June 2017 - FreeIPA-users - Fedora mailing-lists

Certificate renewals with external CA
by Rob Foehl 29 Aug '17

29 Aug '17

I've got a test instance of FreeIPA 4.4.4 running on F25 that was installed with --external-ca, and the resulting CSR signed with a validity period of 30 days to test behavior around expirations. Upon booting that instance today, certmonger decided to preemptively renew every IPA cert -- which is a good thing -- but did so without waiting for renewal of the IPA CA cert first, which is less good. Now that instance has a pile of certs that expire in two weeks, since they were signed with and thus tied to the expiration of the old IPA CA cert. While I'm guessing certmonger will figure this out and do the right thing within a couple weeks -- and with the expectation that this would only happen once per IPA CA renewal with a "real" deployment -- is this the intended behavior? Logs are a bit of a mess between this and a potentially-resolved SELinux issue with certmonger, but I'll wedge them all into a proper bug report if desired. -Rob

3 12

Time Skew on Amazon nodes?
by pgb205 01 Aug '17

01 Aug '17

I have noticed that we had a broken replication agreement between replica in amazon and on another physical node. I have attempted to re-initialize but receivedUpdate failed! Status: [2 Replication error acquiring replica: excessive clock skew] I had triple verified that time on both is correct and at most within seconds of each other. in dirsrv logs I get Excessive clock skew from supplier RUVUnable to acquire replica: error: excessive clock skew After doing a bit of searching I found this beauty:https://www.redhat.com/archives/freeipa-users/2014-February/msg00007… The article mentions that the time skew might occur due to server being virtualied, and I'm wondering if this is applicable to Amazon. The steps mentioned in the article look intrusive (and intimidating) . I'm curious what other avenues are available to me to fix this?If I blow away the replica and re-set up the new one from scratch would that fix the problem.

3 6

Re: FreeIPA - Active Directory integration and domain names
by Striker Leggette 06 Jul '17

06 Jul '17

Well, technically, I don't think IPA needs DNS entries simply for synchronization, so you could technically give it the same domain suffix. However, if you plan on using it for the purpose of clients to connect, it will need to be on its own domain. The reason it is highly suggested for different domains to have different suffixes within DNS is because clients will 'dig' that domain for Kerberos and LDAP type records when looking for domain servers. Something like the below, for example: # dig -t SRV _kerberos._tcp.EXAMPLE.COM. If this returns both AD /and/ IPA servers, your clients will have a bad time. Sent via carrier pigeons -------- Original message -------- From: Striker Leggette via FreeIPA-users <freeipa-users(a)lists.fedorahosted.org> Date: 6/14/17 8:12 PM (GMT-05:00) To: FreeIPA users list <freeipa-users(a)lists.fedorahosted.org> Cc: Striker Leggette <striker(a)terranforge.com> Subject: [Freeipa-users] Re: FreeIPA - Active Directory integration and domain names Yes Sent via carrier pigeons -------- Original message -------- From: bogusmaster--- via FreeIPA-users <freeipa-users(a)lists.fedorahosted.org> Date: 6/14/17 6:06 AM (GMT-05:00) To: freeipa-users(a)redhat.com Cc: bogusmaster(a)o2.pl Subject: [Freeipa-users] FreeIPA - Active Directory integration and domain names Hi, I have a question regarding establishing one-way trust between FreeIPA and Active Directory. In the documentation it is stated that to use a cross-forest trust it is required for FreeIPA to have a different domain than that of Active Directory. Does it also apply to the synchronization scenario? Thank you Bart _______________________________________________ FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org

2 1

Syncronization on servers
by Ataliba Teixeira 05 Jul '17

05 Jul '17

Hello, reading some docs about the sync of my two servers : # ipa-replica-manage list server1.domain: master server2.domain: master # ipa-replica-manage list-ruv Directory Manager password: Replica Update Vectors: server2.domain:389: 7 server1.domain:389: 4 Certificate Server Replica Update Vectors: No CS-RUVs found. My doubt is . To solve this i only need to run the command : ipa-replica-manage force-sync --from srv2.domain ? Thanks for your atention :-) -- Ataliba Teixeira via Inbox by Gmail

2 3

IPA client configuration fail on AIX client
by Lakshan Jayasekara 03 Jul '17

03 Jul '17

Hi all, Once initiating the kinit admin command below error pops up bash-4.3# kinit admin Password for admin(a)LANKACLEAR.LK: xxxxxxxxxx java.net.ConnectException: Connection refused at java.net.PlainSocketImpl.socketConnect(Native Method) at java.net.PlainSocketImpl.doConnect(PlainSocketImpl.java:413) at java.net.PlainSocketImpl.connectToAddress(PlainSocketImpl.java:274) at java.net.PlainSocketImpl.connect(PlainSocketImpl.java:261) at java.net.SocksSocketImpl.connect(SocksSocketImpl.java:392) at java.net.Socket.connect(Socket.java:559) at com.ibm.security.krb5.internal.TCPClient.<init>(TCPClient.java:40) at com.ibm.security.krb5.i.run(i.java:39) at java.security.AccessController.doPrivileged(AccessController.java:379) at com.ibm.security.krb5.h.a(h.java:74) at com.ibm.security.krb5.h.a(h.java:88) at com.ibm.security.krb5.h.a(h.java:31) at com.ibm.security.krb5.internal.tools.Kinit.a(Kinit.java:97) at com.ibm.security.krb5.internal.tools.Kinit.<init>(Kinit.java:108) at com.ibm.security.krb5.internal.tools.Kinit.main(Kinit.java:139) com.ibm.security.krb5.KrbException, status code: 0 message: java.net.ConnectException: Connection refused if you have any clue let men know. Lakshan Jayasekara Senior Systems Engineer Mobile: +94 77 294 0396 | Dir: +94 11 235 6949 General:+94 11 235 6949 Ext: 949 | Fax: +94 11 2544346 LankaClear (Pvt) Ltd, Level 18, Bank of Ceylon Head Office, “BOC Square”, No. 01, Bank of Ceylon Mw, Colombo 01, Sri Lanka. http://www.lankaclear.com<http://www.lankaclear.com/> [cid:image809ccd.JPG@751704c7.46b6c6bd] Confidentiality Notice: The information contained in this message is privileged and confidential information intended only for the use of the individual or entity named above. If the reader of this message is not the intended recipient, or the employee or agent responsible to deliver it to the intended recipient, you are hereby notified that any release, dissemination, distribution, or copying of this communication is strictly prohibited. If you have received this communication in error, please notify the author immediately by replying to this message and delete the original message. Internet communications cannot be guaranteed to be timely, secure, error or virus-free. The sender does not accept liability for any errors or omissions. This email has been scanned for all viruses by the Symantec End Point Protection Email Security System. [cid:imagee396cf.JPG@b84c98ce.49a391a5]<http://>

2 1

Errors after Upgrading from Fedora 23 to Fedora 25
by dntosas＠yuboto.com 03 Jul '17

03 Jul '17

Hello World! I got an installation with FreeIPA server 4.2.4 in Fedora 23 and all worked fine I decided to upgrade to Fedora 25 via dnf-upgrade-plugin All the upgrade proc goes smooth and as a result my freeipa rpm packages also upgraded (from 4.2.4 to 4.4.4) Now, the problem is that nothing works now. The command "ipa-server-upgrade" shows: IPA server upgrade failed: Inspect /var/log/ipaupgrade.log and run command ipa-server-upgrade manually. Timeout exceeded The ipa-server-upgrade command failed. See /var/log/ipaupgrade.log for more information I attach the appropriate logs: /var/log/ipaupgrade.log 2017-06-29T14:55:06Z DEBUG duration: 0 seconds 2017-06-29T14:55:06Z DEBUG [10/10]: starting directory server 2017-06-29T14:55:06Z DEBUG Starting external process 2017-06-29T14:55:06Z DEBUG args=/bin/systemctl start dirsrv(a)xxx.service 2017-06-29T14:55:09Z DEBUG Process finished, return code=0 2017-06-29T14:55:09Z DEBUG stdout= 2017-06-29T14:55:09Z DEBUG stderr= 2017-06-29T14:55:09Z DEBUG Starting external process 2017-06-29T14:55:09Z DEBUG args=/bin/systemctl is-active dirsrv(a)xxx.service 2017-06-29T14:55:09Z DEBUG Process finished, return code=0 2017-06-29T14:55:09Z DEBUG stdout=active 2017-06-29T14:55:09Z DEBUG stderr= 2017-06-29T14:55:09Z DEBUG wait_for_open_ports: localhost [389] timeout 300 /var/log/dirsrv/.../errors.log [29/Jun/2017:17:57:21.091850887 +0300] slapi_ldap_bind - Error: could not send startTLS request: error -1 (Can't contact LDAP server) errno 110 (Connection timed out) [29/Jun/2017:17:58:18.114145058 +0300] slapi_ldap_bind - Error: could not send startTLS request: error -1 (Can't contact LDAP server) errno 107 (Transport endpoint is not connected) [29/Jun/2017:17:58:42.135719951 +0300] slapi_ldap_bind - Error: could not send startTLS request: error -1 (Can't contact LDAP server) errno 110 (Connection timed out) [29/Jun/2017:18:01:30.160763487 +0300] slapi_ldap_bind - Error: could not send startTLS request: error -1 (Can't contact LDAP server) errno 107 (Transport endpoint is not connected) [29/Jun/2017:18:01:54.183552684 +0300] slapi_ldap_bind - Error: could not send startTLS request: error -1 (Can't contact LDAP server) errno 110 (Connection timed out) /var/log/krb5kdc.log Jun 29 17:54:08 ipa1.srv.xxx.com krb5kdc[1335](info): AS_REQ (6 etypes {18 17 16 23 25 26}) x.x.x.x: ISSUE: authtime 1498748048, etypes {rep=18 tkt=18 ses=18}, ldap/ipa1.srv.xxx.com(a)SRV.xxx.COM for krbtgt/SRV.xxx.COM(a)SRV.xxx.COM Jun 29 17:54:08 ipa1.srv.xxx.com krb5kdc[1335](info): closing down fd 4 Jun 29 17:55:08 ipa1.srv.xxx.com krb5kdc[1335](info): AS_REQ (6 etypes {18 17 16 23 25 26}) x.x.x.x: LOOKING_UP_CLIENT: ldap/ipa1.srv.xxx.com(a)SRV.xxx.COM for krbtgt/SRV.xxx.COM(a)SRV.xxx.COM, Server error Jun 29 17:55:08 ipa1.srv.xxx.com krb5kdc[1335](info): closing down fd 4 Jun 29 17:55:08 ipa1.srv.xxx.com krb5kdc[1335](info): AS_REQ (6 etypes {18 17 16 23 25 26}) x.x.x.x: LOOKING_UP_CLIENT: ldap/ipa1.srv.xxx.com(a)SRV.xxx.COM for krbtgt/SRV.xxx.COM(a)SRV.xxx.COM, Server error Jun 29 17:55:08 ipa1.srv.xxx.com krb5kdc[1335](info): closing down fd 4 Jun 29 17:55:24 ipa1.srv.xxx.com krb5kdc[1335](info): AS_REQ (6 etypes {18 17 16 23 25 26}) x.x.x.x: NEEDED_PREAUTH: ldap/ipa1.srv.xxx.com(a)SRV.xxx.COM for krbtgt/SRV.xxx.COM(a)SRV.xxx.COM, Additional pre-authentication required Jun 29 17:55:24 ipa1.srv.xxx.com krb5kdc[1335](info): closing down fd 4 Jun 29 17:55:24 ipa1.srv.xxx.com krb5kdc[1335](info): AS_REQ (6 etypes {18 17 16 23 25 26}) x.x.x.x: ISSUE: authtime 1498748124, etypes {rep=18 tkt=18 ses=18}, ldap/ipa1.srv.xxx.com(a)SRV.xxx.COM for krbtgt/SRV.xxx.COM(a)SRV.xxx.COM Jun 29 17:55:24 ipa1.srv.xxx.com krb5kdc[1335](info): closing down fd 4 I have tried different ways of making command "ipa-server-upgrade" complete its job but nothing worked. Any Ideas ? :(

2 1

FreeIPA 4.5.2 with AD Trust - Web UI trouble
by Jason Hensley 29 Jun '17

29 Jun '17

Hello, I have setup a pair of FreeIPA 4.5.2 servers. One via ipa-server-install, the other via ipa-replica-install. I have tried them both as trust controllers and I have tried them in a controller/agent setup. My problem is that no AD users can login to the self service UI on the secondary IPA server. Is this by design, or is it merely a bug? I can provide more details/logs/configs on request. Thanks, Jason

2 3

New to FreeIPA cant figure out integrated DNS.
by euanhaahrmail2＠gmail.com 29 Jun '17

29 Jun '17

I have been trying to install FreeIPA with integrated dns i found installing freeipa easy without dns but anything todo with the dns portion of it exceeding complicated. I have a internel dns server that i have been using to store all the host names of my internel pcs and then for anything externel it would forward to another dns server. As far as i can tell the freeipa integrated dns is would replace this and would store all the records needed for freeipa also as far as i can tell it would automatically create the A records and AAAA records for the client pcs added to the domain and keep them updated. I originally tried making the integrated dns handle the root zone i think that is what its called where it could create records for any subdomains I read online that this wasnt a good idea and also seemed extremely hard todo trying this would end up in a zone overlap error. I think I need to make my registrar point to the integrated dns for this to work. I read some guides and it seems that people suggest to give the integrated dns server power over its own subdomain zone I did this by creating a NS record in my registrars dns management page but when running the command suggested in the redhat guide to check that it works it returns nothing this is the command i am running "dig @RegistrarsNameServerIPAddress +norecurse +short ipa.example.com. NS" but running a normal dig will show the record. ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4096 ;; QUESTION SECTION: ;ipa.example.com. IN A ;; AUTHORITY SECTION: ipa.example.com. 1799 IN NS ipa.example.com. ;; ADDITIONAL SECTION: ipa.example.com. 1799 IN A MyIPAddress When trying to install using this subdomain I get this error right at the end. I have a feeling it is trying to add records to the integrated dns server but its not working properly. “Updating DNS system records ipa : ERROR DNS query for ipa.example.com. 1 failed: All nameservers failed to answer the query ipa.example.com. IN A: Server 127.0.0.1 UDP port 53 anwered SERVFAIL” I think my main problem with this is I actually dont know how DNS delegates subdomain nameservers it always asks for a FQDN when putting in a nameserver but shouldnt this really be an ip address. If someone could give me and example NS record or how they have set it up that would be great I am extremely lost even some reading materials would be helpful all guides online just assume you already have setup the NS record and don’t give you too much information. Also I have replace all refrences to my domain to example.com (not actually trying to use example.com)

1 0

Error running ipa-certupdate
by Jeff Fouchard 29 Jun '17

29 Jun '17

On our clients when attempting to run ipa-certupdate we are seeing the following error: ipa.ipapython.ipaldap.SchemaCache: DEBUG: retrieving schema for SchemaCache url=ldap://ldap2.int.ba.mydomain.local:389 conn=<ldap.ldapobject.SimpleLDAPObject instance at 0x46dc5a8> ipa.ipaclient.ipa_certupdate.CertUpdate: DEBUG: File "/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 171, in execute return_value = self.run() File "/usr/lib/python2.7/site-packages/ipaclient/ipa_certupdate.py", line 87, in run lwcas = api.Command.ca_find()['result'] File "/usr/lib/python2.7/site-packages/ipalib/plugable.py", line 336, in __getattr__ raise AttributeError(key) ipa.ipaclient.ipa_certupdate.CertUpdate: DEBUG: The ipa-certupdate command failed, exception: AttributeError: ca_find ipa.ipaclient.ipa_certupdate.CertUpdate: ERROR: ca_find ipa.ipaclient.ipa_certupdate.CertUpdate: ERROR: The ipa-certupdate command failed. We have recently migrated to using an external CA and that went smoothly other than this. We had not tried prior to that to run this command. So far this is happening on all of the nodes we have tried. It does seem our server version (4.2.0) and client version (4.4.0) are out of sync. Would that be the cause, or is there something else I should be looking at. Thanks! Jeff

1 0

{ possibly offtopic } -- can sssd.conf alone be configured to copy the custom AD ID Ranges used by IPA server?
by Chris Dagdigian 29 Jun '17

29 Jun '17

Hi folks, I have a set of servers that CANNOT become enrolled IDM clients due to a vendor refusing to support this type of config. This server fleet is directly bound to an AD system via the standard non-IPA "realm join ..." type commands Since I can't bring these servers "into the fold" so to speak at the very least I would love to offset at least one potential future problem by seeing if I can help them configure sssd.conf on their local machines to use the same AD SID-to-UID algorithm (complete with custom ID Range values that we have enabled on the IPA master) so that they at least get the same UID and GID values for their AD users as the same user would get if they logged into the much larger fleet of IDM-managed servers. Hope I'm asking the question properly -- in a nutshell I'm wondering how to trick a standalone sssd.conf file so that it uses the same SID-to-UID algorithm that an IDM master would use. This would at least let me get consistent UID/GID values across my fleet of enrolled vs. non-enrolled IDM clients ! Tips or advice appreciated even if the response is "heck no; you can't do that .. " Regards, Chris

3 4

kinit not working for some accounts
by Tiemen Ruiten 29 Jun '17

29 Jun '17

Hello, I've just noticed that kinit is not working for several but not all accounts in our FreeIPA domain (4.4.0-14.el7.centos.7). I get the following error: on the client: [root@caesium tiemen]# KRB5_TRACE=/dev/stdout kinit *dba* [7827] 1498729905.996951: Resolving unique ccache of type KEYRING [7827] 1498729905.997071: Getting initial credentials for dba(a)I.RDMEDIA.COM [7827] 1498729905.997811: Sending request (167 bytes) to I.RDMEDIA.COM [7827] 1498729905.998340: Initiating TCP connection to stream 10.100.110.36:88 [7827] 1498729906.2356: Sending TCP request to stream 10.100.110.36:88 [7827] 1498729906.9304: Received answer (204 bytes) from stream 10.100.110.36:88 [7827] 1498729906.9334: Terminating TCP connection to stream 10.100.110.36:88 [7827] 1498729906.9621: Response was from master KDC [7827] 1498729906.9683: Received error from KDC: -1765328359/Additional pre-authentication required *[7827] 1498729906.9780: Processing preauth types: 136, 133* *[7827] 1498729906.9795: Received cookie: MIT* *kinit: Generic preauthentication failure while getting initial credentials* whereas [root@caesium tiemen]# KRB5_TRACE=/dev/stdout kinit *admin* [7869] 1498730079.918191: Resolving unique ccache of type KEYRING [7869] 1498730079.918290: Getting initial credentials for admin(a)I.RDMEDIA.COM [7869] 1498730079.918896: Sending request (169 bytes) to I.RDMEDIA.COM [7869] 1498730079.919370: Initiating TCP connection to stream 10.100.110.36:88 [7869] 1498730079.922958: Sending TCP request to stream 10.100.110.36:88 [7869] 1498730079.930832: Received answer (258 bytes) from stream 10.100.110.36:88 [7869] 1498730079.930857: Terminating TCP connection to stream 10.100.110.36:88 [7869] 1498730079.930977: Response was from master KDC [7869] 1498730079.931039: Received error from KDC: -1765328359/Additional pre-authentication required *[7869] 1498730079.931106: Processing preauth types: 136, 19, 2, 133* *[7869] 1498730079.931129: Selected etype info: etype aes256-cts, salt "REDACTED", params ""* *[7869] 1498730079.931139: Received cookie: MIT* *Password for ter(a)I.RDMEDIA.COM <ter(a)I.RDMEDIA.COM>:* What could explain this difference? Where can I look to debug this? -- Tiemen Ruiten Systems Engineer R&D Media

1 1

(no subject)
by Sean Hogan 28 Jun '17

28 Jun '17

Hi All, We are having an issue performing RHEL 6.6 to 6.7 upgrade with SSSD. The systems are already enrolled and working in IPA 3.0.0-50 using 6.6 client. We yum update and sssd gives this Non-fatal POSTTRANS scriptlet failure in rpm package sssd-1.12.4-47.el6_7.8.ppc64 warning: %posttrans(sssd-1.12.4-47.el6_7.8.ppc64) scriptlet failed, exit status 1 Seems to install however sssd will no longer start. I can run ldap searches against the IPA server and kinit without issue I have un-enrolled the client and re-enrolled to no avail... once enroll gets to starting sssd it says sssd restart failed and continues to enroll. I have reinstalled sssd, ipa client and c-ares, I have removed the sssd cache db. The really strange part is if we wait approx 24 hours sssd starts working again which we have reproduced on 2 servers we are testing with... are we missing some sort of lease or cache? Using this to remove the sssd db rm -rf /var/lib/sss/db/* Here is a piece of the gdb core dump Core was generated by `/usr/libexec/sssd/sssd_pac --uid 0 --gid 0 -d 0x37f0 '. Program terminated with signal 11, Segmentation fault. #0 0x00000fff83f2bc64 in ._dl_vdso_vsym () from /lib64/libc.so.6 Part of SSSD.log with debug 9 (Tue Jun 27 21:13:14 2017) [sssd] [sbus_dispatch] (0x4000): dbus conn: 0x10034ca0c10 (Tue Jun 27 21:13:14 2017) [sssd] [sbus_dispatch] (0x4000): Dispatching. (Tue Jun 27 21:13:14 2017) [sssd] [sbus_message_handler] (0x4000): Received SBUS method [RegisterService] (Tue Jun 27 21:13:14 2017) [sssd] [sbus_get_sender_id_send] (0x2000): Not a sysbus message, quit (Tue Jun 27 21:13:14 2017) [sssd] [sbus_handler_got_caller_id] (0x4000): Received SBUS method [RegisterService] (Tue Jun 27 21:13:14 2017) [sssd] [client_registration] (0x0100): Received ID registration: (sudo,1) (Tue Jun 27 21:13:14 2017) [sssd] [mark_service_as_started] (0x0200): Marking sudo as started. (Tue Jun 27 21:13:14 2017) [sssd] [sbus_dispatch] (0x4000): dbus conn: 0x10034ca4590 (Tue Jun 27 21:13:14 2017) [sssd] [sbus_dispatch] (0x4000): Dispatching. (Tue Jun 27 21:13:14 2017) [sssd] [sbus_message_handler] (0x4000): Received SBUS method [RegisterService] (Tue Jun 27 21:13:14 2017) [sssd] [sbus_get_sender_id_send] (0x2000): Not a sysbus message, quit (Tue Jun 27 21:13:14 2017) [sssd] [sbus_handler_got_caller_id] (0x4000): Received SBUS method [RegisterService] (Tue Jun 27 21:13:14 2017) [sssd] [client_registration] (0x0100): Received ID registration: (ssh,1) (Tue Jun 27 21:13:14 2017) [sssd] [mark_service_as_started] (0x0200): Marking ssh as started. (Tue Jun 27 21:13:14 2017) [sssd] [sbus_dispatch] (0x4000): dbus conn: 0x10034ca31b0 (Tue Jun 27 21:13:14 2017) [sssd] [sbus_dispatch] (0x4000): Dispatching. (Tue Jun 27 21:13:14 2017) [sssd] [sbus_message_handler] (0x4000): Received SBUS method [RegisterService] (Tue Jun 27 21:13:14 2017) [sssd] [sbus_get_sender_id_send] (0x2000): Not a sysbus message, quit (Tue Jun 27 21:13:14 2017) [sssd] [sbus_handler_got_caller_id] (0x4000): Received SBUS method [RegisterService] (Tue Jun 27 21:13:14 2017) [sssd] [client_registration] (0x0100): Received ID registration: (pam,1) (Tue Jun 27 21:13:14 2017) [sssd] [mark_service_as_started] (0x0200): Marking pam as started. (Tue Jun 27 21:13:14 2017) [sssd] [sbus_dispatch] (0x4000): dbus conn: 0x10034c9fc70 (Tue Jun 27 21:13:14 2017) [sssd] [sbus_dispatch] (0x4000): Dispatching. (Tue Jun 27 21:13:14 2017) [sssd] [sbus_message_handler] (0x4000): Received SBUS method [RegisterService] (Tue Jun 27 21:13:14 2017) [sssd] [sbus_get_sender_id_send] (0x2000): Not a sysbus message, quit (Tue Jun 27 21:13:14 2017) [sssd] [sbus_handler_got_caller_id] (0x4000): Received SBUS method [RegisterService] (Tue Jun 27 21:13:14 2017) [sssd] [client_registration] (0x0100): Received ID registration: (nss,1) (Tue Jun 27 21:13:14 2017) [sssd] [mark_service_as_started] (0x0200): Marking nss as started. (Tue Jun 27 21:13:14 2017) [sssd] [mt_svc_exit_handler] (0x0040): Child [pac] terminated with signal [11] (Tue Jun 27 21:13:14 2017) [sssd] [mt_svc_restart] (0x0400): Scheduling service pac for restart 1 (Tue Jun 27 21:13:14 2017) [sssd] [get_ping_config] (0x0100): Time between service pings for [pac]: [10] (Tue Jun 27 21:13:14 2017) [sssd] [get_ping_config] (0x0100): Time between SIGTERM and SIGKILL for [pac]: [60] (Tue Jun 27 21:13:14 2017) [sssd] [start_service] (0x0100): Queueing service pac for startup (Tue Jun 27 21:13:14 2017) [sssd] [mt_svc_exit_handler] (0x0040): Child [pac] terminated with signal [11] (Tue Jun 27 21:13:16 2017) [sssd] [mt_svc_restart] (0x0400): Scheduling service pac for restart 2 (Tue Jun 27 21:13:16 2017) [sssd] [get_ping_config] (0x0100): Time between service pings for [pac]: [10] (Tue Jun 27 21:13:16 2017) [sssd] [get_ping_config] (0x0100): Time between SIGTERM and SIGKILL for [pac]: [60] (Tue Jun 27 21:13:16 2017) [sssd] [start_service] (0x0100): Queueing service pac for startup (Tue Jun 27 21:13:16 2017) [sssd] [mt_svc_exit_handler] (0x0040): Child [pac] terminated with signal [11] (Tue Jun 27 21:13:19 2017) [sssd] [services_startup_timeout] (0x0400): Handling timeout (Tue Jun 27 21:13:20 2017) [sssd] [mt_svc_restart] (0x0400): Scheduling service pac for restart 3 (Tue Jun 27 21:13:20 2017) [sssd] [get_ping_config] (0x0100): Time between service pings for [pac]: [10] (Tue Jun 27 21:13:20 2017) [sssd] [get_ping_config] (0x0100): Time between SIGTERM and SIGKILL for [pac]: [60] (Tue Jun 27 21:13:20 2017) [sssd] [start_service] (0x0100): Queueing service pac for startup (Tue Jun 27 21:13:20 2017) [sssd] [mt_svc_exit_handler] (0x0040): Child [pac] terminated with signal [11] (Tue Jun 27 21:13:20 2017) [sssd] [monitor_restart_service] (0x0010): Process [pac], definitely stopped! (Tue Jun 27 21:13:20 2017) [sssd] [monitor_quit] (0x0040): Returned with: 1 (Tue Jun 27 21:13:20 2017) [sssd] [monitor_quit] (0x0020): Terminating [ssh][14092] (Tue Jun 27 21:13:20 2017) [sssd] [monitor_quit] (0x0020): Child [ssh] exited gracefully (Tue Jun 27 21:13:20 2017) [sssd] [monitor_quit] (0x0020): Terminating [pam][14091] (Tue Jun 27 21:13:20 2017) [sssd] [monitor_quit] (0x0020): Child [pam] exited gracefully (Tue Jun 27 21:13:20 2017) [sssd] [monitor_quit] (0x0020): Terminating [sudo][14090] (Tue Jun 27 21:13:20 2017) [sssd] [monitor_quit] (0x0020): Child [sudo] exited gracefully (Tue Jun 27 21:13:20 2017) [sssd] [monitor_quit] (0x0020): Terminating [nss][14089] (Tue Jun 27 21:13:20 2017) [sssd] [monitor_quit] (0x0020): Child [nss] exited gracefully (Tue Jun 27 21:13:20 2017) [sssd] [monitor_quit] (0x0020): Terminating [example.local][14088] (Tue Jun 27 21:13:20 2017) [sssd] [monitor_quit] (0x0020): Child [example.local] exited gracefully (Tue Jun 27 21:13:20 2017) [sssd] [sbus_remove_watch] (0x2000): 0x10034c9b8d0/0x10034c895a0 server.example.local:/var/log/sssd# sssd -d9 (Tue Jun 27 21:46:38:159841 2017) [sssd] [check_file] (0x0400): lstat for [/var/run/nscd/socket] failed: [2][No such file or directory]. (Tue Jun 27 21:46:38:162382 2017) [sssd] [ldb] (0x0400): server_sort:Unable to register control with rootdse! (Tue Jun 27 21:46:38:163358 2017) [sssd] [confdb_get_domain_internal] (0x0400): No enumeration for [example.local]! (Tue Jun 27 21:46:38:163410 2017) [sssd] [confdb_get_domain_internal] (0x1000): pwd_expiration_warning is -1 (Tue Jun 27 21:46:38:163570 2017) [sssd] [become_user] (0x0200): Trying to become user [0][0]. (Tue Jun 27 21:46:38:163597 2017) [sssd] [become_user] (0x0200): Already user [0]. (Tue Jun 27 21:46:38:163675 2017) [sssd] [server_setup] (0x0040): Becoming a daemon. this pauses for a few seconds and drops me back to command line with sssd not started. Client sssd-client-1.12.4-47.el6_7.8.ppc64 sssd-ldap-1.12.4-47.el6_7.8.ppc64 sssd-krb5-common-1.12.4-47.el6_7.8.ppc64 sssd-common-1.12.4-47.el6_7.8.ppc64 sssd-proxy-1.12.4-47.el6_7.8.ppc64 sssd-common-pac-1.12.4-47.el6_7.8.ppc64 sssd-krb5-1.12.4-47.el6_7.8.ppc64 python-sssdconfig-1.12.4-47.el6_7.8.noarch sssd-ipa-1.12.4-47.el6_7.8.ppc64 sssd-1.12.4-47.el6_7.8.ppc64 sssd-ad-1.12.4-47.el6_7.8.ppc64 ipa-client-3.0.0-47.el6_7.2.ppc64 IPA Server ipa-server-3.0.0-50.el6.1.x86_64 Any help is appreciated as I have spent a good 15 hours reading the logs and bug reports and not any closer to a resolution. Sean Hogan

