April 2018 - FreeIPA-users - Fedora mailing-lists

some account not sync password from A/D
by Miguel Angel Coa M. 19 Apr '18

19 Apr '18

Hello Guy's, I have IPA server 4.5, conected to Windows AD the user replication is ok, but i have strange problem with password sync some user synchronize password without problem but other user account not password synchronize User ok (can successfully log in) [....................] User login: pruebas.sistemas First name: Pruebas Last name: Sistemas Home directory: /home/pruebas.sistemas Login shell: /bin/bash Principal alias: pruebas.sistemas(a)EXAMPLE.COM Email address: pruebas.sistemas(a)example.com UID: 494205252 GID: 494205252 Account disabled: False Password: True Kerberos keys available: True [....................] Log ssh auth [....................] Apr 17 16:45:03 odi-scan sshd[26044]: pam_sss(sshd:auth): authentication success; logname= uid=0 euid=0 tty=ssh ruser= rhost=10.191.3.30 user=pruebas.sistemas Apr 17 16:45:05 odi-scan sshd[26041]: Accepted keyboard-interactive/pam for pruebas.sistemas from 10.191.3.30 port 64603 ssh2 Apr 17 16:45:05 odi-scan sshd[26041]: pam_unix(sshd:session): session opened for user pruebas.sistemas by (uid=0) Apr 17 16:45:19 odi-scan sshd[26041]: pam_unix(sshd:session): session closed for user pruebas.sistemas [....................] User error (can't ssh log in) [....................] User login: rodrigo.gutierrez First name: Rodrigo Antonio Last name: Gutiérrez Torres Home directory: /home/rodrigo.gutierrez Login shell: /bin/bash Principal alias: rodrigo.gutierrez(a)EXAMPLE.COM Email address: rodrigo.gutierrez(a)example.com UID: 494206316 GID: 494206316 Telephone Number: +15013 Job Title: Ingeniero en Sistemas Account disabled: False Password: False Member of groups: admins Member of Sudo rule: admin-log Kerberos keys available: False [....................] Error to server client: [....................] Apr 17 17:06:54 odi-scan sshd[27243]: pam_sss(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=10.191.3.30 user=rodrigo.gutierrez Apr 17 17:06:54 odi-scan sshd[27243]: pam_sss(sshd:auth): received for user rodrigo.gutierrez: 17 (Failure setting user credentials) [....................] Two ssh connection is against the same server . Regards. Saludos. --- Miguel Coa M.

2 4

Unknown object class
by Duncan Colhoun 19 Apr '18

19 Apr '18

Hi When attempting to migrate an existing OpenLDAP server to FreeIPA (version 4.5.0 on Centos 7), I am getting the following error - unknown object class "ededuperson" If I look at the LDAP I can see edEduPerson OID: 1.2.826.0.1109.2.0.0 Description: Additional attributes for AuthLDAP Type: auxiliary Inherits from: eduPerson I have added the eduperson ldif to my FreeIPA server, cp /usr/share/dirsrv/schema/60eduperson.ldif /etc/dirsrv/slapd-XXXXXschema/ but I am unsure how to add the object class ededuperson. New to this - any help greatly appreciated Duncan

2 4

ipa-replica-install CA_REJECTED
by Angus Clarke 19 Apr '18

19 Apr '18

Hello We've failed to deploy a replica in a remote DC, initially the CA Master (ipa_server1) was in a location that this remote DC could not reach so I moved the CA to a contactable IPA server in another location (ipa_server2.) I still receive CA_REJECTED however and I suspect we may have hit https://bugzilla.redhat.com/show_bug.cgi?id=1498523 as the previous week, a colleague of mine rebuilt all of our existing IPA deployment using the Damascus Group export/import scripts (his task was to migrate from SUSE Linux to Oracle Linux and upgrade IPA to 4.5.0) If we have hit this issue, I do not feel comfortable carrying out the steps Flo mentions in #c24. 'ipa-getcert list' certainly shows the remote ipa install trying to connect to itself for certificates. After moving the CA Master to ipa_server2 (contactable) we get the same result as before for ipa-getcert list, but also notice an INFO message when running the ipa-replica-install command in the remote DC. == INFO Waiting up to 300 seconds to see our keys appear on host: ipa_server1 (the un-contactable one) == I thought connections between IPA servers were only required along replication agreement paths, this INFO message suggests we might need connectivity between all nodes - perhaps it's just during the install process - I'm unsure. So we've opted to connect the sssd clients in the remote DC to IPA servers in our 2 main DCs, which goes against best practises of having at least 2 IPA servers per DC. I will connect the clients to an IPA server in DC1 and another IPA server in DC2 as each DC has a VPN tunnel connecting to the remote site. The rhel7 documentation does not explain why best practises requires at least 2 IPAs per DC - any thoughts on this setup and best practises recommendation? Thanks for your time. Regards Angus

1 0

passsync and AD computer accounts
by Rob Brown 18 Apr '18

18 Apr '18

I have passsync configured and working just fine, but with one minor annoyance: the passsync.log file is filled with "computer account" password changes. Example: (first one is a user passwd change, second is computer account.) 04/16/18 09:02:02: Received passhook event. Attempting sync 04/16/18 09:02:02: 1 new entries loaded from data file 04/16/18 09:02:02: Cleared contents of data file 04/16/18 09:02:02: Password list has 1 entries 04/16/18 09:02:02: Attempting to sync password for userA 04/16/18 09:02:02: Searching for (ntuserdomainid=userA) 04/16/18 09:02:02: Password modified for remote entry: uid=userA,cn=users,cn=accounts,dc=domain,dc=com 04/16/18 09:02:02: Removing password change from list 04/16/18 09:02:02: Password list is empty. Waiting for passhook event 04/16/18 09:10:50: Received passhook event. Attempting sync 04/16/18 09:10:50: 1 new entries loaded from data file 04/16/18 09:10:50: Cleared contents of data file 04/16/18 09:10:50: Password list has 1 entries 04/16/18 09:10:50: Attempting to sync password for computerA$ 04/16/18 09:10:50: Searching for (ntuserdomainid=computerA$) 04/16/18 09:10:50: There are no entries that match: computerA$ 04/16/18 09:10:50: Deferring password change for computerA$ 04/16/18 09:10:50: Backing off for 2000ms 04/16/18 09:10:52: Backoff time expired. Attempting sync 04/16/18 09:10:52: Password list has 1 entries 04/16/18 09:10:52: Attempting to sync password for computerA$ 04/16/18 09:10:52: Searching for (ntuserdomainid=computerA$) 04/16/18 09:10:52: There are no entries that match: computerA$ 04/16/18 09:10:52: Deferring password change for computerA$ 04/16/18 09:10:52: Backing off for 4000ms ...and so on. Firstly: wondering if that's "normal" to see? Second: Is it possible to configure passync to only look for user password changes and ignore computer accounts? (or at least not log them). I coulda sworn I stumbled across something in the past showing how to configure it that way, but cannot find anything today.

3 3

sudo command group
by Andrew Meyer 18 Apr '18

18 Apr '18

So I'm having an issue with sudo policies where I have about ~200 commands in my sudoers, I added those commands to a group and I got an error in the WebUI: Search result has been truncated: Configured size limit exceeded Also when I run the ipa sudocmdgroup-show I don't see all the commands. Is there a limit to number of commands? Thanks!

2 3

sudoers questions
by Andrew Meyer 18 Apr '18

18 Apr '18

Hello, I have been doing a lot of research on trying to get host groups to work with sudoers policies. However I'm finding that this can't be done and the only achieved by using netgroups. Is this true? I just would like some validation/confirmation before I go to far down the rabbit hole.

