June 2017 - FreeIPA-users - Fedora mailing-lists

Strange behavior on my structure
by Ataliba Teixeira 23 Jun '17

23 Jun '17

Hello, i'm new on freeipa and i have some problems on my structure here. I have two servers : ipa-replica-manage -v list Directory Manager password: server1.domain : master server2.domain : master When i use the command : # ipa-replica-manage -v list server2.domain server1.domain: replica last init status: None last init ended: 1970-01-01 00:00:00+00:00 last update status: Error (0) Replica acquired successfully: Incremental update succeeded last update ended: 2017-06-23 13:35:42+00:00 # ipa-replica-manage -v list server1.domain server2.domain: replica last init status: None last init ended: 1970-01-01 00:00:00+00:00 last update status: Error (0) Replica acquired successfully: Incremental update succeeded last update ended: 2017-06-23 13:36:42+00:00 There are no errors on the syncronization of this two servers. But i have two strange behaviors on my structure. 1. I have network elements ( servers ) listed on server2. domain ( web ) and are no listed on server1.domain ( web ) And i many servers ( many of this are listed on server2 and not on server1 ), i receive this erro when i try to connect via ssh using the dns name : # ssh app01 @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @ @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY! Someone could be eavesdropping on you right now (man-in-the-middle attack)! It is also possible that a host key has just been changed. The fingerprint for the RSA key sent by the remote host is f5:21:f0:0c:b7:4b:cf:c4:f2:8f:9c:8a:75:d3:55:5c. Please contact your system administrator. Add correct host key in /root/.ssh/known_hosts to get rid of this message. Offending RSA key in /var/lib/sss/pubconf/known_hosts:4 RSA host key for app01 has changed and you have requested strict checking. Host key verification failed. Anyone knows how to sync this two servers ? And about the ssh, how to solve this ? Thanks, -- Ataliba Teixeira via Inbox by Gmail

1 1

ipa host-del --updatedns
by arsene.gschwind＠gmail.com 23 Jun '17

23 Jun '17

Hi, I'm running VERSION: 4.4.0, API_VERSION: 2.213. When trying to delete a host using # ipa host-del --updatedns it returns always the following error even if the DNS record exists. ipa: WARNING: DNS record(s) of host velo.vm.example.com could not be removed. (No A, AAAA, SSHFP or PTR records found.) How to reproduce: # ipa host-add velo.vm.example.com --ip-address=10.0.20.67 --random ------------------------------ Added host "velo.vm.example.com" ------------------------------ Host name: velo.vm.example.com Random password: xxxxxxxx Password: True Keytab: False Managed by: velo.vm.example.com # ipa dnsrecord-show vm.example.com velo Record name: velo A record: 10.0.20.67 # ipa dnsrecord-show 10.in-addr.arpa 67.20.0 Record name: 67.20.0 PTR record: velo.vm.example.com. # ipa host-del velo --updatedns ipa: WARNING: DNS record(s) of host velo.vm.example.com could not be removed. (No A, AAAA, SSHFP or PTR records found.) ------------------- Deleted host "velo" ------------------- The DNS records are not deleted ... Thanks for any hint / help Rgds, Arsène

3 2

Insufficient 'delete' privilege
by Sieferlinger, Andreas 23 Jun '17

23 Jun '17

Hi all, after an upgrade von 4.1 to 4.4 (4.4.0-14.el7.centos.7) I have some trouble in changing replication agreements. #ipa-replica-manage del auth4.example.com 'auth9.example.com' has no replication agreement for 'auth4.example.com' # ipa-replica-manage del auth4.example.com --force --clean Cleaning a master is irreversible. This should not normally be require, so use cautiously. Continue to clean master? [no]: yes Re-run /sbin/ipa-replica-manage with --verbose option to get more information Unexpected error: Insufficient access: Insufficient 'delete' privilege to delete the entry 'krbprincipalname=ldap/auth4.example.com(a)example.com,cn=services,cn=accounts,dc=example,dc=com'. I suspect some missing ACLs that probably got lost during an update, although I do not know which and how to read. Any help would be appreciated. Andreas Sieferlinger Site Reliability Engineer glomex GmbH A Company of ProSiebenSat.1 Media SE Landsberger Straße 110 D-80339 Munich Germany Tel. +49 89 9507 8964 Executive Board: Michael Jaschke (CEO), Arnd Mückenberger (CFO) Registered Office: Unterfoehring HRB 224542 AG München VAT number DE 305765704 Tax No. 143/314/40826

