June 2023 - FreeIPA-users - Fedora mailing-lists

sudo and hostnames
by Ronald Wimmer 29 Jun '23

29 Jun '23

Is a correct hostname (FQDN) required for sudo rules to work properly? I do have a host where the hostname is set to its shortname. My user is allowed to perform sudo on this host (as it is a member of the admin group which is allowed to do everything on every host) but another user (who is not member of the admin group) cannot perform sudo on this particular host. (according to IPA this user should be able to use sudo) My suspicion is that this might have to do with the hostname incorrectly set to its shortname and not to its FQDN. Is this plausible? Cheers, Ronald

3 4

certmonger certificate renewal stuck in SUBMITTING loop
by Jernej Jakob 29 Jun '23

29 Jun '23

Hi, I have a client whose host certificate expired on 2023-06-07. Today I logged into the FreeIPA webui and went to the certificates page which was very slow to load. I had this problem before when there was one host (a different one) stuck in a certificate request loop, so I immediately suspected the same thing happened again. Sure enough, there are >3000 certificates for this host listed in IPA. Running 'getcert list' on the host shows: Number of certificates and requests being tracked: 1. Request ID '20190703221417': status: SUBMITTING stuck: no key pair storage: type=NSSDB,location='/etc/ipa/nssdb',nickname='Local IPA host',token='NSS Certificate DB',pinfile='/etc/ipa/nssdb/pwdfile.txt' certificate: type=NSSDB,location='/etc/ipa/nssdb',nickname='Local IPA host',token='NSS Certificate DB' CA: IPA issuer: CN=Certificate Authority,O=EXAMPLE.COM subject: CN=redacted.example.com,O=EXAMPLE.com expires: 2023-06-07 00:14:30 CEST dns: redacted.example.com principal name: host/redacted.example.com(a)EXAMPLE.COM key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment eku: id-kp-serverAuth,id-kp-clientAuth pre-save command: post-save command: track: yes auto-renew: yes I stopped certmonger to stop the loop. Then checked if the problem was the same as on that other host some time ago, but it was not. I saw one error in syslog (this turned out to not be the issue): "Server at https://ipa1.example.com/ipa/xml failed request, will retry: -504 (libcurl failed to execute the HTTP POST transaction, explaining: Could not resolve host: ipa1.example.com)" That is a server that has been shut down. It was the first server I installed IPA onto, which had a replica ipa2. That was on CentOS 7. This year I migrated to Rocky 8 by adding two new clients, ipa3 and ipa4, following the official procedure by promoting each client to a replica, set ipa3 as CA renewal master, and so on. Then after that was done I removed the old servers from replication, shut down IPA services, unenrolled them and updated all SRV records in DNS. I forgot about A/AAAA ipa-ca, which was left pointing at two addresses, that of ipa1 and ipa3. It's weird becase it can obviously contact and obtain a certificate from ipa3, whose logs contain these successful issuances. It could contact it on 2023-06-07, when the ipa-ca record was still pointing to both the ipa1 and ipa3 servers. On 2023-06-09 I dist-upgraded both ipa3/4 servers, at which time I also found the incorrect ipa-ca A/AAAA records (coincidentally as I was configuring a smart card CA certificate), so I corrected it. But the failing certmonger client still kept failing which makes me believe it was not the fault of the incorrect ipa-ca records. I searched around on the "redacted.example.com" for ipa1. It's not in /var/lib/certmonger/requests/20190703221417 (the failing request) but it is in /etc/ipa/default.conf: server = ipa1.example.com xmlrpc_uri = https://ipa1.example.com/ipa/xml I changed these values to ipa3 now, started certmonger and resubmitted the request. Unfortunately no change. That libcurl error for ipa1 is gone now: Jun 16 15:28:01 redacted certmonger[2091940]: 2023-06-16 15:28:01 [2091940] Token is named "NSS Generic Crypto Services", not "NSS Certificate DB", skipping. Jun 16 15:28:01 redacted certmonger[2091940]: 2023-06-16 15:28:01 [2091940] Unable to initialize NSS. Jun 16 15:28:01 redacted certmonger[2091941]: 2023-06-16 15:28:01 [2091941] Setting "CERTMONGER_REQ_SUBJECT" to "CN=redacted.example.com,O=EXAMPLE.COM" for child. Jun 16 15:28:01 redacted certmonger[2091941]: 2023-06-16 15:28:01 [2091941] Setting "CERTMONGER_REQ_PRINCIPAL" to "host/redacted.example.com(a)EXAMPLE.COM" for child. Jun 16 15:28:01 redacted certmonger[2091941]: 2023-06-16 15:28:01 [2091941] Setting "CERTMONGER_OPERATION" to "SUBMIT" for child. Jun 16 15:28:01 redacted certmonger[2091941]: 2023-06-16 15:28:01 [2091941] Setting "CERTMONGER_CSR" to "-----BEGIN NEW CERTIFICATE REQUEST----- Jun 16 15:28:01 redacted certmonger[2091941]: ...redacted..." for child. Jun 16 15:28:01 redacted certmonger[2091941]: 2023-06-16 15:28:01 [2091941] Setting "CERTMONGER_SPKAC" to ...redacted... Jun 16 15:28:01 redacted certmonger[2091941]: 2023-06-16 15:28:01 [2091941] Setting "CERTMONGER_SPKI" to ...redacted... Jun 16 15:28:01 redacted certmonger[2091941]: 2023-06-16 15:28:01 [2091941] Setting "CERTMONGER_LOCAL_CA_DIR" to "/var/lib/certmonger/local" for child. Jun 16 15:28:01 redacted certmonger[2091941]: 2023-06-16 15:28:01 [2091941] Setting "CERTMONGER_KEY_TYPE" to "RSA" for child. Jun 16 15:28:01 redacted certmonger[2091941]: 2023-06-16 15:28:01 [2091941] Setting "CERTMONGER_CA_NICKNAME" to "IPA" for child. Jun 16 15:28:01 redacted certmonger[2091941]: 2023-06-16 15:28:01 [2091941] Setting "CERTMONGER_CERTIFICATE" to "-----BEGIN CERTIFICATE----- Jun 16 15:28:01 redacted certmonger[2091941]: ...redacted..." for child. Jun 16 15:28:01 redacted certmonger[2091941]: 2023-06-16 15:28:01 [2091941] Redirecting stdin and stderr to /dev/null, leaving stdout open for child "/usr/lib/certmonger/ipa-submit". At this point it just keeps repeating the same over and over again. I would appreciate any help. Thanks.

