Re: AD's users ssh to IPA's client - should it work?
by lejeczek
On 21/06/2019 13:08, Sumit Bose wrote:
> On Fri, Jun 21, 2019 at 12:38:22PM +0100, lejeczek wrote:
>> On 21/06/2019 10:57, lejeczek via FreeIPA-users wrote:
>>> I obfuscated those logs I sent you, maybe not too neatly, apologies.
>> this time, maybe not that badly obfuscated logs, attached.
>>
> Ok, so it is about CCC.PRIVATE.DDD.EE.FF which, if I understand to
> correctly, is the AD domain. Please try
>
> KRB5_TRACE=/dev/stdout kinit pawel(a)CCC.PRIVATE.DDD.EE.FF
>
> from the command line and send me the output. Additionally it would be
> good to know which IPA server you are using on the servers.
>
> bye,
> Sumit
I'm baaaack :) In the mean while I upped my IPA to 4.6.5 version.
(redone anew AD one-way trust with shared secret)
and GSSAPI does not seem to work?
on masters:
$ KRB5_TRACE=/dev/stdout kinit pawel(a)ceb.private.cam.ac.uk.
...
[3894] 1573661402.150190: Storing....
$ echo $?
0
But Windoze end, AD controller and its clients when ssh or cifs to
masters still ask for password(which works for ssh) and I cannot spot
any errors in logs.
Any thoughts and suggestions?
many thanks, L.
>
>> pub rsa2048 2019-01-17 [SC] [verfällt: 2020-01-17]
>> 93059F241EEEE1D0769A85F455918ABF21224EBA
>> uid lejeczek <peljasz(a)yahoo.co.uk>
>> sub rsa2048 2019-01-17 [E] [verfällt: 2020-01-17]
4 years, 5 months
Inappropriate authentication when binding as service account
by Joyce Babu
Hello,
I am trying to bind to ldap as a service account. I followed the advice in
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
and created a plain text password using ipa-getkeytab
ipa-getkeytab -s ipa.ennexa.org -p HTTP/service.domain.tld(a)EXAMPLE.COM -P
-k /tmp/test.keytab
But when I try to bind with the same password, it is failing
ldapsearch -D krbprincipalname=HTTP/service.domain.tld(a)EXAMPLE.COM,cn=services,cn=accounts,dc=example,dc=com
-w "MY_PLAIN_TEXT_PASSWORD" -b cn=groups,cn=accounts,dc=example,dc=com -h
ipa.example.com:389
ldap_bind: Inappropriate authentication (48)
Do I have to configure anything else?
Thanks & Regards,
Joyce Babu
4 years, 5 months
Best practices for SSH-Public-Key in an AD Trust scenario with FreeIPA
by LHEUREUX Bernard
Hi all,
I would like to know what could be the best practices for storing SSH-Public-Keys in AD for IPAusers authentication in a scenario with AD Trust ?
---
Bernard Lheureux
Ce message transmis par voie ?lectronique ainsi que toutes ses annexes contiennent des informations qui peuvent ?tre confidentielles ou prot?g?es. Ces informations sont uniquement destin?es ? l'usage des personnes ou des entit?s pr?cis?es dans les champs 'A', 'Cc' et 'Cci'. Si vous n'?tes pas l'un de ces destinataires, soyez conscient que toute forme, partielle ou compl?te, de divulgation, copie, distribution ou utilisation de ces informations est strictement interdite. Si vous avez re?u ce message par erreur, veuillez nous en informer par t?l?phone ou par message ?lectronique et d?truire les informations imm?diatement. Ce message n'engage que son signataire et aucunement son employeur.
4 years, 5 months
Unable to login to IPA console
by Nikita Deeksha
Hi Team,
We have 2 IPA servers in Mater-Master setup are we facing the below issue
on these servers.
Isuue1:
Our httpd certificate has expired because of which our IPA1 UI wasn't
working, we are getting “*loging failed due to an unknown reason*” error
while we log in to the UI
1. First, the IPA console was not working as httpd service was stopped,
httpd was not starting as HTTP certificate is expired. Added
*NSSEnforceValidCerts
off* line in nss.conf to start the service.
