January 2019 - FreeIPA-users - Fedora mailing-lists

SSO
by Николай Савельев 19 Jan '19

19 Jan '19

I'm planning use SSO with freeipa and choosing provider between ipsilon-project and keycloack. I tried ipsilon about year ago, there were some bugs. And I see that project almost die. Just 2 commits during the year. But keycloack seems very big and dificult to me. I'm terrified. What do you think? What should I use? -- С уважением, Николай.

3 2

Per-host 2FA and "Second Factor (optional)" message
by Chris Herdt 18 Jan '19

18 Jan '19

I'd seen previous posts (now a few years old) on enabling per-host 2-factor authentication with FreeIPA. I'm using FreeIPA 4.6.4 on CentOS 7. I followed what I think are the correct steps to enable 2FA on a specific host, but the behavior is a little strange: User A: enable both Password and Two factor authentication (password + OTP), and configure a OTP. User B: enable just the Password option. Host A: select "otp" under Authentication indicators, ensure the following lines are present in /etc/ssh/sshd_config and restart sshd: ChallengeResponseAuthentication yes AuthenticationMethods keyboard-interactive Host B: make no changes to Authentication indicators (none selected), make the same changes as above to sshd_config. After these changes: User A -> Host A The user sees the following prompts: First Factor: Second Factor (optional): However, the second factor is required (as expected) and the login fails without it. User A -> Host B The user gets the same prompt as above, but the second factor is actually optional, and the login succeeds without supplying any value. User B -> Host A The user gets a regular password prompt, but cannot log in using the correct password (as expected, since a OTP is required). User B -> Host B The user gets a regular password prompt and can log in as expected. Everything is working more-or-less as expected, but the "Second Factor (optional)" prompt is a little confusing, particularly in cases where it is required. Is this due to my specific configuration (or mis-configuration) or is this the expected behavior?

2 2

Lost IPA master Left with replica only
by Rob van Halteren 18 Jan '19

18 Jan '19

Hello, I am fairly new to freeipa. Sorry for that. I have a freeipa installation with 1 master in domain bxl.mydomain and a replica in ams.mydomain. At this stage I have lost the master. I did not install the master and replica myself, but from the documentation I learned that the master should be the CA for the system. However when I look for the configs on the master that should determine the CA I can find any that make sense. freeipa version of master and replica are 3.0.0. on Centos 6 both running in lxc container on different Proxmox hypervisors. the ipa config-show output from the master looked like. Maximum username length: 32 Home directory base: /users_roaming/ Default shell: /bin/bash Default users group: prod-users Default e-mail domain: bxl.mydomain Search time limit: 2 Search size limit: 100 User search fields: uid,givenname,sn,telephonenumber,ou,title Group search fields: cn,description Enable migration mode: FALSE Certificate Subject base: O= BXL.MYDOMAIN Password Expiration Notification (days): 4 Password plugin features: AllowNThash SELinux user map order: guest_u:s0$xguest_u:s0$user_u:s0$staff_u:s0-s0:c0.c1023$unconfined_u:s0-s0:c0.c1023 Default SELinux user: unconfined_u:s0-s0:c0.c1023 Default PAC types: MS-PAC I want to know if I need to promote the replica and how to proceed. I have a great part of the master in the backup including the /etc, /var/lib/ /var/log/ and /root directories

2 1

Ipsilon - Unauthorized
by Ronald Wimmer 17 Jan '19

17 Jan '19

I set up ipsilon on a separate machine as documented in https://ipsilon-project.org/doc/quickstart-ipa.html When I try to log in with the admin user I get the "Unauthorized" error. The logs say: ==> ssl_error_log <== [Thu Jan 17 09:51:45.555163 2019] [authnz_pam:warn] [pid 5977] [client 10.65.150.250:33802] PAM account validation failed for user admin: Permission denied, referer: https://ipa-ipsilon.linux.mydomain.at/idp/login/gssapi/negotiate?ipsilon_tr…

