Is it safe to upgrade to 7.4 ?
by Petros Triantafyllidis
Hi all,
Having seen several messages in the list regarding problems that
followed OS upgrades from 7.3 to 7.4 (i.e. rpm IPA 4.4 to 4.5), I would
like to ask whether such an action is considered safe. Are there any
specific steps to be taken in master-replica-client infrastucture in
order to avoid possible pitfalls?
Moreover, is there anything to be done as a precaution which would allow
an immediate rollback?
Thanks in advance,
Petros
6 years, 7 months
Announcing FreeIPA 4.6.1
by Tomas Krizek
The FreeIPA team would like to announce FreeIPA 4.6.1 release!
It can be downloaded from http://www.freeipa.org/page/Downloads. Builds for
Fedora 26 and 27 are available in the official @freeipa/freeipa-4-6 COPR
repository [1].
== Highlights in 4.6.1 ==
=== Known Issues ===
* PyPI packages are broken since 4.6.0 #7132
=== Bug fixes ===
FreeIPA 4.6.1 is a stabilization release for the features delivered as a
part of 4.6.0.
There are more than 10 bug-fixes details of which can be seen in
the list of resolved tickets below.
== Upgrading ==
Upgrade instructions are available on Upgrade page.
== Feedback ==
Please provide comments, bugs and other feedback via the freeipa-users
mailing
list
(https://lists.fedoraproject.org/archives/list/freeipa-users@lists.fedorah...)
or #freeipa channel on Freenode.
== Resolved tickets ==
* 7157 [tracker] pyasn1 fails to parse kerberos principal name
* 7150 Ipa-server-install update dse.ldif with wrong SELinux context
* 7143 "unknown command 'undefined'" error when changing user's password
via the web UI
* 7135 Server deployment still sets up Firefox extension, this is no
longer necessary and broken on F27+
* 7129 ipa-server/replica-install fails with: "exception: BytesWarning:
Comparison between bytes and string" when using '--dirsrv-config-file'
parameter
* 7119 kdc_proxy: kinit admin fails with "Cannot contact any KDC for
realm 'IPA.TEST' while getting initial credentials"
* 7115 ipa-pki-retrieve-key: failure results in crash report
* 7081 [ipatests] - installutils.is_ipa_configured() - users other then
root cannot check if IPA is configured
* 7027 Use TLS for cert-find
* 6874 pylint 1.7.1 fails
* 6848 Test IPA with OpenSSL-base libcurl for Fedora 27
* 6566 [py3] session cookie not found with py3
* 5121 [py3] Remove unnecessary calls to dict.keys()
== Detailed changelog since 4.6.0 ==
=== Alexander Bokovoy (3) ===
* Make sure upgrade also checks for IPv6 stack
* OTP import: support hash names with HMAC- prefix
* dsinstance: Restore context after changing dse.ldif
=== Felipe Volpone (2) ===
* Changing idoverrideuser-* to treat objectClass case insensitively
* Fixing how sssd.conf is updated when promoting a client to replica
=== Florence Blanc-Renaud (3) ===
* Fix ipa-server-upgrade with server cert tracking
* Python3: Fix winsync replication agreement
* Fix ipa config-mod --ca-renewal-master
=== Fraser Tweedale (2) ===
* ipa-pki-retrieve-key: ensure we do not crash
* issue_server_cert: avoid application of str to bytes
=== Martin Basti (1) ===
* py3: set samba dependencies
=== Petr Vobornik (1) ===
* browser config: cleanup after removal of Firefox extension
=== Pavel Vomacka (3) ===
* WebUI: Fix calling undefined method during reset passwords
* WebUI: remove unused parameter from get_whoami_command
* Adds whoami DS plugin in case that plugin is missing
=== Rob Crittenden (2) ===
* Add exec to /var/lib/ipa/sysrestore for install status inquiries
* Use TLS for the cert-find operation
=== Stanislav Laznicka (28) ===
* Don't write p11-kit EKU extension object if no EKU
* pylint: fix missing module
* travis: run the same tests in python2/3
* certmap testing: fix wrong cert construction
* ldap2: don't use decode() on str instance
* client: fix retrieving certs from HTTP
* uninstall: remove deprecation warning
* ldif: handle attribute names as strings
* pkinit: fix sorting dictionaries
* pkinit: don't fail when no pkinit servers found
* travis: remove "fast" from "makecache fast"
* Change Travis CI container to FreeIPA-owned
* Change the requirements for pylint in wheel
* rpcserver: don't call xmlserver.Command
* secrets: disable relative-imports for custodia
* pylint: disable __hash__ for some classes
* install.util: disable no-value-for-parameter
* pylint: make unsupported-assignment-operation check local
* sudocmd: fix unsupported assignment
* pylint: Iterate through dictionaries
* parameters: convert Decimal.precision to int
* dcerpc: disable unbalanced-tuple-unpacking
* dcerpc: refactor assess_dcerpc_exception
* pylint: fix no-member in schema plugin
* csrgen: fix incorrect codec for pyasn BitString
* pylint: fix not-context-manager false positives
* Travis: archive logs of py3 jobs
* travis: temporary workaround for Travis CI
