ipa-healthcheck Error - how to remove an old replica in pki DB ?
by Kathy Zhu
Hi Team,
We are migrating from Centos 7 IPA to Red Hat 8.6. After adding the first
Red Hat master, it reported error:
# ipa-healthcheck
--source=pki.server.healthcheck.clones.connectivity_and_data
Internal server error HTTPSConnectionPool(host='ipa4.example.com',
port=443): Max retries exceeded with url: /ca/rest/certs/search?size=3
(Caused by NewConnectionError('<urllib3.connection.VerifiedHTTPSConnection
object at 0x7f0611b6d5c0>: Failed to establish a new connection: [Errno -2]
Name or service not known',))
[
{
"source": "pki.server.healthcheck.clones.connectivity_and_data",
"check": "ClonesConnectivyAndDataCheck",
"result": "ERROR",
"uuid": "bfb9aeac-2e86-4d1d-ac2a-3cb62300527e",
"when": "20220711221016Z",
"duration": "0.768881",
"kw": {
"status": "ERROR: pki-tomcat : Internal error testing CA clone.
Host: ipa4.example.com Port: 443"
}
}
]
#
ipa4 was a master we had years ago. it did not show up as a dangling master
in the domain. However, it remains in pki DB. How to safely clean it out
from pki DB?
Another interesting fact I like to point out - Centos 7 ipa-healthcheck
does not report this.
Thanks!
Kathy.
1 year, 10 months
Re: ipa-healthcheck errors...
by Eric Ashley
> > On Friday, July 8th, 2022 at 1:02 PM, Rob Crittenden rcritten(a)redhat.com wrote:
> >
> > > Not sure what you mean by "wire traffic". It's a vault so perhaps you
> > > stored some keys there. IPA already encrypts all its own internal traffic.
> >
> > When I first installed FreeIPA it did not yet default to encrypted traffic for all accesses.
>
>
> Can you expand on this? Literally all the KRA does is store secrets. It
> does not protect traffic unless you manually use those secrets to do so.
>
Sorry for muddling my description. I was attempting to only show relative time frames. At about the same time, I was making changes to get wire traffic encrypted and ALSO thinking of switching some of my libvirt VMs to containers, which would require shared vaults. I made my changes for encrypted traffic about 6 weeks before the release that heralded all traffic being encrypted by default. KRA was installed but no vaults actually deployed since I decided to stick with VMs for now.
> There are URI records like:
>
> kpasswd.example.test. 3600 IN URI 0 100 "krb5srv:m:tcp:ipa.example.test."
Thanks.
> > The word match for 'secret=(\w+)$' fails if the first character of the secret isn't alphanumeric. It would incorrectly handle a secret with embedded special characters, though I don't think it would trigger an error, except when the initial alphanumeric portion of the secret was in fact different.
>
>
> Ok yeah, bad regex.
Reported at https://github.com/freeipa/freeipa-healthcheck/issues/275
Best regards,
Eric
1 year, 11 months
ipa-healthcheck errors...
by Eric Ashley
Hello,
I installed FreeIPA version 4.8.7-1.fc32.x86_64 on 24 July 2020. I've
since kept current with the Fedora release channels, up to
4.9.10-1.fc36. I don't have any Windoze AD domains configured, just
FreeIPA. I followed the steps to enable KRA back when it seemed to be
required to force encryption of all wire traffic. I'm sure that I must
have missed some steps, though everything seems to be working correctly.
I've checked the list archive and can't see any instances that are
related to the issues ipa-healthcheck reports. ipa-healthcheck reports
the following:
[
{
"source": "ipahealthcheck.ipa.idns",
"check": "IPADNSSystemRecordsCheck",
"result": "WARNING",
"uuid": "432017b9-ef12-44a5-8843-35fd6424d85f",
"when": "20220708144958Z",
"duration": "0.031444",
"kw": {
"msg": "Expected URI record missing",
"key":
"_kerberos.ipa.example.com.:krb5srv:m:tcp:ipaserv.ipa.example.com."
