December 2024 - FreeIPA-users - Fedora mailing-lists

can't enroll ubuntu 24
by Dmitry Krasov 24 Jan '25

24 Jan '25

Hello. Trying to enroll Ubuntu 24.04 to domain, but it says "certificate verify failed: Hostname mismatch, certificate is not valid for 'ipa2.dom.loc'. (_ssl.c :1000)" But when I trying ipa web adress via browser it's seems fine. It's selfsigned like always, but date and name are fine. And just recently I have successfully added another one host How can I fix it? Maybe I can disable certificate checking somehow, just for start? sudo ipa-client-install --hostname dit-ntb-spc39-1797875.dom.loc --server=ipa2.dom.loc --enable-dns-updates --domain dom.loc --mkhomedir -p admin -w Password --force-join This program will set up IPA client. Version 4.11.1 WARNING: conflicting time&date synchronization service 'ntp' will be disabled in favor of chronyd Using existing certificate '/etc/ipa/ca.crt'. Autodiscovery of servers for failover cannot work with this configuration. If you proceed with the installation, services will be configured to always access the discovered server for all operations and will not fail over to other servers in case of failure. Proceed with fixed values and no DNS discovery? [no]: y Do you want to configure chrony with NTP server or pool address? [no]: Client hostname: dit-ntb-spc39-1797875.dom.loc Realm: dom.loc DNS Domain: dom.loc IPA Server: ipa2.dom.loc BaseDN: dc=l3874,dc=ru Continue to configure the system with these values? [no]: y Removed old keys for realm dom.loc from /etc/krb5.keytab Synchronizing time Configuration of chrony was changed by installer. Attempting to sync time with chronyc. Time synchronization was successful. Enrolled in IPA realm dom.loc Created /etc/ipa/default.conf Domain dom.loc is already configured in existing SSSD config, creating a new one. The old /etc/sssd/sssd.conf is backed up and will be restored during uninstall. Configured /etc/sssd/sssd.conf Connection to https://ipa2.dom.loc/ipa/json failed with [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: Hostname mismatch, certificate is not valid for 'ipa2.dom.loc'. (_ssl.c :1000) Connection to https://ipa.dom.loc/ipa/json failed with [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: Hostname mismatch, certificate is not valid for 'ipa.dom.loc'. (_ssl.c:1000) cannot connect to 'любой из настроенных серверов': https://ipa2.dom.loc/ipa/json, https://ipa.dom.loc/ipa/json The ipa-client-install command failed. See /var/log/ipaclient-install.log for more information

