September 2022 - FreeIPA-users - Fedora mailing-lists

Changing the IP address of IPA Replica Server
by MANIDEEP SAI 16 Sep '22

16 Sep '22

Hi Team, Changing the IP Address of IPA Replica server I have an IPA Replica Server and 10 hosts integrated to it If i change the IP address of the Replica server what will be the impact from Central IPA Server and towards on IPA client hosts What are the steps that i need to follow to change the IP

2 1

Replication topology size limitations?
by Matthew Davis 16 Sep '22

16 Sep '22

Greeting, I am planing a new IPA installation with potentially a large number of replica servers. According to the documentation [1]: > Set up at least two replicas in each data center (not a hard requirement) > A data center can be, for example, a main office or a geographical > location. > Set up a sufficient number of servers to serve your clients > One Identity Management (IdM) server can provide services to 2000 > - 3000 clients. This assumes the clients query the servers > multiple times a day, but not, for example, every minute. If you > expect more frequent queries, plan for more servers. > Set up a sufficient number of Certificate Authority (CA) replicas > Only replicas with the CA role installed can replicate certificate > data. If you use the IdM CA, ensure your environment has at least > two CA replicas with certificate replication agreements between them. > Set up a maximum of 60 replicas in a single IdM domain > Red Hat supports environments with up to 60 replicas. > I have over 60 geographical locations I was hoping to place a replica. I will easily exceed the 60 replica limitation outlined in the documentation. Can any elaborate on the 60 replica limitation? Is this a hard limit? What are the contributing factors for the existing limitation? Each location will have far less than 2000 clients. Are there any considerations that could accommodate a larger number of replica servers? Thanks -- ------------------------------------------------------------------------ */Matthew Davis /*1 https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/ht…

2 1

more rpm conflicts on CentOS
by lejeczek 14 Sep '22

14 Sep '22

Hi guys. I this Samba end of packages having issues (again) ? -> $ dnf update Last metadata expiration check: 0:08:36 ago on Mon 08 Aug 2022 08:14:21 BST. Error: Problem 1: package ipa-server-trust-ad-4.9.8-7.module_el8.6.0+1103+a004f6a8.x86_64 requires libsmbconf.so.0(SMBCONF_0)(64bit), but none of the providers can be installed - cannot install both samba-client-libs-4.16.4-1.el8.x86_64 and samba-client-libs-4.16.2-1.el8.x86_64 - cannot install both samba-client-libs-4.16.4-1.el8.x86_64 and samba-client-libs-4.13.3-3.el8.x86_64 - cannot install both samba-client-libs-4.16.4-1.el8.x86_64 and samba-client-libs-4.14.4-4.el8.x86_64 - cannot install both samba-client-libs-4.16.4-1.el8.x86_64 and samba-client-libs-4.14.5-0.el8.x86_64 - cannot install both samba-client-libs-4.16.4-1.el8.x86_64 and samba-client-libs-4.14.5-2.el8.x86_64 - cannot install both samba-client-libs-4.16.4-1.el8.x86_64 and samba-client-libs-4.15.3-0.el8.x86_64 - cannot install both samba-client-libs-4.16.4-1.el8.x86_64 and samba-client-libs-4.15.4-0.el8.x86_64 - cannot install both samba-client-libs-4.16.4-1.el8.x86_64 and samba-client-libs-4.15.5-0.el8.x86_64 - cannot install both samba-client-libs-4.16.4-1.el8.x86_64 and samba-client-libs-4.15.5-3.el8.x86_64 - cannot install both samba-client-libs-4.16.4-1.el8.x86_64 and samba-client-libs-4.15.5-4.el8.x86_64 - cannot install both samba-client-libs-4.16.4-1.el8.x86_64 and samba-client-libs-4.15.5-5.el8.x86_64 - cannot install both samba-client-libs-4.16.4-1.el8.x86_64 and samba-client-libs-4.15.5-8.el8.x86_64 - cannot install both samba-client-libs-4.16.4-1.el8.x86_64 and samba-client-libs-4.16.1-0.el8.x86_64 - cannot install the best update candidate for package samba-client-libs-4.16.2-1.el8.x86_64 - cannot install the best update candidate for package ipa-server-trust-ad-4.9.8-7.module_el8.6.0+1103+a004f6a8.x86_64 Problem 2: problem with installed package ipa-server-trust-ad-4.9.8-7.module_el8.6.0+1103+a004f6a8.x86_64 - package ipa-server-trust-ad-4.9.8-7.module_el8.6.0+1103+a004f6a8.x86_64 requires libsmbconf.so.0(SMBCONF_0)(64bit), but none of the providers can be installed - cannot install both samba-client-libs-4.16.4-1.el8.x86_64 and samba-client-libs-4.16.2-1.el8.x86_64 - cannot install both samba-client-libs-4.16.4-1.el8.x86_64 and samba-client-libs-4.13.3-3.el8.x86_64 - cannot install both samba-client-libs-4.16.4-1.el8.x86_64 and samba-client-libs-4.14.4-4.el8.x86_64 - cannot install both samba-client-libs-4.16.4-1.el8.x86_64 and samba-client-libs-4.14.5-0.el8.x86_64 - cannot install both samba-client-libs-4.16.4-1.el8.x86_64 and samba-client-libs-4.14.5-2.el8.x86_64 - cannot install both samba-client-libs-4.16.4-1.el8.x86_64 and samba-client-libs-4.15.3-0.el8.x86_64 - cannot install both samba-client-libs-4.16.4-1.el8.x86_64 and samba-client-libs-4.15.4-0.el8.x86_64 - cannot install both samba-client-libs-4.16.4-1.el8.x86_64 and samba-client-libs-4.15.5-0.el8.x86_64 - cannot install both samba-client-libs-4.16.4-1.el8.x86_64 and samba-client-libs-4.15.5-3.el8.x86_64 - cannot install both samba-client-libs-4.16.4-1.el8.x86_64 and samba-client-libs-4.15.5-4.el8.x86_64 - cannot install both samba-client-libs-4.16.4-1.el8.x86_64 and samba-client-libs-4.15.5-5.el8.x86_64 - cannot install both samba-client-libs-4.16.4-1.el8.x86_64 and samba-client-libs-4.15.5-8.el8.x86_64 - cannot install both samba-client-libs-4.16.4-1.el8.x86_64 and samba-client-libs-4.16.1-0.el8.x86_64 - package libsmbclient-4.16.4-1.el8.x86_64 requires libsamba-debug-samba4.so(SAMBA_4.16.4_SAMBA4)(64bit), but none of the providers can be installed - package libsmbclient-4.16.4-1.el8.x86_64 requires libsmbconf.so.0(SMBCONF_0.0.1)(64bit), but none of the providers can be installed and also, I wonder why would a "regular" package want to depend in a debug package - that should not be needed normally. many thanks, L.

