November 2022 - FreeIPA-users - Fedora mailing-lists

DNS Caching w/ FreeIPA
by TomK 20 Nov '22

20 Nov '22

Hello, How do I manipulate the DNS caching settings in FreeIPA? For example, how do I adjust the cache size, ttl etc ? I'm looking to speed up external queries by caching them in FreeIPA to allow faster lookups on subsequent requests, thereby reducing response times. -- Thx, TK.

1 0

Re: ghost replica for radius server
by Grant Janssen 18 Nov '22

18 Nov '22

that was easy - THANX Florence. My ghost replica still doesn’t show in ipa_check_consistency. Any ideas on that? grant@radius01:~[20221118-3:56][#97]$ ipa server-state $HOSTNAME --state=enabled ipa: WARNING: Automatic update of DNS system records failed. Please re-run update of system records manually to get list of missing records. -------------------------------------------------------- Changed server state of "radius01.production.efilm.com<http://radius01.production.efilm.com>". -------------------------------------------------------- grant@radius01:~[20221118-3:57][#98]$ sudo ipa-pkinit-manage status PKINIT is disabled The ipa-pkinit-manage command was successful grant@radius01:~[20221118-3:58][#99]$ sudo ipa-pkinit-manage enable Configuring Kerberos KDC (krb5kdc) [1/1]: installing X509 Certificate for PKINIT Done configuring Kerberos KDC (krb5kdc). The ipa-pkinit-manage command was successful grant@radius01:~[20221118-3:58][#100]$ ipa server-state $HOSTNAME --state=hidden ipa: WARNING: Automatic update of DNS system records failed. Please re-run update of system records manually to get list of missing records. -------------------------------------------------------- Changed server state of "radius01.production.efilm.com<http://radius01.production.efilm.com>". -------------------------------------------------------- grant@radius01:~[20221118-3:59][#101]$ ipa_check_consistency -d PRODUCTION.EFILM.COM<http://PRODUCTION.EFILM.COM> -W ************** FreeIPA servers: ef-idm01 ef-idm02 ef-idm03 ef-idm04 STATE ========================================================================= Active Users 349 349 349 349 OK Stage Users 7 7 7 7 OK Preserved Users 5 5 5 5 OK User Groups 42 42 42 42 OK Hosts 423 423 423 423 OK Host Groups 23 23 23 23 OK HBAC Rules 9 9 9 9 OK SUDO Rules 35 35 35 35 OK DNS Zones ERROR ERROR ERROR ERROR OK LDAP Conflicts NO NO NO NO OK Ghost Replicas NO NO NO NO OK Anonymous BIND YES YES YES YES OK Replication Status ef-idm02 0 ef-idm03 0 ef-idm02 0 ef-idm01 0 ef-idm03 0 ef-idm01 0 ef-idm01 0 ef-idm04 0 radius01 0 ========================================================================= grant@radius01:~[20221118-4:05][#102]$ sudo ipa-pkinit-manage status [sudo] password for grant: PKINIT is enabled The ipa-pkinit-manage command was successful grant@radius01:~[20221118-4:06][#103]$ When I add the _ldap._tcp and _ldaps._tcp SRV records for the radius server, ipa_check_consistency shows the replication is good, but it still doesn’t appear as a Ghost. grant@radius01:~[20221118-4:47][#106]$ ipa_check_consistency -d PRODUCTION.EFILM.COM<http://PRODUCTION.EFILM.COM> -W ************** FreeIPA servers: ef-idm01 ef-idm02 ef-idm03 ef-idm04 radius01 STATE ===================================================================================== Active Users 349 349 349 349 349 OK Stage Users 7 7 7 7 7 OK Preserved Users 5 5 5 5 5 OK User Groups 42 42 42 42 42 OK Hosts 423 423 423 423 423 OK Host Groups 23 23 23 23 23 OK HBAC Rules 9 9 9 9 9 OK SUDO Rules 35 35 35 35 35 OK DNS Zones ERROR ERROR ERROR ERROR ERROR OK LDAP Conflicts NO NO NO NO NO OK Ghost Replicas NO NO NO NO NO OK Anonymous BIND YES YES YES YES YES OK Replication Status ef-idm02 0 ef-idm03 0 ef-idm02 0 ef-idm01 0 ef-idm01 0 ef-idm03 0 ef-idm01 0 ef-idm01 0 ef-idm04 0 radius01 0 ===================================================================================== grant@radius01:~[20221118-4:52][#107]$ thanx - grant