3 3

Re: SSSD not starting
by Sean Hogan 28 Jun '17

28 Jun '17

Apologies.. My subject line was "SSSD not starting" but posted it to the old address. Made a new email with the info and copy paste must have dropped it Sean Hogan From: Sean Hogan via FreeIPA-users <freeipa-users(a)lists.fedorahosted.org> To: freeipa-users(a)lists.fedorahosted.org Cc: Sean Hogan <schogan(a)us.ibm.com> Date: 06/28/2017 07:29 AM Subject: [Freeipa-users] (no subject) Hi All, We are having an issue performing RHEL 6.6 to 6.7 upgrade with SSSD. The systems are already enrolled and working in IPA 3.0.0-50 using 6.6 client. We yum update and sssd gives this Non-fatal POSTTRANS scriptlet failure in rpm package sssd-1.12.4-47.el6_7.8.ppc64 warning: %posttrans(sssd-1.12.4-47.el6_7.8.ppc64) scriptlet failed, exit status 1 Seems to install however sssd will no longer start. I can run ldap searches against the IPA server and kinit without issue I have un-enrolled the client and re-enrolled to no avail... once enroll gets to starting sssd it says sssd restart failed and continues to enroll. I have reinstalled sssd, ipa client and c-ares, I have removed the sssd cache db. The really strange part is if we wait approx 24 hours sssd starts working again which we have reproduced on 2 servers we are testing with... are we missing some sort of lease or cache? Using this to remove the sssd db rm -rf /var/lib/sss/db/* Here is a piece of the gdb core dump Core was generated by `/usr/libexec/sssd/sssd_pac --uid 0 --gid 0 -d 0x37f0 '. Program terminated with signal 11, Segmentation fault. #0 0x00000fff83f2bc64 in ._dl_vdso_vsym () from /lib64/libc.so.6 Part of SSSD.log with debug 9 (Tue Jun 27 21:13:14 2017) [sssd] [sbus_dispatch] (0x4000): dbus conn: 0x10034ca0c10 (Tue Jun 27 21:13:14 2017) [sssd] [sbus_dispatch] (0x4000): Dispatching. (Tue Jun 27 21:13:14 2017) [sssd] [sbus_message_handler] (0x4000): Received SBUS method [RegisterService] (Tue Jun 27 21:13:14 2017) [sssd] [sbus_get_sender_id_send] (0x2000): Not a sysbus message, quit (Tue Jun 27 21:13:14 2017) [sssd] [sbus_handler_got_caller_id] (0x4000): Received SBUS method [RegisterService] (Tue Jun 27 21:13:14 2017) [sssd] [client_registration] (0x0100): Received ID registration: (sudo,1) (Tue Jun 27 21:13:14 2017) [sssd] [mark_service_as_started] (0x0200): Marking sudo as started. (Tue Jun 27 21:13:14 2017) [sssd] [sbus_dispatch] (0x4000): dbus conn: 0x10034ca4590 (Tue Jun 27 21:13:14 2017) [sssd] [sbus_dispatch] (0x4000): Dispatching. (Tue Jun 27 21:13:14 2017) [sssd] [sbus_message_handler] (0x4000): Received SBUS method [RegisterService] (Tue Jun 27 21:13:14 2017) [sssd] [sbus_get_sender_id_send] (0x2000): Not a sysbus message, quit (Tue Jun 27 21:13:14 2017) [sssd] [sbus_handler_got_caller_id] (0x4000): Received SBUS method [RegisterService] (Tue Jun 27 21:13:14 2017) [sssd] [client_registration] (0x0100): Received ID registration: (ssh,1) (Tue Jun 27 21:13:14 2017) [sssd] [mark_service_as_started] (0x0200): Marking ssh as started. (Tue Jun 27 21:13:14 2017) [sssd] [sbus_dispatch] (0x4000): dbus conn: 0x10034ca31b0 (Tue Jun 27 21:13:14 2017) [sssd] [sbus_dispatch] (0x4000): Dispatching. (Tue Jun 27 21:13:14 2017) [sssd] [sbus_message_handler] (0x4000): Received SBUS method [RegisterService] (Tue Jun 27 21:13:14 2017) [sssd] [sbus_get_sender_id_send] (0x2000): Not a sysbus message, quit (Tue Jun 27 21:13:14 2017) [sssd] [sbus_handler_got_caller_id] (0x4000): Received SBUS method [RegisterService] (Tue Jun 27 21:13:14 2017) [sssd] [client_registration] (0x0100): Received ID registration: (pam,1) (Tue Jun 27 21:13:14 2017) [sssd] [mark_service_as_started] (0x0200): Marking pam as started. (Tue Jun 27 21:13:14 2017) [sssd] [sbus_dispatch] (0x4000): dbus conn: 0x10034c9fc70 (Tue Jun 27 21:13:14 2017) [sssd] [sbus_dispatch] (0x4000): Dispatching. (Tue Jun 27 21:13:14 2017) [sssd] [sbus_message_handler] (0x4000): Received SBUS method [RegisterService] (Tue Jun 27 21:13:14 2017) [sssd] [sbus_get_sender_id_send] (0x2000): Not a sysbus message, quit (Tue Jun 27 21:13:14 2017) [sssd] [sbus_handler_got_caller_id] (0x4000): Received SBUS method [RegisterService] (Tue Jun 27 21:13:14 2017) [sssd] [client_registration] (0x0100): Received ID registration: (nss,1) (Tue Jun 27 21:13:14 2017) [sssd] [mark_service_as_started] (0x0200): Marking nss as started. (Tue Jun 27 21:13:14 2017) [sssd] [mt_svc_exit_handler] (0x0040): Child [pac] terminated with signal [11] (Tue Jun 27 21:13:14 2017) [sssd] [mt_svc_restart] (0x0400): Scheduling service pac for restart 1 (Tue Jun 27 21:13:14 2017) [sssd] [get_ping_config] (0x0100): Time between service pings for [pac]: [10] (Tue Jun 27 21:13:14 2017) [sssd] [get_ping_config] (0x0100): Time between SIGTERM and SIGKILL for [pac]: [60] (Tue Jun 27 21:13:14 2017) [sssd] [start_service] (0x0100): Queueing service pac for startup (Tue Jun 27 21:13:14 2017) [sssd] [mt_svc_exit_handler] (0x0040): Child [pac] terminated with signal [11] (Tue Jun 27 21:13:16 2017) [sssd] [mt_svc_restart] (0x0400): Scheduling service pac for restart 2 (Tue Jun 27 21:13:16 2017) [sssd] [get_ping_config] (0x0100): Time between service pings for [pac]: [10] (Tue Jun 27 21:13:16 2017) [sssd] [get_ping_config] (0x0100): Time between SIGTERM and SIGKILL for [pac]: [60] (Tue Jun 27 21:13:16 2017) [sssd] [start_service] (0x0100): Queueing service pac for startup (Tue Jun 27 21:13:16 2017) [sssd] [mt_svc_exit_handler] (0x0040): Child [pac] terminated with signal [11] (Tue Jun 27 21:13:19 2017) [sssd] [services_startup_timeout] (0x0400): Handling timeout (Tue Jun 27 21:13:20 2017) [sssd] [mt_svc_restart] (0x0400): Scheduling service pac for restart 3 (Tue Jun 27 21:13:20 2017) [sssd] [get_ping_config] (0x0100): Time between service pings for [pac]: [10] (Tue Jun 27 21:13:20 2017) [sssd] [get_ping_config] (0x0100): Time between SIGTERM and SIGKILL for [pac]: [60] (Tue Jun 27 21:13:20 2017) [sssd] [start_service] (0x0100): Queueing service pac for startup (Tue Jun 27 21:13:20 2017) [sssd] [mt_svc_exit_handler] (0x0040): Child [pac] terminated with signal [11] (Tue Jun 27 21:13:20 2017) [sssd] [monitor_restart_service] (0x0010): Process [pac], definitely stopped! (Tue Jun 27 21:13:20 2017) [sssd] [monitor_quit] (0x0040): Returned with: 1 (Tue Jun 27 21:13:20 2017) [sssd] [monitor_quit] (0x0020): Terminating [ssh][14092] (Tue Jun 27 21:13:20 2017) [sssd] [monitor_quit] (0x0020): Child [ssh] exited gracefully (Tue Jun 27 21:13:20 2017) [sssd] [monitor_quit] (0x0020): Terminating [pam][14091] (Tue Jun 27 21:13:20 2017) [sssd] [monitor_quit] (0x0020): Child [pam] exited gracefully (Tue Jun 27 21:13:20 2017) [sssd] [monitor_quit] (0x0020): Terminating [sudo][14090] (Tue Jun 27 21:13:20 2017) [sssd] [monitor_quit] (0x0020): Child [sudo] exited gracefully (Tue Jun 27 21:13:20 2017) [sssd] [monitor_quit] (0x0020): Terminating [nss][14089] (Tue Jun 27 21:13:20 2017) [sssd] [monitor_quit] (0x0020): Child [nss] exited gracefully (Tue Jun 27 21:13:20 2017) [sssd] [monitor_quit] (0x0020): Terminating [example.local][14088] (Tue Jun 27 21:13:20 2017) [sssd] [monitor_quit] (0x0020): Child [example.local] exited gracefully (Tue Jun 27 21:13:20 2017) [sssd] [sbus_remove_watch] (0x2000): 0x10034c9b8d0/0x10034c895a0 server.example.local:/var/log/sssd# sssd -d9 (Tue Jun 27 21:46:38:159841 2017) [sssd] [check_file] (0x0400): lstat for [/var/run/nscd/socket] failed: [2][No such file or directory]. (Tue Jun 27 21:46:38:162382 2017) [sssd] [ldb] (0x0400): server_sort:Unable to register control with rootdse! (Tue Jun 27 21:46:38:163358 2017) [sssd] [confdb_get_domain_internal] (0x0400): No enumeration for [example.local]! (Tue Jun 27 21:46:38:163410 2017) [sssd] [confdb_get_domain_internal] (0x1000): pwd_expiration_warning is -1 (Tue Jun 27 21:46:38:163570 2017) [sssd] [become_user] (0x0200): Trying to become user [0][0]. (Tue Jun 27 21:46:38:163597 2017) [sssd] [become_user] (0x0200): Already user [0]. (Tue Jun 27 21:46:38:163675 2017) [sssd] [server_setup] (0x0040): Becoming a daemon. this pauses for a few seconds and drops me back to command line with sssd not started. Client sssd-client-1.12.4-47.el6_7.8.ppc64 sssd-ldap-1.12.4-47.el6_7.8.ppc64 sssd-krb5-common-1.12.4-47.el6_7.8.ppc64 sssd-common-1.12.4-47.el6_7.8.ppc64 sssd-proxy-1.12.4-47.el6_7.8.ppc64 sssd-common-pac-1.12.4-47.el6_7.8.ppc64 sssd-krb5-1.12.4-47.el6_7.8.ppc64 python-sssdconfig-1.12.4-47.el6_7.8.noarch sssd-ipa-1.12.4-47.el6_7.8.ppc64 sssd-1.12.4-47.el6_7.8.ppc64 sssd-ad-1.12.4-47.el6_7.8.ppc64 ipa-client-3.0.0-47.el6_7.2.ppc64 IPA Server ipa-server-3.0.0-50.el6.1.x86_64 Any help is appreciated as I have spent a good 15 hours reading the logs and bug reports and not any closer to a resolution. Sean Hogan _______________________________________________ FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org

1 0

Sync Issues
by Devin Acosta 28 Jun '17

28 Jun '17

I am running the latest CentOS 7.3 / FreeIPA release and it appears that my replication got broke. [27/Jun/2017:17:28:58.705411461 +0000] NSMMReplicationPlugin - agmt="cn=meTolasdc-lmfpa-002.lxi.m451.tech" (lasdc-lmfpa-002:389): Data required to update replica has been purged from the changelog. The replica must be reinitialized. [27/Jun/2017:17:29:02.257550913 +0000] agmt="cn=meTolasdc-lmfpa-002.lxi.m451.tech " (lasdc-lmfpa-002:389) - Can't locate CSN 595283d600b400140000 in the changelog (DB rc=-30988). If replication stops, the consumer may need to be reinitialized. When I try to delete the agreement and re-create it I get the error: Removal of IPA replication agreement is deprecated with managed IPA replication topology. Please use `ipa topologysegment-*` commands to manage the topology. However when I try to delete the segment and recreate it I also get an error. [root@lasdc-lmfpa-002 ~]# ipa topologysegment-del Suffix name: domain Segment name: las01-003-010.lxi.m451.tech-to-lasdc-lmfpa-002.lxi.m451.tech ipa: ERROR: Server is unwilling to perform: Removal of Segment disconnects topology.Deletion not allowed. Any ideas how i resolve this issue? I basically have 2 FreeIPA servers in each DC and the one DC is happy with the sync, but I lost all replication to the other so passwords aren't syncing across DC's.

2 1

Can't install client on scientific linux 7.3
by Niels Walet 27 Jun '17

27 Jun '17

I seem to have some serios issues with ipa on sl 7.3; on installing on a client, the install works through fine until it bombs on the following issue: <long trace of ipa-client-install --password=' --domain --realm --server --hostname=xxxx --debug> ,,,,, Configured /etc/krb5.conf for IPA realm YYY Starting external process args=keyctl search @s user ipa_session_cookie:host/xxx@YYY Process finished, return code=1 stdout= stderr=keyctl_search: Required key not available Starting external process args=/usr/bin/certutil -d /tmp/tmpl7C_lX -N -f /tmp/tmpL9Jnj9 Process finished, return code=0 stdout= stderr= Starting external process args=/usr/bin/certutil -d /tmp/tmpl7C_lX -A -n CA certificate 1 -t C,, Process finished, return code=0 stdout= stderr= Starting external process args=keyctl search @s user ipa_session_cookie:host/xxx@YYY Process finished, return code=1 stdout= stderr=keyctl_search: Required key not available failed to find session_cookie in persistent storage for principal 'host/xxx@YYY' trying https://theoipa.ph.man.ac.uk/ipa/json Created connection context.rpcclient_47349328 Forwarding 'schema' to json server 'https://ipa.xxxx/ipa/json' Destroyed connection context.rpcclient_47349328 Traceback (most recent call last): <long traceback> --- Prof. Niels R. Walet Phone: +44(0)1613063693 School of Physics and Astronomy Mobile: +44(0)7516622121 The University of Manchester Room 7.7, Schuster Building Manchester, M13 9PL, UK email: Niels.Walet(a)manchester.ac.uk twitter: @nwalet

2 1

empty netgroups = all user could access to all machines?
by Thomas Lau 27 Jun '17

27 Jun '17

Folks, After migrated from FreeIPA 3.3.0 to 4.4.0, all user groups to host groups mapping is gone, now 4.4.0 seems introduce this feature call "Netgroups", which is currently empty, I haven't hear any user complain, does it mean if "Netgroups" is empty all user could access to all machines which enrolled on FreeIPA?

1 1

Re: bind-dyndb-ldap and RPZ
by Brendan Kearney 26 Jun '17

26 Jun '17

On 06/26/2017 02:52 PM, Brendan Kearney wrote: > are response policy zones supported by bind-dyndb-ldap? i am looking > to set something up that prevents my smart tv from spying on me, and > found this URL: > > http://rainbow.chard.org/2017/03/08/selectively-blocking-samsung-tvs-networ… > > > a link on the page, referring to blocking win10 from reporting > telemetry data > > http://rainbow.chard.org/2015/08/31/block-windows-10-telemetry-with-local-r… > > > shows an example RPZ construct. right now i have > logingestion.samsungacr.com pointing to 127.0.0.1 via dns domain hack, > but i dont want to have a domain entry for every URL i want to > blackhole via DNS. the RPZ seems like it would be easier, since its > one zone with multiple entries in it. can this be done with > bind-dyndb-ldap? > > thanks, > > brendan > sending to the correct address might help...

1 0

certmonger CA settings
by Ian Pilcher 26 Jun '17

26 Jun '17

As part of my debugging efforts (see "Expired certificates" thread), I changed modified the settings for the dogtag-ipa-renew-agent and dogtag-ipa-ca-renew-agent CAs. Unfortunately, I forgot to make a note of the original settings. Are these correct for IPA 4.4 (on CentOS 7)? CA 'SelfSign': is-default: no ca-type: INTERNAL:SELF next-serial-number: 01 CA 'IPA': is-default: no ca-type: EXTERNAL helper-location: /usr/libexec/certmonger/ipa-server-guard /usr/libexec/certmonger/ipa-submit CA 'certmaster': is-default: no ca-type: EXTERNAL helper-location: /usr/libexec/certmonger/certmaster-submit CA 'dogtag-ipa-renew-agent': is-default: no ca-type: EXTERNAL helper-location: /usr/libexec/certmonger/ipa-server-guard /usr/libexec/certmonger/dogtag-ipa-renew-agent-submit CA 'local': is-default: no ca-type: EXTERNAL helper-location: /usr/libexec/certmonger/local-submit CA 'dogtag-ipa-ca-renew-agent': is-default: no ca-type: EXTERNAL helper-location: /usr/libexec/certmonger/ipa-server-guard /usr/libexec/certmonger/dogtag-ipa-ca-renew-agent-submit -- ======================================================================== Ian Pilcher arequipeno(a)gmail.com -------- "I grew up before Mark Zuckerberg invented friendship" -------- ========================================================================

5 9

Users not imported with Active Directory Synchronization
by laurent2.perrin＠orange.com 26 Jun '17

26 Jun '17

Hi, I'm trying to setup a FreeIPA and Active Directory synchronisation following Red Hat documentation(https://access.redhat.com/documentation/en-US/Red_Hat_Enterpr…. The ipa-replica-manage command returns a success but no user are imported in FreeIPA: ipa-replica-manage connect --winsync --binddn='cn=ipasync,cn=Users,dc=ipa,dc=local' --bindpw='####' --passsync #### --cacert ipa-a-v Directory Manager password: Added CA certificate ipa-ad.cloud.620nm.net.cer to certificate database for ipa.cloud.620nm.net ipa: INFO: AD Suffix is: DC=ipa,DC=local The user for the Windows PassSync service is uid=passsync,cn=sysaccounts,cn=etc,dc=ipa,dc=cloud,dc=620nm,dc=net Windows PassSync system account exists, not resetting password ipa: INFO: Added new sync agreement, waiting for it to become ready . . . ipa: INFO: Replication Update in progress: FALSE: status: Error (0) Replica acquired successfully: Incremental update started: start: 0: end: 0 ipa: INFO: Agreement is ready, starting replication . . . Starting replication, please wait until this has completed. Update in progress, 2 seconds elapsed Update succeeded The ipasync user has been created with the rights as described in the documentation. In the freeipa logs, I didn't find any error message that could explain that user are not imported. Regards, [cid:image001.gif@01CBF2E5.34FD28F0] Laurent PERRIN Service Infra aux Projets Orange Applications for Business SCE/OAB/DPO/DT/SF/CLOUDS tel. +33 4 37 24 62 85 Mob : 07 84 12 78 79 laurent2.perrin(a)orange.com<mailto:laurent2.perrin@orange.com> 139 rue Vendôme 69006 Lyon www.orange-business.com<http://www.orange-business.com/> [cid:image002.gif@01CBF2E5.34FD28F0] _________________________________________________________________________________________________________________________ Ce message et ses pieces jointes peuvent contenir des informations confidentielles ou privilegiees et ne doivent donc pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu ce message par erreur, veuillez le signaler a l'expediteur et le detruire ainsi que les pieces jointes. Les messages electroniques etant susceptibles d'alteration, Orange decline toute responsabilite si ce message a ete altere, deforme ou falsifie. Merci. This message and its attachments may contain confidential or privileged information that may be protected by law; they should not be distributed, used or copied without authorisation. If you have received this email in error, please notify the sender and delete this message and its attachments. As emails may be altered, Orange is not liable for messages that have been modified, changed or falsified. Thank you.

2 2

LDAP + Nextcloud -> retrieve Mailfield
by Jens Laufer 26 Jun '17

26 Jun '17

Hello, iam very happy that i got nextcloud connected to freeipa over ldap. It seems to work nearly perfect now, the only thing i wont get worked is to pull the mail from freeipa and add it to nextcloud. I tried to use the field mail but that seem to be empty. My configuration is nearly the same as here http://poorlydocumented.com/2017/02/integrating-nextcloud-11-with-freeipa-4/ Pls help me:) thank u all

4 4

Strange behavior on my structure
by Ataliba Teixeira 23 Jun '17

23 Jun '17

Hello, i'm new on freeipa and i have some problems on my structure here. I have two servers : ipa-replica-manage -v list Directory Manager password: server1.domain : master server2.domain : master When i use the command : # ipa-replica-manage -v list server2.domain server1.domain: replica last init status: None last init ended: 1970-01-01 00:00:00+00:00 last update status: Error (0) Replica acquired successfully: Incremental update succeeded last update ended: 2017-06-23 13:35:42+00:00 # ipa-replica-manage -v list server1.domain server2.domain: replica last init status: None last init ended: 1970-01-01 00:00:00+00:00 last update status: Error (0) Replica acquired successfully: Incremental update succeeded last update ended: 2017-06-23 13:36:42+00:00 There are no errors on the syncronization of this two servers. But i have two strange behaviors on my structure. 1. I have network elements ( servers ) listed on server2. domain ( web ) and are no listed on server1.domain ( web ) And i many servers ( many of this are listed on server2 and not on server1 ), i receive this erro when i try to connect via ssh using the dns name : # ssh app01 @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @ @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY! Someone could be eavesdropping on you right now (man-in-the-middle attack)! It is also possible that a host key has just been changed. The fingerprint for the RSA key sent by the remote host is f5:21:f0:0c:b7:4b:cf:c4:f2:8f:9c:8a:75:d3:55:5c. Please contact your system administrator. Add correct host key in /root/.ssh/known_hosts to get rid of this message. Offending RSA key in /var/lib/sss/pubconf/known_hosts:4 RSA host key for app01 has changed and you have requested strict checking. Host key verification failed. Anyone knows how to sync this two servers ? And about the ssh, how to solve this ? Thanks, -- Ataliba Teixeira via Inbox by Gmail

1 1

ipa host-del --updatedns
by arsene.gschwind＠gmail.com 23 Jun '17

23 Jun '17

Hi, I'm running VERSION: 4.4.0, API_VERSION: 2.213. When trying to delete a host using # ipa host-del --updatedns it returns always the following error even if the DNS record exists. ipa: WARNING: DNS record(s) of host velo.vm.example.com could not be removed. (No A, AAAA, SSHFP or PTR records found.) How to reproduce: # ipa host-add velo.vm.example.com --ip-address=10.0.20.67 --random ------------------------------ Added host "velo.vm.example.com" ------------------------------ Host name: velo.vm.example.com Random password: xxxxxxxx Password: True Keytab: False Managed by: velo.vm.example.com # ipa dnsrecord-show vm.example.com velo Record name: velo A record: 10.0.20.67 # ipa dnsrecord-show 10.in-addr.arpa 67.20.0 Record name: 67.20.0 PTR record: velo.vm.example.com. # ipa host-del velo --updatedns ipa: WARNING: DNS record(s) of host velo.vm.example.com could not be removed. (No A, AAAA, SSHFP or PTR records found.) ------------------- Deleted host "velo" ------------------- The DNS records are not deleted ... Thanks for any hint / help Rgds, Arsène

3 2

Insufficient 'delete' privilege
by Sieferlinger, Andreas 23 Jun '17

23 Jun '17

Hi all, after an upgrade von 4.1 to 4.4 (4.4.0-14.el7.centos.7) I have some trouble in changing replication agreements. #ipa-replica-manage del auth4.example.com 'auth9.example.com' has no replication agreement for 'auth4.example.com' # ipa-replica-manage del auth4.example.com --force --clean Cleaning a master is irreversible. This should not normally be require, so use cautiously. Continue to clean master? [no]: yes Re-run /sbin/ipa-replica-manage with --verbose option to get more information Unexpected error: Insufficient access: Insufficient 'delete' privilege to delete the entry 'krbprincipalname=ldap/auth4.example.com(a)example.com,cn=services,cn=accounts,dc=example,dc=com'. I suspect some missing ACLs that probably got lost during an update, although I do not know which and how to read. Any help would be appreciated. Andreas Sieferlinger Site Reliability Engineer glomex GmbH A Company of ProSiebenSat.1 Media SE Landsberger Straße 110 D-80339 Munich Germany Tel. +49 89 9507 8964 Executive Board: Michael Jaschke (CEO), Arnd Mückenberger (CFO) Registered Office: Unterfoehring HRB 224542 AG München VAT number DE 305765704 Tax No. 143/314/40826

2 2

Fwd: Logwatch and FreeIPA/sssd
by Lachlan Musicman 22 Jun '17

22 Jun '17

Hola, I have logwatch set up on my server, and there is a stanza in my daily email called "**Unmatched Entries**", which is filled with lines from either ipa or sssd: Failed password for usename(a)domain.com from 10.126.67.170 port 57331 ssh2 : 2 time(s) Accepted password for usename(a)domain.com from 10.126.67.170 port 61402 ssh2 : 1 time(s) pam_sss(sshd:auth): authentication success; logname= uid=0 euid=0 tty=ssh ruser= rhost=hostname.domain.com user=usename(a)domain.com : 1 time(s) Does anyone have a logwatch .conf script that they have written? Does such a thing formally exist for ipa/sssd? cheers L. ------ "Mission Statement: To provide hope and inspiration for collective action, to build collective power, to achieve collective transformation, rooted in grief and rage but pointed towards vision and dreams." - Patrisse Cullors, *Black Lives Matter founder*

1 0

Issue with replica creation
by Oleg Danilovich 22 Jun '17

22 Jun '17

Hello guys, I have problems with creation freeipa master replica. ipa --version VERSION: 4.3.1, API_VERSION: 2.164 Master server Idp+self sign CA I want create full replica of master server Host for replica in domain (ipa-client-install -U --domain= --server= ipa1.itcapital.io --password= --principal=--hostname= --no-ntp --mkhomedir) I try to create replica: ipa-replica-install --hostname=<domain name> --domain=<domain name> --server=<ipa server name> --password=XXXXXX --principal=admin --setup-ca Replica installation success but CA replica creation failed: Configuring certificate server (pki-tomcatd). Estimated time: 3 minutes 30 seconds [1/23]: creating certificate server user [2/23]: creating certificate server db [3/23]: setting up initial replication Starting replication, please wait until this has completed. Update in progress, 5 seconds elapsed Update succeeded [4/23]: creating installation admin user [5/23]: setting up certificate server ipa.ipaserver.install.cainstance.CAInstance: CRITICAL Failed to configure CA instance: Command '/usr/sbin/pkispawn -s CA -f /tmp/tmpjnucvO' returned non-zero exit status 1 ipa.ipaserver.install.cainstance.CAInstance: CRITICAL See the installation logs and the following files/directories for more information: ipa.ipaserver.install.cainstance.CAInstance: CRITICAL /var/log/pki/pki-tomcat [error] RuntimeError: CA configuration failed. Your system may be partly configured. Run /usr/sbin/ipa-server-install --uninstall to clean up. ipa.ipapython.install.cli.install_tool(Replica): ERROR CA configuration failed. ipa.ipapython.install.cli.install_tool(Replica): ERROR The ipa-replica-install command failed. See /var/log/ipareplica-install.log for more information Maybe somebody has information about this issue? -- Best regards, *Oleg Danilovich*

3 3

Fwd: Change subdomain
by Matt . 22 Jun '17

22 Jun '17

Hi Guys, When you have a subdomain with hosts in it is it possible to change that subdomain in a simple way ? Normal DNS server can do but as LDAP is involved I hope this is possible as well! Thanks, Matt

1 0

cannot connect ...Encountered end of file.
by Vinny Del Signore 22 Jun '17

22 Jun '17

Hello all, Has anyone seen this issue? We've tried to generate a new CA and SSL Cert. IPA v.3.0.0-50 # rpm -qa | grep ipa-server ipa-server-selinux-3.0.0-50.el6.1.x86_64 ipa-server-3.0.0-50.el6.1.x86_64 root ldap-srv /var/log/dirsrv/slapd-DOMAIN-COM # ipa-replica-prepare --ip-address=10.10.xx.xx rtlvxl0055.test.local Directory Manager (existing master) password: Preparing replica for rtlvxl0055.test.local from ldap-srv.domain.com Creating SSL certificate for the Directory Server preparation of replica failed: cannot connect to 'https://ldap-srv.domain..com:9444/ca/ee/ca/profileSubmitSSLClient': (PR_END_OF_FILE_ERROR) Encountered end of file. cannot connect to 'https://ldap-srv.domain..com:xxxx/ca/ee/ca/profileSubmitSSLClient': (PR_END_OF_FILE_ERROR) Encountered end of file. File "/usr/sbin/ipa-replica-prepare", line 490, in <module> main() File "/usr/sbin/ipa-replica-prepare", line 361, in main export_certdb(api.env.realm, ds_dir, dir, passwd_fname, "dscert", replica_fqdn, subject_base) File "/usr/sbin/ipa-replica-prepare", line 150, in export_certdb raise e root ldap-srv /var/log/dirsrv/slapd-DOMAIN-COM # root ldap-srv /var/log/dirsrv/slapd-DOMAIN-COM # rpm -qa | grep ipa-server ipa-server-selinux-3.0.0-50.el6.1.x86_64 ipa-server-3.0.0-50.el6.1.x86_64 root ldap-srv /var/log/dirsrv/slapd-DOMAIN-COM # uname -r 2.6.32-642.3.1.el6.x86_64 root ldap-srv /var/log/dirsrv/slapd-DOMAIN-COM # cat /etc/redhat-release Red Hat Enterprise Linux Server release 6.6 (Santiago) root ldap-srv /var/log/dirsrv/slapd-DOMAIN-COM # Kind regards, Vin

4 4

IPA Locations: client chooses wrong/random IPA server
by Denis Iskandarov 22 Jun '17

22 Jun '17

Hello, I have two datacenters. One is self hosted so all the docs are working just fine. The second one is AWS. I've managed to setup replica between "static" DC , "DC1", and AWS "cloud" DC with all its problems. There are still issues to solve within AWS. But "static" which has Bind name servers is not working properly. Client hosts are using my external DNSs, with proper zone delegation to IPA. And are slaves of zone delegated to FreeIPA - so they do receive all updates from IPA. Default TTL lowered to 5min. Configured IPA locations. During install ipa-client-install in "DC1" chooses wrong IPA server, one dedicated for AWS. And because of our security policies clients are not allowed to communicate with AWS IPA - so installation completely fails. At some point randomly of course it chooses correct IPA server. dig on every host in network shows correct priorities and weights. Below I will paste related configs outputs: ; auth.tld zone delegation > auth.tld. IN NS ipa.auth.tld. > auth.tld. IN NS dns1.tld. > ipa.auth.tld. IN A 10.200.10.9 > ipa-aws.auth.tld. IN A 10.70.83.86 on client host, and every other dig looks like: > # dig +short _ldap._tcp.auth.tld SRV > _ldap._tcp.dc1._locations.auth.tld. > 0 100 389 ipa.auth.tld. > 50 100 389 ipa-aws.auth.tld. or putting servers on different positions but still with correct priorities: > dig +short _ldap._tcp.auth.tld SRV > _ldap._tcp.dc1._locations.auth.tld. > 50 100 389 ipa-aws.auth.tld. > 0 100 389 ipa.auth.tld. [root@client-001 ~]# /usr/sbin/ipa-client-install --domain='auth.tld' > --principal='hostreg' --password='xxxxxxx' --mkhomedir --no-sshd --no-ntp > Discovery was successful! > Client hostname: client-001.dmz.dc1.tld > Realm: AUTH.tld > DNS Domain: auth.tld > IPA Server: ipa-aws.auth.tld > BaseDN: dc=auth,dc=tld > Continue to configure the system with these values? [no]: no > Installation failed. Rolling back changes. > IPA client is not configured on this system. I don't understand, why if dig shows correct priorities information, ipa-client-install is choosing wrong server. Looks like ipa-client install not treating priorities and is choosing first ipa server from dig list. Can't find out what I'm missing

2 4

GSSAPI login from trusted AD domain to FreeIPA clients not working
by Tiemen Ruiten 21 Jun '17

21 Jun '17

Hello, I have a FreeIPA domain, i.rdmedia.com, (CentOS 7.3, fully up-to-date: rpm versions are 4.4.0-14.el7.centos.7) with a two-way, non-transitive, external trust to an Active Directory domain in another forest, clients.rdmedia.com, (Windows Server 2012R2). I've setup the trust using the Administrator credentials. As one of the final steps, I would like to get passwordless SSH-access using GSSAPI to work, but unfortunately I get the following error in the Putty log when connecting from an AD domain-joined client: Event Log: GSSAPI authentication initialisation failed Event Log: The target was not recognized Is it possible to configure GSSAPI authentication for a cross-forest trust or should I setup the trust as a 'Trusted Forest' ie. not external? -- Tiemen Ruiten Systems Engineer R&D Media

4 11

Rebuilding IPA environment
by John Bowman 21 Jun '17

21 Jun '17

What would be the best method to stand up a new IPA environment while keeping as much of the existing data as possible? I've read that the ipa migrate-ds only migrates the users and groups and the recommended suggestion is to set up a replica. I'd like to sever any ties to the existing environment but not have to start over completely from scratch if at all possible. Ideally I would be able to just point existing services to the new environment and hopefully minimize impact, I'm sure I'd still have plenty of manual changes as well, but one can dream. Basically I'm just running in to too many issues with trying to expand our existing environment some of which is related to having a mix of IPA 3.0 and 4.x I believe and likely some old and recent missteps that make me question the stability of our environment. Any tips/advice would be appreciated. -- John Bowman

4 3

Master -> replica through NAT?
by Kat 21 Jun '17

21 Jun '17

Here is an odd problem (I think). I am using IPA in one environment, and want to set up a replica in another environment through natted connections. I can setup the client to the NAT server, but here is the tricky part - IPA is also DNS. So if I try to bring the DNS setup over with -- ipa-replica-install --setup-dns --forwarder=10.x.x.x --setup-ca It fails, because when it tries to lookup the master on the other side of the NAT FW, of course it resolves incorrectly. The first failure is conn-check, so even if I --skip-conncheck, it still fails since DNS will not resolve. Suggestions? -K

3 5

Expired certificates
by Ian Pilcher 21 Jun '17

21 Jun '17

After rebooting my CentOS 7 IdM server, pki-tomcatd is failing to start. I see this (repeated many times) in the journal: WARNING: Exception processing realm com.netscape.cms.tomcat.ProxyRealm@383171f8 background process javax.ws.rs.ServiceUnavailableException: Subsystem unavailable at com.netscape.cms.tomcat.ProxyRealm.backgroundProcess(ProxyRealm.java:137) at org.apache.catalina.core.ContainerBase.backgroundProcess(ContainerBase.java:1357) at org.apache.catalina.core.ContainerBase$ContainerBackgroundProcessor.processChildren(ContainerBase.java:1543) at org.apache.catalina.core.ContainerBase$ContainerBackgroundProcessor.processChildren(ContainerBase.java:1553) at org.apache.catalina.core.ContainerBase$ContainerBackgroundProcessor.processChildren(ContainerBase.java:1553) at org.apache.catalina.core.ContainerBase$ContainerBackgroundProcessor.run(ContainerBase.java:1521) at java.lang.Thread.run(Thread.java:748) getcert list shows a number of expired certificates (which is EXTREMELY frustrating, as I thought that certmonger, which is running, was supposed to take care of these renewals): Request ID '20170306100908': status: CA_UNREACHABLE ca-error: Error 60 connecting to https://asterisk.penurio.us:8443/ca/agent/ca/profileReview: Peer certificate cannot be authenticated with given CA certificates. stuck: no key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert cert-pki-ca',token='NSS Certificate DB',pin set certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert cert-pki-ca',token='NSS Certificate DB' CA: dogtag-ipa-ca-renew-agent issuer: CN=Certificate Authority,O=PENURIO.US subject: CN=CA Audit,O=PENURIO.US expires: 2017-06-19 16:27:30 UTC key usage: digitalSignature,nonRepudiation pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "auditSigningCert cert-pki-ca" track: yes auto-renew: yes Request ID '20170306100911': status: CA_UNREACHABLE ca-error: Error 60 connecting to https://asterisk.penurio.us:8443/ca/agent/ca/profileReview: Peer certificate cannot be authenticated with given CA certificates. stuck: no key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert cert-pki-ca',token='NSS Certificate DB',pin set certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert cert-pki-ca',token='NSS Certificate DB' CA: dogtag-ipa-ca-renew-agent issuer: CN=Certificate Authority,O=PENURIO.US subject: CN=OCSP Subsystem,O=PENURIO.US expires: 2017-06-19 16:26:30 UTC eku: id-kp-OCSPSigning pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "ocspSigningCert cert-pki-ca" track: yes auto-renew: yes Request ID '20170306100914': status: CA_UNREACHABLE ca-error: Error 60 connecting to https://asterisk.penurio.us:8443/ca/agent/ca/profileReview: Peer certificate cannot be authenticated with given CA certificates. stuck: no key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert cert-pki-ca',token='NSS Certificate DB',pin set certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert cert-pki-ca',token='NSS Certificate DB' CA: dogtag-ipa-ca-renew-agent issuer: CN=Certificate Authority,O=PENURIO.US subject: CN=CA Subsystem,O=PENURIO.US expires: 2017-06-19 16:26:30 UTC key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment eku: id-kp-serverAuth,id-kp-clientAuth pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "subsystemCert cert-pki-ca" track: yes auto-renew: yes Is there a published procedure to fix this? (I did find a procedure for RHEL/CentOS 6 and IPA 3, on the Red Hat site, but I am using CentOS 7 with IPA 4.4.) -- ======================================================================== Ian Pilcher arequipeno(a)gmail.com -------- "I grew up before Mark Zuckerberg invented friendship" -------- ========================================================================

2 6

Frequent "LDAP query timed out" in named-pkcs11
by emil.flink＠gmail.com 21 Jun '17

21 Jun '17

Hi, I am running two FreeIPA servers up-to-date on Fedora 25, ie. v4.4.4 of FreeIPA, in a small office environment. named-pkcs11 is logging quite many (~30 a day) errors like the below block: LDAP error: Timed out: while modifying(replace) entry 'idnsname=ddns.ske1.bublar.,cn=dns,dc=ipa,dc=bublar' retrying LDAP operation (modifying(replace)) on entry 'idnsname=ddns.ske1.bublar.,cn=dns,dc=ipa,dc=bublar' LDAP query timed out. Try to adjust "timeout" parameter zone ddns.ske1.bublar/IN: serial (1498025739) write back to LDAP failed I am also seeing intermittent login issues in services configured with LDAP login, which further indicates the directory server is intermittently unresponsive. However, the "errors" log for the directory server does not contain any errors. How can I further debug/troubleshoot this issue?

