of Require valid-user : denied (no authenticated user yet) [Sat Sep 25 18:43:43.542639 2021] [authz_core:debug] [pid 432] mod_authz_core.c(809): [client 1.2.3.4:52678] AH01626: authorization result of <RequireAny>: denied (no authenticated user yet) [Sat Sep 25 18:43:45.956792 2021] [ldap:debug] [pid 432] util_ldap.c(379): AH01278: LDAP: Setting referrals to On. [Sat Sep 25 18:43:46.139978 2021] [auth_basic:error] [pid 432] [client 1.2.3.4:52678] AH01617: user u_test: authentication failure for "/": Password Mismatch I tried various examples found online on how to setup Apache BasicAuth LDAP Integration with FreeIPA but none worked. What I don't understand in the first place is the "denied (no authenticated user yet)" repeating and then in the midle a "require valid-user: granted". What am I doing wrong here or am I missing the point entirely? Any help would be appreciated! best regards, Thorsten

1 1

sss_ssh_authorizedkeys vs user certificates
by Radoslaw Kujawa 24 Sep '21

24 Sep '21

Hi list. I have a CentOS 8.4 machine (fully updated), where sss_ssh_authorizedkeys is successfully able to pull public keys from IPA user certificates. Recently I have installed a new Fedora 34 machine and this functionality is not working - running "sss_ssh_authorizedkeys username" only reports public keys explicitly added to the account, omitting keys from X.509 certificates. Both machines are joined to the same IPA domain. I've checked sssd configuration, and ssh_use_certificate_keys option seems to be default, as the man page states. To be extra sure, I have also manually added it sssd.conf: [ssh] ssh_use_certificate_keys = true CentOS machine has the following package versions: python3-sss-murmur-2.4.0-9.el8_4.2.x86_64 sssd-proxy-2.4.0-9.el8_4.2.x86_64 libsss_sudo-2.4.0-9.el8_4.2.x86_64 libsss_autofs-2.4.0-9.el8_4.2.x86_64 sssd-nfs-idmap-2.4.0-9.el8_4.2.x86_64 sssd-2.4.0-9.el8_4.2.x86_64 libsss_idmap-2.4.0-9.el8_4.2.x86_64 sssd-ldap-2.4.0-9.el8_4.2.x86_64 sssd-kcm-2.4.0-9.el8_4.2.x86_64 sssd-dbus-2.4.0-9.el8_4.2.x86_64 python3-cssselect-0.9.2-10.el8.noarch sssd-ipa-2.4.0-9.el8_4.2.x86_64 sssd-ad-2.4.0-9.el8_4.2.x86_64 python3-sssdconfig-2.4.0-9.el8_4.2.noarch sssd-krb5-2.4.0-9.el8_4.2.x86_64 sssd-tools-2.4.0-9.el8_4.2.x86_64 sssd-client-2.4.0-9.el8_4.2.x86_64 sssd-krb5-common-2.4.0-9.el8_4.2.x86_64 sssd-common-2.4.0-9.el8_4.2.x86_64 sssd-common-pac-2.4.0-9.el8_4.2.x86_64 libsss_certmap-2.4.0-9.el8_4.2.x86_64 libsss_nss_idmap-2.4.0-9.el8_4.2.x86_64 libsss_simpleifp-2.4.0-9.el8_4.2.x86_64 python3-sss-2.4.0-9.el8_4.2.x86_64 Fedora machine has the following package versions: libsss_idmap-2.5.2-2.fc34.aarch64 libsss_autofs-2.5.2-2.fc34.aarch64 libsss_sudo-2.5.2-2.fc34.aarch64 libsss_certmap-2.5.2-2.fc34.aarch64 sssd-nfs-idmap-2.5.2-2.fc34.aarch64 libsss_nss_idmap-2.5.2-2.fc34.aarch64 sssd-client-2.5.2-2.fc34.aarch64 sssd-common-2.5.2-2.fc34.aarch64 sssd-common-pac-2.5.2-2.fc34.aarch64 sssd-dbus-2.5.2-2.fc34.aarch64 sssd-krb5-common-2.5.2-2.fc34.aarch64 python3-sssdconfig-2.5.2-2.fc34.noarch python3-sss-2.5.2-2.fc34.aarch64 sssd-tools-2.5.2-2.fc34.aarch64 python3-sss-murmur-2.5.2-2.fc34.aarch64 sssd-ipa-2.5.2-2.fc34.aarch64 sssd-kcm-2.5.2-2.fc34.aarch64 Any hints on how to make sss_ssh_authorizedkeys pull keys from IPA user certificates on Fedora, or how to further debug this? Best regards, Radoslaw

3 4

FreeIPA - FreeRADIUS - privacyIDEA: OTP login not possible with policy otppin = userstore
by Guido Nottebrok 23 Sep '21