2 4

ipa-client-automount troubles
by Sami Hulkko 12 Sep '22

12 Sep '22

Hi, I lately have tried to get the autofs working with bit of trouble. I have a following setup: ipa-autofs: default - auto.master - <mount point at client> auto.home - auto.home -* <path on server>/& nfs-server: <path to share> gss/krb5i(rw,sync,no_subtree_check,no_root_squash) ipa: service nfs/<server fqdn> service nfs/<client fqdn> and copied to server/client all services running and if I (root): ls /<mountpoint of homes>/<user home folder> it should mount but instead I get: SSSD: Sep 04 09:25:11 <host> krb5_child[41263]: Preauthentication failed AUTOFS: >> mount.nfs: access denied by server while mounting <path> On /var/log/sssd/krb5_child.log i get this: * (2022-09-04 9:25:23): [krb5_child[41266]] [become_user] (0x0200): [RID#28] Trying to become user [925800000][925800000]. This is admin user at IPA. Not the user who's home folder we tried to 'ls' * (2022-09-04 9:25:23): [krb5_child[41266]] [main] (0x2000): [RID#28] Running as [925800000][925800000]. * (2022-09-04 9:25:23): [krb5_child[41266]] [set_lifetime_options] (0x0100): [RID#28] No specific renewable lifetime requested. * (2022-09-04 9:25:23): [krb5_child[41266]] [set_lifetime_options] (0x0100): [RID#28] No specific lifetime requested. * (2022-09-04 9:25:23): [krb5_child[41266]] [set_canonicalize_option] (0x0100): [RID#28] Canonicalization is set to [true] * (2022-09-04 9:25:23): [krb5_child[41266]] [main] (0x0400): [RID#28] Will perform auth * (2022-09-04 9:25:23): [krb5_child[41266]] [main] (0x0400): [RID#28] Will perform online auth * (2022-09-04 9:25:23): [krb5_child[41266]] [tgt_req_child] (0x1000): [RID#28] Attempting to get a TGT * (2022-09-04 9:25:23): [krb5_child[41266]] [get_and_save_tgt] (0x0400): [RID#28] Attempting kinit for realm [<REALM>] * (2022-09-04 9:25:23): [krb5_child[41266]] [sss_krb5_responder] (0x4000): [RID#28] Got question [password]. Is asking admin password for kerberos5 ticket and fails. * (2022-09-04 9:25:23): [krb5_child[41266]] [get_and_save_tgt] (0x0020): [RID#28] 1725: [-1765328360][Preauthentication failed] How would one go about this? -- Me worry? That's why my first CD was Peter Gabriel SO.... Sami Hulkko sahulkko(a)gmail.com sahulkko(a)icloud.com samihulkko(a)quantum-black-hole.com +358 45 85693 919

