February 2022 - FreeIPA-users - Fedora mailing-lists

Re: EMC Isilon and IPA - Kerberos
by thing.thing＠gmail.com 03 Feb '22

03 Feb '22

We appear to have the isilon talking to Redhat's IPA / IdM using kerberos as nfs4 and krb5 work, so I assume this will work with freeipa. Do the LDAP part as described elsewhere. If you have access to RH support kbase, based on RHEL6 notes for non-IPA joined NFS servers (See Debian10 NFS server example), https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/ht… On an IPA master obtain a kerberos ticket as an IPA admin. kinit admin add the isilon host, ipa host-add tststocoisnfs01.odstest.xxxxxx.ac.nz And add nfs service, ipa service-add-host nfs/tststocoisnfs01.odstest.xxxxxx.ac.nz --hosts=tststocoisnfs01.odstest.xxxxxx.ac.nz check, ipa service-show nfs/tststocoisnfs01.odstest.xxxxx.ac.nz you should see "false" for the keytab initially Delegate DNS. Allow the Isilon to manage its roundrobin DNS as it has 6 IPs, ipa host-add-managedby tststocoisnfs01.odstest.xxxxxx.ac.nz --hosts=tststocoisnfs01.odstest.xxxxxx.ac.nz Create the other keytabs the Isilon wants (there will be 4, host, HTTP, nfs and hdfs) ipa service-add hdfs/tststocoisnfs01.odstest.xxxxxx.ac.nz ipa service-add HTTP/tststocoisnfs01.odstest.xxxxxx.ac.nz generate the 4 keytabs, ipa-getkeytab -p nfs/tststocoisnfs01.odstest.xxxxxx.ac.nz(a)ODSTEST.xxxxxx.AC.NZ -k ~/tststocoisnfs01-nfs.keytab ipa-getkeytab -p HTTP/tststocoisnfs01.odstest.xxxxxx.ac.nz(a)ODSTEST.xxxxxx.AC.NZ -k ~/tststocoisnfs01-HTTP.keytab ipa-getkeytab -p host/tststocoisnfs01.odstest.xxxxxx.ac.nz(a)ODSTEST.xxxxxx.AC.NZ -k ~/tststocoisnfs01-host.keytab ipa-getkeytab -p hdfs/tststocoisnfs01.odstest.xxxxxx.nz(a)ODSTEST.xxxxxx.AC.NZ -k ~/tststocoisnfs01-hdfs.keytab (seems to complain if all 4 are not done) keytab should now be true scp the 4 keytabs to the isilon. run the isilon CLI to import these 4. (I will add more as I have the commands) So far RHEL8, RHEL7, Centos7 and Debian10 NFS clients mountnfs4 using kerberos fine.

1 0

ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='idm.issc.io', port=8080): Read timed out
by Ricardo Mendes 03 Feb '22