23 Sep '21

Configuration: FreeIPA and FreeRADIUS : Fedora 34 on host ipa.example.com with ip 192.168.1.139 (Proxmox LXC Container) privacyIDEA: Debian 10 on host mfa.example.com with ip 192.168.1.136 (Proxmox LXC Container) yum info freeipa-server Version : 4.9.6 yum info freeradius Version : 3.0.21 pip show privacyidea Name: privacyIDEA Version: 3.5.1 The connection between FreeRADIUS and privacyIDEA is configured with the perl module privacyidea_radius.pm # ipa user-show otp_test Principal name: otp_test(a)EXAMPLE.COM User authentication types: radius, otp RADIUS proxy configuration: privacyidea Password: True Kerberos keys available: True # ipa user-show ipa_test Principal name: ipa_test(a)EXAMPLE.COM User authentication types: password Password: True Kerberos keys available: True # ipa radiusproxy-show privacyidea RADIUS proxy server name: privacyidea Server: 192.168.1.139 Problem: It is not possible to login with user otp_test when the policy in privacyIDEA is set to 'otppin = userstore'. Test: [ipa_test@ipa ~]$ su otp_test First Factor: <password> Second Factor: <otp> su: Authentication failure If I set the privacyIDEA policy to 'otppin = tokenpin' and set the pin = <password> login works. So I think that in general authentication with privacyIDEA works. The problem is that privacyIDEA can not check the password against the FreeIPA LDAP as you can see in the privacyidea.log file. In the krb5kdc.log you can see 'preauth (otp) verify failure: Generic preauthentication failure' Can anybody help me to fix that? Here are parts of the logs: /var/log/privacyidea/privacyidea.log ------------------------------------ [2021-09-22 05:27:03,157][5358][139872937498368][INFO][privacyidea.lib.crypto:821] initializing HSM class: <class 'privacyidea.lib.security.default.DefaultSecurityModule'> [2021-09-22 05:27:03,158][5358][139872937498368][INFO][privacyidea.lib.crypto:260] Initialized HSM object {'obj': <privacyidea.lib.security.default.DefaultSecurityModule object at 0x7f36a43b48d0>} [2021-09-22 05:27:03,486][5358][139872937498368][INFO][privacyidea.lib.user:233] user 'otp_test' found in resolver 'FreeIPA' [2021-09-22 05:27:03,486][5358][139872937498368][INFO][privacyidea.lib.user:234] userid resolved to '69820e7e-1872-11ec-b5e7-8ae8999d4764' [2021-09-22 05:27:03,492][5358][139872937498368][INFO][privacyidea.lib.pooling:119] Created a new engine registry: <privacyidea.lib.pooling.NullEngineRegistry object at 0x7f369fa787b8> [2021-09-22 05:27:03,557][5358][139872937498368][INFO][privacyidea.lib.tokens.vasco:56] PI_VASCO_LIBRARY option is not set, functionality disabled [2021-09-22 05:27:03,566][5358][139872937498368][INFO][privacyidea.lib.user:360] User 'otp_test' from realm 'example.com' tries to authenticate [2021-09-22 05:27:03,576][5358][139872937498368][WARNING][privacyidea.lib.resolvers.LDAPIdResolver:354] failed to check password for '69820e7e-1872-11ec-b5e7-8ae8999d4764'/'uid=otp_test,cn=users,cn=accounts,dc=nottebrok,dc=net': Exception('Wrong credentials') [2021-09-22 05:27:03,577][5358][139872937498368][INFO][privacyidea.lib.user:371] user User(login='otp_test', realm='example.com', resolver='FreeIPA') failed to authenticate. /var/log/radius/radius.log -------------------------- Wed Sep 22 05:27:01 2021 : Info: rlm_perl: Config File /etc/privacyidea/rlm_perl.ini found! Wed Sep 22 05:27:01 2021 : Info: rlm_perl: Debugging config: true Wed Sep 22 05:27:01 2021 : Info: rlm_perl: Default URL https://mfa.example.com/validate/check Wed Sep 22 05:27:01 2021 : Info: rlm_perl: Looking for config for auth-type Perl Wed Sep 22 05:27:01 2021 : rlm_perl: RAD_REQUEST: User-Password = <password><otp> Wed Sep 22 05:27:01 2021 : rlm_perl: RAD_REQUEST: Packet-Src-IP-Address = 192.168.1.139 Wed Sep 22 05:27:01 2021 : rlm_perl: RAD_REQUEST: NAS-Identifier = ipa.example.com Wed Sep 22 05:27:01 2021 : rlm_perl: RAD_REQUEST: Service-Type = Authenticate-Only Wed Sep 22 05:27:01 2021 : rlm_perl: RAD_REQUEST: User-Name = otp_test Wed Sep 22 05:27:01 2021 : Info: rlm_perl: Password encoding guessed: ascii Wed Sep 22 05:27:01 2021 : Info: rlm_perl: Setting client IP to 192.168.1.139. Wed Sep 22 05:27:01 2021 : Info: rlm_perl: Auth-Type: Perl Wed Sep 22 05:27:01 2021 : Info: rlm_perl: url: https://mfa.example.com/validate/check Wed Sep 22 05:27:01 2021 : Info: rlm_perl: user sent to privacyidea: otp_test Wed Sep 22 05:27:01 2021 : Info: rlm_perl: realm sent to privacyidea: Wed Sep 22 05:27:01 2021 : Info: rlm_perl: resolver sent to privacyidea: Wed Sep 22 05:27:01 2021 : Info: rlm_perl: client sent to privacyidea: 192.168.1.139 Wed Sep 22 05:27:01 2021 : Info: rlm_perl: state sent to privacyidea: Wed Sep 22 05:27:01 2021 : rlm_perl: urlparam client = 192.168.1.139 Wed Sep 22 05:27:01 2021 : rlm_perl: urlparam pass = <password><otp> Wed Sep 22 05:27:01 2021 : rlm_perl: urlparam user = otp_test Wed Sep 22 05:27:01 2021 : Info: rlm_perl: Request timeout: 10 Wed Sep 22 05:27:01 2021 : Info: rlm_perl: Not verifying SSL certificate! Wed Sep 22 05:27:03 2021 : Info: rlm_perl: elapsed time for privacyidea call: 2.298527 Wed Sep 22 05:27:03 2021 : rlm_perl: Content {"detail": {"message": "wrong otp pin", "threadid": 139872937498368}, "id": 1, "jsonrpc": "2.0", "result": {"status": true, "value": false}, "time": 1632288423.7560399, "version": "privacyIDEA 3.5.1", "versionnumber": "3.5.1", "signature": "rsa_sha256_pss:a4ea05ca498b36c09137d1f492bc882109adfc8a7fb3a185fb4b8638255dd2539659897591afdffd99b6cdd1bb5c5741f63f2037abdc85c5bafae669a97f1e7cbc76f26da70139651e796e60550d9410c7f7c6cab8f3581cbb6f676683da9a1c4659ec2f30187d18c25297dda2a61e06085ee4265606670377040247e19bb58ca0f04aca71cf30b198376eaf263503228176ec249dccb82036e987d190c6108fddadebd250deb2c19995b7dbeeb8ed2d233066389c871e99c76d85ef908009448c5af2ca7d0605852720bdb9ade99b58711593c9b9f92a2ca45aa351d0d33c721df9417d464aaf9052cdce99440d851ea6f9940de8576df4023974866cc5fb16"} Wed Sep 22 05:27:03 2021 : Info: rlm_perl: privacyIDEA Result status is true! Wed Sep 22 05:27:03 2021 : Info: rlm_perl: privacyIDEA access denied for otp_test realm='' Wed Sep 22 05:27:03 2021 : Info: rlm_perl: return RLM_MODULE_REJECT /var/log/dirsrv/slapd-NOTTEBROK-NET/access ------------------------------------------ [22/Sep/2021:05:27:01.564080274 +0000] conn=3895 op=2 RESULT err=0 tag=101 nentries=1 wtime=0.000049870 optime=0.000150998 etime=0.000199231 [22/Sep/2021:05:27:01.564323730 +0000] conn=3895 op=3 SRCH base="cn=privacyidea,cn=radiusproxy,dc=nottebrok,dc=net" scope=0 filter="(objectClass=*)" attrs="ipatokenRadiusServer ipatokenRadiusSecret ipatokenRadiusTimeout ipatokenRadiusRetries ipatokenUserMapAttribute" [22/Sep/2021:05:27:01.564421567 +0000] conn=3895 op=3 RESULT err=0 tag=101 nentries=1 wtime=0.000041954 optime=0.000099034 etime=0.000139513 [22/Sep/2021:05:27:01.566557293 +0000] conn=3892 op=11 SRCH base="cn=ipservices,cn=accounts,dc=nottebrok,dc=net" scope=2 filter="(&(cn=radius)(ipServiceProtocol=udp)(objectClass=ipService))" attrs="objectClass cn ipServicePort ipServiceProtocol entryusn" [22/Sep/2021:05:27:01.566712813 +0000] conn=3892 op=11 RESULT err=0 tag=101 nentries=0 wtime=0.000084750 optime=0.000157349 etime=0.000240250 [22/Sep/2021:05:27:03.246250221 +0000] conn=3897 fd=121 slot=121 connection from 192.168.1.136 to 192.168.1.139 [22/Sep/2021:05:27:03.246571254 +0000] conn=3897 op=-1 fd=121 closed error - B1 [22/Sep/2021:05:27:03.246630909 +0000] conn=3898 fd=126 slot=126 connection from 192.168.1.136 to 192.168.1.139 [22/Sep/2021:05:27:03.246931986 +0000] conn=3898 op=0 EXT oid="1.3.6.1.4.1.1466.20037" name="start_tls_plugin" [22/Sep/2021:05:27:03.246975107 +0000] conn=3898 op=0 RESULT err=0 tag=120 nentries=0 wtime=0.000135107 optime=0.000048051 etime=0.000181367 [22/Sep/2021:05:27:03.250916223 +0000] conn=3898 TLS1.2 128-bit AES-GCM [22/Sep/2021:05:27:03.251829337 +0000] conn=3898 op=1 BIND dn="uid=privacyidea-bind,cn=sysaccounts,cn=etc,dc=nottebrok,dc=net" method=128 version=3 [22/Sep/2021:05:27:03.252339317 +0000] conn=3898 op=1 RESULT err=0 tag=97 nentries=0 wtime=0.004225141 optime=0.000524375 etime=0.004747290 dn="uid=privacyidea-bind,cn=sysaccounts,cn=etc,dc=nottebrok,dc=net" [22/Sep/2021:05:27:03.253292531 +0000] conn=3898 op=2 SRCH base="" scope=0 filter="(objectClass=*)" attrs="subschemaSubentry +" [22/Sep/2021:05:27:03.254751970 +0000] conn=3898 op=2 RESULT err=0 tag=101 nentries=1 wtime=0.000091257 optime=0.001461035 etime=0.001549672 [22/Sep/2021:05:27:03.256597869 +0000] conn=3898 op=3 SRCH base="cn=schema" scope=0 filter="(objectClass=subschema)" attrs="objectClasses attributeTypes ldapSyntaxes matchingRules matchingRuleUse dITContentRules dITStructureRules nameForms createTimestamp modifyTimestamp * + aci" [22/Sep/2021:05:27:03.351666572 +0000] conn=3898 op=3 RESULT err=0 tag=101 nentries=1 wtime=0.000120956 optime=0.095069951 etime=0.095184874 [22/Sep/2021:05:27:03.484292759 +0000] conn=3898 op=4 SRCH base="cn=users,cn=accounts,dc=nottebrok,dc=net" scope=2 filter="(&(uid=*)(objectClass=inetOrgPerson)(uid=otp_test))" attrs="telephoneNumber mobile mail sn givenName gecos uid ipaUniqueID" [22/Sep/2021:05:27:03.485807992 +0000] conn=3898 op=4 RESULT err=0 tag=101 nentries=1 wtime=0.000140279 optime=0.001516926 etime=0.001653375 notes=U details="Partially Unindexed Filter" [22/Sep/2021:05:27:03.564155920 +0000] conn=3898 op=5 SRCH base="cn=users,cn=accounts,dc=nottebrok,dc=net" scope=2 filter="(&(uid=*)(objectClass=inetOrgPerson)(ipaUniqueID=69820e7e-1872-11ec-b5e7-8ae8999d4764))" attrs="telephoneNumber mobile mail sn givenName gecos uid" [22/Sep/2021:05:27:03.565628714 +0000] conn=3898 op=5 RESULT err=0 tag=101 nentries=1 wtime=0.000138785 optime=0.001475478 etime=0.001609564 notes=U details="Partially Unindexed Filter" [22/Sep/2021:05:27:03.568418557 +0000] conn=3898 op=6 SRCH base="cn=users,cn=accounts,dc=nottebrok,dc=net" scope=2 filter="(&(uid=*)(objectClass=inetOrgPerson)(ipaUniqueID=69820e7e-1872-11ec-b5e7-8ae8999d4764))" attrs="telephoneNumber mobile mail sn givenName gecos uid" [22/Sep/2021:05:27:03.569936263 +0000] conn=3898 op=6 RESULT err=0 tag=101 nentries=1 wtime=0.000139985 optime=0.001520723 etime=0.001656185 notes=U details="Partially Unindexed Filter" [22/Sep/2021:05:27:03.570551770 +0000] conn=3899 fd=121 slot=121 connection from 192.168.1.136 to 192.168.1.139 [22/Sep/2021:05:27:03.570832412 +0000] conn=3899 op=-1 fd=121 closed error - B1 [22/Sep/2021:05:27:03.570894957 +0000] conn=3900 fd=127 slot=127 connection from 192.168.1.136 to 192.168.1.139 [22/Sep/2021:05:27:03.571225293 +0000] conn=3900 op=0 EXT oid="1.3.6.1.4.1.1466.20037" name="start_tls_plugin" [22/Sep/2021:05:27:03.571270580 +0000] conn=3900 op=0 RESULT err=0 tag=120 nentries=0 wtime=0.000153969 optime=0.000047853 etime=0.000200296 [22/Sep/2021:05:27:03.574890946 +0000] conn=3900 TLS1.2 128-bit AES-GCM [22/Sep/2021:05:27:03.575569529 +0000] conn=3900 op=1 BIND dn="uid=otp_test,cn=users,cn=accounts,dc=nottebrok,dc=net" method=128 version=3 [22/Sep/2021:05:27:03.576077489 +0000] conn=3900 op=1 RESULT err=49 tag=97 nentries=0 wtime=0.003805205 optime=0.000518648 etime=0.004320920 [22/Sep/2021:05:27:04.869258275 +0000] conn=3029 op=13493 MOD dn="uid=otp_test,cn=users,cn=accounts,dc=nottebrok,dc=net" [22/Sep/2021:05:27:04.939090470 +0000] conn=3029 op=13493 RESULT err=0 tag=103 nentries=0 wtime=0.000077276 optime=0.069837500 etime=0.069910794 [22/Sep/2021:05:27:04.940438540 +0000] conn=3890 op=36 SRCH base="cn=etc,dc=nottebrok,dc=net" scope=2 filter="(&(cn=ipaConfig)(objectClass=ipaGuiConfig))" attrs="ipaMigrationEnabled ipaSELinuxUserMapDefault ipaSELinuxUserMapOrder" [22/Sep/2021:05:27:04.940991039 +0000] conn=3890 op=36 RESULT err=0 tag=101 nentries=1 wtime=0.000166940 optime=0.000555022 etime=0.000718249 /var/log/krb5kdc.log -------------------- Sep 22 05:27:01 ipa krb5kdc[8615](info): AS_REQ (8 etypes {aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17), aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19), UNSUPPORTED:des3-hmac-sha1(16), DEPRECATED:arcfour-hmac(23), camellia128-cts-cmac(25), camellia256-cts-cmac(26)}) 192.168.1.129: NEEDED_PREAUTH: otp_test(a)EXAMPLE.COM for krbtgt/EXAMPLE.COM(a)EXAMPLE.COM, Additional pre-authentication required Sep 22 05:27:01 ipa krb5kdc[8615](info): closing down fd 11 Sep 22 05:27:01 ipa krb5kdc[8615](info): AS_REQ (8 etypes {aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17), aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19), UNSUPPORTED:des3-hmac-sha1(16), DEPRECATED:arcfour-hmac(23), camellia128-cts-cmac(25), camellia256-cts-cmac(26)}) 192.168.1.129: NEEDED_PREAUTH: otp_test(a)EXAMPLE.COM for krbtgt/EXAMPLE.COM(a)EXAMPLE.COM, Additional pre-authentication required Sep 22 05:27:01 ipa krb5kdc[8615](info): closing down fd 11 Sep 22 05:27:04 ipa krb5kdc[8615](info): preauth (otp) verify failure: Generic preauthentication failure Sep 22 05:27:04 ipa krb5kdc[8615](info): AS_REQ (8 etypes {aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17), aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19), UNSUPPORTED:des3-hmac-sha1(16), DEPRECATED:arcfour-hmac(23), camellia128-cts-cmac(25), camellia256-cts-cmac(26)}) 192.168.1.129: PREAUTH_FAILED: otp_test(a)EXAMPLE.COM for krbtgt/EXAMPLE.COM(a)EXAMPLE.COM, Preauthentication failed Sep 22 05:27:04 ipa krb5kdc[8615](info): closing down fd 11