2 4

ipa_enable_dns_sites doesn't appear to be working
by Ranbir 12 Sep '22

12 Sep '22

Hello Everyone, I've configured IPA Locations for all our sites and added site specific IPA servers to each one. I've also configured the first few IPA clients to use only the IPA DNS servers that are in the same location as the IPA clients. These are the three pertinant options set on the IPA clients (I left out the rest): [domain/idm.tld.com] dns_discovery_domain = idm.tld.com ipa_server = _srv_, ala-p1idma02.idm.tld.com ipa_enable_dns_sites = True The issue is that when I check which IPA server the IPA client in "ala" is connected to, it's invariably talking to one that's far away: ~$ ss -t -r state established | grep ldap 0 0 ala-ntp.tld.com:42456 ism-p1idma01.idm.tld.com:ldap If I restart sssd on the client or on the IPA server it's communicating with, the client switches to an IPA server that is in its location. However, after some time, the client once again returns to the old, far away IPA server. I've run DNS queries to confirm that location based records are being returned properly: ~$ dig -t SRV +short _ldap._tcp.idm.tld.com | sort -k 4,4n 0 100 389 ala-p1idma01.idm.tld.com. 0 100 389 ala-p1idma02.idm.tld.com. 0 100 389 ala-p1idma03.idm.tld.com. 0 100 389 ala-p1idmc01.idm.tld.com. 50 100 389 arn-p1idma01.idm.tld.com. 50 100 389 arn-p1idma02.idm.tld.com. 50 100 389 ctu-p1idma01.idm.tld.com. 50 100 389 ctu-p1idma02.idm.tld.com. 50 100 389 ism-p1idma01.idm.tld.com. 50 100 389 ism-p1idma02.idm.tld.com. 50 100 389 otp-p1idma01.idm.tld.com. 50 100 389 otp-p1idma02.idm.tld.com. 50 100 389 pek-p1idma01.idm.tld.com. 50 100 389 pek-p1idma02.idm.tld.com. 50 100 389 san-p1idma01.idm.tld.com. 50 100 389 san-p1idma02.idm.tld.com. 50 100 389 sel-p1idma01.idm.tld.com. 50 100 389 sel-p1idma02.idm.tld.com. 50 100 389 sjo-p1idma01.idm.tld.com. 50 100 389 sjo-p1idma02.idm.tld.com. 50 100 389 tok-p1idma01.idm.tld.com. 50 100 389 tok-p1idma02.idm.tld.com. 50 100 389 yow-p1idma01.idm.tld.com. 50 100 389 yow-p1idma02.idm.tld.com. 50 100 389 yow-p1idma03.idm.tld.com. 50 100 389 yow-p1idmc01.idm.tld.com. _ldap._tcp.ala._locations.idm.tld.com. Note: some clients are not in the same dns domain as the ipa domain. That's why the config snippet above had the "dns_discovery_domain" set. What I am I doing incorrectly? Why won't the IPA client machine "stay" in its location? -- Ranbir

1 0

How to decide if a sssd.conf parameter is better suited on a master or a client?
by Ranbir 10 Sep '22

10 Sep '22

Hi Everyone, I've been tweaking sssd.conf configs on the masters and clients in my AlmaLinux 9 IdM domain (it's in a trust with AD, too). Sometimes it's easy to tell when a particular option belongs on the master or on the client or on both. Most of the time though, I don't know for sure when to put a parameter in the masters' sssd.conf instead of in the client's. The man page for sssd.conf doesn't usually make it clear either. For example, I'm playing around with the cache timeouts. I've done the tweaks on the client side since the cache is local to the client. Thus, I figured setting the timeouts on the client is appropriate. However, I still wonder: if the same settings were on the masters instead, wouldn't the masters then return results much faster to the client? Here's what one Ubuntu 20's sssd.conf looks like right now: [domain/idm.tld.com] id_provider = ipa dns_discovery_domain = idm.tld.com ipa_server = _srv_, p1idma01.idm.tld.com ipa_domain = idm.tld.com ipa_hostname = gitlab.tld.com auth_provider = ipa chpass_provider = ipa access_provider = ipa cache_credentials = True ldap_tls_cacert = /etc/ipa/ca.crt krb5_store_password_if_offline = True pwd_expiration_warning = 14 selinux_provider = none lookup_family_order = ipv4_only sudo_provider = ipa autofs_provider = ipa subdomains_provider = ipa session_provider = ipa hostid_provider = ipa ipa_automount_location = ala [domain/idm.tld.com/corp.ad.tld.com] ad_site = ala [domain/corp.ad.tld.com] entry_cache_timeout = 43200 entry_cache_service_timeout = 5400 entry_cache_computer_timeout = 5400 lookup_family_order = ipv4_only [sssd] domains = idm.tld.com default_domain_suffix = corp.ad.tld.com [nss] cache_first = True default_shell = /bin/bash enum_cache_timeout = 3600 entry_negative_timeout = 360 memcache_timeout = 3600 [pam] cache_first = True [sudo] cache_first = True [autofs] cache_first = True autofs_negative_timeout = 3600 [ssh] [pac] cache_first = True pac_lifetime = 3600 [ifp] [secrets] [session_recording] How do we find out when the parameters should be set on the master instead of the client? Is the determining factor to decide if we want a "domain wide" setting instead of per client? If so, how do I know which paramter is better suited to be set "domain wide"? I'm sorry if this is obvious to others. But, it's never been 100% clear to me (except in some cases). -- Ranbir