}
},
{
"source": "ipahealthcheck.ipa.idns",
"check": "IPADNSSystemRecordsCheck",
"result": "WARNING",
"uuid": "498649c8-1460-4f34-807b-1b06c08f3aec",
"when": "20220708144958Z",
"duration": "0.031469",
"kw": {
"msg": "Expected URI record missing",
"key":
"_kerberos.ipa.example.com.:krb5srv:m:udp:ipaserv.ipa.example.com."
}
},
{
"source": "ipahealthcheck.ipa.idns",
"check": "IPADNSSystemRecordsCheck",
"result": "WARNING",
"uuid": "3a6c7f80-3ce9-4ba0-b821-d731eb6929a3",
"when": "20220708144958Z",
"duration": "0.033407",
"kw": {
"msg": "Expected URI record missing",
"key":
"_kpasswd.ipa.example.com.:krb5srv:m:tcp:ipaserv.ipa.example.com."
}
},
{
"source": "ipahealthcheck.ipa.proxy",
"check": "IPAProxySecretCheck",
"result": "CRITICAL",
"uuid": "6820b5b3-08a9-4632-a834-a71d1ae0d84b",
"when": "20220708144958Z",
"duration": "0.000894",
"kw": {
"key": "proxy_secrets",
"proxy_conf": "/etc/httpd/conf.d/ipa-pki-proxy.conf",
"msg": "No ProxyPassMatch secrets found in {proxy_conf}"
}
},
{
"source": "pki.server.healthcheck.meta.csconfig",
"check": "KRADogtagCertsConfigCheck",
"result": "ERROR",
"uuid": "1978555c-72d6-47af-8a21-de3967002eca",
"when": "20220708145007Z",
"duration": "0.065948",
"kw": {
"key": "kra_sslserver",
"nickname": "Server-Cert cert-pki-ca",
"directive": "kra.sslserver.cert",
"configfile": "/var/lib/pki/pki-tomcat/kra/conf/CS.cfg",
"msg": "Certificate 'Server-Cert cert-pki-ca' does not match the
value of kra.sslserver.cert in /var/lib/pki/pki-tomcat/kra/conf/CS.cfg"
}
},
{
"source": "pki.server.healthcheck.meta.csconfig",
"check": "KRADogtagCertsConfigCheck",
"result": "ERROR",
"uuid": "cbf470d2-0d58-4c24-aba0-8a62cc399ffe",
"when": "20220708145007Z",
"duration": "0.114728",
"kw": {
"key": "kra_subsystem",
"nickname": "subsystemCert cert-pki-ca",
"directive": "kra.subsystem.cert",
"configfile": "/var/lib/pki/pki-tomcat/kra/conf/CS.cfg",
"msg": "Certificate 'subsystemCert cert-pki-ca' does not match
the value of kra.subsystem.cert in /var/lib/pki/pki-tomcat/kra/conf/CS.cfg"
}
}
]
Some pointers on how to fix these would be greatly appreciated.
Best regards,
Eric
1 year, 11 months
MasterCRL.bin URL
by IPA Listmail
Is there a way, either during ipa-server-install or after to modify the URL
to the CRL? I've seen some things that looked promising, but still didn't
pan out regarding editing the
policyset.serverCertSet.9.default.params.crlDistPointsPointName_0 parameter
as well as setting the IPA_SERVER_HOSTNAME env var before installing.
Thanks!
1 year, 11 months
ipa-healthcheck errors, CADogtagCertsConfigCheck and IPADogtagCertsMatchCheck
by Ivars Strazdins
Hi guys,
after upgrading FreeIPA from 4.6.8 to 4.9.8 I was able to run ipa-healthcheck for the first time.