1 0

fedora coreos :: ipa-client-install makes system users disappear
by hillar aarelaid 23 Sep '21

23 Sep '21

Fedora CoreOS 34.20210904.3.0 ``` [root@fcostest ~]# id -u systemd-resolve 990 [root@fcostest ~]# ipa-client-install --unattended -p ${IPA_USER} -w ${IPA_PASS} --domain ${IPA_DOMAIN} --ntp-pool ${NTP_POOL} --force --force-join This program will set up IPA client. Version 4.9.6 ... The ipa-client-install command was successful [root@fcostest ~]# id -u systemd-resolve id: ‘systemd-resolve’: no such user ``` Any suggestion for fix || workaround ?

1 0

IPA/dirsrv hang
by Kathy Zhu 23 Sep '21

23 Sep '21

Hi list, one of my ipa server (dirsrv) hang this morning. "ipactl status" no output and did not return. With nsslapd-errorlog-level being set to 16384, however, very few log entries. I rebooted the server to recover. But after reboot, ipa hang again then I have to reboot it. I collected following before 2nd reboot: Check where the process got stuck: [root@ipa5 ~]# cat /proc/$PID/stack [<ffffffffb0a63465>] poll_schedule_timeout+0x55/0xc0 [<ffffffffb0a64bfd>] do_sys_poll+0x48d/0x590 [<ffffffffb0a64e04>] SyS_poll+0x74/0x110 [<ffffffffb0f92ed2>] system_call_fastpath+0x25/0x2a [<ffffffffffffffff>] 0xffffffffffffffff [root@ipa5 ~]# check if there is any lock in place: [root@ipa5 ~]# gdb -ex 'set confirm off' -ex 'set pagination off' -ex 'thread apply all bt full' -ex 'quit' /usr/sbin/ns-slapd $PID |& grep '^#0.*lock' #0 0x00007f132465f39e in pthread_rwlock_wrlock () at /lib64/libpthread.so.0 #0 0x00007f132465f184 in pthread_rwlock_rdlock () at /lib64/libpthread.so.0 #0 0x00007f132465f184 in pthread_rwlock_rdlock () at /lib64/libpthread.so.0 #0 0x00007f132465f184 in pthread_rwlock_rdlock () at /lib64/libpthread.so.0 #0 0x00007f132465f184 in pthread_rwlock_rdlock () at /lib64/libpthread.so.0 #0 0x00007f132465f184 in pthread_rwlock_rdlock () at /lib64/libpthread.so.0 #0 0x00007f132465f184 in pthread_rwlock_rdlock () at /lib64/libpthread.so.0 #0 0x00007f132465f184 in pthread_rwlock_rdlock () at /lib64/libpthread.so.0 #0 0x00007f132465f184 in pthread_rwlock_rdlock () at /lib64/libpthread.so.0 #0 0x00007f132465f184 in pthread_rwlock_rdlock () at /lib64/libpthread.so.0 #0 0x00007f132465f184 in pthread_rwlock_rdlock () at /lib64/libpthread.so.0 #0 0x00007f132465f184 in pthread_rwlock_rdlock () at /lib64/libpthread.so.0 #0 0x00007f132465f184 in pthread_rwlock_rdlock () at /lib64/libpthread.so.0 #0 0x00007f132465f184 in pthread_rwlock_rdlock () at /lib64/libpthread.so.0 #0 0x00007f132465f184 in pthread_rwlock_rdlock () at /lib64/libpthread.so.0 #0 0x00007f132465f39e in pthread_rwlock_wrlock () at /lib64/libpthread.so.0 [root@ipa5 ~]# The software versions: Centos 7-8.2003.0 SELinux enabled 389-ds-base-1.3.10.2-12.el7_9.x86_64 389-ds-base-libs-1.3.10.2-12.el7_9.x86_64 slapi-nis-0.56.5-3.el7_9.x86_64 I attached related messages and dirsrv errors log. Does anyone know how to fix it? Many thanks! Kathy. In the messages (11:37 was 1st reboot and 14:32 was second reboot): [root@ipa5 log]# grep ERR messages Sep 20 09:06:17 ipa5 ns-slapd: [20/Sep/2021:09:06:17.767149314 -0700] - ERR - NSMMReplicationPlugin - bind_and_check_pwp - agmt="cn=meToipa6.example.com" (ipa6:389) - Replication bind with GSSAPI auth failed: LDAP error -1 (Can't contact LDAP server) () Sep 21 11:37:24 ipa5 ns-slapd: [21/Sep/2021:11:37:24.603324539 -0700] - ERR - schema-compat-plugin - scheduled schema-compat-plugin tree scan in about 5 seconds after the server startup! Sep 21 11:37:25 ipa5 ns-slapd: [21/Sep/2021:11:37:25.630440119 -0700] - ERR - set_krb5_creds - Could not get initial credentials for principal [ldap/ ipa5.example.com(a)EXAMPLE.COM] in keytab [FILE:/etc/dirsrv/ds.keytab]: -1765328228 (Cannot contact any KDC for requested realm) Sep 21 11:37:25 ipa5 ns-slapd: [21/Sep/2021:11:37:25.676602753 -0700] - ERR - schema-compat-plugin - schema-compat-plugin tree scan will start in about 5 seconds! Sep 21 11:37:25 ipa5 ns-slapd: [21/Sep/2021:11:37:25.714060760 -0700] - ERR - set_krb5_creds - Could not get initial credentials for principal [ldap/ ipa5.example.com(a)EXAMPLE.COM] in keytab [FILE:/etc/dirsrv/ds.keytab]: -1765328228 (Cannot contact any KDC for requested realm) Sep 21 11:37:25 ipa5 ns-slapd: [21/Sep/2021:11:37:25.796587660 -0700] - ERR - set_krb5_creds - Could not get initial credentials for principal [ldap/ ipa5.example.com(a)EXAMPLE.COM] in keytab [FILE:/etc/dirsrv/ds.keytab]: -1765328228 (Cannot contact any KDC for requested realm) Sep 21 11:37:25 ipa5 ns-slapd: [21/Sep/2021:11:37:25.879136209 -0700] - ERR - set_krb5_creds - Could not get initial credentials for principal [ldap/ ipa5.example.com(a)EXAMPLE.COM] in keytab [FILE:/etc/dirsrv/ds.keytab]: -1765328228 (Cannot contact any KDC for requested realm) Sep 21 11:37:31 ipa5 ns-slapd: [21/Sep/2021:11:37:31.829134731 -0700] - ERR - schema-compat-plugin - warning: no entries set up under cn=computers, cn=compat,dc=example,dc=com Sep 21 11:37:31 ipa5 ns-slapd: [21/Sep/2021:11:37:31.833560101 -0700] - ERR - schema-compat-plugin - Finished plugin initialization. Sep 21 14:32:13 ipa5 ns-slapd: [21/Sep/2021:14:32:13.105730037 -0700] - ERR - schema-compat-plugin - scheduled schema-compat-plugin tree scan in about 5 seconds after the server startup! Sep 21 14:32:14 ipa5 ns-slapd: [21/Sep/2021:14:32:14.107014580 -0700] - ERR - set_krb5_creds - Could not get initial credentials for principal [ldap/ ipa5.example.com(a)EXAMPLE.COM] in keytab [FILE:/etc/dirsrv/ds.keytab]: -1765328228 (Cannot contact any KDC for requested realm) Sep 21 14:32:14 ipa5 ns-slapd: [21/Sep/2021:14:32:14.153908801 -0700] - ERR - schema-compat-plugin - schema-compat-plugin tree scan will start in about 5 seconds! Sep 21 14:32:14 ipa5 ns-slapd: [21/Sep/2021:14:32:14.191647629 -0700] - ERR - set_krb5_creds - Could not get initial credentials for principal [ldap/ ipa5.example.com(a)EXAMPLE.COM] in keytab [FILE:/etc/dirsrv/ds.keytab]: -1765328228 (Cannot contact any KDC for requested realm) Sep 21 14:32:14 ipa5 ns-slapd: [21/Sep/2021:14:32:14.273919809 -0700] - ERR - set_krb5_creds - Could not get initial credentials for principal [ldap/ ipa5.example.com(a)EXAMPLE.COM] in keytab [FILE:/etc/dirsrv/ds.keytab]: -1765328228 (Cannot contact any KDC for requested realm) Sep 21 14:32:20 ipa5 ns-slapd: [21/Sep/2021:14:32:20.293525463 -0700] - ERR - schema-compat-plugin - warning: no entries set up under cn=computers, cn=compat,dc=example,dc=com Sep 21 14:32:20 ipa5 ns-slapd: [21/Sep/2021:14:32:20.293736655 -0700] - ERR - schema-compat-plugin - Finished plugin initialization. [root@ipa5 log]# errors log (11:37 was 1st reboot and 14:32 was second reboot): [root@ipa5 slapd-EXAMPLE-COM]# cat errors 389-Directory/1.3.10.2 B2021.160.169 ipa5.example.com:636 (/etc/dirsrv/slapd-EXAMPLE-COM) [20/Sep/2021:09:06:17.768066990 -0700] - ERR - NSMMReplicationPlugin - bind_and_check_pwp - agmt="cn=meToipa6.example.com" (ipa6:389) - Replication bind with GSSAPI auth failed: LDAP error -1 (Can't contact LDAP server) () [20/Sep/2021:09:06:20.348325236 -0700] - INFO - NSMMReplicationPlugin - bind_and_check_pwp - agmt="cn=meToipa6.example.com" (ipa6:389): Replication bind with GSSAPI auth resumed [20/Sep/2021:09:08:24.400342570 -0700] - WARN - NSMMReplicationPlugin - replica_generate_next_csn - opcsn=6148fb190008002a0000 <= basecsn=6148fb19ae5800040000, adjusted opcsn=6148fb19ae5a002a0000 [20/Sep/2021:09:09:14.372623984 -0700] - WARN - NSMMReplicationPlugin - replica_generate_next_csn - opcsn=6148fb4b0007002a0000 <= basecsn=6148fb4bafac00040000, adjusted opcsn=6148fb4bafae002a0000 [20/Sep/2021:11:51:58.900633352 -0700] - WARN - NSMMReplicationPlugin - replica_generate_next_csn - opcsn=6149216f0004002a0000 <= basecsn=6149216f718a00040000, adjusted opcsn=6149216f718c002a0000 [21/Sep/2021:11:26:59.139128524 -0700] - INFO - op_thread_cleanup - slapd shutting down - signaling operation threads - op stack size 0 max work q size 316 max work q stack size 12 [21/Sep/2021:11:26:59.140129110 -0700] - INFO - slapd_daemon - slapd shutting down - waiting for 24 threads to terminate [21/Sep/2021:11:30:08.927140039 -0700] - WARN - NSMMReplicationPlugin - acquire_replica - agmt="cn=meToipa6.example.com" (ipa6:389): Unable to receive the response for a startReplication extended operation to consumer (Timed out). Will retry later. [21/Sep/2021:11:37:22.087091069 -0700] - INFO - slapd_extract_cert - CA CERT NAME: EXAMPLE.COM IPA CA [21/Sep/2021:11:37:22.107553462 -0700] - WARN - Security Initialization - SSL alert: Sending pin request to SVRCore. You may need to run systemd-tty-ask-password-agent to provide the password. [21/Sep/2021:11:37:22.108208619 -0700] - INFO - slapd_extract_cert - SERVER CERT NAME: Server-Cert [21/Sep/2021:11:37:22.121340459 -0700] - INFO - Security Initialization - SSL info: Enabling default cipher set. [21/Sep/2021:11:37:22.131009941 -0700] - INFO - Security Initialization - SSL info: Configured NSS Ciphers [21/Sep/2021:11:37:22.141010955 -0700] - INFO - Security Initialization - SSL info: TLS_AES_128_GCM_SHA256: enabled [21/Sep/2021:11:37:22.143647711 -0700] - INFO - Security Initialization - SSL info: TLS_CHACHA20_POLY1305_SHA256: enabled [21/Sep/2021:11:37:22.143881989 -0700] - INFO - Security Initialization - SSL info: TLS_AES_256_GCM_SHA384: enabled [21/Sep/2021:11:37:22.144109322 -0700] - INFO - Security Initialization - SSL info: TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384: enabled [21/Sep/2021:11:37:22.144325392 -0700] - INFO - Security Initialization - SSL info: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA: enabled [21/Sep/2021:11:37:22.144620475 -0700] - INFO - Security Initialization - SSL info: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256: enabled [21/Sep/2021:11:37:22.144823798 -0700] - INFO - Security Initialization - SSL info: TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256: enabled [21/Sep/2021:11:37:22.145040176 -0700] - INFO - Security Initialization - SSL info: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA: enabled [21/Sep/2021:11:37:22.145248453 -0700] - INFO - Security Initialization - SSL info: TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384: enabled [21/Sep/2021:11:37:22.145449371 -0700] - INFO - Security Initialization - SSL info: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA: enabled [21/Sep/2021:11:37:22.145647646 -0700] - INFO - Security Initialization - SSL info: TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256: enabled [21/Sep/2021:11:37:22.145844189 -0700] - INFO - Security Initialization - SSL info: TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256: enabled [21/Sep/2021:11:37:22.146054551 -0700] - INFO - Security Initialization - SSL info: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA: enabled [21/Sep/2021:11:37:22.146251412 -0700] - INFO - Security Initialization - SSL info: TLS_DHE_RSA_WITH_AES_256_GCM_SHA384: enabled [21/Sep/2021:11:37:22.146449693 -0700] - INFO - Security Initialization - SSL info: TLS_DHE_RSA_WITH_AES_256_CBC_SHA: enabled [21/Sep/2021:11:37:22.146735864 -0700] - INFO - Security Initialization - SSL info: TLS_DHE_DSS_WITH_AES_256_CBC_SHA: enabled [21/Sep/2021:11:37:22.146936445 -0700] - INFO - Security Initialization - SSL info: TLS_DHE_RSA_WITH_AES_256_CBC_SHA256: enabled [21/Sep/2021:11:37:22.147149142 -0700] - INFO - Security Initialization - SSL info: TLS_DHE_RSA_WITH_AES_128_GCM_SHA256: enabled [21/Sep/2021:11:37:22.147348187 -0700] - INFO - Security Initialization - SSL info: TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256: enabled [21/Sep/2021:11:37:22.147543861 -0700] - INFO - Security Initialization - SSL info: TLS_DHE_RSA_WITH_AES_128_CBC_SHA: enabled [21/Sep/2021:11:37:22.147740471 -0700] - INFO - Security Initialization - SSL info: TLS_DHE_DSS_WITH_AES_128_CBC_SHA: enabled [21/Sep/2021:11:37:22.147945320 -0700] - INFO - Security Initialization - SSL info: TLS_DHE_RSA_WITH_AES_128_CBC_SHA256: enabled [21/Sep/2021:11:37:22.148203907 -0700] - INFO - Security Initialization - SSL info: TLS_RSA_WITH_AES_256_GCM_SHA384: enabled [21/Sep/2021:11:37:22.148408650 -0700] - INFO - Security Initialization - SSL info: TLS_RSA_WITH_AES_256_CBC_SHA: enabled [21/Sep/2021:11:37:22.148608462 -0700] - INFO - Security Initialization - SSL info: TLS_RSA_WITH_AES_256_CBC_SHA256: enabled [21/Sep/2021:11:37:22.148856140 -0700] - INFO - Security Initialization - SSL info: TLS_RSA_WITH_AES_128_GCM_SHA256: enabled [21/Sep/2021:11:37:22.149070747 -0700] - INFO - Security Initialization - SSL info: TLS_RSA_WITH_AES_128_CBC_SHA: enabled [21/Sep/2021:11:37:22.149270007 -0700] - INFO - Security Initialization - SSL info: TLS_RSA_WITH_AES_128_CBC_SHA256: enabled [21/Sep/2021:11:37:22.152892336 -0700] - INFO - Security Initialization - slapd_ssl_init2 - Configured SSL version range: min: TLS1.0, max: TLS1.2 [21/Sep/2021:11:37:22.153485284 -0700] - INFO - main - 389-Directory/ 1.3.10.2 B2021.160.169 starting up [21/Sep/2021:11:37:22.153702300 -0700] - INFO - main - Setting the maximum file descriptor limit to: 16384 [21/Sep/2021:11:37:24.381088447 -0700] - INFO - ldbm_instance_config_cachememsize_set - force a minimal value 512000 [21/Sep/2021:11:37:24.383729177 -0700] - WARN - default_mr_indexer_create - Plugin [caseIgnoreIA5Match] does not handle caseExactIA5Match [21/Sep/2021:11:37:24.385755952 -0700] - INFO - ldbm_instance_config_cachememsize_set - force a minimal value 512000 [21/Sep/2021:11:37:24.389648132 -0700] - INFO - ldbm_instance_config_cachememsize_set - force a minimal value 512000 [21/Sep/2021:11:37:24.393387733 -0700] - NOTICE - ldbm_back_start - found 8008992k physical memory [21/Sep/2021:11:37:24.393534680 -0700] - NOTICE - ldbm_back_start - found 7254208k available [21/Sep/2021:11:37:24.393666179 -0700] - NOTICE - ldbm_back_start - cache autosizing: db cache: 200224k [21/Sep/2021:11:37:24.393811926 -0700] - NOTICE - ldbm_back_start - cache autosizing: userRoot entry cache (3 total): 196608k [21/Sep/2021:11:37:24.394413949 -0700] - NOTICE - ldbm_back_start - cache autosizing: userRoot dn cache (3 total): 65536k [21/Sep/2021:11:37:24.395241483 -0700] - NOTICE - ldbm_back_start - cache autosizing: ipaca entry cache (3 total): 196608k [21/Sep/2021:11:37:24.395762334 -0700] - NOTICE - ldbm_back_start - cache autosizing: ipaca dn cache (3 total): 65536k [21/Sep/2021:11:37:24.396437365 -0700] - NOTICE - ldbm_back_start - cache autosizing: changelog entry cache (3 total): 196608k [21/Sep/2021:11:37:24.396931574 -0700] - NOTICE - ldbm_back_start - cache autosizing: changelog dn cache (3 total): 65536k [21/Sep/2021:11:37:24.399397009 -0700] - NOTICE - ldbm_back_start - total cache size: 969330524 B; [21/Sep/2021:11:37:24.402519856 -0700] - NOTICE - dblayer_start - Detected Disorderly Shutdown last time Directory Server was running, recovering database. [21/Sep/2021:11:37:24.603333323 -0700] - ERR - schema-compat-plugin - scheduled schema-compat-plugin tree scan in about 5 seconds after the server startup! [21/Sep/2021:11:37:24.619972344 -0700] - WARN - NSACLPlugin - acl_parse - The ACL target cn=groups,cn=compat,dc=example,dc=com does not exist [21/Sep/2021:11:37:24.620216729 -0700] - WARN - NSACLPlugin - acl_parse - The ACL target cn=computers,cn=compat,dc=example,dc=com does not exist [21/Sep/2021:11:37:24.620395665 -0700] - WARN - NSACLPlugin - acl_parse - The ACL target cn=ng,cn=compat,dc=example,dc=com does not exist [21/Sep/2021:11:37:24.620631777 -0700] - WARN - NSACLPlugin - acl_parse - The ACL target ou=sudoers,dc=example,dc=com does not exist [21/Sep/2021:11:37:24.620809457 -0700] - WARN - NSACLPlugin - acl_parse - The ACL target cn=users,cn=compat,dc=example,dc=com does not exist [21/Sep/2021:11:37:24.621006476 -0700] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=example,dc=com does not exist [21/Sep/2021:11:37:24.621182026 -0700] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=example,dc=com does not exist [21/Sep/2021:11:37:24.621361114 -0700] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=example,dc=com does not exist [21/Sep/2021:11:37:24.621543112 -0700] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=example,dc=com does not exist [21/Sep/2021:11:37:24.621719758 -0700] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=example,dc=com does not exist [21/Sep/2021:11:37:24.621912694 -0700] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=example,dc=com does not exist [21/Sep/2021:11:37:24.622087172 -0700] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=example,dc=com does not exist [21/Sep/2021:11:37:24.622263736 -0700] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=example,dc=com does not exist [21/Sep/2021:11:37:24.622439497 -0700] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=example,dc=com does not exist [21/Sep/2021:11:37:24.622616843 -0700] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=example,dc=com does not exist [21/Sep/2021:11:37:24.622793368 -0700] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=example,dc=com does not exist [21/Sep/2021:11:37:24.663383897 -0700] - WARN - NSACLPlugin - acl_parse - The ACL target cn=casigningcert cert-pki-ca,cn=ca_renewal,cn=ipa,cn=etc,dc=example,dc=com does not exist [21/Sep/2021:11:37:24.663575439 -0700] - WARN - NSACLPlugin - acl_parse - The ACL target cn=casigningcert cert-pki-ca,cn=ca_renewal,cn=ipa,cn=etc,dc=example,dc=com does not exist [21/Sep/2021:11:37:24.727752819 -0700] - WARN - NSACLPlugin - acl_parse - The