3 5

'ipa-ca-install' conncheck failure on freeIPA
by Arne Verheyden 28 Jun '23

28 Jun '23

I'm facing a problem while trying to set up a replica of our main FreeIPA server. We're planning to migrate from an old server to a new one. ipa-replica-install and ipa-dns-install runs without issue but the problem arises when I try to use the ipa-ca-install command. The command fails at the connection check phase with this output: $ ipa-ca-install Directory Manager (existing master) password: Run connection check to master Your system may be partly configured. Run /usr/sbin/ipa-server-install --uninstall to clean up. Connection check failed! See /var/log/ipareplica-conncheck.log for more information. If the check results are not valid it can be skipped with --skip-conncheck parameter. Logs of /var/log/ipa-replica-conncheck.log 2023-06-27T14:25:28Z DEBUG Ports opened, notify original thread 2023-06-27T14:25:28Z DEBUG Original thread resumed 2023-06-27T14:25:28Z INFO Get credentials to log in to remote master 2023-06-27T14:25:28Z DEBUG KRB5CCNAME set to /tmp/krbcc2_1ny8e1/ccache 2023-06-27T14:25:28Z INFO Check RPC connection to remote master 2023-06-27T14:25:28Z DEBUG Starting external process 2023-06-27T14:25:28Z DEBUG args=['/usr/bin/certutil', '-d', '/tmp/tmp66e_2bfv', '-N', '-f', '/tmp/tmp66e_2bfv/pwdfile.txt', '-@', '/tmp/tmp66e_2bfv/pwdfile.txt'] 2023-06-27T14:25:29Z DEBUG Process finished, return code=0 2023-06-27T14:25:29Z DEBUG stdout= 2023-06-27T14:25:29Z DEBUG stderr= 2023-06-27T14:25:29Z DEBUG Starting external process 2023-06-27T14:25:29Z DEBUG args=['/usr/sbin/selinuxenabled'] 2023-06-27T14:25:29Z DEBUG Process finished, return code=0 2023-06-27T14:25:29Z DEBUG stdout= 2023-06-27T14:25:29Z DEBUG stderr= 2023-06-27T14:25:29Z DEBUG Starting external process 2023-06-27T14:25:29Z DEBUG args=['/sbin/restorecon', '-F', '/tmp/tmp66e_2bfv'] 2023-06-27T14:25:29Z DEBUG Process finished, return code=0 2023-06-27T14:25:29Z DEBUG stdout=Warning no default label for /tmp/tmp66e_2bfv 2023-06-27T14:25:29Z DEBUG stderr= 2023-06-27T14:25:29Z DEBUG Starting external process 2023-06-27T14:25:29Z DEBUG args=['/usr/sbin/selinuxenabled'] 2023-06-27T14:25:29Z DEBUG Process finished, return code=0 2023-06-27T14:25:29Z DEBUG stdout= 2023-06-27T14:25:29Z DEBUG stderr= 2023-06-27T14:25:29Z DEBUG Starting external process 2023-06-27T14:25:29Z DEBUG args=['/sbin/restorecon', '-F', '/tmp/tmp66e_2bfv/cert9.db'] 2023-06-27T14:25:29Z DEBUG Process finished, return code=0 2023-06-27T14:25:29Z DEBUG stdout=Warning no default label for /tmp/tmp66e_2bfv/cert9.db 2023-06-27T14:25:29Z DEBUG stderr= 2023-06-27T14:25:29Z DEBUG Starting external process 2023-06-27T14:25:29Z DEBUG args=['/usr/sbin/selinuxenabled'] 2023-06-27T14:25:29Z DEBUG Process finished, return code=0 2023-06-27T14:25:29Z DEBUG stdout= 2023-06-27T14:25:29Z DEBUG stderr= 2023-06-27T14:25:29Z DEBUG Starting external process 2023-06-27T14:25:29Z DEBUG args=['/sbin/restorecon', '-F', '/tmp/tmp66e_2bfv/key4.db'] 2023-06-27T14:25:29Z DEBUG Process finished, return