1 0

Replication conflict woes
by John Bowman 20 Jun '17

20 Jun '17

After a lot of patching in order to get the environment up to date in order to add a new CA replica and remove our IPA 3.0 servers we ended up with a bunch of conflicts and other inconsistencies: $ ldapsearch -o ldif-wrap=no -ZZ -LLLx -h "ipa0.domain.tld" -D "cn=directory manager" -w secret -b "dc=domain,dc=tld" "nsds5ReplConflict=*" \ nsds5ReplConflict dn: cn=ipaservers+nsuniqueid=e8d2f705-512111e7-9205b5bf-43202000,cn=hostgroups,cn=accounts,dc=domain,dc=tld dn: cn=ipaservers+nsuniqueid=e8d2f707-512111e7-9205b5bf-43202000,cn=ng,cn=alt,dc=domain,dc=tld dn: cn=domain+nsuniqueid=e8d2f70e-512111e7-9205b5bf-43202000,cn=topology,cn=ipa,cn=etc,dc=domain,dc=tld dn: cn=locations+nsuniqueid=e8d2f712-512111e7-9205b5bf-43202000,cn=etc,dc=domain,dc=tld dn: cn=DNS Administrators+nsuniqueid=e8d2f718-512111e7-9205b5bf-43202000,cn=privileges,cn=pbac,dc=domain,dc=tld dn: cn=DNS Servers+nsuniqueid=e8d2f71a-512111e7-9205b5bf-43202000,cn=privileges,cn=pbac,dc=domain,dc=tld dn: cn=cas+nsuniqueid=e8d2f71c-512111e7-9205b5bf-43202000,cn=ca,dc=domain,dc=tld dn: cn=dogtag+nsuniqueid=e8d2f74d-512111e7-9205b5bf-43202000,cn=custodia,cn=ipa,cn=etc,dc=domain,dc=tld dn: cn=ca+nsuniqueid=e8d2f750-512111e7-9205b5bf-43202000,cn=topology,cn=ipa,cn=etc,dc=domain,dc=tld dn: cn=System: Add CA+nsuniqueid=e8d2f75d-512111e7-9205b5bf-43202000,cn=permissions,cn=pbac,dc=domain,dc=tld dn: cn=System: Delete CA+nsuniqueid=e8d2f761-512111e7-9205b5bf-43202000,cn=permissions,cn=pbac,dc=domain,dc=tld dn: cn=System: Modify CA+nsuniqueid=e8d2f765-512111e7-9205b5bf-43202000,cn=permissions,cn=pbac,dc=domain,dc=tld dn: cn=System: Read CAs+nsuniqueid=e8d2f769-512111e7-9205b5bf-43202000,cn=permissions,cn=pbac,dc=domain,dc=tld dn: cn=System: Modify DNS Servers Configuration+nsuniqueid=e8d2f77a-512111e7-9205b5bf-43202000,cn=permissions,cn=pbac,dc=domain,dc=tld dn: cn=System: Read DNS Servers Configuration+nsuniqueid=e8d2f77e-512111e7-9205b5bf-43202000,cn=permissions,cn=pbac,dc=domain,dc=tld dn: cn=System: Add IPA Locations+nsuniqueid=e8d2f807-512111e7-9205b5bf-43202000,cn=permissions,cn=pbac,dc=domain,dc=tld dn: cn=System: Modify IPA Locations+nsuniqueid=e8d2f80b-512111e7-9205b5bf-43202000,cn=permissions,cn=pbac,dc=domain,dc=tld dn: cn=System: Read IPA Locations+nsuniqueid=e8d2f80f-512111e7-9205b5bf-43202000,cn=permissions,cn=pbac,dc=domain,dc=tld dn: cn=System: Remove IPA Locations+nsuniqueid=e8d2f813-512111e7-9205b5bf-43202000,cn=permissions,cn=pbac,dc=domain,dc=tld dn: cn=System: Read Locations of IPA Servers+nsuniqueid=e8d2f82c-512111e7-9205b5bf-43202000,cn=permissions,cn=pbac,dc=domain,dc=tld dn: cn=System: Read Status of Services on IPA Servers+nsuniqueid=e8d2f830-512111e7-9205b5bf-43202000,cn=permissions,cn=pbac,dc=domain,dc=tld dn: cn=System: Manage Service Principals+nsuniqueid=e8d2f834-512111e7-9205b5bf-43202000,cn=permissions,cn=pbac,dc=domain,dc=tld dn: cn=System: Manage User Principals+nsuniqueid=e8d2f866-512111e7-9205b5bf-43202000,cn=permissions,cn=pbac,dc=domain,dc=tld dn: dnaHostname=ipa1.domain.tld+dnaPortNum=0+nsuniqueid=c90407a3-51e311e7-9205b5bf-43202000,cn=posix-ids,cn=dna,cn=ipa,cn=etc,dc=domain,dc=tld Looking only at the first one I see two entries for it: $ ldapsearch -o ldif-wrap=no -ZZ -LLLx -h "ipa0.domain.tld" -D "cn=directory manager" -w secret -b cn=ipaservers+nsuniqueid=e8d2f705-512111e7-9205b5bf-43202000,cn=hostgroups,cn=accounts,dc=domain,dc=tld -s base dn: cn=ipaservers+nsuniqueid=e8d2f705-512111e7-9205b5bf-43202000,cn=hostgroups,cn=accounts,dc=domain,dc=tld ipaUniqueID: fe7226e4-5121-11e7-82f1-005056972fd9 cn: ipaservers description: IPA server hosts objectClass: top objectClass: ipahostgroup objectClass: ipaobject objectClass: groupOfNames objectClass: nestedGroup objectClass: mepOriginEntry mepManagedEntry: cn=ipaservers,cn=ng,cn=alt,dc=domain,dc=tld member: fqdn=ipa1.domain.tld,cn=computers,cn=accounts,dc=domain,dc=tld [jbowman@idm ipa_check_consistency]$ ldapsearch -o ldif-wrap=no -ZZ -LLLx -h "ipa0.domain.tld" -D "cn=directory manager" -w secret -b cn=ipaservers,cn=hostgroups,cn=accounts,dc=domain,dc=tld -s base dn: cn=ipaservers,cn=hostgroups,cn=accounts,dc=domain,dc=tld ipaUniqueID: 319cb1ce-c21b-11e6-bab9-005056977521 cn: ipaservers description: IPA server hosts objectClass: top objectClass: ipahostgroup objectClass: ipaobject objectClass: groupOfNames objectClass: nestedGroup objectClass: mepOriginEntry mepManagedEntry: cn=ipaservers,cn=ng,cn=alt,dc=domain,dc=tld member: fqdn=ipa1.domain.tld,cn=computers,cn=accounts,dc=domain,dc=tld member: fqdn=ipa4.domain.tld,cn=computers,cn=accounts,dc=domain,dc=tld member: fqdn=ipa5.domain.tld,cn=computers,cn=accounts,dc=domain,dc=tld memberOf: cn=replication administrators,cn=privileges,cn=pbac,dc=domain,dc=tld memberOf: cn=add replication agreements,cn=permissions,cn=pbac,dc=domain,dc=tld memberOf: cn=modify replication agreements,cn=permissions,cn=pbac,dc=domain,dc=tld memberOf: cn=remove replication agreements,cn=permissions,cn=pbac,dc=domain,dc=tld memberOf: cn=read passsync managers configuration,cn=permissions,cn=pbac,dc=domain,dc=tld memberOf: cn=modify passsync managers configuration,cn=permissions,cn=pbac,dc=domain,dc=tld memberOf: cn=read ldbm database configuration,cn=permissions,cn=pbac,dc=domain,dc=tld memberOf: cn=add configuration sub-entries,cn=permissions,cn=pbac,dc=domain,dc=tld memberOf: cn=modify dna range,cn=permissions,cn=pbac,dc=domain,dc=tld memberOf: cn=read dna range,cn=permissions,cn=pbac,dc=domain,dc=tld memberOf: cn=read replication agreements,cn=permissions,cn=pbac,dc=domain,dc=tld memberOf: ipauniqueid=87c611a4-3753-11e3-a382-0050568e07ed,cn=sudorules,cn=sudo,dc=domain,dc=tld memberOf: cn=ipaservers,cn=ng,cn=alt,dc=domain,dc=tld memberOf: cn=ipaservers+nsuniqueid=e8d2f707-512111e7-9205b5bf-43202000,cn=ng,cn=alt,dc=domain,dc=tld I made the mistake of trying to delete: cn=ipaservers+nsuniqueid=e8d2f705-512111e7-9205b5bf-43202000,cn=hostgroups,cn=accounts,dc=domain,dc=tld After a successful deletion with ldapmodify, the entry is removed on 5 of the 6 servers but 1 server (in this case ipa1.domain.tld) it deletes the valid entry on that server. I'm concerned these errors could cause other issues further down the road and would like to get them cleared up but not having much success which doesn't build confidence unfortunately. Any tips would be appreciated. If it helps ipa0 = RHEL 6 with IPA 3.0 ipa1 = RHEL 7 with IPA 4.4 (recently updated from 4.2) ipa2 = RHEL 6 with IPA 3.0 ipa3 = RHEL 6 with IPA 3.0 ipa4 = RHEL 7 with IPA 4.4 ipa5 = RHEL 7 with IPA 4.4 Thanks!

3 5

Overcoming hurdles installing freeipa-server on ubuntu 17.10
by David Harvey 20 Jun '17

20 Jun '17

Hope this helps to save some of some time digging. And I know, freeipa-server on a non LTS release is daft.. apt-get install freeipa-server-trust-ad #This has been mentioned elsewhere, and it should either be a dependency OR it's absence should not break things as it currently does sudo mkdir /etc/krb5.conf.d/ #Apparently this is expected by ipa-server to have been generated by one of the kerberos packages but is not.. mkdir -p /usr/libexec/ipa sudo ln -s /usr/lib/ipa/ipa-httpd-kdcproxy /usr/libexec/ipa/ipa-httpd-kdcproxy #The last two lines are a pretty dirty hack as I couldn't work out where in the ipa-server-install the file /etc/systemd/system/apache2.service.d/ipa.conf is created or updated. This file has a bad path to ipa-httpd-kdcproxy so ideally there should be some logic to check where it is before defining a path to it.

3 4

admin account locked due to external ssh authentication attempts
by peter＠husen.dk 20 Jun '17

20 Jun '17

I manage a small FreeIPA domain that has one server that can be accessed through ssh from the internet. I occasionally find that the admin account is locked, when I try to log in to the FreeIPA admin interface (not available from the Internet), and it seems that this is due to an endless stream of incoming ssh authentication attempts for common names like "root" and "admin", and in the latter case, the authentication is forwarded to the FreeIPA server (since the user exists in the directory, I suppose), and the account gets locked out temporarily now and then due to too many failed attempts. Now, admin is not actually supposed to be able to login through ssh (or as a POSIX account in general), so I have tried to add: DenyUsers admin to sshd_config on that server to filter out these attempts, but it seems (as far as I can see in the logs) that the authentication is still tried against the FreeIPA server, before it gets blocked by sshd. What is the best way to prevent the evil bots of the Internet from locking out my admin account?

4 4

new replica install?
by Kat 19 Jun '17

19 Jun '17

Trying to find the new replica installation procedure for doing it. Apparently ipa-replica-prepare, etc is no longer the way, although all the Rehdat docs say it is. :-(

2 2

Migration from freeipa to samba-ad
by Николай Савельев 19 Jun '17

19 Jun '17

Hello. I have about 60 linux clients in free-ipa and about 20 clients in AD. I want to use only one system for users identication. Freeipa can't identication and autentication windows client. So I shoud to use AD. For migration I should only deleting freeipa-client from host and then registering that hosts in AD? Best regards, Nik.

2 2

FreeIPA master and replica behind an Elastic load balancer
by ridha.zorgui＠infor.com 19 Jun '17

19 Jun '17

I set up a FreeIPA master and replica behind an elastic load balancer in AWS cloud. FreeIPA Clients will be contacting the replica and the master sever through the load balancer so the dns name used when configurting the clients is the ELB CNAME. The problem is when retreiving data and during the authentication, the SSL handshake fail as the certificate send back from the master or replica has a hostname different than the one used in the sssd. so the connection is terminated. There is a workaround which is the use reqcert=allow but this b ring a security issue with a MITM attack. another solution i found is the use SAN but i don't seem to make it right. any thought on how to solve that will be very helpful.

3 4

Announcing FreeIPA 4.5.2
by Tomas Krizek 18 Jun '17

18 Jun '17

ReleaseDate: 2017-06-18 The FreeIPA team would like to announce FreeIPA 4.5.2 release! It can be downloaded from http://www.freeipa.org/page/Downloads. Builds for Fedora 25/26 will be available in the official COPR repository https://copr.fedorainfracloud.org/coprs/g/freeipa/freeipa-4-5/ . == Highlights in 4.5.2 == * 5860: depracate --no-sssd option Option '--no-sssd' has been deprecated because SSSD is recommened to use on modern platforms - Fedora, RHEL 6, RHEL 7, Debian. === Enhancements === === Known Issues === === Bug fixes === FreeIPA 4.5.2 is a stabilization release for the features delivered as a part of 4.5.0. There are more than 20 bug-fixes details of which can be seen in the list of resolved tickets below. == Upgrading == Upgrade instructions are available on page: https://www.freeipa.org/page/Upgrade == Feedback == Please provide comments, bugs and other feedback via the freeipa-users mailing list (https://lists.fedoraproject.org/archives/list/freeipa-users@lists.fedorahos…) or #freeipa channel on Freenode. == Resolved tickets == * 7020 Installation of KRA replica fails * 7015 allow to modify list of UPNs of a trusted forest * 7001 Do not send Max-Age in ipa_session cookie to avoid breaking older clients * 7000 Provide a simple command to issue KDC certificates on a IPA master * 6993 certauth: use canonical principal for lookups * 6982 Provide a tooling automating the configuration of Smart Card authentication on a FreeIPA master * 6981 Enabling OCSP checks in mod_nss breaks certificate issuance when ipa-ca records are not resolvable * 6977 Simple service uninstallers must be able to handle missing service files gracefully * 6972 Replica installation grants HTTP principal access in WebUI * 6966 Document that port 8080 needs to be open on IPA masters for cert-find * 6965 ipa-replica-manage del replica.name fails * 6963 ipa certmaprule change not reflected in krb5kdc workers * 6958 [tracker] SELinux policy denies IPA framework to perform anonymous PKINIT on localhost during FAST armoring * 6948 services entries missing krbCanonicalName attribute. * 6937 Provide an API command to retrieve PKINIT status in the FreeIPA topology * 6936 Deprecate `ipa pkinit-anonymous` command in FreeIPA 4.5+ * 6935 ipa-replica-conncheck fails when there is no ssh executable on the master * 6885 ipa cert-show does not raise error if no file name specified * 6867 [ipa-replica-install] - KDC has no support for encryption type * 6800 Investigate how privilege separation feature will work after DL0->DL1 update * 6796 WSGI fails with recursion error in GSSAPI * 6749 "ipa: ERROR: an internal error has occurred" on executing command "ipa cert-request --add" after upgrade * 6736 Add pkinit_indicator option to KDC configuration * 6572 server-del doesn't remove dns-server configuration from ldap * 5860 depracate --no-sssd option * 5788 user-add postcallback is not efficient when --noprivate flag is set * 5406 ipa-client-install should not use hardcoded admin principal == Detailed changelog since 4.5.1 == === Alexander Bokovoy (4) === * trust-mod: allow modifying list of UPNs of a trusted forest * ipa-kdb: add pkinit authentication indicator in case of a successful certauth * Fix index definition for ipaAnchorUUID * krb5: make sure KDC certificate is readable === David Kupka (1) === * kra: promote: Get ticket before calling custodia === Felipe Volpone (2) === * Changing cert-find to go through the proxy instead of using the port 8080 * Changing cert-find to do not use only primary key to search in LDAP. === Florence Blanc-Renaud (1) === * ipa-replica-conncheck: handle ssh not installed === Jan Cholasta (4) === * server upgrade: do not enable PKINIT by default * pkinit manage: introduce ipa-pkinit-manage * server certinstall: update KDC master entry * httpinstance: wait until the service entry is replicated === Martin Babinsky (10) === * Prepare advise plugin for smart card auth configuration * Extend the advice printing code by some useful abstractions * fix incorrect suffix handling in topology checks * only stop/disable simple service if it is installed * test_serverroles: Get rid of MockLDAP and use ldap2 instead * Add `pkinit-status` command * Add the list of PKINIT servers as a virtual attribute to global config * Add an attribute reporting client PKINIT-capable servers * Refactor the role/attribute member reporting code * Allow for multivalued server attributes === Martin Basti (4) === * Only warn when specified server IP addresses don't match intf * Add remote_plugins subdirectories to RPM * custodia dep: require explictly python2 version * 4.5 set back to git snapshot === Pavel Vomacka (4) === * WebUI: add support for changing trust UPN suffixes * Bump version of python-gssapi * Turn off OCSP check * Change python-cryptography to python2-cryptography === Sumit Bose (2) === * ipa-kdb: use canonical principal in certauth plugin * ipa-kdb: reload certificate mapping rules periodically === Simo Sorce (3) === * Revert setting sessionMaxAge for old clients * Add code to be able to set default kinit lifetime * Fix rare race condition with missing ccache file === Stanislav Laznicka (6) === * rpc: avoid possible recursion in create_connection * rpc: preparations for recursion fix * Avoid possible endless recursion in RPC call * kdc.key should not be visible to all * Remove pkinit-anonymous command * ca/cert-show: check certificate_out in options === Tibor Dudlák (3) === * server.py: Removes dns-server configuration from ldap * sssd.py: Deprecating no-sssd option. * client.py: Replace hardcoded 'admin' with options.principal === Tibor Dudlák (1) === * user.py: replace user_mod with ldap.update_entry() === Tomas Krizek (2) === * Become IPA 4.5.2 * Update translations -- Tomas Krizek PGP: 4A8B A48C 2AED 933B D495 C509 A1FB A5F7 EF8C 4869

1 0

Access issues with SSH/IPA
by John Bowman 15 Jun '17

15 Jun '17

So yesterday we upgrade our older IPA 3.x servers (RHEL 6.8) to the latest and greatest (RHEL 6.9) and it seemed to be working as expected. Came in the next day and older IPA 4.2 server (RHEL 7.2) was having issues so thought it would be a good time patch it up to the latest (IPA 4.4 and RHEL 7.3) seemed okay after it came back up but after a little while hosts configured to use IPA stopped allowing access via ssh. I can explicitly put in sssd.conf to use the patched up 4.4 server and I seem to be able to log in via ssh but when a server is pointing to one of the 3.x servers it just gives me an access denied. The strange part is some accounts (like my test account) can log in to some servers via ssh and can even sudo to root where available regardless of which IPA server the host is using. Any help would be appreciated because I'm stumped on this one. Just let me know what logs would be helpful in troubleshooting. Thanks! -- John Bowman

3 6

How to Setup FreeIPA Services for Mac OS X 10.12
by Jason Sherrill 15 Jun '17

15 Jun '17

Hello All, I have recently submitted a How/To <https://www.freeipa.org/page/HowTo/Setup_FreeIPA_Services_for_Mac_OS_X_10.12> for FreeIPA. I'd very much appreciate any feedback or editing on it- I don't want to link to it without a review. Thanks! -- *Jason Sherrill* Deeplocal Inc. <http://deeplocal.com/> mobile: 412-636-2073 <(412)%20636-2073> office: 412-362-0201 <(412)%20362-0201>

3 3

replication problem
by Adrian HY 15 Jun '17

15 Jun '17

Hi folks, I had a problem with replication and I tried to add the slave back to the replica. The process stops in the initial replication phase. The firewall and selinux are down and both servers are synchronized with the time. Centos 7.3 Freeipa 4.4.0-14 *Master error log:* 11/Jun/2017:01:11:45.690402715 -0400] NSMMReplicationPlugin - agmt="cn= meTousuarios-replica.ipa.server.com" (usuarios-replica:389): Replication bind with GSSAPI auth failed: LDAP error 49 (Invalid credentials) () [11/Jun/2017:01:11:45.690877649 -0400] NSMMReplicationPlugin - Warning: unable to acquire replica for total update, error: 49, retrying in 1 seconds. [11/Jun/2017:01:11:46.966060891 -0400] NSMMReplicationPlugin - agmt="cn= meTousuarios-replica.ipa.server.com" (usuarios-replica:389): Replication bind with GSSAPI auth resumed [11/Jun/2017:01:11:47.095800971 -0400] NSMMReplicationPlugin - Beginning total update of replica "agmt="cn=meTousuarios-replica.ipa.server.com" (usuarios-replica:389)". [11/Jun/2017:01:12:06.873713837 -0400] NSMMReplicationPlugin - agmt="cn= meTousuarios-replica.ipa.server.com" (usuarios-replica:389): Failed to send extended operation: LDAP error -1 (Can't contact LDAP server) [11/Jun/2017:01:12:06.874590112 -0400] NSMMReplicationPlugin - agmt="cn= meTousuarios-replica.ipa.server.com" (usuarios-replica:389): Received error -1 (Can't contact LDAP server): for total updat e operation [11/Jun/2017:01:12:06.874950648 -0400] NSMMReplicationPlugin - agmt="cn= meTousuarios-replica.ipa.server.com" (usuarios-replica:389): Warning: unable to send endReplication extended operation (Can' t contact LDAP server) [11/Jun/2017:01:12:06.875217640 -0400] NSMMReplicationPlugin - Total update failed for replica "agmt="cn=meTousuarios-replica.ipa.server.com" (usuarios-replica:389)", error (-11) [11/Jun/2017:01:12:06.894882383 -0400] NSMMReplicationPlugin - agmt="cn= meTousuarios-replica.ipa.server.com" (usuarios-replica:389): Replication bind with GSSAPI auth resumed [11/Jun/2017:01:12:06.905304992 -0400] NSMMReplicationPlugin - agmt="cn= meTousuarios-replica.ipa.server.com" (usuarios-replica:389): The remote replica has a different database generation ID than the local database. You may have to reinitialize the remote replica, or the local replica. [11/Jun/2017:01:12:09.912282245 -0400] NSMMReplicationPlugin - agmt="cn= meTousuarios-replica.ipa.server.com" (usuarios-replica:389): The remote replica has a different database generation ID than the local database. You may have to reinitialize the remote replica, or the local replica. *Client ipareplica-install.log:* 2017-06-11T05:24:24Z DEBUG stderr= 2017-06-11T05:24:24Z DEBUG wait_for_open_ports: localhost [389] timeout 300 2017-06-11T05:24:24Z DEBUG Fetching nsDS5ReplicaId from master [attempt 1/5] 2017-06-11T05:24:24Z DEBUG flushing ldap://usuarios.ipa.server.com:389 from SchemaCache 2017-06-11T05:24:24Z DEBUG retrieving schema for SchemaCache url=ldap:// usuarios.ipa.server.com:389 conn=<ldap.ldapobject.SimpleLDAPObject instance at 0x86909e0> 2017-06-11T05:24:24Z DEBUG Successfully updated nsDS5ReplicaId. 2017-06-11T05:24:24Z DEBUG flushing ldapi://%2fvar%2frun%2fslapd-IPA.SERVER.COM.socket from SchemaCache 2017-06-11T05:24:24Z DEBUG retrieving schema for SchemaCache url=ldapi://%2fvar%2frun%2fslapd-IPA.SERVER.COM.socket conn=<ldap.ldapobject.SimpleLDAPObject instance at 0x9e74440> 2017-06-11T05:24:46Z DEBUG Traceback (most recent call last): File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 449, in start_creation run_step(full_msg, method) File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 439, in run_step method() File "/usr/lib/python2.7/site-packages/ipaserver/install/dsinstance.py", line 416, in __setup_replica repl.setup_promote_replication(self.master_fqdn) File "/usr/lib/python2.7/site-packages/ipaserver/install/replication.py", line 1643, in setup_promote_replication raise RuntimeError("Failed to start replication") RuntimeError: Failed to start replication 2017-06-11T05:24:46Z DEBUG [error] RuntimeError: Failed to start replication 2017-06-11T05:24:46Z DEBUG Destroyed connection context.ldap2_101192976 2017-06-11T05:24:46Z DEBUG File "/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 171, in execute return_value = self.run() File "/usr/lib/python2.7/site-packages/ipapython/install/cli.py", line 318, in run cfgr.run() File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 310, in run self.execute() File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 332, in execute for nothing in self._executor(): File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 372, in __runner self._handle_exception(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 394, in _handle_exception six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 362, in __runner step() File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 359, in <lambda> step = lambda: next(self.__gen) File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from value = gen.send(prev_value) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 586, in _configure next(executor) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 372, in __runner self._handle_exception(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 449, in _handle_exception self.__parent._handle_exception(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 394, in _handle_exception six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 446, in _handle_exception super(ComponentBase, self)._handle_exception(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 394, in _handle_exception six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 362, in __runner step() File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 359, in <lambda> step = lambda: next(self.__gen) File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from value = gen.send(prev_value) File "/usr/lib/python2.7/site-packages/ipapython/install/common.py", line 63, in _install for nothing in self._installer(self.parent): File "/usr/lib/python2.7/site-packages/ipaserver/install/server/replicainstall.py", line 1722, in main promote(self) File "/usr/lib/python2.7/site-packages/ipaserver/install/server/replicainstall.py", line 372, in decorated func(installer) File "/usr/lib/python2.7/site-packages/ipaserver/install/server/replicainstall.py", line 1423, in promote promote=True, pkcs12_info=dirsrv_pkcs12_info) File "/usr/lib/python2.7/site-packages/ipaserver/install/server/replicainstall.py", line 135, in install_replica_ds api=remote_api, File "/usr/lib/python2.7/site-packages/ipaserver/install/dsinstance.py", line 401, in create_replica self.start_creation(runtime=60) File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 449, in start_creation run_step(full_msg, method) File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 439, in run_step method() File "/usr/lib/python2.7/site-packages/ipaserver/install/dsinstance.py", line 416, in __setup_replica repl.setup_promote_replication(self.master_fqdn) File "/usr/lib/python2.7/site-packages/ipaserver/install/replication.py", line 1643, in setup_promote_replication raise RuntimeError("Failed to start replication")

6 15

Apache authentication with Kerberos to IPA
by Ivars Strazdiņš 15 Jun '17

15 Jun '17

Hi, my question is not directly related to IPA, but since IPA provides underlying authentication services, I think it almost fits here. I have an Apache WebDAV server that authenticates via Kerberos to IPA server. Related configuration in Apache is: AuthType Kerberos # Essential for Windows clients to connect KrbMethodNegotiate Off KrbMethodK5Passwd On KrbAuthRealms REALM Krb5KeyTab /etc/httpd/conf/krb5.keytab KrbServiceName HTTP Require valid-user I can login with IPA username (i.e. user) and user@REALM But I also need to login with e-mail, as user@domain, which does not work. “domain" equals “REALM", but, naturally, domain is lowercase and REALM is uppercase. I could not find any simple solution so far. I thought I could manipulate username supplied by user and I tried to play with /etc/krb5.conf, by adding auth_to_local statements, as below: [realms] REALM = { pkinit_anchors = FILE:/etc/ipa/ca.crt # experimenting to convert to uppercase auth_to_local = RULE:[1:$1@$0](^.*@domain$)s/@domain/@REALM/ auth_to_local = DEFAULT } But this doesn’t work and it seems that it is not even tried by Apache/Kerberos. Could you suggest any other solution if this is possible to achieve at all? One other way that might work is via Apache module mod_map_user, but I could not compile it on Centos7. Thanks for you time and kind regards, Ivars

1 0

Query about the configuration on the High Availability of the FreeIPA
by wenxing zheng 14 Jun '17

14 Jun '17

Dear experts, I have configured a FreeIPA server + a FreeIPA replica, which can work in expectation. But now when I am coming to configure the Client, how to specify the option --server for the ipa-client-install? Since FreeIPA are working in the mode of master + replica, I think when we are configuring the client, we need to specify a "logical" server, otherwise, how to implement the failover? Appreciated for your hints Kind Regards, Wenxing

4 10

Re: FreeIPA - Active Directory integration and domain names
by Striker Leggette 14 Jun '17

14 Jun '17

Yes Sent via carrier pigeons -------- Original message -------- From: bogusmaster--- via FreeIPA-users <freeipa-users(a)lists.fedorahosted.org> Date: 6/14/17 6:06 AM (GMT-05:00) To: freeipa-users(a)redhat.com Cc: bogusmaster(a)o2.pl Subject: [Freeipa-users] FreeIPA - Active Directory integration and domain names Hi, I have a question regarding establishing one-way trust between FreeIPA and Active Directory. In the documentation it is stated that to use a cross-forest trust it is required for FreeIPA to have a different domain than that of Active Directory. Does it also apply to the synchronization scenario? Thank you Bart _______________________________________________ FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org

1 0

Re: IPA Compat + ID Views + AIX 7.1
by wouter.hummelink＠kpn.com 14 Jun '17

14 Jun '17

Is there a way for the compat view to respond to both fully qualified and short uids? IBM seems to require that for trust to work Verzonden vanaf mijn Samsung-apparaat -------- Oorspronkelijk bericht -------- Van: "Hummelink, Wouter" <wouter.hummelink(a)kpn.com> Datum: 22-05-17 15:46 (GMT+01:00) Aan: freeipa-users(a)lists.fedorahosted.org Onderwerp: RE: [Freeipa-users] IPA Compat + ID Views + AIX 7.1 Hi All, We have our basic configuration working now however AD trusted users cannot log in. The system reports: Can't retrieve attribute SYSTEM for NOUSER: No such file or directory In LDAP Access logs we see AIX query user@<ad.domain<mailto:user@%3cad.domain>> and directly after <user> on slapd. The same behavior happens with SU and that results in a session with empty HOME and SHELL variables (and an error report that you can’t change directory to ‘’) LSUSER command do however return correct information about these users. (IPA groups included) [22/May/2017:15:14:10.074845110 +0200] conn=1046 op=75 SRCH base="cn=users,cn=aixtest,cn=views,cn=compat,dc=ipa,dc=domain" scope=2 filter="(&(objectClass=posixaccount)(uid=aduser(a)ad.domain))" attrs=ALL [22/May/2017:15:14:10.076149098 +0200] conn=1046 op=75 RESULT err=0 tag=101 nentries=1 etime=0 [22/May/2017:15:14:10.099789298 +0200] conn=1046 op=76 SRCH base="cn=users,cn=aixtest,cn=views,cn=compat,dc=ipa,dc=domain" scope=2 filter="(&(objectClass=posixaccount)(uid=aduser))" attrs=ALL [22/May/2017:15:14:10.110271957 +0200] conn=1046 op=76 RESULT err=0 tag=101 nentries=0 etime=0 From: freeipa-users-bounces(a)redhat.com [mailto:freeipa-users-bounces@redhat.com] On Behalf Of Bjarne Blichfeldt Sent: woensdag 17 mei 2017 07:30 To: Luiz Fernando Vianna da Silva; freeipa-users(a)redhat.com Subject: Re: [Freeipa-users] IPA Compat + ID Views + AIX 7.1 Thank you for pointing that out. I should of course have been more specific: native aix sudo does not support ldap and therefore sudorules from ldap, but it is possible to install a different sudo version with ldap enabled. Unfortunately, in our case, using external rpm’s is not an option. Regards Bjarne Blichfeldt. From: Luiz Fernando Vianna da Silva [mailto:luiz.vianna@tivit.com.br] Sent: 16. maj 2017 16:43 To: Bjarne Blichfeldt <BJB(a)jndata.dk<mailto:BJB@jndata.dk>>; freeipa-users(a)redhat.com<mailto:freeipa-users@redhat.com> Subject: Re: [Freeipa-users] IPA Compat + ID Views + AIX 7.1 As far as I found out, it is not possible to integrate sudo rules from IPA into AIX. sudo on aix does not support that. You will have to maintain /etc/sudoers by som other means. Thats where you are mistaken. It is possible to integrate sudo rules into AIX, I've done it and have documented it here: https://www.freeipa.org/page/SUDO_Integration_for_AIX Give it a try, its a fairly simple procedure. P.S. IBM has recently pimped the AIX toolbox RPMs and even implemented it as a YUM server. I haven't tried using these new RPMs yet to see if they work with sudo integration. If you want to keep it safe, user perzl RPMs as I describe on the documentation. If you want, and I would appreciate it if you would, give the new RPMs from toolbox a go and if it works please update the documentaion, or send me your notes and I'll update it. Atenciosamente/Best Regards __________________________________________ Luiz Fernando Vianna da Silva Em 15-05-2017 02:53, Bjarne Blichfeldt escreveu: We have a working setup on three aix servers and by comparing our config with yours, I see the following differences: LDAP: /etc/security/ldap/ldap.cfg : userattrmappath:/etc/security/ldap/FreeIPAuser.map groupattrmappath:/etc/security/ldap/FreeIPAgroup.map userclasses:posixaccount /etc/security/ldap/FreeIPAuser.map: #FreeIPAuser.map file # https://docs.fedoraproject.org/en-US/Fedora/15/html/FreeIPA_Guide/Configuri… keyobjectclass SEC_CHAR posixaccount s # The following attributes are required by AIX to be functional username SEC_CHAR uid s id SEC_INT uidnumber s pgrp SEC_CHAR gidnumber s home SEC_CHAR homedirectory s shell SEC_CHAR loginshell s gecos SEC_CHAR gecos s spassword SEC_CHAR userpassword s lastupdate SEC_INT shadowlastchange s /etc/security/ldap/FreeIPAgroup.map: #FreeIPAgroup.map file # https://docs.fedoraproject.org/en-US/Fedora/15/html/FreeIPA_Guide/Configuri… groupname SEC_CHAR cn s id SEC_INT gidNumber s users SEC_LIST member m To test if the ldap is working: ls-secldapclntd lsldap -a passwd lsuser -R LDAP ALL KERBEROS: /etc/methods.cfg: KRB5: program = /usr/lib/security/KRB5 program_64 = /usr/lib/security/KRB5_64 options = authonly,is_kadmind_compat=no,tgt_verify=no,allow_expired_pwd=yes Add Kerberos to authorized authentication entities and verify: chauthent -k5 -std #Verify lsauthent Kerberos 5 Standard Aix To test: lsuser -R KRB5LDAP <someuser> Configure aix to create homedir during login: /etc/security/login.cfg: mkhomeatlogin = true usw: shells = /bin/sh,/bin/bsh,/bin/csh,/bin/ksh,/bin/tsh,/bin/ksh93,/usr/bin/sh,/usr/bin/bsh,/usr/bin/csh,/usr/bin/ksh,/usr/bin/tsh,/usr/bin/ksh93,/ usr/bin/rksh,/usr/bin/rksh93,/usr/sbin/sliplogin,/usr/sbin/uucp/uucico,/usr/sbin/snappd maxlogins = 32767 logintimeout = 30 maxroles = 8 auth_type = STD_AUTH mkhomeatlogin = true Also remember: user can be locked in AIX so use smitty to unlock user and reset login attempts. As far as I found out, it is not possible to integrate sudo rules from IPA into AIX. sudo on aix does not support that. You will have to maintain /etc/sudoers by som other means. Hope that helps, good luck. Regards Bjarne Blichfeldt. From: wouter.hummelink(a)kpn.com<mailto:wouter.hummelink@kpn.com> [mailto:wouter.hummelink@kpn.com] Sent: 12. maj 2017 16:03 To: iulian.roman(a)gmail.com<mailto:iulian.roman@gmail.com> Cc: freeipa-users(a)redhat.com<mailto:freeipa-users@redhat.com> Subject: Re: [Freeipa-users] IPA Compat + ID Views + AIX 7.1 Yes, kinit works with IPA users. GSSAPI authentication is not keeping it simple, since we want passwords to work before trying TGS based logins over GSSAPI. The keytab works sinds lsuser is still able to get user data. (Documentation specifies that enabling krb5 in ldap.cfg makes the bind user and password moot, secldapclntd uses krb5 to identify itself to IPA) Also we are able to kinit host/aixlpar.example.org(a)EXAMPLE.ORG<mailto:host/aixlpar.example.org@EXAMPLE.ORG> -kt /etc/krb5/krb5.keytab We van try using su from an unprivileged user, but su has some different issues altogether, it doesn’t like @ in usernames which we need at the next stage (integrating AD Trust) From: Iulian Roman [mailto:iulian.roman@gmail.com] Sent: vrijdag 12 mei 2017 15:56 To: Hummelink, Wouter Cc: luiz.vianna(a)tivit.com.br<mailto:luiz.vianna@tivit.com.br>; freeipa-users(a)redhat.com<mailto:freeipa-users@redhat.com> Subject: Re: [Freeipa-users] IPA Compat + ID Views + AIX 7.1 On Fri, May 12, 2017 at 3:31 PM, <wouter.hummelink(a)kpn.com<mailto:wouter.hummelink@kpn.com>> wrote: The shell is shown correctly as ksh in lsuser, so that doesnt appear to be an issue for the ID view. My advice would be to start simple ,prove that your authentication works and you can develop a more elaborated setup afterwards. If you combine them all together it will be a trial and error which eventually will work at some point. Do you have the correct keytabs in /etc/krb5/krb5.keytab ? can you run kinit (with password and with the keytab) from aix and get a ticket from Kerberos ? can you su to an IPA account ? do you have GSSAPIAuthentication enabled in sshd_config ? From what you've described i would suspect that your keytab is not correct , but that should be confirmed only by answering the questions above. Verzonden vanaf mijn Samsung-apparaat -------- Oorspronkelijk bericht -------- Van: Luiz Fernando Vianna da Silva <luiz.vianna(a)tivit.com.br<mailto:luiz.vianna@tivit.com.br>> Datum: 12-05-17 15:03 (GMT+01:00) Aan: "Hummelink, Wouter" <wouter.hummelink(a)kpn.com<mailto:wouter.hummelink@kpn.com>>, freeipa-users(a)redhat.com<mailto:freeipa-users@redhat.com> Onderwerp: Re: [Freeipa-users] IPA Compat + ID Views + AIX 7.1 Hello Wouter. It may seem silly, but try installing bash on one AIX server and test authenticating against that one. Its a single rpm with no dependencies. For me it did the trick and I ended up doing that on all my AIX servers. Let me know how it goes or if you have any issues. Best Regards __________________________________________ Luiz Fernando Vianna da Silva Em 12-05-2017 09:47, wouter.hummelink(a)kpn.com<mailto:wouter.hummelink@kpn.com> escreveu: Hi All, We’re running a POC to integrate IPA and AIX using AIX KRB5LDAP compound module. All the moving parts seem to be working on their own, however logging in doesn’t work with SSH on AIX reporting Failed password for user <xxx> We’re using ID views to overwrite the user shell and home dirs. (Since AIX will refuse a login with a nonexisting shell (like bash)) AIXs lsuser command is able to find all of the users it’s supposed to and su to IPA users works. Also when a user tries to log in I can see a successful Kerberos conversation to our IPA server. Tips for troubleshooting would be much appreciated, increasing SSH log level did not produce any meaningful logging. =============== Configuration Excerpt ================================================================ /etc/security/ldap/ldap.cfg: ldapservers:ipaserver.example.org<http://ipaserver.example.org> binddn:uid=srvc-aixservice,cn=users,cn=accounts,dc=example,dc=org bindpwd:{DESv2}<redacted> authtype:ldap_auth useSSL:TLS ldapsslkeyf:/etc/security/ldap/example.kdb ldapsslkeypwd:{DESv2}4688216124E33174C03FBBB420 88FA8 932F219867AA7C2C552A12BEEC0CC67 useKRB5:yes krbprincipal:host/aixlpar.example.org<http://aixlpar.example.org> krbkeypath:/etc/krb5/krb5.keytab userattrmappath:/etc/security/ldap/2307user.map groupattrmappath:/etc/security/ldap/2307group.map userbasedn:cn=users,cn=aixtest,cn=views,cn=compat,dc=example,dc=org groupbasedn:cn=groups,cn=aixtest,cn=views,cn=compat,dc=example,dc=org netgroupbasedn:cn=ng,cn=compat,dc=example,dc=org automountbasedn:cn=default,cn=automount,dc=example,dc=org etherbasedn:cn=computers,cn=accounts,dc=example,dc=org userclasses:posixaccount,account,shadowaccount groupclasses:posixgroup ldapport:389 searchmode:ALL defaultentrylocation:LDAP /etc/security/user default: SYSTEM = KRB5LDAP or compat /etc/methods.cfg LDAP: program = /usr/lib/security/LDAP program_64 =/usr/lib/security/LDAP64 NIS: program = /usr/lib/security/NIS program_64 = /usr/lib/security/NIS_64 DCE: program = /usr/lib/security/DCE KRB5: program = /usr/lib/security/KRB5 program_64 = /usr/lib/security/KRB5_64 options = authonly,is_kadmind_compat=no,tgt_verify=yes,kadmind=no,keep_creds=yes,allow_expired_pwd=no KRB5LDAP: options = auth=KRB5,db=LDAP Met vriendelijke groet, Wouter Hummelink Technical Consultant - Enterprise Webhosting / Tooling & Automation T: +31-6-12882447<tel:+31%206%2012882447> E: wouter.hummelink(a)kpn.com<mailto:wouter.hummelink@kpn.com> -- Manage your subscription for the Freeipa-users mailing list: https://www.redhat.com/mailman/listinfo/freeipa-users Go to http://freeipa.org for more info on the project

1 0

Hoping it is something simple - CA install error?
by Kat 14 Jun '17

14 Jun '17

Hi all, Having a problem with a new server install on RHEL 7 - Done configuring directory server (dirsrv). Configuring certificate server (pki-tomcatd). Estimated time: 3 minutes 30 seconds [1/31]: creating certificate server user [2/31]: configuring certificate server instance ipa.ipaserver.install.cainstance.CAInstance: CRITICAL Failed to configure CA instance: Command '/usr/sbin/pkispawn -s CA -f /tmp/tmphCcxuk' returned non-zero exit status 1 I have researched through "the google", and not much luck. Although I see others who have had the problem, there seems to be no specific fix. This is RHEL 7.3 in AWS and ipa-server-4.4.0-14.el7_3.7.x86_64 I have an exact duplicate of this in another VPC with no issues, so just wondering if there are some places to look?

