kinit: KDC can't fulfill requested option while renewing credentials - which approach?
by Pieter Baele
I tried various approached to get Renewable tickets :
modifying the kdc
modifying krb5.conf
using kadmin.local on every replica to modify the principal; which is not
working - as designed (?)- in IPA
What should I do to get a ticket with the correct R flag from IPA ?
I don't think this is SSSD related (the service needing the renewable
ticket this way is Apache Storm)
Thanks a lot!
7 months, 1 week
Custom ssl cert for freeipa docker
by Leo O
Hello Guys,
I'm would like to use custom ssl certificates for http and ldap, I saw the following:
https://www.freeipa.org/page/Using_3rd_part_certificates_for_HTTP/LDAP
But I wonder how would this be done when using freeipa in a docker/podman container. I mean the container is started with "--read-only" flag. So it's not clear to me what the correct approach here would be. I hope it's not that you have to re-build an own image with the ssl certificates every time?
Background Info: I'm using acme.sh in a VM, which creates my wildcard letsencrypt certificates and puts them on an nfs share. Freeipa should simply use that certificates for http and ldap and that's it. No renewing as this is done by the acme.sh VM itself.
8 months
Visibility/access of Freeipa users to windows on trusted AD
by Francis Augusto Medeiros-Logeay
Hi,
I have searched this everywhere, but can't find it.
I want to grant access to a FreeIPA user to a Windows machine. When I
try to grant the user access on windows, adding it like
FREEIPADOMAIN\freeipauser, I get an error. There is a trust between both
domains, but every place where I see the trusted domain on Windows (for
example when configuring a GPO) I can't search for FreeIPA users.
Is this how it is supposed to be, or how can I see my FreeIPA users on
Windows the same way I see AD users on my freeipa linux clients?
Best,
Francis
--
Francis Augusto Medeiros-Logeay
Oslo, Norway
8 months, 2 weeks
Cannot get rid of a replica/agreement
by lejeczek
Hi guys.
Two masters from which third got disconnected in a "dirty"
manner.
-> $ ipa-replica-manage del midway.ccn.priv.dom
Server removal aborted:
Replication topology in suffix 'domain' is disconnected:
Topology does not allow server love.ccn.priv.dom to
replicate with servers:
midway.ccn.priv.dom
Topology does not allow server midway.ccn.priv.dom to
replicate with servers:
love.ccn.priv.dom
punch.ccn.priv.dom
Topology does not allow server punch.ccn.priv.dom to
replicate with servers:
midway.ccn.priv.dom.
-> $ ipa topologysegment-find domain
-----------------
1 segment matched
-----------------
Segment name: punch.ccn.priv.dom-to-love.ccn.priv.dom
Left node: punch.ccn.priv.dom
Right node: love.ccn.priv.dom
Connectivity: both
----------------------------
Number of entries returned 1
-> $ ipa-replica-manage del midway.ccn.priv.dom --force
ipa: WARNING:
/usr/lib/python3.6/site-packages/ipaserver/plugins/dogtag.py:1973:
The subsystem in PKIConnection.__init__() has been
deprecated
(https://www.dogtagpki.org/wiki/PKI_10.8_Python_Changes).
Updating DNS system records
Not allowed on non-leaf entry
I've tried to 'reinitialize' but without success.
Anybody care to share suggestions & thoughts?
many thanks, L.
9 months, 1 week
Limiting access to GUI
by Entrepreneur AJ
Hey all,
I have a wan facing install due to many of my team operating with mobile phone hotspots whilst visiting customers.
An Issue I'm having is I want to restrict the GUI to only our admin team's IP address but editing the Apache Config with;
# webUI is now completely static, and served out of that directory
Alias /ipa/ui "/usr/share/ipa/ui"
<Directory "/usr/share/ipa/ui">
SetHandler None
AllowOverride None
Satisfy Any
Require all granted
ExpiresActive On
ExpiresDefault "access plus 1 year"
<FilesMatch "(index.html|loader.js|login.html|reset_password.html)">
ExpiresDefault "access plus 0 seconds"
</FilesMatch>
Order allow,deny
Allow from <ADMIN IP RANGE>
</Directory>
Is still allowing anyone with a browser to reach the IPA gui.
