July 2022 - FreeIPA-users - Fedora mailing-lists

ipa-healthcheck Error - how to remove an old replica in pki DB ?
by Kathy Zhu 14 Jul '22

14 Jul '22

Hi Team, We are migrating from Centos 7 IPA to Red Hat 8.6. After adding the first Red Hat master, it reported error: # ipa-healthcheck --source=pki.server.healthcheck.clones.connectivity_and_data Internal server error HTTPSConnectionPool(host='ipa4.example.com', port=443): Max retries exceeded with url: /ca/rest/certs/search?size=3 (Caused by NewConnectionError('<urllib3.connection.VerifiedHTTPSConnection object at 0x7f0611b6d5c0>: Failed to establish a new connection: [Errno -2] Name or service not known',)) [ { "source": "pki.server.healthcheck.clones.connectivity_and_data", "check": "ClonesConnectivyAndDataCheck", "result": "ERROR", "uuid": "bfb9aeac-2e86-4d1d-ac2a-3cb62300527e", "when": "20220711221016Z", "duration": "0.768881", "kw": { "status": "ERROR: pki-tomcat : Internal error testing CA clone. Host: ipa4.example.com Port: 443" } } ] # ipa4 was a master we had years ago. it did not show up as a dangling master in the domain. However, it remains in pki DB. How to safely clean it out from pki DB? Another interesting fact I like to point out - Centos 7 ipa-healthcheck does not report this. Thanks! Kathy.

3 11

Re: ipa-healthcheck errors...
by Eric Ashley 13 Jul '22

13 Jul '22

> > On Friday, July 8th, 2022 at 1:02 PM, Rob Crittenden rcritten(a)redhat.com wrote: > > > > > Not sure what you mean by "wire traffic". It's a vault so perhaps you > > > stored some keys there. IPA already encrypts all its own internal traffic. > > > > When I first installed FreeIPA it did not yet default to encrypted traffic for all accesses. > > > Can you expand on this? Literally all the KRA does is store secrets. It > does not protect traffic unless you manually use those secrets to do so. > Sorry for muddling my description. I was attempting to only show relative time frames. At about the same time, I was making changes to get wire traffic encrypted and ALSO thinking of switching some of my libvirt VMs to containers, which would require shared vaults. I made my changes for encrypted traffic about 6 weeks before the release that heralded all traffic being encrypted by default. KRA was installed but no vaults actually deployed since I decided to stick with VMs for now. > There are URI records like: > > kpasswd.example.test. 3600 IN URI 0 100 "krb5srv:m:tcp:ipa.example.test." Thanks. > > The word match for 'secret=(\w+)$' fails if the first character of the secret isn't alphanumeric. It would incorrectly handle a secret with embedded special characters, though I don't think it would trigger an error, except when the initial alphanumeric portion of the secret was in fact different. > > > Ok yeah, bad regex. Reported at https://github.com/freeipa/freeipa-healthcheck/issues/275 Best regards, Eric