ACL target cn=automember rebuild membership,cn=tasks,cn=config does not exist [21/Sep/2021:11:37:24.754864655 -0700] - NOTICE - NSMMReplicationPlugin - changelog program - _cl5ConstructRUV - Rebuilding the replication changelog RUV, this may take several minutes... [21/Sep/2021:11:37:24.757027555 -0700] - NOTICE - NSMMReplicationPlugin - changelog program - _cl5ConstructRUV - Rebuilding replication changelog RUV complete. Result 0 (Success) [21/Sep/2021:11:37:24.757181126 -0700] - NOTICE - NSMMReplicationPlugin - changelog program - _cl5ConstructRUV - Rebuilding the replication changelog RUV, this may take several minutes... [21/Sep/2021:11:37:24.759270661 -0700] - NOTICE - NSMMReplicationPlugin - changelog program - _cl5ConstructRUV - Rebuilding replication changelog RUV complete. Result 0 (Success) [21/Sep/2021:11:37:24.959483078 -0700] - NOTICE - NSMMReplicationPlugin - changelog program - _cl5ConstructRUV - Rebuilding the replication changelog RUV, this may take several minutes... [21/Sep/2021:11:37:25.287387667 -0700] - NOTICE - NSMMReplicationPlugin - changelog program - _cl5ConstructRUV - Rebuilding replication changelog RUV complete. Result 0 (Success) [21/Sep/2021:11:37:25.287687713 -0700] - NOTICE - NSMMReplicationPlugin - changelog program - _cl5ConstructRUV - Rebuilding the replication changelog RUV, this may take several minutes... [21/Sep/2021:11:37:25.626948414 -0700] - NOTICE - NSMMReplicationPlugin - changelog program - _cl5ConstructRUV - Rebuilding replication changelog RUV complete. Result 0 (Success) [21/Sep/2021:11:37:25.628156874 -0700] - WARN - NSMMReplicationPlugin - replica_check_for_data_reload - Disorderly shutdown for replica o=ipaca. Check if DB RUV needs to be updated [21/Sep/2021:11:37:25.628441700 -0700] - WARN - NSMMReplicationPlugin - replica_check_for_data_reload - Disorderly shutdown for replica dc=example,dc=com. Check if DB RUV needs to be updated [21/Sep/2021:11:37:25.628593983 -0700] - NOTICE - NSMMReplicationPlugin - Force update of database RUV (from CL RUV) -> 614a6468b12c002a0000 [21/Sep/2021:11:37:25.628741783 -0700] - NOTICE - NSMMReplicationPlugin - Force update of database RUV (from CL RUV) -> 614a6465b119001c0000 [21/Sep/2021:11:37:25.630449068 -0700] - ERR - set_krb5_creds - Could not get initial credentials for principal [ldap/ipa5.example.com(a)EXAMPLE.COM] in keytab [FILE:/etc/dirsrv/ds.keytab]: -1765328228 (Cannot contact any KDC for requested realm) [21/Sep/2021:11:37:25.637993198 -0700] - INFO - slapd_daemon - slapd started. Listening on All Interfaces port 389 for LDAP requests [21/Sep/2021:11:37:25.638150651 -0700] - INFO - slapd_daemon - Listening on All Interfaces port 636 for LDAPS requests [21/Sep/2021:11:37:25.638294957 -0700] - INFO - slapd_daemon - Listening on /var/run/slapd-EXAMPLE-COM.socket for LDAPI requests [21/Sep/2021:11:37:25.676737896 -0700] - ERR - schema-compat-plugin - schema-compat-plugin tree scan will start in about 5 seconds! [21/Sep/2021:11:37:25.714069163 -0700] - ERR - set_krb5_creds - Could not get initial credentials for principal [ldap/ipa5.example.com(a)EXAMPLE.COM] in keytab [FILE:/etc/dirsrv/ds.keytab]: -1765328228 (Cannot contact any KDC for requested realm) [21/Sep/2021:11:37:25.796599172 -0700] - ERR - set_krb5_creds - Could not get initial credentials for principal [ldap/ipa5.example.com(a)EXAMPLE.COM] in keytab [FILE:/etc/dirsrv/ds.keytab]: -1765328228 (Cannot contact any KDC for requested realm) [21/Sep/2021:11:37:25.879148077 -0700] - ERR - set_krb5_creds - Could not get initial credentials for principal [ldap/ipa5.example.com(a)EXAMPLE.COM] in keytab [FILE:/etc/dirsrv/ds.keytab]: -1765328228 (Cannot contact any KDC for requested realm) [21/Sep/2021:11:37:29.469422032 -0700] - INFO - csngen_new_csn - Detected large jump in CSN time. Delta: 3195237 (current time: 1632249449 vs previous time: 1629054212) [21/Sep/2021:11:37:31.829146877 -0700] - ERR - schema-compat-plugin - warning: no entries set up under cn=computers, cn=compat,dc=example,dc=com [21/Sep/2021:11:37:31.833570449 -0700] - ERR - schema-compat-plugin - Finished plugin initialization. [21/Sep/2021:14:21:48.128729268 -0700] - INFO - op_thread_cleanup - slapd shutting down - signaling operation threads - op stack size 0 max work q size 1237 max work q stack size 5 [21/Sep/2021:14:21:48.130690397 -0700] - INFO - slapd_daemon - slapd shutting down - waiting for 24 threads to terminate [21/Sep/2021:14:32:10.605597874 -0700] - INFO - slapd_extract_cert - CA CERT NAME: EXAMPLE.COM IPA CA [21/Sep/2021:14:32:10.606686976 -0700] - WARN - Security Initialization - SSL alert: Sending pin request to SVRCore. You may need to run systemd-tty-ask-password-agent to provide the password. [21/Sep/2021:14:32:10.607191737 -0700] - INFO - slapd_extract_cert - SERVER CERT NAME: Server-Cert [21/Sep/2021:14:32:10.610492924 -0700] - INFO - Security Initialization - SSL info: Enabling default cipher set. [21/Sep/2021:14:32:10.610702247 -0700] - INFO - Security Initialization - SSL info: Configured NSS Ciphers [21/Sep/2021:14:32:10.610883434 -0700] - INFO - Security Initialization - SSL info: TLS_AES_128_GCM_SHA256: enabled [21/Sep/2021:14:32:10.611082442 -0700] - INFO - Security Initialization - SSL info: TLS_CHACHA20_POLY1305_SHA256: enabled [21/Sep/2021:14:32:10.611262035 -0700] - INFO - Security Initialization - SSL info: TLS_AES_256_GCM_SHA384: enabled [21/Sep/2021:14:32:10.611464581 -0700] - INFO - Security Initialization - SSL info: TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384: enabled [21/Sep/2021:14:32:10.611640568 -0700] - INFO - Security Initialization - SSL info: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA: enabled [21/Sep/2021:14:32:10.611817444 -0700] - INFO - Security Initialization - SSL info: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256: enabled [21/Sep/2021:14:32:10.612010226 -0700] - INFO - Security Initialization - SSL info: TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256: enabled [21/Sep/2021:14:32:10.612186942 -0700] - INFO - Security Initialization - SSL info: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA: enabled [21/Sep/2021:14:32:10.612359300 -0700] - INFO - Security Initialization - SSL info: TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384: enabled [21/Sep/2021:14:32:10.612534043 -0700] - INFO - Security Initialization - SSL info: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA: enabled [21/Sep/2021:14:32:10.612707265 -0700] - INFO - Security Initialization - SSL info: TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256: enabled [21/Sep/2021:14:32:10.612890259 -0700] - INFO - Security Initialization - SSL info: TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256: enabled [21/Sep/2021:14:32:10.613072932 -0700] - INFO - Security Initialization - SSL info: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA: enabled [21/Sep/2021:14:32:10.613252512 -0700] - INFO - Security Initialization - SSL info: TLS_DHE_RSA_WITH_AES_256_GCM_SHA384: enabled [21/Sep/2021:14:32:10.613428106 -0700] - INFO - Security Initialization - SSL info: TLS_DHE_RSA_WITH_AES_256_CBC_SHA: enabled [21/Sep/2021:14:32:10.613607982 -0700] - INFO - Security Initialization - SSL info: TLS_DHE_DSS_WITH_AES_256_CBC_SHA: enabled [21/Sep/2021:14:32:10.613783773 -0700] - INFO - Security Initialization - SSL info: TLS_DHE_RSA_WITH_AES_256_CBC_SHA256: enabled [21/Sep/2021:14:32:10.613963528 -0700] - INFO - Security Initialization - SSL info: TLS_DHE_RSA_WITH_AES_128_GCM_SHA256: enabled [21/Sep/2021:14:32:10.614139566 -0700] - INFO - Security Initialization - SSL info: TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256: enabled [21/Sep/2021:14:32:10.614313931 -0700] - INFO - Security Initialization - SSL info: TLS_DHE_RSA_WITH_AES_128_CBC_SHA: enabled [21/Sep/2021:14:32:10.614485765 -0700] - INFO - Security Initialization - SSL info: TLS_DHE_DSS_WITH_AES_128_CBC_SHA: enabled [21/Sep/2021:14:32:10.614667815 -0700] - INFO - Security Initialization - SSL info: TLS_DHE_RSA_WITH_AES_128_CBC_SHA256: enabled [21/Sep/2021:14:32:10.614843058 -0700] - INFO - Security Initialization - SSL info: TLS_RSA_WITH_AES_256_GCM_SHA384: enabled [21/Sep/2021:14:32:10.615033164 -0700] - INFO - Security Initialization - SSL info: TLS_RSA_WITH_AES_256_CBC_SHA: enabled [21/Sep/2021:14:32:10.615208640 -0700] - INFO - Security Initialization - SSL info: TLS_RSA_WITH_AES_256_CBC_SHA256: enabled [21/Sep/2021:14:32:10.615384704 -0700] - INFO - Security Initialization - SSL info: TLS_RSA_WITH_AES_128_GCM_SHA256: enabled [21/Sep/2021:14:32:10.615558123 -0700] - INFO - Security Initialization - SSL info: TLS_RSA_WITH_AES_128_CBC_SHA: enabled [21/Sep/2021:14:32:10.615747508 -0700] - INFO - Security