3 29

Re: Create IPA user via LDAP
by Ronald Wimmer 21 Jan '25

21 Jan '25

On 08.01.24 17:58, Alexander Bokovoy wrote: > On Пан, 08 сту 2024, Ronald Wimmer wrote: >> On 02.01.24 17:57, Ronald Wimmer via FreeIPA-users wrote: >>> On 02.01.24 16:27, Rob Crittenden wrote: >>>> Ronald Wimmer via FreeIPA-users wrote: >>>>> >>>>> >>>>> On 14.12.23 14:42, Alexander Bokovoy wrote: >>>>>> On Чцв, 14 сне 2023, Ronald Wimmer via FreeIPA-users wrote: >>>>>>> In our company we do have an IAM tool for user management. We >>>>>>> need to >>>>>>> create IPA users via this particular tool. I am aware of all IPA >>>>>>> commands or API calls to create/modify or delete a user. >>>>>>> >>>>>>> As the tool does not support FreeIPA yet they asked if there is a >>>>>>> way >>>>>>> to manage users by using LDAP only. Could that work? What about >>>>>>> attributes like ipaNTSecurityIdentifier, ipaUniqueID or uidNumber? >>>>>> >>>>>> Learn about lifecycle management. This is your way of integrating >>>>>> with >>>>>> such tools bvy creating staged users: >>>>>> https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/ht… >>>>>> >>>>> >>>>> I followed the instructions from the documentation. >>>>> >>>>> How could I possibly overcome >>>>> >>>>> Dec 19 09:18:39 tipa01.ipatest.mydomain.at ipa-activate-all[836863]: >>>>> ipa: ERROR: Constraint violation: pre-hashed passwords are not valid >>>>> >>>>> I need to set passwords from the external system. >>>> >>>> You need to enable migration mode (ipa config-mod --enable-migration >>>> true). >>>> >>>> By default a pre-hashed password can only be set once: during the user >>>> add operation. >>> >>> Ok. So this would not work for a password change. So if we need to >>> set an initial password and change that particular password in some >>> point in time the only feasible way is the IPA API, right? >>> >>> Can the immediate password expiration be overridden? >> >> As we have an upcoming please allow me to ask if I got the point here. >> >> I appreciate your support in this matter! >> > > I was looking over the code. The only way to accept pre-hashed passwords > is when they also have Kerberos keys set. This means you cannot use > external LDAP modify/add for that as you cannot create the Kerberos key > without knowing a Kerberos master key. > > So the only other option is to submit a clear-text password: > > userPassword: {CLEAR}text-password > > That will be accepted and if bind DN that performed this change is > either a cn=Directory Manager or a one from the passsync managers, it > would also not be marked for expiration immediately. If I try to set the userPassword attribute to some value with an LDAP browser and chose "plaintext" the value gets hashed immediately. I do see {PBKDF2_SHA256}. As a consequence the user cannot be activated. What am I doing wrong? I tried to enable migration mode and wanted to try it again but now I cannot connect to IPA's LDAP directory at all anymore... [root@tipa01 ~]# ipa config-mod --enable-migration=true Maximum username length: 32 Maximum hostname length: 64 Home directory base: /home Default shell: /bin/sh Default users group: ipausers Default e-mail domain: ipatest.mydomain.at Search time limit: 2 Search size limit: 100 User search fields: uid,givenname,sn,telephonenumber,ou,title Group search fields: cn,description Enable migration mode: True Certificate Subject base: O=IPATEST.MYDOMAIN.AT Password Expiration Notification (days): 4 Password plugin features: AllowNThash, KDC:Disable Last Success SELinux user map order: guest_u:s0$xguest_u:s0$user_u:s0$staff_u:s0-s0:c0.c1023$sysadm_u:s0-s0:c0.c1023$unconfined_u:s0-s0:c0.c1023 Default SELinux user: unconfined_u:s0-s0:c0.c1023 Default PAC types: MS-PAC, nfs:NONE IPA masters: tipa01.ipatest.mydomain.at, tipa02.ipatest.mydomain.at IPA master capable of PKINIT: tipa01.ipatest.mydomain.at, tipa02.ipatest.mydomain.at IPA CA servers: tipa01.ipatest.mydomain.at IPA CA renewal master: tipa01.ipatest.mydomain.at Domain resolution order: org.mydomain.at:ipatest.mydomain.at [root@tipa01 ~]# ipa config-mod --enable-migration=false ipa: ERROR: Major (851968): Unspecified GSS failure. Minor code may provide more information, Minor (2529638972): KDC returned error string: PROCESS_TGS

4 47

2FA not working with OpenVPN Free IPA Integration
by Tinku Goyal 20 Jan '25

20 Jan '25

My setup includes a set of FreeIPA servers running on 4.9.2 version and a OpenVPN configured for the users to connect to VPN. Previously I was using IPA version 4.6.8 on CentOS7 and now installed IPA replica on 4.9.2 on OL8 and decommissioned the old one. I am using openvpn-plugin-auth-pam.so with login pam file to authenticate the IPA users logging in to OpenVPN. when I am resetting the password of users now, then users are not able to login to OpenVPN with 2FA (password+otp) whereas, with otp disabled it is working for old users for whom password is not resetted recently after change in IPA cluster, their authentication is working through OpenVPN with/without OTP both. All users(old + users whose password is resetted recently) are able to login to linux servers using password and OTP both combination, its just not authenticating in OpenVPN. I have tried multiple things but still couldn't able to get it work. Hoping if someone can help with this!!