2 1

FreeIPA - Active Directory integration and domain names
by bogusmaster＠o2.pl 14 Jun '17

14 Jun '17

Hi, I have a question regarding establishing one-way trust between FreeIPA and Active Directory. In the documentation it is stated that to use a cross-forest trust it is required for FreeIPA to have a different domain than that of Active Directory. Does it also apply to the synchronization scenario? Thank you Bart

1 0

freeipa cluster. replication ok but "secondary" DNS not recognized as DNS role.
by Tiran Efrat 13 Jun '17

13 Jun '17

Hi,I setup a while a go a freeIPA cluster and all records are replicated.The issue is that I found out the secondary DNS was probably configured as caching dns as it's not recognized as a DNS role on the web gui.How can i configure it to be a replicate DNS role correctly (note that the original conf had the listen on 127.0.0.1. weird..) ? Thanks,Tiran. this is my secondary IPA named.conf / named.conf // // Provided by Red Hat bind package to configure the ISC BIND named(8) DNS // server as a caching only nameserver (as a localhost DNS resolver only). // // See /usr/share/doc/bind*/sample/ for example named configuration files. // // See the BIND Administrator's Reference Manual (ARM) for details about the // configuration located in /usr/share/doc/bind-{version}/Bv9ARM.html options { // listen-on port 53 { 127.0.0.1; }; // listen-on-v6 port 53 { ::1; }; directory "/var/named"; dump-file "/var/named/data/cache_dump.db"; statistics-file "/var/named/data/named_stats.txt"; memstatistics-file "/var/named/data/named_mem_stats.txt"; allow-query { any; }; /* - If you are building an AUTHORITATIVE DNS server, do NOT enable recursion. - If you are building a RECURSIVE (caching) DNS server, you need to enable recursion. - If your recursive DNS server has a public IP address, you MUST enable access control to limit queries to your legitimate users. Failing to do so will cause your server to become part of large scale DNS amplification attacks. Implementing BCP38 within your network would greatly reduce such attack surface */ recursion yes; dnssec-enable yes; dnssec-validation yes; /* Path to ISC DLV key */ bindkeys-file "/etc/named.iscdlv.key"; managed-keys-directory "/var/named/dynamic"; pid-file "/run/named/named.pid"; session-keyfile "/run/named/session.key"; }; logging { channel default_debug { file "data/named.run"; severity dynamic; }; }; zone "." IN { type hint; file "named.ca"; }; include "/etc/named.rfc1912.zones"; include "/etc/named.root.key";

2 1

DNS zone origin record search
by John Morris 13 Jun '17

13 Jun '17

This works to find a single DNS record: $ ipa dnsrecord-find example.com --name=ipa-ca --pkey-only Record name: ipa-ca ---------------------------- Number of entries returned 1 ---------------------------- But this fails to find the origin record: $ ipa dnsrecord-find example.com --name=@ --pkey-only ---------------------------- Number of entries returned 0 ---------------------------- It appears that the origin record is only treated inconsistently in `dnsrecord-find`; other dnsrecord commands work fine in the form `dnsrecord-* example.com @`. How does one find ONLY for a zone's origin record? Thanks- John

2 2

ipa 4.4.0-14 not honoring "ipa-client-install --force-join" command?
by Chris Dagdigian 13 Jun '17

13 Jun '17

Hi folks, Fixing a topology and replication issue caused my IDM infrastructure to forget about roughly 30 enrolled client hosts. Though this would be trivial to fix via an ansible playbook that runs the IPA client install command again with the "--force-join" argument. Manpage and docs suggest this should work. Any tips or help appreciated! Software: ipa-common-4.4.0-14.el7.centos.7.noarch ipa-client-common-4.4.0-14.el7.centos.7.noarch ipa-client-4.4.0-14.el7.centos.7.x86_64 Error when I try to re-enroll the client: [root@deawilldpp06 centos]# [root@deawilldpp06 centos]# ipa-client-install --force-join --mkhomedir --unattended --password=XXXX --principal YYYY --server deawilidmp001.ZZZZ.org --domain WWWWW.org IPA client is already configured on this system. If you want to reinstall the IPA client, uninstall it first using 'ipa-client-install --uninstall'. [root@deawilldpp06 centos]# [root@deawilldpp06 centos]#

3 7

FreeIPA and TACACS+
by Andrew Meyer 13 Jun '17

13 Jun '17

Has anyone gotten FreeIPA and TACACS+ from shrubbery.net working?

3 9

Ansible and ipa-client-install
by Florence Blanc-Renaud 13 Jun '17

13 Jun '17

Hi, the team is starting investigations regarding the deployment of IPA using Ansible, and we would like to get community feedback. Ansible already provides a few community-maintained Identity Modules [1] allowing to manage users, groups, hosts, hbac rules, roles, sudo rules, but in a first phase, we are focusing on IPA client installation. The command line ipa-client-install is configuring various components (hostname, NTP client, IPA client, SSSD, PAM and NSS, Kerberos client + host keytab, DNS, ssh, OpenLDAP client, NIS, automount, firefox prefs...) Because of this modularity, a possible strategy would be to provide an Ansible role for ipaclient, decomposing the installation into reusable Ansible parts (kerberos client role, OpenLDAP client etc). In order to avoid maintaining 2 different installation mechanisms, we could rewrite ipa-client-install so that it internally calls Ansible to perform the configuration. Note that this would include a new dependency on Ansible, and we need to make sure that this is acceptable, keeping in mind that we are not targeting only RHEL and Fedora but also other Linux distributions. Another strategy would be to have Ansible call the current ipa-client-install command, but the limitation is that this CLI is not idempotent. It exits on error when the host is already configured as an IPA client. A few community-provided IPA roles (client or server) are already using this approach. They can be found in Galaxy [2]. Whatever strategy is picked, we need to - keep aligned the Ansible module/role/playbook version and IPA version. - identify the most important options from ipa-client-install in order to start with what is really needed from the community - identify the most frequent use cases regarding * authentication: install with username and password, with one-time password, with an existing keytab * DNS configuration: using DNS autodiscovery based on the host domain name, specifying a domain or a server ... We are waiting for your feedback on all these topics: would you be likely to use Ansible to deploy an IPA client, which requirements, concerns, ideas do you have in this area? Thank you for your involvement in this project: as users of FreeIPA, your voice really matters, and you can take this opportunity to influence the direction we are going to take. Flo [1] https://docs.ansible.com/ansible/list_of_identity_modules.html [2] https://galaxy.ansible.com/list#/roles?page=1&page_size=10&autocomplete=ipa

6 6

Replication failing on some records
by Nick Campion 13 Jun '17

13 Jun '17

Hi all, We have a 3 master setup that is failing to replicate changes from a particular node to the other IPA instances. The replication status says it's all fine, however the record hasn't been changed on the other servers. We've seen this on user password changes, adding hosts and services. The only thing we've found that seems to fix this temporarily is to re-initialize from the master with the changed record. A force-sync doesn't pick up the changed record. Not sure what logs would be helpful to diagnose what is happening in this setup. # ipa-replica-manage -v list `hostname` freeipa03.mgmt.example.com: replica last init status: None last init ended: 1970-01-01 00:00:00+00:00 last update status: Error (0) Replica acquired successfully: Incremental update succeeded last update ended: 2017-06-07 14:43:53+00:00 freeipa02.mgmt.example.com: replica last init status: None last init ended: 1970-01-01 00:00:00+00:00 last update status: Error (0) Replica acquired successfully: Incremental update succeeded last update ended: 2017-06-07 14:43:53+00:00 # ldapsearch -W -x -D "cn=directory manager" -b "cn=users,cn=accounts,dc=ipa,dc=example,dc=com" "nsds5ReplConflict=*" * nsds5ReplConflict Enter LDAP Password: # extended LDIF # # LDAPv3 # base <cn=users,cn=accounts,dc=ipa,dc=example,dc=com> with scope subtree # filter: nsds5ReplConflict=* # requesting: * nsds5ReplConflict # # search result search: 2 result: 0 Success # numResponses: 1 Any help in what else can be checked or what logs would be helpful would be appreciated. Thanks Nick

2 5

FreeIPA 4.4 with Yubikey and Radius for VPN auth
by Dagan McGregor 12 Jun '17

12 Jun '17

Hello, I have been asked to configure FreeIPA 4.4 servers to handle VPN authentication using a FreeRADIUS server, with 2FA being generated by a Yubikey given to each user. The existing radius server configuration uses PAM sssd and yubico modules with a static file for the Yubikeys, and works with the token appended to the password. The sssd functions as a user lookup to FreeIPA. I am hoping to be able to migrate the configuration to use only FreeRADIUS and FreeIPA with dynamic lookups, but I am not sure where to start. Is there a recommended method, like using the radius ldap module, to query username, password, and Yubikey values? Does anyone have a working implementation of something similar? Cheers, Dagan

2 3

FreeIPA Replica Install issue on CentOS 7.3 and ipa 4.4.0
by Eric Renfro 12 Jun '17

12 Jun '17

I've been trying to rebuild my FreeIPA server that I run on CentOS 7.3. Previously, I was running FreeIPA 4.2.x and upgraded over time to 4.4.0 now, but somewhere along the lines, it totally broke and failed. For me it's not a big deal because it serves very little in a home cluster lab, but I wanted to take this time to update my chef cookbooks to accomodate the new way to auto-configure FreeIPA. The Server installation portion was pretty much the same as before. It's the replica that's mostly changed. Using the install method with ipa-replica-install, I'm using these arguments: ipa-replica-install --unattended \ --no-ntp --mkhomedir --skip-conncheck \ --ip-address 172.17.0.102 \ --principal admin \ --admin-password "redacted" \ --server ipa1.home.ld \ --domain home.ld \ --realm HOME.LD And it's failing with the following results: Configuring directory server (dirsrv). Estimated time: 1 minute [1/44]: creating directory server user [2/44]: creating directory server instance [3/44]: updating configuration in dse.ldif [4/44]: restarting directory server [5/44]: adding default schema [6/44]: enabling memberof plugin [7/44]: enabling winsync plugin [8/44]: configuring replication version plugin [9/44]: enabling IPA enrollment plugin [10/44]: enabling ldapi [11/44]: configuring uniqueness plugin [12/44]: configuring uuid plugin [13/44]: configuring modrdn plugin [14/44]: configuring DNS plugin [15/44]: enabling entryUSN plugin [16/44]: configuring lockout plugin [17/44]: configuring topology plugin [18/44]: creating indices [19/44]: enabling referential integrity plugin [20/44]: configuring certmap.conf [21/44]: configure autobind for root [22/44]: configure new location for managed entries [23/44]: configure dirsrv ccache [24/44]: enabling SASL mapping fallback [25/44]: restarting directory server [26/44]: creating DS keytab [27/44]: retrieving DS Certificate [28/44]: restarting directory server [29/44]: setting up initial replication Starting replication, please wait until this has completed. Update in progress, 15 seconds elapsed [ipa1.home.ld] reports: Update failed! Status: [49 - LDAP error: Invalid credentials] [error] RuntimeError: Failed to start replication Your system may be partly configured. Run /usr/sbin/ipa-server-install --uninstall to clean up. STDERR: Client hostname: ipa2.home.ld Realm: HOME.LD DNS Domain: home.ld IPA Server: ipa1.home.ld BaseDN: dc=home,dc=ld Skipping synchronizing time with NTP server. Successfully retrieved CA cert Subject: CN=Certificate Authority,O=HOME.LD Issuer: CN=Certificate Authority,O=HOME.LD Valid From: Sun Jun 11 14:31:12 2017 UTC Valid Until: Thu Jun 11 14:31:12 2037 UTC Enrolled in IPA realm HOME.LD Created /etc/ipa/default.conf Configured sudoers in /etc/nsswitch.conf Configured /etc/sssd/sssd.conf Configured /etc/krb5.conf for IPA realm HOME.LD trying https://ipa1.home.ld/ipa/json Forwarding 'schema' to json server 'https://ipa1.home.ld/ipa/json' trying https://ipa1.home.ld/ipa/session/json Forwarding 'ping' to json server 'https://ipa1.home.ld/ipa/session/json ' Forwarding 'ca_is_enabled' to json server 'https://ipa1.home.ld/ipa/ses sion/json' Systemwide CA database updated. Adding SSH public key from /etc/ssh/ssh_host_rsa_key.pub Adding SSH public key from /etc/ssh/ssh_host_ecdsa_key.pub Adding SSH public key from /etc/ssh/ssh_host_ed25519_key.pub Forwarding 'host_mod' to json server 'https://ipa1.home.ld/ipa/session/ json' Could not update DNS SSHFP records. SSSD enabled Configured /etc/openldap/ldap.conf Configured /etc/ssh/ssh_config Configured /etc/ssh/sshd_config Configuring home.ld as NIS domain. Client configuration complete. ipa.ipapython.install.cli.install_tool(Replica): ERROR Failed to start replication ipa.ipapython.install.cli.install_tool(Replica): ERROR The ipa- replica-install command failed. See /var/log/ipareplica-install.log for more information Attached is the full logs from ipareplica-install.log Any help on this would be greatly appreciated. I had tried all weekend long trying to get this to work all to the same basic failure. Eric

1 0

Scheduled disable/delete user account
by Per Qvindesland 12 Jun '17

12 Jun '17

Hi All Is it possible to a schedule for when a user account is disabled/deleted? the reason why I am asking is that we would like to be able to set an account to be disabled or deleted when the user leaves the company, for the moment it can take time until a sys admin disables or deletes the account which is not optimal. Regards Per

2 1

Re: documentation or example of using S42U for NFS
by Jens Timmerman 12 Jun '17

12 Jun '17

Hi Greg, On 02/03/2017 03:29, Greg wrote: > I've been at this as well for a while now, and managed to make it work > for my NFS needs (automounting user homes with password-less logons). > > > > $ ipa servicedelegationrule-show ipa-nfs-delegation > Delegation name: ipa-nfs-delegation > Allowed Target: ipa-nfs-delegation-targets > Member principals: *host*/*nfsclient*.dom.com(a)DOM.COM > <mailto:dom.com@DOM.COM> > > $ ipa servicedelegationtarget-show ipa-nfs-delegation-targets > Delegation name: ipa-nfs-delegation-targets > Member principals: *nfs*/*nfsserver*.dom.com(a)DOM.COM > <mailto:dom.com@DOM.COM> > > Only niggle here is IPA CLI didn't let me add "host/..." principal to > the rule, or perhaps there's a default LDAP ACI of some sort and it > requires a privilege/permission to be granted. The "ipa > servicedelegationrule-add-member ..." command simply says "no such > entry" for "host/..." type principals. Maybe IPA folks can comment. > An official reply form IPA dev's might indeed be useful here. > I force added it to the delegation rule via LDAP instead using this ldif: > > dn: cn=ipa-nfs-delegation,cn=s4u2proxy,cn=etc,dc=dom,dc=com > changetype: modify > add: memberPrincipal > memberPrincipal: host/nfsclient.dom.com(a)DOM.COM > <mailto:nfsclient.dom.com@DOM.COM> > I didn't want to resort to this trickery, turns out there's no reason at all to use host/, you can create a nfs-client service, and use this. (I guess this is the recommended way?) $ ipa service-add nfs-client/node2801.example.com(a)EXAMPLE.COM --ok-to-auth-as-delegate=True $ ipa servicedelegationrule-add-member nfs-delegation --principals=nfs-client/node2801.example.com $ ipa servicedelegationrule-show nfs-delegation Delegation name: nfs-delegation Allowed Target: nfs-delegation-targets Member principals: nfs-client/node2801.example.com(a)EXAMPLE.COM > The "nfs/..." principal can be added using CLI > "ipa servicedelegationtarget-add-member ..." just fine. > > 3. Allow the "nfsclient" host to impersonate users: > > $ ipa host-mod nfsclient.dom.com <http://nfsclient.dom.com> > --ok-to-auth-as-delegate=true not needed, we did this for the service > > 4. On the "nfsclient" machine, add "impersonate = true" line in the > "[service/nfs-client]" section of /etc/gssproxy/gssproxy.conf. change cred_store = keytab:/etc/krb5.keytab to cred_store = keytab:/etc/nfs-client.keytab where you get nfs-client.keytab by running ipa-getkeytab -p nfs-client/node2801.example.com -k /etc/nfs-client.keytab > > 5. Restart nfs/gssproxy/rpc services on client and server (it's > probably just gssproxy on the client that needs a kick, but just to be > sure). I was also religiously doing "sss_cache -E" for good measure, > unmounting anything that got mounted, and clearing > /var/lib/gssproxy/clients of all caches, to start as cleanly before > each attempt at user logon. Obv make sure the user does not have an > existing/valid ticket in their own cache ("kdestroy -A" as the user), > otherwise it'll just mount successfully without delegation. > > I think that's it, I've messed about with the config for a long time > and in many places, so there's a small chance there's something else > that I did and don't remember. Gssproxy config on "nfsserver" is > vanilla, as are my sssd.confs and krb5.confs on both machines, can't > think of much else that I might've changed for now. worked for me, thx! > > So my IPA automount config now mounts users' home dirs on the > "nfsclient", without any tickets or keytabs from users. > > There's also a "krb5_principal" option available in gssproxy.conf - I > tried to set that to "nfs/nfsclient(a)DOM.COM > <mailto:nfsclient@DOM.COM>" in "[service/nfs-client]" section on the > "nfsclient" machine, to try and force gssproxy to use that principal > instead of "host/...", but it didn't seem to work, gssproxy defaults > to "host/...". Possibly mis-understanding what this option is for, and > possibly "host/..." is the safer/standard option? I'm assuming it's > default for a reason, or maybe just operational convenience (not > having to pollute /etc/krb5.keytabs with more principals than necessary). > according to https://lists.fedorahosted.org/archives/list/gss-proxy@lists.fedorahosted.o… `Well ... embarrassingly ... you might be right if we used krb5_principal anywhere. I am looking at master code and this looks like a forgotten option ... oops. ` > Hope this helps. > > -- > Thanks, > > Greg Kubok. > Regards, Jens Timmerman

2 1

String index out of range: -36
by jochem＠kuijpersadvies.nl 11 Jun '17

11 Jun '17

Hello all, This i my first post here, so be gentle. I'm running FreeIPA 4.4.0-14 (ipa-server-4.4.0-14.el7.centos.7.x86_64) on CentOS 7.3.1611 and since a while i can't get any certificates to my hosts. The client has installed: ipa-client-4.4.0-14.el7.centos.7.x86_64 ans is also running CentOS 7.3.1611 (actually, this happens on all new clients, same os, same version). I'm running 'ipa-getcert request -f /etc/pki/tls/certs/servername.crt -k /etc/pki/tls/private/servername.key' on the client. This runs without any errors. When i look at the output of 'ipa-getcert list' i get: Request ID '20170610005114': status: CA_UNREACHABLE ca-error: Server at https://freeipa.crossyn.local/ipa/xml failed request, will retry: 4301 (RPC failed at server. Certificate operation cannot be completed: FAILURE (String index out of range: -36)). stuck: no key pair storage: type=FILE,location='/etc/pki/tls/private/servername.key' certificate: type=FILE,location='/etc/pki/tls/certs/servername.crt' CA: IPA issuer: subject: expires: unknown pre-save command: post-save command: track: yes auto-renew: yes On the FreeIPA server i noticed in /var/log/httpd/error_log: [Sat Jun 10 02:51:15.230313 2017] [:error] [pid 7199] ipa: ERROR: ra.request_certificate(): FAILURE (String index out of range: -36) [Sat Jun 10 02:51:15.230621 2017] [:error] [pid 7199] ipa: INFO: [xmlserver] host/<hostname removed>: cert_request(<removed certificate for security reasons>', principal=u'host/<hostname removed>', add=True, version=u'2.51'): CertificateOperationError Any thoughts on how to fix this? Or debug this further? This i a single FreeIPA server with no replica's. When this is fixed i'm going to add a replica but i don't think i can do that without fixing this. Best regards, Jochem Kuijpers

3 6

AD - IPA Trust Issues
by Matt Wells 09 Jun '17

09 Jun '17

Hello everyone. I hoped I could ask for a little assistance on an AD / IPA Trust. I've for a Windows 2008R2 domain. Response Type: LOGON_SAM_LOGON_RESPONSE_EX GUID: e**********************6497 Flags: Is a PDC: no Is a GC of the forest: yes Is an LDAP server: yes Supports DS: yes Is running a KDC: yes Is running time services: yes Is the closest DC: yes Is writable: yes Has a hardware clock: no Is a non-domain NC serviced by LDAP server: no Is NT6 DC that has some secrets: no Is NT6 DC that has all secrets: yes Runs Active Directory Web Services: yes Runs on Windows 2012 or later: no Forest: example.local Domain: example.local Domain Controller: CSAD1.example.local Pre-Win2k Domain: example Pre-Win2k Hostname: CSAD1 Server Site Name : Site1 Client Site Name : Site1 NT Version: 5 LMNT Token: ffff LM20 Token: ffff ----------------- IPA ipa-server-4.4.0-14.el7 Domain = lci.example.com ------------------ I start the process and DNS lookups are working. [root@ipa-001 samba]# !872 dig SRV _ldap._tcp.example.local ; <<>> DiG 9.9.4-RedHat-9.9.4-38.el7_3.3 <<>> SRV _ldap._tcp.example.local ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 45828 ;; flags: qr rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 5 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4096 ;; QUESTION SECTION: ;_ldap._tcp.example.local. IN SRV ;; ANSWER SECTION: _ldap._tcp.example.local. 600 IN SRV 0 100 389 ac-ad4.example.local. _ldap._tcp.example.local. 600 IN SRV 0 100 389 csad2.example.local. _ldap._tcp.example.local. 600 IN SRV 0 100 389 csad1.example.local. _ldap._tcp.example.local. 600 IN SRV 0 100 389 ac-ad3.example.local. ;; ADDITIONAL SECTION: csad1.example.local. 3196 IN A 192.168.2.1 ac-ad4.example.local. 3196 IN A 192.168.2.4 ac-ad3.example.local. 3196 IN A 192.168.2.3 csad2.example.local. 3196 IN A 192.168.2.2 ;; Query time: 1 msec ;; SERVER: 127.0.0.1#53(127.0.0.1) ;; WHEN: Fri Jun 09 19:50:34 UTC 2017 ;; MSG SIZE rcvd: 290 [root@ipa-001 samba]# dig SRV _ldap._tcp.lci.example.local ; <<>> DiG 9.9.4-RedHat-9.9.4-38.el7_3.3 <<>> SRV _ldap._tcp.lci.example.local ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 64288 ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 2, ADDITIONAL: 3 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4096 ;; QUESTION SECTION: ;_ldap._tcp.lci.example.local. IN SRV ;; ANSWER SECTION: _ldap._tcp.lci.example.local. 86400 IN CNAME _ldap._tcp.atl._locations.lci. example.local. _ldap._tcp.atl._locations.lci.example.local. 86400 IN SRV 0 5 389 ipa-001.lci.example.local. _ldap._tcp.atl._locations.lci.example.local. 86400 IN SRV 0 10 389 ipa-002.lci.example.local. ;; AUTHORITY SECTION: lci.example.local. 86400 IN NS ipa-002.lci.example.local. lci.example.local. 86400 IN NS ipa-001.lci.example.local. ;; ADDITIONAL SECTION: ipa-001.lci.example.local. 1200 IN A 192.168.1.11 ipa-002.lci.example.local. 1200 IN A 192.168.1.12 ;; Query time: 0 msec ;; SERVER: 127.0.0.1#53(127.0.0.1) ;; WHEN: Fri Jun 09 19:50:40 UTC 2017 ;; MSG SIZE rcvd: 272 [root@ipa-001 samba]# -------------- My bound `ldapsearch` and `kinit` on both domains domain work well. As I move onto testing the `trust-fetch-domains` area things go bad ( well start to show they are ). -------------- [root@ipa-001 samba]# ipa trust-fetch-domains example.local ------------------------------------------------------------ ---------------------------- List of trust domains successfully refreshed. Use trustdomain-find command to list them. ------------------------------------------------------------ ---------------------------- ---------------------------- Number of entries returned 0 ---------------------------- [root@ipa-001 samba]# ipa trustdomain-find example.LOCAL Domain name: example.local Domain NetBIOS name: example Domain Security Identifier: S-1-5-21-******-857828577-140568808 Domain enabled: True ---------------------------- Number of entries returned 1 ---------------------------- Of course any movement from there on fails. Using other posts I bumped up the logging and pulled out items that I believe assist in this matter. ---------- log.winbindd-dc-connect: check_negative_conn_cache returning result 0 for domain example.local server 192.168.2.3 log.winbindd-dc-connect: check_negative_conn_cache returning result -1073741823 for domain example.local server 192.168.2.2 log.winbindd-dc-connect: check_negative_conn_cache returning result -1073741823 for domain example.local server 192.168.2.4 log.winbindd-dc-connect: get_sorted_dc_list: attempting lookup for name example.local (sitename NULL) log.winbindd-dc-connect: saf_fetch: failed to find server for "example.local" domain log.winbindd-dc-connect: internal_resolve_name: looking up example.local#1c (sitename (null)) log.winbindd-dc-connect: name example.local#1C found. log.winbindd-dc-connect: check_negative_conn_cache returning result -1073741823 for domain example.local server 192.168.2.1 log.winbindd-dc-connect: Adding cache entry with key=[NEG_CONN_CACHE/example.local,192.168.2.3] and timeout=[Thu Jan 1 12:00:00 AM 1970 UTC] (-1497038264 seconds in the past) log.winbindd-dc-connect: check_negative_conn_cache returning result 0 for domain example.local server 192.168.2.3 log.winbindd-dc-connect: check_negative_conn_cache returning result -1073741823 for domain example.local server 192.168.2.2 log.winbindd-dc-connect: check_negative_conn_cache returning result -1073741823 for domain example.local server 192.168.2.4 log.winbindd-dc-connect: get_sorted_dc_list: attempting lookup for name example.local (sitename NULL) log.winbindd-dc-connect: saf_fetch: failed to find server for "example.local" domain log.winbindd-dc-connect: internal_resolve_name: looking up example.local#1c (sitename (null)) log.winbindd-dc-connect: name example.local#1C found. log.winbindd-dc-connect: check_negative_conn_cache returning result -1073741823 for domain example.local server 192.168.2.1 log.winbindd-dc-connect: Adding cache entry with key=[NEG_CONN_CACHE/example.local,192.168.2.3] and timeout=[Thu Jan 1 12:00:00 AM 1970 UTC] (-1497038340 seconds in the past) log.winbindd-dc-connect: check_negative_conn_cache returning result 0 for domain example.local server 192.168.2.3 log.winbindd-dc-connect: check_negative_conn_cache returning result -1073741823 for domain example.local server 192.168.2.2 log.winbindd-dc-connect: check_negative_conn_cache returning result -1073741823 for domain example.local server 192.168.2.4 log.winbindd-idmap: pdb_init_ipasam: support for pdb_enum_upn_suffixes enabled for domain lci.example.local ------------------- I see in the logs the timeouts however I thought they appeared to conflict with the ability to `net ads lookup`. Any assistance on this would be appreciated a great deal. Thank you so much for your time and looking at this.

1 0

Enroll CentOS 5 on FreeIPA 4.3
by Jose Alvarez R. 09 Jun '17

09 Jun '17

Hello A question What another way I can enroll my server client on my IPA server ? I have a server IPA with S.O. Fedora 24 and freeipa-server-4.3.3-1.fc24.x86_64 My client server have a S.O. CentOS release 5.10 with ipa-client-2.1.3-7.el5 This is the "ipa-client-install -d" [root@l1 ~]# ipa-client-install -d root : DEBUG /usr/sbin/ipa-client-install was invoked with options: {'conf_ntp': True, 'domain': None, 'uninstall': False, 'force': False, 'sssd': True, 'krb5_offline_passwords': True, 'hostname': None, 'permit': False, 'server': None, 'prompt_password': False, 'mkhomedir': False, 'dns_updates': False, 'preserve_sssd': False, 'debug': True, 'on_master': False, 'ca_cert_file': None, 'realm_name': None, 'unattended': None, 'ntp_server': None, 'principal': None} root : DEBUG missing options might be asked for interactively later root : DEBUG Loading Index file from '/var/lib/ipa-client/sysrestore/sysrestore.index' root : DEBUG Loading StateFile from '/var/lib/ipa-client/sysrestore/sysrestore.state' root : DEBUG [IPA Discovery] root : DEBUG Starting IPA discovery with domain=None, servers=None, hostname=l1.example.com root : DEBUG [ipadnssearchldap(example.com)] root : DEBUG [ipadnssearchkrb] root : DEBUG [ipacheckldap] root : DEBUG Verifying that ipa.example.com (realm EXAMPLE.COM) is an IPA server root : DEBUG Init ldap with: ldap://ipa.example.com:389 root : DEBUG Search LDAP server for IPA base DN root : DEBUG Check if naming context 'cn=changelog' is for IPA root : DEBUG Info attribute with IPA server version not found root : DEBUG Check if naming context 'dc=example,dc=com' is for IPA root : DEBUG Naming context 'dc=example,dc=com' is a valid IPA context root : DEBUG Search for (objectClass=krbRealmContainer) in dc=example,dc=com(sub) root : DEBUG Found: [('cn=example.COM,cn=kerberos,dc=example,dc=com', {'objectClass': ['top', 'krbrealmcontainer', 'krbticketpolicyaux'], 'cn': ['example.COM']})] root : DEBUG Discovery result: Success; server=ipa.example.com, domain=example.com, kdc=ipa.example.com, basedn=dc=example,dc=com root : DEBUG Validated servers: ipa.example.com root : DEBUG will use domain: example.com root : DEBUG [ipadnssearchldap(example.com)] root : DEBUG DNS validated, enabling discovery root : DEBUG will use discovered server: ipa.example.com Discovery was successful! root : DEBUG will use cli_realm: EXAMPLE.COM root : DEBUG will use cli_basedn: dc=example,dc=com Hostname: l1.example.com Realm: example.COM DNS Domain: example.com IPA Server: ipa.example.com BaseDN: dc=example,dc=com Continue to configure the system with these values? [no]: yes User authorized to enroll computers: admin root : DEBUG will use principal: admin Synchronizing time with KDC... root : DEBUG args=/usr/sbin/ntpdate -U ntp -s -b ipa.example.com root : DEBUG stdout= root : DEBUG stderr= root : DEBUG Writing Kerberos configuration to /tmp/tmpSeQjKB: #File modified by ipa-client-install [libdefaults] default_realm = EXAMPLE.COM dns_lookup_realm = false dns_lookup_kdc = false rdns = false ticket_lifetime = 24h forwardable = yes [realms] example.COM = { kdc = ipa.example.com:88 master_kdc = ipa.example.com:88 admin_server = ipa.example.com:749 default_domain = example.com pkinit_anchors = FILE:/etc/ipa/ca.crt } [domain_realm] .example.com = EXAMPLE.COM example.com = EXAMPLE.COM Password for admin(a)EXAMPLE.COM: root : DEBUG args=kinit admin(a)EXAMPLE.COM root : DEBUG stdout=Password for admin(a)EXAMPLE.COM: root : DEBUG stderr= root : DEBUG trying to retrieve CA cert via LDAP from ldap://ipa.example.com root : DEBUG Existing CA cert and Retrieved CA cert are identical In the line "root : DEBUG Existing CA cert and Retrieved CA cert are identical" It's don't progress. Do Is there any other way I could do it ? Thanks for your response Jose Alvarez

4 6

very slow remove users process
by Adrian HY 09 Jun '17

09 Jun '17

Hi folks, I have a freeipa group with 30000 users to delete. The process is very very slow. For example: # time ipa -v user-del vvv ------------------------- Deleted user "vvv" ------------------------- real 0m16.913s user 0m0.814s sys 0m0.084s The hardware parameters are normal. The hard drive is SSD. Regards.