Now I am facing two errors:
# ipa-healthcheck
Unhandler rdtype 256
Unhandler rdtype 256
Unhandler rdtype 256
Unhandler rdtype 256
Unhandler rdtype 256
Unhandler rdtype 256
Unhandler rdtype 256
Unhandler rdtype 256
[
{
"source": "pki.server.healthcheck.meta.csconfig",
"check": "CADogtagCertsConfigCheck",
"result": "ERROR",
"uuid": "92710f34-de94-4226-a81c-3e1d116c6410",
"when": "20220707130401Z",
"duration": "0.324141",
"kw": {
"key": "ca_signing",
"nickname": "caSigningCert cert-pki-ca",
"directive": "ca.signing.cert",
"configfile": "/var/lib/pki/pki-tomcat/ca/conf/CS.cfg",
"msg": "Certificate 'caSigningCert cert-pki-ca' does not match the value of ca.signing.cert in /var/lib/pki/pki-tomcat/ca/conf/CS.cfg"
}
},
{
"source": "ipahealthcheck.ipa.certs",
"check": "IPADogtagCertsMatchCheck",
"result": "ERROR",
"uuid": "b26ad134-e798-4e21-961a-bc17899ac267",
"when": "20220707130408Z",
"duration": "0.162734",
"kw": {
"key": "caSigningCert cert-pki-ca",
"nickname": "caSigningCert cert-pki-ca",
"dbdir": "/etc/pki/pki-tomcat/alias",
"msg": "{nickname} certificate in NSS DB {dbdir} does not match entry in LDAP"
}
}
]
certutil output is:
# certutil -L -d /etc/pki/pki-tomcat/alias/
Certificate Nickname Trust Attributes
SSL,S/MIME,JAR/XPI
CN=ISRG Root X1,O=Internet Security Research Group,C=US C,,
CN=ISRG Root X2,O=Internet Security Research Group,C=US C,,
CN=R3,O=Let's Encrypt,C=US C,,
CN=E1,O=Let's Encrypt,C=US C,,
CN=R4,O=Let's Encrypt,C=US C,,
CN=E2,O=Let's Encrypt,C=US C,,
caSigningCert cert-pki-ca CTu,Cu,Cu
ocspSigningCert cert-pki-ca u,u,u
auditSigningCert cert-pki-ca u,u,Pu
subsystemCert cert-pki-ca u,u,u
EXAMPLE.COM IPA CA CTu,Cu,Cu
Server-Cert cert-pki-ca u,u,u
How do I fix these errors?
To explain above Letsencrypt certificates - our IPA servers Directory server and Apache server use Letsencrypt certificates that have been added to FreeIPA with command “ipa-server-certinstall -w -d ..."
Thank you in advance for your time.
Ivars
1 year, 11 months
iPA-cacert-manage renew --external-ca Failed
by roy liang
> roy liang via FreeIPA-users wrote:
>
> Take below with a grain of salt. There be dragons. I did not try this
> myself.
>
> What I'd suggest is you pick a different IPA server to start with. I
> think this Ubuntu host is a lost cause. IIRC you have several
> Fedora/CentOS/RHEL replicas as well. You want one without the CA on it.
>
At present, Freeipa is all deployed on Ubuntu 16.04 by Zheng, which is left over by the company and cannot be changed.Now I cannot copy new nodes and upgrade because the certificate has expired. I have given up repairing the expired certificate, because I have tried too many times but failed.Now I have found a quick switching scheme, I don't know whether it is feasible, I hope you can guide it, thank you
1:
I currently generate my self-signed certificate from this document
https://mariadb.com/docs/security/data-in-transit-encryption/create-self-...
2:
Switch the CA certificate installed by default
# ipa-cacert-manage renew --external-ca --external-cert-file /root/new_ca/ca-cert.pem
Importing the renewed CA certificate, please wait
IPA CA certificate not found in /root/new_ca/ca-cert.pem
The ipa-cacert-manage command failed.
# iPA-cacert-manage renew --external-ca --external-cert-file /root/new_ca/ca-cert.pem --external-cert-file/ root/new_ca/ca - key. Pem
Importing the renewed CA certificate, please wait
Failed to load /root/new_ca/ca-key.pem
The ipa-cacert-manage command failed.
How to do this? I am blind now, can you guide the normal command to switch the CA?Thank you very much.
Because according to the documentation here, it should be possible to switch
https://floblanc.wordpress.com/2017/12/05/demystifying-the-certificate-au...
I installed FreeIPA without any embedded CA but I change my mind?
FreeIPA allows to install an embedded CA at a later time, using ipa-ca-install. The tool provides the same options as ipa-server-install: you can either install a self-signed CA or an externally signed CA.
Important: installing an embedded CA with ipa-ca-install does not replace the HTTP and LDAP server certificates. If they were initially delivered by an external CA, they will not be automatically renewed.
