FreeIPA-users November 2022

freeipa-users@lists.fedorahosted.org

42 participants
69 discussions

LoadBalancer vs. DNS
by Ronald Wimmer 06 Nov '22

06 Nov '22

IPA heavily relies on DNS entries. In my opinion, this design makes it more difficult to quickly disable one or more IPA servers - especially when using IPA in combination with external DNS (managed by a different department). Would it be possible to put all relevant DNS entries on a Loadbalancer VIP and let the LB resolve to all IPA servers? e.g. instead of having 8 DNS entries for _kerberos-master._tcp.linux.oebb.at for every of our 8 IPA servers I would have just one _kerberos-master._tcp.linux.oebb.at entry. The LB would distribute requests in such a setup. Is it possible to do that or would it break some IPA functionality? Cheers, Ronald

3 9

IPA API - Fetch keytab
by Ronald Wimmer 06 Nov '22

06 Nov '22

In order to integrate our AIX clients we do have to take two steps manually: 1) Enrolling the host 2) Fetching the keytab file for this particular host A quick search in the WebGUIs API browser revealed a host_add method but I cannot find a method for fetching a keytab file. Did I miss something here? Cheers, Ronald

4 12

Migrating from RHEL 7 IDM to Fedora 36 FreeIPA: passwords and root CA
by Martin Gignac 06 Nov '22

06 Nov '22

Hello, I would like to take a RedHat IDM installation running on RHEL 7 and migrate it to a Fedora 36 installation running FreeIPA. Since the jump in version is too big to simply make the Fedora 36 server a replica of the RHEL 7 installation, and since I'd like to change the domain name from 'country.example.com' to 'example.com', I've decided to use the API to extract users and groups from the RHEL installation and populate them in the Fedora 36 server. The Python script I wrote to run this seems to work fine. However I am left with two remaining things I would like to migrate: passwords and the root CA certificate. 1. Is there a way to transfer over the hashed passwords from the RHEL 7 install to the Fedora 36 one? (I expect that the answer will be "no", but I gotta ask anyway!) 2. Is there away to extract the root CA from the RHEL 7 install and use it as the root CA for all generated certificates on the Fedora 36 one? I would like to keep the same root CA so that I don't have to go and change that certificate on all of my LDAPS clients. Thanks for any hints, tips or guidance you can provide! -Martin

2 2

Rocky Linux 9 missing groups or modules: idm:DL1
by Leo O 06 Nov '22

06 Nov '22

I would like to build my Freeipa Postfix-Book plugin for Rocky Linux 9. Therefore I'm following my readme instructions to setup a development environment: https://github.com/leonidas-o/freeipa-postfixbook-plugin#development-enviro… Unfortunately when executing "dnf module enable idm:DL1" on a Rocky Linux 9 VM, I get: " Error: Problems in request: missing groups or modules: idm:DL1 " How can I do that on Rocky9, Rhel9?