We have Keycloak in place for staff and users to update their passwords.
Any pointers? I would personally prefer to firewall it off but that effects other IPA features.
9 months, 2 weeks
FreeIPA and AIX - sudoers_base
by Ronald Wimmer
We managed to integrate AIX IPA clients successfully some time ago. sudo
was also working fine. A few weeks ago sudo stopped working.
The /etc/ldap.conf on our AIX clients contains the following line:
sudoers_base cn=users,cn=compat,ou=sudoers,dc=linux,dc=mydomain,dc=at
If we try to look that up with an LDAP browser we do not even find a OU
named "sudoers". Did the LDAP structure change in the recent past? What
should the sudoers_base line contain?
Cheers,
Ronald
10 months, 2 weeks
Do keytabs expire?
by Ronald Wimmer
Hi,
today I found out that some entries in a keytab file seemed to have expired:
Request ticket server HTTP/mwc.linux.mydomain.at(a)LINUX.MYDOMAIN.AT kvno
4 not found in keytab; keytab is likely out of date
Fetching the keytab again with ipa-getkeytab fixed the problem. But why
is this happening? Do keytab entries expire? I have not set any custom
password or ticket policies.
Regards,
Ronald
10 months, 3 weeks
dns suddenly not happy with DNSSEC
by lejeczek
Hi guys.
That is on first master which was happy for short while and
then suddenly:
...
29-May-2023 12:38:23.597 info: client @0x7f6484005538
127.0.0.1#43235 (onet.pl): query failed (broken trust chain)
for onet.pl/IN/A at ../../../lib/ns/query.c:7355
29-May-2023 12:39:08.518 info: client @0x7f64b0080088
127.0.0.1#48441 (onet.pl): query failed (broken trust chain)
for onet.pl/IN/A at ../../../lib/ns/query.c:7355
and that is for any & every query.
With given forwards or no forwarders.
Time is in sync, network works, everything else seem good
too... and the second master/replica does not complain.
What might the issue (beside the obvious)?
many thanks, L.
11 months
New DNS Record - Create Reverse Option Fails
by Jeff Hochberg
Hello,
I have an odd issue that just cropped up... I've been using FreeIPA for the past two or three months. I'm using it both for user/group membership as well as for internal DNS.
Any time I try to add an A record with the "Create reverse" option checked, I see the "waiting" message for about 30 seconds, then I get an error message that the reverse record could not be created.
Here's an example:
Forward Lookup Zone:
company.com
Reverse Lookup Zones:
10.16.172.in-addr.arpa.
100.16.172.in-addr.arpa.
101.16.172.in-addr.arpa.
11.16.172.in-addr.arpa.
12.16.172.in-addr.arpa.
Let's say I go to add an A record for "test-record" in the company.com forward lookup zone:
A -> 172.16.100.123
I see the "Waiting" message for roughly 30 seconds, followed by this error message:
"Cannot create reverse record for "172.16.100.123": No answers could be found in the specified lifetime for DNS reverse zone 123.100.16.172.in-addr.arpa."
It looks like FreeIPA is appending 123 to the zone name (123.100.16.172.in-addr.arpa.) when it should be trying to create the PTR record in 100.16.172.in-addr.arpa.
This only happens with some of the Reverse Lookup Zones - it doesn't occur consistently across all zones.
For example, I just tried creating a second entry for "test-record2" in company.com:
A -> 172.16.10.124 (PTR should be in 10.16.172.in-addr.arpa.)
Both the A record and PTR record get created successfully.
Does anyone happen to have any thoughts as to why this may be happening?
I've been considering deleting the 100.16.172.in-addr.arpa. zone and recreating it, but I have a few dozen records and would prefer to not have to create them again.
Thanks in advance!
11 months