2 1

Re: Microsoft November 2022 updates breaks Active Directory integration
by Rob Crittenden 18 Nov '22

18 Nov '22

Rob Crittenden wrote: > Microsoft addressed a number of CVEs last week which introduced some > authentication issues. After installation of these patches, user > authentication on Linux systems integrated in Active Directory no longer > works and new systems are unable to join an AD domain that is managed by > domain controllers where these patches have been applied. > > For more details see https://access.redhat.com/solutions/6985061 (open > to the public). > > rob > More detailed information on the issue from Alexander, https://www.redhat.com/en/blog/red-hat-enterprise-linux-and-microsoft-secur… rob

3 2

ghost replica for radius server
by Grant Janssen 18 Nov '22

18 Nov '22

Building a radius server, and decided this was an ideal application for a hidden replica. I got some errors in the replica install, and the consistency check does not show a ghost replica (but does show my radius host in Replication Status.) I run external DNS, this radius host has only has A and PTR records. grant@radius01:~[20221117-13:45][#89]$ sudo ipa-replica-install --setup-ca --hidden-replica Password for admin(a)PRODUCTION.EFILM.COM<mailto:admin@PRODUCTION.EFILM.COM>: ************* WARNING: 376 existing users or groups do not have a SID identifier assigned. Installer can run a task to have ipa-sidgen Directory Server plugin generate the SID identifier for all these users. Please note, in case of a high number of users and groups, the operation might lead to high replication traffic and performance degradation. Refer to ipa-adtrust-install(1) man page for details. Do you want to run the ipa-sidgen task? [no]: no Run connection check to master Connection check OK -snip- [28/30]: importing IPA certificate profiles Lookup failed: Preferred host radius01.production.efilm.com<http://radius01.production.efilm.com> does not provide CA. Lookup failed: Preferred host radius01.production.efilm.com<http://radius01.production.efilm.com> does not provide CA. Failed to import profile 'acmeIPAServerCert': Request failed with status 500: Non-2xx response from CA REST API: 500. . Running ipa-server-upgrade when installation is completed may resolve this issue. [29/30]: configuring certmonger renewal for lightweight CAs [30/30]: deploying ACME service Done configuring certificate server (pki-tomcatd). Configuring Kerberos KDC (krb5kdc) [1/1]: installing X509 Certificate for PKINIT PKINIT certificate request failed: Certificate issuance failed (CA_REJECTED: Server at https://ef-idm01.production.efilm.com/ipa/json failed request, will retry: 903 (an internal error has occurred).) Failed to configure PKINIT Full PKINIT configuration did not succeed The setup will only install bits essential to the server functionality You can enable PKINIT after the setup completed using 'ipa-pkinit-manage' Done configuring Kerberos KDC (krb5kdc). Applying LDAP updates Upgrading IPA:. Estimated time: 1 minute 30 seconds [1/10]: stopping directory server [2/10]: saving configuration [3/10]: disabling listeners -snip- [7/7]: adding fallback group Fallback group already set, nothing to do Done. The ipa-replica-install command was successful grant@radius01:~[20221117-13:51][#90]$ check consistency grant@radius01:~[20221117-13:53][#92]$ ipa_check_consistency -d PRODUCTION.EFILM.COM<http://PRODUCTION.EFILM.COM> -W ************* FreeIPA servers: ef-idm01 ef-idm02 ef-idm03 ef-idm04 STATE ========================================================================= Active Users 349 349 349 349 OK Stage Users 7 7 7 7 OK Preserved Users 5 5 5 5 OK User Groups 42 42 42 42 OK Hosts 423 423 423 423 OK Host Groups 23 23 23 23 OK HBAC Rules 9 9 9 9 OK SUDO Rules 35 35 35 