Initialization - SSL info: TLS_RSA_WITH_AES_128_CBC_SHA256: enabled [21/Sep/2021:14:32:10.619176886 -0700] - INFO - Security Initialization - slapd_ssl_init2 - Configured SSL version range: min: TLS1.0, max: TLS1.2 [21/Sep/2021:14:32:10.619596992 -0700] - INFO - main - 389-Directory/ 1.3.10.2 B2021.160.169 starting up [21/Sep/2021:14:32:10.619786789 -0700] - INFO - main - Setting the maximum file descriptor limit to: 16384 [21/Sep/2021:14:32:12.863761900 -0700] - INFO - ldbm_instance_config_cachememsize_set - force a minimal value 512000 [21/Sep/2021:14:32:12.866303167 -0700] - WARN - default_mr_indexer_create - Plugin [caseIgnoreIA5Match] does not handle caseExactIA5Match [21/Sep/2021:14:32:12.868327459 -0700] - INFO - ldbm_instance_config_cachememsize_set - force a minimal value 512000 [21/Sep/2021:14:32:12.872018894 -0700] - INFO - ldbm_instance_config_cachememsize_set - force a minimal value 512000 [21/Sep/2021:14:32:12.875942159 -0700] - NOTICE - ldbm_back_start - found 8008992k physical memory [21/Sep/2021:14:32:12.876118261 -0700] - NOTICE - ldbm_back_start - found 7273264k available [21/Sep/2021:14:32:12.876251543 -0700] - NOTICE - ldbm_back_start - cache autosizing: db cache: 200224k [21/Sep/2021:14:32:12.876401888 -0700] - NOTICE - ldbm_back_start - cache autosizing: userRoot entry cache (3 total): 196608k [21/Sep/2021:14:32:12.877015107 -0700] - NOTICE - ldbm_back_start - cache autosizing: userRoot dn cache (3 total): 65536k [21/Sep/2021:14:32:12.879111165 -0700] - NOTICE - ldbm_back_start - cache autosizing: ipaca entry cache (3 total): 196608k [21/Sep/2021:14:32:12.879699133 -0700] - NOTICE - ldbm_back_start - cache autosizing: ipaca dn cache (3 total): 65536k [21/Sep/2021:14:32:12.880810497 -0700] - NOTICE - ldbm_back_start - cache autosizing: changelog entry cache (3 total): 196608k [21/Sep/2021:14:32:12.881400177 -0700] - NOTICE - ldbm_back_start - cache autosizing: changelog dn cache (3 total): 65536k [21/Sep/2021:14:32:12.883113645 -0700] - NOTICE - ldbm_back_start - total cache size: 969330524 B; [21/Sep/2021:14:32:12.886703828 -0700] - NOTICE - dblayer_start - Detected Disorderly Shutdown last time Directory Server was running, recovering database. [21/Sep/2021:14:32:13.105739416 -0700] - ERR - schema-compat-plugin - scheduled schema-compat-plugin tree scan in about 5 seconds after the server startup! [21/Sep/2021:14:32:13.122672646 -0700] - WARN - NSACLPlugin - acl_parse - The ACL target cn=groups,cn=compat,dc=example,dc=com does not exist [21/Sep/2021:14:32:13.122865415 -0700] - WARN - NSACLPlugin - acl_parse - The ACL target cn=computers,cn=compat,dc=example,dc=com does not exist [21/Sep/2021:14:32:13.123066536 -0700] - WARN - NSACLPlugin - acl_parse - The ACL target cn=ng,cn=compat,dc=example,dc=com does not exist [21/Sep/2021:14:32:13.123271167 -0700] - WARN - NSACLPlugin - acl_parse - The ACL target ou=sudoers,dc=example,dc=com does not exist [21/Sep/2021:14:32:13.123441717 -0700] - WARN - NSACLPlugin - acl_parse - The ACL target cn=users,cn=compat,dc=example,dc=com does not exist [21/Sep/2021:14:32:13.123629053 -0700] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=example,dc=com does not exist [21/Sep/2021:14:32:13.123800535 -0700] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=example,dc=com does not exist [21/Sep/2021:14:32:13.123971584 -0700] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=example,dc=com does not exist [21/Sep/2021:14:32:13.124143620 -0700] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=example,dc=com does not exist [21/Sep/2021:14:32:13.124311857 -0700] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=example,dc=com does not exist [21/Sep/2021:14:32:13.124489965 -0700] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=example,dc=com does not exist [21/Sep/2021:14:32:13.124665189 -0700] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=example,dc=com does not exist [21/Sep/2021:14:32:13.124836908 -0700] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=example,dc=com does not exist [21/Sep/2021:14:32:13.125004506 -0700] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=example,dc=com does not exist [21/Sep/2021:14:32:13.125172452 -0700] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=example,dc=com does not exist [21/Sep/2021:14:32:13.125341330 -0700] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=example,dc=com does not exist [21/Sep/2021:14:32:13.167392303 -0700] - WARN - NSACLPlugin - acl_parse - The ACL target cn=casigningcert cert-pki-ca,cn=ca_renewal,cn=ipa,cn=etc,dc=example,dc=com does not exist [21/Sep/2021:14:32:13.167585840 -0700] - WARN - NSACLPlugin - acl_parse - The ACL target cn=casigningcert cert-pki-ca,cn=ca_renewal,cn=ipa,cn=etc,dc=example,dc=com does not exist [21/Sep/2021:14:32:13.231724926 -0700] - WARN - NSACLPlugin - acl_parse - The ACL target cn=automember rebuild membership,cn=tasks,cn=config does not exist [21/Sep/2021:14:32:13.256786460 -0700] - NOTICE - NSMMReplicationPlugin - changelog program - _cl5ConstructRUV - Rebuilding the replication changelog RUV, this may take several minutes... [21/Sep/2021:14:32:13.258790153 -0700] - NOTICE - NSMMReplicationPlugin - changelog program - _cl5ConstructRUV - Rebuilding replication changelog RUV complete. Result 0 (Success) [21/Sep/2021:14:32:13.258932037 -0700] - NOTICE - NSMMReplicationPlugin - changelog program - _cl5ConstructRUV - Rebuilding the replication changelog RUV, this may take several minutes... [21/Sep/2021:14:32:13.260869035 -0700] - NOTICE - NSMMReplicationPlugin - changelog program - _cl5ConstructRUV - Rebuilding replication changelog RUV complete. Result 0 (Success) [21/Sep/2021:14:32:13.453340945 -0700] - NOTICE - NSMMReplicationPlugin - changelog program - _cl5ConstructRUV - Rebuilding the replication changelog RUV, this may take several minutes... [21/Sep/2021:14:32:13.778192948 -0700] - NOTICE - NSMMReplicationPlugin - changelog program - _cl5ConstructRUV - Rebuilding replication changelog RUV complete. Result 0 (Success) [21/Sep/2021:14:32:13.778399400 -0700] - NOTICE - NSMMReplicationPlugin - changelog program - _cl5ConstructRUV - Rebuilding the replication changelog RUV, this may take several minutes... [21/Sep/2021:14:32:14.104152139 -0700] - NOTICE - NSMMReplicationPlugin - changelog program - _cl5ConstructRUV - Rebuilding replication changelog RUV complete. Result 0 (Success) [21/Sep/2021:14:32:14.105222428 -0700] - WARN - NSMMReplicationPlugin - replica_check_for_data_reload - Disorderly shutdown for replica o=ipaca. Check if DB RUV needs to be updated [21/Sep/2021:14:32:14.105487767 -0700] - WARN - NSMMReplicationPlugin - replica_check_for_data_reload - Disorderly shutdown for replica dc=example,dc=com. Check if DB RUV needs to be updated [21/Sep/2021:14:32:14.105629420 -0700] - NOTICE - NSMMReplicationPlugin - Force update of database RUV (from CL RUV) -> 614a70200002002a0000 [21/Sep/2021:14:32:14.105754006 -0700] - NOTICE - NSMMReplicationPlugin - Force update of database RUV (from CL RUV) -> 614a701f001100040000 [21/Sep/2021:14:32:14.107024420 -0700] - ERR - set_krb5_creds - Could not get initial credentials for principal [ldap/ipa5.example.com(a)EXAMPLE.COM] in keytab [FILE:/etc/dirsrv/ds.keytab]: -1765328228 (Cannot contact any KDC for requested realm) [21/Sep/2021:14:32:14.115281150 -0700] - INFO - slapd_daemon - slapd started. Listening on All Interfaces port 389 for LDAP requests [21/Sep/2021:14:32:14.115431268 -0700] - INFO - slapd_daemon - Listening on All Interfaces port 636 for LDAPS requests [21/Sep/2021:14:32:14.115563063 -0700] - INFO - slapd_daemon - Listening on /var/run/slapd-EXAMPLE-COM.socket for LDAPI requests [21/Sep/2021:14:32:14.153916575 -0700] - ERR - schema-compat-plugin - schema-compat-plugin tree scan will start in about 5 seconds! [21/Sep/2021:14:32:14.191656955 -0700] - ERR - set_krb5_creds - Could not get initial credentials for principal [ldap/ipa5.example.com(a)EXAMPLE.COM] in keytab [FILE:/etc/dirsrv/ds.keytab]: -1765328228 (Cannot contact any KDC for requested realm) [21/Sep/2021:14:32:14.273925417 -0700] - ERR - set_krb5_creds - Could not get initial credentials for principal [ldap/ipa5.example.com(a)EXAMPLE.COM] in keytab [FILE:/etc/dirsrv/ds.keytab]: -1765328228 (Cannot contact any KDC for requested realm) [21/Sep/2021:14:32:17.628480282 -0700] - INFO - csngen_new_csn - Detected large jump in CSN time. Delta: 3205725 (current time: 1632259937 vs previous time: 1629054212) [21/Sep/2021:14:32:20.293538970 -0700] - ERR - schema-compat-plugin - warning: no entries set up under cn=computers, cn=compat,dc=example,dc=com [21/Sep/2021:14:32:20.293740865 -0700] - ERR - schema-compat-plugin - Finished plugin initialization. [root@ipa5 slapd-EXAMPLE-COM]#