code=0 2023-06-27T14:25:29Z DEBUG stdout=Warning no default label for /tmp/tmp66e_2bfv/key4.db 2023-06-27T14:25:29Z DEBUG stderr= 2023-06-27T14:25:29Z DEBUG Starting external process 2023-06-27T14:25:29Z DEBUG args=['/usr/sbin/selinuxenabled'] 2023-06-27T14:25:29Z DEBUG Process finished, return code=0 2023-06-27T14:25:29Z DEBUG stdout= 2023-06-27T14:25:29Z DEBUG stderr= 2023-06-27T14:25:29Z DEBUG Starting external process 2023-06-27T14:25:29Z DEBUG args=['/sbin/restorecon', '-F', '/tmp/tmp66e_2bfv/pkcs11.txt'] 2023-06-27T14:25:29Z DEBUG Process finished, return code=0 2023-06-27T14:25:29Z DEBUG stdout=Warning no default label for /tmp/tmp66e_2bfv/pkcs11.txt 2023-06-27T14:25:29Z DEBUG stderr= 2023-06-27T14:25:29Z DEBUG Starting external process 2023-06-27T14:25:29Z DEBUG args=['/usr/sbin/selinuxenabled'] 2023-06-27T14:25:29Z DEBUG Process finished, return code=0 2023-06-27T14:25:29Z DEBUG stdout= 2023-06-27T14:25:29Z DEBUG stderr= 2023-06-27T14:25:29Z DEBUG Starting external process 2023-06-27T14:25:29Z DEBUG args=['/sbin/restorecon', '-F', '/tmp/tmp66e_2bfv/pwdfile.txt'] 2023-06-27T14:25:29Z DEBUG Process finished, return code=0 2023-06-27T14:25:29Z DEBUG stdout=Warning no default label for /tmp/tmp66e_2bfv/pwdfile.txt 2023-06-27T14:25:29Z DEBUG stderr= 2023-06-27T14:25:29Z DEBUG Starting external process 2023-06-27T14:25:29Z DEBUG args=['/usr/bin/certutil', '-d', 'sql:/tmp/tmp66e_2bfv', '-A', '-n', 'CN=Certificate Authority,O=EXAMPLE.COM', '-t', 'C,,', '-a', '-f', '/tmp/tmp66e_2bfv/pwdfile.txt'] 2023-06-27T14:25:29Z DEBUG Process finished, return code=0 2023-06-27T14:25:29Z DEBUG stdout= 2023-06-27T14:25:29Z DEBUG stderr= 2023-06-27T14:25:29Z DEBUG importing all plugin modules in ipaclient.remote_plugins.schema$8182589c... 2023-06-27T14:25:29Z DEBUG importing plugin module ipaclient.remote_plugins.schema$8182589c.plugins 2023-06-27T14:25:29Z DEBUG importing all plugin modules in ipaclient.plugins... 2023-06-27T14:25:29Z DEBUG importing plugin module ipaclient.plugins.automember 2023-06-27T14:25:29Z DEBUG importing plugin module ipaclient.plugins.automount 2023-06-27T14:25:29Z DEBUG importing plugin module ipaclient.plugins.ca 2023-06-27T14:25:29Z DEBUG importing plugin module ipaclient.plugins.cert 2023-06-27T14:25:29Z DEBUG importing plugin module ipaclient.plugins.certmap 2023-06-27T14:25:29Z DEBUG importing plugin module ipaclient.plugins.certprofile 2023-06-27T14:25:29Z DEBUG importing plugin module ipaclient.plugins.dns 2023-06-27T14:25:29Z DEBUG importing plugin module ipaclient.plugins.hbacrule 2023-06-27T14:25:29Z DEBUG importing plugin module ipaclient.plugins.hbactest 2023-06-27T14:25:29Z DEBUG importing plugin module ipaclient.plugins.host 2023-06-27T14:25:29Z DEBUG importing plugin module ipaclient.plugins.idrange 2023-06-27T14:25:29Z DEBUG importing plugin module ipaclient.plugins.internal 2023-06-27T14:25:29Z DEBUG importing plugin module ipaclient.plugins.location 2023-06-27T14:25:29Z DEBUG importing plugin module ipaclient.plugins.migration 2023-06-27T14:25:29Z DEBUG importing