3 4

ipa-client package - is it necessary after install?
by Lachlan Musicman 09 Jun '17

09 Jun '17

Hola, So in doing a system analysis, I noted that some of our hosts have ipa-client and some don't. All of the hosts are using SSSD to connect to the FreeIPA server. Once a client system has joined the domain successfully and users can login, is ipa-client still necessary? (ie, the real question is: in order to get uniformity, do I install ipa-client on all hosts or remove ipa-client from all hosts) cheers L. ------ "Mission Statement: To provide hope and inspiration for collective action, to build collective power, to achieve collective transformation, rooted in grief and rage but pointed towards vision and dreams." - Patrisse Cullors, *Black Lives Matter founder*

2 1

samba file server
by Zhanghui 08 Jun '17

08 Jun '17

I want to configure a samba file server. I have read the following two links: https://www.freeipa.org/page/Howto/Integrating_a_Samba_File_Server_With_IPA http://www.freeipa.org/page/Howto/Integrating_a_Samba_File_Server_With_IPA/… Is the second link based on the first. I don't have any active directory server. I hope windows clients that are not enrolled to the ipa domain to be able to access the shares. Is there any more documents? Thanks.

1 0

Replication error
by Bret Wortman 08 Jun '17

08 Jun '17

I've also just realized that replication appears to have ceased; I have entries in some IPA servers but not all. [root@zsipa ~]# ipa-replica-manage list Directory Manager password: zsipa.damascusgrp.com: master zsipa2.damascusgrp.com: master zsipa3.damascusgrp.com: master [root@zsipa ~]# ipa-replica-manage list zsipa.damascusgrp.com Directory Manager password: zsipa3.damascusgrp.com: replica last init status: None last init ended: 1970-01-01 00:00:00+00:00 last update status: Error (19) Replication error acquiring replica: Replica has different database generation ID, remote replica may need to be initialized (RUV error) last update ended: 1970-01-01 00:00:00+00:00 [root@zsipa ~]# Only zsipa3 is listed as a replica anywhere, and it's not a functioning one. I can set up replication between zsipa and zsipa2, but is there a good way to bring zsipa3 back in line as well? The background is that we attempted to do a rolling update of our IPA servers by bringing in a new server, zsipa2, and then upgrading each of the other two from Fedora to Centos 7 and then initialized them as replicas of zsipa2. But apparently, this didn't work as we had thought. So add replication errors to the certificate issue I'm still trying to run to ground. -- *Bret Wortman* Damascus Products ph/fax: 1-855-644-2783 Wrap Buddies <wrapbuddies.co/store> now available for preorder!