4 7

on a client logs increase size very quickly
by lejeczek 21 Sep '21

21 Sep '21

Hi guys. I've noticed I think a patter, such that when IPA clientA does lots of ssh to a former IPA clientB (or might be to any non-IPA host?) then logs size go up rapidly. Logs: sssd_ssh.log, sssd_private.lot.log, In terms of IPA client configs - those are vanilla default, nothing added for extra verbosity. As soon as I add such a non-IPA host as a client then logs stop growing. Before I start going through logs I thought I'd ask if this might be a result of some obvious & gruesome IPA misconfiguration? many thanks, L.

2 4

New IPA server and unable to sudo from client
by Jeremy Tourville 20 Sep '21

20 Sep '21

After all the trouble with fixing a botched upgrade I decided it was easier to build a new IPA Server. Now that I have it up and running I am running into an issue with my ipa enrolled clients. I am unable to sudo. The client says: <user>@<host> is not allowed to run sudo on <host>. This incident will be reported. The HBAC test in the GUI tells me "ACCESS GRANTED" so my policy is setup correctly. I looked at /etc/nsswitch on the client and see a line: sudoers: files sss Shouldn't sss be listed first? Stopping, clearing sssd cache and restarting again doesn't fix it, I presume because the order is wrong. This is happening on two of my ipa clients so far and I hate to go any further until I figure put what the issue is. Is there something on the server side that controls the nsswitch config or do I need to change the config on the client?

2 3

sudo rules for local accounts
by iulian roman 20 Sep '21

20 Sep '21

Hello everybody, Does anybody know if it is possible to have sudo rules in FreeIPA for local accounts (accounts which are in /etc/passwd) ?

2 1

Signature verification
by Patrick Northon 18 Sep '21

18 Sep '21

Hi, I'm having a problem verifying the signature of the latest release (4.9.7), did something change with how it is signed? Previous releases work fine: gpg: Signature made mar 29 jun 2021 11:32:36 EDT gpg: using RSA key 840A1D1C7F3EC4B2FE5304354719E2B8ABBF621A gpg: Good signature from "FreeIPA Master Signing Key" [unknown] gpg: WARNING: This key is not certified with a trusted signature! gpg: There is no indication that the signature belongs to the owner. Primary key fingerprint: 0E63 D716 D76A C080 A4A3 3513 F408 00B6 298E B963 Subkey fingerprint: 840A 1D1C 7F3E C4B2 FE53 0435 4719 E2B8 ABBF 621A Current release: gpg: Signature made jeu 19 aoû 2021 11:23:09 EDT gpg: using RSA key FAF42668FC4263CD83C365149F853DF24BC2DFE1 gpg: Can't check signature: No public key Was it signed with a different key?

2 1

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users September 2021