3 7

Multi-Arch support of freeipa-container images
by Ronald Wimmer 17 Jan '25

17 Jan '25

I've read https://github.com/freeipa/freeipa-container/issues/596#issuecomment-198865… for example. I am wondering if there is any progress here? We are experimenting with K3s clusters on Raspberry Pis (5). It would be great if FreeIPA could run inside a pod on that hardware...

3 3

Migrate freeipa enrolled host to new host
by Ranbir 06 Jan '25

06 Jan '25

Hello Everyone, Can I migrate a freeipa enrolled host, host.domain.tld, to a brand new host with the same name without disrupting services that depend on keytabs on the old host? The keytab files from the old host should just work on the new one as long as the hostnames are exactly the same, right? What I'm unsure about is how to get the new host enrolled without overwriting the old host's kerberos "stuff" in freeipa. Thanks, -- Ranbir

3 2

GetKeytabControl extended operation
by Yuriy Halytskyy 02 Jan '25

02 Jan '25

Hi, and Happy New Year! I am trying to request service and host keytabs programmatically. The idea is to create terraform data source with Go, but I am also experimenting with python because it has good ASN1 support. There are already several terraform providers for IPA but they all use RPC only and there does not appear to be an RPC call to get a keytab. This looks like straightforward extended operation in ldap: https://github.com/freeipa/freeipa/blob/3a5ce9cb2af362d97d598f2198cbc20c4c3… The reply I am supposed to receive is: GKReply ::= SEQUENCE { newkvno Int32, keys SEQUENCE OF KrbKey } So I send GKCurrentKeys message, but the reply is interpreted as LDAP controls both by python and Go ldap libraries? Which doesn't make any sense to me because controls are supposedly part of ldap request, not ldap response, but I don't know much about ldap. This is what I get in python after sending a request for host/ipa.example.test(a)IPA.EXAMPLE.TEST Request message is: >>LDAPMessage: >> messageID=30 >> protocolOp=ProtocolOp: >> extendedReq=ExtendedRequest: >> requestName=2.16.840.1.113730.3.8.10.5 >> requestValue=0xa11b3019a0170415686f73742f6970612e6578616d706c652e74657374 Result message: <<{'controls': [(0, << True, << 16, << [(0, False, 4, b'2.16.840.1.113730.3.8.10.5'), << (0, << False, << 4, << b'\xa2\x81\xf30\x81\xf0\x02\x01\x020\x81\xea0-\xa0+0)\xa0\x03' << b'\x02\x01\x12\xa1"\x04 R%\xb2\xec\x13=g\xc9J\xad\x07\xbf\x14' << b'\x83\xac\xccg\xa4w\xfcV\xd8\x90#\x1a%s\xe7\xd8\xb0G\x9c0' << b'\x1d\xa0\x1b0\x19\xa0\x03\x02\x01\x11\xa1\x12\x04\x10\xf7k' << b'\x90\x84-\xf0\xa9\x02\xbf\xa5H\xdb\xfe\xa0\x94y0\x1d' << b'\xa0\x1b0\x19\xa0\x03\x02\x01\x13\xa1\x12\x04\x10MOX' << b'\x0e\xae\xed\x95_\xba\xe7\xaa\xcd?C7\x050-\xa0+0)\xa0' << b'\x03\x02\x01\x14\xa1"\x04 \xd5]6\xe4\xf6D\x96#i\xa6\x9fX' << b"\x93\xd7\xf3\x03\xc9f\xb5'\x022z\x93WZ\xb2\x8c\xe5rW\x0f" << b'0\x1d\xa0\x1b0\x19\xa0\x03\x02\x01\x19\xa1\x12\x04\x10<' << b'|\x84\xdd"\x9cl\xed\x01\xdb\xc7\xbe\xd2\xbfg\xbe0-\xa0+0' << b')\xa0\x03\x02\x01\x1a\xa1"\x04 \xf6.