3 3

Need 'dns notify' sequence clarification please!
by Harry G Coin 09 Sep '22

09 Sep '22

In a 'standard' freeipa setup with two freeipa masters that provide authoritative DNS for a zone (in this instance using the named-pkcs11 bind version) and no other DNS slaves: When an IP address is changed in freeipa DNS for a host: Question 1: Does the 'notify' feature of bind9/named from one machine to the other accomplish any actual value (TTL related or otherwise) given they both rely on bind-dyndbldap and as such the dns change is migrated via ldap? In other words, would any performance suffer if I just turned off notifies among the freeipa masters? Question 2: What is the sequence of operations when an IP address is changed in freeipa? I expect it would be the first ldap db gets updated, then the replicas ldap dbs get updated, then after all ldaps are updated each of them tells 'their respective' bind instances to update. Yes? No? Thanks! Harry Coin

2 1

web ui issue after restore
by askstack＠yahoo.com 07 Sep '22

07 Sep '22

I am testing my restore procedure by restore the production data onto an isolated VM with the same IP and hostname. Ipa-restore was successful. Ipactl status shows all services are running. Kinit , dns and ldapsearch are working. Web UI would let me log in but encountered unknown errors. [Tue Sep 06 15:38:25.383729 2022] [:error] [pid 25141] SSL Library Error: -12195 Peer does not recognize and trust the CA that issued your certificate [Tue Sep 06 15:38:25.490606 2022] [:error] [pid 28173] SSL Library Error: -12195 Peer does not recognize and trust the CA that issued your certificate [Tue Sep 06 15:38:41.202257 2022] [:error] [pid 25139] ipa: DEBUG: WSGI wsgi_dispatch.__call__: [Tue Sep 06 15:38:41.202793 2022] [:error] [pid 25139] ipa: DEBUG: WSGI login_password.__call__: [Tue Sep 06 15:38:41.205805 2022] [:error] [pid 25139] ipa: DEBUG: Obtaining armor in ccache /var/run/ipa/ccaches/armor_25139 [Tue Sep 06 15:38:41.206144 2022] [:error] [pid 25139] ipa: DEBUG: Initializing anonymous ccache [Tue Sep 06 15:38:41.206850 2022] [:error] [pid 25139] ipa: DEBUG: Starting external process [Tue Sep 06 15:38:41.206979 2022] [:error] [pid 25139] ipa: DEBUG: args=/usr/bin/kinit -n -c /var/run/ipa/ccaches/armor_25139 -X X509_anchors=FILE:/var/kerberos/krb5kdc/kdc.crt -X X509_anchors=FILE:/var/lib/ipa-client/pki/kdc-ca-bundle.pem [Tue Sep 06 15:38:41.364653 2022] [:error] [pid 25139] ipa: DEBUG: Process finished, return code=0 [Tue Sep 06 15:38:41.364952 2022] [:error] [pid 25139] ipa: DEBUG: stdout= [Tue Sep 06 15:38:41.365047 2022] [:error] [pid 25139] ipa: DEBUG: stderr= [Tue Sep 06 15:38:41.365828 2022] [:error] [pid 25139] ipa: DEBUG: Initializing principal user1 using password [Tue Sep 06 15:38:41.365934 2022] [:error] [pid 25139] ipa: DEBUG: Using armor ccache /var/run/ipa/ccaches/armor_25139 for FAST webauth [Tue Sep 06 15:38:41.366004 2022] [:error] [pid 25139] ipa: DEBUG: Using enterprise principal [Tue Sep 06 15:38:41.366194 2022] [:error] [pid 25139] ipa: DEBUG: Starting external process [Tue Sep 06 15:38:41.366262 2022] [:error] [pid 25139] ipa: DEBUG: args=/usr/bin/kinit user1 -c /var/run/ipa/ccaches/kinit_25139 -T /var/run/ipa/ccaches/armor_25139 -E [Tue Sep 06 15:38:41.466465 2022] [:error] [pid 25139] ipa: DEBUG: Process finished, return code=0 [Tue Sep 06 15:38:41.466659 2022] [:error] [pid 25139] ipa: DEBUG: stdout=Password for user1(a)DOMAIN.NET: [Tue Sep 06 15:38:41.466672 2022] [:error] [pid 25139] [Tue Sep 06 15:38:41.466750 2022] [:error] [pid 25139] ipa: DEBUG: stderr= [Tue Sep 06 15:38:41.467047 2022] [:error] [pid 25139] ipa: DEBUG: Cleanup the armor ccache [Tue Sep 06 15:38:41.467372 2022] [:error] [pid 25139] ipa: DEBUG: Starting external process [Tue Sep 06 15:38:41.467506 2022] [:error] [pid 25139] ipa: DEBUG: args=/usr/bin/kdestroy -A -c /var/run/ipa/ccaches/armor_25139 [Tue Sep 06 15:38:41.496559 2022] [:error] [pid 25139] ipa: DEBUG: Process finished, return