2 2

Re: FreeIPA-users Digest, Vol 2, Issue 2
by Chris Scutcher 08 Jun '17

08 Jun '17

unsubscribe On 3 June 2017 at 05:04, <freeipa-users-request(a)lists.fedorahosted.org> wrote: > Send FreeIPA-users mailing list submissions to > freeipa-users(a)lists.fedorahosted.org > > To subscribe or unsubscribe via email, send a message with subject or > body 'help' to > freeipa-users-request(a)lists.fedorahosted.org > > You can reach the person managing the list at > freeipa-users-owner(a)lists.fedorahosted.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of FreeIPA-users digest..." > > Today's Topics: > > 1. Re: ipa-adtrust-install command fails to add fallback group > (Sumit Bose) > 2. Re: Time Skew on Amazon nodes? (Ludwig Krispenz) > 3. status of auditd integration on freeipa clients (Sven Kieske) > 4. Re: IPA and CM? (Simo Sorce) > 5. new/fresh server can't be setup as replica due to "The remote > replica has a different database generation ID ..." > (Chris Dagdigian) > 6. Re: DatabaseError: Server is unwilling to perform: Too many failed > logins. > (Jose Alvarez R.) > 7. Re: IPA and CM? (Kat) > 8. Re: IPA and CM? (Simo Sorce) > 9. Re: IPA and CM? (Alexander Bokovoy) > 10. FreeIPA for simply managing DNS (Striker Leggette) > 11. FreeIPA (adding all new users to admin group by default?) > (Devin Acosta) > 12. Re: FreeIPA (adding all new users to admin group by default?) > (Rob Crittenden) > 13. Re: FreeIPA (adding all new users to admin group by default?) > (Devin Acosta) > 14. Re: FreeIPA (adding all new users to admin group by default?) > (wouter.hummelink(a)kpn.com) > 15. Re: FreeIPA (adding all new users to admin group by default?) > (Devin Acosta) > 16. export users to new freeipa server (Adrian HY) > 17. Re: export users to new freeipa server (Striker Leggette) > 18. Scripting a SSSD client to add SID to UIDnumbers from ad > Trust into custom LDAP schema. (Frank Rey) > 19. Re: FreeIPA for simply managing DNS (Brendan Kearney) > > > ---------------------------------------------------------------------- > > Date: Fri, 2 Jun 2017 09:49:34 +0200 > From: Sumit Bose <sbose(a)redhat.com> > Subject: [Freeipa-users] Re: ipa-adtrust-install command fails to add > fallback group > To: freeipa-users(a)lists.fedorahosted.org > Message-ID: > <20170602074934.GJ29267(a)p.Speedport_W_724V_Typ_A_05011603_00_011> > Content-Type: text/plain; charset=utf-8 > > On Thu, Jun 01, 2017 at 04:41:52PM +0000, Marin BERNARD via FreeIPA-users > wrote: > > Hi, > > > > I'm trying to configure ad trust on a freshly installed FreeIPA server > 4.4.0 running on an up-to-date instance of CentOS 7 (1611). The > ipa-adtrust-install command fails at step 17 (failed to add fallback > group). As a consequence, Samba cannot be started and AD trusts can't be > established. > > > > Here is an excerpt of the install log: > > > > ```` > > # ipa-adtrust-install --netbios-name=PEP06-IPA --add-sids --enable-compat > > > > (...) > > > > 2017-06-01T13:49:29Z DEBUG [18/23]: adding fallback group > > 2017-06-01T13:49:29Z DEBUG flushing ldapi://%2fvar%2frun%2fslapd-IPA-PEP06-FR.socket > from SchemaCache > > 2017-06-01T13:49:29Z DEBUG retrieving schema for SchemaCache > url=ldapi://%2fvar%2frun%2fslapd-IPA-PEP06-FR.socket > conn=<ldap.ldapobject.SimpleLDAPObject instance at 0x62107a0> > > 2017-06-01T13:49:30Z DEBUG Starting external process > > 2017-06-01T13:49:30Z DEBUG args=/usr/bin/ldapmodify -v -f /tmp/tmpyj5xIJ > -H ldapi://%2fvar%2frun%2fslapd-IPA-PEP06-FR.socket -Y EXTERNAL > > 2017-06-01T13:49:30Z DEBUG Process finished, return code=1 > > 2017-06-01T13:49:30Z DEBUG stdout=add cn: > > Default SMB Group > > add description: > > Fallback group for primary group RID, do not add users to this > group > > add gidnumber: > > -1 > > add objectclass: > > top > > ipaobject > > posixgroup > > adding new entry "cn=Default SMB Group,cn=groups,cn=accounts, > dc=ipa,dc=pep06,dc=fr" > > > > > > 2017-06-01T13:49:30Z DEBUG stderr=ldap_initialize( > ldapi://%2Fvar%2Frun%2Fslapd-IPA-PEP06-FR.socket/??base ) > > SASL/EXTERNAL authentication started > > SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth > > SASL SSF: 0 > > ldap_add: Operations error (1) > > additional info: Allocation of a new value for range cn=posix > ids,cn=distributed numeric assignment plugin,cn=plugins,cn=config failed! > Unable to proceed. > > The DNA plugin (used to generate new UIDs and GIDs) has some issues. > Maybe https://blog-rcritten.rhcloud.com/?p=50 can help? > > If the DNA plugin works again you can run ipa-adtrust-install which then > should properly generate the fallback group. > > HTH > > bye, > Sumit > > > > > 2017-06-01T13:49:30Z CRITICAL Failed to load default-smb-group.ldif: > Command '/usr/bin/ldapmodify -v -f /tmp/tmpyj5xIJ -H > ldapi://%2fvar%2frun%2fslapd-IPA-PEP06-FR.socket -Y EXTERNAL' returned > non-zero exit status 1 > > 2017-06-01T13:49:30Z DEBUG Failed to add fallback group. > > 2017-06-01T13:49:30Z DEBUG duration: 0 seconds > > > > (...) > > > > ```` > > > > In the end, Samba logically fails to start with the following error: > > > > ```` > > Missing mandatory attribute ipaNTFallbackPrimaryGroup. > > > > ```` > > > > I ran the same command one week ago on another server and had no issue. > > Does anybody have an idea about what to do to make it work ? > > > > Thanks, > > > > Marin BERNARD > > Administrateur systèmes > > Pupilles de l’Enseignement Public 06 > > 35 boulevard de la Madeleine — 06300 Nice > > marin.bernard[at]pep06.fr > > > _______________________________________________ > > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org > > To unsubscribe send an email to freeipa-users-leave@lists. > fedorahosted.org > > ------------------------------ > > Date: Fri, 02 Jun 2017 10:09:12 +0200 > From: Ludwig Krispenz <lkrispen(a)redhat.com> > Subject: [Freeipa-users] Re: Time Skew on Amazon nodes? > To: freeipa-users(a)lists.fedorahosted.org > Message-ID: <59311D28.2060008(a)redhat.com> > Content-Type: multipart/alternative; > boundary="------------090802020609060703090300" > > This is a multi-part message in MIME format. > --------------090802020609060703090300 > Content-Type: text/plain; charset=UTF-8; format=flowed > Content-Transfer-Encoding: 7bit > > replication uses CSNs(change sequence numbers) to synchronize data > across the topology, and it requires the times to be in sync and that > time never goes backward, otherwise a new change would get an older csn > and probably be ignored after repliciation. > Since it is not guaranteed that system time is always is sync and that > no one plays with the time setting, replcation uses its own csn state, > maintainig the local system time and remote or local offsets when > differnces in time were detected. This ensures that time is in sync, as > good as possible, and that time never goes backward. > Unfortunately these offsets can accumulate over time and reach a value > where replication "thinks" it is insane to continue and raises the clock > skew error. > In my opinion this should not be a fatal error, but right now it is, > feel free to log an RFE. > > Now, the csns are part of all the individual data in the servers's > database, so you cannot just clean them up, also if you add a new > replica it will inherit the offsets present in other servers. > Unfortunately I only see the hard way to get out of this: export the > data without state information(csns), reimport and reinitialize. That's > in the doc you referenced > > Ludwig > > On 06/01/2017 09:29 PM, pgb205 via FreeIPA-users wrote: > > I have noticed that we had a broken replication agreement between > > replica in amazon and on another physical node. > > I have attempted to re-initialize but received > > /Update failed! Status: [2 Replication error acquiring replica: > > excessive clock skew]/ > > > > > > I had triple verified that time on both is correct and at most within > > seconds of each other. > > > > in dirsrv logs I get > > /Excessive clock skew from supplier RUV/ > > /Unable to acquire replica: error: excessive clock skew/ > > / > > / > > After doing a bit of searching I found this beauty: > > https://www.redhat.com/archives/freeipa-users/2014- > February/msg00007.html > > > > The article mentions that the time skew might occur due to server > > being virtualied, and I'm wondering if this is applicable to Amazon. > > > > The steps mentioned in the article look intrusive (and intimidating) . > > I'm curious what other avenues are available to me to fix this? > > If I blow away the replica and re-set up the new one from scratch > > would that fix the problem. > > > > > > > > _______________________________________________ > > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org > > To unsubscribe send an email to freeipa-users-leave@lists. > fedorahosted.org > > -- > Red Hat GmbH, http://www.de.redhat.com/, Registered seat: Grasbrunn, > Commercial register: Amtsgericht Muenchen, HRB 153243, > Managing Directors: Charles Cachera, Michael Cunningham, Michael O'Neill, > Eric Shander > > > --------------090802020609060703090300 > Content-Type: text/html; charset=UTF-8 > Content-Transfer-Encoding: quoted-printable > > <html> > <head> > <meta content=3D"text/html; charset=3DUTF-8" http-equiv=3D"Content-Ty= > pe"> > </head> > <body bgcolor=3D"#FFFFFF" text=3D"#000000"> > replication uses CSNs(change sequence numbers) to synchronize data > across the topology, and it requires the times to be in sync and > that time never goes backward, otherwise a new change would get an > older csn and probably be ignored after repliciation.<br> > Since it is not guaranteed that system time is always is sync and > that no one plays with the time setting, replcation uses its own csn > state, maintainig the local system time and remote or local offsets > when differnces in time were detected. This ensures that time is in > sync, as good as possible, and that time never goes backward.<br> > Unfortunately these offsets can accumulate over time and reach a > value where replication "thinks" it is insane to continue and raises > the clock skew error.<br> > In my opinion this should not be a fatal error, but right now it is, > feel free to log an RFE.<br> > <br> > Now, the csns are part of all the individual data in the servers's > database, so you cannot just clean them up, also if you add a new > replica it will inherit the offsets present in other servers. > Unfortunately I only see the hard way to get out of this: export the > data without state information(csns), reimport and reinitialize. > That's in the doc you referenced<br> > <br> > Ludwig<br> > <br> > <div class=3D"moz-cite-prefix">On 06/01/2017 09:29 PM, pgb205 via > FreeIPA-users wrote:<br> > </div> > <blockquote > cite=3D"mid:1514317342.632956.1496345396127@mail.yahoo.com" > type=3D"cite"> > <meta http-equiv=3D"Context-Type" content=3D"text/html; charset=3DU= > TF-8"> > <div> > <div id=3D"yui_3_16_0_ym19_1_1496345010090_2766">I have noticed > that we had a broken replication agreement between replica in > amazon and on another physical node.=C2=A0</div> > <div id=3D"yui_3_16_0_ym19_1_1496345010090_2729">I have attempted > to re-initialize but received</div> > <div dir=3D"ltr" id=3D"yui_3_16_0_ym19_1_1496345010090_2767"><i > id=3D"yui_3_16_0_ym19_1_1496345010090_2869">Update failed! > Status: [2 Replication error acquiring replica: excessive > clock skew]</i><br> > </div> > <div dir=3D"ltr" id=3D"yui_3_16_0_ym19_1_1496345010090_2778"><br> > </div> > <div dir=3D"ltr" id=3D"yui_3_16_0_ym19_1_1496345010090_2778"><br> > </div> > <div dir=3D"ltr" id=3D"yui_3_16_0_ym19_1_1496345010090_2778">I ha= > d > triple verified that time on both is correct and at most > within seconds of each other.</div> > <div dir=3D"ltr" id=3D"yui_3_16_0_ym19_1_1496345010090_2778"><br> > </div> > <div dir=3D"ltr" id=3D"yui_3_16_0_ym19_1_1496345010090_2778">in > dirsrv logs I get=C2=A0<br> > </div> > <div dir=3D"ltr" id=3D"yui_3_16_0_ym19_1_1496345010090_2817"><i > id=3D"yui_3_16_0_ym19_1_1496345010090_2861">Excessive clock > skew from supplier RUV</i></div> > <div dir=3D"ltr" id=3D"yui_3_16_0_ym19_1_1496345010090_2818"><i > id=3D"yui_3_16_0_ym19_1_1496345010090_2863">Unable to acquire > replica: error: excessive clock skew</i><br> > </div> > <div dir=3D"ltr" id=3D"yui_3_16_0_ym19_1_1496345010090_2818"><i><= > br> > </i></div> > <div dir=3D"ltr" id=3D"yui_3_16_0_ym19_1_ > 1496345010090_2818">=C2=A0= > After > doing a bit of searching I found this beauty:</div> > <div dir=3D"ltr" id=3D"yui_3_16_0_ym19_1_1496345010090_2818"><a > moz-do-not-send=3D"true" > href=3D"https://www.redhat.com/archives/freeipa-users/2014-February/msg00= > 007.html" > class=3D"" id=3D"yui_3_16_0_ym19_1_1496345010090_2896">https:= > //www.redhat.com/archives/freeipa-users/2014-February/msg00007.html</a><b= > r> > </div> > <div id=3D"yui_3_16_0_ym19_1_1496345010090_2912"><br> > </div> > <div id=3D"yui_3_16_0_ym19_1_1496345010090_2961">The article > mentions that the time skew might occur due to server being > virtualied, and I'm =C2=A0wondering if this is applicable to > Amazon.</div> > <div id=3D"yui_3_16_0_ym19_1_1496345010090_2961"><br> > </div> > <div id=3D"yui_3_16_0_ym19_1_1496345010090_2961">The steps > mentioned in the article look intrusive (and intimidating) . > I'm curious what other avenues are available to me to fix > this?</div> > <div id=3D"yui_3_16_0_ym19_1_1496345010090_2961" dir=3D"ltr">If I > blow away the replica and re-set up the new one from scratch > would that fix the problem.</div> > <div dir=3D"ltr" id=3D"yui_3_16_0_ym19_1_1496345010090_2765"><br> > </div> > </div> > <br> > <fieldset class=3D"mimeAttachmentHeader"></fieldset> > <br> > <pre wrap=3D"">_______________________________________________ > FreeIPA-users mailing list -- <a class=3D"moz-txt-link-abbreviated" > href=3D= > "mailto:freeipa-users@lists.fedorahosted.org">freeipa-users(a)lists.fedorah= > osted.org</a> > To unsubscribe send an email to <a class=3D"moz-txt-link-abbreviated" hre= > f=3D"mailto:freeipa-users-leave@lists.fedorahosted.org">freeipa-users-lea= > ve(a)lists.fedorahosted.org</a> > </pre> > </blockquote> > <br> > <pre class=3D"moz-signature" cols=3D"72">--=20 > Red Hat GmbH, <a class=3D"moz-txt-link-freetext" href=3D"http://www.de.re= > dhat.com/">http://www.de.redhat.com/</a>, Registered seat: Grasbrunn,=20 > Commercial register: Amtsgericht Muenchen, HRB 153243, > Managing Directors: Charles Cachera, Michael Cunningham, Michael O'Neill,= > Eric Shander</pre> > </body> > </html> > > --------------090802020609060703090300-- > > ------------------------------ > > Date: Fri, 2 Jun 2017 09:52:03 +0000 > From: Sven Kieske <S.Kieske(a)mittwald.de> > Subject: [Freeipa-users] status of auditd integration on freeipa > clients > To: "freeipa-users(a)lists.fedorahosted.org" > <freeipa-users(a)lists.fedorahosted.org> > Message-ID: <1496397122.11351.8.camel(a)mittwald.de> > Content-Type: multipart/signed; micalg=pgp-sha1; > protocol="application/pgp-signature"; > boundary="=-BLDUS3cjdZxkLqEvtnxZ" > > --=-BLDUS3cjdZxkLqEvtnxZ > Content-Type: text/plain; charset="UTF-8" > Content-Transfer-Encoding: quoted-printable > > Hi, > > I got a question regarding integration of auditd on freeipa clients. > > What I want to achieve is full audit logging, like auditd provides, on > the freeipa clients. > > we tried to hook auditd up with the currently deployed ipa via kerberos, > but had no luck so far. > > we tried to reuse the already present kerberos authentication > to transmit the auditdata in a secure way, but auditd needs the > principal name to be "host/$hostname@REALM" > whereas freeipa requires "$foo/$fqdn@REALM", so it seems we can't > use kerberos tickets from ipa? > > (see also this ML Thread: > https://www.redhat.com/archives/freeipa-users/2014-August/msg00079.html) > > it's very sad to see this divergent development, given that both > projects are heavily developed by redhat, maybe this can get fixed? > If I can help with this (even if you just need bug reports opened), > please tell me so. > > In the mean time I would like to ask about the status of this project > page: > > https://www.freeipa.org/page/Session_Recording > > Is this already implemnted? So far I couldn't find any practical > examples on how to configure freeipa with auditd on freeipa clients :( > > If you know of any other working solution, please share! > > Thanks in advance > > --=20 > Mit freundlichen Gr=C3=BC=C3=9Fen / Regards > > Sven Kieske > > Systemadministrator > > Mittwald CM Service GmbH & Co. KG > K=C3=B6nigsberger Stra=C3=9Fe 6 > 32339 Espelkamp > > T: +495772 293100 > F: +495772 293333 > > https://www.mittwald.de > > Gesch=C3=A4ftsf=C3=BChrer: Robert Meyer, Maik Behring > > St.Nr.: 331/5721/1033, USt-IdNr.: DE814773217 > HRA 6640, AG Bad Oeynhausen > > Komplement=C3=A4rin: Robert Meyer Verwaltungs GmbH > HRB 13260, AG Bad Oeynhausen > > --=-BLDUS3cjdZxkLqEvtnxZ > Content-Type: application/pgp-signature; name="signature.asc" > Content-Description: This is a digitally signed message part > Content-Transfer-Encoding: 7bit > > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v2.0.22 (GNU/Linux) > > iQIcBAABAgAGBQJZMTVCAAoJEMby9TMDAbQRm74P/Ra0GCM0J/Za4QyLna9hAnYB > zqXS47d69dSvLiGQdi3byxvzUy/WXfrruFYsk4YqbUhYSXiaDn8VY3VQEIlgb8kx > sQLTWzFZDEs8aw391REuYeJLEtH0QxoLo6X/N5w1wSMvCH/ihJf+i/AUdtG8xmYK > 1Z2WqUPW2CVjNUWmLi9M1H4xN4fgYD6mJXFkoQ0mfavDMCyDiRmE01/3cuFGDSOM > qljeSulmwGCaBHwKh3HZFgLrHzWv/ja1/c933FzLVQvW90X+fR4vERCsKzvGP0IB > 0snHPFk2Tgep3ShR/fR+Nm54WwFQeYomsZiLQJsqI5/n0/9eP4Ia5kBfmSvcgR6C > U+cDgCLn+zeBOYn8Pq9Dk9AdjDQQIkXSRGKciRfgS26ig6q8J/giobILJN3ChJRf > MmUEmqwuMdTQbcnpf86heORkoQCekYO5XxSdq6VUlsXtuCAFzd/l8VNcewDejRYN > IkV4NjvK/8aBYVUTaTXxjBLpJUPYTihAnocdpt7kBmgon01kT5mb4dinmxyOXe0p > 0FCbQjSD0tcpv0zSe0rqpUs9UthFskSTR2w5AMBoXfGCMC7eBhdwmC6KdYhWS9FS > bbr3wsYt/mvxRddmfFNalhMAl5L1K6n/oNfSVPMIScXBeUWnmuea3+5WzXrpKp6x > tsmdESLJNmv0+TUGqdcA > =pPNW > -----END PGP SIGNATURE----- > > --=-BLDUS3cjdZxkLqEvtnxZ-- > > ------------------------------ > > Date: Fri, 02 Jun 2017 08:59:11 -0400 > From: Simo Sorce <simo(a)redhat.com> > Subject: [Freeipa-users] Re: IPA and CM? > To: FreeIPA users list <freeipa-users(a)lists.fedorahosted.org> > Cc: Kat <uncommonkat(a)gmail.com> > Message-ID: <1496408351.929.96.camel(a)redhat.com> > Content-Type: text/plain; charset="UTF-8" > > On Thu, 2017-06-01 at 14:24 -0500, Kat via FreeIPA-users wrote: > > Hi, > > > > I have read several pages on getting IPA and Clouder Manager working > > together to make nice with Kerberos, however, having an issue > > following the various steps. When I run through CM set and put the > > primary account in I run into the classic "Preauth required" and yet, > > I can kinit the account with no issues, so I am wondering if there > > are any hints on debugging this? What is typically the cuase of that > > kind of error? > > Kat, does something fail, or are you simply concerned with the error > showing up in the kdc logs ? > > This error is 'expected' in modern kerberos implementations. The > original krb5 protocol did not use pre-authentication and that made it > subject to offline dictionary attacks. > So to "fix" this hole, pre-authentication mechanism were introduced. > > The requirement to pre-authenticate is communicated to the client in > form of a "Preauth required" error. This is to preserve protocol > compatibility with previous clients and allow a client to discover what > kind of pre-authentication is allowed by the KDC (the allowed pre-auth > types list is returned together with the error). > > HTH, > Simo. > > ------------------------------ > > Date: Fri, 02 Jun 2017 10:48:23 -0400 > From: Chris Dagdigian <dag(a)sonsorol.org> > Subject: [Freeipa-users] new/fresh server can't be setup as replica > due to "The remote replica has a different database generation ID > ..." > To: FreeIPA users list <freeipa-users(a)lists.fedorahosted.org> > Message-ID: <59317AB7.9030908(a)sonsorol.org> > Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > Hi folks, > > Related to my posts from earlier in the week. I'm stuck in catch-22 land > with no seemingly viable way forward ... > > I am stuck with 2x IPA masters in different AWS regions that refuse to > replicate because the topology is disconnected, I can't seem to force > the re-connect so I'm trying to expand my topology options by building > new fresh masters from scratch. CentOS 7.3 with fully updated IPA > software. > > > The fresh replica install fails with a "Local LDAP" error, these seem to > be the corresponding errors in the /var/log/dirserv logs: > > > [02/Jun/2017:14:29:31.965022647 +0000] 389-Directory/1.3.5.10 > B2017.145.2037 starting up > [02/Jun/2017:14:29:31.976521839 +0000] default_mr_indexer_create: > warning - plugin [caseIgnoreIA5Match] does not handle caseExactIA5Match > [02/Jun/2017:14:29:32.102416271 +0000] slapd started. Listening on All > Interfaces port 389 for LDAP requests > [02/Jun/2017:14:29:32.104077504 +0000] Listening on All Interfaces port > 636 for LDAPS requests > [02/Jun/2017:14:29:32.105380691 +0000] Listening on > /var/run/slapd-companyIDM-ORG.socket for LDAPI requests > [02/Jun/2017:14:29:35.776066609 +0000] NSMMReplicationPlugin - > agmt="cn=meTodeawilidmp001.companyidm.org" (deawilidmp001:389): The > remote replica has a different database generation ID than the local > database. You may have to reinitialize the remote replica, or the local > replica. > > > > And here is the output from trying to perform the replica setup: > > > [root@usaeilidmp003 centos]# ipa-replica-install --setup-ca --principal > admin --admin-password SEKRIT > > Configuring client side components > Using existing certificate '/etc/ipa/ca.crt'. > Discovery was successful! > Client hostname: usaeilidmp003.companyidm.org > Realm: companyIDM.ORG > DNS Domain: companyidm.org > IPA Server: deawilidmp001.companyidm.org > BaseDN: dc=companyidm,dc=org > > Skipping synchronizing time with NTP server. > Enrolled in IPA realm companyIDM.ORG > Created /etc/ipa/default.conf > New SSSD config will be created > Configured sudoers in /etc/nsswitch.conf > Configured /etc/sssd/sssd.conf > Configured /etc/krb5.conf for IPA realm companyIDM.ORG > trying https://deawilidmp001.companyidm.org/ipa/json > Forwarding 'schema' to json server > 'https://deawilidmp001.companyidm.org/ipa/json' > trying https://deawilidmp001.companyidm.org/ipa/session/json > Forwarding 'ping' to json server > 'https://deawilidmp001.companyidm.org/ipa/session/json' > Forwarding 'ca_is_enabled' to json server > 'https://deawilidmp001.companyidm.org/ipa/session/json' > Systemwide CA database updated. > Adding SSH public key from /etc/ssh/ssh_host_rsa_key.pub > Adding SSH public key from /etc/ssh/ssh_host_ecdsa_key.pub > Adding SSH public key from /etc/ssh/ssh_host_ed25519_key.pub > Forwarding 'host_mod' to json server > 'https://deawilidmp001.companyidm.org/ipa/session/json' > SSSD enabled > Configured /etc/openldap/ldap.conf > Configured /etc/ssh/ssh_config > Configured /etc/ssh/sshd_config > Configuring companyidm.org as NIS domain. > Client configuration complete. > > Run connection check to master > Connection check OK > Configuring NTP daemon (ntpd) > [1/4]: stopping ntpd > [2/4]: writing configuration > [3/4]: configuring ntpd to start on boot > [4/4]: starting ntpd > Done configuring NTP daemon (ntpd). > Configuring directory server (dirsrv). Estimated time: 1 minute > [1/44]: creating directory server user > [2/44]: creating directory server instance > [3/44]: updating configuration in dse.ldif > [4/44]: restarting directory server > [5/44]: adding default schema > [6/44]: enabling memberof plugin > [7/44]: enabling winsync plugin > [8/44]: configuring replication version plugin > [9/44]: enabling IPA enrollment plugin > [10/44]: enabling ldapi > [11/44]: configuring uniqueness plugin > [12/44]: configuring uuid plugin > [13/44]: configuring modrdn plugin > [14/44]: configuring DNS plugin > [15/44]: enabling entryUSN plugin > [16/44]: configuring lockout plugin > [17/44]: configuring topology plugin > [18/44]: creating indices > [19/44]: enabling referential integrity plugin > [20/44]: configuring certmap.conf > [21/44]: configure autobind for root > [22/44]: configure new location for managed entries > [23/44]: configure dirsrv ccache > [24/44]: enabling SASL mapping fallback > [25/44]: restarting directory server > [26/44]: creating DS keytab > [27/44]: retrieving DS Certificate > [28/44]: restarting directory server > [29/44]: setting up initial replication > Starting replication, please wait until this has completed. > Update in progress, 15 seconds elapsed > [deawilidmp001.companyidm.org] reports: Update failed! Status: [-2 - > LDAP error: Local error] > > [error] RuntimeError: Failed to start replication > Your system may be partly configured. > Run /usr/sbin/ipa-server-install --uninstall to clean up. > > ipa.ipapython.install.cli.install_tool(Replica): ERROR Failed to > start replication > ipa.ipapython.install.cli.install_tool(Replica): ERROR The > ipa-replica-install command failed. See /var/log/ipareplica-install.log > for more information > [root@usaeilidmp003 centos]# > > \ > > ------------------------------ > > Date: Fri, 2 Jun 2017 09:04:37 -0600 > From: "Jose Alvarez R." <jalvarez(a)cyberfuel.com> > Subject: [Freeipa-users] Re: DatabaseError: Server is unwilling to > perform: Too many failed logins. > To: "'FreeIPA users list'" <freeipa-users(a)lists.fedorahosted.org> > Cc: 'Rob Crittenden' <rcritten(a)redhat.com> > Message-ID: <023101d2dbb1$8d3ec080$a7bc4180$(a)cyberfuel.com> > Content-Type: text/plain; charset="UTF-8" > > Hi Rob > > Thanks for your response > > Well, the source error is Internal Server Error 500 and this happened when > I was surfing the UI website. > > A forum talks about the problem and show these same mistakes. > > [root@ipa ipa_memcached]# cat /var/log/httpd/error_log* | grep > var/run/ipa_memcached/ > [Sun May 28 06:40:51.725678 2017] [wsgi:error] [pid 25441] ipa: ERROR: > release_ipa_ccache: ccache_name (FILE:/var/run/ipa_memcached/krbcc_25441) > != KRB5CCNAME environment variable (/var/run/httpd/ipa/krbcache/ > krb5ccache) > [Mon May 29 08:33:47.909256 2017] [wsgi:error] [pid 30951] ipa: ERROR: > release_ipa_ccache: ccache_name (FILE:/var/run/ipa_memcached/krbcc_30951) > != KRB5CCNAME environment variable (/var/run/httpd/ipa/krbcache/ > krb5ccache) > [Wed May 31 11:20:33.216853 2017] [wsgi:error] [pid 2024] ipa: ERROR: > release_ipa_ccache: ccache_name (FILE:/var/run/ipa_memcached/krbcc_2024) > != KRB5CCNAME environment variable (/var/run/httpd/ipa/krbcache/ > krb5ccache) > [Wed May 31 14:58:20.765378 2017] [wsgi:error] [pid 2638] ipa: ERROR: > release_ipa_ccache: ccache_name (FILE:/var/run/ipa_memcached/krbcc_2638) > != KRB5CCNAME environment variable (/var/run/httpd/ipa/krbcache/ > krb5ccache) > [Sun May 14 10:37:26.328760 2017] [wsgi:error] [pid 14689] ipa: ERROR: > release_ipa_ccache: ccache_name (FILE:/var/run/ipa_memcached/krbcc_14689) > != KRB5CCNAME environment variable (/var/run/httpd/ipa/krbcache/ > krb5ccache) > [Mon May 15 10:52:54.329041 2017] [wsgi:error] [pid 15684] ipa: ERROR: > release_ipa_ccache: ccache_name (FILE:/var/run/ipa_memcached/krbcc_15684) > != KRB5CCNAME environment variable (/var/run/httpd/ipa/krbcache/ > krb5ccache) > [Sun May 21 08:24:44.796135 2017] [wsgi:error] [pid 21336] ipa: ERROR: > release_ipa_ccache: ccache_name (FILE:/var/run/ipa_memcached/krbcc_21336) > != KRB5CCNAME environment variable (/var/run/httpd/ipa/krbcache/ > krb5ccache) > [Sun May 21 09:06:47.160491 2017] [wsgi:error] [pid 22286] ipa: ERROR: > release_ipa_ccache: ccache_name (FILE:/var/run/ipa_memcached/krbcc_22286) > != KRB5CCNAME environment variable (/var/run/httpd/ipa/krbcache/ > krb5ccache) > [Mon May 22 08:08:36.230187 2017] [wsgi:error] [pid 1172] ipa: ERROR: > release_ipa_ccache: ccache_name (FILE:/var/run/ipa_memcached/krbcc_1172) > != KRB5CCNAME environment variable (/var/run/httpd/ipa/krbcache/ > krb5ccache) > [Mon May 22 09:46:18.902093 2017] [wsgi:error] [pid 18385] ipa: ERROR: > release_ipa_ccache: ccache_name (FILE:/var/run/ipa_memcached/krbcc_18385) > != KRB5CCNAME environment variable (/var/run/httpd/ipa/krbcache/ > krb5ccache) > [Thu May 25 11:17:44.614808 2017] [wsgi:error] [pid 17917] ipa: ERROR: > release_ipa_ccache: ccache_name (FILE:/var/run/ipa_memcached/krbcc_17917) > != KRB5CCNAME environment variable (/var/run/httpd/ipa/krbcache/ > krb5ccache) > [Fri May 26 06:47:28.370299 2017] [wsgi:error] [pid 19054] ipa: ERROR: > release_ipa_ccache: ccache_name (FILE:/var/run/ipa_memcached/krbcc_19054) > != KRB5CCNAME environment variable (/var/run/httpd/ipa/krbcache/ > krb5ccache) > [Fri May 26 09:47:38.076514 2017] [wsgi:error] [pid 21824] ipa: ERROR: > release_ipa_ccache: ccache_name (FILE:/var/run/ipa_memcached/krbcc_21824) > != KRB5CCNAME environment variable (/var/run/httpd/ipa/krbcache/ > krb5ccache) > [Fri May 26 10:58:15.032141 2017] [wsgi:error] [pid 22569] ipa: ERROR: > release_ipa_ccache: ccache_name (FILE:/var/run/ipa_memcached/krbcc_22569) > != KRB5CCNAME environment variable (/var/run/httpd/ipa/krbcache/ > krb5ccache) > > > Error is not by login > > > Thanks, Regards > > Jose Alvarez > > > -----Original Message----- > From: Rob Crittenden via FreeIPA-users [mailto:freeipa-users@lists. > fedorahosted.org] > Sent: jueves 1 de junio de 2017 03:05 p.m. > To: FreeIPA users list <freeipa-users(a)lists.fedorahosted.org> > Cc: Jose Alvarez R. <jalvarez(a)cyberfuel.com>; Rob Crittenden < > rcritten(a)redhat.com> > Subject: [Freeipa-users] Re: DatabaseError: Server is unwilling to > perform: Too many failed logins. > > Jose Alvarez R. via FreeIPA-users wrote: > > Hi > > > > > > > > Can you help me with this problem? > > > > > > > > My FreeIPA version 4.3.3 and the S.O. is Fedora 24 > > It would help if you'd provide context to what you were doing at the time. > > A account may be locked out for a period of time due to too many failed > authentication requests. > > rob > > > > > > > > > Thanks Regards > > > > > > > > Jose Alvarez > > > > > > > > > > > > > > > > *From:*Jose Alvarez R. [mailto:jalvarez@cyberfuel.com] > > *Sent:* miércoles 31 de mayo de 2017 12:17 p.m. > > *To:* 'FreeIPA users list' <freeipa-users(a)lists.fedorahosted.org> > > *Subject:* DatabaseError: Server is unwilling to perform: Too many > > failed logins. > > > > > > > > Hi > > > > > > > > A question, I have the following errors on my server FreeIPA 4.3.3 > > > > > > > > > > > > cat /var/log/httpd/error_log > > > > > > > > > > > > Wed May 31 11:27:59.079315 2017] [wsgi:error] [pid 2024] [remote > > 192.168.0.114:200] mod_wsgi (pid=2024): Exception occurred processing > > WSGI script '/usr/share/ipa/wsgi > > > > [Wed May 31 11:27:59.079432 2017] [wsgi:error] [pid 2024] [remote > > 192.168.0.114:200] Traceback (most recent call last): > > > > [Wed May 31 11:27:59.079486 2017] [wsgi:error] [pid 2024] [remote > > 192.168.0.114:200] File "/usr/share/ipa/wsgi.py", line 63, in > application > > > > [Wed May 31 11:27:59.079675 2017] [wsgi:error] [pid 2024] [remote > > 192.168.0.114:200] return api.Backend.wsgi_dispatch(environ, > > start_response) > > > > [Wed May 31 11:27:59.079703 2017] [wsgi:error] [pid 2024] [remote > > 192.168.0.114:200] File > > "/usr/lib/python2.7/site-packages/ipaserver/rpcserver.py", line 261, > > in __ca > > > > [Wed May 31 11:27:59.080261 2017] [wsgi:error] [pid 2024] [remote > > 192.168.0.114:200] return self.route(environ, start_response) > > > > [Wed May 31 11:27:59.080298 2017] [wsgi:error] [pid 2024] [remote > > 192.168.0.114:200] File > > "/usr/lib/python2.7/site-packages/ipaserver/rpcserver.py", line 273, > > in rout > > > > [Wed May 31 11:27:59.080343 2017] [wsgi:error] [pid 2024] [remote > > 192.168.0.114:200] return app(environ, start_response) > > > > [Wed May 31 11:27:59.080401 2017] [wsgi:error] [pid 2024] [remote > > 192.168.0.114:200] File > > "/usr/lib/python2.7/site-packages/ipaserver/rpcserver.py", line 811, > > in __ca > > > > [Wed May 31 11:27:59.080437 2017] [wsgi:error] [pid 2024] [remote > > 192.168.0.114:200] self.create_context(ccache=ipa_ccache_name) > > > > [Wed May 31 11:27:59.080455 2017] [wsgi:error] [pid 2024] [remote > > 192.168.0.114:200] File > > "/usr/lib/python2.7/site-packages/ipalib/backend.py", line 123, in > > create_co > > > > [Wed May 31 11:27:59.080578 2017] [wsgi:error] [pid 2024] [remote > > 192.168.0.114:200] self.Backend.ldap2.connect(ccache=ccache) > > > > [Wed May 31 11:27:59.080611 2017] [wsgi:error] [pid 2024] [remote > > 192.168.0.114:200] File > > "/usr/lib/python2.7/site-packages/ipalib/backend.py", line 66, in > > connect > > > > [Wed May 31 11:27:59.080654 2017] [wsgi:error] [pid 2024] [remote > > 192.168.0.114:200] conn = self.create_connection(*args, **kw) > > > > [Wed May 31 11:27:59.080691 2017] [wsgi:error] [pid 2024] [remote > > 192.168.0.114:200] File > > "/usr/lib/python2.7/site-packages/ipaserver/plugins/ldap2.py", line > > 202, in > > > > [Wed May 31 11:27:59.080973 2017] [wsgi:error] [pid 2024] [remote > > 192.168.0.114:200] client_controls=clientctrls) > > > > [Wed May 31 11:27:59.081019 2017] [wsgi:error] [pid 2024] [remote > > 192.168.0.114:200] File > > "/usr/lib/python2.7/site-packages/ipapython/ipaldap.py", line 1085, in > > gssap > > > > [Wed May 31 11:27:59.081653 2017] [wsgi:error] [pid 2024] [remote > > 192.168.0.114:200] '', auth_tokens, server_controls, > client_controls) > > > > [Wed May 31 11:27:59.081678 2017] [wsgi:error] [pid 2024] [remote > > 192.168.0.114:200] File "/usr/lib64/python2.7/contextlib.py", line 35, > > in __exit__ > > > > [Wed May 31 11:27:59.081835 2017] [wsgi:error] [pid 2024] [remote > > 192.168.0.114:200] self.gen.throw(type, value, traceback) > > > > [Wed May 31 11:27:59.081897 2017] [wsgi:error] [pid 2024] [remote > > 192.168.0.114:200] File > > "/usr/lib/python2.7/site-packages/ipapython/ipaldap.py", line 998, in > > error_ > > > > [Wed May 31 11:27:59.081955 2017] [wsgi:error] [pid 2024] [remote > > 192.168.0.114:200] raise errors.DatabaseError(desc=desc, info=info) > > > > [Wed May 31 11:27:59.082028 2017] [wsgi:error] [pid 2024] [remote > > 192.168.0.114:200] DatabaseError: Server is unwilling to perform: Too > > many failed logins. > > > > > > > > I checked this link: https://pagure.io/freeipa/issue/5653 > > > > > > > > But I'm not sure, How can I solve that? > > > > > > > > Thanks, Regards > > > > > > > > > > > > Jose Alvarez > > > > > > > > > > > > > > > > _______________________________________________ > > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org > > To unsubscribe send an email to > > freeipa-users-leave(a)lists.fedorahosted.org > > > _______________________________________________ > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org > To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org > > ------------------------------ > > Date: Fri, 2 Jun 2017 10:10:26 -0500 > From: Kat <uncommonkat(a)gmail.com> > Subject: [Freeipa-users] Re: IPA and CM? > To: Simo Sorce <simo(a)redhat.com>, FreeIPA users list > <freeipa-users(a)lists.fedorahosted.org> > Message-ID: <484a0111-7e87-0dac-2be1-2e4df5e6aeb2(a)gmail.com> > Content-Type: text/plain; charset=utf-8; format=flowed > > Hi Simo, > > I understand the mechanics of the error, however, when you are trying to > configure Cloudera Manager with IPA, the configuration/setup process > fails with the error (and it shows in logs) and therefore, CM does not > finish the configuration. > > I was also just reading: > https://community.cloudera.com/t5/Cloudera-Manager- > Installation/Add-Support-for-FreeIPA-to-CM/td-p/34582 > > Which has Dmitri discussing things with Cloudera. The problem seems to > be that although CM has a script for custom principal retrievals, maybe > what I am seeing here is that it is the ipa-client install that causes > the problems? Or am I missing the boat completely? > > -K > > > On 6/2/17 7:59 AM, Simo Sorce wrote: > > On Thu, 2017-06-01 at 14:24 -0500, Kat via FreeIPA-users wrote: > >> Hi, > >> > >> I have read several pages on getting IPA and Clouder Manager working > >> together to make nice with Kerberos, however, having an issue > >> following the various steps. When I run through CM set and put the > >> primary account in I run into the classic "Preauth required" and yet, > >> I can kinit the account with no issues, so I am wondering if there > >> are any hints on debugging this? What is typically the cuase of that > >> kind of error? > > Kat, does something fail, or are you simply concerned with the error > > showing up in the kdc logs ? > > > > This error is 'expected' in modern kerberos implementations. The > > original krb5 protocol did not use pre-authentication and that made it > > subject to offline dictionary attacks. > > So to "fix" this hole, pre-authentication mechanism were introduced. > > > > The requirement to pre-authenticate is communicated to the client in > > form of a "Preauth required" error. This is to preserve protocol > > compatibility with previous clients and allow a client to discover what > > kind of pre-authentication is allowed by the KDC (the allowed pre-auth > > types list is returned together with the error). > > > > HTH, > > Simo. > > ------------------------------ > > Date: Fri, 02 Jun 2017 11:25:36 -0400 > From: Simo Sorce <simo(a)redhat.com> > Subject: [Freeipa-users] Re: IPA and CM? > To: Kat <uncommonkat(a)gmail.com>, FreeIPA users list > <freeipa-users(a)lists.fedorahosted.org> > Message-ID: <1496417136.929.102.camel(a)redhat.com> > Content-Type: text/plain; charset="UTF-8" > > On Fri, 2017-06-02 at 10:10 -0500, Kat wrote: > > Hi Simo, > > > > I understand the mechanics of the error, however, when you are trying > > to configure Cloudera Manager with IPA, the configuration/setup > > process fails with the error (and it shows in logs) and therefore, CM > > does not finish the configuration. > > I am not familiar with clouders, if it depends on the kadmin interface, > then it will not work as in FreeIPA thatintrerface is read-only. > > If the only issue is using a keytab where they use some old kerberos > component that does not handle preauthenticated encryption, then you > can go into freeipa and lift the requirement to perform > preauthentication for that specific principal. > > ipa service-mod my/principal@REALM --requires-pre-auth=false > > HTH, > Simo. > > > I was also just reading: > > https://community.cloudera.com/t5/Cloudera-Manager-Installation/Add-S > > upport-for-FreeIPA-to-CM/td-p/34582 > > > > Which has Dmitri discussing things with Cloudera. The problem seems > > to be that although CM has a script for custom principal retrievals, > > maybe what I am seeing here is that it is the ipa-client install > > that causes the problems? Or am I missing the boat completely? > > > > -K > > > > > > On 6/2/17 7:59 AM, Simo Sorce wrote: > > > On Thu, 2017-06-01 at 14:24 -0500, Kat via FreeIPA-users wrote: > > > > Hi, > > > > > > > > I have read several pages on getting IPA and Clouder Manager > > > > working > > > > together to make nice with Kerberos, however, having an issue > > > > following the various steps. When I run through CM set and put > > > > the > > > > primary account in I run into the classic "Preauth required" and > > > > yet, > > > > I can kinit the account with no issues, so I am wondering if > > > > there > > > > are any hints on debugging this? What is typically the cuase of > > > > that > > > > kind of error? > > > > > > Kat, does something fail, or are you simply concerned with the > > > error > > > showing up in the kdc logs ? > > > > > > This error is 'expected' in modern kerberos implementations. The > > > original krb5 protocol did not use pre-authentication and that made > > > it > > > subject to offline dictionary attacks. > > > So to "fix" this hole, pre-authentication mechanism were > > > introduced. > > > > > > The requirement to pre-authenticate is communicated to the client > > > in > > > form of a "Preauth required" error. This is to preserve protocol > > > compatibility with previous clients and allow a client to discover > > > what > > > kind of pre-authentication is allowed by the KDC (the allowed pre- > > > auth > > > types list is returned together with the error). > > > > > > HTH, > > > Simo. > > > > > > ------------------------------ > > Date: Fri, 2 Jun 2017 18:34:45 +0300 > From: Alexander Bokovoy <abokovoy(a)redhat.com> > Subject: [Freeipa-users] Re: IPA and CM? > To: FreeIPA users list <freeipa-users(a)lists.fedorahosted.org> > Cc: Kat <uncommonkat(a)gmail.com> > Message-ID: <20170602153445.qhu4rttqkqrfrmor(a)redhat.com> > Content-Type: text/plain; charset=iso-8859-1; format=flowed > > On pe, 02 kesä 2017, Simo Sorce via FreeIPA-users wrote: > >On Fri, 2017-06-02 at 10:10 -0500, Kat wrote: > >> Hi Simo, > >> > >> I understand the mechanics of the error, however, when you are trying > >> to configure Cloudera Manager with IPA, the configuration/setup > >> process fails with the error (and it shows in logs) and therefore, CM > >> does not finish the configuration. > > > >I am not familiar with clouders, if it depends on the kadmin interface, > >then it will not work as in FreeIPA thatintrerface is read-only. > > > >If the only issue is using a keytab where they use some old kerberos > >component that does not handle preauthenticated encryption, then you > >can go into freeipa and lift the requirement to perform > >preauthentication for that specific principal. > > > >ipa service-mod my/principal@REALM --requires-pre-auth=false > I did already refer to this blogpost the other week: > https://mapredit.blogspot.fi/2016/10/freeipa-and-hadoop- > distributions-hdp-cdh.html > > -- > / Alexander Bokovoy > > ------------------------------ > > Date: Fri, 2 Jun 2017 13:10:04 -0400 > From: Striker Leggette <striker(a)terranforge.com> > Subject: [Freeipa-users] FreeIPA for simply managing DNS > To: freeipa-users(a)redhat.com > Message-ID: <6f3803ff-6052-5f3a-3b57-b63d4b51f786(a)terranforge.com> > Content-Type: multipart/alternative; > boundary="------------2E0C330E1EE2AA61A1B67AAF" > > This is a multi-part message in MIME format. > --------------2E0C330E1EE2AA61A1B67AAF > Content-Type: text/plain; charset=utf-8; format=flowed > Content-Transfer-Encoding: 7bit > > FreeIPA has a very well-made and easy to use DNS management GUI that > would serve well as a standalone tool. Are there any plans to fork the > DNS GUI like this for those who would like an easy DNS management > application who do not necessarily need LDAP/PKI/Kerberos/etc.? > > -- > Striker Leggette > Identity Management > > linkedin.com/in/striker > > > --------------2E0C330E1EE2AA61A1B67AAF > Content-Type: text/html; charset=utf-8 > Content-Transfer-Encoding: quoted-printable > > <html> > <head> > > <meta http-equiv=3D"content-type" content=3D"text/html; charset=3Dutf= > -8"> > </head> > <body text=3D"#000000" bgcolor=3D"#FFFFFF"> > <p><tt><font size=3D"-1">FreeIPA has a very well-made and easy to use > DNS management GUI that would serve well as a standalone > tool.=C2=A0 Are there any plans to fork the DNS GUI like this f= > or > those who would like an easy DNS management application who do > not necessarily need LDAP/PKI/Kerberos/etc.?</font></tt><br> > </p> > <pre class=3D"moz-signature" cols=3D"72">--=20 > Striker Leggette > Identity Management > > linkedin.com/in/striker</pre> > </body> > </html> > > --------------2E0C330E1EE2AA61A1B67AAF-- > > ------------------------------ > > Date: Fri, 2 Jun 2017 10:21:47 -0700 > From: Devin Acosta <linuxguru.co(a)gmail.com> > Subject: [Freeipa-users] FreeIPA (adding all new users to admin group > by default?) > To: freeipa-users(a)lists.fedorahosted.org > Message-ID: > <CAAqg8ePTEzbH5CqOrSooMZcQRDF18Ajw-J12gvfnBU7QApM9kw@mail. > gmail.com> > Content-Type: multipart/alternative; > boundary="001a113e3aba5c916f0550fd638e" > > --001a113e3aba5c916f0550fd638e > Content-Type: text/plain; charset="UTF-8" > > I am hoping to see if someone can tell me what I either need to change or > update to get it so that FreeIPA doesn't automatically keep adding all new > users that is created automatically to the admin group. I inherited this > installation of FreeIPA and so far haven't been able to figure out what > either got changed or how to disable this behavior? I am running the latest > FreeIPA 4.4 on CentOS 7.3. > > Any help would be greatly appreciated. > > Devin Acosta > > --001a113e3aba5c916f0550fd638e > Content-Type: text/html; charset="UTF-8" > Content-Transfer-Encoding: quoted-printable > > <div dir=3D"ltr"><br><div>I am hoping to see if someone can tell me what I > = > either need to change or update to get it so that FreeIPA doesn't > autom= > atically keep adding all new users that is created automatically to the > adm= > in group. I inherited this installation of FreeIPA and so far haven't > b= > een able to figure out what either got changed or how to disable this > behav= > ior? I am running the latest FreeIPA 4.4 on CentOS > 7.3.</div><div><br></div= > ><div>Any help would be greatly appreciated.</div><div><br></ > div><div>Devin= > Acosta</div></div> > > --001a113e3aba5c916f0550fd638e-- > > ------------------------------ > > Date: Fri, 2 Jun 2017 14:02:03 -0400 > From: Rob Crittenden <rcritten(a)redhat.com> > Subject: [Freeipa-users] Re: FreeIPA (adding all new users to admin > group by default?) > To: FreeIPA users list <freeipa-users(a)lists.fedorahosted.org> > Cc: Devin Acosta <linuxguru.co(a)gmail.com> > Message-ID: <4bc6e614-0f53-c177-848d-a574e0cb0b15(a)redhat.com> > Content-Type: text/plain; charset=UTF-8 > > Devin Acosta via FreeIPA-users wrote: > > > > I am hoping to see if someone can tell me what I either need to change > > or update to get it so that FreeIPA doesn't automatically keep adding > > all new users that is created automatically to the admin group. I > > inherited this installation of FreeIPA and so far haven't been able to > > figure out what either got changed or how to disable this behavior? I am > > running the latest FreeIPA 4.4 on CentOS 7.3. > > > > Any help would be greatly appreciated. > > Probably the default users group. Try: > > $ kinit admin > $ ipa config-show |grep 'Default users group' > > Can be changed using: > > $ ipa config-mod --defaultgroup ipausers > > You can probably do this in the UI as well but I'm a CLI guy. > > rob > > ------------------------------ > > Date: Fri, 2 Jun 2017 11:12:35 -0700 > From: Devin Acosta <linuxguru.co(a)gmail.com> > Subject: [Freeipa-users] Re: FreeIPA (adding all new users to admin > group by default?) > To: Rob Crittenden <rcritten(a)redhat.com> > Cc: FreeIPA users list <freeipa-users(a)lists.fedorahosted.org> > Message-ID: > <CAAqg8eMzKRjO3ZNkOmiN=9cVD_B-voRNcmwbaesGifSyjEU+sw@mail. > gmail.com> > Content-Type: multipart/alternative; > boundary="94eb2c04fa92075a9e0550fe1901" > > --94eb2c04fa92075a9e0550fe1901 > Content-Type: text/plain; charset="UTF-8" > > Rob, > > That is what confuses me, I show that the default users group is > "ipausers", however when I added an account which I just tested it added to > admins group. Anything else that could be making it add it to the "admin" > group? > > [root@ipa01 ~]# ipa config-show > Maximum username length: 32 > Home directory base: /home > Default shell: /bin/bash > * Default users group: ipausers* > Default e-mail domain: m451.tech > Search time limit: 2 > Search size limit: -1 > User search fields: uid,givenname,sn,telephonenumber,ou,title > Group search fields: cn,description > Enable migration mode: FALSE > Certificate Subject base: O=M451.TECH > Password Expiration Notification (days): 4 > Password plugin features: AllowNThash > SELinux user map order: > guest_u:s0$xguest_u:s0$user_u:s0$staff_u:s0-s0:c0.c1023$ > unconfined_u:s0-s0:c0.c1023 > Default SELinux user: unconfined_u:s0-s0:c0.c1023 > Default PAC types: nfs:NONE, MS-PAC > > [root@ipa01 ~]# ipa user-add testuser-devin > First name: Devin > Last name: Acosta > --------------------------- > Added user "testuser-devin" > --------------------------- > User login: testuser-devin > First name: Devin > Last name: Acosta > Full name: Devin Acosta > Display name: Devin Acosta > Initials: DA > Home directory: /home/testuser-devin > GECOS: Devin Acosta > Login shell: /bin/bash > Principal name: testuser-devin(a)M451.TECH > Principal alias: testuser-devin(a)M451.TECH > Email address: testuser-devin(a)m451.tech > UID: 34375527 > GID: 34375527 > Password: False > *Member of groups: ipausers, admins* > Roles: IT Security Specialist, sec_netops2, helpdesk, IT Specialist, User > Administrator, Security Architect, ipa_join > Indirect Member of role: ipa_join, helpdesk, IT Security Specialist, > sec_netops2, IT Specialist, Security Architect, User Administrator > Kerberos keys available: False > > On Fri, Jun 2, 2017 at 11:02 AM, Rob Crittenden <rcritten(a)redhat.com> > wrote: > > > Devin Acosta via FreeIPA-users wrote: > > > > > > I am hoping to see if someone can tell me what I either need to change > > > or update to get it so that FreeIPA doesn't automatically keep adding > > > all new users that is created automatically to the admin group. I > > > inherited this installation of FreeIPA and so far haven't been able to > > > figure out what either got changed or how to disable this behavior? I > am > > > running the latest FreeIPA 4.4 on CentOS 7.3. > > > > > > Any help would be greatly appreciated. > > > > Probably the default users group. Try: > > > > $ kinit admin > > $ ipa config-show |grep 'Default users group' > > > > Can be changed using: > > > > $ ipa config-mod --defaultgroup ipausers > > > > You can probably do this in the UI as well but I'm a CLI guy. > > > > rob > > > > --94eb2c04fa92075a9e0550fe1901 > Content-Type: text/html; charset="UTF-8" > Content-Transfer-Encoding: quoted-printable > > <div dir=3D"ltr"><br><div>Rob,</div><div><br></div><div>That is what > confus= > es me, I show that the default users group is "ipausers", > however= > when I added an account which I just tested it added to admins group.=C2= > =A0 Anything else that could be making it add it to the "admin" > g= > roup?</div><div><br></div><div><div>[root@ipa01 ~]# ipa > config-show</div><d= > iv>=C2=A0 Maximum username length: 32</div><div>=C2=A0 Home directory > base:= > /home</div><div>=C2=A0 Default shell: /bin/bash</div><div><b>=C2=A0 > Defaul= > t users group: ipausers</b></div><div>=C2=A0 Default e-mail domain: > m451.te= > ch</div><div>=C2=A0 Search time limit: 2</div><div>=C2=A0 Search size > limit= > : -1</div><div>=C2=A0 User search fields: uid,givenname,sn, > telephonenumber,= > ou,title</div><div>=C2=A0 Group search fields: > cn,description</div><div>=C2= > =A0 Enable migration mode: FALSE</div><div>=C2=A0 Certificate Subject > base:= > O=3DM451.TECH</div><div>=C2=A0 Password Expiration Notification (days): > 4<= > /div><div>=C2=A0 Password plugin features: AllowNThash</div><div>=C2=A0 > SEL= > inux user map order: guest_u:s0$xguest_u:s0$user_u: > s0$staff_u:s0-s0:c0.c102= > 3$unconfined_u:s0-s0:c0.c1023</div><div>=C2=A0 Default SELinux user: > unconf= > ined_u:s0-s0:c0.c1023</div><div>=C2=A0 Default PAC types: nfs:NONE, > MS-PAC<= > /div></div><div><br></div><div><div>[root@ipa01 ~]# ipa user-add > testuser-d= > evin</div><div>First name: Devin</div><div>Last name: > Acosta</div><div>----= > -----------------------</div><div>Added user "testuser-devin"</ > di= > v><div>---------------------------</div><div>=C2=A0 User login: > testuser-de= > vin</div><div>=C2=A0 First name: Devin</div><div>=C2=A0 Last name: > Acosta</= > div><div>=C2=A0 Full name: Devin Acosta</div><div>=C2=A0 Display name: > Devi= > n Acosta</div><div>=C2=A0 Initials: DA</div><div>=C2=A0 Home directory: > /ho= > me/testuser-devin</div><div>=C2=A0 GECOS: Devin Acosta</div><div>=C2=A0 > Log= > in shell: /bin/bash</div><div>=C2=A0 Principal name: testuser-devin(a)M451.TE > = > CH</div><div>=C2=A0 Principal alias: testuser-devin(a)M451.TECH</div> > <div>=C2= > =A0 Email address: testuser-devin(a)m451.tech</div><div>=C2=A0 UID: > 34375527<= > /div><div>=C2=A0 GID: 34375527</div><div>=C2=A0 Password: False</div><div>= > =C2=A0 <b>Member of groups: ipausers, admins</b></div><div>=C2=A0 Roles: > IT= > Security Specialist, sec_netops2, helpdesk, IT Specialist, User > Administra= > tor, Security Architect, ipa_join</div><div>=C2=A0 Indirect Member of > role:= > ipa_join, helpdesk, IT Security Specialist, sec_netops2, IT Specialist, > Se= > curity Architect, User Administrator</div><div>=C2=A0 Kerberos keys > availab= > le: False</div></div></div><div class=3D"gmail_extra"><br><div > class=3D"gma= > il_quote">On Fri, Jun 2, 2017 at 11:02 AM, Rob Crittenden <span > dir=3D"ltr"= > ><<a href=3D"mailto:rcritten@redhat.com" target=3D"_blank">rcritten@ > redh= > at.com</a>></span> wrote:<br><blockquote class=3D"gmail_quote" > style=3D"= > margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class= > =3D"">Devin Acosta via FreeIPA-users wrote:<br> > ><br> > > I am hoping to see if someone can tell me what I either need to > change= > <br> > > or update to get it so that FreeIPA doesn't automatically keep > add= > ing<br> > > all new users that is created automatically to the admin group. I<br> > > inherited this installation of FreeIPA and so far haven't been > abl= > e to<br> > > figure out what either got changed or how to disable this behavior? I > = > am<br> > > running the latest FreeIPA 4.4 on CentOS 7.3.<br> > ><br> > > Any help would be greatly appreciated.<br> > <br> > </span>Probably the default users group. Try:<br> > <br> > $ kinit admin<br> > $ ipa config-show |grep 'Default users group'<br> > <br> > Can be changed using:<br> > <br> > $ ipa config-mod --defaultgroup ipausers<br> > <br> > You can probably do this in the UI as well but I'm a CLI guy.<br> > <span class=3D"HOEnZb"><font color=3D"#888888"><br> > rob<br> > </font></span></blockquote></div><br></div> > > --94eb2c04fa92075a9e0550fe1901-- > > ------------------------------ > > Date: Fri, 2 Jun 2017 18:20:52 +0000 > From: <wouter.hummelink(a)kpn.com> > Subject: [Freeipa-users] Re: FreeIPA (adding all new users to admin > group by default?) > To: <freeipa-users(a)lists.fedorahosted.org>, <rcritten(a)redhat.com> > Cc: linuxguru.co(a)gmail.com > Message-ID: <wr5vefergmq3fe5uuk63b7cn.1496427649570(a)email.android.com> > Content-Type: multipart/alternative; > boundary="_000_wr5vefergmq3fe5uuk63b7cn149642 > 7649570emailandroidcom_" > > --_000_wr5vefergmq3fe5uuk63b7cn1496427649570emailandroidcom_ > Content-Type: text/plain; charset="us-ascii" > Content-Transfer-Encoding: quoted-printable > > Look at automember rules. > > > > Verzonden vanaf mijn Samsung-apparaat > > > -------- Oorspronkelijk bericht -------- > Van: Devin Acosta via FreeIPA-users <freeipa-users(a)lists.fedorahosted.org> > Datum: 02-06-17 20:13 (GMT+01:00) > Aan: Rob Crittenden <rcritten(a)redhat.com> > Cc: FreeIPA users list <freeipa-users(a)lists.fedorahosted.org>, Devin > Acosta= > <linuxguru.co(a)gmail.com> > Onderwerp: [Freeipa-users] Re: FreeIPA (adding all new users to admin > group= > by default?) > > > Rob, > > That is what confuses me, I show that the default users group is > "ipausers"= > , however when I added an account which I just tested it added to admins > gr= > oup. Anything else that could be making it add it to the "admin" group? > > [root@ipa01 ~]# ipa config-show > Maximum username length: 32 > Home directory base: /home > Default shell: /bin/bash > Default users group: ipausers > Default e-mail domain: m451.tech > Search time limit: 2 > Search size limit: -1 > User search fields: uid,givenname,sn,telephonenumber,ou,title > Group search fields: cn,description > Enable migration mode: FALSE > Certificate Subject base: O=3DM451.TECH > Password Expiration Notification (days): 4 > Password plugin features: AllowNThash > SELinux user map order: guest_u:s0$xguest_u:s0$user_u: > s0$staff_u:s0-s0:c0= > .c1023$unconfined_u:s0-s0:c0.c1023 > Default SELinux user: unconfined_u:s0-s0:c0.c1023 > Default PAC types: nfs:NONE, MS-PAC > > [root@ipa01 ~]# ipa user-add testuser-devin > First name: Devin > Last name: Acosta > --------------------------- > Added user "testuser-devin" > --------------------------- > User login: testuser-devin > First name: Devin > Last name: Acosta > Full name: Devin Acosta > Display name: Devin Acosta > Initials: DA > Home directory: /home/testuser-devin > GECOS: Devin Acosta > Login shell: /bin/bash > Principal name: testuser-devin(a)M451.TECH > Principal alias: testuser-devin(a)M451.TECH > Email address: testuser-devin(a)m451.tech > UID: 34375527 > GID: 34375527 > Password: False > Member of groups: ipausers, admins > Roles: IT Security Specialist, sec_netops2, helpdesk, IT Specialist, > User= > Administrator, Security Architect, ipa_join > Indirect Member of role: ipa_join, helpdesk, IT Security Specialist, > sec_= > netops2, IT Specialist, Security Architect, User Administrator > Kerberos keys available: False > > On Fri, Jun 2, 2017 at 11:02 AM, Rob Crittenden <rcritten(a)redhat.com > <mailto= > :rcritten@redhat.com>> wrote: > Devin Acosta via FreeIPA-users wrote: > > > > I am hoping to see if someone can tell me what I either need to change > > or update to get it so that FreeIPA doesn't automatically keep adding > > all new users that is created automatically to the admin group. I > > inherited this installation of FreeIPA and so far haven't been able to > > figure out what either got changed or how to disable this behavior? I am > > running the latest FreeIPA 4.4 on CentOS 7.3. > > > > Any help would be greatly appreciated. > > Probably the default users group. Try: > > $ kinit admin > $ ipa config-show |grep 'Default users group' > > Can be changed using: > > $ ipa config-mod --defaultgroup ipausers > > You can probably do this in the UI as well but I'm a CLI guy. > > rob > > > --_000_wr5vefergmq3fe5uuk63b7cn1496427649570emailandroidcom_ > Content-Type: text/html; charset="us-ascii" > Content-Transfer-Encoding: quoted-printable > > <html> > <head> > <meta http-equiv=3D"Content-Type" content=3D"text/html; > charset=3Dus-ascii"= > > > </head> > <body> > <div>Look at automember rules.</div> > <div><br> > </div> > <div><br> > </div> > <div><br> > </div> > <div id=3D"composer_signature"> > <div dir=3D"auto" style=3D"font-size:88%; color:#364f67">Verzonden vanaf > mi= > jn Samsung-apparaat</div> > </div> > <br> > <br> > -------- Oorspronkelijk bericht --------<br> > Van: Devin Acosta via FreeIPA-users <freeipa-users@lists. > fedorahosted.or= > g> <br> > Datum: 02-06-17 20:13 (GMT+01:00) <br> > Aan: Rob Crittenden <rcritten(a)redhat.com> <br> > Cc: FreeIPA users list <freeipa-users(a)lists.fedorahosted.org>, > Devin = > Acosta <linuxguru.co(a)gmail.com> > <br> > Onderwerp: [Freeipa-users] Re: FreeIPA (adding all new users to admin > group= > by default?) > <br> > <br> > <div> > <div dir=3D"ltr"><br> > <div>Rob,</div> > <div><br> > </div> > <div>That is what confuses me, I show that the default users group is > &quot= > ;ipausers", however when I added an account which I just tested it > add= > ed to admins group.  Anything else that could be making it add it to > t= > he "admin" group?</div> > <div><br> > </div> > <div> > <div>[root@ipa01 ~]# ipa config-show</div> > <div>  Maximum username length: 32</div> > <div>  Home directory base: /home</div> > <div>  Default shell: /bin/bash</div> > <div><b>  Default users group: ipausers</b></div> > <div>  Default e-mail domain: m451.tech</div> > <div>  Search time limit: 2</div> > <div>  Search size limit: -1</div> > <div>  User search fields: uid,givenname,sn, > telephonenumber,ou,title</= > div> > <div>  Group search fields: cn,description</div> > <div>  Enable migration mode: FALSE</div> > <div>  Certificate Subject base: O=3DM451.TECH</div> > <div>  Password Expiration Notification (days): 4</div> > <div>  Password plugin features: AllowNThash</div> > <div>  SELinux user map order: guest_u:s0$xguest_u:s0$user_u: > s0$staff_= > u:s0-s0:c0.c1023$unconfined_u:s0-s0:c0.c1023</div> > <div>  Default SELinux user: unconfined_u:s0-s0:c0.c1023</div> > <div>  Default PAC types: nfs:NONE, MS-PAC</div> > </div> > <div><br> > </div> > <div> > <div>[root@ipa01 ~]# ipa user-add testuser-devin</div> > <div>First name: Devin</div> > <div>Last name: Acosta</div> > <div>---------------------------</div> > <div>Added user "testuser-devin"</div> > <div>---------------------------</div> > <div>  User login: testuser-devin</div> > <div>  First name: Devin</div> > <div>  Last name: Acosta</div> > <div>  Full name: Devin Acosta</div> > <div>  Display name: Devin Acosta</div> > <div>  Initials: DA</div> > <div>  Home directory: /home/testuser-devin</div> > <div>  GECOS: Devin Acosta</div> > <div>  Login shell: /bin/bash</div> > <div>  Principal name: testuser-devin(a)M451.TECH</div> > <div>  Principal alias: testuser-devin(a)M451.TECH</div> > <div>  Email address: testuser-devin(a)m451.tech</div> > <div>  UID: 34375527</div> > <div>  GID: 34375527</div> > <div>  Password: False</div> > <div>  <b>Member of groups: ipausers, admins</b></div> > <div>  Roles: IT Security Specialist, sec_netops2, helpdesk, IT > Specia= > list, User Administrator, Security Architect, ipa_join</div> > <div>  Indirect Member of role: ipa_join, helpdesk, IT Security > Specia= > list, sec_netops2, IT Specialist, Security Architect, User > Administrator</d= > iv> > <div>  Kerberos keys available: False</div> > </div> > </div> > <div class=3D"gmail_extra"><br> > <div class=3D"gmail_quote">On Fri, Jun 2, 2017 at 11:02 AM, Rob Crittenden > = > <span dir=3D"ltr"> > <<a href=3D"mailto:rcritten@redhat.com" target=3D"_blank">rcritten@ > redha= > t.com</a>></span> wrote:<br> > <blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex; > border-left:1= > px #ccc solid; padding-left:1ex"> > <span class=3D"">Devin Acosta via FreeIPA-users wrote:<br> > ><br> > > I am hoping to see if someone can tell me what I either need to > change= > <br> > > or update to get it so that FreeIPA doesn't automatically keep > adding<= > br> > > all new users that is created automatically to the admin group. I<br> > > inherited this installation of FreeIPA and so far haven't been able > to= > <br> > > figure out what either got changed or how to disable this behavior? I > = > am<br> > > running the latest FreeIPA 4.4 on CentOS 7.3.<br> > ><br> > > Any help would be greatly appreciated.<br> > <br> > </span>Probably the default users group. Try:<br> > <br> > $ kinit admin<br> > $ ipa config-show |grep 'Default users group'<br> > <br> > Can be changed using:<br> > <br> > $ ipa config-mod --defaultgroup ipausers<br> > <br> > You can probably do this in the UI as well but I'm a CLI guy.<br> > <span class=3D"HOEnZb"><font color=3D"#888888"><br> > rob<br> > </font></span></blockquote> > </div> > <br> > </div> > </div> > </body> > </html> > > --_000_wr5vefergmq3fe5uuk63b7cn1496427649570emailandroidcom_-- > > ------------------------------ > > Date: Fri, 2 Jun 2017 12:11:49 -0700 > From: Devin Acosta <linuxguru.co(a)gmail.com> > Subject: [Freeipa-users] Re: FreeIPA (adding all new users to admin > group by default?) > To: wouter.hummelink(a)kpn.com > Cc: FreeIPA users list <freeipa-users(a)lists.fedorahosted.org>, Rob > Crittenden <rcritten(a)redhat.com> > Message-ID: > <CAAqg8eOxyAvPVT_AZQ17GbNx_JisCay6L2167NJwie499n81ww@ > mail.gmail.com> > Content-Type: multipart/alternative; > boundary="f40304354dd0e22ee50550feec46" > > --f40304354dd0e22ee50550feec46 > Content-Type: text/plain; charset="UTF-8" > > Thanks, > > That was the problem. > > [root@ipa01 ~]# ipa automember-default-group-show > Grouping Type: group > Default (fallback) Group: cn=admins,cn=groups,cn= > accounts,dc=m451,dc=tech > [root@ipa01 ~] > > Removed that and problem has been fixed. > > Thanks much! > > On Fri, Jun 2, 2017 at 11:20 AM, <wouter.hummelink(a)kpn.com> wrote: > > > Look at automember rules. > > > > > > > > Verzonden vanaf mijn Samsung-apparaat > > > > > > -------- Oorspronkelijk bericht -------- > > Van: Devin Acosta via FreeIPA-users <freeipa-users@lists. > fedorahosted.org> > > > > Datum: 02-06-17 20:13 (GMT+01:00) > > Aan: Rob Crittenden <rcritten(a)redhat.com> > > Cc: FreeIPA users list <freeipa-users(a)lists.fedorahosted.org>, Devin > > Acosta <linuxguru.co(a)gmail.com> > > Onderwerp: [Freeipa-users] Re: FreeIPA (adding all new users to admin > > group by default?) > > > > > > Rob, > > > > That is what confuses me, I show that the default users group is > > "ipausers", however when I added an account which I just tested it added > to > > admins group. Anything else that could be making it add it to the > "admin" > > group? > > > > [root@ipa01 ~]# ipa config-show > > Maximum username length: 32 > > Home directory base: /home > > Default shell: /bin/bash > > * Default users group: ipausers* > > Default e-mail domain: m451.tech > > Search time limit: 2 > > Search size limit: -1 > > User search fields: uid,givenname,sn,telephonenumber,ou,title > > Group search fields: cn,description > > Enable migration mode: FALSE > > Certificate Subject base: O=M451.TECH > > Password Expiration Notification (days): 4 > > Password plugin features: AllowNThash > > SELinux user map order: guest_u:s0$xguest_u:s0$user_u: > > s0$staff_u:s0-s0:c0.c1023$unconfined_u:s0-s0:c0.c1023 > > Default SELinux user: unconfined_u:s0-s0:c0.c1023 > > Default PAC types: nfs:NONE, MS-PAC > > > > [root@ipa01 ~]# ipa user-add testuser-devin > > First name: Devin > > Last name: Acosta > > --------------------------- > > Added user "testuser-devin" > > --------------------------- > > User login: testuser-devin > > First name: Devin > > Last name: Acosta > > Full name: Devin Acosta > > Display name: Devin Acosta > > Initials: DA > > Home directory: /home/testuser-devin > > GECOS: Devin Acosta > > Login shell: /bin/bash > > Principal name: testuser-devin(a)M451.TECH > > Principal alias: testuser-devin(a)M451.TECH > > Email address: testuser-devin(a)m451.tech > > UID: 34375527 > > GID: 34375527 > > Password: False > > *Member of groups: ipausers, admins* > > Roles: IT Security Specialist, sec_netops2, helpdesk, IT Specialist, > > User Administrator, Security Architect, ipa_join > > Indirect Member of role: ipa_join, helpdesk, IT Security Specialist, > > sec_netops2, IT Specialist, Security Architect, User Administrator > > Kerberos keys available: False > > > > On Fri, Jun 2, 2017 at 11:02 AM, Rob Crittenden <rcritten(a)redhat.com> > > wrote: > > > >> Devin Acosta via FreeIPA-users wrote: > >> > > >> > I am hoping to see if someone can tell me what I either need to change > >> > or update to get it so that FreeIPA doesn't automatically keep adding > >> > all new users that is created automatically to the admin group. I > >> > inherited this installation of FreeIPA and so far haven't been able to > >> > figure out what either got changed or how to disable this behavior? I > am > >> > running the latest FreeIPA 4.4 on CentOS 7.3. > >> > > >> > Any help would be greatly appreciated. > >> > >> Probably the default users group. Try: > >> > >> $ kinit admin > >> $ ipa config-show |grep 'Default users group' > >> > >> Can be changed using: > >> > >> $ ipa config-mod --defaultgroup ipausers > >> > >> You can probably do this in the UI as well but I'm a CLI guy. > >> > >> rob > >> > > > > > > --f40304354dd0e22ee50550feec46 > Content-Type: text/html; charset="UTF-8" > Content-Transfer-Encoding: quoted-printable > > <div dir=3D"ltr"><div><br></div><div>Thanks,</div><div><br></div><div>That > = > was the problem.</div><div><br></div><div><div>[root@ipa01 ~]# ipa > automemb= > er-default-group-show</div><div>Grouping Type: group</div><div>=C2=A0 > Defau= > lt (fallback) Group: cn=3Dadmins,cn=3Dgroups,cn= > 3Daccounts,dc=3Dm451,dc=3Dt= > ech</div><div>[root@ipa01 ~]</div></div><div class=3D"gmail_extra"><br></ > di= > v><div class=3D"gmail_extra">Removed that and problem has been > fixed.</div>= > <div class=3D"gmail_extra"><br></div><div class=3D"gmail_extra">Thanks > much= > !</div><div class=3D"gmail_extra"><br><div class=3D"gmail_quote">On Fri, > Ju= > n 2, 2017 at 11:20 AM, <span dir=3D"ltr"><<a href=3D"mailto: > wouter.humm= > elink(a)kpn.com" target=3D"_blank">wouter.hummelink(a)kpn.com</a>></span> > wr= > ote:<br><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 > .8ex;border= > -left:1px #ccc solid;padding-left:1ex"> > > > > <div> > <div>Look at automember rules.</div> > <div><br> > </div> > <div><br> > </div> > <div><br> > </div> > <div id=3D"m_4874056557701448549composer_signature"> > <div dir=3D"auto" style=3D"font-size:88%;color:#364f67">Verzonden vanaf > mij= > n Samsung-apparaat</div> > </div> > <br> > <br> > -------- Oorspronkelijk bericht --------<br> > Van: Devin Acosta via FreeIPA-users <<a href=3D"mailto:freeipa-users@ > lis= > ts.fedorahosted.org" target=3D"_blank">freeipa-users@lists. > <wbr>fedorahoste= > d.org</a>> <br> > Datum: 02-06-17 20:13 (GMT+01:00) <br> > Aan: Rob Crittenden <<a href=3D"mailto:rcritten@redhat.com" > target=3D"_b= > lank">rcritten(a)redhat.com</a>> <br> > Cc: FreeIPA users list <<a href=3D"mailto:freeipa-users@ > lists.fedorahost= > ed.org" target=3D"_blank">freeipa-users@lists.<wbr>fedorahosted.org > </a>>= > , Devin Acosta <<a href=3D"mailto:linuxguru.co@gmail.com" > target=3D"_bla= > nk">linuxguru.co(a)gmail.com</a>> > <br> > Onderwerp: [Freeipa-users] Re: FreeIPA (adding all new users to admin > group= > by default?) > <br><div><div class=3D"h5"> > <br> > <div> > <div dir=3D"ltr"><br> > <div>Rob,</div> > <div><br> > </div> > <div>That is what confuses me, I show that the default users group is > &quot= > ;ipausers", however when I added an account which I just tested it > add= > ed to admins group.=C2=A0 Anything else that could be making it add it to > t= > he "admin" group?</div> > <div><br> > </div> > <div> > <div>[root@ipa01 ~]# ipa config-show</div> > <div>=C2=A0 Maximum username length: 32</div> > <div>=C2=A0 Home directory base: /home</div> > <div>=C2=A0 Default shell: /bin/bash</div> > <div><b>=C2=A0 Default users group: ipausers</b></div> > <div>=C2=A0 Default e-mail domain: m451.tech</div> > <div>=C2=A0 Search time limit: 2</div> > <div>=C2=A0 Search size limit: -1</div> > <div>=C2=A0 User search fields: uid,givenname,sn,<wbr> > telephonenumber,ou,ti= > tle</div> > <div>=C2=A0 Group search fields: cn,description</div> > <div>=C2=A0 Enable migration mode: FALSE</div> > <div>=C2=A0 Certificate Subject base: O=3DM451.TECH</div> > <div>=C2=A0 Password Expiration Notification (days): 4</div> > <div>=C2=A0 Password plugin features: AllowNThash</div> > <div>=C2=A0 SELinux user map order: guest_u:s0$xguest_u:s0$user_u: > <wbr>s0$s= > taff_u:s0-s0:c0.c1023$<wbr>unconfined_u:s0-s0:c0.c1023</div> > <div>=C2=A0 Default SELinux user: unconfined_u:s0-s0:c0.c1023</div> > <div>=C2=A0 Default PAC types: nfs:NONE, MS-PAC</div> > </div> > <div><br> > </div> > <div> > <div>[root@ipa01 ~]# ipa user-add testuser-devin</div> > <div>First name: Devin</div> > <div>Last name: Acosta</div> > <div>---------------------------</div> > <div>Added user "testuser-devin"</div> > <div>---------------------------</div> > <div>=C2=A0 User login: testuser-devin</div> > <div>=C2=A0 First name: Devin</div> > <div>=C2=A0 Last name: Acosta</div> > <div>=C2=A0 Full name: Devin Acosta</div> > <div>=C2=A0 Display name: Devin Acosta</div> > <div>=C2=A0 Initials: DA</div> > <div>=C2=A0 Home directory: /home/testuser-devin</div> > <div>=C2=A0 GECOS: Devin Acosta</div> > <div>=C2=A0 Login shell: /bin/bash</div> > <div>=C2=A0 Principal name: testuser-devin(a)M451.TECH</div> > <div>=C2=A0 Principal alias: testuser-devin(a)M451.TECH</div> > <div>=C2=A0 Email address: testuser-devin(a)m451.tech</div> > <div>=C2=A0 UID: 34375527</div> > <div>=C2=A0 GID: 34375527</div> > <div>=C2=A0 Password: False</div> > <div>=C2=A0 <b>Member of groups: ipausers, admins</b></div> > <div>=C2=A0 Roles: IT Security Specialist, sec_netops2, helpdesk, IT > Specia= > list, User Administrator, Security Architect, ipa_join</div> > <div>=C2=A0 Indirect Member of role: ipa_join, helpdesk, IT Security > Specia= > list, sec_netops2, IT Specialist, Security Architect, User > Administrator</d= > iv> > <div>=C2=A0 Kerberos keys available: False</div> > </div> > </div> > <div class=3D"gmail_extra"><br> > <div class=3D"gmail_quote">On Fri, Jun 2, 2017 at 11:02 AM, Rob Crittenden > = > <span dir=3D"ltr"> > <<a href=3D"mailto:rcritten@redhat.com" target=3D"_blank">rcritten@ > redha= > t.com</a>></span> wrote:<br> > <blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 > .8ex;border-left:1p= > x #ccc solid;padding-left:1ex"> > <span>Devin Acosta via FreeIPA-users wrote:<br> > ><br> > > I am hoping to see if someone can tell me what I either need to > change= > <br> > > or update to get it so that FreeIPA doesn't automatically keep > add= > ing<br> > > all new users that is created automatically to the admin group. I<br> > > inherited this installation of FreeIPA and so far haven't been > abl= > e to<br> > > figure out what either got changed or how to disable this behavior? I > = > am<br> > > running the latest FreeIPA 4.4 on CentOS 7.3.<br> > ><br> > > Any help would be greatly appreciated.<br> > <br> > </span>Probably the default users group. Try:<br> > <br> > $ kinit admin<br> > $ ipa config-show |grep 'Default users group'<br> > <br> > Can be changed using:<br> > <br> > $ ipa config-mod --defaultgroup ipausers<br> > <br> > You can probably do this in the UI as well but I'm a CLI guy.<br> > <span class=3D"m_4874056557701448549HOEnZb"><font color=3D"#888888"><br> > rob<br> > </font></span></blockquote> > </div> > <br> > </div> > </div> > </div></div></div> > > </blockquote></div><br></div></div> > > --f40304354dd0e22ee50550feec46-- > > ------------------------------ > > Date: Fri, 2 Jun 2017 15:22:05 -0400 > From: Adrian HY <ayeja153(a)gmail.com> > Subject: [Freeipa-users] export users to new freeipa server > To: freeipa-users(a)lists.fedorahosted.org > Message-ID: > <CAOito+X7U2W7SNZ6Ga2z__rnRrc3gWLO=uJXdcPDpmdun369jQ@ > mail.gmail.com> > Content-Type: multipart/alternative; > boundary="94eb2c1cf3bc99d4320550ff1182" > > --94eb2c1cf3bc99d4320550ff1182 > Content-Type: text/plain; charset="UTF-8" > > Hi, I need to export an existing user from a freeipa server to another > server, including password. Regards. > > --94eb2c1cf3bc99d4320550ff1182 > Content-Type: text/html; charset="UTF-8" > Content-Transfer-Encoding: quoted-printable > > <div dir=3D"ltr">Hi, I need to export an existing user from a freeipa > serve= > r to another server, including password. Regards.=C2=A0</div> > > --94eb2c1cf3bc99d4320550ff1182-- > > ------------------------------ > > Date: Fri, 2 Jun 2017 15:27:01 -0400 > From: Striker Leggette <striker(a)terranforge.com> > Subject: [Freeipa-users] Re: export users to new freeipa server > To: FreeIPA users list <freeipa-users(a)lists.fedorahosted.org> > Cc: Adrian HY <ayeja153(a)gmail.com> > Message-ID: <9f513bc5-feae-c245-73b8-bafa003d1c79(a)terranforge.com> > Content-Type: multipart/alternative; > boundary="------------986A2380EEA4C56C02FC2CA9" > > This is a multi-part message in MIME format. > --------------986A2380EEA4C56C02FC2CA9 > Content-Type: text/plain; charset=utf-8; format=flowed > Content-Transfer-Encoding: 7bit > > We have documentation that might help: > > https://www.freeipa.org/page/V4/FreeIPA_to_FreeIPA_Migration > > Is this what you need? > > > On 06/02/2017 03:22 PM, Adrian HY via FreeIPA-users wrote: > > Hi, I need to export an existing user from a freeipa server to another > > server, including password. Regards. > > > > > > _______________________________________________ > > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org > > To unsubscribe send an email to freeipa-users-leave@lists. > fedorahosted.org > > > --------------986A2380EEA4C56C02FC2CA9 > Content-Type: text/html; charset=utf-8 > Content-Transfer-Encoding: quoted-printable > > <html> > <head> > <meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Dutf= > -8"> > </head> > <body text=3D"#000000" bgcolor=3D"#FFFFFF"> > <p><font size=3D"-1"><tt>We have documentation that might help:</tt><= > /font></p> > <p><font size=3D"-1"><tt><a class=3D"moz-txt-link-freetext" href=3D"h= > ttps://www.freeipa.org/page/V4/FreeIPA_to_FreeIPA_Migration">https://www.= > freeipa.org/page/V4/FreeIPA_to_FreeIPA_Migration</a></tt></font></p> > <p><font size=3D"-1"><tt>Is this what you need?</tt></font><br> > </p> > <br> > <div class=3D"moz-cite-prefix">On 06/02/2017 03:22 PM, Adrian HY via > FreeIPA-users wrote:<br> > </div> > <blockquote type=3D"cite" > cite=3D"mid:CAOito+X7U2W7SNZ6Ga2z__rnRrc3gWLO=3DuJXdcPDpmdun369jQ@mail.gm= > ail.com"> > <div dir=3D"ltr">Hi, I need to export an existing user from a > freeipa server to another server, including password. Regards.=C2= > =A0</div> > <br> > <fieldset class=3D"mimeAttachmentHeader"></fieldset> > <br> > <pre wrap=3D"">_______________________________________________ > FreeIPA-users mailing list -- <a class=3D"moz-txt-link-abbreviated" > href=3D= > "mailto:freeipa-users@lists.fedorahosted.org">freeipa-users(a)lists.fedorah= > osted.org</a> > To unsubscribe send an email to <a class=3D"moz-txt-link-abbreviated" hre= > f=3D"mailto:freeipa-users-leave@lists.fedorahosted.org">freeipa-users-lea= > ve(a)lists.fedorahosted.org</a> > </pre> > </blockquote> > <br> > </body> > </html> > > --------------986A2380EEA4C56C02FC2CA9-- > > ------------------------------ > > Date: Fri, 2 Jun 2017 14:05:34 -0600 > From: Frank Rey <frank.ray.reynoldsiii(a)gmail.com> > Subject: [Freeipa-users] Scripting a SSSD client to add SID to > UIDnumbers from ad Trust into custom LDAP schema. > To: freeipa-users(a)lists.fedorahosted.org > Message-ID: > <CAHzNX24x5MiqoY4_VLrOQ3h8FpVjOb3ES_SB8ehxVEgecEMgTA(a)mail.gmail. > com> > Content-Type: multipart/alternative; > boundary="001a113f022a1895390550ffad8d" > > --001a113f022a1895390550ffad8d > Content-Type: text/plain; charset="UTF-8" > > I have a Netapp that does not support SSSD or Windbind and i want to use > IDM ldap to do permission/name mapping. would using a Script on a SSSD > client to populate a custom ldap schema in IPA with the SSSD uidnumber > mappings be a bad idea? I know i would have to set up a cron job to run it > at a reasonable interval. set it up to create and remove users added or > removed from the Posix group i have mapped from the AD trust. > > Ray > > --001a113f022a1895390550ffad8d > Content-Type: text/html; charset="UTF-8" > Content-Transfer-Encoding: quoted-printable > > <div dir=3D"ltr"><div class=3D"gmail_quote"><br><div dir=3D"ltr"><div>I > hav= > e a Netapp that does not support SSSD or Windbind and i want to use IDM > lda= > p to do permission/name mapping. would using a Script on a SSSD client to > p= > opulate a custom ldap schema in IPA with the SSSD uidnumber mappings be a > b= > ad idea? I know i would have to set up a cron job to run it at a > reasonable= > interval. set it up to create and remove users added or removed from the > P= > osix group i have mapped from the AD trust. =C2=A0</div><br > clear=3D"all"><= > div><div class=3D"m_1675926449220289611gmail_signature" > data-smartmail=3D"g= > mail_signature"><div dir=3D"ltr"><div dir=3D"ltr">Ray<br><div><br></ > div></d= > iv></div></div></div> > </div> > </div><br></div> > > --001a113f022a1895390550ffad8d-- > > ------------------------------ > > Date: Fri, 2 Jun 2017 20:52:54 -0400 > From: Brendan Kearney <bpk678(a)gmail.com> > Subject: [Freeipa-users] Re: FreeIPA for simply managing DNS > To: freeipa-users(a)lists.fedorahosted.org > Message-ID: <baf1caf4-0291-8b1a-86b9-f87d011db019(a)gmail.com> > Content-Type: multipart/alternative; > boundary="------------403C6276125A532E124ED5A0" > > This is a multi-part message in MIME format. > --------------403C6276125A532E124ED5A0 > Content-Type: text/plain; charset=utf-8; format=flowed > Content-Transfer-Encoding: 7bit > > On 06/02/2017 01:10 PM, Striker Leggette via FreeIPA-users wrote: > > > > FreeIPA has a very well-made and easy to use DNS management GUI that > > would serve well as a standalone tool. Are there any plans to fork > > the DNS GUI like this for those who would like an easy DNS management > > application who do not necessarily need LDAP/PKI/Kerberos/etc.? > > > > -- > > Striker Leggette > > Identity Management > > > > linkedin.com/in/striker > > > > > > _______________________________________________ > > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org > > To unsubscribe send an email to freeipa-users-leave@lists. > fedorahosted.org > > why not look at ISC BIND with bind-dyndb-ldap. i am using it, managing > BIND zone data in my OpenLDAP directory. > > > --------------403C6276125A532E124ED5A0 > Content-Type: text/html; charset=utf-8 > Content-Transfer-Encoding: quoted-printable > > <html> > <head> > <meta content=3D"text/html; charset=3Dutf-8" http-equiv=3D"Content-Ty= > pe"> > </head> > <body bgcolor=3D"#FFFFFF" text=3D"#000000"> > <div class=3D"moz-cite-prefix">On 06/02/2017 01:10 PM, Striker > Leggette via FreeIPA-users wrote:<br> > </div> > <blockquote > cite=3D"mid:6f3803ff-6052-5f3a-3b57-b63d4b51f786@terranforge.com" > type=3D"cite"> > <meta http-equiv=3D"content-type" content=3D"text/html; charset=3Du= > tf-8"> > <p><tt><font size=3D"-1">FreeIPA has a very well-made and easy to > use DNS management GUI that would serve well as a standalone > tool.=C2=A0 Are there any plans to fork the DNS GUI like this= > for > those who would like an easy DNS management application who > do not necessarily need LDAP/PKI/Kerberos/etc.?</font></tt><b= > r> > </p> > <pre class=3D"moz-signature" cols=3D"72">--=20 > Striker Leggette > Identity Management > > linkedin.com/in/striker</pre> > <br> > <fieldset class=3D"mimeAttachmentHeader"></fieldset> > <br> > <pre wrap=3D"">_______________________________________________ > FreeIPA-users mailing list -- <a class=3D"moz-txt-link-abbreviated" > href=3D= > "mailto:freeipa-users@lists.fedorahosted.org">freeipa-users(a)lists.fedorah= > osted.org</a> > To unsubscribe send an email to <a class=3D"moz-txt-link-abbreviated" hre= > f=3D"mailto:freeipa-users-leave@lists.fedorahosted.org">freeipa-users-lea= > ve(a)lists.fedorahosted.org</a> > </pre> > </blockquote> > <p>why not look at ISC BIND with bind-dyndb-ldap.=C2=A0 i am using it= > , > managing BIND zone data in my OpenLDAP directory.<br> > </p> > </body> > </html> > > --------------403C6276125A532E124ED5A0-- > > ------------------------------ > > Subject: Digest Footer > > _______________________________________________ > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org > To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org > > > ------------------------------ > > End of FreeIPA-users Digest, Vol 2, Issue 2 > ******************************************* > -- Chris Scutcher E-Mail :: chris(a)scutcher.co.uk Web :: http://chris.scutcher.co.uk Phone:: +447743186526