2 3

ERR 20: Auth Rejected Credentials (client should begin new session)
by TomK 18 Apr '18

18 Apr '18

Hey All, I have an external NFS cluster serviced by a VIP. The clients run autofs configured via IPA to provide NFS home directories to client. However, running into an issue on one of the clients and wondering if anyone seen this message from a tcpdump of a simple mount session that's preventing the mount: psql02: mount nfs-c01:/n /m Yields this message ERR 20: Auth Rejected Credentials (client should begin new session) and the mount attempt never exits and never mounts /m . nfs-c01 is a VIP that's serviced by HAproxy / keepalived. nfs-c01 however has a record in IPA Server, both forward and a reverse one. Using one of the underlying hosts that services nfs-c01 works and mounts succeeds for them. All VM hosts are clones of the same template. I have autofs running as part of this IPA client setup and applied the following fix as well: https://access.redhat.com/solutions/3261981 /m is a test mount folder I'm using on this client to troubleshoot the autofs mounting issue. So autofs is also running on the same hosts where I'm trying this mount from. Trying to trace the exact source of this error and not quite sure where to look further. idmipa01/02 are the IPA servers. (192.168.0.44/45 respectively) psql01/02 are the problem VM's. (192.168.0.108/124 ) nfs01/02 are the NFS hosts. (192.168.0.131/119 ) nfs-c01 192.168.0.80 This works fine on the other two VM hosts without any issue but I just can't find any difference comparing all the configs and so looking for suggestions to bounce off of. -- Cheers, Tom K. ------------------------------------------------------------------------------------- Living on earth is expensive, but it includes a free trip around the sun. Apr 15 23:29:54 psql02 kernel: INFO: task mount.nfs:1443 blocked for more than 120 seconds. Apr 15 23:29:54 psql02 kernel: "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. Apr 15 23:29:54 psql02 kernel: mount.nfs D ffff880135ed8000 0 1443 1442 0x00000080 Apr 15 23:29:54 psql02 kernel: Call Trace: Apr 15 23:29:54 psql02 kernel: [<ffffffff816ac7c9>] schedule_preempt_disabled+0x29/0x70 Apr 15 23:29:54 psql02 kernel: [<ffffffff816aa5f7>] __mutex_lock_slowpath+0xc7/0x1d0 Apr 15 23:29:54 psql02 kernel: [<ffffffff816a9a0f>] mutex_lock+0x1f/0x2f Apr 15 23:29:54 psql02 kernel: [<ffffffffc05ddd58>] nfs4_discover_server_trunking+0x48/0x2e0 [nfsv4] Apr 15 23:29:54 psql02 kernel: [<ffffffffc05e6906>] nfs4_init_client+0x126/0x300 [nfsv4] Apr 15 23:29:54 psql02 kernel: [<ffffffff811e17d3>] ? kmem_cache_alloc+0x193/0x1e0 Apr 15 23:29:54 psql02 kernel: [<ffffffffc0562526>] ? __fscache_acquire_cookie+0x66/0x180 [fscache] Apr 15 23:29:54 psql02 kernel: [<ffffffffc0562526>] ? __fscache_acquire_cookie+0x66/0x180 [fscache] Apr 15 23:29:54 psql02 kernel: [<ffffffffc0341b61>] ? __rpc_init_priority_wait_queue+0x81/0xc0 [sunrpc] Apr 15 23:29:54 psql02 kernel: [<ffffffffc057c6d6>] nfs_get_client+0x2c6/0x3e0 [nfs] Apr 15 23:29:54 psql02 kernel: [<ffffffffc05e5de8>] nfs4_set_client+0x98/0x130 [nfsv4] Apr 15 23:29:54 psql02 kernel: [<ffffffffc05e75de>] nfs4_create_server+0x13e/0x3b0 [nfsv4] Apr 15 23:29:54 psql02 kernel: [<ffffffffc05de7ce>] nfs4_remote_mount+0x2e/0x60 [nfsv4] Apr 15 23:29:54 psql02 kernel: [<ffffffff81207549>] mount_fs+0x39/0x1b0 Apr 15 23:29:54 psql02 kernel: [<ffffffff811a7f25>] ? __alloc_percpu+0x15/0x20 Apr 15 23:29:54 psql02 kernel: [<ffffffff81224177>] vfs_kern_mount+0x67/0x110 Apr 15 23:29:54 psql02 kernel: [<ffffffffc05de6f6>] nfs_do_root_mount+0x86/0xc0 [nfsv4] Apr 15 23:29:54 psql02 kernel: [<ffffffffc05deaf4>] nfs4_try_mount+0x44/0xc0 [nfsv4] Apr 15 23:29:54 psql02 kernel: [<ffffffffc057d627>] ? get_nfs_version+0x27/0x90 [nfs] Apr 15 23:29:54 psql02 kernel: [<ffffffffc0589a95>] nfs_fs_mount+0x4c5/0xd90 [nfs] Apr 15 23:29:54 psql02 kernel: [<ffffffffc058a9c0>] ? nfs_clone_super+0x140/0x140 [nfs] Apr 15 23:29:54 psql02 kernel: [<ffffffffc05888c0>] ? param_set_portnr+0x70/0x70 [nfs] Apr 15 23:29:54 psql02 kernel: [<ffffffff81207549>] mount_fs+0x39/0x1b0 Apr 15 23:29:54 psql02 kernel: [<ffffffff811a7f25>] ? __alloc_percpu+0x15/0x20 Apr 15 23:29:54 psql02 kernel: [<ffffffff81224177>] vfs_kern_mount+0x67/0x110 Apr 15 23:29:54 psql02 kernel: [<ffffffff81226683>] do_mount+0x233/0xaf0 Apr 15 23:29:54 psql02 kernel: [<ffffffff812272c6>] SyS_mount+0x96/0xf0 Apr 15 23:29:54 psql02 kernel: [<ffffffff816b89fd>] system_call_fastpath+0x16/0x1b Apr 15 23:29:54 psql02 kernel: [<ffffffff816b889d>] ? system_call_after_swapgs+0xca/0x214 Message from syslogd@psql01 at Apr 17 03:08:31 ... kernel:NMI watchdog: BUG: soft lockup - CPU#0 stuck for 22s! [mount.nfs:1606] Linux psql02.nix.my.dom 3.10.0-693.21.1.el7.x86_64 #1 SMP Wed Mar 7 19:03:37 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux [root@nfs02 log]# tcpdump -i eth0|grep -v "192.168.0.76"|grep -v NLB|grep -v nfs01|grep -v netbios|grep -v NBT tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes 01:23:42.183158 IP nfs02.my.dom.xyz.60807 > idmipa01.my.dom.xyz.domain: 23358+ PTR? 76.0.168.192.in-addr.arpa. (43) 01:23:42.183884 IP idmipa01.my.dom.xyz.domain > nfs02.my.dom.xyz.60807: 23358 NXDomain* 0/1/0 (110) 01:23:42.184090 IP nfs02.my.dom.xyz.59911 > idmipa01.my.dom.xyz.domain: 29059+ PTR? 119.0.168.192.in-addr.arpa. (44) 01:23:42.184601 IP idmipa01.my.dom.xyz.domain > nfs02.my.dom.xyz.59911: 29059* 1/2/2 PTR nfs02.my.dom.xyz. (153) 01:23:42.184827 IP nfs02.my.dom.xyz.49329 > idmipa01.my.dom.xyz.domain: 50753+ PTR? 44.0.168.192.in-addr.arpa. (43) 01:23:42.185122 IP idmipa01.my.dom.xyz.domain > nfs02.my.dom.xyz.49329: 50753* 1/2/2 PTR idmipa01.my.dom.xyz. (146) 01:23:42.250263 IP nfs02.my.dom.xyz.49035 > idmipa01.my.dom.xyz.domain: 17264+ PTR? 255.0.168.192.in-addr.arpa. (44) 01:23:42.250983 IP idmipa01.my.dom.xyz.domain > nfs02.my.dom.xyz.49035: 17264 NXDomain* 