code=0 [Tue Sep 06 15:38:41.496713 2022] [:error] [pid 25139] ipa: DEBUG: stdout= [Tue Sep 06 15:38:41.496818 2022] [:error] [pid 25139] ipa: DEBUG: stderr= [Tue Sep 06 15:38:41.547374 2022] [:error] [pid 25139] ipa: INFO: Starting new HTTP connection (1): itw-idm-1.domain.net [Tue Sep 06 15:38:41.551593 2022] [:error] [pid 25139] ipa: DEBUG: "GET /ipa/session/cookie HTTP/1.1" 301 258 [Tue Sep 06 15:38:41.556402 2022] [:error] [pid 25139] ipa: INFO: Starting new HTTPS connection (1): itw-idm-1.domain.net [Tue Sep 06 15:38:41.593584 2022] [:error] [pid 25139] ipa: DEBUG: "GET /ipa/session/cookie HTTP/1.1" 200 0 [Tue Sep 06 15:38:41.621035 2022] [:error] [pid 25138] ipa: DEBUG: WSGI wsgi_dispatch.__call__: [Tue Sep 06 15:38:41.621308 2022] [:error] [pid 25138] ipa: DEBUG: WSGI jsonserver_session.__call__: [Tue Sep 06 15:38:41.672362 2022] [:error] [pid 25138] ipa: DEBUG: Created connection context.ldap2_140687411018832 [Tue Sep 06 15:38:41.672486 2022] [:error] [pid 25138] ipa: DEBUG: WSGI jsonserver.__call__: [Tue Sep 06 15:38:41.672579 2022] [:error] [pid 25138] ipa: DEBUG: WSGI WSGIExecutioner.__call__: [Tue Sep 06 15:38:41.675901 2022] [:error] [pid 25138] ipa: DEBUG: raw: batch(i18n_messages(), config_show(), whoami(), env(None), dns_is_enabled(), trustconfig_show(), domainlevel_get(), ca_is_enabled(), vaultconfig_show()) [Tue Sep 06 15:38:41.676739 2022] [:error] [pid 25138] ipa: DEBUG: batch(i18n_messages(), config_show(), whoami(), env(None), dns_is_enabled(), trustconfig_show(), domainlevel_get(), ca_is_enabled(), vaultconfig_show()) [Tue Sep 06 15:38:41.677117 2022] [:error] [pid 25138] ipa: DEBUG: raw: i18n_messages(version=u'2.237') [Tue Sep 06 15:38:41.677293 2022] [:error] [pid 25138] ipa: DEBUG: i18n_messages(version=u'2.237') [Tue Sep 06 15:38:41.688523 2022] [:error] [pid 25138] ipa: INFO: user1(a)DOMAIN.NET: batch: i18n_messages(): SUCCESS [Tue Sep 06 15:38:41.688782 2022] [:error] [pid 25138] ipa: DEBUG: raw: config_show(version=u'2.237') [Tue Sep 06 15:38:41.689075 2022] [:error] [pid 25138] ipa: DEBUG: config_show(rights=False, all=False, raw=False, version=u'2.237') [Tue Sep 06 15:38:41.695013 2022] [:error] [pid 25138] ipa: DEBUG: retrieving schema for SchemaCache url=ldapi://%2fvar%2frun%2fslapd-ITW-DOMAIN-NET.socket conn=<ldap.ldapobject.SimpleLDAPObject instance at 0x7ff456914248> [Tue Sep 06 15:38:42.054113 2022] [:error] [pid 25138] ipa: INFO: user1(a)DOMAIN.NET: batch: config_show(): ValueError [Tue Sep 06 15:38:42.054821 2022] [:error] [pid 25138] ipa: DEBUG: raw: whoami(version=u'2.237') [Tue Sep 06 15:38:42.055022 2022] [:error] [pid 25138] ipa: DEBUG: whoami(version=u'2.237') [Tue Sep 06 15:38:42.056385 2022] [:error] [pid 25138] ipa: INFO: user1(a)DOMAIN.NET: batch: whoami(): ValueError [Tue Sep 06 15:38:42.056674 2022] [:error] [pid 25138] ipa: DEBUG: raw: env(None, version=u'2.237') [Tue Sep 06 15:38:42.056923 2022] [:error] [pid 25138] ipa: DEBUG: env(None, server=False, all=True, version=u'2.237') [Tue Sep 06 15:38:42.057678 2022] [:error] [pid 25138] ipa: INFO: user1(a)DOMAIN.NET: batch: env(None): SUCCESS [Tue Sep 06 15:38:42.057941 2022] [:error] [pid 25138] ipa: DEBUG: raw: dns_is_enabled(version=u'2.237') [Tue Sep 06 15:38:42.058105 2022] [:error] [pid 25138] ipa: DEBUG: dns_is_enabled(version=u'2.237') [Tue Sep 06 15:38:42.059050 2022] [:error] [pid 25138] ipa: INFO: user1(a)DOMAIN.NET: batch: dns_is_enabled(): ValueError [Tue Sep 06 15:38:42.059329 2022] [:error] [pid 25138] ipa: DEBUG: raw: trustconfig_show(version=u'2.237') [Tue Sep 06 15:38:42.059608 2022] [:error] [pid 25138] ipa: DEBUG: trustconfig_show(rights=False, trust_type=u'ad', all=False, raw=False, version=u'2.237') [Tue Sep 06 15:38:42.060185 2022] [:error] [pid 25138] ipa: INFO: user1(a)DOMAIN.NET: batch: trustconfig_show(): ValueError [Tue Sep 06 15:38:42.060504 2022] [:error] [pid 25138] ipa: DEBUG: raw: domainlevel_get(version=u'2.237') [Tue Sep 06 15:38:42.060679 2022] [:error] [pid 25138] ipa: DEBUG: domainlevel_get(version=u'2.237') [Tue Sep 06 15:38:42.061078 2022] [:error] [pid 25138] ipa: INFO: user1(a)DOMAIN.NET: batch: domainlevel_get(): ValueError [Tue Sep 06 15:38:42.061301 2022] [:error] [pid 25138] ipa: DEBUG: raw: ca_is_enabled(version=u'2.237') [Tue Sep 06 15:38:42.061464 2022] [:error] [pid 25138] ipa: DEBUG: ca_is_enabled(version=u'2.237') [Tue Sep 06 15:38:42.061893 2022] [:error] [pid 25138] ipa: INFO: user1(a)DOMAIN.NET: batch: ca_is_enabled(): ValueError [Tue Sep 06 15:38:42.062105 2022] [:error] [pid 25138] ipa: DEBUG: raw: vaultconfig_show(version=u'2.237') [Tue Sep 06 15:38:42.062273 2022] [:error] [pid 25138] ipa: DEBUG: vaultconfig_show(all=False, raw=False, version=u'2.237') [Tue Sep 06 15:38:42.062813 2022] [:error] [pid 25138] ipa: DEBUG: raw: kra_is_enabled(version=u'2.237') [Tue Sep 06 15:38:42.062991 2022] [:error] [pid 25138] ipa: DEBUG: kra_is_enabled(version=u'2.237') [Tue Sep 06 15:38:42.063332 2022] [:error] [pid 25138] ipa: INFO: user1(a)DOMAIN.NET: batch: vaultconfig_show(): ValueError [Tue Sep 06 15:38:42.064095 2022] [:error] [pid 25138] ipa: INFO: [jsonserver_session] user1(a)DOMAIN.NET: batch(i18n_messages(), config_show(), whoami(), env(None), dns_is_enabled(), trustconfig_show(), domainlevel_get(), ca_is_enabled(), vaultconfig_show()): SUCCESS [Tue Sep 06 15:38:42.072409 2022] [:error] [pid 25138] ipa: DEBUG: Destroyed connection context.ldap2_140687411018832 [Tue Sep 06 15:38:45.051789 2022] [:warn] [pid 25140] [client 10.64.112.25:60408] failed to set perms (3140) on file (/var/run/ipa/ccaches/user1(a)DOMAIN.NET) referer: https://itw-idm-1.domain.net/ipa/ui/ [Tue Sep 06 15:38:45.053009 2022] [:warn] [pid 28173] [client 10.64.112.25:60410] failed to set perms (3140) on file (/var/run/ipa/ccaches/user1(a)DOMAIN.NET) referer: https://itw-idm-1.domain.net/ipa/ui/ [Tue Sep 06 15:38:45.054271 2022] [:error] [pid 25139] ipa: DEBUG: WSGI wsgi_dispatch.__call__: [Tue Sep 06 15:38:45.054442 2022] [:error] [pid 25139] ipa: DEBUG: WSGI jsonserver_session.__call__: [Tue Sep 06 15:38:45.055890 2022] [:error] [pid 25138] ipa: DEBUG: WSGI wsgi_dispatch.__call__: [Tue Sep 06 15:38:45.055985 2022] [:error] [pid 25138] ipa: DEBUG: WSGI jsonserver_session.__call__: [Tue Sep 06 15:38:45.083430 2022] [:error] [pid 25138] ipa: DEBUG: Created connection context.ldap2_140687411018832 [Tue Sep 06 15:38:45.083524 2022] [:error] [pid 25138] ipa: DEBUG: WSGI jsonserver.__call__: [Tue Sep 06 15:38:45.083592 2022] [:error] [pid 25138] ipa: DEBUG: WSGI WSGIExecutioner.__call__: [Tue Sep 06 15:38:45.084235 2022] [:error] [pid 25138] ipa: DEBUG: raw: json_metadata(None, None, command=u'all', version=u'2.237') [Tue Sep 06 15:38:45.084482 2022] [:error] [pid 25138] ipa: DEBUG: json_metadata(None, None, command=u'all', version=u'2.237') [Tue Sep 06 15:38:45.122224 2022] [:error] [pid 25139] ipa: DEBUG: Created connection context.ldap2_140687411018832 [Tue Sep 06 15:38:45.122394 2022] [:error] [pid 25139] ipa: DEBUG: WSGI jsonserver.__call__: [Tue Sep 06 15:38:45.122500 2022] [:error] [pid 25139] ipa: DEBUG: WSGI WSGIExecutioner.__call__: [Tue Sep 06 15:38:45.123725 2022] [:error] [pid 25139] ipa: DEBUG: raw: json_metadata(None, None, object=u'all', version=u'2.237') [Tue Sep 06 15:38:45.124105 2022] [:error] [pid 25139] ipa: DEBUG: json_metadata(None, None, object=u'all', version=u'2.237') [Tue Sep 06 15:38:45.998711 2022] [:error] [pid 25139] ipa: INFO: [jsonserver_session] user1(a)DOMAIN.NET: json_metadata(None, None, object=u'all', version=u'2.237'): SUCCESS [Tue Sep 06 15:38:46.273104 2022] [:error] [pid 25139] ipa: DEBUG: Destroyed connection context.ldap2_140687411018832 [Tue Sep 06 15:38:47.391521 2022] [:error] [pid 25138] ipa: INFO: [jsonserver_session] user1(a)DOMAIN.NET: json_metadata(None, None, command=u'all', version=u'2.237'): SUCCESS [Tue Sep 06 15:38:48.092665 2022] [:error] [pid 25138] ipa: DEBUG: Destroyed connection context.ldap2_140687411018832 Many thanks.