1 year, 11 months
How to Delete IPA CA and sub-CA entries
by roy liang
https://www.freeipa.org/page/Using_3rd_part_certificates_for_HTTP/LDAP
I have generated my own CA and CA sub-certificates and successfully added them according to this document. Now I want to remove the previous CA and CA-related sub-certificates in the system. According to the steps in this document, I am currently stuck in this step.
https://frasertweedale.github.io/blog-redhat/posts/2019-10-24-removing-ip...
How do I do that
my linux ubuntu16.04 freeipa4.3
1:
#ldapsearch -Y GSSAPI -QLLL -b cn=masters,cn=ipa,cn=etc,dc=yydevops,dc=com '(cn=CA)'
dn: cn=CA,cn=migration-ipa-65-214.hiido.host.yydevops.com,cn=masters,cn=ipa,cn
=etc,dc=yydevops,dc=com
objectClass: ipaConfigObject
objectClass: nsContainer
objectClass: top
ipaConfigString: enabledService
ipaConfigString: startOrder 50
ipaConfigString: caRenewalMaster
cn: CA
#ldapdelete -Y GSSAPI -Q cn=CA,cn=migration-ipa-65-214.hiido.host.yydevops.com,cn=masters,cn=ipa,cn=etc,dc=yydevops,dc=com
2：
#ldapsearch -h localhost -p 389 -D cn="directory manager" -w directorypassxx -b cn=certificates,cn=ipa,cn=etc,dc=yydevops,dc=com | grep ^dn:
dn: cn=certificates,cn=ipa,cn=etc,dc=yydevops,dc=com
dn: cn=YYDEVOPS.COM IPA CA,cn=certificates,cn=ipa,cn=etc,dc=yydevops,dc=com
dn: cn=newca,cn=certificates,cn=ipa,cn=etc,dc=yydevops,dc=com
ldapdelete -Y GSSAPI -Q "cn=YYDEVOPS.COM IPA CA,cn=certificates,cn=ipa,cn=etc,dc=yydevops,dc=com"
3：
# certutil -d /etc/dirsrv/slapd-YYDEVOPS-COM/ -L
Certificate Nickname Trust Attributes
SSL,S/MIME,JAR/XPI
newca u,u,u
YYDEVOPS.COM IPA CA CT,C,C
newca C,,
#certutil -d /etc/dirsrv/slapd-YYDEVOPS-COM/ -D -n 'YYDEVOPS.COM IPA CA'
#certutil -d /etc/ipa/nssdb -D -n 'YYDEVOPS.COM IPA CA'
4：
#ldapsearch -Y GSSAPI -QLLL -b dc=yydevops,dc=com '(objectclass=ipaca)' 1.1
I can't find any iPACA entry certificate here, why?How do I delete the original sub-ca entries for this system
5：
Are the entries in ipacaACL sub-ca entries? Can I delete this entry? ipaca and ipacaacl Will it make any difference?
root@migration-ipa-65-214:~/new_ca# ldapsearch -Y GSSAPI -QLLL -b dc=yydevops,dc=com | grep ipaca
ipaReplTopoManagedSuffix: o=ipaca
objectClass: ipacaacl
ipaReplTopoConfRoot: o=ipaca
ipaPermTargetFilter: (objectclass=ipacaacl)
ipaPermTargetFilter: (objectclass=ipacaacl)
ipaPermTargetFilter: (objectclass=ipacaacl)
ipaPermDefaultAttr: ipacacategory
ipaPermTargetFilter: (objectclass=ipacaacl)
ipaPermTargetFilter: (objectclass=ipacaacl)
ipaPermDefaultAttr: ipacacategory
root@migration-ipa-65-214:~/new_ca# ldapsearch -Y GSSAPI -QLLL -b dc=yydevops,dc=com '(objectclass=ipacaacl)' 1.1
dn: ipaUniqueID=05c04bac-fc16-11ec-a218-246e967383f8,cn=caacls,cn=ca,dc=yydevo
ps,dc=com
Can I delete this entry?
ldapdelete -Y GSSAPI -Q ipaUniqueID=05c04bac-fc16-11ec-a218-246e967383f8,cn=caacls,cn=ca,dc=yydevo
If not, how do I delete sub-ca entries? request guidance, thank you very much
1 year, 11 months
Assign workstation to user
by Joyce Babu
Currently I am creating a new HBAC rule for each user to grant login access to their work station.
