July 2022 - FreeIPA-users - Fedora mailing-lists

LoadBalancer vs. DNS
by Ronald Wimmer 06 Nov '22

06 Nov '22

IPA heavily relies on DNS entries. In my opinion, this design makes it more difficult to quickly disable one or more IPA servers - especially when using IPA in combination with external DNS (managed by a different department). Would it be possible to put all relevant DNS entries on a Loadbalancer VIP and let the LB resolve to all IPA servers? e.g. instead of having 8 DNS entries for _kerberos-master._tcp.linux.oebb.at for every of our 8 IPA servers I would have just one _kerberos-master._tcp.linux.oebb.at entry. The LB would distribute requests in such a setup. Is it possible to do that or would it break some IPA functionality? Cheers, Ronald

3 9

Ubuntu 20.04 client can't find names for some group IDs
by Ranbir 17 Aug '22

17 Aug '22

Hi Everyone, I migrated an Ubuntu 20.04 client from NIS authentication to an AlmaLinux 9 IdM domain. I purged the NIS package, installed the freeipa-client, successfully enrolled it into the domain and now when I login via ssh, I get these messages: groups: cannot find name for group ID 1762200513 groups: cannot find name for group ID 1762213360 groups: cannot find name for group ID 1762225405 groups: cannot find name for group ID 1762243097 groups: cannot find name for group ID 1762243100 groups: cannot find name for group ID 1762263161 groups: cannot find name for group ID 1762313267 groups: cannot find name for group ID 1762313342 groups: cannot find name for group ID 1762313405 groups: cannot find name for group ID 1762358745 I can lookup the group names from an idm server. Also, I think this groups lookup problem is the cause of slow logins on this Ubuntu client. On other clients, I get similar messages when I use the "groups" command to see which groups I'm a member of. I've never experienced this before in an idm environment. What's causing the issue? -- Ranbir

2 5

IdM with trust relationship with Samba AD DC - User accounts with passwords expired
by Mateo Duffour 10 Aug '22

10 Aug '22

Hi, We currently have an IdM installation with a trust relationship with a Samba AD DC. Our user accounts reside on Samba AD DC, we dont have user accounts on IdM. We are having a problem with Samba user acounts that have its passwords expired. When we try to login with an ubuntu IdM client with one of those accounts, it fails and asks again for password. The behaviour we are expecting is that Ubuntu should ask for a password change. Thanks, best regards. Lic. Mateo Duffour Unidad Informática 2901.40.91 [ http://maps.apple.com/?q=18%20de%20julio%20985%20-%20Piso%204,Montevideo,Ur… | 18 de julio 985 - Piso 3, Montevideo, Uruguay ] [ http://www.fnr.gub.uy/ | ] No me imprimas si no es necesario. Protejamos el medio ambiente. Este mensaje y la información adjunta al mismo está dirigido exclusivamente a su destinatario. Puede contener información confidencial, privilegiada o de uso restringido, protegida por las normas. Si Ud. recibió este e-mail por error, por favor, sírvase notificarle a quien se lo envió y borrar el original. Cualquier otro uso del e-mail por Ud. está prohibido.