0/1/0 (111) 01:23:42.257700 IP nfs02.my.dom.xyz.51938 > idmipa01.my.dom.xyz.domain: 51451+ PTR? 131.0.168.192.in-addr.arpa. (44) 01:23:42.360669 IP nfs02.my.dom.xyz.46447 > idmipa01.my.dom.xyz.domain: 12552+ PTR? 224.0.168.192.in-addr.arpa. (44) 01:23:42.361247 IP idmipa01.my.dom.xyz.domain > nfs02.my.dom.xyz.46447: 12552 NXDomain* 0/1/0 (111) 01:23:42.361434 IP nfs02.my.dom.xyz.37305 > idmipa01.my.dom.xyz.domain: 34850+ PTR? 223.0.168.192.in-addr.arpa. (44) 01:23:42.361766 IP idmipa01.my.dom.xyz.domain > nfs02.my.dom.xyz.37305: 34850 NXDomain* 0/1/0 (111) 01:23:42.420742 IP nfs02.my.dom.xyz > vrrp.mcast.net: VRRPv2, Advertisement, vrid 51, prio 104, authtype none, intvl 1s, length 20 01:23:42.421026 IP nfs02.my.dom.xyz.58510 > idmipa01.my.dom.xyz.domain: 7249+ PTR? 18.0.0.224.in-addr.arpa. (41) 01:23:42.421745 IP idmipa01.my.dom.xyz.domain > nfs02.my.dom.xyz.58510: 7249 1/13/0 PTR vrrp.mcast.net. (277) 01:23:42.751583 IP nfs02.my.dom.xyz.43409 > idmipa01.my.dom.xyz.domain: 29327+ PTR? 222.0.168.192.in-addr.arpa. (44) 01:23:42.752250 IP idmipa01.my.dom.xyz.domain > nfs02.my.dom.xyz.43409: 29327 NXDomain* 0/1/0 (111) 01:23:43.421723 IP nfs02.my.dom.xyz > vrrp.mcast.net: VRRPv2, Advertisement, vrid 51, prio 104, authtype none, intvl 1s, length 20 01:23:44.422648 IP nfs02.my.dom.xyz > vrrp.mcast.net: VRRPv2, Advertisement, vrid 51, prio 104, authtype none, intvl 1s, length 20 01:23:45.423492 IP nfs02.my.dom.xyz > vrrp.mcast.net: VRRPv2, Advertisement, vrid 51, prio 104, authtype none, intvl 1s, length 20 01:23:46.424492 IP nfs02.my.dom.xyz > vrrp.mcast.net: VRRPv2, Advertisement, vrid 51, prio 104, authtype none, intvl 1s, length 20 01:23:47.188951 ARP, Request who-has nfs02.my.dom.xyz tell idmipa01.my.dom.xyz, length 46 01:23:47.188966 ARP, Reply nfs02.my.dom.xyz is-at 00:50:56:86:2d:21 (oui Unknown), length 28 01:23:47.248948 ARP, Request who-has 192.168.0.103 tell 192.168.0.222, length 46 01:23:47.249297 IP nfs02.my.dom.xyz.50518 > idmipa01.my.dom.xyz.domain: 46693+ PTR? 103.0.168.192.in-addr.arpa. (44) 01:23:47.250150 IP idmipa01.my.dom.xyz.domain > nfs02.my.dom.xyz.50518: 46693 NXDomain* 0/1/0 (111) 01:23:47.425440 IP nfs02.my.dom.xyz > vrrp.mcast.net: VRRPv2, Advertisement, vrid 51, prio 104, authtype none, intvl 1s, length 20 01:23:48.426303 IP nfs02.my.dom.xyz > vrrp.mcast.net: VRRPv2, Advertisement, vrid 51, prio 104, authtype none, intvl 1s, length 20 01:23:49.427153 IP nfs02.my.dom.xyz > vrrp.mcast.net: VRRPv2, Advertisement, vrid 51, prio 104, authtype none, intvl 1s, length 20 01:23:50.428133 IP nfs02.my.dom.xyz > vrrp.mcast.net: VRRPv2, Advertisement, vrid 51, prio 104, authtype none, intvl 1s, length 20 01:23:51.428574 IP psql02.my.dom.xyz.885 > nfs-c01.my.dom.xyz.nfs: Flags [S], seq 1812770089, win 29200, options [mss 1460,sackOK,TS val 167449689 ecr 0,nop,wscale 7], length 0 01:23:51.428634 IP nfs-c01.my.dom.xyz.nfs > psql02.my.dom.xyz.885: Flags [S.], seq 2612074554, ack 1812770090, win 28960, options [mss 1460,sackOK,TS val 172963836 ecr 167449689,nop,wscale 7], length 0 01:23:51.428787 IP psql02.my.dom.xyz.885 > nfs-c01.my.dom.xyz.nfs: Flags [.], ack 1, win 229, options [nop,nop,TS val 167449689 ecr 172963836], length 0 01:23:51.428838 IP psql02.my.dom.xyz.885 > nfs-c01.my.dom.xyz.nfs: Flags [P.], seq 1:45, ack 1, win 229, options [nop,nop,TS val 167449689 ecr 172963836], length 44: NFS request xid 2544096005 40 null 01:23:51.428859 IP nfs-c01.my.dom.xyz.nfs > psql02.my.dom.xyz.885: Flags [.], ack 45, win 227, options [nop,nop,TS val 172963836 ecr 167449689], length 0 01:23:51.429003 IP nfs02.my.dom.xyz > vrrp.mcast.net: VRRPv2, Advertisement, vrid 51, prio 104, authtype none, intvl 1s, length 20 01:23:51.429079 IP nfs02.my.dom.xyz.52213 > idmipa01.my.dom.xyz.domain: 17880+ PTR? 80.0.168.192.in-addr.arpa. (43) 01:23:51.429514 IP idmipa01.my.dom.xyz.domain > nfs02.my.dom.xyz.52213: 17880* 1/2/2 PTR nfs-c01.my.dom.xyz. (154) 01:23:51.429748 IP nfs02.my.dom.xyz.58966 > idmipa01.my.dom.xyz.domain: 50455+ PTR? 124.0.168.192.in-addr.arpa. (44) 01:23:51.430092 IP idmipa01.my.dom.xyz.domain > nfs02.my.dom.xyz.58966: 50455* 1/2/2 PTR psql02.my.dom.xyz. (154) 01:23:51.430129 IP nfs-c01.my.dom.xyz.nfs > psql02.my.dom.xyz.885: Flags [P.], seq 1:29, ack 45, win 227, options [nop,nop,TS val 172963838 ecr 167449689], length 28: NFS reply xid 2544096005 reply ok 24 null 01:23:51.430247 IP psql02.my.dom.xyz.885 > nfs-c01.my.dom.xyz.nfs: Flags [.], ack 29, win 229, options [nop,nop,TS val 167449690 ecr 172963838], length 0 01:23:51.433079 IP psql02.my.dom.xyz.40999 > nfs-c01.my.dom.xyz.nfs: Flags [S], seq 3882292069, win 29200, options [mss 1460,sackOK,TS val 167449693 ecr 0,nop,wscale 7], length 0 01:23:51.433124 IP nfs-c01.my.dom.xyz.nfs > psql02.my.dom.xyz.40999: Flags [S.], seq 876416044, ack 3882292070, win 28960, options [mss 1460,sackOK,TS val 172963841 ecr 167449693,nop,wscale 7], length 0 01:23:51.433214 IP psql02.my.dom.xyz.40999 > nfs-c01.my.dom.xyz.nfs: Flags [.], ack 1, win 229, options [nop,nop,TS val 167449693 ecr 172963841], length 0 01:23:51.435147 IP psql02.my.dom.xyz.40999 > nfs-c01.my.dom.xyz.nfs: Flags [P.], seq 1:693, ack 1, win 229, options [nop,nop,TS val 167449695 ecr 172963841], length 692: NFS request xid 3844890745 688 null 01:23:51.435184 IP nfs-c01.my.dom.xyz.nfs > psql02.my.dom.xyz.40999: Flags [.], ack 693, win 238, options [nop,nop,TS val 172963843 ecr 167449695], length 0 01:23:51.436257 IP nfs-c01.my.dom.xyz.nfs > psql02.my.dom.xyz.40999: Flags [P.], seq 1:25, ack 693, win 238, options [nop,nop,TS val 172963844 ecr 167449695], length 24: NFS reply xid 3844890745 reply ERR 20: Auth Rejected Credentials (client should begin new session) 01:23:51.436374 IP psql02.my.dom.xyz.40999 > nfs-c01.my.dom.xyz.nfs: Flags [.], ack 25, win 229, options [nop,nop,TS val 167449697 ecr 172963844], length 0 01:23:51.483369 IP nfs02.my.dom.xyz.53527 > idmipa01.my.dom.xyz.domain: 62714+ PTR? 105.0.168.192.in-addr.arpa. (44) 01:23:51.484027 IP idmipa01.my.dom.xyz.domain > nfs02.my.dom.xyz.53527: 62714 NXDomain* 0/1/0 (111) 01:23:51.487612 IP nfs02.my.dom.xyz.41147 > idmipa01.my.dom.xyz.domain: 4106+ PTR? 100.0.168.192.in-addr.arpa. (44) 01:23:51.487992 IP idmipa01.my.dom.xyz.domain > nfs02.my.dom.xyz.41147: 4106 NXDomain* 0/1/0 (111) 01:23:52.429933 IP nfs02.my.dom.xyz > vrrp.mcast.net: VRRPv2, Advertisement, vrid 51, prio 104, authtype none, intvl 1s, length 20 01:23:53.430801 IP nfs02.my.dom.xyz > vrrp.mcast.net: VRRPv2, Advertisement, vrid 51, prio 104, authtype none, intvl 1s, length 20 01:23:54.432246 IP nfs02.my.dom.xyz > vrrp.mcast.net: VRRPv2, Advertisement, vrid 51, prio 104, authtype none, intvl 1s, length 20 01:23:55.433173 IP nfs02.my.dom.xyz > vrrp.mcast.net: VRRPv2, Advertisement, vrid 51, prio 104, authtype none, intvl 1s, length 20 01:23:55.453824 IP ovirt01.my.dom.xyz.843 > nfs-c01.my.dom.xyz.nfs: Flags [P.], seq 2034285336:2034285468, ack 3501594280, win 614, options [nop,nop,TS val 272589184 ecr 172927798], length 132: NFS request xid 2543449196 128 getattr fh 0,1/53 01:23:55.454235 IP nfs02.my.dom.xyz.34495 > idmipa01.my.dom.xyz.domain: 10353+ PTR? 145.0.168.192.in-addr.arpa. (44) 01:23:55.454456 IP nfs-c01.my.dom.xyz.nfs > ovirt01.my.dom.xyz.843: Flags [P.], seq 1:85, ack 132, win 788, options [nop,nop,TS val 172967862 ecr 272589184], length 84: NFS reply xid 2543449196 reply ok 80 getattr NON 1 ids 0/50331648 sz 1518458202 01:23:55.454669 IP ovirt01.my.dom.xyz.843 > nfs-c01.my.dom.xyz.nfs: Flags [.], ack 85, win 614, options [nop,nop,TS val 272589185 ecr 172967862], length 0 01:23:55.455038 IP idmipa01.my.dom.xyz.domain > nfs02.my.dom.xyz.34495: 10353* 1/2/2 PTR ovirt01.my.dom.xyz. (155) 01:23:56.434163 IP nfs02.my.dom.xyz > vrrp.mcast.net: VRRPv2, Advertisement, vrid 51, prio 104, authtype none, intvl 1s, length 20 01:23:56.443495 ARP, Request who-has nfs-c01.my.dom.xyz tell psql02.my.dom.xyz, length 46 01:23:56.443577 ARP, Reply nfs-c01.my.dom.xyz is-at 00:50:56:86:2d:21 (oui Unknown), length 28 01:23:56.541140 IP nfs02.my.dom.xyz.51079 > idmipa01.my.dom.xyz.domain: 58928+ PTR? 14.0.168.192.in-addr.arpa. (43) 01:23:56.541904 IP idmipa01.my.dom.xyz.domain > nfs02.my.dom.xyz.51079: 58928 NXDomain* 0/1/0 (110) 01:23:57.435087 IP nfs02.my.dom.xyz > vrrp.mcast.net: VRRPv2, Advertisement, vrid 51, prio 104, authtype none, intvl 1s, length 20 01:23:58.436052 IP nfs02.my.dom.xyz > vrrp.mcast.net: VRRPv2, Advertisement, vrid 51, prio 104, authtype none, intvl 1s, length 20 01:23:59.437014 IP nfs02.my.dom.xyz > vrrp.mcast.net: VRRPv2, Advertisement, vrid 51, prio 104, authtype none, intvl 1s, length 20 01:24:00.437885 IP nfs02.my.dom.xyz > vrrp.mcast.net: VRRPv2, Advertisement, vrid 51, prio 104, authtype none, intvl 1s, length 20 01:24:00.456019 ARP, Request who-has ovirt01.my.dom.xyz tell nfs02.my.dom.xyz, length 28 01:24:00.456439 ARP, Reply ovirt01.my.dom.xyz is-at 00:50:56:86:f7:7e (oui Unknown), length 46 01:24:00.461740 ARP, Request who-has nfs-c01.my.dom.xyz tell ovirt01.my.dom.xyz, length 46 01:24:00.461754 ARP, Reply nfs-c01.my.dom.xyz is-at 00:50:56:86:2d:21 (oui Unknown), length 28 01:24:01.233709 ARP, Request who-has 192.168.0.222 tell 192.168.0.221, length 46 01:24:01.234102 IP nfs02.my.dom.xyz.56105 > idmipa01.my.dom.xyz.domain: 38431+ PTR? 221.0.168.192.in-addr.arpa. (44) 01:24:01.234620 ARP, Request who-has 192.168.0.221 tell 192.168.0.222, length 46 01:24:01.234749 IP idmipa01.my.dom.xyz.domain > nfs02.my.dom.xyz.56105: 38431 NXDomain* 0/1/0 (111) 01:24:01.438897 IP nfs02.my.dom.xyz > vrrp.mcast.net: VRRPv2, Advertisement, vrid 51, prio 104, authtype none, intvl 1s, length 20 01:24:02.439939 IP nfs02.my.dom.xyz > vrrp.mcast.net: VRRPv2, Advertisement, vrid 51, prio 104, authtype none, intvl 1s, length 20 01:24:03.440864 IP nfs02.my.dom.xyz > vrrp.mcast.net: VRRPv2, Advertisement, vrid 51, prio 104, authtype none, intvl 1s, length 20 01:24:03.552006 ARP, Request who-has 192.168.0.1 tell 192.168.0.105, length 46 01:24:03.552336 IP nfs02.my.dom.xyz.46470 > idmipa01.my.dom.xyz.domain: 51908+ PTR? 1.0.168.192.in-addr.arpa. (42) 01:24:03.552821 IP idmipa01.my.dom.xyz.domain > nfs02.my.dom.xyz.46470: 51908 NXDomain* 0/1/0 (109) 01:24:03.563789 ARP, Request who-has 192.168.0.1 tell 192.168.0.100, length 46 01:24:04.441825 IP nfs02.my.dom.xyz > vrrp.mcast.net: VRRPv2, Advertisement, vrid 51, prio 104, authtype none, intvl 1s, length 20 01:24:04.947786 ARP, Request who-has idmipa01.my.dom.xyz tell 192.168.0.220, length 46 01:24:04.948254 IP nfs02.my.dom.xyz.57360 > idmipa01.my.dom.xyz.domain: 43921+ PTR? 220.0.168.192.in-addr.arpa. (44) 01:24:04.949368 IP idmipa01.my.dom.xyz.domain > nfs02.my.dom.xyz.57360: 43921 NXDomain* 0/1/0 (111) 01:24:05.442850 IP nfs02.my.dom.xyz > vrrp.mcast.net: VRRPv2, Advertisement, vrid 51, prio 104, authtype none, intvl 1s, length 20 01:24:05.545549 IP 192.168.0.236.connendp > nfs-c01.my.dom.xyz.nfs: Flags [P.], seq 3632955218:3632955354, ack 762815828, win 229, options [nop,nop,TS val 797511168 ecr 172937890], length 136: NFS request xid 351180291 132 getattr fh 0,1/53 01:24:05.545893 IP nfs02.my.dom.xyz.44899 > idmipa01.my.dom.xyz.domain: 42739+ PTR? 236.0.168.192.in-addr.arpa. (44) 01:24:05.546508 IP idmipa01.my.dom.xyz.domain > nfs02.my.dom.xyz.44899: 42739 NXDomain* 0/1/0 (111) 01:24:05.546662 IP nfs-c01.my.dom.xyz.nfs > 192.168.0.236.connendp: Flags [P.], seq 1:85, ack 136, win 361, options [nop,nop,TS val 172977954 ecr 797511168], length 84: NFS reply xid 351180291 reply ok 80 getattr NON 1 ids 0/83886080 sz 260232538 01:24:05.546890 IP 192.168.0.236.connendp > nfs-c01.my.dom.xyz.nfs: Flags [.], ack 85, win 229, options [nop,nop,TS val 797511169 ecr 172977954], length 0 01:24:06.443781 IP nfs02.my.dom.xyz > vrrp.mcast.net: VRRPv2, Advertisement, vrid 