\xd9/\xae\xf8\xc3j4\x03' << b'\n\x12?\xb4%!\x10+&]\xae\xad\xb5\x07\xf7f\xc6\x93\xb1\xcb' << b'L\x96')])], << 'messageID': 30, << 'payload': [(0, False, 10, 0), (0, False, 4, b''), (0, False, 4, b'')], << 'protocolOp': 24} The payload is just 4 bytes... That bit blob in controls is valid keytab list and I can decode it using asn1 definitions from >>> c.result['controls']['2.16.840.1.113730.3.8.10.5'].values().mapping['value'] b'\xa2\x81\xf30\x81\xf0\x02\x01\x020\x81\xea0-\xa0+0)\xa0\x03\x02\x01\x12\xa1"\x04 R%\xb2\xec\x13=g\xc9J\xad\x07\xbf\x14\x83\xac\xccg\xa4w\xfcV\xd8\x90#\x1a%s\xe7\xd8\xb0G\x9c0\x1d\xa0\x1b0\x19\xa0\x03\x02\x01\x11\xa1\x12\x04\x10\xf7k\x90\x84-\xf0\xa9\x02\xbf\xa5H\xdb\xfe\xa0\x94y0\x1d\xa0\x1b0\x19\xa0\x03\x02\x01\x13\xa1\x12\x04\x10MOX\x0e\xae\xed\x95_\xba\xe7\xaa\xcd?C7\x050-\xa0+0)\xa0\x03\x02\x01\x14\xa1"\x04 \xd5]6\xe4\xf6D\x96#i\xa6\x9fX\x93\xd7\xf3\x03\xc9f\xb5\'\x022z\x93WZ\xb2\x8c\xe5rW\x0f0\x1d\xa0\x1b0\x19\xa0\x03\x02\x01\x19\xa1\x12\x04\x10<|\x84\xdd"\x9cl\xed\x01\xdb\xc7\xbe\xd2\xbfg\xbe0-\xa0+0)\xa0\x03\x02\x01\x1a\xa1"\x04 \xf6.\xd9/\xae\xf8\xc3j4\x03\n\x12?\xb4%!\x10+&]\xae\xad\xb5\x07\xf7f\xc6\x93\xb1\xcbL\x96' Go produces similar result. This is what the response looks like: LDAP Response: (Universal, Constructed, Sequence and Sequence of) Len=297 "<nil>" Message ID: (Universal, Primitive, Integer) Len=1 "2" Extended Response: (Application, Constructed, 0x18) Len=7 "<nil>" (Universal, Primitive, Enumerated) Len=1 "0" (Universal, Primitive, Octet String) Len=0 "" (Universal, Primitive, Octet String) Len=0 "" (Context, Constructed, 0x00) Len=281 "<nil>" (Universal, Constructed, Sequence and Sequence of) Len=277 "<nil>" (Universal, Primitive, Octet String) Len=26 "2.16.840.1.113730.3.8.10.5" (Universal, Primitive, Octet String) Len=246 "\xa2\x81\xf30\x81\xf0\x02\x01\x020\x81\xea0-\xa0+0)\xa0\x03\x02\x01\x12\xa1\"\x04 R%\xb2\xec\x13=g\xc9J\xad\a\xbf\x14\x83\xac\xccg\xa4w\xfcVؐ#\x1a%s\xe7ذG\x9c0\x1d\xa0\x1b0\x19\xa0\x03\x02\x01\x11\xa1\x12\x04\x10\xf7k\x90\x84-\xf0\xa9\x02\xbf\xa5H\xdb\xfe\xa0\x94y0\x1d\xa0\x1b0\x19\xa0\x03\x02\x01\x13\xa1\x12\x04\x10MOX\x0e\xae\xed\x95_\xba\xe7\xaa\xcd?C7\x050-\xa0+0)\xa0\x03\x02\x01\x14\xa1\"\x04 \xd5]6\xe4\xf6D\x96#i\xa6\x9fX\x93\xd7\xf3\x03\xc9f\xb5'\x022z\x93WZ\xb2\x8c\xe5rW\x0f0\x1d\xa0\x1b0\x19\xa0\x03\x02\x01\x19\xa1\x12\x04\x10<|\x84\xdd\"\x9cl\xed\x01\xdbǾҿg\xbe0-\xa0+0)\xa0\x03\x02\x01\x1a\xa1\"\x04 \xf6.\xd9/\xae\xf8\xc3j4\x03\n\x12?\xb4%!\x10+&]\xae\xad\xb5\a\xf7fƓ\xb1\xcbL\x96" Again, the extended response is just 4 bytes of nothing, and the actual result is provided after that and Go is confused (and so am I). [root@ipa /]# ipa --version VERSION: 4.11.0, API_VERSION: 2.253 Is there a bug here, or does this work as intended? Cheers, Yuriy