2 2

orphan certificate key Issue
by Uzor Ide 16 Jan '19

16 Jan '19

Hello All, I upgraded our ipa server and after the upgrade ipa won't start again. further investigation shows that components of ipa starts but pki-tomcatd(a)pki-tomcat.service appears to be where the issue lies. checking the logs suggested that issue lies in the certificate database. on checking the directory /etc/pki/pki-tomcat/alias with certutils [namead@ipasvr01 alias]$ sudo certutil -K -d . -f pwdfile.txt certutil: Checking token "NSS Certificate DB" in slot "NSS User Private Key and Certificate Services" < 0> rsa 9bb20dbec9d8dd63e1db53b0662eaf37a1518bf9 ocspSigningCert cert-pki-ca < 1> rsa 49d9f7a5f5ab3ed93d4037676b1bf9e236b89d0f subsystemCert cert-pki-ca < 2> rsa df374a636d9a424aaefefc6367dcb868f82f536d Server-Cert cert-pki-ca *< 3> rsa 7cebd0bbadddd5e581c328a99982e0ef5172d61f (orphan)* < 4> rsa 52839be82200bb2a9ff2034629c53cd90a0575a8 auditSigningCert cert-pki-ca < 5> rsa c4a6d42c22a874a69231a2d7446bccfe9ce0cbaa caSigningCert cert-pki-ca Any help in the deleting the key would be appreciated. Thanks _Uz

3 7

Abstracted NTP server configuration
by Rob Crittenden 15 Jan '19

15 Jan '19

A PR to support multiple NTP servers was submitted in https://github.com/freeipa/freeipa/pull/2169 This spawned a design at https://www.freeipa.org/page/V4/NTP_Servers_Configuration We need to discuss the design. rob