51, prio 104, authtype none, intvl 1s, length 20 01:24:07.444765 IP nfs02.my.dom.xyz > vrrp.mcast.net: VRRPv2, Advertisement, vrid 51, prio 104, authtype none, intvl 1s, length 20 01:24:08.445813 IP nfs02.my.dom.xyz > vrrp.mcast.net: VRRPv2, Advertisement, vrid 51, prio 104, authtype none, intvl 1s, length 20 01:24:08.568058 ARP, Request who-has idmipa01.my.dom.xyz tell nfs02.my.dom.xyz, length 28 01:24:08.568511 ARP, Reply idmipa01.my.dom.xyz is-at 00:50:56:86:0d:fa (oui Unknown), length 46 01:24:08.898274 ARP, Request who-has 192.168.0.14 tell 192.168.0.2, length 46 01:24:08.898657 IP nfs02.my.dom.xyz.54390 > idmipa01.my.dom.xyz.domain: 42138+ PTR? 2.0.168.192.in-addr.arpa. (42) 01:24:08.899280 IP idmipa01.my.dom.xyz.domain > nfs02.my.dom.xyz.54390: 42138 NXDomain* 0/1/0 (109) 01:24:08.899574 ARP, Request who-has 192.168.0.14 tell 192.168.0.222, length 46 01:24:09.446886 IP nfs02.my.dom.xyz > vrrp.mcast.net: VRRPv2, Advertisement, vrid 51, prio 104, authtype none, intvl 1s, length 20 01:24:10.447830 IP nfs02.my.dom.xyz > vrrp.mcast.net: VRRPv2, Advertisement, vrid 51, prio 104, authtype none, intvl 1s, length 20 01:24:10.552020 ARP, Request who-has 192.168.0.236 tell nfs02.my.dom.xyz, length 28 01:24:10.552560 ARP, Reply 192.168.0.236 is-at 00:50:56:86:d7:4c (oui Unknown), length 46 01:24:10.553359 ARP, Request who-has nfs-c01.my.dom.xyz tell 192.168.0.236, length 46 01:24:10.553369 ARP, Reply nfs-c01.my.dom.xyz is-at 00:50:56:86:2d:21 (oui Unknown), length 28 01:24:11.448844 IP nfs02.my.dom.xyz > vrrp.mcast.net: VRRPv2, Advertisement, vrid 51, prio 104, authtype none, intvl 1s, length 20 01:24:12.449409 IP nfs02.my.dom.xyz > vrrp.mcast.net: VRRPv2, Advertisement, vrid 51, prio 104, authtype none, intvl 1s, length 20 01:24:12.832432 ARP, Request who-has idmipa02.my.dom.xyz tell 192.168.0.1, length 46 01:24:12.832806 IP nfs02.my.dom.xyz.33863 > idmipa01.my.dom.xyz.domain: 37466+ PTR? 45.0.168.192.in-addr.arpa. (43) 01:24:12.833413 IP idmipa01.my.dom.xyz.domain > nfs02.my.dom.xyz.33863: 37466* 1/2/2 PTR idmipa02.my.dom.xyz. (146) 01:24:13.450394 IP nfs02.my.dom.xyz > vrrp.mcast.net: VRRPv2, Advertisement, vrid 51, prio 104, authtype none, intvl 1s, length 20 01:24:14.040800 IP nfs-c01.my.dom.xyz.nfs > psql02.my.dom.xyz.802: Flags [F.], seq 2201716585, ack 1255679435, win 227, options [nop,nop,TS val 172986448 ecr 167412300], length 0 01:24:14.041146 IP psql02.my.dom.xyz.802 > nfs-c01.my.dom.xyz.nfs: Flags [F.], seq 1, ack 1, win 229, options [nop,nop,TS val 167472301 ecr 172986448], length 0 01:24:14.041250 IP nfs-c01.my.dom.xyz.nfs > psql02.my.dom.xyz.802: Flags [.], ack 2, win 227, options [nop,nop,TS val 172986449 ecr 167472301], length 0 01:24:14.046310 IP nfs-c01.my.dom.xyz.nfs > psql02.my.dom.xyz.58177: Flags [F.], seq 4209302181, ack 3983186871, win 238, options [nop,nop,TS val 172986454 ecr 167412306], length 0 01:24:14.086690 IP psql02.my.dom.xyz.58177 > nfs-c01.my.dom.xyz.nfs: Flags [.], ack 1, win 229, options [nop,nop,TS val 167472347 ecr 172986454], length 0 01:24:14.451465 IP nfs02.my.dom.xyz > vrrp.mcast.net: VRRPv2, Advertisement, vrid 51, prio 104, authtype none, intvl 1s, length 20 01:24:15.452474 IP nfs02.my.dom.xyz > vrrp.mcast.net: VRRPv2, Advertisement, vrid 51, prio 104, authtype none, intvl 1s, length 20 01:24:16.453415 IP nfs02.my.dom.xyz > vrrp.mcast.net: VRRPv2, Advertisement, vrid 51, prio 104, authtype none, intvl 1s, length 20 01:24:17.454417 IP nfs02.my.dom.xyz > vrrp.mcast.net: VRRPv2, Advertisement, vrid 51, prio 104, authtype none, intvl 1s, length 20 01:24:18.455350 IP nfs02.my.dom.xyz > vrrp.mcast.net: VRRPv2, Advertisement, vrid 51, prio 104, authtype none, intvl 1s, length 20 01:24:19.456342 IP nfs02.my.dom.xyz > vrrp.mcast.net: VRRPv2, Advertisement, vrid 51, prio 104, authtype none, intvl 1s, length 20 01:24:20.457423 IP nfs02.my.dom.xyz > vrrp.mcast.net: VRRPv2, Advertisement, vrid 51, prio 104, authtype none, intvl 1s, length 20 01:24:21.079896 ARP, Request who-has 192.168.0.223 tell 192.168.0.220, length 46 01:24:21.080332 ARP, Request who-has 192.168.0.220 tell 192.168.0.223, length 46 01:24:21.458358 IP nfs02.my.dom.xyz > vrrp.mcast.net: VRRPv2, Advertisement, vrid 51, prio 104, authtype none, intvl 1s, length 20 01:24:22.459358 IP nfs02.my.dom.xyz > vrrp.mcast.net: VRRPv2, Advertisement, vrid 51, prio 104, authtype none, intvl 1s, length 20 01:24:22.628588 ARP, Reply nfs02.my.dom.xyz is-at 00:50:56:86:2d:21 (oui Unknown), length 28 01:24:23.460347 IP nfs02.my.dom.xyz > vrrp.mcast.net: VRRPv2, Advertisement, vrid 51, prio 104, authtype none, intvl 1s, length 20 01:24:24.461359 IP nfs02.my.dom.xyz > vrrp.mcast.net: VRRPv2, Advertisement, vrid 51, prio 104, authtype none, intvl 1s, length 20 01:24:25.462168 IP nfs02.my.dom.xyz > vrrp.mcast.net: VRRPv2, Advertisement, vrid 51, prio 104, authtype none, intvl 1s, length 20 01:24:26.463188 IP nfs02.my.dom.xyz > vrrp.mcast.net: VRRPv2, Advertisement, vrid 51, prio 104, authtype none, intvl 1s, length 20 01:24:27.464196 IP nfs02.my.dom.xyz > vrrp.mcast.net: VRRPv2, Advertisement, vrid 51, prio 104, authtype none, intvl 1s, length 20 01:24:28.465215 IP nfs02.my.dom.xyz > vrrp.mcast.net: VRRPv2, Advertisement, vrid 51, prio 104, authtype none, intvl 1s, length 20 01:24:29.466269 IP nfs02.my.dom.xyz > vrrp.mcast.net: VRRPv2, Advertisement, vrid 51, prio 104, authtype none, intvl 1s, length 20 01:24:30.467227 IP nfs02.my.dom.xyz > vrrp.mcast.net: VRRPv2, Advertisement, vrid 51, prio 104, authtype none, intvl 1s, length 20 01:24:31.468185 IP nfs02.my.dom.xyz > vrrp.mcast.net: VRRPv2, Advertisement, vrid 51, prio 104, authtype none, intvl 1s, length 20 01:24:32.469246 IP nfs02.my.dom.xyz > vrrp.mcast.net: VRRPv2, Advertisement, vrid 51, prio 104, authtype none, intvl 1s, length 20 01:24:33.470258 IP nfs02.my.dom.xyz > vrrp.mcast.net: VRRPv2, Advertisement, vrid 51, prio 104, authtype