2 6

Directory server disk being hammered with writes and constantly growing database
by Brian J. Murrell 31 Dec '24

31 Dec '24

Hi. I am running FreeIPA on (fully up-to-date) EL8 and am experiencing really heavy constant writes to the (/var/lib/)dirsrv database disk: 12:00:01 AM tps rkB/s wkB/s dkB/s areq-sz aqu-sz await %util DEV 01:00:01 AM 774.16 401.09 7371.63 0.00 10.04 0.78 1.01 39.59 var_lib_dirsrv 02:00:00 AM 511.07 0.14 4896.57 0.00 9.58 0.51 1.00 26.06 var_lib_dirsrv 03:00:00 AM 501.74 0.50 4807.00 0.00 9.58 0.50 1.00 25.54 var_lib_dirsrv 04:00:00 AM 497.64 0.07 4771.83 0.00 9.59 0.50 1.00 25.43 var_lib_dirsrv 05:00:00 AM 442.64 0.14 4241.13 0.00 9.58 0.44 0.98 22.34 var_lib_dirsrv 06:00:00 AM 487.64 0.96 4676.10 0.00 9.59 0.48 0.99 24.92 var_lib_dirsrv 07:00:00 AM 474.65 0.14 4558.98 0.00 9.61 0.48 1.00 24.32 var_lib_dirsrv 08:00:00 AM 534.18 0.81 5137.36 0.00 9.62 0.54 1.01 27.59 var_lib_dirsrv 09:00:00 AM 574.34 0.43 5537.93 0.00 9.64 0.58 1.00 29.52 var_lib_dirsrv 10:00:00 AM 672.95 0.43 6501.68 0.00 9.66 0.67 0.99 34.12 var_lib_dirsrv 11:00:00 AM 749.18 0.82 7250.97 0.00 9.68 0.75 1.00 38.38 var_lib_dirsrv 12:00:00 PM 958.57 1.05 9296.95 0.00 9.70 0.95 0.99 48.60 var_lib_dirsrv 01:00:00 PM 1003.80 0.80 9743.29 0.00 9.71 0.99 0.99 51.09 var_lib_dirsrv 02:00:01 PM 567.52 1.34 5508.37 0.00 9.71 0.57 1.01 29.40 var_lib_dirsrv 03:00:01 PM 514.13 0.16 5006.66 0.00 9.74 0.52 1.01 26.71 var_lib_dirsrv 04:00:00 PM 515.12 0.34 5025.29 0.00 9.76 0.51 1.00 26.49 var_lib_dirsrv 05:00:01 PM 514.74 0.03 5034.02 0.00 9.78 0.52 1.00 26.56 var_lib_dirsrv 06:00:01 PM 490.61 0.04 4809.68 0.00 9.80 0.49 1.00 25.29 var_lib_dirsrv 07:00:00 PM 513.17 0.02 5034.52 0.00 9.81 0.52 1.00 26.81 var_lib_dirsrv 08:00:00 PM 506.14 0.00 4964.79 0.00 9.81 0.50 1.00 25.99 var_lib_dirsrv 09:00:01 PM 503.88 0.05 4943.89 0.00 9.81 0.50 1.00 25.89 var_lib_dirsrv 10:00:01 PM 509.54 0.02 5004.35 0.00 9.82 0.51 1.00 26.35 var_lib_dirsrv 11:00:01 PM 498.23 0.02 4893.29 0.00 9.82 0.50 1.00 25.78 var_lib_dirsrv Average: 578.94 17.80 5609.40 0.00 9.72 0.58 1.00 29.68 var_lib_dirsrv As you can see it's a pretty constant 5MB/s write bandwidth. That disk is just the database, no log files, etc. The files most frequently being written to are: -rw-------. 1 dirsrv dirsrv 37347328 Dec 12 09:54 /var/lib/dirsrv/slapd-EXAMPLE-COM/db/userRoot/id2entry.db -rw-------. 1 dirsrv dirsrv 2744320 Dec 12 09:54 /var/lib/dirsrv/slapd-EXAMPLE-COM/db/userRoot/entryusn.db -rw-------. 1 dirsrv dirsrv 2646016 Dec 12 09:54 /var/lib/dirsrv/slapd-EXAMPLE-COM/db/ipaca/id2entry.db -rw-------. 1 dirsrv dirsrv 16384 Dec 12 09:54 /var/lib/dirsrv/slapd-EXAMPLE-COM/db/ipaca/entryusn.db -rw-------. 1 dirsrv dirsrv 1109262336 Dec 12 09:54 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 14745600 Dec 12 09:54 /var/lib/dirsrv/slapd-EXAMPLE-COM/db/__db.001 -rw-------. 1 dirsrv dirsrv 104949064 Dec 12 09:54 /var/lib/dirsrv/slapd-EXAMPLE-COM/db/__db.003 -rw-------. 1 dirsrv dirsrv 10485760 Dec 12 09:54 /var/lib/dirsrv/slapd-EXAMPLE-COM/db/log.0000005162 -rw-------. 1 dirsrv dirsrv 57999360 Dec 12 09:54 /var/lib/dirsrv/slapd-EXAMPLE-COM/db/__db.002 And the main database files themselves have just continually grown over time: -rw-------. 1 dirsrv dirsrv 121634816 Aug 27 2022 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 144097280 Nov 3 2022 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 166150144 Dec 3 2022 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 174202880 Dec 17 2022 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 187965440 Jan 20 2023 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 202571776 Feb 17 2023 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 247570432 May 12 2023 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 262955008 Jun 10 2023 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 279224320 Jul 8 2023 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 293167104 Aug 5 2023 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 304029696 Aug 26 2023 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 