Is there an easier method to do this by adding their workstation hostname to a custom attribute?
1 year, 11 months
SSSD Problem after update
by Ronald Wimmer
Today I updated all packages on one of our IPA servers. Unfortunately,
SSSD stopped working:
[sssd] [main] (0x0010): SSSD couldn't load the configuration database.
[sssd] [ldb] (0x0020): Unable to open tdb '/var/lib/sss/db/config.ldb':
Permission denied
[sssd] [ldb] (0x0020): Failed to connect to '/var/lib/sss/db/config.ldb'
with backend 'tdb': Unable to open tdb '/var/lib/sss/db/config.ldb':
Permission denied
[sssd] [confdb_init] (0x0010): Unable to open config database
[/var/lib/sss/db/config.ldb]
[sssd] [confdb_setup] (0x0010): The confdb initialization failed [5]:
Input/output error
[sssd] [load_configuration] (0x0010): Unable to setup ConfDB [5]:
Input/output error
I noticed that owner and group of config.ldb are changed to sssd when I
try to restart the sssd.service. On all remaining IPA servers this
particular file belongs to root.
I will revert to the snapshot I made before updating packages in order
to make that IPA server work again properly.
Cheers,
Ronald
1 year, 11 months
SSL Library Error: -12269 The server has rejected your certificate as expired
by roy liang
I deliberately set the server back 2 years, installed Freeipa-Server, and then synchronized the time back.The related service certificate expires.Verify this:https://access.redhat.com/documentation/en-us/red_hat_enterprise_lin...
But it didn't work out.
I confirm my modification:
1:less /etc/apache2/mods-enabled/nss.conf
#add
NSSEnforceValidCerts off
2:root@ipa-test-65-198:/home/liangrui# ldapsearch -h $(hostname) -p 389 -D "cn=directory manager" -w directorypassxx -LLL -b cn=config -s base "(objectclass=*)" nsslapd-validate-cert
dn: cn=config
nsslapd-validate-cert: warn
You have restarted all services and rebooted the server.However, the result is still unable to use the relevant command
root@ipa-test-65-198:/home# ipa user-find
ipa: ERROR: cert validation failed for "CN=ipa-test-65-198.hiido.host.yydevops.com,O=YYDEVOPS.COM" ((SEC_ERROR_EXPIRED_CERTIFICATE) Peer's Certificate has expired.)
ipa: ERROR: cannot connect to 'https://ipa-test-65-198.hiido.host.yydevops.com/ipa/json': (SEC_ERROR_EXPIRED_CERTIFICATE) Peer's Certificate has expired.
What is the reason for this? Do I need to view or configure anything?For guidance, thank you
My system is ubuntu16.04 and freeipa 4.3
/var/log/apache2/error
[Mon Jul 04 17:40:18.464189 2022] [:error] [pid 2942:tid 140680101848832] SSL Library Error: -12269 The server has rejected your certificate as expired
less /var/log/dirsrv/slapd-YYDEVOPS-COM/errors
[04/Jul/2022:17:23:07 +0800] - SSL alert: CERT_VerifyCertificateNow: verify certificate failed for cert Server-Cert of family cn=RSA,cn=encryption,cn=config (Netscape Portable Runtime error -8181 - Peer's Certificate has expired.)
[04/Jul/2022:17:23:07 +0800] SSL Initialization - Configured SSL version range: min: TLS1.0, max: TLS1.2
[04/Jul/2022:17:23:07 +0800] - 389-Directory/1.3.4.9 B2016.109.158 starting up
[04/Jul/2022:17:23:07 +0800] schema-compat-plugin - scheduled schema-compat-plugin tree scan in about 5 seconds after the server startup!