1 0

How to check the number of read/write locks on /usr/sbin/ns-slapd process?
by Kathy Zhu 06 Sep '22

06 Sep '22

Hi Team, We used following to get the number of rwlocks for /usr/sbin/ns-slapd process in Centos 7.9 to catch deadlocks: PID=`pidof ns-slapd` gdb -ex 'set confirm off' -ex 'set pagination off' -ex 'thread apply all bt full' -ex 'quit' /usr/sbin/ns-slapd $PID |& grep '^#0.*lock' | grep pthread_rwlock | sort -u That helped us to detect ns-slapd hang caused by deadlocks. After migrating to Red Hat 8.6, we had a lot of hangs (dirsvr is running but not responding) and could not find why. We use the same above method, however, we are not able to catch anything. I wonder if there is a different way to count the rwlocks in Red Hat 8.6? We realize that there are multiple reasons to cause hangs, however, we would like to rule out the possibility of the deadlock. The OS and packages: Red Hat Enterprise Linux release 8.6 (Ootpa) ipa-server.x86_64 4.9.8-7.module+el8.6.0+14337+19b76db2 @rhel-8-for-x86_64-appstream-rpms slapi-nis-0.56.6-4.module+el8.6.0+12936+736896b2.x86_64 389-ds-base-libs-1.4.3.28-6.module+el8.6.0+14129+983ceada.x86_64 389-ds-base-1.4.3.28-6.module+el8.6.0+14129+983ceada.x86_64 Many thanks. Kathy.