5 15

ipa services continue to fail
by Andrew Meyer 14 Jan '19

14 Jan '19

Currently in my environment I have 6 servers 2 in my local office and 2 in each region in AWS. The AWS servers are all running CentOS 7.x with FreeIPA 4.5.x running on all 6. The AWS servers are all t2.medium w/ unlimited turned on. Occasionally we issues with all 6 where one of the processes for freeipa stops working completely. This could be the ipa.service or the named-pkcs11, or dirsrv(a)MYREALM.ORG. Sometimes it will be resource constraints, other times the whole system could come to a crawl for no reason whatsoever. Looking through the IPA logs doesn't always tell me what was going on. I usually have to restart the service or reboot the whole instance/machine to get it back to a working state. Also as of right now i'm seeing that dirsrv(a)MYREALM.NET will not start because a configured resource limit was exceeded. Here is the error i'm getting all of a sudden: ● dirsrv(a)EXAMPLE.NET.service - 389 Directory Server EXAMPLE.NET. Loaded: loaded (/usr/lib/systemd/system/dirsrv@.service; enabled; vendor preset: disabled) Active: failed (Result: resources) Jan 14 19:55:21 freeipa01.west.example.net systemd[1]: Failed to load environment files: No such file or directoryJan 14 19:55:21 freeipa01.west.example.net systemd[1]: dirsrv(a)EXAMPLE.NET.service failed to run 'start-pre' task: No such file or directoryJan 14 19:55:21 freeipa01.west.example.net systemd[1]: Failed to start 389 Directory Server EXAMPLE.NET..Jan 14 19:55:21 freeipa01.west.example.net systemd[1]: Unit dirsrv(a)EXAMPLE.NET.service entered failed state.Jan 14 19:55:21 freeipa01.west.example.net systemd[1]: dirsrv(a)EXAMPLE.NET.service failed.Jan 14 19:55:21 freeipa01.west.example.net systemd[1]: Starting 389 Directory Server EXAMPLE.NET....[andrew.meyer@freeipa01 ~]$ Here is a snippet from the logs:/var/log/dirsrv/slapd-EXAMPLE-NET/errors [14/Jan/2019:19:51:42.631413149 +0000] - NOTICE - ldbm_back_start - found 3880412k physical memory[14/Jan/2019:19:51:42.632553293 +0000] - NOTICE - ldbm_back_start - found 3273584k available[14/Jan/2019:19:51:42.633584210 +0000] - NOTICE - ldbm_back_start - cache autosizing: db cache: 97010k[14/Jan/2019:19:51:42.634560420 +0000] - NOTICE - ldbm_back_start - cache autosizing: userRoot entry cache (3 total): 131072k[14/Jan/2019:19:51:42.636236633 +0000] - NOTICE - ldbm_back_start - cache autosizing: userRoot dn cache (3 total): 65536k[14/Jan/2019:19:51:42.639592221 +0000] - NOTICE - ldbm_back_start - cache autosizing: ipaca entry cache (3 total): 131072k[14/Jan/2019:19:51:42.641296133 +0000] - NOTICE - ldbm_back_start - cache autosizing: ipaca dn cache (3 total): 65536k[14/Jan/2019:19:51:42.643594212 +0000] - NOTICE - ldbm_back_start - cache autosizing: changelog entry cache (3 total): 131072k[14/Jan/2019:19:51:42.645241367 +0000] - NOTICE - ldbm_back_start - cache autosizing: changelog dn cache (3 total): 65536k[14/Jan/2019:19:51:42.646916994 +0000] - NOTICE - ldbm_back_start - total cache size: 683450613 B;[14/Jan/2019:19:51:42.650449731 +0000] - NOTICE - dblayer_start - Detected Disorderly Shutdown last time Directory Server was running, recovering database.[14/Jan/2019:19:51:49.346656922 +0000] - ERR - schema-compat-plugin - scheduled schema-compat-plugin tree scan in about 5 seconds after the server startup![14/Jan/2019:19:51:49.544963162 +0000] - ERR - NSACLPlugin - acl_parse - The ACL target cn=groups,cn=compat,dc=example,dc=net does not exist[14/Jan/2019:19:51:49.564630973 +0000] - ERR - NSACLPlugin - acl_parse - The ACL target cn=computers,cn=compat,dc=example,dc=net does not exist[14/Jan/2019:19:51:49.584635724 +0000] - ERR - NSACLPlugin - acl_parse - The ACL target cn=ng,cn=compat,dc=example,dc=net does not exist[14/Jan/2019:19:51:49.604545604 +0000] - ERR - NSACLPlugin - acl_parse - The ACL target ou=sudoers,dc=example,dc=net does not exist[14/Jan/2019:19:51:49.624542861 +0000] - ERR - NSACLPlugin - acl_parse - The ACL target cn=users,cn=compat,dc=example,dc=net does not exist[14/Jan/2019:19:51:49.684538158 +0000] - ERR - NSACLPlugin - acl_parse - The ACL target cn=ad,cn=etc,dc=example,dc=net does not exist[14/Jan/2019:19:51:49.825646593 +0000] - ERR - NSACLPlugin - acl_parse - The ACL target cn=casigningcert cert-pki-ca,cn=ca_renewal,cn=ipa,cn=etc,dc=example,dc=net does not exist[14/Jan/2019:19:51:49.844539895 +0000] - ERR - NSACLPlugin - acl_parse - The ACL target cn=casigningcert cert-pki-ca,cn=ca_renewal,cn=ipa,cn=etc,dc=example,dc=net does not exist[14/Jan/2019:19:51:49.990796503 +0000] - ERR - NSACLPlugin - acl_parse - The ACL target cn=automember rebuild membership,cn=tasks,cn=config does not exist[14/Jan/2019:19:52:00.365183146 +0000] - NOTICE - NSMMReplicationPlugin - changelog program - _cl5ConstructRUV - Rebuilding the replication changelog RUV, this may take several minutes...