=== Tomas Krizek (6) ===
* Become IPA 4.6.1
* Update contributors
* Update translations
* spec: bump python-pyasn1 to 0.3.2-2
* prci: use f26 template for master
* VERSION: set back to git snapshot
[1] - https://copr.fedorainfracloud.org/coprs/g/freeipa/freeipa-4-6/
--
Tomas Krizek
PGP: 4A8B A48C 2AED 933B D495 C509 A1FB A5F7 EF8C 4869
6 years, 7 months
ipa-server-install failing at wait_for_open_ports
by Eric Scholwin
Foolishly, I blew up my entire 4.4 on Centos 7.4 environment and I'm trying to get 4.5 working on 7.4. I've been hitting the same exact problem while trying to install freeipa 4.5 on centos 7.4 from scratch and that's at step 6/45 "starting directory server". The following message is what I get hung up on during the installation and I'm at a complete loss as to what's going on.
DEBUG wait_for_open_ports: localhost [389] timeout 300
I, like many others, had ipv6 disabled, but I've re-enabled it, and I'm still running into issues.
This is what my ipaserver-install.log looks like, it fails at this samespot every single time:
2017-09-20T15:14:48Z DEBUG wait_for_open_ports: localhost [389] timeout 300
2017-09-20T15:19:49Z DEBUG Traceback (most recent call last):
File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 504, in start_creation
run_step(full_msg, method)
File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 494, in run_step
method()
File "/usr/lib/python2.7/site-packages/ipaserver/install/dsinstance.py", line 651, in __start_instance
self.start(self.serverid)
File "/usr/lib/python2.7/site-packages/ipaserver/install/dsinstance.py", line 627, in start
super(DsInstance, self).start(*args, **kwargs)
File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 401, in start
self.service.start(instance_name, capture_output=capture_output, wait=wait)
File "/usr/lib/python2.7/site-packages/ipaplatform/redhat/services.py", line 157, in start
instance_name, capture_output=capture_output, wait=wait)
File "/usr/lib/python2.7/site-packages/ipaplatform/base/services.py", line 300, in start
self.wait_for_open_ports(self.service_instance(instance_name))
File "/usr/lib/python2.7/site-packages/ipaplatform/base/services.py", line 270, in wait_for_open_ports
self.api.env.startup_timeout)
File "/usr/lib/python2.7/site-packages/ipapython/ipautil.py", line 1227, in wait_for_open_ports
raise socket.timeout("Timeout exceeded")
timeout: Timeout exceeded
2017-09-20T15:19:49Z DEBUG [error] timeout: Timeout exceeded
2017-09-20T15:19:49Z DEBUG File "/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 172, in execute
return_value = self.run()
File "/usr/lib/python2.7/site-packages/ipapython/install/cli.py", line 333, in run
cfgr.run()
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 368, in run
self.execute()
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 392, in execute
for _nothing in self._executor():
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 434, in __runner
exc_handler(exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 463, in _handle_execute_exception
self._handle_exception(exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 453, in _handle_exception
six.reraise(*exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 424, in __runner
step()
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 421, in <lambda>
step = lambda: next(self.__gen)
File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from
six.reraise(*exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from
value = gen.send(prev_value)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 658, in _configure
next(executor)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 434, in __runner
exc_handler(exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 463, in _handle_execute_exception
self._handle_exception(exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 521, in _handle_exception
self.__parent._handle_exception(exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 453, in _handle_exception
six.reraise(*exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 518, in _handle_exception
super(ComponentBase, self)._handle_exception(exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 453, in _handle_exception
six.reraise(*exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 424, in __runner
step()
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 421, in <lambda>
step = lambda: next(self.__gen)
File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from
six.reraise(*exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from
value = gen.send(prev_value)
File "/usr/lib/python2.7/site-packages/ipapython/install/common.py", line 63, in _install
for _nothing in self._installer(self.parent):
File "/usr/lib/python2.7/site-packages/ipaserver/install/server/__init__.py", line 578, in main