35 OK DNS Zones ERROR ERROR ERROR ERROR OK LDAP Conflicts NO NO NO NO OK Ghost Replicas NO NO NO NO OK Anonymous BIND YES YES YES YES OK Replication Status ef-idm02 0 ef-idm03 0 ef-idm02 0 ef-idm01 0 ef-idm03 0 ef-idm01 0 ef-idm01 0 ef-idm04 0 radius01 0 ========================================================================= grant@radius01:~[20221117-13:53][#93]$ I executed ipa-server-upgrade as suggested grant@radius01:~[20221117-16:09][#88]$ sudo ipa-server-upgrade [sudo] password for grant: Upgrading IPA:. Estimated time: 1 minute 30 seconds [1/11]: stopping directory server [2/11]: saving configuration [3/11]: disabling listeners [4/11]: enabling DS global lock [5/11]: disabling Schema Compat [6/11]: starting directory server [7/11]: updating schema [8/11]: upgrading server Add failure attribute "cn" not allowed [9/11]: stopping directory server [10/11]: restoring configuration [11/11]: starting directory server Done. Update complete Upgrading IPA services -snip- Migrating profile 'caAuditSigningCert' [Ensuring presence of included profiles] [Add default CA ACL] [Updating ACME configuration] [Migrating to authselect profile] [Create systemd-user hbac service and rule] hbac service systemd-user already exists [Add root(a)PRODUCTION.EFILM.COM<mailto:root@PRODUCTION.EFILM.COM> alias to admin account] Added 'root(a)PRODUCTION.EFILM.COM<mailto:root@PRODUCTION.EFILM.COM>' alias to admin account [Setup SPAKE] [Setup PKINIT] [Enable server krb5.conf snippet] [Setup kpasswd_server] [Adding ipa-ca alias to HTTP certificate] Resubmitting HTTP cert tracking request The IPA services were upgraded The ipa-server-upgrade command was successful grant@radius01:~[20221117-16:11][#89]$ ipa_check_consistency -d PRODUCTION.EFILM.COM<http://PRODUCTION.EFILM.COM> -W ************* FreeIPA servers: ef-idm01 ef-idm02 ef-idm03 ef-idm04 STATE ========================================================================= Active Users 349 349 349 349 OK Stage Users 7 7 7 7 OK Preserved Users 5 5 5 5 OK User Groups 42 42 42 42 OK Hosts 423 423 423 423 OK Host Groups 23 23 23 23 OK HBAC Rules 9 9 9 9 OK SUDO Rules 35 35 35 35 OK DNS Zones ERROR ERROR ERROR ERROR OK LDAP Conflicts NO NO NO NO OK Ghost Replicas NO NO NO NO OK Anonymous BIND YES YES YES YES OK Replication Status ef-idm02 0 ef-idm03 0 ef-idm02 0 ef-idm01 0 ef-idm03 0 ef-idm01 0 ef-idm01 0 ef-idm04 0 radius01 0 ========================================================================= grant@radius01:~[20221117-16:11][#90]$ My version of ipa_check_consistency grant@radius01:~[20221117-16:16][#93]$ grep APP_VER /usr/local/bin/ipa_check_consistency readonly APP_VER="17.2.21a" printf "%s version %s\n" "$APP_NAME" "$APP_VER" grant@radius01:~[20221117-16:16][#94]$ I reviewed the installation again, then executed ipa-pkinit-manage grant@radius01:~[20221117-16:29][#91]$ sudo ipa-pkinit-manage status PKINIT is disabled The ipa-pkinit-manage command was successful grant@radius01:~[20221117-16:29][#92]$ sudo ipa-pkinit-manage enable Configuring Kerberos KDC (krb5kdc) [1/1]: installing X509 Certificate for PKINIT PKINIT certificate request failed: Certificate issuance failed (CA_REJECTED: Server at https://ef-idm01.production.efilm.com/ipa/json denied our request, giving up: 2100 (Insufficient access: Host 'radius01.production.efilm.com<http://radius01.production.efilm.com>' is not an active KDC).) Failed to configure PKINIT Full PKINIT configuration did not succeed The setup will only install bits essential to the server functionality You can enable PKINIT after the setup completed using 'ipa-pkinit-manage' Done configuring Kerberos KDC (krb5kdc). The ipa-pkinit-manage command was successful grant@radius01:~[20221117-16:30][#93]$ Are SRV records REQUIRED for PKINIT to succeed? thanx - grant