none, intvl 1s, length 20 01:24:34.471274 IP nfs02.my.dom.xyz > vrrp.mcast.net: VRRPv2, Advertisement, vrid 51, prio 104, authtype none, intvl 1s, length 20 01:24:35.472280 IP nfs02.my.dom.xyz > vrrp.mcast.net: VRRPv2, Advertisement, vrid 51, prio 104, authtype none, intvl 1s, length 20 01:24:35.517800 IP ovirt01.my.dom.xyz.843 > nfs-c01.my.dom.xyz.nfs: Flags [P.], seq 132:264, ack 85, win 614, options [nop,nop,TS val 272629248 ecr 172967862], length 132: NFS request xid 2560226412 128 getattr fh 0,1/53 01:24:35.518462 IP nfs-c01.my.dom.xyz.nfs > ovirt01.my.dom.xyz.843: Flags [P.], seq 85:169, ack 264, win 796, options [nop,nop,TS val 173007926 ecr 272629248], length 84: NFS reply xid 2560226412 reply ok 80 getattr NON 1 ids 0/50331648 sz 1518458202 01:24:35.518691 IP ovirt01.my.dom.xyz.843 > nfs-c01.my.dom.xyz.nfs: Flags [.], ack 169, win 614, options [nop,nop,TS val 272629249 ecr 173007926], length 0 01:24:36.473289 IP nfs02.my.dom.xyz > vrrp.mcast.net: VRRPv2, Advertisement, vrid 51, prio 104, authtype none, intvl 1s, length 20 01:24:37.474260 IP nfs02.my.dom.xyz > vrrp.mcast.net: VRRPv2, Advertisement, vrid 51, prio 104, authtype none, intvl 1s, length 20 01:24:38.475265 IP nfs02.my.dom.xyz > vrrp.mcast.net: VRRPv2, Advertisement, vrid 51, prio 104, authtype none, intvl 1s, length 20 01:24:39.476199 IP nfs02.my.dom.xyz > vrrp.mcast.net: VRRPv2, Advertisement, vrid 51, prio 104, authtype none, intvl 1s, length 20 01:24:39.786771 ARP, Request who-has idmipa02.my.dom.xyz tell 192.168.0.222, length 46 01:24:40.477213 IP nfs02.my.dom.xyz > vrrp.mcast.net: VRRPv2, Advertisement, vrid 51, prio 104, authtype none, intvl 1s, length 20 01:24:40.520055 ARP, Request who-has ovirt01.my.dom.xyz tell nfs02.my.dom.xyz, length 28 01:24:40.520485 ARP, Reply ovirt01.my.dom.xyz is-at 00:50:56:86:f7:7e (oui Unknown), length 46 01:24:40.525642 ARP, Request who-has nfs-c01.my.dom.xyz tell ovirt01.my.dom.xyz, length 46 01:24:40.525653 ARP, Reply nfs-c01.my.dom.xyz is-at 00:50:56:86:2d:21 (oui Unknown), length 28 01:24:41.478228 IP nfs02.my.dom.xyz > vrrp.mcast.net: VRRPv2, Advertisement, vrid 51, prio 104, authtype none, intvl 1s, length 20 01:24:42.478738 IP nfs02.my.dom.xyz > vrrp.mcast.net: VRRPv2, Advertisement, vrid 51, prio 104, authtype none, intvl 1s, length 20 01:24:43.479744 IP nfs02.my.dom.xyz > vrrp.mcast.net: VRRPv2, Advertisement, vrid 51, prio 104, authtype none, intvl 1s, length 20 01:24:44.480774 IP nfs02.my.dom.xyz > vrrp.mcast.net: VRRPv2, Advertisement, vrid 51, prio 104, authtype none, intvl 1s, length 20 01:24:45.481793 IP nfs02.my.dom.xyz > vrrp.mcast.net: VRRPv2, Advertisement, vrid 51, prio 104, authtype none, intvl 1s, length 20 01:24:45.609470 IP 192.168.0.236.connendp > nfs-c01.my.dom.xyz.nfs: Flags [P.], seq 136:272, ack 85, win 229, options [nop,nop,TS val 797551232 ecr 172977954], length 136: NFS request xid 367957507 132 getattr fh 0,1/53 01:24:45.610283 IP nfs-c01.my.dom.xyz.nfs > 192.168.0.236.connendp: Flags [P.], seq 85:169, ack 272, win 369, options [nop,nop,TS val 173018018 ecr 797551232], length 84: NFS reply xid 367957507 reply ok 80 getattr NON 1 ids 0/83886080 sz 260232538 01:24:45.610540 IP 192.168.0.236.connendp > nfs-c01.my.dom.xyz.nfs: Flags [.], ack 169, win 229, options [nop,nop,TS val 797551233 ecr 173018018], length 0 01:24:46.482737 IP nfs02.my.dom.xyz > vrrp.mcast.net: VRRPv2, Advertisement, vrid 51, prio 104, authtype none, intvl 1s, length 20 01:24:47.483693 IP nfs02.my.dom.xyz > vrrp.mcast.net: VRRPv2, Advertisement, vrid 51, prio 104, authtype none, intvl 1s, length 20 01:24:48.484672 IP nfs02.my.dom.xyz > vrrp.mcast.net: VRRPv2, Advertisement, vrid 51, prio 104, authtype none, intvl 1s, length 20 01:24:49.485644 IP nfs02.my.dom.xyz > vrrp.mcast.net: VRRPv2, Advertisement, vrid 51, prio 104, authtype none, intvl 1s, length 20 01:24:50.486707 IP nfs02.my.dom.xyz > vrrp.mcast.net: VRRPv2, Advertisement, vrid 51, prio 104, authtype none, intvl 1s, length 20 01:24:50.615938 ARP, Request who-has 192.168.0.236 tell nfs02.my.dom.xyz, length 28 01:24:50.616486 ARP, Reply 192.168.0.236 is-at 00:50:56:86:d7:4c (oui Unknown), length 46 01:24:50.617258 ARP, Request who-has nfs-c01.my.dom.xyz tell 192.168.0.236, length 46 01:24:50.617273 ARP, Reply nfs-c01.my.dom.xyz is-at 00:50:56:86:2d:21 (oui Unknown), length 28 01:24:51.432203 IP nfs-c01.my.dom.xyz.nfs > psql02.my.dom.xyz.885: Flags [F.], seq 29, ack 45, win 227, options [nop,nop,TS val 173023840 ecr 167449690], length 0 01:24:51.432585 IP psql02.my.dom.xyz.885 > nfs-c01.my.dom.xyz.nfs: Flags [F.], seq 45, ack 30, win 229, options [nop,nop,TS val 167509693 ecr 173023840], length 0 01:24:51.432617 IP nfs-c01.my.dom.xyz.nfs > psql02.my.dom.xyz.885: Flags [.], ack 46, win 227, options [nop,nop,TS val 173023840 ecr 167509693], length 0 01:24:51.437650 IP nfs-c01.my.dom.xyz.nfs > psql02.my.dom.xyz.40999: Flags [F.], seq 25, ack 693, win 238, options [nop,nop,TS val 173023845 ecr 167449697], length 0 01:24:51.477546 IP psql02.my.dom.xyz.40999 > nfs-c01.my.dom.xyz.nfs: Flags [.], ack 26, win 229, options [nop,nop,TS val 167509738 ecr 173023845], length 0 01:24:51.487729 IP nfs02.my.dom.xyz > vrrp.mcast.net: VRRPv2, Advertisement, vrid 51, prio 104, authtype none, intvl 1s, length 20 01:24:52.488796 IP nfs02.my.dom.xyz > vrrp.mcast.net: VRRPv2, Advertisement, vrid 51, prio 104, authtype none, intvl 1s, length 20 01:24:53.489834 IP nfs02.my.dom.xyz > vrrp.mcast.net: VRRPv2, Advertisement, vrid 51, prio 104, authtype none, intvl 1s, length 20 01:24:54.490898 IP nfs02.my.dom.xyz > vrrp.mcast.net: VRRPv2, Advertisement, vrid 51, prio 104, authtype none, intvl 1s, length 20 01:24:55.492024 IP nfs02.my.dom.xyz > vrrp.mcast.net: VRRPv2, Advertisement, vrid 51, prio 104, authtype none, intvl 1s, length 20 ^C1161 packets captured 1162 packets received by filter 0 packets dropped by kernel [root@nfs02 log]#