master_install(self)
File "/usr/lib/python2.7/site-packages/ipaserver/install/server/install.py", line 248, in decorated
func(installer)
File "/usr/lib/python2.7/site-packages/ipaserver/install/server/install.py", line 758, in install
setup_pkinit=not options.no_pkinit)
File "/usr/lib/python2.7/site-packages/ipaserver/install/dsinstance.py", line 344, in create_instance
self.start_creation(runtime=30)
File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 504, in start_creation
run_step(full_msg, method)
File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 494, in run_step
method()
File "/usr/lib/python2.7/site-packages/ipaserver/install/dsinstance.py", line 651, in __start_instance
self.start(self.serverid)
File "/usr/lib/python2.7/site-packages/ipaserver/install/dsinstance.py", line 627, in start
super(DsInstance, self).start(*args, **kwargs)
File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 401, in start
self.service.start(instance_name, capture_output=capture_output, wait=wait)
File "/usr/lib/python2.7/site-packages/ipaplatform/redhat/services.py", line 157, in start
instance_name, capture_output=capture_output, wait=wait)
File "/usr/lib/python2.7/site-packages/ipaplatform/base/services.py", line 300, in start
self.wait_for_open_ports(self.service_instance(instance_name))
File "/usr/lib/python2.7/site-packages/ipaplatform/base/services.py", line 270, in wait_for_open_ports
self.api.env.startup_timeout)
File "/usr/lib/python2.7/site-packages/ipapython/ipautil.py", line 1227, in wait_for_open_ports
raise socket.timeout("Timeout exceeded")
2017-09-20T15:19:49Z DEBUG The ipa-server-install command failed, exception: timeout: Timeout exceeded
2017-09-20T15:19:49Z ERROR Timeout exceeded
2017-09-20T15:19:49Z ERROR The ipa-server-install command failed. See /var/log/ipaserver-install.log for more information
6 years, 7 months
Disabling 2FA on a single host
by Maciej Drobniuch
Hey Ipa list!
Is there a way to disable 2FA for a particular host?
I'm using PAM auth there for a webservice that does not have kerberos and
it's annoying users to enter the 2FA every-time(so I want to make an
exception)
Thanks
--
Best regards
Maciej Drobniuch
Network Security Engineer
Collective-Sense,LLC
6 years, 7 months
Sudo Rules out of sync?!
by email＠ml.jacobdevans.com
ipa users,
I am running the https://github.com/peterpakos/ipa_check_consistency and seeing my rule counts are out of sync, is there a process to force these to replicate?
It seems only sudo rules are out of sync at this time, new hosts replicating properly.
ipa-server-install --version
4.4.0
cat /etc/redhat-release
CentOS Linux release 7.3.1611 (Core)
Thanks,
- Jake
6 years, 7 months
server setup in existing DNS zone
by Gordon Messmer
I'd like to set up a new FreeIPA instance with DNS, and I'd like to
use a zone that already exists. My intention is to configure the ipa
server, then delete the existing DNS zone and point NS records for
that zone toward the ipa server.
ipa-server-install fails when the domain given by --domain already
exists. Can I instruct the setup process to skip that check?
If not, then presumably the hostname of the ipa server must not be a
member of the zone given by --domain? I'd prefer for its hostname to
be a member of that zone, but the hostname must resolve during setup.
That's not possible if the hostname is a child of the domain given by
--domain, and that domain can't already exist.
6 years, 7 months
Solaris client proxyDN logins not working
by Louis Abel
Configuring a Solaris 11.3 system as a FreeIPA client. I've read various articles, mail list archives, and pages found on google trying to figure out how to properly make this work. So far, I've only gotten the ability to do su - user(a)domain.tld and check getent passwd/group. This successfully works. The things that do not work are ssh and console logins. This is what I've tried so far:
Setting authenticationMethod to 'simple:tls'
-> My service account never seems to work and the log says: "libsldap: Status: 53 Mesg: openConnection: simple bind failed - DSA is unwilling to perform"
-> "libsldap: Status: 49 Mesg: openConnection: simple bind failed - Invalid credentials" - This isn't the case as I've tried the credentials multiple times using ldapsearch commands with success. My credentials for my users are correct since I can login to a CentOS 6 and CentOS 7 client perfectly fine.
These are the steps I took:
-> Create host in IPA
-> ipa-getkeytab and transferred it to the client
-> Created nss database with CA certificate and placed it in /var/ldap with proper permissions
-> Configured /etc/krb5/krb5.conf
-> Configured nsswitch.conf to be files ldap
-> Configured /etc/pam.d/* files accordingly
-> Used ldapclient init on the client
Here is my kinit and ldap tests.