2. After the change IPA console was loading we are not able to login to the
console as pki-tomcatd service was not running,
[root@ipa1 ca]# ipactl status
Directory Service: RUNNING
krb5kdc Service: RUNNING
kadmin Service: RUNNING
httpd Service: RUNNING
ipa-custodia Service: RUNNING
ntpd Service: RUNNING
pki-tomcatd Service: STOPPED
ipa-otpd Service: RUNNING
# systemctl status pki-tomcatd(a)pki-tomcat.service -l
● pki-tomcatd(a)pki-tomcat.service - PKI Tomcat Server pki-tomcat
Loaded: loaded (/lib/systemd/system/pki-tomcatd@.service; enabled;
vendor preset: disabled)
Active: active (running) since Tue 2019-11-05 10:16:50 GMT; 31min ago
Process: 97068 ExecStartPre=/usr/bin/pkidaemon start %i (code=exited,
status=0/SUCCESS)
Main PID: 97233 (java)
CGroup:
/system.slice/system-pki\x2dtomcatd.slice/pki-tomcatd(a)pki-tomcat.service
└─97233 /usr/lib/jvm/jre-1.8.0-openjdk/bin/java
-DRESTEASY_LIB=/usr/share/java/resteasy-base
-Djava.library.path=/usr/lib64/nuxwdog-jni -classpath
/usr/share/tomcat/bin/bootstrap.jar:/usr/share/tomcat/bin/tomcat-juli.jar:/usr/share/java/commons-daemon.jar
-Dcatalina.base=/var/lib/pki/pki-tomcat -Dcatalina.home=/usr/share/tomcat
-Djava.endorsed.dirs= -Djava.io.tmpdir=/var/lib/pki/pki-tomcat/temp
-Djava.util.logging.config.file=/var/lib/pki/pki-tomcat/conf/logging.properties
-Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager
-Djava.security.manager
-Djava.security.policy==/var/lib/pki/pki-tomcat/conf/catalina.policy
org.apache.catalina.startup.Bootstrap start
Nov 05 10:47:57 ipa1.xxx.xxxxx.com server[97233]: WARNING: Exception
processing realm com.netscape.cms.tomcat.ProxyRealm@1896e072 background
process
Nov 05 10:47:57 ipa1.xxx.xxxxx.com server[97233]:
javax.ws.rs.ServiceUnavailableException: Subsystem unavailable
Nov 05 10:47:57 ipa1.xxx.xxxxx.com server[97233]: at
com.netscape.cms.tomcat.ProxyRealm.backgroundProcess(ProxyRealm.java:137)
Nov 05 10:47:57 ipa1.xxx.xxxxx.com server[97233]: at
org.apache.catalina.core.ContainerBase.backgroundProcess(ContainerBase.java:1356)
Nov 05 10:47:57 ipa1.xxx.xxxxx.com server[97233]: at
org.apache.catalina.core.StandardContext.backgroundProcess(StandardContext.java:5958)
Nov 05 10:47:57 ipa1.xxx.xxxxx.com server[97233]: at
org.apache.catalina.core.ContainerBase$ContainerBackgroundProcessor.processChildren(ContainerBase.java:1542)
Nov 05 10:47:57 ipa1.xxx.xxxxx.com server[97233]: at
org.apache.catalina.core.ContainerBase$ContainerBackgroundProcessor.processChildren(ContainerBase.java:1552)
Nov 05 10:47:57 ipa1.xxx.xxxxx.com server[97233]: at
org.apache.catalina.core.ContainerBase$ContainerBackgroundProcessor.processChildren(ContainerBase.java:1552)
Nov 05 10:47:57 ipa1.xxx.xxxxx.com server[97233]: at
org.apache.catalina.core.ContainerBase$ContainerBackgroundProcessor.run(ContainerBase.java:1520)
Nov 05 10:47:57 ipa1.xxx.xxxxx.com server[97233]: at
java.lang.Thread.run(Thread.java:748)
This service wasn’t starting with this error
# less /var/log/pki/pki-tomcat/ca/debug
31/Oct/2019:13:24:23][localhost-startStop-1]:
SSLClientCertificateSelectionCB: desired cert found in list: subsystemCert
cert-pki-ca
[31/Oct/2019:13:24:23][localhost-startStop-1]:
SSLClientCertificateSelectionCB: returning: subsystemCert cert-pki-ca
[31/Oct/2019:13:24:23][localhost-startStop-1]: SSL handshake happened
Could not connect to LDAP server host ipa1.xxx.xxxx.com port 636 Error
netscape.ldap.LDAPException: Authentication failed (49)
at
com.netscape.cmscore.ldapconn.LdapBoundConnFactory.makeConnection(LdapBoundConnFactory.java:205)
at
com.netscape.cmscore.ldapconn.LdapBoundConnFactory.init(LdapBoundConnFactory.java:166)
at
com.netscape.cmscore.ldapconn.LdapBoundConnFactory.init(LdapBoundConnFactory.java:130)
at com.netscape.cmscore.dbs.DBSubsystem.init(DBSubsystem.java:654)
at
com.netscape.cmscore.apps.CMSEngine.initSubsystem(CMSEngine.java:1176)
at
com.netscape.cmscore.apps.CMSEngine.initSubsystems(CMSEngine.java:1082)
at com.netscape.cmscore.apps.CMSEngine.init(CMSEngine.java:572)
at com.netscape.certsrv.apps.CMS.init(CMS.java:189)
at com.netscape.certsrv.apps.CMS.start(CMS.java:1631)
at
com.netscape.cms.servlet.base.CMSStartServlet.init(CMSStartServlet.java:117)
at javax.servlet.GenericServlet.init(GenericServlet.java:158)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at
sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
at
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:498)
at
org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:288)
at
org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:285)
at java.security.AccessController.doPrivileged(Native Method)
at javax.security.auth.Subject.doAsPrivileged(Subject.java:549)
at
org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:320)
at
org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:175)
at
org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:124)
at
org.apache.catalina.core.StandardWrapper.initServlet(StandardWrapper.java:1257)
at
org.apache.catalina.core.StandardWrapper.loadServlet(StandardWrapper.java:1182)
at
org.apache.catalina.core.StandardWrapper.load(StandardWrapper.java:1072)