5 43

Potential API change for FreeIPA plugin writers
by Alexander Bokovoy 08 Aug '22

08 Aug '22

Hi, as you have probably noticed in a thread we had with Leo on freeipa-users@ about FreeIPA plugin development, we hadn't had consistency in handling boolean types between LDAP and IPA Python API level. A change is coming that would make 'native' boolean types used in both worlds. If your plugins rely on Bool() parameter handling in FreeIPA, your code might be affected. If your scripts using output of IPA API rely on case-sensitive output, you might need to adjust your code. If not, you can skip this email. Pull request https://github.com/freeipa/freeipa/pull/6294 turns handling of boolean types to be native to each side: - in LDAP, TRUE and FALSE strings used to represent the values - in Python, native True and False constants of bool type will be used to represent an LDAP boolean. Prior to PR#6294, when an LDAP attribute with a boolean syntax was read from LDAP, its representation in IPA Python code was either 'TRUE' or 'FALSE' string. This created a bit of inconvenience: - Python code had to explicitly compare a value to 'TRUE' or 'FALSE', - Web UI JavaScript code had to use a radio-box where a simple checkbox would be enough - JavaScript plugin code would need to handle all types of 'TRUE', 'FALSE', 1, 0, true, false, none in every place where a boolean type would be enough After PR#6294 is merged, IPA Python code will use Python bool type. JSON-RPC response to an IPA API command request would produce a simple 'true' or 'false' instead of ["TRUE"] or ["FALSE"] elements. This means, for example, that in the following command ipa dnszone-show ipa.test instead of "idnsallowdynupdate": [ "TRUE" ], one would get "idnsallowdynupdate": [ true ], and the output of 'ipa dnszone-show ipa.test' would have 'True' instead of 'TRUE' (and False instead of 'FALSE'): $ ipa dnszone-show ipa.test Zone name: ipa.test. Active zone: True Authoritative nameserver: idm.ipa.test. Administrator e-mail address: hostmaster.ipa.test. SOA serial: 1654159048 SOA refresh: 3600 SOA retry: 900 SOA expire: 1209600 SOA minimum: 3600 BIND update policy: grant IPA.TEST krb5-self * A; grant IPA.TEST krb5-self * AAAA; grant IPA.TEST krb5-self * SSHFP; Dynamic update: True Allow query: any; Allow transfer: none; If your scripts rely on the case-sensitive output, you'd need to fix them. IPA tools already able to handle the changes so they are backward-compatible. -- / Alexander Bokovoy Sr. Principal Software Engineer Security / Identity Management Engineering Red Hat Limited, Finland

3 3

Dnssec rejected by Cloudflair, Google, accepted by Verizon, AT&T
by Harry G. Coin 08 Aug '22

08 Aug '22

I have a dnssec enabled domain that passes all the verisign and related dnssec tests (all green, no errors) and dns sources like AT&T and Verizon. But it fails at some popular dns servers like google and cloudflair. I'd appreciate what anyone can make of that, there are no obvious debugging directions when verisgn says 'all good'. If I turn on the 'cdflag' most all of https://dnschecker.org/#A/quietfountain.com works. Turn it off, and some report problems. Some clues most welcome! Harry Coin Here's Quad9, for example: [root@registry1 ~]# dig @9.9.9.9 quietfountain.com ; <<>> DiG 9.11.36-RedHat-9.11.36-3.el8 <<>> @9.9.9.9 quietfountain.com ; (1 server found) ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 45758 ;; flags: qr rd ra ad; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 512 ;; QUESTION SECTION: ;quietfountain.com. IN A ;; ANSWER SECTION: quietfountain.com. 43200 IN A 147.135.121.120 quietfountain.com. 43200 IN A 51.81.131.192 ;; Query time: 1463 msec ;; SERVER: 9.9.9.9#53(9.9.9.9) ;; WHEN: Tue Jul 26 17:53:39 CDT 2022 ;; MSG SIZE rcvd: 78 But, here's cloudflair and google: [root@registry1 ~]# dig @1.1.1.1 quietfountain.com ; <<>> DiG 9.11.36-RedHat-9.11.36-3.el8 <<>> @1.1.1.1 quietfountain.com ; (1 server found) ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 64113 ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 1232 ; EDE: 9 (DNSKEY Missing): (no SEP matching the DS found for quietfountain.com.) ;; QUESTION SECTION: ;quietfountain.com. IN A ;; Query time: 2197 msec ;; SERVER: 1.1.1.1#53(1.1.1.1) ;; WHEN: Tue Jul 26 17:51:22 CDT 2022 ;; MSG SIZE rcvd: 103 [root@registry1 ~]# dig @8.8.8.8 quietfountain.com ; <<>> DiG 9.11.36-RedHat-9.11.36-3.el8 <<>> @8.8.8.8 quietfountain.com ; (1 server found) ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 61907 ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 512 ;; QUESTION SECTION: ;quietfountain.com. IN A ;; Query time: 2303 msec ;; SERVER: 8.8.8.8#53(8.8.8.8) ;; WHEN: Tue Jul 26 17:51:35 CDT 2022 ;; MSG SIZE rcvd: 46

3 7

Ubuntu uses /etc/apache2/nssdb instead of the /etc/httpd/alias service and the certificate store.
by roy liang 07 Aug '22