# kinit admin
Password for admin(a)IPA.EXAMPLE.COM:
kinit: no ktkt_warnd warning possible
# klist
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: admin(a)IPA.EXAMPLE.COM
Valid starting Expires Service principal
09/13/17 16:22:29 09/14/17 16:22:29 krbtgt/IPA.EXAMPLE.COM(a)IPA.EXAMPLE.COM
renew until 09/20/17 16:22:29
# ldaplist -l passwd louis.abel
dn: uid=louis.abel,cn=users,cn=compat,dc=ipa,dc=example,dc=com
cn: Louis Abel
objectClass: posixAccount
objectClass: top
gidNumber: 1006800013
gecos: Louis Abel
uidNumber: 25439
loginShell: /bin/bash
homeDirectory: /home/louis.abel
uid: louis.abel(a)ad.example.com
uid: louis.abel
# ldaplist -l passwd louis.abel2
dn: uid=louis.abel2,cn=users,cn=compat,dc=ipa,dc=example,dc=com
cn: Louis Abel
objectClass: posixAccount
objectClass: top
gidNumber: 1006800001
gecos: Louis Abel
uidNumber: 1006800001
loginShell: /bin/bash
homeDirectory: /home/louis.abel2
uid: louis.abel2(a)ipa.example.com
uid: louis.abel2
dn: uid=louis.abel2,cn=users,cn=compat,dc=ipa,dc=example,dc=com
cn: Louis Abel
objectClass: posixAccount
objectClass: ipaOverrideTarget
objectClass: top
gidNumber: 1006800001
gecos: Louis Abel
uidNumber: 1006800001
ipaAnchorUUID: :IPA:ipa.example.com:8babb9a8-5aaf-11e7-9769-00505690319e
loginShell: /bin/bash
homeDirectory: /home/louis.abel2
uid: louis.abel2
My pam configuration files:
/etc/pam.d/other
auth definitive pam_user_policy.so.1
auth sufficient pam_krb5.so.1
auth requisite pam_authtok_get.so.1
auth required pam_dhkeys.so.1
auth binding pam_unix_auth.so.1 server_policy
auth required pam_unix_cred.so.1
auth sufficient pam_krb5.so.1
account requisite pam_roles.so.1
account definitive pam_user_policy.so.1
account binding pam_unix_account.so.1 server_policy
account required pam_unix_account.so.1
account required pam_krb5.so.1
account required pam_tsol_account.so.1
session definitive pam_user_policy.so.1
session required pam_unix_session.so.1
password definitive pam_user_policy.so.1
password include pam_authtok_common
password sufficient pam_krb5.so.1
password required pam_authtok_store.so.1 server_policy
/etc/pam.d/login
auth requisite pam_authtok_get.so.1
auth required pam_dhkeys.so.1
auth required pam_unix_cred.so.1
auth sufficient pam_krb5.so.1 try_first_pass
auth required pam_unix_auth.so.1 use_first_pass
auth required pam_dial_auth.so.1
# ldapclient list
NS_LDAP_FILE_VERSION= 2.0
NS_LDAP_BINDDN= uid=solaris,cn=sysaccounts,cn=etc,dc=ipa,dc=example,dc=com
NS_LDAP_BINDPASSWD= removed
NS_LDAP_SERVERS= pentl01.ipa.example.com, pentl02.ipa.example.com, pentl03.ipa.example.com, sentl01.ipa.example.com, sentl02.ipa.example.com, sentl03.ipa.example.com
NS_LDAP_SEARCH_BASEDN= dc=ipa,dc=example,dc=com
NS_LDAP_AUTH= tls:simple
NS_LDAP_SEARCH_REF= TRUE
NS_LDAP_SEARCH_TIME= 15
NS_LDAP_CACHETTL= 6000
NS_LDAP_PROFILE= default solaris_authssl
NS_LDAP_SERVICE_SEARCH_DESC= group:cn=groups,cn=compat,dc=ipa,dc=example,dc=com
NS_LDAP_SERVICE_SEARCH_DESC= passwd:cn=users,cn=compat,dc=ipa,dc=example,dc=com
NS_LDAP_SERVICE_SEARCH_DESC= netgroup:cn=ng,cn=compat,dc=ipa,dc=example,dc=com
NS_LDAP_SERVICE_SEARCH_DESC= ethers:cn=computers,cn=accounts,dc=ipa,dc=example,dc=com
NS_LDAP_SERVICE_SEARCH_DESC= sudoers:ou=sudoers,dc=ipa,dc=example,dc=com
NS_LDAP_BIND_TIME= 5
NS_LDAP_OBJECTCLASSMAP= shadow:shadowAccount=posixAccount
NS_LDAP_OBJECTCLASSMAP= passwd:posixAccount=posixaccount
NS_LDAP_OBJECTCLASSMAP= group:posixGroup=posixgroup
nsswitch changes:
passwd: files ldap [NOTFOUND=return]
group: files ldap [NOTFOUND=return]
This is what I looked at:
https://www.redhat.com/archives/freeipa-users/2013-January/msg00021.html
https://www.redhat.com/archives/freeipa-users/2015-January/msg00017.html
http://etcfstab.com/oraclelinux/solaris_n_freeipa.html
https://mkosek.fedorapeople.org/publican_site/en-US/FreeIPA/3.3/html/Free...