1 0

ipa-healthcheck errors...
by Eric Ashley 12 Jul '22

12 Jul '22

Hello, I installed FreeIPA version 4.8.7-1.fc32.x86_64 on 24 July 2020. I've since kept current with the Fedora release channels, up to 4.9.10-1.fc36. I don't have any Windoze AD domains configured, just FreeIPA. I followed the steps to enable KRA back when it seemed to be required to force encryption of all wire traffic. I'm sure that I must have missed some steps, though everything seems to be working correctly. I've checked the list archive and can't see any instances that are related to the issues ipa-healthcheck reports. ipa-healthcheck reports the following: [ { "source": "ipahealthcheck.ipa.idns", "check": "IPADNSSystemRecordsCheck", "result": "WARNING", "uuid": "432017b9-ef12-44a5-8843-35fd6424d85f", "when": "20220708144958Z", "duration": "0.031444", "kw": { "msg": "Expected URI record missing", "key": "_kerberos.ipa.example.com.:krb5srv:m:tcp:ipaserv.ipa.example.com." } }, { "source": "ipahealthcheck.ipa.idns", "check": "IPADNSSystemRecordsCheck", "result": "WARNING", "uuid": "498649c8-1460-4f34-807b-1b06c08f3aec", "when": "20220708144958Z", "duration": "0.031469", "kw": { "msg": "Expected URI record missing", "key": "_kerberos.ipa.example.com.:krb5srv:m:udp:ipaserv.ipa.example.com." } }, { "source": "ipahealthcheck.ipa.idns", "check": "IPADNSSystemRecordsCheck", "result": "WARNING", "uuid": "3a6c7f80-3ce9-4ba0-b821-d731eb6929a3", "when": "20220708144958Z", "duration": "0.033407", "kw": { "msg": "Expected URI record missing", "key": "_kpasswd.ipa.example.com.:krb5srv:m:tcp:ipaserv.ipa.example.com." } }, { "source": "ipahealthcheck.ipa.proxy", "check": "IPAProxySecretCheck", "result": "CRITICAL", "uuid": "6820b5b3-08a9-4632-a834-a71d1ae0d84b", "when": "20220708144958Z", "duration": "0.000894", "kw": { "key": "proxy_secrets", "proxy_conf": "/etc/httpd/conf.d/ipa-pki-proxy.conf", "msg": "No ProxyPassMatch secrets found in {proxy_conf}" } }, { "source": "pki.server.healthcheck.meta.csconfig", "check": "KRADogtagCertsConfigCheck", "result": "ERROR", "uuid": "1978555c-72d6-47af-8a21-de3967002eca", "when": "20220708145007Z", "duration": "0.065948", "kw": { "key": "kra_sslserver", "nickname": "Server-Cert cert-pki-ca", "directive": "kra.sslserver.cert", "configfile": "/var/lib/pki/pki-tomcat/kra/conf/CS.cfg", "msg": "Certificate 'Server-Cert cert-pki-ca' does not match the value of kra.sslserver.cert in /var/lib/pki/pki-tomcat/kra/conf/CS.cfg" } }, { "source": "pki.server.healthcheck.meta.csconfig", "check": "KRADogtagCertsConfigCheck", "result": "ERROR", "uuid": "cbf470d2-0d58-4c24-aba0-8a62cc399ffe", "when": "20220708145007Z", "duration": "0.114728", "kw": { "key": "kra_subsystem", "nickname": "subsystemCert cert-pki-ca", "directive": "kra.subsystem.cert", "configfile": "/var/lib/pki/pki-tomcat/kra/conf/CS.cfg", "msg": "Certificate 'subsystemCert cert-pki-ca' does not match the value of kra.subsystem.cert in /var/lib/pki/pki-tomcat/kra/conf/CS.cfg" } } ] Some pointers on how to fix these would be greatly appreciated. Best regards, Eric

3 5

MasterCRL.bin URL
by IPA Listmail 08 Jul '22

08 Jul '22

Is there a way, either during ipa-server-install or after to modify the URL to the CRL? I've seen some things that looked promising, but still didn't pan out regarding editing the policyset.serverCertSet.9.default.params.crlDistPointsPointName_0 parameter as well as setting the IPA_SERVER_HOSTNAME env var before installing. Thanks!

2 2

ipa-healthcheck errors, CADogtagCertsConfigCheck and IPADogtagCertsMatchCheck
by Ivars Strazdins 08 Jul '22