2 1

SCEP
by Francis Augusto Medeiros-Logeay 17 Nov '22

17 Nov '22

Hi, I try to find good documentation on SCEP and FreeIPA, but I cannot find something that seems updated nor conclusive. Does FreeIPA support SCEP out of the box, or does it need some hacking to do so? And does it support other types of certificate enrolment besides its own api/client? Best, Francis -- Francis Augusto Medeiros-Logeay Oslo, Norway

3 6

dirsrv times out at startup
by Roberto Cornacchia 17 Nov '22

17 Nov '22

Yesterday I installed a replica on a clean Rocky 9 system. No issues at all. Everything seemed to work fine. Today the machine was rebooted (no dnf updates, no system changes) and ipa could not start anymore. ipactl start -d says: Starting Directory Service ipa: DEBUG: Starting external process ipa: DEBUG: args=['/bin/systemctl', 'start', 'dirsrv(a)HQ-SPINQUE-COM.service '] ipa: DEBUG: Process finished, return code=0 ipa: DEBUG: Starting external process ipa: DEBUG: args=['/bin/systemctl', 'is-active', 'dirsrv(a)HQ-SPINQUE-COM.service'] ipa: DEBUG: Process finished, return code=0 ipa: DEBUG: stdout=active ipa: DEBUG: stderr= ipa: DEBUG: wait_for_open_ports: localhost [389] timeout 120 ipa: DEBUG: waiting for port: 389 ipa: DEBUG: Failed to connect to port 389 tcp on ::1 ipa: DEBUG: File "/usr/lib/python3.9/site-packages/ipaserver/install/installutils.py", line 781, in run_script return_value = main_function() File "/usr/lib/python3.9/site-packages/ipaserver/install/ipactl.py", line 739, in main ipa_restart(options) File "/usr/lib/python3.9/site-packages/ipaserver/install/ipactl.py", line 499, in ipa_restart raise IpactlError("Failed to start Directory Service: " + str(e)) ipa: DEBUG: The ipactl command failed, exception: IpactlError: Failed to start Directory Service: Timeout exceeded Failed to start Directory Service: Timeout exceeded /var/log/dirsrv/slapd-HQ-SPINQUE-COM/errors says: [17/Nov/2022:17:22:21.074990853 +0100] - INFO - slapd_extract_cert - CA CERT NAME: HQ.SPINQUE.COM IPA CA [17/Nov/2022:17:22:21.668775045 +0100] - WARN - Security Initialization - SSL alert: Sending pin request to SVRCore. You may need to run systemd-tty-ask-password-agent to provide the password if pin.txt does not exist. [17/Nov/2022:17:22:22.295325169 +0100] - INFO - slapd_extract_cert - SERVER CERT NAME: Server-Cert [17/Nov/2022:17:22:23.275812957 +0100] - INFO - Security Initialization - SSL info: Enabling default cipher set. [17/Nov/2022:17:22:26.090728693 +0100] - INFO - Security Initialization - SSL info: Configured NSS Ciphers [17/Nov/2022:17:22:26.771211814 +0100] - INFO - Security Initialization - SSL info: TLS_AES_128_GCM_SHA256: enabled [17/Nov/2022:17:22:28.438124063 +0100] - INFO - Security Initialization - SSL info: TLS_CHACHA20_POLY1305_SHA256: enabled [17/Nov/2022:17:22:28.928766931 +0100] - INFO - Security Initialization - SSL info: TLS_AES_256_GCM_SHA384: enabled [17/Nov/2022:17:22:29.544178747 +0100] - INFO - Security Initialization - SSL info: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256: enabled [17/Nov/2022:17:22:30.099717701 +0100] - INFO - Security Initialization - SSL info: TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256: enabled [17/Nov/2022:17:22:30.657974763 +0100] - INFO - Security Initialization - SSL info: TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256: enabled [17/Nov/2022:17:22:31.245996850 +0100] - INFO - Security Initialization - SSL info: TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256: enabled [17/Nov/2022:17:22:31.790186166 +0100] - INFO - Security Initialization - SSL info: TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384: enabled [17/Nov/2022:17:22:32.205374722 +0100] - INFO - Security Initialization - SSL info: TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384: enabled [17/Nov/2022:17:22:32.771492861 +0100] - INFO - Security Initialization - SSL info: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA: enabled [17/Nov/2022:17:22:33.139528386 +0100] - INFO - Security Initialization - SSL info: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA: enabled [17/Nov/2022:17:22:33.392948327 +0100] - INFO - Security Initialization - SSL info: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA: enabled [17/Nov/2022:17:22:33.420924018 +0100] - INFO - Security Initialization - SSL info: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256: enabled [17/Nov/2022:17:22:33.468560401 +0100] - INFO - Security Initialization - SSL info: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256: enabled [17/Nov/2022:17:22:33.524578902 +0100] - INFO - Security Initialization - SSL info: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA: enabled [17/Nov/2022:17:22:33.769874334 +0100] - INFO - Security Initialization - SSL info: TLS_DHE_RSA_WITH_AES_128_GCM_SHA256: enabled [17/Nov/2022:17:22:34.596047264 +0100] - INFO - Security Initialization - SSL info: TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256: enabled [17/Nov/2022:17:22:35.137255640 +0100] - INFO - Security Initialization - SSL info: TLS_DHE_RSA_WITH_AES_256_GCM_SHA384: enabled [17/Nov/2022:17:22:35.938316117 +0100] - INFO - Security Initialization - SSL info: TLS_DHE_RSA_WITH_AES_128_CBC_SHA: enabled [17/Nov/2022:17:22:36.492933614 +0100] - INFO - Security Initialization - SSL info: TLS_DHE_RSA_WITH_AES_128_CBC_SHA256: enabled [17/Nov/2022:17:22:37.059388478 +0100] - INFO - Security Initialization - SSL info: TLS_DHE_RSA_WITH_AES_256_CBC_SHA: enabled [17/Nov/2022:17:22:37.497954414 +0100] - INFO - Security Initialization - SSL info: TLS_DHE_RSA_WITH_AES_256_CBC_SHA256: enabled [17/Nov/2022:17:22:37.899521527 +0100] - INFO - Security Initialization - SSL info: TLS_RSA_WITH_AES_128_GCM_SHA256: enabled [17/Nov/2022:17:22:38.340476108 +0100] - INFO - Security Initialization - SSL info: TLS_RSA_WITH_AES_256_GCM_SHA384: enabled [17/Nov/2022:17:22:38.910037361 +0100] - INFO - Security Initialization - SSL info: TLS_RSA_WITH_AES_128_CBC_SHA: enabled [17/Nov/2022:17:22:39.572044273 +0100] - INFO - Security Initialization - SSL info: TLS_RSA_WITH_AES_128_CBC_SHA256: enabled [17/Nov/2022:17:22:40.025517184 +0100] - INFO - Security Initialization - SSL info: TLS_RSA_WITH_AES_256_CBC_SHA: enabled [17/Nov/2022:17:22:40.426814987 +0100] - INFO - Security Initialization - SSL info: TLS_RSA_WITH_AES_256_CBC_SHA256: enabled [17/Nov/2022:17:22:40.972957570 +0100] - INFO - Security Initialization - slapd_ssl_init2 - Configured SSL version range: min: TLS1.2, max: TLS1.3 [17/Nov/2022:17:22:41.780274052 +0100] - INFO - Security Initialization - slapd_ssl_init2 - NSS adjusted SSL version range: min: TLS1.2, max: TLS1.3 [17/Nov/2022:17:22:42.112229404 +0100] - INFO - main - 389-Directory/2.0.14 B2022.028.0000 starting up [17/Nov/2022:17:22:42.255025476 +0100] - INFO - main - Setting the maximum file descriptor limit to: 524288 [17/Nov/2022:17:22:42.302617003 +0100] - ERR - allow_operation - Component identity is NULL [17/Nov/2022:17:22:42.487999340 +0100] - ERR - allow_operation - Component identity is NULL [17/Nov/2022:17:22:43.468192243 +0100] - INFO - PBKDF2_SHA256 - Based on CPU performance, chose 2048 rounds [17/Nov/2022:17:22:44.183513462 +0100] - INFO - ldbm_instance_config_cachememsize_set - force a minimal value 512000 [17/Nov/2022:17:22:44.624731155 +0100] - INFO - ldbm_instance_config_cachememsize_set - force a minimal value 512000 [17/Nov/2022:17:22:45.253918872 +0100] - INFO - ldbm_instance_config_cachememsize_set - force a minimal value 512000 [17/Nov/2022:17:22:45.858243466 +0100] - NOTICE - bdb_start_autotune - found 4009000k physical memory [17/Nov/2022:17:22:46.481252068 +0100] - NOTICE - bdb_start_autotune - found 2327312k available [17/Nov/2022:17:22:47.020077517 +0100] - NOTICE - bdb_start_autotune - cache autosizing: db cache: 250562k [17/Nov/2022:17:22:47.566361446 +0100] - NOTICE - bdb_start_autotune - cache autosizing: userRoot entry cache (3 total): 262144k [17/Nov/2022:17:22:48.138811388 +0100] - NOTICE - bdb_start_autotune - cache autosizing: userRoot dn cache (3 total): 65536k [17/Nov/2022:17:22:48.755496155 +0100] - NOTICE - bdb_start_autotune - cache autosizing: ipaca entry cache (3 total): 262144k [17/Nov/2022:17:22:49.175857218 +0100] - NOTICE - bdb_start_autotune - cache autosizing: ipaca dn cache (3 total): 65536k [17/Nov/2022:17:22:49.566843365 +0100] - NOTICE - bdb_start_autotune - cache autosizing: changelog entry cache (3 total): 262144k [17/Nov/2022:17:22:49.909708217 +0100] - NOTICE - bdb_start_autotune - cache autosizing: changelog dn cache (3 total): 65536k [17/Nov/2022:17:22:50.263993498 +0100] - NOTICE - bdb_start_autotune - total cache size: 1211893760 B; [17/Nov/2022:17:22:50.333639865 +0100] - ERR - schema-compat-plugin - scheduled schema-compat-plugin tree scan in about 5 seconds after the server startup! [17/Nov/2022:17:22:50.389238294 +0100] - WARN - NSACLPlugin - acl_parse - The ACL target cn=groups,cn=compat,dc=hq,dc=spinque,dc=com does not exist [17/Nov/2022:17:22:51.043292508 +0100] - WARN - NSACLPlugin - acl_parse - The ACL target cn=computers,cn=compat,dc=hq,dc=spinque,dc=com does not exist [17/Nov/2022:17:22:51.289250298 +0100] - WARN - NSACLPlugin - acl_parse - The ACL target cn=ng,cn=compat,dc=hq,dc=spinque,dc=com does not exist [17/Nov/2022:17:22:51.707124934 +0100] - WARN - NSACLPlugin - acl_parse - The ACL target ou=sudoers,dc=hq,dc=spinque,dc=com does not exist [17/Nov/2022:17:22:52.141269102 +0100] - WARN - NSACLPlugin - acl_parse - The ACL target cn=users,cn=compat,dc=hq,dc=spinque,dc=com does not exist [17/Nov/2022:17:22:52.683089238 +0100] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=hq,dc=spinque,dc=com does not exist [17/Nov/2022:17:22:53.088962531 +0100] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=hq,dc=spinque,dc=com does not exist [17/Nov/2022:17:22:53.508436603 +0100] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=hq,dc=spinque,dc=com does not exist [17/Nov/2022:17:22:53.968874992 +0100] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=hq,dc=spinque,dc=com does not exist [17/Nov/2022:17:22:54.420310634 +0100] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=hq,dc=spinque,dc=com