07 Aug '22

> I made the following soft link > ln -s /etc/apache2/nssdb /etc/httpd/alias > But return code 77 as well, so what do I need to do? > > root@migration-ipa-65-186:/.ipa/log# tailf renew.log > 2022-04-09T16:02:13Z 21810 MainThread ipa DEBUG stderr=* Trying > 10.12.65.186... > * Connected to migration-ipa-65-186.hiido.host.yydevops.com (10.12.65.186) port 8443 (#0) > * Initializing NSS with certpath: sql:/etc/httpd/alias > * WARNING: failed to load NSS PEM library libnsspem.so. Using OpenSSL PEM certificates > will not work. > * Closing connection 0 > GET > "https://migration-ipa-65-186.hiido.host.yydevops.com:8443/ca/agent/ca/profi…" > code = 77 > code_text = "Problem with the SSL CA cert (path? access rights?)" > results = "(null)" > > 2022-04-09T16:02:22Z 21811 MainThread ipa DEBUG Initializing principal > host/migration-ipa-65-186.hiido.host.yydevops.com(a)YYDEVOPS.COM using keytab > /etc/krb5.keytab > 2022-04-09T16:02:22Z 21811 MainThread ipa DEBUG using ccache > /var/run/certmonger/tmp-FYfJPZ/ccache > 2022-04-09T16:02:22Z 21811 MainThread ipa DEBUG Attempt 1/1: success > 2022-04-09T16:02:22Z 21811 MainThread ipa DEBUG Loading StateFile from > '/var/lib/ipa/sysrestore/sysrestore.state' > 2022-04-09T16:02:23Z 21811 MainThread ipa.ipapython.ipaldap.SchemaCache > DEBUG flushing ldap://migration-ipa-65-186.hiido.host.yydevops.com:389 from SchemaCache > 2022-04-09T16:02:23Z 21811 MainThread ipa.ipapython.ipaldap.SchemaCache > DEBUG retrieving schema for SchemaCache > url=ldap://migration-ipa-65-186.hiido.host.yydevops.com:389 > conn=<ldap.ldapobject.SimpleLDAPObject instance at 0x7f307a537290> > 2022-04-09T16:02:24Z 21811 MainThread ipa DEBUG Starting external process > 2022-04-09T16:02:24Z 21811 MainThread ipa DEBUG > args=/usr/lib/certmonger/dogtag-ipa-renew-agent-submit -vv > 2022-04-09T16:02:24Z 21811 MainThread ipa DEBUG Process finished, return > code=3 > 2022-04-09T16:02:24Z 21811 MainThread ipa DEBUG stdout=Error 77 connecting > to https://migration-ipa-65-186.hiido.host.yydevops.com:8443/ca/agent/ca/pro...: > Problem with the SSL CA cert (path? access rights?). > > 2022-04-09T16:02:24Z 21811 MainThread ipa DEBUG stderr=* Trying > 10.12.65.186... > * Connected to migration-ipa-65-186.hiido.host.yydevops.com (10.12.65.186) port 8443 (#0) > * Initializing NSS with certpath: sql:/etc/httpd/alias > * WARNING: failed to load NSS PEM library libnsspem.so. Using OpenSSL PEM certificates > will not work. > * Closing connection 0 > GET > "https://migration-ipa-65-186.hiido.host.yydevops.com:8443/ca/agent/ca/profi…" > code = 77 > code_text = "Problem with the SSL CA cert (path? access rights?)" > results = "(null)" > > 2022-04-09T16:02:32Z 21809 MainThread ipa DEBUG Initializing principal > host/migration-ipa-65-186.hiido.host.yydevops.com(a)YYDEVOPS.COM using keytab > /etc/krb5.keytab > 2022-04-09T16:02:32Z 21809 MainThread ipa DEBUG using ccache > /var/run/certmonger/tmp-svWgpP/ccache > 2022-04-09T16:02:32Z 21809 MainThread ipa DEBUG Attempt 1/1: success > 2022-04-09T16:02:32Z 21809 MainThread ipa DEBUG Loading StateFile from > '/var/lib/ipa/sysrestore/sysrestore.state' > 2022-04-09T16:02:33Z 21809 MainThread ipa.ipapython.ipaldap.SchemaCache > DEBUG flushing ldap://migration-ipa-65-186.hiido.host.yydevops.com:389 from SchemaCache > 2022-04-09T16:02:33Z 21809 MainThread ipa.ipapython.ipaldap.SchemaCache > DEBUG retrieving schema for SchemaCache > url=ldap://migration-ipa-65-186.hiido.host.yydevops.com:389 > conn=<ldap.ldapobject.SimpleLDAPObject