[14/Jan/2019:19:52:00.445692209 +0000] - NOTICE - NSMMReplicationPlugin - changelog program - _cl5ConstructRUV - Rebuilding replication changelog RUV complete. Result 0 (Success)[14/Jan/2019:19:52:00.446842275 +0000] - NOTICE - NSMMReplicationPlugin - changelog program - _cl5ConstructRUV - Rebuilding the replication changelog RUV, this may take several minutes...[14/Jan/2019:19:52:00.513081196 +0000] - NOTICE - NSMMReplicationPlugin - changelog program - _cl5ConstructRUV - Rebuilding replication changelog RUV complete. Result 0 (Success)[14/Jan/2019:19:52:00.514432537 +0000] - NOTICE - NSMMReplicationPlugin - changelog program - _cl5ConstructRUV - Rebuilding the replication changelog RUV, this may take several minutes...[14/Jan/2019:19:52:00.515614720 +0000] - NOTICE - NSMMReplicationPlugin - changelog program - _cl5ConstructRUV - Rebuilding replication changelog RUV complete. Result 0 (Success)[14/Jan/2019:19:52:00.516689146 +0000] - NOTICE - NSMMReplicationPlugin - changelog program - _cl5ConstructRUV - Rebuilding the replication changelog RUV, this may take several minutes...[14/Jan/2019:19:52:00.517810761 +0000] - NOTICE - NSMMReplicationPlugin - changelog program - _cl5ConstructRUV - Rebuilding replication changelog RUV complete. Result 0 (Success)[14/Jan/2019:19:52:00.526034848 +0000] - WARN - NSMMReplicationPlugin - replica_check_for_data_reload - Disorderly shutdown for replica o=ipaca. Check if DB RUV needs to be updated[14/Jan/2019:19:52:00.584599421 +0000] - ERR - set_krb5_creds - Could not get initial credentials for principal [ldap/freeipa01.west.example.net(a)EXAMPLE.NET] in keytab [FILE:/etc/dirsrv/ds.keytab]: -1765328228 (Cannot contact any KDC for requested realm)[14/Jan/2019:19:52:00.604610301 +0000] - WARN - NSMMReplicationPlugin - replica_check_for_data_reload - Disorderly shutdown for replica dc=example,dc=net. Check if DB RUV needs to be updated[14/Jan/2019:19:52:00.624573161 +0000] - ERR - set_krb5_creds - Could not get initial credentials for principal [ldap/freeipa01.west.example.net(a)EXAMPLE.NET] in keytab [FILE:/etc/dirsrv/ds.keytab]: -1765328228 (Cannot contact any KDC for requested realm)[14/Jan/2019:19:52:00.644588420 +0000] - NOTICE - NSMMReplicationPlugin - Force update of database RUV (from CL RUV) -> 5c3cdd700000001b0000[14/Jan/2019:19:52:00.675318674 +0000] - INFO - slapd_daemon - slapd started. Listening on All Interfaces port 389 for LDAP requests[14/Jan/2019:19:52:00.684551689 +0000] - INFO - slapd_daemon - Listening on All Interfaces port 636 for LDAPS requests[14/Jan/2019:19:52:00.704669406 +0000] - INFO - slapd_daemon - Listening on /var/run/slapd-EXAMPLE-NET.socket for LDAPI requests[14/Jan/2019:19:52:00.752022024 +0000] - ERR - schema-compat-plugin - schema-compat-plugin tree scan will start in about 5 seconds![14/Jan/2019:19:52:04.456691971 +0000] - ERR - NSMMReplicationPlugin - bind_and_check_pwp - agmt="cn=meTofreeipa03.east.example.net" (freeipa03:389) - Replication bind with GSSAPI auth failed: LDAP error -1 (Can't contact LDAP server) ()[14/Jan/2019:19:52:05.055410972 +0000] - ERR - NSMMReplicationPlugin - bind_and_check_pwp - agmt="cn=meTofreeipa02.west.example.net" (freeipa02:389) - Replication bind with GSSAPI auth failed: LDAP error -1 (Can't contact LDAP server) ()[14/Jan/2019:19:52:06.180112049 +0000] - ERR - schema-compat-plugin - warning: no entries set up under cn=computers, cn=compat,dc=example,dc=net[14/Jan/2019:19:52:06.225167327 +0000] - ERR - schema-compat-plugin - Finished plugin initialization.[14/Jan/2019:19:52:09.118232562 +0000] - INFO - NSMMReplicationPlugin - bind_and_check_pwp - agmt="cn=meTofreeipa02.west.example.net" (freeipa02:389): Replication bind with GSSAPI auth resumed[14/Jan/2019:19:52:09.417962320 +0000] - INFO - NSMMReplicationPlugin - bind_and_check_pwp - agmt="cn=meTofreeipa03.east.example.net" (freeipa03:389): Replication bind with GSSAPI auth resumed For the on premise freeipa servers I have upgraded the RAM/CPU to 4x4. However I wanted to reach out to the mailing list to find out what to do about the servers in AWS. Regards,