does not exist [17/Nov/2022:17:22:54.999192598 +0100] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=hq,dc=spinque,dc=com does not exist [17/Nov/2022:17:22:55.956089913 +0100] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=hq,dc=spinque,dc=com does not exist [17/Nov/2022:17:22:56.410138348 +0100] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=hq,dc=spinque,dc=com does not exist [17/Nov/2022:17:22:56.849184508 +0100] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=hq,dc=spinque,dc=com does not exist [17/Nov/2022:17:22:57.326422211 +0100] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=hq,dc=spinque,dc=com does not exist [17/Nov/2022:17:22:57.907640062 +0100] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=hq,dc=spinque,dc=com does not exist [17/Nov/2022:17:22:58.319864944 +0100] - WARN - NSACLPlugin - acl_parse - The ACL target cn=casigningcert cert-pki-ca,cn=ca_renewal,cn=ipa,cn=etc,dc=hq,dc=spinque,dc=com does not exist [17/Nov/2022:17:22:58.828744743 +0100] - WARN - NSACLPlugin - acl_parse - The ACL target cn=casigningcert cert-pki-ca,cn=ca_renewal,cn=ipa,cn=etc,dc=hq,dc=spinque,dc=com does not exist [17/Nov/2022:17:22:59.370165550 +0100] - WARN - NSACLPlugin - acl_parse - The ACL target cn=automember rebuild membership,cn=tasks,cn=config does not exist [17/Nov/2022:17:22:59.588838582 +0100] - INFO - slapi_vattrspi_regattr - Because krbPwdPolicyReference is a new registered virtual attribute , nsslapd-ignore-virtual-attrs was set to 'off' [17/Nov/2022:17:22:59.745115662 +0100] - ERR - NSMMReplicationPlugin - bind_and_check_pwp - agmt="cn=ipa02.hq.spinque.com-to-ipa03.hq.spinque.com" (ipa03:389) - Replication bind with GSSAPI auth failed: LDAP error -1 (Can't contact LDAP server) () [17/Nov/2022:17:22:59.767333919 +0100] - ERR - NSMMReplicationPlugin - bind_and_check_pwp - agmt="cn=ipa02.hq.spinque.com-to-ipa03.hq.spinque.com" (ipa03:389) - Replication bind with GSSAPI auth failed: LDAP error -1 (Can't contact LDAP server) () [17/Nov/2022:17:22:59.860445639 +0100] - ERR - schema-compat-plugin - schema-compat-plugin tree scan will start in about 5 seconds! [17/Nov/2022:17:23:00.264824712 +0100] - INFO - slapd_daemon - slapd started. Listening on All Interfaces port 389 for LDAP requests [17/Nov/2022:17:23:00.921258615 +0100] - INFO - slapd_daemon - Listening on All Interfaces port 636 for LDAPS requests [17/Nov/2022:17:23:01.412183755 +0100] - INFO - slapd_daemon - Listening on /run/slapd-HQ-SPINQUE-COM.socket for LDAPI requests [17/Nov/2022:17:23:04.807261352 +0100] - ERR - schema-compat-plugin - warning: no entries set up under cn=computers, cn=compat,dc=hq,dc=spinque,dc=com Two things to notice about this last output: - bind_and_check_pwp - agmt="cn=ipa02.hq.spinque.com-to-ipa03.hq.spinque.com" (ipa03:389) is not surprising, because ipa03 no longer exists for quite some time. I thought I had removed it cleanly, but apparently there are still some reminders. I don't know how serious of a problem this can be, nor how to remove these traces. - sometimes, but not always, this log also shows: ERR - bdb_version_write - Could not open file "/dev/shm/slapd-HQ-SPINQUE-COM/DBVERSION" for writing Netscape Portable Runtime -5950 (File not found.) Afterwards, the file is there. Perhaps just a timing issue? I don't know what else to look at to see what the problem is. Thanks for your help, Roberto