318144512 Sep 30 2023 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 337469440 Nov 4 2023 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 364732416 Dec 8 2023 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 396328960 Jan 12 2024 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 410517504 Feb 8 2024 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 418586624 Feb 22 2024 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 456179712 Mar 15 2024 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 485425152 Apr 7 2024 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 562569216 May 28 2024 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 612147200 Aug 18 02:42 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 639762432 Aug 31 01:53 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 662282240 Sep 6 01:51 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 695541760 Sep 14 04:18 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 715882496 Sep 21 02:33 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 731496448 Sep 28 02:10 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 761552896 Oct 13 02:18 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 778076160 Oct 20 01:18 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 794820608 Oct 27 01:46 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 809304064 Nov 2 03:36 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 822583296 Nov 7 08:36 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 844079104 Nov 10 01:21 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 848076800 Nov 11 01:40 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 857710592 Nov 12 01:53 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 867352576 Nov 13 01:58 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 876568576 Nov 14 01:11 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 888070144 Nov 15 03:31 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 898465792 Nov 16 04:08 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 907616256 Nov 17 02:07 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 916480000 Nov 18 01:46 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 926220288 Nov 19 01:50 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 935952384 Nov 20 01:38 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 945872896 Nov 21 01:44 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 955441152 Nov 22 01:31 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 963747840 Nov 23 01:59 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 972324864 Nov 24 01:27 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 980189184 Nov 25 00:57 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 988086272 Nov 26 00:58 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 995680256 Nov 27 01:26 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 1003315200 Nov 28 01:25 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 1010884608 Nov 29 01:53 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 1021444096 Nov 30 01:47 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 1027997696 Dec 1 01:58 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 1036558336 Dec 2 02:10 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 1068269568 Dec 6 03:23 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 1073307648 Dec 7 01:33 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 1082449920 Dec 8 11:02 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 1088061440 Dec 9 09:06 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 1092091904 Dec 10 01:01 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 1098244096 Dec 11 00:50 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 1105944576 Dec 12 00:44 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db Should the directory server really need to sustain 5MB/s of write 24/7? Should the database file(s) have this kind of constant growth model or is there some pruning that should be getting done? Could these two issues be related? Cheers, b.