2 2

Fwd: Logwatch and FreeIPA/sssd
by Lachlan Musicman 22 Jun '17

22 Jun '17

Hola, I have logwatch set up on my server, and there is a stanza in my daily email called "**Unmatched Entries**", which is filled with lines from either ipa or sssd: Failed password for usename(a)domain.com from 10.126.67.170 port 57331 ssh2 : 2 time(s) Accepted password for usename(a)domain.com from 10.126.67.170 port 61402 ssh2 : 1 time(s) pam_sss(sshd:auth): authentication success; logname= uid=0 euid=0 tty=ssh ruser= rhost=hostname.domain.com user=usename(a)domain.com : 1 time(s) Does anyone have a logwatch .conf script that they have written? Does such a thing formally exist for ipa/sssd? cheers L. ------ "Mission Statement: To provide hope and inspiration for collective action, to build collective power, to achieve collective transformation, rooted in grief and rage but pointed towards vision and dreams." - Patrisse Cullors, *Black Lives Matter founder*

1 0

Issue with replica creation
by Oleg Danilovich 22 Jun '17

22 Jun '17

Hello guys, I have problems with creation freeipa master replica. ipa --version VERSION: 4.3.1, API_VERSION: 2.164 Master server Idp+self sign CA I want create full replica of master server Host for replica in domain (ipa-client-install -U --domain= --server= ipa1.itcapital.io --password= --principal=--hostname= --no-ntp --mkhomedir) I try to create replica: ipa-replica-install --hostname=<domain name> --domain=<domain name> --server=<ipa server name> --password=XXXXXX --principal=admin --setup-ca Replica installation success but CA replica creation failed: Configuring certificate server (pki-tomcatd). Estimated time: 3 minutes 30 seconds [1/23]: creating certificate server user [2/23]: creating certificate server db [3/23]: setting up initial replication Starting replication, please wait until this has completed. Update in progress, 5 seconds elapsed Update succeeded [4/23]: creating installation admin user [5/23]: setting up certificate server ipa.ipaserver.install.cainstance.CAInstance: CRITICAL Failed to configure CA instance: Command '/usr/sbin/pkispawn -s CA -f /tmp/tmpjnucvO' returned non-zero exit status 1 ipa.ipaserver.install.cainstance.CAInstance: CRITICAL See the installation logs and the following files/directories for more information: ipa.ipaserver.install.cainstance.CAInstance: CRITICAL /var/log/pki/pki-tomcat [error] RuntimeError: CA configuration failed. Your system may be partly configured. Run /usr/sbin/ipa-server-install --uninstall to clean up. ipa.ipapython.install.cli.install_tool(Replica): ERROR CA configuration failed. ipa.ipapython.install.cli.install_tool(Replica): ERROR The ipa-replica-install command failed. See /var/log/ipareplica-install.log for more information Maybe somebody has information about this issue? -- Best regards, *Oleg Danilovich*

3 3

Fwd: Change subdomain
by Matt . 22 Jun '17

22 Jun '17

Hi Guys, When you have a subdomain with hosts in it is it possible to change that subdomain in a simple way ? Normal DNS server can do but as LDAP is involved I hope this is possible as well! Thanks, Matt

1 0

cannot connect ...Encountered end of file.
by Vinny Del Signore 22 Jun '17

22 Jun '17

Hello all, Has anyone seen this issue? We've tried to generate a new CA and SSL Cert. IPA v.3.0.0-50 # rpm -qa | grep ipa-server ipa-server-selinux-3.0.0-50.el6.1.x86_64 ipa-server-3.0.0-50.el6.1.x86_64 root ldap-srv /var/log/dirsrv/slapd-DOMAIN-COM # ipa-replica-prepare --ip-address=10.10.xx.xx rtlvxl0055.test.local Directory Manager (existing master) password: Preparing replica for rtlvxl0055.test.local from ldap-srv.domain.com Creating SSL certificate for the Directory Server preparation of replica failed: cannot connect to 'https://ldap-srv.domain..com:9444/ca/ee/ca/profileSubmitSSLClient': (PR_END_OF_FILE_ERROR) Encountered end of file. cannot connect to 'https://ldap-srv.domain..com:xxxx/ca/ee/ca/profileSubmitSSLClient': (PR_END_OF_FILE_ERROR) Encountered end of file. File "/usr/sbin/ipa-replica-prepare", line 490, in <module> main() File "/usr/sbin/ipa-replica-prepare", line 361, in main export_certdb(api.env.realm, ds_dir, dir, passwd_fname, "dscert", replica_fqdn, subject_base) File "/usr/sbin/ipa-replica-prepare", line 150, in export_certdb raise e root ldap-srv /var/log/dirsrv/slapd-DOMAIN-COM # root ldap-srv /var/log/dirsrv/slapd-DOMAIN-COM # rpm -qa | grep ipa-server ipa-server-selinux-3.0.0-50.el6.1.x86_64 ipa-server-3.0.0-50.el6.1.x86_64 root ldap-srv /var/log/dirsrv/slapd-DOMAIN-COM # uname -r 2.6.32-642.3.1.el6.x86_64 root ldap-srv /var/log/dirsrv/slapd-DOMAIN-COM # cat /etc/redhat-release Red Hat Enterprise Linux Server release 6.6 (Santiago) root ldap-srv /var/log/dirsrv/slapd-DOMAIN-COM # Kind regards, Vin