plugin module ipaclient.plugins.misc 2023-06-27T14:25:29Z DEBUG importing plugin module ipaclient.plugins.otptoken 2023-06-27T14:25:29Z DEBUG importing plugin module ipaclient.plugins.otptoken_yubikey 2023-06-27T14:25:29Z DEBUG importing plugin module ipaclient.plugins.passwd 2023-06-27T14:25:29Z DEBUG importing plugin module ipaclient.plugins.permission 2023-06-27T14:25:29Z DEBUG importing plugin module ipaclient.plugins.rpcclient 2023-06-27T14:25:29Z DEBUG importing plugin module ipaclient.plugins.server 2023-06-27T14:25:29Z DEBUG importing plugin module ipaclient.plugins.service 2023-06-27T14:25:29Z DEBUG importing plugin module ipaclient.plugins.sudorule 2023-06-27T14:25:29Z DEBUG importing plugin module ipaclient.plugins.topology 2023-06-27T14:25:29Z DEBUG importing plugin module ipaclient.plugins.trust 2023-06-27T14:25:29Z DEBUG importing plugin module ipaclient.plugins.user 2023-06-27T14:25:29Z DEBUG importing plugin module ipaclient.plugins.vault 2023-06-27T14:25:30Z DEBUG failed to find session_cookie in persistent storage for principal 'host/replica1.example.com(a)EXAMPLE.COM' 2023-06-27T14:25:30Z DEBUG trying https://ipa01.example.com/ipa/json 2023-06-27T14:25:30Z DEBUG New HTTP connection (ipa01.example.com) 2023-06-27T14:25:31Z DEBUG [details redacted for brevity] 2023-06-27T14:25:31Z INFO Connection to https://ipa01.example.com/ipa/json failed with Insufficient access: SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Credential cache is empty) 2023-06-27T14:25:31Z DEBUG trying https://replica1.example.com/ipa/json 2023-06-27T14:25:31Z DEBUG New HTTP connection (replica1.example.com) 2023-06-27T14:25:31Z DEBUG [details redacted for brevity] 2023-06-27T14:25:31Z DEBUG Created connection context.rpcclient_140381866522064 2023-06-27T14:25:31Z DEBUG raw: ping(version='2.251') 2023-06-27T14:25:31Z DEBUG ping(version='2.251') 2023-06-27T14:25:31Z DEBUG [try 1]: Forwarding 'ping/1' to json server 'https://replica1.example.com/ipa/json' 2023-06-27T14:25:31Z DEBUG HTTP connection keep-alive (replica1.example.com) 2023-06-27T14:25:31Z DEBUG [details redacted for brevity] 2023-06-27T14:25:31Z INFO Execute check on remote master 2023-06-27T14:25:31Z DEBUG [try 1]: Forwarding 'server_conncheck' to json server 'https://replica1.example.com/ipa/json' 2023-06-27T14:25:31Z DEBUG HTTP connection keep-alive (replica1.example.com) 2023-06-27T14:25:31Z DEBUG [details redacted for brevity] 2023-06-27T14:25:31Z DEBUG Destroyed connection context.rpcclient_140381866522064 2023-06-27T14:25:31Z ERROR ERROR: Remote master check failed with following error message(s): invalid 'cn': must be "replica1.example.com" I don't know how to debug this, i have searched the web for similar issue and the only one i have managed to find is this one: https://lists.fedoraproject.org/archives/list/freeipa-users@lists.fedorahos… . The problem is similar but not the same as the one i have, so it did not help me much. I would greatly appreciate any suggestions or advice on how to resolve this problem. Sincerely, Arne