08 Jul '22

Hi guys, after upgrading FreeIPA from 4.6.8 to 4.9.8 I was able to run ipa-healthcheck for the first time. Now I am facing two errors: # ipa-healthcheck Unhandler rdtype 256 Unhandler rdtype 256 Unhandler rdtype 256 Unhandler rdtype 256 Unhandler rdtype 256 Unhandler rdtype 256 Unhandler rdtype 256 Unhandler rdtype 256 [ { "source": "pki.server.healthcheck.meta.csconfig", "check": "CADogtagCertsConfigCheck", "result": "ERROR", "uuid": "92710f34-de94-4226-a81c-3e1d116c6410", "when": "20220707130401Z", "duration": "0.324141", "kw": { "key": "ca_signing", "nickname": "caSigningCert cert-pki-ca", "directive": "ca.signing.cert", "configfile": "/var/lib/pki/pki-tomcat/ca/conf/CS.cfg", "msg": "Certificate 'caSigningCert cert-pki-ca' does not match the value of ca.signing.cert in /var/lib/pki/pki-tomcat/ca/conf/CS.cfg" } }, { "source": "ipahealthcheck.ipa.certs", "check": "IPADogtagCertsMatchCheck", "result": "ERROR", "uuid": "b26ad134-e798-4e21-961a-bc17899ac267", "when": "20220707130408Z", "duration": "0.162734", "kw": { "key": "caSigningCert cert-pki-ca", "nickname": "caSigningCert cert-pki-ca", "dbdir": "/etc/pki/pki-tomcat/alias", "msg": "{nickname} certificate in NSS DB {dbdir} does not match entry in LDAP" } } ] certutil output is: # certutil -L -d /etc/pki/pki-tomcat/alias/ Certificate Nickname Trust Attributes SSL,S/MIME,JAR/XPI CN=ISRG Root X1,O=Internet Security Research Group,C=US C,, CN=ISRG Root X2,O=Internet Security Research Group,C=US C,, CN=R3,O=Let's Encrypt,C=US C,, CN=E1,O=Let's Encrypt,C=US C,, CN=R4,O=Let's Encrypt,C=US C,, CN=E2,O=Let's Encrypt,C=US C,, caSigningCert cert-pki-ca CTu,Cu,Cu ocspSigningCert cert-pki-ca u,u,u auditSigningCert cert-pki-ca u,u,Pu subsystemCert cert-pki-ca u,u,u EXAMPLE.COM IPA CA CTu,Cu,Cu Server-Cert cert-pki-ca u,u,u How do I fix these errors? To explain above Letsencrypt certificates - our IPA servers Directory server and Apache server use Letsencrypt certificates that have been added to FreeIPA with command “ipa-server-certinstall -w -d ..." Thank you in advance for your time. Ivars

2 6

iPA-cacert-manage renew --external-ca Failed
by roy liang 07 Jul '22

07 Jul '22

> roy liang via FreeIPA-users wrote: > > Take below with a grain of salt. There be dragons. I did not try this > myself. > > What I'd suggest is you pick a different IPA server to start with. I > think this Ubuntu host is a lost cause. IIRC you have several > Fedora/CentOS/RHEL replicas as well. You want one without the CA on it. > At present, Freeipa is all deployed on Ubuntu 16.04 by Zheng, which is left over by the company and cannot be changed.Now I cannot copy new nodes and upgrade because the certificate has expired. I have given up repairing the expired certificate, because I have tried too many times but failed.Now I have found a quick switching scheme, I don't know whether it is feasible, I hope you can guide it, thank you 1: I currently generate my self-signed certificate from this document https://mariadb.com/docs/security/data-in-transit-encryption/create-self-si… 2: Switch the CA certificate installed by default # ipa-cacert-manage renew --external-ca --external-cert-file /root/new_ca/ca-cert.pem Importing the renewed CA certificate, please wait IPA CA certificate not found in /root/new_ca/ca-cert.pem The ipa-cacert-manage command failed. # iPA-cacert-manage renew --external-ca --external-cert-file /root/new_ca/ca-cert.pem --external-cert-file/ root/new_ca/ca - key. Pem Importing the renewed CA certificate, please wait Failed to load /root/new_ca/ca-key.pem The ipa-cacert-manage command failed. How to do this? I am blind now, can you guide the normal command to switch the CA?Thank you very much. Because according to the documentation here, it should be possible to switch https://floblanc.wordpress.com/2017/12/05/demystifying-the-certificate-auth… I installed FreeIPA without any embedded CA but I change my mind? FreeIPA allows to install an embedded CA at a later time, using ipa-ca-install. The tool provides the same options as ipa-server-install: you can either install a self-signed CA or an externally signed CA. Important: installing an embedded CA with ipa-ca-install does not replace the HTTP and LDAP server certificates. If they were initially delivered by an external CA, they will not be automatically renewed.