1 0

Re: certificate has expired?
by Rob Crittenden 08 Jun '17

08 Jun '17

Adding freeipa-users back. Roberto Cornacchia wrote: > Just to confirm, this is indeed the expired certificate > > $ getcert list -d /etc/httpd/alias -n Server-Cert > Number of certificates and requests being tracked: 8. > Request ID '20150316184529': > status: CA_UNREACHABLE > ca-error: Error setting up ccache for "host" service on client using > default keytab: Cannot contact any KDC for requested realm. > stuck: no > key pair storage: > type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS > Certificate DB',pinfile='/etc/httpd/alias/pwdfile.txt' > certificate: > type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS > Certificate DB' > CA: IPA > issuer: CN=Certificate Authority,O=HQ.SPINQUE.COM <http://HQ.SPINQUE.COM> > subject: CN=spinque04.hq.spinque.com > <http://spinque04.hq.spinque.com>,O=HQ.SPINQUE.COM <http://HQ.SPINQUE.COM> > expires: 2017-03-16 18:45:29 UTC > key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment > eku: id-kp-serverAuth,id-kp-clientAuth > pre-save command: > post-save command: /usr/lib64/ipa/certmonger/restart_httpd > track: yes > auto-renew: yes Since you have Apache up and limping along I'd first try: # getcert resubmit -i 20150316184529 It is very possible that the tool will reject the server cert since it is expired. If that happens then you'll need to set time back. I'd encourage you to run: getcert list | grep expires This will show you what certs need to be renewed and should give some insight into the window of opportunity for setting the date back. Assuming it's just the Apache cert that is expired I'd try setting the date back to March 15, restart IPA, then I'd restart certmonger or try the about resubmit command again. Things can get tricky when some certs have renewed and some haven't. rob > > > On Wed, 7 Jun 2017 at 15:36 Roberto Cornacchia > <roberto.cornacchia(a)gmail.com <mailto:roberto.cornacchia@gmail.com>> wrote: > > Thanks Rob, > > I've seen in similar posts that you recommend to go back in time and > restart certmonger. Would it work in this case? > > > On Wed, 7 Jun 2017 at 15:30 Rob Crittenden <rcritten(a)redhat.com > <mailto:rcritten@redhat.com>> wrote: > > Roberto Cornacchia via FreeIPA-users wrote: > > OK, I did so and httpd restarts. > > > > $ openssl s_client -connect 127.0.0.1:443 > <http://127.0.0.1:443> <http://127.0.0.1:443> -showcerts > > CONNECTED(00000003) > > depth=1 O = HQ.SPINQUE.COM <http://HQ.SPINQUE.COM> > <http://HQ.SPINQUE.COM>, CN = Certificate > > Authority > > verify return:1 > > depth=0 O = HQ.SPINQUE.COM <http://HQ.SPINQUE.COM> > <http://HQ.SPINQUE.COM>, CN = > > spinque04.hq.spinque.com <http://spinque04.hq.spinque.com> > <http://spinque04.hq.spinque.com> > > verify error:num=10:certificate has expired > > notAfter=Mar 16 18:45:29 2017 GMT > > verify return:1 > > depth=0 O = HQ.SPINQUE.COM <http://HQ.SPINQUE.COM> > <http://HQ.SPINQUE.COM>, CN = > > spinque04.hq.spinque.com <http://spinque04.hq.spinque.com> > <http://spinque04.hq.spinque.com> > > notAfter=Mar 16 18:45:29 2017 GMT > > verify return:1 > > --- > > Certificate chain > > 0 s:/O=HQ.SPINQUE.COM/CN=spinque04.hq.spinque.com > <http://HQ.SPINQUE.COM/CN=spinque04.hq.spinque.com> > > <http://HQ.SPINQUE.COM/CN=spinque04.hq.spinque.com> > > i:/O=HQ.SPINQUE.COM/CN=Certificate > <http://HQ.SPINQUE.COM/CN=Certificate> > > <http://HQ.SPINQUE.COM/CN=Certificate> Authority > > ... > > > > Fair enough, but why does this say it expires in 2019? Are > they two > > different certificates? > > > > $ getcert list -d /etc/httpd/alias -n ipaCert > > Number of certificates and requests being tracked: 8. > > Request ID '20160501114633': > > status: MONITORING > > stuck: no > > key pair storage: > > > type=NSSDB,location='/etc/httpd/alias',nickname='ipaCert',token='NSS > > Certificate DB',pinfile='/etc/httpd/alias/pwdfile.txt' > > certificate: > > > type=NSSDB,location='/etc/httpd/alias',nickname='ipaCert',token='NSS > > Certificate DB' > > CA: dogtag-ipa-ca-renew-agent > > issuer: CN=Certificate Authority,O=HQ.SPINQUE.COM > <http://HQ.SPINQUE.COM> <http://HQ.SPINQUE.COM> > > subject: CN=IPA RA,O=HQ.SPINQUE.COM <http://HQ.SPINQUE.COM> > <http://HQ.SPINQUE.COM> > > expires: 2019-01-26 19:41:51 UTC > > key usage: > digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment > > eku: id-kp-serverAuth,id-kp-clientAuth > > pre-save command: /usr/lib64/ipa/certmonger/renew_ra_cert_pre > > post-save command: /usr/lib64/ipa/certmonger/renew_ra_cert > > track: yes > > auto-renew: yes > > > > What's the right way to solve this? > > You're looking at the wrong cert. > > # getcert list -d /etc/httpd/alias -n Server-Cert > > And really, you should examine all certificate status, not just > a single > one. > > I was also strongly urge you to wait until all problems are resolved > before attempting to update packages in the future (unless a package > claims to fix a specific problem), particularly when it comes to > certificates. > > rob >

3 6

Reminder: Southeast Linux Fest 2017
by Striker Leggette 07 Jun '17

07 Jun '17

Hi all, This is a reminder of the upcoming Linux Fest this weekend (June 9th to the 11th). We will have two folks manning a table for FreeIPA, showing off features and spreading the good word while answering questions from the audience. If you're in the area, feel free to stop by. 3315 Scott Futrell Dr, Charlotte, NC 28208 -- Striker Leggette Red Hat Identity Management linkedin.com/in/striker

1 0

Unable to communicate with CMS
by John Bowman 07 Jun '17

07 Jun '17

I'm hoping this is a firewall issue but I figured I would check just in case I'm looking in the wrong direction. I setup a pair non-CA replicas today and as far as I could tell everything seemed to be okay but I noticed that when searching via the web ui on the new replicas it would take 2 minutes to return information. I the logs I noticed this time out error which is what I assumed was the culprit: [Wed Jun 07 14:48:31.155444 2017] [:error] [pid 14384] ipa: ERROR: ra.find(): Unable to communicate with CMS ([Errno 110] Connection timed out) I can see in tcpdump connections over ldap and 8080 which should be open between the two and I wanted to verify if there should be any other ports open that aren't covered in the install instructions or maybe something I missed (7389 perhaps because its 4.x to 3.x communication). Also I was hoping to cut down traffic across the network since the new servers are in the EU and the old ones are in the US. Are there any tips/instructions on doing something like this if its even possible? # firewall-cmd --zone=public --list-all public (active) target: default icmp-block-inversion: no interfaces: ens224 sources: services: dns http https kerberos kpasswd ldap ldaps ntp snmp ssh Thanks! -- John Bowman

2 2

certificate has expired?
by Roberto Cornacchia 07 Jun '17

07 Jun '17

Not being able to login to the admin console, I checked the httpd log and found the following errors: [Wed Jun 07 12:50:59.352022 2017] [:error] [pid 10240] Unable to verify certificate 'Server-Cert'. Add "NSSEnforceValidCerts off" to nss.conf so the server can start until the problem can be resolved. [Wed Jun 07 12:50:59.353372 2017] [:error] [pid 10237] SSL Library Error: -8181 Certificate has expired [Wed Jun 07 12:50:59.353395 2017] [:error] [pid 10237] Unable to verify certificate 'Server-Cert'. Add "NSSEnforceValidCerts off" to nss.conf so the server can start until the problem can be resolved. [Wed Jun 07 12:50:59.986025 2017] [core:error] [pid 11522] AH00546: no record of generation 47 of exiting child 10203 I also get an error during enrollment of a new client (which seems to retrieve a valid certificate anyway): Password for admin(a)HQ.SPINQUE.COM: Successfully retrieved CA cert Subject: CN=Certificate Authority,O=HQ.SPINQUE.COM Issuer: CN=Certificate Authority,O=HQ.SPINQUE.COM Valid From: Mon Mar 16 18:44:35 2015 UTC Valid Until: Fri Mar 16 18:44:35 2035 UTC Joining realm failed: libcurl failed to execute the HTTP POST transaction, explaining: TCP connection reset by peer Services are up: $ ipactl status Directory Service: RUNNING krb5kdc Service: RUNNING kadmin Service: RUNNING named Service: RUNNING ipa_memcached Service: RUNNING httpd Service: RUNNING pki-tomcatd Service: RUNNING ipa-otpd Service: RUNNING ipa-dnskeysyncd Service: RUNNING ipa: INFO: The ipactl command was successful Certificate monitoring seems ok: $ getcert list -d /etc/httpd/alias -n ipaCert Number of certificates and requests being tracked: 8. Request ID '20160501114633': status: MONITORING stuck: no key pair storage: type=NSSDB,location='/etc/httpd/alias',nickname='ipaCert',token='NSS Certificate DB',pinfile='/etc/httpd/alias/pwdfile.txt' certificate: type=NSSDB,location='/etc/httpd/alias',nickname='ipaCert',token='NSS Certificate DB' CA: dogtag-ipa-ca-renew-agent issuer: CN=Certificate Authority,O=HQ.SPINQUE.COM subject: CN=IPA RA,O=HQ.SPINQUE.COM expires: 2019-01-26 19:41:51 UTC key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment eku: id-kp-serverAuth,id-kp-clientAuth pre-save command: /usr/lib64/ipa/certmonger/renew_ra_cert_pre post-save command: /usr/lib64/ipa/certmonger/renew_ra_cert track: yes auto-renew: yes Version: $ ipa --version VERSION: 4.4.3, API_VERSION: 2.215 Could you please point me at what else to check?