Anyone have better experience or any documentation that could help?
6 years, 7 months
kdc.crt absent after upgrade from 4.4 to 4.5 (Scientific linux 7)
by Niels Walet
My kdc.crt has disappeared after a large number of problems with amn upgrade from 7.3 to 7.4 on my SL7 box (roughly equivalent to Centos). It is a vanilla installation with self-signed cerificates.
I am aware of the permission errors in 4.5.0, but what I really need to know is what command to execute to regenerate this file--I can fix the permissions issue afterwards. I really would like to be able to login to the web interface agiain.
Niels
6 years, 7 months
Unable to add AD group to new install
by Bobby Jones
Hi:
I am trying to finish my integration of FreeIPA with Active Directory, but
when I try to add my group information it fails.
# ipa group-add-member ad_admins_external --external 'AD/Domain Admins'
member group: AD\Domain Admins: trusted domain object not found
As far as I can tell, I have established a trust relationship between my
IPA realm (ipa.mydomain.com) and my AD domain (ad.mydomain.com). If I run
netdom query /d:AD.MYDOMAIN.COM TRUST I get:
<- ipa.mydomain.com Direct
I am assuming that the direction (<-) indicates that ipa trusts AD. From
the other side, everything looks ok to me:
# ipa trustdomain-find AD.MYDOMAIN.COM
Domain name: AD.MYDOMAIN.COM
Domain NetBIOS name: AD
Domain Security Identifier: S-1-5-21-3800000002-3276000039-3459556696
Domain enabled: True
----------------------------
Number of entries returned 1
----------------------------
In troubleshooting this, I ran:
# KRB5_TRACE=/dev/stderr kvno -S cifs ad.mydomain.com
The last two lines were:
[16487] 1505918874.707116: TGS request result: -1765328377/Server cifs/
ad.mydomain.com(a)IPA.MYDOMAIN.COM not found in Kerberos database
kvno: Server cifs/ad.mydomain.com(a)IPA.MYDOMAIN.COM not found in Kerberos
database while getting credentials for cifs/ad.mydomain.com(a)IPA.MYDOMAIN.COM
This led me to try the following (based on a tutorial I found), but with no
success:
# ipa service-add cifs/ad.mydomain.com(a)IPA.MYDOMAIN.COM --force
ipa: ERROR: The host 'ad.mydomain.com' does not exist to add a service to.
I am running CentOS 7 with ipa 4.5; all AD servers are running server 2016.
If anyone has any pointers which could help with this, I'd appreciate it.
Thanks!
Bob
6 years, 7 months
Can't log on using password when /tmp is full
by Marius Bjørnstad
Hi,
When /tmp is full, it is impossible to authenticate with Kerberos. Login with password over SSH and sudo don't work. Login with ssh key works fine. Here is the output in the system log when I try to log on via SSH with password auth (this is on RHEL 6):
Sep 18 16:56:59 vali sshd[35157]: Set /proc/self/oom_score_adj to 0
Sep 18 16:56:59 vali sshd[35157]: Connection from 192.168.1.48 port 49917
Sep 18 16:57:02 vali [sssd[krb5_child[35165]]]: Credentials cache I/O operation failed XXX
Sep 18 16:57:02 vali [sssd[krb5_child[35165]]]: Credentials cache I/O operation failed XXX
Sep 18 16:57:04 vali sshd[35157]: Failed password for paalmbj from 192.168.1.48 port 49917 ssh2
Sep 18 16:57:07 vali sshd[35158]: Connection closed by 192.168.1.48
From SSH I get:
Permission denied, please try again.
The problem seems to be that Kerberos can't store its credentials cache. Is this normal, and is there a way around it? Sure, ideally I should limit the space usable by each user, but that doesn't help when a given user needs to log in and fix their tmp usage.
Thanks,
Marius
6 years, 7 months