1 0

Peer certificate cannot be authenticated with given CA certificates
by Petr Benas 14 Jan '19

14 Jan '19

Hello, we have an issue with resubmitting several certificates. We suspect the reason might be the encoding mismatch between the certificate and the CA certificate. Our environment was upgraded during the years from some 3.x version to current 4.5.4. So the very first CA certificate was encoded in PRINTABLESTRING. Issuer: organizationName = PRINTABLESTRING:EXAMPLE.COM commonName = PRINTABLESTRING:Certificate Authority Validity Not Before: Dec 1 14:14:37 2014 GMT Not After : Dec 1 14:14:37 2034 GMT Subject: organizationName = PRINTABLESTRING:EXAMPLE.COM commonName = PRINTABLESTRING:Certificate Authority When we renew-ed (due to SHA1) we got to PRINTABLESTRING X UTF8STRING and after we renewed again, so now we have: Issuer: organizationName = UTF8STRING:EXAMPLE.COM commonName = UTF8STRING:Certificate Authority Validity Not Before: Oct 9 07:34:24 2017 GMT Not After : Oct 9 07:34:24 2037 GMT Subject: organizationName = UTF8STRING:EXAMPLE.COM commonName = UTF8STRING:Certificate Authority And most certificated were renewed fine. However, recently we noticed that several certificated can't be resubmitted, all of them seem to be like this: Issuer: organizationName = PRINTABLESTRING:EXAMPLE.COM commonName = PRINTABLESTRING:Certificate Authority Validity Not Before: Nov 24 12:17:12 2016 GMT Not After : Nov 14 12:17:12 2018 GMT Subject: organizationName = UTF8STRING:EXAMPLE.COM commonName = UTF8STRING:ipa07.example.com The error when resubmitting is: Peer certificate cannot be authenticated with given CA certificates. The tcpdump from 8443 says Unknown CA. Is the assumption that the encoding mismatch is blocking the submitting certificate correct? One of the certificate which we also can't renew is the 'IPA RA' (/var/lib/ipa/ra-agent.pem) What we tried: Add all versions of CA certificate to /etc/pki/pki-tomcat/alias trust store (also add them one-by-one) Setting date back before the expiration. Advises from: https://rcritten.wordpress.com/2017/09/20/peer-certificate-cannot-be-authen… Deleting the related CSR from o=ipaca, supposing that newly generated csr will be fine. Any suggestions what else we could try? Thanks Petr

2 2

Ldap authentication
by Alex Severov 14 Jan '19

14 Jan '19

Hello. I have ipa with ad integration. I want to install nextcloud with ldap authentication. I used this document https://www.freeipa.org/page/Owncloud_Authentication_against_FreeIPA I changed ldap tree to compat. But I can't login in nextcloud with ad user password! Wat's wrong? -- Alex Severov

1 0

FreeIPA for the maximally paranoid and overworked?
by K. M. Peterson 13 Jan '19

13 Jan '19

Hi all, This is a newbie question with respect to FreeIPA, and I haven't seen this elsewhere, so I thought I'd ask. I've just cleaned up an issue with trying to implement a new replica on our domain, and I've realized that there are a couple of areas I don't understand that are causing more stress than I need at this point, for I am maximally paranoid and overworked, and I need some advice on how not to make that worse when implementing FreeIPA. I've been reading this list on and off for most of the last year, and what's struck me is how complicated this project is, especially of course areas where I personally have less expertise (e.g., LDAP, Kerberos). Implementing and managing this is just one of my jobs, and our IdM becomes more critical as time goes on, so I need to understand a few things. Question 1: As I just had, for the first time, to manually modify LDAP to remove data, I'd like to understand how taking that approach can backfire. In other words, it's clear this isn't habitually a good idea, because mistakes will replicate, for example. But, where are the real danger points: for example, I've seen stories of having to recover a server in an environment where the time was intentionally set back to allow an operation on an expired cert. As with a database update that triggers other (unexpected) changes, are there LDAP operations that can't practically be "un-done"? I know that deleting records is permanent (obvious), but are there gotchas like changing a particular object fires some large number of events that there's no way to revert? Or, in colloquial terms, are there places that are really, really bad to try to outwit the management interfaces? I'm not talking everyday updates, but instances where we get stuck (as I was yesterday and today)? Question 2: How to stay safe. Our installation on a small network as a pair of masters replicating with each other, CA and DNS installed on both. They are VMs allocated on separate physical hosts. Before updates, I snapshot both for recovery purposes. I update one at a time, now, and ensure that they're functional before doing the other one (I know that schema changes will propagate before service is applied elsewhere, but I can't do anything else about that). I haven't had to deal with the question of how to make sure my (self-signed) CA certificate doesn't expire, but I know when it will and am leaving myself ample time to understand that. I'm about to start pushing out this functionality to multiple geos, again at small-ish scale, and I'm reading the topology references to be sure I understand what I'm doing. But: what am I missing? I get the impression that trying to (conventionally) "back up" data isn't useful. I've tried to design the network to make it as simple as possible to meet our needs. Does anyone else have anything to add in the sense of "best practices", or to echo my first question "there be dragons <here>"? I've learned a lot from this list, and I'd also like to add a thank you to everyone here who have helped with that! I do see this getting better and better, and it's appreciated.

3 4

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users January 2019