1 0

IPA Error 4203: DatabaseError: Constraint violation: Too soon to change password.
by TomK 16 Apr '18

16 Apr '18

Hey Guy's, Not 'really' an issue but curious about the logic behind this scenario. I get a message saying "Your password expires in 4 days." So I go to change it for the admin user (I'm reusing the same pass) and type it in but then get this message: IPA Error 4203: DatabaseError Constraint violation: Too soon to change password. I do have a replica but no errors in the log (grep -Ei error /var/log/ipa/* yields no results on both nodes). So then why the message? Shouldn't it be perfectly legit to change the pass before it's expiration? Would like to be able to change it because in 4 days it won't be very convenient for me to do so. -- Cheers, Tom K. ------------------------------------------------------------------------------------- Living on earth is expensive, but it includes a free trip around the sun.

2 1

Cannot figure out why ipa-server-install says ipv6 ::1 is not assigned
by Paul Raines 13 Apr '18

13 Apr '18

Can anyone tell me why ipa-server-install is saying the ::1 address is not assigned [root@vm2test1 ~]# ip addr 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo valid_lft forever preferred_lft forever inet6 ::1/128 scope host valid_lft forever preferred_lft forever 2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000 link/ether 00:16:3e:5e:44:55 brd ff:ff:ff:ff:ff:ff inet 172.17.223.17/24 brd 172.17.223.255 scope global eth0 valid_lft forever preferred_lft forever inet6 fe80::216:3eff:fe5e:4455/64 scope link valid_lft forever preferred_lft forever [root@vm2test1 ~]# cat /etc/hosts 127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4 ::1 localhost localhost.localdomain localhost6 localhost6.localdomain6 172.17.223.17 vm2test1.nmr.mgh.harvard.edu vm2test1 [root@vm2test1 ~]# cat /proc/net/if_inet6 00000000000000000000000000000001 01 80 10 80 lo fe8000000000000002163efffe5e4455 02 40 20 80 eth0 [root@vm2test1 ~]# ping6 ::1 PING ::1(::1) 56 data bytes 64 bytes from ::1: icmp_seq=1 ttl=64 time=0.062 ms 64 bytes from ::1: icmp_seq=2 ttl=64 time=0.076 ms 64 bytes from ::1: icmp_seq=3 ttl=64 time=0.076 ms 64 bytes from ::1: icmp_seq=4 ttl=64 time=0.113 ms ^C --- ::1 ping statistics --- 4 packets transmitted, 4 received, 0% packet loss, time 2999ms rtt min/avg/max/mdev = 0.062/0.081/0.113/0.021 ms [root@vm2test1 ~]# ipa-server-install --setup-dns ipa.ipapython.install.cli.install_tool(CompatServerMasterInstall): ERROR IPv6 stack is enabled in the kernel but there is no interface that has ::1 address assigned. Add ::1 address resolution to 'lo' interface. You might need to enable IPv6 on the interface 'lo' in sysctl.conf. ipa.ipapython.install.cli.install_tool(CompatServerMasterInstall): ERROR The ipa-server-install command failed. See /var/log/ipaserver-install.log for more information [root@vm2test1 ~]#