3 3

how to set the RIDs during migration to Rocky 8?
by Harald Dunkel 28 Jun '23

28 Jun '23

Hi folks, I am trying to migrate FreeIPA from CentOS7 to Rocky 8. No AD trust relationship involved by now. Problem: ipa-replica-install on the first Rocky 8 host to join the IPA servers complained # -------------------------------------------------------------------------- [root@ipaca8 ~]# ipa-replica-install --setup-ca --ip-address 172.19.96.100 Trust is configured but no NetBIOS domain name found, setting it now. Enter the NetBIOS name for the IPA domain. Only up to 15 uppercase ASCII letters, digits and dashes are allowed. Example: EXAMPLE. NetBIOS domain name [EXAMPLE]: WARNING: 564 existing users or groups do not have a SID identifier assigned. Installer can run a task to have ipa-sidgen Directory Server plugin generate the SID identifier for all these users. Please note, in case of a high number of users and groups, the operation might lead to high replication traffic and performance degradation. Refer to ipa-adtrust-install(1) man page for details. Do you want to run the ipa-sidgen task? [no]: yes Run connection check to master Connection check OK Disabled p11-kit-proxy Configuring directory server (dirsrv). Estimated time: 30 seconds [1/39]: creating directory server instance Validate installation settings ... Create file system structures ... selinux is disabled, will not relabel ports or files. Create database backend: dc=example,dc=de ... Perform post-installation tasks ... [2/39]: tune ldbm plugin [3/39]: adding default schema [4/39]: enabling memberof plugin [5/39]: enabling winsync plugin [6/39]: configure password logging : : [20/30]: starting certificate server instance [21/30]: Finalize replication settings [22/30]: configure certmonger for renewals [23/30]: Importing RA key [24/30]: configure certificate renewals [25/30]: Configure HTTP to proxy connections [26/30]: updating IPA configuration [27/30]: enabling CA instance [28/30]: importing IPA certificate profiles Lookup failed: Preferred host ipaca8.example.de does not provide CA. Lookup failed: Preferred host ipaca8.example.de does not provide CA. Failed to import profile 'acmeIPAServerCert': Request failed with status 500: Non-2xx response from CA REST API: 500. . Running ipa-server-upgrade when installation is completed may resolve this issue. [29/30]: configuring certmonger renewal for lightweight CAs [30/30]: deploying ACME service Done configuring certificate server (pki-tomcatd). Configuring Kerberos KDC (krb5kdc) [1/1]: installing X509 Certificate for PKINIT Done configuring Kerberos KDC (krb5kdc). Applying LDAP updates Upgrading IPA:. Estimated time: 1 minute 30 seconds [1/10]: stopping directory server [2/10]: saving configuration [3/10]: disabling listeners [4/10]: enabling DS global lock [5/10]: disabling Schema Compat [6/10]: starting directory server [7/10]: upgrading server Could not get dnaHostname entries in 60 seconds [8/10]: stopping directory server [9/10]: restoring configuration [10/10]: starting directory server Done. Finalize replication settings Restarting the KDC Configuring SID generation [1/8]: creating samba domain object [2/8]: adding admin(group) SIDs [3/8]: adding RID bases Found more than one local domain ID range with no RID base set. [error] RuntimeError: Too many ID ranges Your system may be partly configured. Run /usr/sbin/ipa-server-install --uninstall to clean up. Too many ID ranges The ipa-replica-install command failed. See /var/log/ipareplica-install.log for more information # -------------------------------------------------------------------------- Here is the list of id ranges: # -------------------------------------------------------------------------- [root@ipaca8 ~]# ipa idrange-find --all --raw ---------------- 3 ranges matched ---------------- dn: cn=EXAMPLE.DE_id_range,cn=ranges,cn=etc,dc=example,dc=de cn: EXAMPLE.DE_id_range ipabaseid: 379400000 ipaidrangesize: 200000 iparangetype: ipa-local objectclass: top objectclass: ipaIDrange objectclass: ipaDomainIDRange dn: cn=EXAMPLE.DE_posix,cn=ranges,cn=etc,dc=example,dc=de cn: EXAMPLE.DE_posix ipabaseid: 1000 ipaidrangesize: 99000 iparangetype: ipa-local objectclass: ipadomainidrange objectclass: ipaIDrange dn: cn=EXAMPLE.DE_subid_range,cn=ranges,cn=etc,dc=example,dc=de cn: EXAMPLE.DE_subid_range ipabaseid: 2147483648 ipaidrangesize: 2147352576 ipabaserid: 2147283648 ipanttrusteddomainsid: S-1-5-21-738065-838566-194929194 iparangetype: ipa-ad-trust objectclass: top objectclass: ipaIDrange objectclass: ipaTrustedADDomainRange ---------------------------- Number of entries returned 3 ---------------------------- # -------------------------------------------------------------------------- I didn't ask for an AD trust relationship, introducing even more complexity to something that should be kept as simple as possible. And now its making problems :-(. Is there some way to drop this again? AFAICT ipa idrange-mod cannot set the RID, so how can I resolve this nightmare? Every helpful comment is highly appreciated. Harri