3 3

yet another certificate renewal issue
by kifal75＠hotmail.com 05 Sep '22

05 Sep '22

Hi , This time I can't blame certmonger for not renewing my freeipa certs because they were not added to the tracking list. Now I have manually added them by following the KB article "https://access.redhat.com/articles/4062581". Once added i followed the following article to update it manually by following the KB article "https://access.redhat.com/solutions/3357261". Even performing all the steps where i had to reverse the system time and submitting the manual renewal request using "ipa-getcert resubmit -i [Request ID]" command, i have no luck renewing the following one. "auditSigningCert cert-pki-ca" "ocspSigningCert cert-pki-ca" "subsystemCert cert-pki-ca" "Server-Cert cert-pki-ca". Here is my getcert list command output: Number of certificates and requests being tracked: 8. Request ID '20220903192955': status: MONITORING ca-error: Unable to determine principal name for signing request. stuck: no key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert cert-pki-ca',token='NSS Certificate DB',pin set certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert cert-pki-ca',token='NSS Certificate DB' CA: IPA issuer: CN=Certificate Authority,O=XYZ.COM subject: CN=CA Audit,O=XYZ.COM expires: 2022-07-07 09:02:50 UTC key usage: digitalSignature,nonRepudiation pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "auditSigningCert cert-pki-ca" track: yes auto-renew: yes Request ID '20220903193147': status: MONITORING ca-error: Unable to determine principal name for signing request. stuck: no key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert cert-pki-ca',token='NSS Certificate DB',pin set certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert cert-pki-ca',token='NSS Certificate DB' CA: IPA issuer: CN=Certificate Authority,O=XYZ.COM subject: CN=OCSP Subsystem,O=XYZ.COM expires: 2022-07-07 09:01:40 UTC eku: id-kp-OCSPSigning pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "ocspSigningCert cert-pki-ca" track: yes auto-renew: yes Request ID '20220903193259': status: MONITORING ca-error: Unable to determine principal name for signing request. stuck: no key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert cert-pki-ca',token='NSS Certificate DB',pin set certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert cert-pki-ca',token='NSS Certificate DB' CA: IPA issuer: CN=Certificate Authority,O=XYZ.COM subject: CN=CA Subsystem,O=XYZ.COM expires: 2022-07-27 16:09:07 UTC key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment eku: id-kp-serverAuth,id-kp-clientAuth pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "subsystemCert cert-pki-ca" track: yes auto-renew: yes Request ID '20220903193355': status: MONITORING ca-error: Unable to determine principal name for signing request. stuck: no key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert cert-pki-ca',token='NSS Certificate DB',pin set certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert cert-pki-ca',token='NSS Certificate DB' CA: IPA issuer: CN=Certificate Authority,O=XYZ.COM subject: CN=hq-idm-lxd-01.xyz.com,O=XYZ.COM expires: 2022-07-27 16:08:27 UTC key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment eku: id-kp-serverAuth,id-kp-clientAuth pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "Server-Cert cert-pki-ca" track: yes auto-renew: yes Request ID '20220903193457': status: MONITORING stuck: no key pair storage: type=FILE,location='/var/kerberos/krb5kdc/kdc.key' certificate: type=FILE,location='/var/kerberos/krb5kdc/kdc.crt' CA: IPA issuer: CN=Certificate Authority,O=XYZ.COM subject: CN=hq-idm-lxd-01.xyz.com,O=XYZ.COM expires: 2024-07-06 13:07:27 UTC principal name: krbtgt/XYZ.COM(a)XYZ.COM key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment eku: id-kp-serverAuth,id-pkinit-KPKdc certificate template/profile: KDCs_PKINIT_Certs pre-save command: post-save command: /usr/libexec/ipa/certmonger/renew_kdc_cert track: yes auto-renew: yes Request ID '20220903193541': status: MONITORING ca-error: Unable to determine principal name for signing request. stuck: no key pair storage: type=FILE,location='/var/lib/ipa/ra-agent.key' certificate: type=FILE,location='/var/lib/ipa/ra-agent.pem' CA: IPA issuer: CN=Certificate Authority,O=XYZ.COM subject: CN=IPA RA,O=XYZ.COM expires: 2022-07-27 16:08:37 UTC key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment eku: id-kp-serverAuth,id-kp-clientAuth pre-save command: /usr/libexec/ipa/certmonger/renew_ra_cert_pre post-save command: /usr/libexec/ipa/certmonger/renew_ra_cert track: yes auto-renew: yes Request ID '20220903193608': status: MONITORING stuck: no key pair storage: type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS Certificate DB',pinfile='/etc/httpd/alias/pwdfile.txt' certificate: type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS Certificate DB' CA: IPA issuer: CN=Certificate Authority,O=XYZ.COM subject: CN=hq-idm-lxd-01.xyz.com,O=XYZ.COM expires: 2024-07-06 13:08:14 UTC principal name: HTTP/hq-idm-lxd-01.xyz.com(a)XYZ.COM key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment eku: id-kp-serverAuth,id-kp-clientAuth pre-save command: post-save command: /usr/libexec/ipa/certmonger/restart_httpd track: yes auto-renew: yes Request ID '20220903194017': status: MONITORING stuck: no key pair storage: type=NSSDB,location='/etc/dirsrv/slapd-XYZ.COM',nickname='Server-Cert',token='NSS Certificate DB',pinfile='/etc/dirsrv/slapd-XYZ.COM/pwdfile.txt' certificate: type=NSSDB,location='/etc/dirsrv/slapd-XYZ.COM',nickname='Server-Cert',token='NSS Certificate DB' CA: IPA issuer: CN=Certificate Authority,O=XYZ.COM subject: CN=hq-idm-lxd-01.xyz.com,O=XYZ.COM expires: 2024-07-06 13:08:32 UTC principal name: ldap/hq-idm-lxd-01.xyz.com(a)XYZ.COM key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment eku: id-kp-serverAuth,id-kp-clientAuth pre-save command: post-save command: /usr/libexec/ipa/certmonger/restart_dirsrv slapd-XYZ.COM track: yes auto-renew: yes Here is the output of the ipactl status command, all services run but pki-tomcatd Service: STOPPED [root@hq-idm-lxd-01 tmp]# ipactl status Directory Service: RUNNING krb5kdc Service: RUNNING kadmin Service: RUNNING named Service: RUNNING httpd Service: RUNNING ipa-custodia Service: RUNNING ntpd Service: RUNNING pki-tomcatd Service: STOPPED smb Service: RUNNING winbind Service: RUNNING ipa-otpd Service: RUNNING ipa-dnskeysyncd Service: RUNNING ipa: INFO: The ipactl command was successful The output of the log /var/log/pki/pki-tomcat/ca/debug Internal Database Error encountered: Could not connect to LDAP server host hq-idm-lxd-01.linuxdev.addev.ssa.gov port 636 Error netscape.ldap.LDAPException: Authentication failed (48) Finally [root@hq-idm-lxd-01 tmp]# ipa --version VERSION: 4.6.5, API_VERSION: 2.231 [root@hq-idm-lxd-01 tmp]# cat /etc/redhat-release CentOS Linux release 7.7.1908 (Core) Due to my limited knowledge of certs and IPA , i would like someone to help me mitigate this issue. I have exhausted all my resources but still no luck VR Z Sahibzada

2 4

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users September 2022