03 Feb '22

Hi, I'm having an issue where I can't remove an host due to the error: "Operation Error Some entries were not deleted Show details: - Certificate operation cannot be completed: Unable to communicate with CMS (403)" getcert list Number of certificates and requests being tracked: 9. Request ID '20210401150403': status: MONITORING stuck: no key pair storage: type=FILE,location='/var/lib/ipa/ra-agent.key' certificate: type=FILE,location='/var/lib/ipa/ra-agent.pem' CA: dogtag-ipa-ca-renew-agent issuer: CN=Certificate Authority subject: CN=IPA RA expires: 2023-03-22 16:04:03 WET key usage: digitalSignature,keyEncipherment,dataEncipherment eku: id-kp-clientAuth profile: caSubsystemCert pre-save command: /usr/libexec/ipa/certmonger/renew_ra_cert_pre post-save command: /usr/libexec/ipa/certmonger/renew_ra_cert track: yes auto-renew: yes Request ID '20210401150418': status: MONITORING stuck: no key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert cert-pki-ca',token='NSS Certificate DB',pin set certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert cert-pki-ca',token='NSS Certificate DB' CA: dogtag-ipa-ca-renew-agent issuer: CN=Certificate Authority subject: CN=CA Audit expires: 2023-03-22 16:03:31 WET key usage: digitalSignature,nonRepudiation profile: caSignedLogCert pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "auditSigningCert cert-pki-ca" track: yes auto-renew: yes Request ID '20210401150419': status: MONITORING stuck: no key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert cert-pki-ca',token='NSS Certificate DB',pin set certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert cert-pki-ca',token='NSS Certificate DB' CA: dogtag-ipa-ca-renew-agent issuer: CN=Certificate Authority subject: CN=OCSP Subsystem expires: 2023-03-22 16:03:28 WET eku: id-kp-OCSPSigning profile: caOCSPCert pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "ocspSigningCert cert-pki-ca" track: yes auto-renew: yes Request ID '20210401150420': status: MONITORING stuck: no key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert cert-pki-ca',token='NSS Certificate DB',pin set certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert cert-pki-ca',token='NSS Certificate DB' CA: dogtag-ipa-ca-renew-agent issuer: CN=Certificate Authority subject: CN=CA Subsystem expires: 2023-03-22 16:03:30 WET key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment eku: id-kp-clientAuth profile: caSubsystemCert pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "subsystemCert cert-pki-ca" track: yes auto-renew: yes Request ID '20210401150421': status: MONITORING stuck: no key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert cert-pki-ca',token='NSS Certificate DB',pin set certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert cert-pki-ca',token='NSS Certificate DB' CA: dogtag-ipa-ca-renew-agent issuer: CN=Certificate Authority subject: CN=Certificate Authority expires: 2041-04-01 16:03:26 WEST key usage: digitalSignature,nonRepudiation,keyCertSign,cRLSign profile: caCACert pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "caSigningCert cert-pki-ca" track: yes auto-renew: yes Request ID '20210401150422': status: MONITORING stuck: no key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert cert-pki-ca',token='NSS Certificate DB',pin set certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert cert-pki-ca',token='NSS Certificate DB' CA: dogtag-ipa-ca-renew-agent issuer: CN=Certificate Authority subject: CN=idm.domain.io expires: 2023-03-22 16:03:29 WET dns: idm.domain.io key usage: digitalSignature,keyEncipherment,dataEncipherment eku: id-kp-serverAuth profile: caServerCert pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "Server-Cert cert-pki-ca" track: yes auto-renew: yes Request ID '20210401150440': status: MONITORING stuck: no key pair storage: type=NSSDB,location='/etc/dirsrv/slapd-DOMAIN-IO',nickname='Server-Cert',token='NSS Certificate DB',pinfile='/etc/dirsrv/slapd-DOMAIN-IO/pwdfile.txt' certificate: type=NSSDB,location='/etc/dirsrv/slapd-DOMAIN-IO',nickname='Server-Cert',token='NSS Certificate DB' CA: IPA issuer: CN=Certificate Authority subject: CN=idm.domain.io expires: 2023-04-02 16:04:42 WEST dns: idm.domain.io principal name: ldap/idm.domain.io(a)domain.io key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment eku: id-kp-serverAuth,id-kp-clientAuth profile: caIPAserviceCert pre-save command: post-save command: /usr/libexec/ipa/certmonger/restart_dirsrv DOMAIN-IO track: yes auto-renew: yes Request ID '20210401150509': status: MONITORING stuck: no key pair storage: type=FILE,location='/var/lib/ipa/private/httpd.key',pinfile='/var/lib/ipa/passwds/idm.domain.io-443-RSA' certificate: type=FILE,location='/var/lib/ipa/certs/httpd.crt' CA: IPA issuer: CN=Certificate Authority subject: CN=idm.domain.io expires: 2023-04-02 16:05:09 WEST dns: idm.domain.io,ipa-ca.domain.io principal name: HTTP/idm.domain.io(a)domain.io key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment eku: id-kp-serverAuth,id-kp-clientAuth profile: caIPAserviceCert pre-save command: post-save command: /usr/libexec/ipa/certmonger/restart_httpd track: yes auto-renew: yes Request ID '20210401150519': status: MONITORING stuck: no key pair storage: type=FILE,location='/var/kerberos/krb5kdc/kdc.key' certificate: type=FILE,location='/var/kerberos/krb5kdc/kdc.crt' CA: IPA issuer: CN=Certificate Authority subject: CN=idm.domain.io expires: 2023-04-02 16:05:20 WEST principal name: krbtgt/domain.io(a)domain.io key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment eku: id-kp-serverAuth,id-pkinit-KPKdc profile: KDCs_PKINIT_Certs pre-save command: post-save command: /usr/libexec/ipa/certmonger/renew_kdc_cert track: yes auto-renew: yes ski-tomcat doesn't fail to start, however I get the following errors: -- Subject: Unit pki-tomcatd(a)pki-tomcat.service has begun start-up -- Defined-By: systemd -- Support: https://access.redhat.com/support -- -- Unit pki-tomcatd(a)pki-tomcat.service has begun starting up. Feb 02 15:22:15 idm.domain.io server[8216]: Java virtual machine used: /usr/lib/jvm/jre-1.8.0-openjdk/bin/java Feb 02 15:22:15 idm.domain.io server[8216]: classpath used: /usr/share/tomcat/bin/bootstrap.jar:/usr/share/tomcat/bin/tomcat-juli.jar:/usr/share/java/ant.jar:/usr/share/java/ant-laun> Feb 02 15:22:15 idm.domain.io server[8216]: main class used: org.apache.catalina.startup.Bootstrap Feb 02 15:22:15 idm.domain.io server[8216]: flags used: -Dcom.redhat.fips=false Feb 02 15:22:15 idm.domain.io server[8216]: options used: -Dcatalina.base=/var/lib/pki/pki-tomcat -Dcatalina.home=/usr/share/tomcat -Djava.endorsed.dirs= -Djava.io.tmpdir=/var/lib/pk> Feb 02 15:22:15 idm.domain.io server[8216]: arguments used: start Feb 02 15:22:16 idm.domain.io ipa-pki-wait-running[8217]: pki.client: /usr/libexec/ipa/ipa-pki-wait-running:63: The subsystem in PKIConnection.__init__() has been deprecated (https:/> Feb 02 15:22:16 idm.domain.io ipa-pki-wait-running[8217]: ipa-pki-wait-running: Created connection http://idm.domain.io:8080/ca Feb 02 15:22:16 idm.domain.io ipa-pki-wait-running[8217]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='idm.domain.io', port=8080): Max retries exceeded with url: /> Feb 02 15:22:17 idm.domain.io ipa-pki-wait-running[8217]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='idm.domain.io', port=8080): Max retries exceeded with url: /> Feb 02 15:22:18 idm.domain.io server[8216]: WARNING: Some of the specified [protocols] are not supported by the SSL engine and have been skipped: [[TLSv1, TLSv1.1]] Feb 02 15:22:19 idm.domain.io ipa-pki-wait-running[8217]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='idm.domain.io', port=8080): Read timed out. (read timeout=1.> Feb 02 15:22:21 idm.domain.io ipa-pki-wait-running[8217]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='idm.domain.io', port=8080): Read timed out. (read timeout=1.> Feb 02 15:22:23 idm.domain.io ipa-pki-wait-running[8217]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='idm.domain.io', port=8080): Read timed out. (read timeout=1.> Feb 02 15:22:25 idm.domain.io ipa-pki-wait-running[8217]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='idm.domain.io', port=8080): Read timed out. (read timeout=1.> Feb 02 15:22:27 idm.domain.io ipa-pki-wait-running[8217]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='idm.domain.io', port=8080): Read timed out. (read timeout=1.> Feb 02 15:22:29 idm.domain.io ipa-pki-wait-running[8217]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='idm.domain.io', port=8080): Read timed out. (read timeout=1.> Feb 02 15:22:31 idm.domain.io ipa-pki-wait-running[8217]: ipa-pki-wait-running: Success, subsystem ca is running! Feb 02 15:22:31 idm.domain.io systemd[1]: Started PKI Tomcat Server pki-tomcat. -- Subject: Unit pki-tomcatd(a)pki-tomcat.service has finished start-up -- Defined-By: systemd -- Support: https://access.redhat.com/support -- -- Unit pki-tomcatd(a)pki-tomcat.service has finished starting up. -- -- The start-up result is done. I have followed this solution as well, but it didn't made any difference. https://access.redhat.com/solutions/4796941 IPA doesn't fail, all services are running, I simply can't do any operations that involve the CMS. Any help appreciated, thank you. Ricardo M.