4 5

ipa-pkinit-manage failure
by Алексей Иванов 28 Jun '23

28 Jun '23

Greetings, I'm trying to configure my replica IPA servers to support PKINIT. [root@office-ipa-1 ~]# ipa-pkinit-manage enable Configuring Kerberos KDC (krb5kdc) [1/1]: installing X509 Certificate for PKINIT PKINIT certificate request failed: Certificate issuance failed (CA_UNREACHABLE: Server at https://office-ipa-1.<domain>/ipa/json failed request, will retry: 4301 (Certificate operation cannot be completed: Key Parameters 4096,8192 Not Matched).) Failed to configure PKINIT Full PKINIT configuration did not succeed The setup will only install bits essential to the server functionality You can enable PKINIT after the setup completed using 'ipa-pkinit-manage' Done configuring Kerberos KDC (krb5kdc). The ipa-pkinit-manage command was successful [root@office-ipa-1 ~]# I've manually installed the correct KDC cert with ipa-server-certinstall -k, but it seems I'm missing something out. Error regarding Key Parameters 4096,8192 Not Matched is expected, as we've changed all our certificate templates to support 4096 key and above. But I don't understand why ipa-pkinit-manage enable command tries to issue a new certificate and does not utilise the existing one? Regards, Alex Ivanov.

2 1

pki-tomcat fails to start after upgrade
by Tania Hagan 27 Jun '23

27 Jun '23

Hi FreeIPA, I am currently using FreeIPA version 4.9.10 with 6 ipareaplicas. I went to upgrade the server to 4.9.11 but the ipa-server-upgrade failed where it attempted to start pki-tomcat. In the /var/log/pki/pki-tomcat/ca/debug.log I see: Unable to connect to LDAP server: Unable to create socket: java.net.ConnectException: Connection refused (Connection refused) … At netscape.ldap.LDAPConnection(Uknown Source) Unable to start CA engine: Unable to connect to LDAP server: Unable to create socket: java.net.ConnectionExection: Connection refused (Connection refused) …. I've been through the guide https://floblanc.wordpress.com/2017/09/11/troubleshooting-freeipa-pki-tomca… where I can confirm the /etc/pki/pki-tomcat/ca/CS.cfg is using: internaldb.ldapauth.authtype=SslClientAuth internaldb.ldapauth.bindDN=cn=Directory Manager internaldb.ldapauth.bindPWPrompt=internaldb internaldb.ldapauth.clientCertNickname=subsystemCert cert-pki-ca internaldb.ldapconn.host=<servername> internaldb.ldapconn.port=636 internaldb.ldapconn.secureConn=true certutil -L -d /etc/pki/pki-tomcat/alias -n 'subsystemCert cert-pki-ca' shows the cert with the correct Serial number and the cert does not expire until next year. If I read the private key, I have checked the Nickname is correct and does work on another ipareplica but not the one I'm troubleshooting. grep internal /var/lib/pki/pki-tomcat/conf/password.conf | cut -d= -f2 > /tmp/pwdfile.txt certutil -K -d /etc/pki/pki-tomcat/alias -f /tmp/pwdfile.txt -n 'subsystemCert cert-pki-ca' certutil: Checking token "NSS Certificate DB" in slot "NSS User Private Key and Certificate Services" certutil: problem listing keys: SEC_ERROR_INVALID_ARGS: security library: invalid arguments. The ldap server configuration looks to be using the correct certificate. I rolled back the server to my last known working server, and find that commands such as ipa cert-find work fine, all my replicas have the same cert, but the command certutil -K -d /etc/pki/pki-tomcat/alias -f /tmp/pwdfile.txt -n 'subsystemCert cert-pki-ca' fails on 4 out of 6 ipareplicas. 2 replicas see the correct result. Could any one help point me to how I might resolve this issue? Many Thanks, Tania

2 2

Install Error - RuntimeError: CA configuration failed - java.nio.file.AccessDeniedException: /tmp/nss-cert-11721189233651257758.crt
by Jacob Chapman 26 Jun '23