4 13

Two-way trusts and AD Linux client.
by Aleksandr Sabirov 31 Dec '24

31 Dec '24

Hello, Suppose we have: Machine - with the full name ws16.ad16.loc - MS AD. Windows Server 2016 Machine - with the full name ipasrv-1.ipadomain.loc - IdM AD version 4.8.10. Linux Debian Machine - with the full name adclient-1.ad16.loc - AD Client. Linux Debian Bidirectional trust relationships between IPA and AD are configured. The third machine is joined to the AD domain using sssd 2.4.0. Can I somehow authenticate on the AD client (third machine) using IdM users via the bidirectional trust relationships? That is, I don't mean the case where we make the AD client partially integrated into IdM by adding settings in sssd.conf for the second domain ([domain/ipadomain.loc]) and updating krb5.keytab. I mean, how can I make it so that the request goes specifically through AD (i.e., via the trust relationships) and not directly to IdM? And is this possible? Thanks.

4 16

Creating_a_binddn_for_Foreman
by Dirk Streubel 24 Dec '24

24 Dec '24

Hello everbody, i want to create a bindddb for Foreman and i find this documentation: https://www.freeipa.org/page/Creating_a_binddn_for_Foreman So i make a file with thid contents: root@ipa9:~# cat foreman-binddn.update dn: uid=foreman,cn=sysaccounts,cn=etc,dc=linux,dc=schnell,dc=er default:objectclass:account default:objectclass:simplesecurityobject default:uid:foreman only:userPassword:Test123$ only:nsIdleTimeout:0 After this i make : ipa-ldap-updater foreman-binddn.update and the result ist this: 2024-12-23T12:23:09Z DEBUG flushing ldapi://%2Frun%2Fslapd-LINUX-SCHNELL-ER.socket from SchemaCache 2024-12-23T12:23:09Z DEBUG retrieving schema for SchemaCache url=ldapi://%2Frun%2Fslapd-LINUX-SCHNELL-ER.socket conn=<ldap.ldapobject.SimpleLDAPObject object at 0x 9f55e50> 2024-12-23T12:23:09Z DEBUG Parsing update file 'foreman-binddn.update' 2024-12-23T12:23:09Z DEBUG Destroyed connection context.ldap2_281472470150800 2024-12-23T12:23:09Z DEBUG File "/usr/lib/python3.13/site-packages/ipapython/admintool.py", line 180, in execute return_value = self.run() File "/usr/lib/python3.13/site-packages/ipaserver/install/ipa_ldap_updater.py", line 150, in run modified = ld.update(self.files) or modified ~~~~~~~~~^^^^^^^^^^^^ File "/usr/lib/python3.13/site-packages/ipaserver/install/ldapupdate.py", line 1040, in update self.parse_update_file(f, data, all_updates) ~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^ File "/usr/lib/python3.13/site-packages/ipaserver/install/ldapupdate.py", line 596, in parse_update_file emit_item(logical_line) ~~~~~~~~~^^^^^^^^^^^^^^ File "/usr/lib/python3.13/site-packages/ipaserver/install/ldapupdate.py", line 446, in emit_item logical_line = self._template_str(logical_line) File "/usr/lib/python3.13/site-packages/ipaserver/install/ldapupdate.py", line 409, in _template_str return ipautil.template_str(s, self.sub_dict) ~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^ File "/usr/lib/python3.13/site-packages/ipapython/ipautil.py", line 303, in template_str val = string.Template(txt).substitute(vars) File "/usr/lib64/python3.13/string.py", line 121, in substitute return self.pattern.sub(convert, self.template) ~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^ File "/usr/lib64/python3.13/string.py", line 118, in convert self._invalid(mo) ~~~~~~~~~~~~~^^^^ File "/usr/lib64/python3.13/string.py", line 101, in _invalid raise ValueError('Invalid placeholder in string: line %d, col %d' % (lineno, colno)) 2024-12-23T12:23:09Z DEBUG The ipa-ldap-updater command failed, exception: ValueError: Invalid placeholder in string: line 1, col 26 2024-12-23T12:23:09Z ERROR Unexpected error - see /var/log/ipaupgrade.log for details: ValueError: Invalid placeholder in string: line 1, col 26 2024-12-23T12:23:09Z ERROR The ipa-ldap-updater command failed. See /var/log/ipaupgrade.log for more information In the documentation there is $Suffix and only:passwordExpirationTime:20380119031407Z, with these options or without the result is same Any ideas what i am doing wrong? Regards Dirk

