FreeIPA-users January 2023

freeipa-users@lists.fedorahosted.org

36 participants
57 discussions

Do keytabs expire?
by Ronald Wimmer 07 Jun '23

07 Jun '23

Hi, today I found out that some entries in a keytab file seemed to have expired: Request ticket server HTTP/mwc.linux.mydomain.at(a)LINUX.MYDOMAIN.AT kvno 4 not found in keytab; keytab is likely out of date Fetching the keytab again with ipa-getkeytab fixed the problem. But why is this happening? Do keytab entries expire? I have not set any custom password or ticket policies. Regards, Ronald

4 13

FreeIPA-Kubernetes Setup
by Ronald Wimmer 20 Mar '23

20 Mar '23

Hi, are there any plans (or maybe ongoing work already) to let FreeIPA run in a K8s environment? Cheers, Ronald

6 8

Ensure that IPA user can be resolved upon SystemD-Unit start
by Ronald Wimmer 17 Feb '23

17 Feb '23

I do have a sytemd service unit that uses an IPA used. However, upon reboot it seems that that particular IPA user is not available upon start of that particular systemd service. Using "After=sssd.service" is not sufficient. What would you recommend in this case? (I am looking for a reliable systemd solution and do not want to rely on a script checking for a particular user with getent for example) Cheers, Ronald

2 3

Force LDAPS and 636 port
by Alex Ivanov 09 Feb '23

09 Feb '23

Greetings, I'm struggling to find a comprehensive guide on how to block LDAP and 389 port on FreeIPA and force usage of LDAPS and 636 port for all clients and connections. I would really appreciate a link or a hint.

5 6

ipa-replica-install fails when I use custom certificates
by Peter Tselios 08 Feb '23

08 Feb '23

I have installed the ipa server by using the following command: --------- ipa-server-install --realm "EXAMPLE.COM" -p 'password' -a 'password' --hostname="server.example.com" -n example.com --ip-address="10.1.4.2" --dirsrv-cert-file=/etc/pki/tls/private/example.com.pem --dirsrv-cert-file=/etc/pki/tls/certs/example.com.crt --dirsrv-pin='' --http-cert-file=/etc/pki/tls/certs/example.com.crt --http-cert-file=/etc/pki/tls/private/example.com.pem --http-pin='' --ca-cert-file=/etc/pki/ca-trust/source/anchors/myca.pem --ca-cert-file=/etc/pki/ca-trust/source/anchors/mysubca.pem --mkhomedir -N --no-host-dns --unattended --------- Which works perfectly fine. However, I cannot make it work with ipa-replica-install since there is no option for --ca-cert-file. So, how can I install a replica with custom certificates?

6 12

Re-enrolling and keeping hostkeys
by Steve Brasier 01 Feb '23

01 Feb '23

Hi. I'm looking at using `ipa-client-install --keytab` to re-enrole a VM after reimaging. However this changes the host's ssh keys, which is undesirable in this case. Is there a "smart" way of preventing that? Or is this comment from 10 years ago the correct way to reset it: https://pagure.io/freeipa/issue/2655#comment-320195 thanks Steve

2 2

Re: Explanation on how Smartcard Authentication works with all it's componants.
by Rob Crittenden 31 Jan '23

31 Jan '23

r0nam1 wrote: > So far it's a lot of 'I thinks'. I think I've configured OpenSC and > pcscd correctly, I think I've configured SSSD correctly, and I think > I've configured PAM correctly, if you can give me a list of relevant > logs or test commands (Even full directory's of logs) I'll do what I can. Please keep responses on the list. The log to see depends on the behavior. Some additional readings (some are rather old but still relevant): https://floblanc.wordpress.com/?s=smart https://frasertweedale.github.io/blog-redhat/posts/2016-08-12-yubikey-sc-lo… rob

5 7

Converting self-signed root CA to intermediate CA
by Schrock, Chad - 0336 - MITLL 30 Jan '23

30 Jan '23

Hi everyone, We have a small-ish RHEL 7 IdM (4.6.8) domain that is currently running with a self-signed root CA. All is well and good, except we've been told that we have to play nice with the rest of the organization now, which includes changing the self-signed root CA in to an intermediate CA. I remember a discussion on here about converting an IdM root CA in to an intermediate CA, but for the life of me I can't find the discussion or any related documentation. (Was I hallucinating?) So: * Is what I'm talking about even possible? * If it is possible, is there some documentation somewhere where I can read up on the process and potential risks? * If it isn't possible, short of creating a new domain[1] and moving all of the clients to it, what might work here? [1] - I'm not against this, however, we have several replica IdM servers at remote sites that are on the other end of low-bandwidth high-latency satellite links. Having the various IdM servers talk amongst themselves for regular domain updates hasn't been a problem. We've never been able to create a new replica at our remote sites though. Thank you all for your time, Chad -- Chad Schrock, he/him Supporting MIT Lincoln Laboratory, Lexington, MA

2 2

FreeIPA external groups showing SID and not User Friendly name
by Ty zang 27 Jan '23

27 Jan '23

Hi all, I have a FreeIPA 4.6.8 with some Linux groups added. They are external groups that have external members (AD groups) via their trust with AD. So everything works, but clicking and viewing the external group under the web app shows the SID. Is there a package or something missing that would cause it to show SID instead of name of group, or is this a by design thing? I am fairly certain that months ago, it was showing group name, not SID which is why I ask.

1 0

FreeIPA Upgrade Failing with "Could not find cert: ipaCert"
by Ty zang 27 Jan '23

27 Jan '23

Hi all, I am very very green at understanding/supporting FreeIPA so bare with me please. I tried to update my Red Hat 8.7 in December and part of that update was trying to install IPA 4.6.8. So after updating my server, I tried to start IPA but it said it needed an upgrade. The upgrades have been failing and the ipaupgrade log shows one error near the end.. "certutil: Could not find cert: ipaCert". I think it is looking at /etc/httpd/alias and when I run certutil -d /etc/httpd/alias -L, I see: Server-Cert u,u,u acme.com IPA CA CT,C,C I googled around but found no real answer. Would it just be a case of my certificate being called Server-Cert and not ipaCert? Am I missing a certificate? Does anyone have any suggestions on how to troubleshoot this?

3 6

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users January 2023