26 Jun '23

I am installing on Docker for MacOS. During initial install, it reaches step [1/30]: configuring certificate server instance when it shows the error. I looked in the /data/var/log/ipaserver-install.log and it looks like everything is OK until it hits the errors below. Any ideas what could cause this? FINE: NSSDatabase: Issuing cert for CN=freeipa.mydomain.cloud,O=2023-06-25 23:40:10 FINE: NSSDatabase: - issuer: CN=freeipa.mydomain.cloud,O=2023-06-25 23:40:10 FINE: NSSDatabase: - public key algorithm: RSA FINE: NSSDatabase: - serial number: 0x79a6edffa89c946d7cb055c19b4befa4 FINE: NSSDatabase: - not before: Sun Jun 25 23:42:17 UTC 2023 FINE: NSSDatabase: - not after: Mon Sep 25 23:42:17 UTC 2023 FINE: NSSDatabase: - hash algorithm: SHA256 FINE: NSSDatabase: - key algorithm: SHA256withRSA FINE: NSSDatabase: Finding request private key FINE: NSSDatabase: - private key: 0xdbb9f417bd81a12aa00c1b20227c91a6b2ccefd6 FINE: NSSDatabase: Private key algorithm: RSA FINE: NSSDatabase: Signing algorithm: SHA256withRSA FINE: CryptoUtil: Signing certificate FINE: CryptoUtil: - signing algorithm: RSASignatureWithSHA256Digest FINE: CryptoUtil: - algorithm name: SHA256withRSA FINE: CryptoUtil: - algorithm ID: SHA256withRSA DEBUG: NSSDatabase.add_cert(temp Server-Cert cert-pki-ca) DEBUG: Command: pki -d /etc/pki/pki-tomcat/alias -C /tmp/tmp5y2f9zop/XXXXXXXX.txt nss-cert-import --cert /tmp/tmp_tmyllsd/sslserver.crt --debug temp Server-Cert cert-pki-ca INFO: Initializing NSS INFO: Logging into internal token INFO: Using internal token java.nio.file.AccessDeniedException: /tmp/nss-cert-11721189233651257758.crt at java.base/sun.nio.fs.UnixException.translateToIOException(UnixException.java:90) at java.base/sun.nio.fs.UnixException.rethrowAsIOException(UnixException.java:106) at java.base/sun.nio.fs.UnixException.rethrowAsIOException(UnixException.java:111) at java.base/sun.nio.fs.UnixFileSystemProvider.newByteChannel(UnixFileSystemProvider.java:218) at java.base/java.nio.file.Files.newByteChannel(Files.java:380) at java.base/java.nio.file.Files.createFile(Files.java:658) at java.base/java.nio.file.TempFileHelper.create(TempFileHelper.java:136) at java.base/java.nio.file.TempFileHelper.createTempFile(TempFileHelper.java:159) at java.base/java.nio.file.Files.createTempFile(Files.java:923) at org.dogtagpki.nss.NSSDatabase.addCertificate(NSSDatabase.java:342) at com.netscape.cmstools.nss.NSSCertImportCLI.execute(NSSCertImportCLI.java:104) at org.dogtagpki.cli.CommandCLI.execute(CommandCLI.java:58) at org.dogtagpki.cli.CLI.execute(CLI.java:353) at org.dogtagpki.cli.CLI.execute(CLI.java:353) at org.dogtagpki.cli.CLI.execute(CLI.java:353) at com.netscape.cmstools.cli.MainCLI.execute(MainCLI.java:658) at com.netscape.cmstools.cli.MainCLI.main(MainCLI.java:697)