5 8

389ds perfomance and paging out operations
by vladislav zharkov 05 Nov '22

05 Nov '22

Hi, I need assistance in understanding what kind of processes happen behind the work of 389ds server in my case, to come with better approaches in troubleshooting further problems. In our environment we are running FreeIPA instances in Docker, but neither the case that it is FreeIPA nor the Docker part actually matter that much, cause ns-slapd service is the main actor of a "problem" I faced. Prerequisites ------------- Host has 4 CPU, 8gb RAM FreeIPA v.4.9.8 ns-slapd -v 389 Project 389-Directory/1.4.3.28 B2022.074.1358 ------------- Most of the time the host does not expirience any kind of load, though RAM usage (talking about used) can grow linery over time but it makes no odds. After some moment (now I can say with some certainty that's because if buff/cache grows) the host begin to expirience heavy disk write load, which I notice by CPU IOWait alerts. cpu iowait https://imgur.com/ifXPX5N disk IO and latency https://imgur.com/HyT0cNR The increase in load is not due to external causes (increase of ldap queries). Actually, "page out" operations were increasing. https://imgur.com/OxofSD9 and also process exporter showed increased major page faults which served as indicator of memory problems (memory shortage though? there was plenty of RAM) https://imgur.com/xt2p933 Memory status during the problem -------------------------------- Tasks: 175 total, 1 running, 174 sleeping, 0 stopped, 0 zombie %CPU(s): 0.7 us, 0.7 sy, 0.0 ni, 29.1 id, 69.4 wa, 0.0 hi, 0.0 si, 0.0 st MiB Mem : 7957.3 total, 414.3 free, 2332.7 used, 5210.3 buff/cache MiB Swap: 0.0 total, 0.0 free, 0.0 used. 5300.7 avail Mem I tried to use some other instruments that would indicate that something was wrong, but I didn't succeed, but I will still add them here for full picture Here output of https://github.com/iovisor/bcc/blob/master/tools/ext4slower_example.txt shows that fsync syscalls by ns-slapd taking to long TIME COMM PID T BYTES OFF_KB LAT(ms) FILENAME 07:00:02 ns-slapd 4017 S 0 0 1455.28 log.0000006661 07:00:10 ns-slapd 4017 S 0 0 1133.62 log.0000006661 07:00:11 ns-slapd 4017 S 0 0 1248.36 log.0000006661 07:01:02 ns-slapd 4017 S 0 0 736.46 log.0000006661 07:01:05 ns-slapd 4017 S 0 0 1541.29 access 07:01:07 ns-slapd 4017 S 0 0 1220.32 log.0000006661 07:01:08 ns-slapd 4017 S 0 0 832.87 log.0000006661 07:01:08 ns-slapd 4017 S 0 0 93.07 entryusn.db 07:01:09 ns-slapd 4017 S 0 0 418.88 description.db 07:01:10 ns-slapd 4017 S 0 0 822.64 nsuniqueid.db 07:01:10 ns-slapd 4017 S 0 0 417.25 displayname.db 07:01:10 ns-slapd 4017 S 0 0 1493.60 log.0000006661 07:01:11 ns-slapd 4017 S 0 0 617.68 memberHost.db 07:01:12 ns-slapd 4017 S 0 0 1684.12 log.0000006661 07:01:12 ns-slapd 4017 S 0 0 434.58 parentid.db 07:01:12 ns-slapd 4017 S 0 0 601.09 accessRuleType.db 07:01:13 ns-slapd 4017 S 0 0 1051.10 memberUser.db 07:01:14 ns-slapd 4017 S 0 0 1056.28 ipakrbprincipalalias.db 07:01:14 ns-slapd 4017 S 0 0 1803.00 log.0000006661 And another output of https://github.com/iovisor/bcc/blob/master/tools/cachetop_example.txt I honestly not sure how to interpret those results, maybe it would be helpful 07:15:30 Buffers MB: 97 / Cached MB: 4212 / Sort: HITS / Order: descending PID UID CMD HITS MISSES DIRTIES READ_HIT% WRITE_HIT% 4017 UNKNOWN( ns-slapd 7259 7177 7177 0.6% 0.0% So, in the attempts to figure out the solution I tried to restart FreeIPA container but it had no effect. In the end, I stopped container, dropped all memory caches (sync; echo 3 > /proc/sys/vm/drop_caches) and started container, and only after that excessive paging out (and disk IO) was gone. So my questions are: 1) What processes behind the scenes of 389ds server could cause such behavior? 2) Is it (kind of) normal? 3) What actions would you suggest to mitigate such behavior. Would ldap metrics in cn=monitor helped to determing something was wrong? (unfortunately they are not currently monitored, but will be). 4) Generally, what would you suggest to monitor additionally, maybe some metrics that would be of help, but not very obvious.

1 0

[SSSD] Announcing SSSD 2.8.1
by Pavel Březina 04 Nov '22

04 Nov '22

# SSSD 2.8.1 The SSSD team is announcing the release of version 2.8.1 of the System Security Services Daemon. The tarball can be downloaded from: https://github.com/SSSD/sssd/releases/tag/2.8.1 See the full release notes at: https://sssd.io/release-notes/sssd-2.8.1.html RPM packages will be made available for Fedora shortly. ## Feedback Please provide comments, bugs and other feedback via the sssd-devel or sssd-users mailing lists: https://lists.fedorahosted.org/mailman/listinfo/sssd-devel https://lists.fedorahosted.org/mailman/listinfo/sssd-users ## Highlights ### Important fixes * A regression when running sss_cache when no SSSD domain is enabled would produce a syslog critical message was fixed.

1 0

debian and derivates as ipa clients?
by Mathias Homann 02 Nov '22

02 Nov '22

Hi, I have a few debian hosts of various flavours (raspbian, OSMC, and actual debian) that I have to attach to my ipa server (which runs in docker using the last official image), and I'm having trouble finding some of the required packages, namely authselect... any suggestions? I have Ubuntu 22.04.1 LTS and Debian 11 Bullseye here... Cheers MH -- Mathias Homann Mathias.Homann(a)openSUSE.org Jabber (XMPP): lemmy(a)tuxonline.tech Matrix: @mathias:eregion.de IRC: [Lemmy] on freenode and ircnet (bouncer active) keybase: https://keybase.io/lemmy gpg key fingerprint: 8029 2240 F4DD 7776 E7D2 C042 6B8E 029E 13F2 C102

2 3

Cannot obtain CA certificate
by Ronald Wimmer 02 Nov '22

02 Nov '22

When trying to add some new ipa clients (RHEL 7.9) I do get the following error: Cannot obtain CA certificate 'ldap://pipag01.linux.gleis.at' doesn't have a certificate. Installation failed. Rolling back changes. LDAP(S)/HTTP(S) ports are open. What's going on here? How can I debug further? Cheers, Ronald

2 2

Cannot obtain CA certificate
by Ronald Wimmer 02 Nov '22

02 Nov '22

When trying to an ipa client (RHEL 7.9) I do get the following error: Cannot obtain CA certificate 'ldap://ipa1.linux.mydomain.at' doesn't have a certificate. Installation failed. Rolling back changes. LDAP(S) and HTTP(S) ports are open. I do not have a clue why install fails yet. Cheers, Ronald

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users November 2022