[04/Jul/2022:17:23:07 +0800] NSACLPlugin - The ACL target cn=groups,cn=compat,dc=yydevops,dc=com does not exist
[04/Jul/2022:17:23:07 +0800] NSACLPlugin - The ACL target cn=computers,cn=compat,dc=yydevops,dc=com does not exist
[04/Jul/2022:17:23:08 +0800] NSACLPlugin - The ACL target cn=ng,cn=compat,dc=yydevops,dc=com does not exist
[04/Jul/2022:17:23:08 +0800] NSACLPlugin - The ACL target ou=sudoers,dc=yydevops,dc=com does not exist
[04/Jul/2022:17:23:08 +0800] NSACLPlugin - The ACL target cn=users,cn=compat,dc=yydevops,dc=com does not exist
[04/Jul/2022:17:23:08 +0800] NSACLPlugin - The ACL target cn=vaults,cn=kra,dc=yydevops,dc=com does not exist
[04/Jul/2022:17:23:08 +0800] NSACLPlugin - The ACL target cn=vaults,cn=kra,dc=yydevops,dc=com does not exist
[04/Jul/2022:17:23:08 +0800] NSACLPlugin - The ACL target cn=vaults,cn=kra,dc=yydevops,dc=com does not exist
[04/Jul/2022:17:23:08 +0800] NSACLPlugin - The ACL target cn=vaults,cn=kra,dc=yydevops,dc=com does not exist
[04/Jul/2022:17:23:08 +0800] NSACLPlugin - The ACL target cn=vaults,cn=kra,dc=yydevops,dc=com does not exist
[04/Jul/2022:17:23:08 +0800] NSACLPlugin - The ACL target cn=vaults,cn=kra,dc=yydevops,dc=com does not exist
[04/Jul/2022:17:23:08 +0800] NSACLPlugin - The ACL target cn=vaults,cn=kra,dc=yydevops,dc=com does not exist
[04/Jul/2022:17:23:08 +0800] NSACLPlugin - The ACL target cn=vaults,cn=kra,dc=yydevops,dc=com does not exist
[04/Jul/2022:17:23:08 +0800] NSACLPlugin - The ACL target cn=vaults,cn=kra,dc=yydevops,dc=com does not exist
[04/Jul/2022:17:23:08 +0800] NSACLPlugin - The ACL target cn=vaults,cn=kra,dc=yydevops,dc=com does not exist
[04/Jul/2022:17:23:08 +0800] NSACLPlugin - The ACL target cn=vaults,cn=kra,dc=yydevops,dc=com does not exist
[04/Jul/2022:17:23:08 +0800] NSACLPlugin - The ACL target cn=ad,cn=etc,dc=yydevops,dc=com does not exist
[04/Jul/2022:17:23:08 +0800] NSACLPlugin - The ACL target cn=casigningcert cert-pki-ca,cn=ca_renewal,cn=ipa,cn=etc,dc=yydevops,dc=com does not exist
[04/Jul/2022:17:23:08 +0800] NSACLPlugin - The ACL target cn=casigningcert cert-pki-ca,cn=ca_renewal,cn=ipa,cn=etc,dc=yydevops,dc=com does not exist
[04/Jul/2022:17:23:08 +0800] NSACLPlugin - The ACL target cn=automember rebuild membership,cn=tasks,cn=config does not exist
[04/Jul/2022:17:23:08 +0800] - Skipping CoS Definition cn=Password Policy,cn=accounts,dc=yydevops,dc=com--no CoS Templates found, which should be added before the CoS Definition.
[04/Jul/2022:17:23:08 +0800] schema-compat-plugin - schema-compat-plugin tree scan will start in about 5 seconds!
[04/Jul/2022:17:23:08 +0800] - slapd started. Listening on All Interfaces port 389 for LDAP requests
[04/Jul/2022:17:23:08 +0800] - Listening on All Interfaces port 636 for LDAPS requests
[04/Jul/2022:17:23:08 +0800] - Listening on /var/run/slapd-YYDEVOPS-COM.socket for LDAPI requests
[04/Jul/2022:17:23:12 +0800] schema-compat-plugin - warning: no entries set up under ou=sudoers,dc=yydevops,dc=com
[04/Jul/2022:17:23:13 +0800] schema-compat-plugin - warning: no entries set up under cn=ng, cn=compat,dc=yydevops,dc=com
[04/Jul/2022:17:23:13 +0800] schema-compat-plugin - warning: no entries set up under cn=computers, cn=compat,dc=yydevops,dc=com
[04/Jul/2022:17:23:13 +0800] schema-compat-plugin - Finished plugin initialization
1 year, 11 months