2 4

IPA WebGUI login fails with "Login failed due to an unknown reason"
by code bugs 02 Feb '22

02 Feb '22

Hello, -IPA WebGUI login fails with "Login failed due to an unknown reason" -After upgrading IPA, can no longer log into the WebGUI Version/Release/Distribution $ cat /etc/centos-release CentOS Linux release 8.5.2111 $ rpm -q freeipa-server freeipa-client ipa-server ipa-client 389-ds-base pki-ca krb5-server package freeipa-server is not installed package freeipa-client is not installed ipa-server-4.9.6-10.module_el8.5.0+1055+c415bbe9.x86_64 ipa-client-4.9.6-10.module_el8.5.0+1055+c415bbe9.x86_64 389-ds-base-1.4.3.23-12.module_el8.5.0+1056+b3c5a4b9.x86_64 pki-ca-10.11.2-2.module_el8.5.0+945+a81e57da.noarch krb5-server-1.18.2-14.el8.x86_64 Additional info: tail /var/log/httpd/error_log [wsgi:error] [pid 8833:tid 139812622513920] [remote 10.2.3.80:51404] ipa: INFO: 401 Unauthorized: Major (851968): Unspecified GSS failure. Minor code may provide more information, Minor (2598844948): TGT has been revoked further, 1. default "admin" user can IPA WebGUIlogin 2. other users cannot login IPA WebGUIlogin, but can login using cli (kinit) 3. when i create a new user, the new user can login IPA WebGUI.