instance at 0x7fbd8bfd6f80> > 2022-04-09T16:02:34Z 21809 MainThread ipa DEBUG Starting external process > 2022-04-09T16:02:34Z 21809 MainThread ipa DEBUG > args=/usr/lib/certmonger/dogtag-ipa-renew-agent-submit -vv > 2022-04-09T16:02:34Z 21809 MainThread ipa DEBUG Process finished, return > code=3 > 2022-04-09T16:02:34Z 21809 MainThread ipa DEBUG stdout=Error 77 connecting > to https://migration-ipa-65-186.hiido.host.yydevops.com:8443/ca/agent/ca/pro...: > Problem with the SSL CA cert (path? access rights?). > > 2022-04-09T16:02:34Z 21809 MainThread ipa DEBUG stderr=* Trying > 10.12.65.186... > * Connected to migration-ipa-65-186.hiido.host.yydevops.com (10.12.65.186) port 8443 (#0) > * Initializing NSS with certpath: sql:/etc/httpd/alias > * WARNING: failed to load NSS PEM library libnsspem.so. Using OpenSSL PEM certificates > will not work. > * Closing connection 0 > GET > "https://migration-ipa-65-186.hiido.host.yydevops.com:8443/ca/agent/ca/profi…" > code = 77 > code_text = "Problem with the SSL CA cert (path? access rights?)" > results = "(null)" > > 2022-04-09T16:02:42Z 21812 MainThread ipa DEBUG Initializing principal > host/migration-ipa-65-186.hiido.host.yydevops.com(a)YYDEVOPS.COM using keytab > /etc/krb5.keytab > 2022-04-09T16:02:42Z 21812 MainThread ipa DEBUG using ccache > /var/run/certmonger/tmp-DSagx_/ccache > 2022-04-09T16:02:42Z 21812 MainThread ipa DEBUG Attempt 1/1: success > 2022-04-09T16:02:42Z 21812 MainThread ipa DEBUG Loading StateFile from > '/var/lib/ipa/sysrestore/sysrestore.state' > 2022-04-09T16:02:43Z 21812 MainThread ipa.ipapython.ipaldap.SchemaCache > DEBUG flushing ldap://migration-ipa-65-186.hiido.host.yydevops.com:389 from SchemaCache > 2022-04-09T16:02:43Z 21812 MainThread ipa.ipapython.ipaldap.SchemaCache > DEBUG retrieving schema for SchemaCache > url=ldap://migration-ipa-65-186.hiido.host.yydevops.com:389 > conn=<ldap.ldapobject.SimpleLDAPObject instance at 0x7f1c70811b00> > 2022-04-09T16:02:44Z 21812 MainThread ipa DEBUG Starting external process > 2022-04-09T16:02:44Z 21812 MainThread ipa DEBUG > args=/usr/lib/certmonger/dogtag-ipa-renew-agent-submit -vv > 2022-04-09T16:02:44Z 21812 MainThread ipa DEBUG Process finished, return > code=3 > 2022-04-09T16:02:44Z 21812 MainThread ipa DEBUG stdout=Error 77 connecting > to https://migration-ipa-65-186.hiido.host.yydevops.com:8443/ca/agent/ca/pro...: > Problem with the SSL CA cert (path? access rights?). > > 2022-04-09T16:02:44Z 21812 MainThread ipa DEBUG stderr=* Trying > 10.12.65.186... > * Connected to migration-ipa-65-186.hiido.host.yydevops.com (10.12.65.186) port 8443 (#0) > * Initializing NSS with certpath: sql:/etc/httpd/alias > * WARNING: failed to load NSS PEM library libnsspem.so. Using OpenSSL PEM certificates > will not work. > * Closing connection 0 > GET > "https://migration-ipa-65-186.hiido.host.yydevops.com:8443/ca/agent/ca/profi…" > code = 77 > code_text = "Problem with the SSL CA cert (path? access rights?)" > results = "(null)" > > root@migration-ipa-65-186:/.ipa/log# ll /etc/httpd/alias > lrwxrwxrwx 1 root root 18 Apr 10 00:00 /etc/httpd/alias -> /etc/apache2/nssdb hello Can I get some attention? Using Ubuntu install freeipa is an addition left by the company, I also feel very sorry. If I fix the expiration problem, I will migrate to centos, but I need to solve the certificate expiration problem first, Ubuntu does not use /etc/httpd/alias service and certificate store./etc/apache2/nssdb /apache2/nssdb /etc/apache2/nssdb