4 4

IPA Locations: client chooses wrong/random IPA server
by Denis Iskandarov 22 Jun '17

22 Jun '17

Hello, I have two datacenters. One is self hosted so all the docs are working just fine. The second one is AWS. I've managed to setup replica between "static" DC , "DC1", and AWS "cloud" DC with all its problems. There are still issues to solve within AWS. But "static" which has Bind name servers is not working properly. Client hosts are using my external DNSs, with proper zone delegation to IPA. And are slaves of zone delegated to FreeIPA - so they do receive all updates from IPA. Default TTL lowered to 5min. Configured IPA locations. During install ipa-client-install in "DC1" chooses wrong IPA server, one dedicated for AWS. And because of our security policies clients are not allowed to communicate with AWS IPA - so installation completely fails. At some point randomly of course it chooses correct IPA server. dig on every host in network shows correct priorities and weights. Below I will paste related configs outputs: ; auth.tld zone delegation > auth.tld. IN NS ipa.auth.tld. > auth.tld. IN NS dns1.tld. > ipa.auth.tld. IN A 10.200.10.9 > ipa-aws.auth.tld. IN A 10.70.83.86 on client host, and every other dig looks like: > # dig +short _ldap._tcp.auth.tld SRV > _ldap._tcp.dc1._locations.auth.tld. > 0 100 389 ipa.auth.tld. > 50 100 389 ipa-aws.auth.tld. or putting servers on different positions but still with correct priorities: > dig +short _ldap._tcp.auth.tld SRV > _ldap._tcp.dc1._locations.auth.tld. > 50 100 389 ipa-aws.auth.tld. > 0 100 389 ipa.auth.tld. [root@client-001 ~]# /usr/sbin/ipa-client-install --domain='auth.tld' > --principal='hostreg' --password='xxxxxxx' --mkhomedir --no-sshd --no-ntp > Discovery was successful! > Client hostname: client-001.dmz.dc1.tld > Realm: AUTH.tld > DNS Domain: auth.tld > IPA Server: ipa-aws.auth.tld > BaseDN: dc=auth,dc=tld > Continue to configure the system with these values? [no]: no > Installation failed. Rolling back changes. > IPA client is not configured on this system. I don't understand, why if dig shows correct priorities information, ipa-client-install is choosing wrong server. Looks like ipa-client install not treating priorities and is choosing first ipa server from dig list. Can't find out what I'm missing

2 4

GSSAPI login from trusted AD domain to FreeIPA clients not working
by Tiemen Ruiten 22 Jun '17

22 Jun '17

Hello, I have a FreeIPA domain, i.rdmedia.com, (CentOS 7.3, fully up-to-date: rpm versions are 4.4.0-14.el7.centos.7) with a two-way, non-transitive, external trust to an Active Directory domain in another forest, clients.rdmedia.com, (Windows Server 2012R2). I've setup the trust using the Administrator credentials. As one of the final steps, I would like to get passwordless SSH-access using GSSAPI to work, but unfortunately I get the following error in the Putty log when connecting from an AD domain-joined client: Event Log: GSSAPI authentication initialisation failed Event Log: The target was not recognized Is it possible to configure GSSAPI authentication for a cross-forest trust or should I setup the trust as a 'Trusted Forest' ie. not external? -- Tiemen Ruiten Systems Engineer R&D Media

4 11

Rebuilding IPA environment
by John Bowman 21 Jun '17

21 Jun '17

What would be the best method to stand up a new IPA environment while keeping as much of the existing data as possible? I've read that the ipa migrate-ds only migrates the users and groups and the recommended suggestion is to set up a replica. I'd like to sever any ties to the existing environment but not have to start over completely from scratch if at all possible. Ideally I would be able to just point existing services to the new environment and hopefully minimize impact, I'm sure I'd still have plenty of manual changes as well, but one can dream. Basically I'm just running in to too many issues with trying to expand our existing environment some of which is related to having a mix of IPA 3.0 and 4.x I believe and likely some old and recent missteps that make me question the stability of our environment. Any tips/advice would be appreciated. -- John Bowman

4 3

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users June 2017