2 2

How to Delete IPA CA and sub-CA entries
by roy liang 06 Jul '22

06 Jul '22

https://www.freeipa.org/page/Using_3rd_part_certificates_for_HTTP/LDAP I have generated my own CA and CA sub-certificates and successfully added them according to this document. Now I want to remove the previous CA and CA-related sub-certificates in the system. According to the steps in this document, I am currently stuck in this step. https://frasertweedale.github.io/blog-redhat/posts/2019-10-24-removing-ipa-… How do I do that my linux ubuntu16.04 freeipa4.3 1: #ldapsearch -Y GSSAPI -QLLL -b cn=masters,cn=ipa,cn=etc,dc=yydevops,dc=com '(cn=CA)' dn: cn=CA,cn=migration-ipa-65-214.hiido.host.yydevops.com,cn=masters,cn=ipa,cn =etc,dc=yydevops,dc=com objectClass: ipaConfigObject objectClass: nsContainer objectClass: top ipaConfigString: enabledService ipaConfigString: startOrder 50 ipaConfigString: caRenewalMaster cn: CA #ldapdelete -Y GSSAPI -Q cn=CA,cn=migration-ipa-65-214.hiido.host.yydevops.com,cn=masters,cn=ipa,cn=etc,dc=yydevops,dc=com 2： #ldapsearch -h localhost -p 389 -D cn="directory manager" -w directorypassxx -b cn=certificates,cn=ipa,cn=etc,dc=yydevops,dc=com | grep ^dn: dn: cn=certificates,cn=ipa,cn=etc,dc=yydevops,dc=com dn: cn=YYDEVOPS.COM IPA CA,cn=certificates,cn=ipa,cn=etc,dc=yydevops,dc=com dn: cn=newca,cn=certificates,cn=ipa,cn=etc,dc=yydevops,dc=com ldapdelete -Y GSSAPI -Q "cn=YYDEVOPS.COM IPA CA,cn=certificates,cn=ipa,cn=etc,dc=yydevops,dc=com" 3： # certutil -d /etc/dirsrv/slapd-YYDEVOPS-COM/ -L Certificate Nickname Trust Attributes SSL,S/MIME,JAR/XPI newca u,u,u YYDEVOPS.COM IPA CA CT,C,C newca C,, #certutil -d /etc/dirsrv/slapd-YYDEVOPS-COM/ -D -n 'YYDEVOPS.COM IPA CA' #certutil -d /etc/ipa/nssdb -D -n 'YYDEVOPS.COM IPA CA' 4： #ldapsearch -Y GSSAPI -QLLL -b dc=yydevops,dc=com '(objectclass=ipaca)' 1.1 I can't find any iPACA entry certificate here, why?How do I delete the original sub-ca entries for this system 5： Are the entries in ipacaACL sub-ca entries? Can I delete this entry? ipaca and ipacaacl Will it make any difference? root@migration-ipa-65-214:~/new_ca# ldapsearch -Y GSSAPI -QLLL -b dc=yydevops,dc=com | grep ipaca ipaReplTopoManagedSuffix: o=ipaca objectClass: ipacaacl ipaReplTopoConfRoot: o=ipaca ipaPermTargetFilter: (objectclass=ipacaacl) ipaPermTargetFilter: (objectclass=ipacaacl) ipaPermTargetFilter: (objectclass=ipacaacl) ipaPermDefaultAttr: ipacacategory ipaPermTargetFilter: (objectclass=ipacaacl) ipaPermTargetFilter: (objectclass=ipacaacl) ipaPermDefaultAttr: ipacacategory root@migration-ipa-65-214:~/new_ca# ldapsearch -Y GSSAPI -QLLL -b dc=yydevops,dc=com '(objectclass=ipacaacl)' 1.1 dn: ipaUniqueID=05c04bac-fc16-11ec-a218-246e967383f8,cn=caacls,cn=ca,dc=yydevo ps,dc=com Can I delete this entry? ldapdelete -Y GSSAPI -Q ipaUniqueID=05c04bac-fc16-11ec-a218-246e967383f8,cn=caacls,cn=ca,dc=yydevo If not, how do I delete sub-ca entries? request guidance, thank you very much

3 4

Assign workstation to user
by Joyce Babu 06 Jul '22

06 Jul '22

Currently I am creating a new HBAC rule for each user to grant login access to their work station. Is there an easier method to do this by adding their workstation hostname to a custom attribute?