3 17

IPA to IPA migration - lot more groups - why?
by lejeczek 02 Feb '22

02 Feb '22

Hi guys. I migrate: -> $ ipa migrate-ds --bind-dn="cn=Directory Manager" --user-container=cn=users,cn=accounts --group-container=cn=groups,cn=accounts --group-objectclass=posixgroup --with-compat ldap://10.0.0.16 and I end up, according to 'group-find', having a lot more - one for each user - extra groups which do not exist(or don't show up?) on the source IPA domain. Why is that? Is that a symptom of a problem? Is it safe to remove those extra groups? many thanks, L

4 5

Rawhide upgrade dirsrv startup failure workaround
by Harry G. Coin 02 Feb '22

02 Feb '22

When 'upgrading' using Rawhide, (instead of a fresh install), you might notice ns-slapd / dirsrv fails to start. Do this to work around it: #mkdir /dev/shm/slapd-<your kerberos domain with - instead of .> #chown dirsrv:dirsrv /dev/shm/slapd-<your kerberos domain with - instead of .> #systemctl restart ipa

2 2

Group permissions failing on group with ipaNTSecurityIdentifier attribute
by Scott Serr 02 Feb '22

02 Feb '22

Hello, I have an IPA cluster of 5 servers, running version 4.9.6-10. The system was put in production Feb 2021 and has been updated several times. These updates have sometimes not gone well: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost… I'll try to keep this concise. A user was not able to access an NFS share provided by our EMC Isilon. They were a member of the group that owned the directory/share. But not always, it depended upon what Isilon IP was mounted. After many hours of troubleshooting, we found the group was newly created and different than our old groups. The group had an attribute we are not yet familiar with: ipaNTSecurityIdentifier The group also had an objectClass none of our others have: ipaNTGroupAttrs This brought to my attention an issue I saw last week when trying to add an IPA replica to our cluster. This is new prompting that I have not seen before while setting up replicas: WARNING: 1755 existing users or groups do not have a SID identifier assigned. Installer can run a task to have ipa-sidgen Directory Server plugin generate the SID identifier for all these users. Please note, in case of a high number of users and groups, the operation might lead to high replication traffic and performance degradation. Refer to ipa-adtrust-install(1) man page for details. Do you want to run the ipa-sidgen task? [no]: ---- I'm trying to understand the thread "Login failed due to an unknown reason" https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost… where Alexander explains how to fix SIDs. Also there is a thread: IPA WebGUI login fails with "Login failed due to an unknown reason". Are SIDs now required? An aside, in one of my install-replica attempts last week I was asked to provide a NetBIOS name. :( My IPA cluster is now wanting to do these SMB/AD sorts of things. Newly created groups now have ipaNTSecurityIdentifier, which causes permission issues when mounting NFS on our Isilon. Are we forced down this road or do I have something misconfigured that is "half-way" doing AD? I'd like to learn about the big picture. Thank you, Scott Serr

2 3

Accidentally deleted NS record
by Nikolay Sukhno 02 Feb '22

02 Feb '22

FreeIPA 4.9.6 One Server. I made a big mistake - accidentally deleted NS record from my dns zone and reload named. Zone configured via dyndb Now the dns server is not starting - zone company.local/IN: has no NS records If I try to add ns record from command line ipa dnsrecord-add gisw.ru @ --ns-hostname=vm-it-ipa1.company.local. ipa: ERROR: All nameservers failed to answer the query vm-it-ipa1.company.local.ru. IN A: Server 127.0.0.1 UDP port 53 answered SERVFAIL I'm stumped....

2 3

Short names in named dyndb module
by Nikolay Sukhno 02 Feb '22

02 Feb '22

I understand that short names in DNS are not what you need The DNS suffix is substituted on the client side from the resolv.conf, tcp\ip settings etc. But in my infrastructure there are some strings for short names and I would like the dns server to supply the suffix itself. There is no problem in the "classic" bind - the first short name found in the zones and return fdqn. But when using dindb as part of FreeIPA this doesn't happen. Maybe there is some kind of workround?

1 0

AD groups detected only on one ipa server
by iulian roman 02 Feb '22

02 Feb '22

Hi everybody, I have an IPA setup with AD trust and when I added a new group in AD it is detected only on one ipa server (I have 2 ipa servers in replication mode). getent group correctly returns the group only on one IPA server, therefore only the ipa clients enrolled to that ipa server can see the group. In the sssd logs I can see the following error: [ipa_s2n_exop_done] (0x0040): ldap_extended_operation result: No such object(32), (null). If i try to add the AD group as external to a IPA group , by executing: ipa group-add-member ad_group --external "infosec(a)example.local" , I get the following error: member group: infosec(a)example.local: trusted domain object not found Any idea how can I solve or troubleshoot it?

2 2

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users February 2022