3 14

road-warrior laptop vs password change in FreeIPA
by Harald Dunkel 04 Aug '22

04 Aug '22

Hi folks, I've got a few colleagues running Debian 10 or 11 on a laptop. Their account is managed by FreeIPA in the office. On first-time login their laptop is wired to the office lan. When they are in home office they have a VPN connection (IPsec, wireguard or openvpn) to the office, but since both wlan and VPN are usually activated by Network Manager *after* login time I wonder what needs to be done to update the login information cached by sssd, esp if the user has changed his login password in the FreeIPA web interface? By now I tried kinit username sss_cache -E service restart sssd This did not help. kinit accepts the new password, of course, but it doesn't update the cache, nor do the others. Important point is that the user doesn't lose his cached entry, anyway. Coming to the office just to register his new password is not an optiom. Every helpful hint is highly appreciated Harri

3 5

ipa-certupdate error due to expired certificate
by stefano.antonelli＠cnaf 29 Jul '22

29 Jul '22

Dear All we have a three nodes FreeIPA 4.6.8 installation with third part certificate (https / dirsrv). This certificate has expired and when I try to follow the ipa-cacert-manage install ... ipa-certupdate I get the error: "cannot connect to https://ipaserver/ipa/json : [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:618)" I suppose that this is due to the fact that https connection is blocked for expired certificate which I can't renew. Is there a way to bypass this? I've tried to set a date on the server previous than the expiring one of the cert, but I get an SASL/GSSAPI error (even if I renew admin ticket). I was thinking to regenerate /etc/httpd/alias/cert8.db,key3.db with new cert/key but I don't know how thank you regards Stefano

3 5

Change home location when autofs offline
by Ranbir 28 Jul '22

28 Jul '22

Hello All, I don't see a direct option that would allow the auto creation of a home directory in a different location if the default home directory provided by autofs isn't available for one reason or another. Is there a workaround that could let me do that? I'm thinking that maybe I could do something with pam, but I don't know where to start with that. Thanks in advance for any tips. -- Ranbir

2 1

Problem running IPA client on IPv6 only connection
by William Muriithi 26 Jul '22

26 Jul '22

Hello, I have an IPA clients that has both IPv4 and IPv6 addresses. One of the IPA client is in the office and hence can reach the IPA server on both IPv4 and IPv6. However, the client outside the LAN can only reach the IPA server over IPv6. I was able to enroll the external client fine over IPv6 and from the logs, all clean. However, when I attempted to ssh, its not able to retreave the user from IPA. The client in the office works fine. I can also make for example LDAP queries and they work over IPv6 fine. It looks like kerberos is somehow however using IPv4. I reached this conclusion after taking a tcpdump when attempting to ssh to the server and the kerberos traffic from the client to IPA is on IPv4. What would I need to do on the IPA client for it to prefer IPv6? I am aware I could remove IPv4 address from DNS, but that would break any communication from IPv4 only systems. Any assistance would be appreaciated. [william@ansible ~]$ ssh root(a)mars.external.example.com Last login: Mon Jan 7 17:19:49 2019 from 65.98.193.94 [root@mars ~]# kinit admin kinit: Cannot contact any KDC for realm 'EXTERNAL.EXAMPLE.COM <http://external.example.com/>' while getting initial credentials [root@mars ~]# ldapsearch -x -b cn=ftp,cn=groups,cn=compat,dc=external,dc=example,dc=com | tail -n 4 result: 0 Success # numResponses: 2 # numEntries: 1 [root@mars ~]# cat /etc/resolv.conf search external.example.com nameserver 2607:4860:6000:a::5 [root@mars ~]# Regards, William

5 10

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users July 2022