2 2

freeipa + freeradius = kerberos ticket issue
by Fiodor Cibulin 23 Dec '24

23 Dec '24

Hi all. I would like your help to fix next issue What we need. We configured freeradius server to use it as authentication method for freeipa users. When we use option password (I mean password configured in ipa server itself) everything works. If we change authentication method to RADIUS we have next problems. User password on ipa client not cached. So if users go home with laptop and have no access to ipa server they can't log in to their ubuntu. Behavior on ipa server: User with local password # kinit local-user Password for local-user(a)OUR.DOMAIN.COM: It works krb5kdc.log ec 11 17:57:23 our.domain.com krb5kdc[1571](info): AS_REQ (4 etypes {aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19), aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17)}) 10.41.100.15: NEEDED_PREAUTH: local-user(a)OUR.DOMAIN.COM for krbtgt/OUR.DOMAIN.COM(a)OUR.DOMAIN.COM, Additional pre-authentication required Dec 11 17:57:23 our.domain.com krb5kdc[1571](info): closing down fd 11 Rows below after enter password Dec 11 17:58:17 our.domain.com krb5kdc[1571](info): AS_REQ (4 etypes {aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19), aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17)}) 10.41.100.15: ISSUE: authtime 1733932697, etypes {rep=aes256-cts-hmac-sha384-192(20), tkt=aes256-cts-hmac-sha384-192(20), ses=aes256-cts-hmac-sha384-192(20)}, local-user(a)OUR.DOMAIN.COM for krbtgt/OUR.DOMAIN.COM(a)OUR.DOMAIN.COM Dec 11 17:58:17 our.domain.com krb5kdc[1571](info): closing down fd 11 RADIUS user # kinit radius-user kinit: Pre-authentication failed: Invalid argument while getting initial credentials So ticket not created krb5kdc.log Dec 11 18:04:26 our.domain.com krb5kdc[1571](info): AS_REQ (4 etypes {aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19), aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17)}) 10.41.100.15: NEEDED_PREAUTH: radius-user(a)OUR.DOMAIN.COM for krbtgt/OUR.DOMAIN.COM(a)OUR.DOMAIN.COM, Additional pre-authentication required Dec 11 18:04:26 our.domain.com krb5kdc[1571](info): closing down fd 11 Additional strange behaviour. If i try to log in to ipa server via ssh with local user it asks me password. If I try to log in to ipa server with radius user it asks me first factor and second factor. it accepts password for the first factor and empty 2nd factor. And let's me log-in. Thank you in advance. I can provide any additional info

2 1

2025

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users December 2024