2 2

Removing dead servers with tombstone entries
by Joe Rhodes 26 Jun '23

26 Jun '23

Hello all! I have a CentOS 7 based FreeIPA system that I’m migrating to Rocky 9. As suggested, I’ve created a Rocky 8 instance replica first. As I’ve been working on this (in a dev environment first), I’ve gotten myself into a state where I have two servers in the config that I cannot delete. (The VMs have been uninstalled and deleted.) ipa server-find --------------------- 7 IPA servers matched --------------------- Server name: ia-ipa-1.dev.purestake.tech Min domain level: 0 Max domain level: 1 Server name: ia-ipa-2.dev.purestake.tech Min domain level: 0 Max domain level: 1 Server name: joe-rocky-8.dev.purestake.tech Min domain level: 1 Max domain level: 1 Server name: joe-rocky-9.dev.purestake.tech Min domain level: 1 Max domain level: 1 Server name: oh-ipa-1.dev.purestake.tech Min domain level: 0 Max domain level: 1 Server name: oh-ipa-2.dev.purestake.tech Min domain level: 0 Max domain level: 1 Server name: oh-ipa-21.dev.purestake.tech Min domain level: 1 Max domain level: 1 The two servers I want to delete are joe-rocky-9 and oh-ipa-21. Trying to delete either give me: ipa server-del joe-rocky-9.dev.purestake.tech Removing joe-rocky-9.dev.purestake.tech from replication topology, please wait... ipa: ERROR: Server removal aborted: Replication topology in suffix 'domain' is disconnected: Topology does not allow server ia-ipa-1.dev.purestake.tech to replicate with servers: joe-rocky-9.dev.purestake.tech Topology does not allow server ia-ipa-2.dev.purestake.tech to replicate with servers: joe-rocky-9.dev.purestake.tech Topology does not allow server joe-rocky-8.dev.purestake.tech to replicate with servers: joe-rocky-9.dev.purestake.tech Topology does not allow server joe-rocky-9.dev.purestake.tech to replicate with servers: joe-rocky-8.dev.purestake.tech oh-ipa-1.dev.purestake.tech oh-ipa-2.dev.purestake.tech ia-ipa-1.dev.purestake.tech oh-ipa-21.dev.purestake.tech ia-ipa-2.dev.purestake.tech Topology does not allow server oh-ipa-1.dev.purestake.tech to replicate with servers: joe-rocky-9.dev.purestake.tech Topology does not allow server oh-ipa-2.dev.purestake.tech to replicate with servers: joe-rocky-9.dev.purestake.tech Topology does not allow server oh-ipa-21.dev.purestake.tech to replicate with servers: joe-rocky-9.dev.purestake.tech. and attempting to delete, ignoring the replication topology: ipa server-del joe-rocky-9.dev.purestake.tech --ignore-topology-disconnect Removing joe-rocky-9.dev.purestake.tech from replication topology, please wait... ipa: ERROR: Not allowed on non-leaf entry When I do a: ipa topologysegment-find domain the server joe-rocky-9 is not listed in any of the segments. I believe the issue is I have a bunch of replication issues regarding these two servers. (I had been adding and removing them as I was finding the right way to go about my upgrade) This command shows both of the servers: ldapsearch "nsds5ReplConflict=*" When I do the following search I see quite a few nsTombstone entries as children, which I assume is what’s blocking me from removing this DN (either using the ipa server-del command or the ldapdelete command). ldapsearch -D "cn=Directory Manager” -W "(objectclass=nsTombstone)" dn When I do this command: ipa-replica-manage list-ruv Replica Update Vectors: ia-ipa-1.dev.purestake.tech:389: 4 oh-ipa-1.dev.purestake.tech:389: 7 ia-ipa-2.dev.purestake.tech:389: 3 oh-ipa-2.dev.purestake.tech:389: 8 joe-rocky-8.dev.purestake.tech:389: 19 Certificate Server Replica Update Vectors: ia-ipa-1.dev.purestake.tech:389: 6 joe-rocky-8.dev.purestake.tech:389: 20 ia-ipa-2.dev.purestake.tech:389: 5 I get the expected list of RUVs, without the two servers I want to delete. Only the serves that are really on-line and legit show up. So I cannot use the “clean-ruv” command because the bad servers don’t show up with a replication ID. When I do this: ipa-replica-manage -p Extraordinary-northern-Conditioning-Idaho-7 clean-dangling-ruv The server 'joe-rocky-9.dev.purestake.tech' appears to be offline. The server 'oh-ipa-21.dev.purestake.tech' appears to be offline. No dangling RUVs found I see the two problematic entries timing out (as expected, since they don’t exist). I’m just not sure how to remove these two dead servers. It seems like I need to resolve or delete the nsTombstone children, but that doesn’t seem to be possible. I’m kind of wondering if I’m at a point where I’ll need to do an ipa-backup/modify the ldif/ipa-restore to get rid of these? I’m not even sure that’s possible. Any help would be greatly appreciated.

3 4

Replication of account lock state
by Djerk Geurts 26 Jun '23

26 Jun '23

Hi all, Having read up on whether replica servers can also replicate the lock status of an account. I'm trying to find out what the current status is on the latest FreeIPA v4.x. What are the available options? Right now having to log into multiple IPA servers to find lockouts is a real pita and security wise it like either failed Auth counters or the lockout status to be replicated. The ability to unlock from a single IPA server would also be pretty sweet. Is there any way to get either working? Thanks, Djerk

3 2

Antivirus/malware scan
by Ronald Wimmer 26 Jun '23

26 Jun '23

If a company policy forces you to install an antivirus/malware scan tool on Linux servers which IPA directories should be excluded because a severe performance impact would be very likely? I would start with: /var/lib/sss /etc/dirsrv/slapd-LINUX-MYDOMAIN-AT What else? Cheers, Ronald

2 3

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users June 2023