3 6

IPA-clients fail to update DNS: "response to GSS-TSIG query was unsuccessful"
by Josh Pavel 07 Jun '17

07 Jun '17

I have a setup with 2 zones: My IPA realm is mob.nuance.com My first IPA server was built out with the DNS zone prod.mcs.som.mob.nuance.com My second IPA server is in a DNS zone of dev.mcs.az-eastus2.mob.nuance.com I can successfully add client to my first IPA server, and everything works as expected, including DNS updates. When I add clients to my second IPA server, they complete successfully for everything except updating DNS. I recreated the DNS Update file from ipa-client install log, and executed it manually as "admin" with debug. Any ideas what is wrong? # kinit admin Password for admin(a)MOB.NUANCE.COM: # id admin uid=1294000000(admin) gid=1294000000(admins) groups=1294000000(admins) # getent passwd admin admin:*:1294000000:1294000000:Administrator:/home/admin:/bin/bash # kinit -k # klist Ticket cache: KEYRING:persistent:0:krb_ccache_3k4KdJI Default principal: host/ metrics-frontend-01.dev.mcs.az-eastus2.mob.nuance.com(a)MOB.NUANCE.COM Valid starting Expires Service principal 06/05/2017 18:11:39 06/06/2017 18:11:39 krbtgt/ MOB.NUANCE.COM(a)MOB.NUANCE.COM # nsupdate -v -g ./dns_update.txt Outgoing update query: ;; ->>HEADER<<- opcode: UPDATE, status: NOERROR, id: 0 ;; flags:; ZONE: 0, PREREQ: 0, UPDATE: 0, ADDITIONAL: 0 ;; UPDATE SECTION: metrics-frontend-01.dev.mcs.az-eastus2.mob.nuance.com. 0 ANY A Reply from SOA query: ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 58840 ;; flags: qr aa rd ra; QUESTION: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0 ;; QUESTION SECTION: ;metrics-frontend-01.dev.mcs.az-eastus2.mob.nuance.com. IN SOA ;; AUTHORITY SECTION: dev.mcs.az-eastus2.mob.nuance.com. 0 IN SOA freeipa-01.dev.mcs.az-eastus2.mob.nuance.com. hostmaster.dev.mcs.az-eastus2.mob.nuance.com. 1496548206 3600 900 1209600 3600 Found zone name: dev.mcs.az-eastus2.mob.nuance.com The master is: freeipa-01.dev.mcs.az-eastus2.mob.nuance.com start_gssrequest send_gssrequest Outgoing update query: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 14301 ;; flags:; QUESTION: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1 ;; QUESTION SECTION: ;2603545440.sig-freeipa-01.dev.mcs.az-eastus2.mob.nuance.com. ANY TKEY ;; ADDITIONAL SECTION: 2603545440.sig-freeipa-01.dev.mcs.az-eastus2.mob.nuance.com. 0 ANY TKEY gss-tsig. 1496686456 1496686456 3 NOERROR 750 YIIC6gYJKoZIhvcSAQICAQBuggLZMIIC1aADAgEFoQMCAQ6iBwMFACAA AACjggGyYYIBrjCCAaqgAwIBBaEQGw5NT0IuTlVBTkNFLkNPTaI+MDyg AwIBA6E1MDMbA0ROUxssZnJlZWlwYS0wMS5kZXYubWNzLmF6LWVhc3R1 czIubW9iLm51YW5jZS5jb22jggFPMIIBS6ADAgESoQMCAQKiggE9BIIB OT6iIBKUylVkyZojuFesiyK9xr2TNsJcCxjHSKxRxDTI781ECObVev0r 5FEux+izbNYji5vEZpfZDela6vLLJuieQ7EUz02jEMU9lvkhfuiaA9w8 UGLjT+l7TsKLLa6O+gnZ9bLWoTeR++QTE3g/5ePKCLd5rv/h3fvsHoW9 MxUD896pNNYCSutwm9Q6WigpMabxz4oli2l2YpbABJGEk6ZOB3Dr65m6 j4ou1LCnJpy0pkCwQfNPqPtF6UXUiL7DBvZfDhr+MlOeH7o0EBmUEiy2 uNIj9D6VaXeThLBMzyOeZRAVgutqSGxCiBraZ2hVGCQ5Xdet2XuJtUMq gZEn7uS6B8d5iIRDhsiOZ2eGUfZqReXaoE9YFBROvvyn0tosoqwW7YUZ 1Yc6gItyh2p7T8s3VBu1H4K8+vSkggEIMIIBBKADAgESooH8BIH56H4C tKcmdKBDujhBN3UmWECEm1stlWq1CcmSqtYmU6LpWa2duyX4rUDHfHVC 1eHhxrWB9mdEb3DKPHiJrJ0vLOuKJprPFEJpf/RGJylnglPs0JCf0Caa dGZpgeXCQ10xNIdKFsxzcgSChF5ClYK5A+Axg8zxVnLnNKCLR3TGdMrJ +YIOe04oHl4SdREVP09IrtubcOZSJeG3lRt4v/NHHuSMXXb337y/7ErU 1/8YoSs1K3H9du22vLF2VxB8k70DDtDKKpYFj1PzNXD5Tk7yuuWb//Ze voVsTc9g86212KzDYOfDdaN5JM2j51R/O/ummcYw8GnqR5Kt 0 recvmsg reply from GSS-TSIG query ;; ->>HEADER<<- opcode: QUERY, status: REFUSED, id: 14301 ;; flags: qr ra; QUESTION: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0 ;; QUESTION SECTION: ;2603545440.sig-freeipa-01.dev.mcs.az-eastus2.mob.nuance.com. ANY TKEY *response to GSS-TSIG query was unsuccessful*

2 5

certificate has expired?
by Roberto Cornacchia 07 Jun '17

07 Jun '17

Not being able to login to the admin console, I checked the httpd log and found the following errors: [Wed Jun 07 12:50:59.352022 2017] [:error] [pid 10240] Unable to verify certificate 'Server-Cert'. Add "NSSEnforceValidCerts off" to nss.conf so the server can start until the problem can be resolved. [Wed Jun 07 12:50:59.353372 2017] [:error] [pid 10237] SSL Library Error: -8181 Certificate has expired [Wed Jun 07 12:50:59.353395 2017] [:error] [pid 10237] Unable to verify certificate 'Server-Cert'. Add "NSSEnforceValidCerts off" to nss.conf so the server can start until the problem can be resolved. [Wed Jun 07 12:50:59.986025 2017] [core:error] [pid 11522] AH00546: no record of generation 47 of exiting child 10203 I also get an error during enrollment of a new client (which seems to retrieve a valid certificate anyway): Password for admin(a)HQ.SPINQUE.COM: Successfully retrieved CA cert Subject: CN=Certificate Authority,O=HQ.SPINQUE.COM Issuer: CN=Certificate Authority,O=HQ.SPINQUE.COM Valid From: Mon Mar 16 18:44:35 2015 UTC Valid Until: Fri Mar 16 18:44:35 2035 UTC Joining realm failed: libcurl failed to execute the HTTP POST transaction, explaining: TCP connection reset by peer Services are up: $ ipactl status Directory Service: RUNNING krb5kdc Service: RUNNING kadmin Service: RUNNING named Service: RUNNING ipa_memcached Service: RUNNING httpd Service: RUNNING pki-tomcatd Service: RUNNING ipa-otpd Service: RUNNING ipa-dnskeysyncd Service: RUNNING ipa: INFO: The ipactl command was successful Certificate monitoring seems ok: $ getcert list -d /etc/httpd/alias -n ipaCert Number of certificates and requests being tracked: 8. Request ID '20160501114633': status: MONITORING stuck: no key pair storage: type=NSSDB,location='/etc/httpd/alias',nickname='ipaCert',token='NSS Certificate DB',pinfile='/etc/httpd/alias/pwdfile.txt' certificate: type=NSSDB,location='/etc/httpd/alias',nickname='ipaCert',token='NSS Certificate DB' CA: dogtag-ipa-ca-renew-agent issuer: CN=Certificate Authority,O=HQ.SPINQUE.COM subject: CN=IPA RA,O=HQ.SPINQUE.COM expires: 2019-01-26 19:41:51 UTC key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment eku: id-kp-serverAuth,id-kp-clientAuth pre-save command: /usr/lib64/ipa/certmonger/renew_ra_cert_pre post-save command: /usr/lib64/ipa/certmonger/renew_ra_cert track: yes auto-renew: yes Version: $ ipa --version VERSION: 4.4.3, API_VERSION: 2.215 Could you please point me at what else to check?

1 0

keytab usage?
by Kat 06 Jun '17

06 Jun '17

Ok, I guess I am not understanding something here. What am I missing? The PW is correct, but no matter what I do, I can't use the keytab file for a user as shown below: [root@ipa ~]# ktutil ktutil: addent -password -p cyberj(a)EXAMPLE.COM -k 1 -e aes256-cts-hmac-sha1-96 Password for cyberj(a)EXAMPLE.COM: ktutil: wkt /root/cyberj.keytab ktutil: q [root@ipa ~]# kinit -k -t cyberj.keytab cyberj(a)EXAMPLE.COM kinit: Password incorrect while getting initial credentials :-( -K

4 4

Scripting a SSSD client to add SIDtoUIDnumbers from ad Trust into custom LDAP schema.
by Frank Rey 06 Jun '17

06 Jun '17

I have a Netapp that does not support SSSD or Windbind and i want to use IDM ldap to do permission/name mapping. would using a Script on a SSSD client to populate a custom ldap schema in IPA with the SSSD uidnumber mappings be a bad idea? I know i would have to set up a cron job to run it at a reasonable interval. set it up to create and remove users added or removed from the Posix group i have mapped from the AD trust. Am i missing anything? Ray

2 2

Scripting a SSSD client to add SID to UIDnumbers from ad Trust into custom LDAP schema.
by Frank Rey 05 Jun '17

05 Jun '17

I have a Netapp that does not support SSSD or Windbind and i want to use IDM ldap to do permission/name mapping. would using a Script on a SSSD client to populate a custom ldap schema in IPA with the SSSD uidnumber mappings be a bad idea? I know i would have to set up a cron job to run it at a reasonable interval. set it up to create and remove users added or removed from the Posix group i have mapped from the AD trust. Ray

2 2

status of auditd integration on freeipa clients
by Sven Kieske 05 Jun '17

05 Jun '17

Hi, I got a question regarding integration of auditd on freeipa clients. What I want to achieve is full audit logging, like auditd provides, on the freeipa clients. we tried to hook auditd up with the currently deployed ipa via kerberos, but had no luck so far. we tried to reuse the already present kerberos authentication to transmit the auditdata in a secure way, but auditd needs the principal name to be "host/$hostname@REALM" whereas freeipa requires "$foo/$fqdn@REALM", so it seems we can't use kerberos tickets from ipa? (see also this ML Thread: https://www.redhat.com/archives/freeipa-users/2014-August/msg00079.html) it's very sad to see this divergent development, given that both projects are heavily developed by redhat, maybe this can get fixed? If I can help with this (even if you just need bug reports opened), please tell me so. In the mean time I would like to ask about the status of this project page: https://www.freeipa.org/page/Session_Recording Is this already implemnted? So far I couldn't find any practical examples on how to configure freeipa with auditd on freeipa clients :( If you know of any other working solution, please share! Thanks in advance -- Mit freundlichen Grüßen / Regards Sven Kieske Systemadministrator Mittwald CM Service GmbH & Co. KG Königsberger Straße 6 32339 Espelkamp T: +495772 293100 F: +495772 293333 https://www.mittwald.de Geschäftsführer: Robert Meyer, Maik Behring St.Nr.: 331/5721/1033, USt-IdNr.: DE814773217 HRA 6640, AG Bad Oeynhausen Komplementärin: Robert Meyer Verwaltungs GmbH HRB 13260, AG Bad Oeynhausen

2 1

Privileges needed for ipa-client-install
by Ronald Wimmer 04 Jun '17

04 Jun '17

Which privileges are needed for ipa-client-install? I created a user and gave it host enrollment privileges. But that does not seem to be enough...

4 6

FreeIPA for simply managing DNS
by Striker Leggette 04 Jun '17

04 Jun '17

FreeIPA has a very well-made and easy to use DNS management GUI that would serve well as a standalone tool. Are there any plans to fork the DNS GUI like this for those who would like an easy DNS management application who do not necessarily need LDAP/PKI/Kerberos/etc.? -- Striker Leggette Identity Management linkedin.com/in/striker

5 4

ipa server-del results in "internal error"
by dbischof＠hrz.uni-kassel.de 03 Jun '17

03 Jun '17

Dear list, I'm in the process of upgrading my IPA installation (1 master, 1 replica, external DNS) from IPA version 3.0 to 4.4. I followed the instructions at [1]. Everything worked flawlessly (kudos to all developers and supporters!): My new 4.4 master is up and running. To my understanding, the last step would be to remove the still existing replication agreements of the old 3.0 master and replica before creating the new 4.4 replica (the new 4.4 master is new hardware with a new hostname, but i want to keep the old hardware and hostname for the 4.4 replica). My attempt to remove the old servers result in --- root@o201:~# ipa server-del poolsrv.example.org Removing poolsrv.example.org from replication topology, please wait... ipa: ERROR: an internal error has occurred --- The error occurs even if i try to remove a non-existing server with --force. Attempts to remove the server via the web interface fail as well. IPA/OS versions: --- root@o201:~# cat /etc/redhat-release CentOS Linux release 7.3.1611 (Core) root@o201:~# rpm -qa | grep -i ipa libipa_hbac-1.14.0-43.el7_3.14.x86_64 python-libipa_hbac-1.14.0-43.el7_3.14.x86_64 ipa-server-common-4.4.0-14.el7.centos.7.noarch python2-ipalib-4.4.0-14.el7.centos.7.noarch ipa-client-4.4.0-14.el7.centos.7.x86_64 ipa-common-4.4.0-14.el7.centos.7.noarch ipa-client-common-4.4.0-14.el7.centos.7.noarch python-ipaddress-1.0.16-2.el7.noarch python2-ipaserver-4.4.0-14.el7.centos.7.noarch sssd-ipa-1.14.0-43.el7_3.14.x86_64 ipa-admintools-4.4.0-14.el7.centos.7.noarch python2-ipaclient-4.4.0-14.el7.centos.7.noarch python-iniparse-0.4-9.el7.noarch ipa-server-4.4.0-14.el7.centos.7.x86_64 --- Something I could try? [1] https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/ht… Best regards, --Daniel.

2 3

export users to new freeipa server
by Adrian HY 02 Jun '17

02 Jun '17

Hi, I need to export an existing user from a freeipa server to another server, including password. Regards.

2 1

FreeIPA (adding all new users to admin group by default?)
by Devin Acosta 02 Jun '17

02 Jun '17

I am hoping to see if someone can tell me what I either need to change or update to get it so that FreeIPA doesn't automatically keep adding all new users that is created automatically to the admin group. I inherited this installation of FreeIPA and so far haven't been able to figure out what either got changed or how to disable this behavior? I am running the latest FreeIPA 4.4 on CentOS 7.3. Any help would be greatly appreciated. Devin Acosta

3 4

IPA and CM?
by Kat 02 Jun '17

02 Jun '17

Hi, I have read several pages on getting IPA and Clouder Manager working together to make nice with Kerberos, however, having an issue following the various steps. When I run through CM set and put the primary account in I run into the classic "Preauth required" and yet, I can kinit the account with no issues, so I am wondering if there are any hints on debugging this? What is typically the cuase of that kind of error? Thanks K

3 4

Re: DatabaseError: Server is unwilling to perform: Too many failed logins.
by Jose Alvarez R. 02 Jun '17

02 Jun '17

Hi Can you help me with this problem? My FreeIPA version 4.3.3 and the S.O. is Fedora 24 Thanks Regards Jose Alvarez From: Jose Alvarez R. [mailto:jalvarez@cyberfuel.com] Sent: miércoles 31 de mayo de 2017 12:17 p.m. To: 'FreeIPA users list' <freeipa-users(a)lists.fedorahosted.org> Subject: DatabaseError: Server is unwilling to perform: Too many failed logins. Hi A question, I have the following errors on my server FreeIPA 4.3.3 cat /var/log/httpd/error_log Wed May 31 11:27:59.079315 2017] [wsgi:error] [pid 2024] [remote 192.168.0.114:200] mod_wsgi (pid=2024): Exception occurred processing WSGI script '/usr/share/ipa/wsgi [Wed May 31 11:27:59.079432 2017] [wsgi:error] [pid 2024] [remote 192.168.0.114:200] Traceback (most recent call last): [Wed May 31 11:27:59.079486 2017] [wsgi:error] [pid 2024] [remote 192.168.0.114:200] File "/usr/share/ipa/wsgi.py", line 63, in application [Wed May 31 11:27:59.079675 2017] [wsgi:error] [pid 2024] [remote 192.168.0.114:200] return api.Backend.wsgi_dispatch(environ, start_response) [Wed May 31 11:27:59.079703 2017] [wsgi:error] [pid 2024] [remote 192.168.0.114:200] File "/usr/lib/python2.7/site-packages/ipaserver/rpcserver.py", line 261, in __ca [Wed May 31 11:27:59.080261 2017] [wsgi:error] [pid 2024] [remote 192.168.0.114:200] return self.route(environ, start_response) [Wed May 31 11:27:59.080298 2017] [wsgi:error] [pid 2024] [remote 192.168.0.114:200] File "/usr/lib/python2.7/site-packages/ipaserver/rpcserver.py", line 273, in rout [Wed May 31 11:27:59.080343 2017] [wsgi:error] [pid 2024] [remote 192.168.0.114:200] return app(environ, start_response) [Wed May 31 11:27:59.080401 2017] [wsgi:error] [pid 2024] [remote 192.168.0.114:200] File "/usr/lib/python2.7/site-packages/ipaserver/rpcserver.py", line 811, in __ca [Wed May 31 11:27:59.080437 2017] [wsgi:error] [pid 2024] [remote 192.168.0.114:200] self.create_context(ccache=ipa_ccache_name) [Wed May 31 11:27:59.080455 2017] [wsgi:error] [pid 2024] [remote 192.168.0.114:200] File "/usr/lib/python2.7/site-packages/ipalib/backend.py", line 123, in create_co [Wed May 31 11:27:59.080578 2017] [wsgi:error] [pid 2024] [remote 192.168.0.114:200] self.Backend.ldap2.connect(ccache=ccache) [Wed May 31 11:27:59.080611 2017] [wsgi:error] [pid 2024] [remote 192.168.0.114:200] File "/usr/lib/python2.7/site-packages/ipalib/backend.py", line 66, in connect [Wed May 31 11:27:59.080654 2017] [wsgi:error] [pid 2024] [remote 192.168.0.114:200] conn = self.create_connection(*args, **kw) [Wed May 31 11:27:59.080691 2017] [wsgi:error] [pid 2024] [remote 192.168.0.114:200] File "/usr/lib/python2.7/site-packages/ipaserver/plugins/ldap2.py", line 202, in [Wed May 31 11:27:59.080973 2017] [wsgi:error] [pid 2024] [remote 192.168.0.114:200] client_controls=clientctrls) [Wed May 31 11:27:59.081019 2017] [wsgi:error] [pid 2024] [remote 192.168.0.114:200] File "/usr/lib/python2.7/site-packages/ipapython/ipaldap.py", line 1085, in gssap [Wed May 31 11:27:59.081653 2017] [wsgi:error] [pid 2024] [remote 192.168.0.114:200] '', auth_tokens, server_controls, client_controls) [Wed May 31 11:27:59.081678 2017] [wsgi:error] [pid 2024] [remote 192.168.0.114:200] File "/usr/lib64/python2.7/contextlib.py", line 35, in __exit__ [Wed May 31 11:27:59.081835 2017] [wsgi:error] [pid 2024] [remote 192.168.0.114:200] self.gen.throw(type, value, traceback) [Wed May 31 11:27:59.081897 2017] [wsgi:error] [pid 2024] [remote 192.168.0.114:200] File "/usr/lib/python2.7/site-packages/ipapython/ipaldap.py", line 998, in error_ [Wed May 31 11:27:59.081955 2017] [wsgi:error] [pid 2024] [remote 192.168.0.114:200] raise errors.DatabaseError(desc=desc, info=info) [Wed May 31 11:27:59.082028 2017] [wsgi:error] [pid 2024] [remote 192.168.0.114:200] DatabaseError: Server is unwilling to perform: Too many failed logins. I checked this link: https://pagure.io/freeipa/issue/5653 But I'm not sure, How can I solve that? Thanks, Regards Jose Alvarez

2 2

new/fresh server can't be setup as replica due to "The remote replica has a different database generation ID ..."
by Chris Dagdigian 02 Jun '17

02 Jun '17

Hi folks, Related to my posts from earlier in the week. I'm stuck in catch-22 land with no seemingly viable way forward ... I am stuck with 2x IPA masters in different AWS regions that refuse to replicate because the topology is disconnected, I can't seem to force the re-connect so I'm trying to expand my topology options by building new fresh masters from scratch. CentOS 7.3 with fully updated IPA software. The fresh replica install fails with a "Local LDAP" error, these seem to be the corresponding errors in the /var/log/dirserv logs: [02/Jun/2017:14:29:31.965022647 +0000] 389-Directory/1.3.5.10 B2017.145.2037 starting up [02/Jun/2017:14:29:31.976521839 +0000] default_mr_indexer_create: warning - plugin [caseIgnoreIA5Match] does not handle caseExactIA5Match [02/Jun/2017:14:29:32.102416271 +0000] slapd started. Listening on All Interfaces port 389 for LDAP requests [02/Jun/2017:14:29:32.104077504 +0000] Listening on All Interfaces port 636 for LDAPS requests [02/Jun/2017:14:29:32.105380691 +0000] Listening on /var/run/slapd-companyIDM-ORG.socket for LDAPI requests [02/Jun/2017:14:29:35.776066609 +0000] NSMMReplicationPlugin - agmt="cn=meTodeawilidmp001.companyidm.org" (deawilidmp001:389): The remote replica has a different database generation ID than the local database. You may have to reinitialize the remote replica, or the local replica. And here is the output from trying to perform the replica setup: [root@usaeilidmp003 centos]# ipa-replica-install --setup-ca --principal admin --admin-password SEKRIT Configuring client side components Using existing certificate '/etc/ipa/ca.crt'. Discovery was successful! Client hostname: usaeilidmp003.companyidm.org Realm: companyIDM.ORG DNS Domain: companyidm.org IPA Server: deawilidmp001.companyidm.org BaseDN: dc=companyidm,dc=org Skipping synchronizing time with NTP server. Enrolled in IPA realm companyIDM.ORG Created /etc/ipa/default.conf New SSSD config will be created Configured sudoers in /etc/nsswitch.conf Configured /etc/sssd/sssd.conf Configured /etc/krb5.conf for IPA realm companyIDM.ORG trying https://deawilidmp001.companyidm.org/ipa/json Forwarding 'schema' to json server 'https://deawilidmp001.companyidm.org/ipa/json' trying https://deawilidmp001.companyidm.org/ipa/session/json Forwarding 'ping' to json server 'https://deawilidmp001.companyidm.org/ipa/session/json' Forwarding 'ca_is_enabled' to json server 'https://deawilidmp001.companyidm.org/ipa/session/json' Systemwide CA database updated. Adding SSH public key from /etc/ssh/ssh_host_rsa_key.pub Adding SSH public key from /etc/ssh/ssh_host_ecdsa_key.pub Adding SSH public key from /etc/ssh/ssh_host_ed25519_key.pub Forwarding 'host_mod' to json server 'https://deawilidmp001.companyidm.org/ipa/session/json' SSSD enabled Configured /etc/openldap/ldap.conf Configured /etc/ssh/ssh_config Configured /etc/ssh/sshd_config Configuring companyidm.org as NIS domain. Client configuration complete. Run connection check to master Connection check OK Configuring NTP daemon (ntpd) [1/4]: stopping ntpd [2/4]: writing configuration [3/4]: configuring ntpd to start on boot [4/4]: starting ntpd Done configuring NTP daemon (ntpd). Configuring directory server (dirsrv). Estimated time: 1 minute [1/44]: creating directory server user [2/44]: creating directory server instance [3/44]: updating configuration in dse.ldif [4/44]: restarting directory server [5/44]: adding default schema [6/44]: enabling memberof plugin [7/44]: enabling winsync plugin [8/44]: configuring replication version plugin [9/44]: enabling IPA enrollment plugin [10/44]: enabling ldapi [11/44]: configuring uniqueness plugin [12/44]: configuring uuid plugin [13/44]: configuring modrdn plugin [14/44]: configuring DNS plugin [15/44]: enabling entryUSN plugin [16/44]: configuring lockout plugin [17/44]: configuring topology plugin [18/44]: creating indices [19/44]: enabling referential integrity plugin [20/44]: configuring certmap.conf [21/44]: configure autobind for root [22/44]: configure new location for managed entries [23/44]: configure dirsrv ccache [24/44]: enabling SASL mapping fallback [25/44]: restarting directory server [26/44]: creating DS keytab [27/44]: retrieving DS Certificate [28/44]: restarting directory server [29/44]: setting up initial replication Starting replication, please wait until this has completed. Update in progress, 15 seconds elapsed [deawilidmp001.companyidm.org] reports: Update failed! Status: [-2 - LDAP error: Local error] [error] RuntimeError: Failed to start replication Your system may be partly configured. Run /usr/sbin/ipa-server-install --uninstall to clean up. ipa.ipapython.install.cli.install_tool(Replica): ERROR Failed to start replication ipa.ipapython.install.cli.install_tool(Replica): ERROR The ipa-replica-install command failed. See /var/log/ipareplica-install.log for more information [root@usaeilidmp003 centos]# \

1 0

ipa-adtrust-install command fails to add fallback group
by Marin BERNARD 02 Jun '17

02 Jun '17

Hi, I'm trying to configure ad trust on a freshly installed FreeIPA server 4.4.0 running on an up-to-date instance of CentOS 7 (1611). The ipa-adtrust-install command fails at step 17 (failed to add fallback group). As a consequence, Samba cannot be started and AD trusts can't be established. Here is an excerpt of the install log: ```` # ipa-adtrust-install --netbios-name=PEP06-IPA --add-sids --enable-compat (...) 2017-06-01T13:49:29Z DEBUG [18/23]: adding fallback group 2017-06-01T13:49:29Z DEBUG flushing ldapi://%2fvar%2frun%2fslapd-IPA-PEP06-FR.socket from SchemaCache 2017-06-01T13:49:29Z DEBUG retrieving schema for SchemaCache url=ldapi://%2fvar%2frun%2fslapd-IPA-PEP06-FR.socket conn=<ldap.ldapobject.SimpleLDAPObject instance at 0x62107a0> 2017-06-01T13:49:30Z DEBUG Starting external process 2017-06-01T13:49:30Z DEBUG args=/usr/bin/ldapmodify -v -f /tmp/tmpyj5xIJ -H ldapi://%2fvar%2frun%2fslapd-IPA-PEP06-FR.socket -Y EXTERNAL 2017-06-01T13:49:30Z DEBUG Process finished, return code=1 2017-06-01T13:49:30Z DEBUG stdout=add cn: Default SMB Group add description: Fallback group for primary group RID, do not add users to this group add gidnumber: -1 add objectclass: top ipaobject posixgroup adding new entry "cn=Default SMB Group,cn=groups,cn=accounts,dc=ipa,dc=pep06,dc=fr" 2017-06-01T13:49:30Z DEBUG stderr=ldap_initialize( ldapi://%2Fvar%2Frun%2Fslapd-IPA-PEP06-FR.socket/??base ) SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 ldap_add: Operations error (1) additional info: Allocation of a new value for range cn=posix ids,cn=distributed numeric assignment plugin,cn=plugins,cn=config failed! Unable to proceed. 2017-06-01T13:49:30Z CRITICAL Failed to load default-smb-group.ldif: Command '/usr/bin/ldapmodify -v -f /tmp/tmpyj5xIJ -H ldapi://%2fvar%2frun%2fslapd-IPA-PEP06-FR.socket -Y EXTERNAL' returned non-zero exit status 1 2017-06-01T13:49:30Z DEBUG Failed to add fallback group. 2017-06-01T13:49:30Z DEBUG duration: 0 seconds (...) ```` In the end, Samba logically fails to start with the following error: ```` Missing mandatory attribute ipaNTFallbackPrimaryGroup. ```` I ran the same command one week ago on another server and had no issue. Does anybody have an idea about what to do to make it work ? Thanks, Marin BERNARD Administrateur systèmes Pupilles de l’Enseignement Public 06 35 boulevard de la Madeleine — 06300 Nice marin.bernard[at]pep06.fr

2 1

ipa-server-upgrade stuck
by pgb205 01 Jun '17

01 Jun '17

I have tried to start an apparently crashed instance of ipa server and got ipactl startUpgrade required: please run ipa-server-upgrade commandAborting ipactl ran ipa-server-upgrade which got to the following step, but no further ipa.ipaserver.install.ldapupdate.LDAPUpdate: DEBUG: ---------------------------------------------ipa.ipaserver.install.ldapupdate.LDAPUpdate: DEBUG: Final value after applying updatesipa.ipaserver.install.ldapupdate.LDAPUpdate: DEBUG: dn: cn=selinux,dc=mmracks,dc=internalipa.ipaserver.install.ldapupdate.LDAPUpdate: DEBUG: objectClass:ipa.ipaserver.install.ldapupdate.LDAPUpdate: DEBUG: nsContaineripa.ipaserver.install.ldapupdate.LDAPUpdate: DEBUG: topipa.ipaserver.install.ldapupdate.LDAPUpdate: DEBUG: cn:ipa.ipaserver.install.ldapupdate.LDAPUpdate: DEBUG: selinux the command is stuck and is not giving me any error. Any advise as to why I am suddenly prompted to upgrade but even more importantly on how I should get past the above point in the upgrade? thanks

2 2

Replica - From version 3 to 4
by Roberto Cantalapiedra 01 Jun '17

01 Jun '17

Hi, My master server is version 3 and I would like to create a replica but using version 4. Is It possible without update the master server to version 4?. Thanks in advance,

2 1

Need a clue re: broken topology and broken replication in a simple 2-server setup
by Chris Dagdigian 01 Jun '17

01 Jun '17

Situation: Two servers housed in 2 different AWS regions are completely disconnected and totally out of sync. I can't fix replication at all so I'm looking for clues or tips .. Backstory: - Complex Active Directory needs including transitive trusts across multiple child domains of the AD Forrest - This means that we've been constantly upgrading IPA and subsystems like sssd* given the speed at which AD integration is being improved/fixed - We've been doing "yum update" and "ipa-server-upgrade" commands all the way from ipa-3.x to current v4.4.0 - Due to incremental upgrades over time we've been at "domain level 0" until very recently Issues - Two servers work but they are islands to their own - no replication seems to be occurring - IPA connection-check scripts seem to all pass - IPA replication-manage "list" commands seem to work fine - forcing replication or forcing a complete reinit has zero effect - IPA topologysegment-find domain commands seem to show the proper segments - BUT -- the topology-verify command clearly shows broken topology and disconnected state It was only recently that I discovered the broken topology status - had spent too much time in the weeds looking at debug output trying to figure out why replication was not working . I'm wondering what the best next-step is to regaining a unified IPA view. From reading the admin guide I'm thinking that I need to bring up new IPA servers so that I have more "nodes" to play with when potentially connecting and fixing the topology segments -- seems easier to fix segments when you have more nodes to play with. I'm not sure what to fix first -- is the broken topology segment the cause for broken replication or is something wrong in the replication internals that results in a disconnected topology? Guidance appreciated. I'm appending some redacted command output below. Regards, Chris ### # ipa-replica-manage list us-idmp001.COMPANYidm.org: master eu-idmp001.COMPANYidm.org: master # ipa topologysegment-find domain ----------------- 1 segment matched ----------------- Segment name: us-idmp001.COMPANYidm.org-to-eu-idmp001.COMPANYidm.org Left node: us-idmp001.COMPANYidm.org Right node: eu-idmp001.COMPANYidm.org Connectivity: left-right ---------------------------- Number of entries returned 1 ---------------------------- #ipa topologysegment-find domain ----------------- 1 segment matched ----------------- Segment name: eu-idmp001.COMPANYidm.org-to-us-idmp001.COMPANYidm.org Left node: eu-idmp001.COMPANYidm.org Right node: us-idmp001.COMPANYidm.org Connectivity: left-right ---------------------------- Number of entries returned 1 ---------------------------- [root@eu-idmp001 centos]# # ipa topologysuffix-verify domain ======================================================== Replication topology of suffix "domain" contains errors. ======================================================== ------------------------ Topology is disconnected ------------------------ Server eu-idmp001.COMPANYidm.org can't contact servers: us-idmp001.COMPANYidm.org [root@us-idmp001 centos]# # ipa topologysuffix-verify domain ======================================================== Replication topology of suffix "domain" contains errors. ======================================================== ------------------------ Topology is disconnected ------------------------ Server us-idmp001.COMPANYidm.org can't contact servers: eu-idmp001.COMPANYidm.org [root@eu-idmp001 centos]# [root@eu-idmp001 centos]# # /usr/sbin/ipa-replica-conncheck --replica eu-idmp001.COMPANYidm.org Check connection from master to remote replica 'eu-idmp001.COMPANYidm.org': Directory Service: Unsecure port (389): OK Directory Service: Secure port (636): OK Kerberos KDC: TCP (88): OK Kerberos KDC: UDP (88): WARNING Kerberos Kpasswd: TCP (464): OK Kerberos Kpasswd: UDP (464): WARNING HTTP Server: Unsecure port (80): OK HTTP Server: Secure port (443): OK The following UDP ports could not be verified as open: 88, 464 This can happen if they are already bound to an application and ipa-replica-conncheck cannot attach own UDP responder. Connection from master to replica is OK. ipa-replica-conncheck --master us-idmp001.COMPANYidm.org Check connection from replica to remote master 'us-idmp001.COMPANYidm.org': Directory Service: Unsecure port (389): OK Directory Service: Secure port (636): OK Kerberos KDC: TCP (88): OK Kerberos Kpasswd: TCP (464): OK HTTP Server: Unsecure port (80): OK HTTP Server: Secure port (443): OK The following list of ports use UDP protocol and would need to be checked manually: Kerberos KDC: UDP (88): SKIPPED Kerberos Kpasswd: UDP (464): SKIPPED Connection from replica to master is OK. Start listening on required ports for remote master check Listeners are started. Use CTRL+C to terminate the listening part after the test. Please run the following command on remote master: /usr/sbin/ipa-replica-conncheck --replica eu-idmp001.COMPANYidm.org

2 2

ipa-client-install combined with 'authconfig --enablenis --update'
by paul＠kenla.nl 01 Jun '17

01 Jun '17

Hi, I have boot problem when i combine a ipa-client-install with 'authconfig --enablenis --update' According to the ovirt/RHEV docs [1] I have to do this to make SSO to the VM possible. Messages during boot are: Failed to start RealtimeKit for Policy Services Failed to start Authorization Manager Dependency failed for Dynamic System tuning deamon My setup is: All systems Centos 7.3(1611) oVirt 4.1 IPA server 4.4 IPA client 4.4 If i use an old VM with Centos 7.2(1511) and ipa-client 4.2 there are no problems and SSO is working so oVirt and IPA seem to be configured correct. My findings so far: - Centos 7.3 does not include ypbind. If i install manually it sometimes boots (but takes a long time) but the other times stops at same point as mentioned before. This could imply some kind of race condition during boot. - I tried different versions of ipa-client (ipa-client-4.4.0-12.el7.centos.x86_64 up to ipa-client-4.4.0-14.el7.centos.7.x86_64) none worked. Older versions i could not find anymore. Can anyone comfirm my findings or point me in some direction? Kind regards, Paul [1]https://access.redhat.com/documentation/en-us/red_hat_virtualization/4.1/…

2 5

SSH Key replication time/issues
by Jake 01 Jun '17

01 Jun '17

Hey again, I'm trying to track down how to ensure ssh keys are added AND removed quickly. Right now it seems I must restart ipa services or sss_cache -E to force them to update, and there doesn't seem to be a determinate amount of time to allow replication. Note, SSH keys are stored in the "Default View" for external users (external one-way trust with AD). Thanks, -Jake

3 5

Get rid of manually calling kinit with SSSD
by Ronald Wimmer 31 May '17

31 May '17

Hi, I read Jakub Hrozeks post https://jhrozek.wordpress.com/2015/07/17/get-rid-of-calling-manually-callin… and found that it is exactly what I need. The only problem is that I am using Ubuntu and not Fedora or CentOS. In sssd_pamlog i only see a SSS_PAM_OPEN_SESSION but no SSS_PAM_AUTHENTICATE - so most likely the pam config is still wrong. Is anybody here who got this working under Ubuntu? This is how my /etc/pam.d/common-auth looks: auth [success=2 default=ignore] pam_unix.so nullok_secure try_first_pass auth [success=1 default=ignore] pam_sss.so use_first_pass auth requisite pam_deny.so auth required pam_permit.so auth optional pam_ecryptfs.so unwrap auth optional pam_cap.so And this is my nsswitch.conf passwd: compat group: compat shadow: compat hosts: files wins mdns4_minimal [NOTFOUND=return] resolve [!UNAVAIL=return] dns myhostname networks: files protocols: db files services: db files ethers: db files rpc: db files netgroup: nis sudoers: files sss Any ideas on this matter would be highly appreciated! Regards, Ronald

3 5

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users June 2017