2 1

SSSD Problem after update
by Ronald Wimmer 05 Jul '22

05 Jul '22

Today I updated all packages on one of our IPA servers. Unfortunately, SSSD stopped working: [sssd] [main] (0x0010): SSSD couldn't load the configuration database. [sssd] [ldb] (0x0020): Unable to open tdb '/var/lib/sss/db/config.ldb': Permission denied [sssd] [ldb] (0x0020): Failed to connect to '/var/lib/sss/db/config.ldb' with backend 'tdb': Unable to open tdb '/var/lib/sss/db/config.ldb': Permission denied [sssd] [confdb_init] (0x0010): Unable to open config database [/var/lib/sss/db/config.ldb] [sssd] [confdb_setup] (0x0010): The confdb initialization failed [5]: Input/output error [sssd] [load_configuration] (0x0010): Unable to setup ConfDB [5]: Input/output error I noticed that owner and group of config.ldb are changed to sssd when I try to restart the sssd.service. On all remaining IPA servers this particular file belongs to root. I will revert to the snapshot I made before updating packages in order to make that IPA server work again properly. Cheers, Ronald

2 6

SSL Library Error: -12269 The server has rejected your certificate as expired
by roy liang 05 Jul '22

05 Jul '22

I deliberately set the server back 2 years, installed Freeipa-Server, and then synchronized the time back.The related service certificate expires.Verify this:https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux… But it didn't work out. I confirm my modification: 1:less /etc/apache2/mods-enabled/nss.conf #add NSSEnforceValidCerts off 2:root@ipa-test-65-198:/home/liangrui# ldapsearch -h $(hostname) -p 389 -D "cn=directory manager" -w directorypassxx -LLL -b cn=config -s base "(objectclass=*)" nsslapd-validate-cert dn: cn=config nsslapd-validate-cert: warn You have restarted all services and rebooted the server.However, the result is still unable to use the relevant command root@ipa-test-65-198:/home# ipa user-find ipa: ERROR: cert validation failed for "CN=ipa-test-65-198.hiido.host.yydevops.com,O=YYDEVOPS.COM" ((SEC_ERROR_EXPIRED_CERTIFICATE) Peer's Certificate has expired.) ipa: ERROR: cannot connect to 'https://ipa-test-65-198.hiido.host.yydevops.com/ipa/json': (SEC_ERROR_EXPIRED_CERTIFICATE) Peer's Certificate has expired. What is the reason for this? Do I need to view or configure anything?For guidance, thank you My system is ubuntu16.04 and freeipa 4.3 /var/log/apache2/error [Mon Jul 04 17:40:18.464189 2022] [:error] [pid 2942:tid 140680101848832] SSL Library Error: -12269 The server has rejected your certificate as expired less /var/log/dirsrv/slapd-YYDEVOPS-COM/errors [04/Jul/2022:17:23:07 +0800] - SSL alert: CERT_VerifyCertificateNow: verify certificate failed for cert Server-Cert of family cn=RSA,cn=encryption,cn=config (Netscape Portable Runtime error -8181 - Peer's Certificate has expired.) [04/Jul/2022:17:23:07 +0800] SSL Initialization - Configured SSL version range: min: TLS1.0, max: TLS1.2 [04/Jul/2022:17:23:07 +0800] - 389-Directory/1.3.4.9 B2016.109.158 starting up [04/Jul/2022:17:23:07 +0800] schema-compat-plugin - scheduled schema-compat-plugin tree scan in about 5 seconds after the server startup! [04/Jul/2022:17:23:07 +0800] NSACLPlugin - The ACL target cn=groups,cn=compat,dc=yydevops,dc=com does not exist [04/Jul/2022:17:23:07 +0800] NSACLPlugin - The ACL target cn=computers,cn=compat,dc=yydevops,dc=com does not exist [04/Jul/2022:17:23:08 +0800] NSACLPlugin - The ACL target cn=ng,cn=compat,dc=yydevops,dc=com does not exist [04/Jul/2022:17:23:08 +0800] NSACLPlugin - The ACL target ou=sudoers,dc=yydevops,dc=com does not exist [04/Jul/2022:17:23:08 +0800] NSACLPlugin - The ACL target cn=users,cn=compat,dc=yydevops,dc=com does not exist [04/Jul/2022:17:23:08 +0800] NSACLPlugin - The ACL target cn=vaults,cn=kra,dc=yydevops,dc=com does not exist [04/Jul/2022:17:23:08 +0800] NSACLPlugin - The ACL target cn=vaults,cn=kra,dc=yydevops,dc=com does not exist [04/Jul/2022:17:23:08 +0800] NSACLPlugin - The ACL target cn=vaults,cn=kra,dc=yydevops,dc=com does not exist [04/Jul/2022:17:23:08 +0800] NSACLPlugin - The ACL target cn=vaults,cn=kra,dc=yydevops,dc=com does not exist [04/Jul/2022:17:23:08 +0800] NSACLPlugin - The ACL target cn=vaults,cn=kra,dc=yydevops,dc=com does not exist [04/Jul/2022:17:23:08 +0800] NSACLPlugin - The ACL target cn=vaults,cn=kra,dc=yydevops,dc=com does not exist [04/Jul/2022:17:23:08 +0800] NSACLPlugin - The ACL target cn=vaults,cn=kra,dc=yydevops,dc=com does not exist [04/Jul/2022:17:23:08 +0800] NSACLPlugin - The ACL target cn=vaults,cn=kra,dc=yydevops,dc=com does not exist [04/Jul/2022:17:23:08 +0800] NSACLPlugin - The ACL target cn=vaults,cn=kra,dc=yydevops,dc=com does not exist [04/Jul/2022:17:23:08 +0800] NSACLPlugin - The ACL target cn=vaults,cn=kra,dc=yydevops,dc=com does not exist [04/Jul/2022:17:23:08 +0800] NSACLPlugin - The ACL target cn=vaults,cn=kra,dc=yydevops,dc=com does not exist [04/Jul/2022:17:23:08 +0800] NSACLPlugin - The ACL target cn=ad,cn=etc,dc=yydevops,dc=com does not exist [04/Jul/2022:17:23:08 +0800] NSACLPlugin - The ACL target cn=casigningcert cert-pki-ca,cn=ca_renewal,cn=ipa,cn=etc,dc=yydevops,dc=com does not exist [04/Jul/2022:17:23:08 +0800] NSACLPlugin - The ACL target cn=casigningcert cert-pki-ca,cn=ca_renewal,cn=ipa,cn=etc,dc=yydevops,dc=com does not exist [04/Jul/2022:17:23:08 +0800] NSACLPlugin - The ACL target cn=automember rebuild membership,cn=tasks,cn=config does not exist [04/Jul/2022:17:23:08 +0800] - Skipping CoS Definition cn=Password Policy,cn=accounts,dc=yydevops,dc=com--no CoS Templates found, which should be added before the CoS Definition. [04/Jul/2022:17:23:08 +0800] schema-compat-plugin - schema-compat-plugin tree scan will start in about 5 seconds! [04/Jul/2022:17:23:08 +0800] - slapd started. Listening on All Interfaces port 389 for LDAP requests [04/Jul/2022:17:23:08 +0800] - Listening on All Interfaces port 636 for LDAPS requests [04/Jul/2022:17:23:08 +0800] - Listening on /var/run/slapd-YYDEVOPS-COM.socket for LDAPI requests [04/Jul/2022:17:23:12 +0800] schema-compat-plugin - warning: no entries set up under ou=sudoers,dc=yydevops,dc=com [04/Jul/2022:17:23:13 +0800] schema-compat-plugin - warning: no entries set up under cn=ng, cn=compat,dc=yydevops,dc=com [04/Jul/2022:17:23:13 +0800] schema-compat-plugin - warning: no entries set up under cn=computers, cn=compat,dc=yydevops,dc=com [04/Jul/2022:17:23:13 +0800] schema-compat-plugin - Finished plugin initialization

2 4

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users July 2022