3 3

IPA 3.0.0, Problem with expired certificate
by lune voo 12 Apr '18

12 Apr '18

Hello. I contact you because I have a problem of expired certificates on my IPA servers. I'm still using IPA 3.0.0 for the moment. # ipa-getcert list Number of certificates and requests being tracked: 8. Request ID '20160321140609': status: CA_UNREACHABLE ca-error: Server at https://<HOST>/ipa/xml failed request, will retry: 4301 (RPC failed at server. Certificate operation cannot be completed: Unable to communicate with CMS (Not Found)). stuck: no key pair storage: type=NSSDB,location='/etc/dirsrv/slapd-<REALM>',nickname='Server-Cert',token='NSS Certificate DB',pinfile='/etc/dirsrv/slapd-<REALM>/pwdfile.txt' certificate: type=NSSDB,location='/etc/dirsrv/slapd-<REALM>',nickname='Server-Cert',token='NSS Certificate DB' CA: IPA issuer: CN=Certificate Authority,O=<REALM> subject: CN=<HOST>,O=<REALM> expires: 2018-03-22 14:06:09 UTC key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment eku: id-kp-serverAuth,id-kp-clientAuth pre-save command: post-save command: track: yes auto-renew: yes Request ID '20160321140642': status: CA_UNREACHABLE ca-error: Server at https://<HOST>/ipa/xml failed request, will retry: 4301 (RPC failed at server. Certificate operation cannot be completed: Unable to communicate with CMS (Not Found)). stuck: no key pair storage: type=NSSDB,location='/etc/dirsrv/slapd-PKI-IPA',nickname='Server-Cert',token='NSS Certificate DB',pinfile='/etc/dirsrv/slapd-PKI-IPA/pwdfile.txt' certificate: type=NSSDB,location='/etc/dirsrv/slapd-PKI-IPA',nickname='Server-Cert',token='NSS Certificate DB' CA: IPA issuer: CN=Certificate Authority,O=<REALM> subject: CN=<HOST>,O=<REALM> expires: 2018-03-22 14:06:41 UTC key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment eku: id-kp-serverAuth,id-kp-clientAuth pre-save command: post-save command: track: yes auto-renew: yes Request ID '20160321140750': status: CA_UNREACHABLE ca-error: Server at https://<HOST>/ipa/xml failed request, will retry: 4301 (RPC failed at server. Certificate operation cannot be completed: Unable to communicate with CMS (Not Found)). stuck: no key pair storage: type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS Certificate DB',pinfile='/etc/httpd/alias/pwdfile.txt' certificate: type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS Certificate DB' CA: IPA issuer: CN=Certificate Authority,O=<REALM> subject: CN=<HOST>,O=<REALM> expires: 2018-03-22 14:07:50 UTC key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment eku: id-kp-serverAuth,id-kp-clientAuth pre-save command: post-save command: track: yes auto-renew: yes Because of this, unfortunately, the commands ipa user-show etc.. does not work anymore. I wonder if IPA itself work well or not when we have this certificate problem ? Anyway, I came back in time, to before the certificates expire : ### service ntpd stop date --set="2018-03-10 10:00:00" ### And then I tried to renew these certificates with certmonger : ### # ipa-getcert resubmit -i 20160321140609 Resubmitting "20160321140609" to "IPA". # ipa-getcert resubmit -i 20160321140642 Resubmitting "20160321140642" to "IPA". # ipa-getcert resubmit -i 20160321140750 Resubmitting "20160321140750" to "IPA". ### But, it didn't change anything, the certificate are still expired :(. I have the following error message in httpd log when I perform a resubmit. ### [Sat Mar 10 11:29:18 2018] [error] ipa: ERROR: ipaserver.plugins.dogtag.ra.get_certificate(): Unable to communicate with CMS (Not Found) [Sat Mar 10 11:29:18 2018] [error] ipa: INFO: host/<HOST>@<REALM>: cert_request(u'MIIDwjCCAqoCAQAwPTEQMA4GA1UEChMHQkRGREVWMjEpMCcGA1UEAxMgZHZiZGZrYjIxLnJvdWVuLmZyYW5jZXRlbGVjb20uZnIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDr7BrPDFwenvnTLYPx29WEcsELc94+XcCm8fZSnr749/OGcqfqwurwH6NehL0eZjW7+uwtl3l3SJ1XIrUL4DDQ7b46EQh39hXRCepAIjfAFL2QVc1OEMtcGU2ahFk6Qoh+0ERr2zUMzV968IaebICzsHFyDedbM1lekOZKCpmgdhKi4JJM2IRXQggFsJGfoePfh7inj5VsLplC1Lkx22ka3I/8TiXdfUp0mzZQkXD3B3HTDy5hubhYeUXDwayqLQP6Wu0GHWwko2tlWZPCpg7Hfk+f1Wfu2XIb7JfbRscG/4C2bJNiTaGx7fqb3JDVnrOWEdEWZ2Lug+h6aBNa18oZAgMBAAGgggE+MCUGCSqGSIb3DQEJFDEYHhYAUwBlAHIAdgBlAHIALQBDAGUAcgB0MIIBEwYJKoZIhvcNAQkOMYIBBDCCAQAwDgYDVR0PAQEABAQDAgTwMIGbBgNVHREBAQAEgZAwgY2gPQYKKwYBBAGCNxQCA6AvDC1sZGFwL2R2YmRma2IyMS5yb3Vlbi5mcmFuY2V0ZWxlY29tLmZyQEJERkRFVjKgTAYGKwYBBQICoEIwQKAJGwdCREZERVYyoTMwMaADAgEBoSowKBsEbGRhcBsgZHZiZGZrYjIxLnJvdWVuLmZyYW5jZXRlbGVjb20uZnIwIAYDVR0lAQEABBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMAwGA1UdEwEB/wQCMAAwIAYDVR0OAQEABBYEFBa5zjLzw1wh3+5Mask290q98ZOxMA0GCSqGSIb3DQEBCwUAA4IBAQBx55mJOaAL0z4w8PzND8IgfdusTS2F1YsdfeMtoERl++n1kEvU0W0AmcQ9i9POiDx1+wTvhiVkdvrc18r6FKxHUjKDPkdEZ61jW9vuXY+uzFdQzbezOQ842n2vhmapgLX9WQrdv7iE+CLTn3sA3pNnbg4M6mL77CUPo7VJgiaNIuj4y7GCaAnUFrjyje93KBYDdsV2FLUoCblzE14DMmbxa1ApskYhskaPkbmvuiVWdsejsaPG3vYPZw+mZhhoKKeB8eenVIFqLmj42Cc8nZghgw6gqDj9aB3vj+wVhba2jFFLMqp8NB9oohHSb4wAY8zceU6ygKyO1MhTaqy+GSPo', principal=u'ldap/<HOST>@<REALM>', add=True): CertificateOperationError ### The CA service is running : ### # service ipa status Directory Service: RUNNING KDC Service: RUNNING KPASSWD Service: RUNNING MEMCACHE Service: RUNNING HTTP Service: RUNNING CA Service: RUNNING ### I wonder what I could do ? Thank you in advance for your help. BR. Lune

2 5

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users April 2018