4 8

failing ipa-server-upgrade
by Roberto Cornacchia 17 Nov '22

17 Nov '22

Hi there, I appear to be stuck in a failing upgrade. On Rocky Linux 8.6. The server is one of 2 replicas, both CA and DNS servers. It all started with pki-tomcat being down on a running server ( ipa02.hq.spinque.com) ipactl status Directory Service: RUNNING krb5kdc Service: RUNNING kadmin Service: RUNNING named Service: RUNNING httpd Service: RUNNING ipa-custodia Service: RUNNING pki-tomcatd Service: STOPPED ipa-otpd Service: RUNNING ipa-dnskeysyncd Service: RUNNING 1 service(s) are not running and unable to go up again, with these errors: ipa-pki-wait-running: Request failed unexpectedly, 404 Client Error: for url: http://ipa02.hq.spinque.com:8080/ca/admin/ca/getStatus SEVERE: LdapBoundConnFactory: Unable to connect to LDAP server: Authentication failed netscape.ldap.LDAPException: Authentication failed (48) Having read something about a similar issue being caused by nss 3.67 (the one installed in the system), I ran a dnf update (4.9.8-8 installed). This actually complicated things, because now it still fails, but also it tries to upgrade every time it starts, failing the upgrade. As far as I can see in the upgrade log, The actual upgrade succeeds, but starting the services at the end fails, which makes the whole procedure fail. So running ipactl restart --ignore-service-failures does not help, because the automatic upgrade fails and that stops all the services as a last step. I'm not sure how I could continue, some pointer would be appreciated. Errors I see now: ERR - set_krb5_creds - Could not get initial credentials for principal [ldap/ipa02.hq.spinque.com(a)HQ.SPINQUE.COM] in keytab [FILE:/etc/dirsrv/ds.keytab]: -1765328228 (Cannot contact any KDC for requested realm) ldap_child[2130]: Failed to initialize credentials using keytab [MEMORY:/etc/krb5.keytab]: Cannot contact any KDC for realm 'HQ.SPINQUE.COM'. Unable to create GSSAPI-encrypted LDAP connection. Thanks for your help, Roberto

4 14

ipa-replica-install: "Trust is configured"
by Roberto Cornacchia 17 Nov '22

17 Nov '22

I'm adding a replica, with CA and DNS setup, to an existing server (also DNS and CA). First enrolled the server-to-be with ipa-client-install, then promoting it to replica with ipa-replica-install. With or without CA and DNs, I get: ======= # ipa-replica-install Lookup failed: Preferred host ipa02.hq.spinque.com does not provide DNS. Trust is configured but no NetBIOS domain name found, setting it now. Enter the NetBIOS name for the IPA domain. Only up to 15 uppercase ASCII letters, digits and dashes are allowed. Example: EXAMPLE. NetBIOS domain name [HQ]: ======= The system is a clean Rocky 9 install, we never had a single Windows machine, we never used AD-trust, on both ipa01 and ipa02 ipa trust-find returns 0 matches. Where is it getting this from, and how can I avoid it? VERSION: 4.9.8, API_VERSION: 2.246 Thanks, Roberto

2 2

Microsoft November 2022 updates breaks Active Directory integration
by Rob Crittenden 15 Nov '22

15 Nov '22

Microsoft addressed a number of CVEs last week which introduced some authentication issues. After installation of these patches, user authentication on Linux systems integrated in Active Directory no longer works and new systems are unable to join an AD domain that is managed by domain controllers where these patches have been applied. For more details see https://access.redhat.com/solutions/6985061 (open to the public). rob

4 3

Modify IP address for a FreeIPA Server
by Deepak Ramanath 14 Nov '22

14 Nov '22

I'm trying to see if an IP address for a FreeIPA server can be changed after its been installed?

3 5

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users November 2022