at
org.apache.catalina.core.StandardContext.loadOnStartup(StandardContext.java:5368)
at
org.apache.catalina.core.StandardContext.startInternal(StandardContext.java:5660)
at
org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:145)
at
org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.java:899)
at
org.apache.catalina.core.ContainerBase.access$000(ContainerBase.java:133)
at
org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(ContainerBase.java:156)
at
org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(ContainerBase.java:145)
at java.security.AccessController.doPrivileged(Native Method)
at
org.apache.catalina.core.ContainerBase.addChild(ContainerBase.java:873)
at
org.apache.catalina.core.StandardHost.addChild(StandardHost.java:652)
at
org.apache.catalina.startup.HostConfig.deployDescriptor(HostConfig.java:679)
at
org.apache.catalina.startup.HostConfig$DeployDescriptor.run(HostConfig.java:1966)
at
java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)
at java.util.concurrent.FutureTask.run(FutureTask.java:266)
at
java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
at
java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
at java.lang.Thread.run(Thread.java:748)
Internal Database Error encountered: Could not connect to LDAP server host
ipa1.xxx.xxx.com port 636 Error netscape.ldap.LDAPException: Authentication
failed (49)
at com.netscape.cmscore.dbs.DBSubsystem.init(DBSubsystem.java:676)
at
com.netscape.cmscore.apps.CMSEngine.initSubsystem(CMSEngine.java:1176)
at
com.netscape.cmscore.apps.CMSEngine.initSubsystems(CMSEngine.java:1082)
at com.netscape.cmscore.apps.CMSEngine.init(CMSEngine.java:572)
at com.netscape.certsrv.apps.CMS.init(CMS.java:189)
at com.netscape.certsrv.apps.CMS.start(CMS.java:1631)
at
com.netscape.cms.servlet.base.CMSStartServlet.init(CMSStartServlet.java:117)
at javax.servlet.GenericServlet.init(GenericServlet.java:158)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at
sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
at
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:498)
at
org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:288)
at
org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:285)
at java.security.AccessController.doPrivileged(Native Method)
at javax.security.auth.Subject.doAsPrivileged(Subject.java:549)
at
org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:320)
at
org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:175)
at
org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:124)
at
org.apache.catalina.core.StandardWrapper.initServlet(StandardWrapper.java:1257)
at
org.apache.catalina.core.StandardWrapper.loadServlet(StandardWrapper.java:1182)
at
org.apache.catalina.core.StandardWrapper.load(StandardWrapper.java:1072)
at
org.apache.catalina.core.StandardContext.loadOnStartup(StandardContext.java:5368)
at
org.apache.catalina.core.StandardContext.startInternal(StandardContext.java:5660)
at
org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:145)
at
org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.java:899)
at
org.apache.catalina.core.ContainerBase.access$000(ContainerBase.java:133)
at
org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(ContainerBase.java:156)
at
org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(ContainerBase.java:145)
at java.security.AccessController.doPrivileged(Native Method)
at
org.apache.catalina.core.ContainerBase.addChild(ContainerBase.java:873)
at
org.apache.catalina.core.StandardHost.addChild(StandardHost.java:652)
at
org.apache.catalina.startup.HostConfig.deployDescriptor(HostConfig.java:679)
at
org.apache.catalina.startup.HostConfig$DeployDescriptor.run(HostConfig.java:1966)
at
java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)
at java.util.concurrent.FutureTask.run(FutureTask.java:266)
at
java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
at
java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
at java.lang.Thread.run(Thread.java:748)
# getcert list
Request ID '20180412150739':
status: SUBMITTING
stuck: no
key pair storage: type=NSSDB,location='/etc/httpd/alias',nickname='CN=
ipa1.xxxx.xxxxx.com,O=xxx.xxxx.COM',token='NSS Certificate
DB',pinfile='/etc/httpd/alias/pwdfile.txt'
certificate: type=NSSDB,location='/etc/httpd/alias',nickname='CN=
ipa1.xxxx.xxxxx.com,O=xxx.xxxxx.COM',token='NSS Certificate DB'
CA: IPA
issuer: CN=Certificate Authority,O=xxx.xxxxx.COM
subject: CN=ipa1.xxxx.xxxx.com,O=xxx.xxxxx.COM
expires: 2019-10-25 20:16:38 UTC
principal name: krbtgt/xxxx.xxxx.COM(a)xxxx.xxxx.COM
key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
eku: id-kp-serverAuth,id-pkinit-KPKdc
pre-save command:
post-save command: /usr/libexec/ipa/certmonger/restart_httpd
track: yes
auto-renew: yes
Issue2:
On the IPA2 server, we are unable to login with the admin user credentials
without OTP, but when an AD user is trying to login with 2FA (i.e,
password and OTP) we are getting this error *"The password you entered is
incorrect."*
# [root@ipa2 log]# ipactl status
Directory Service: RUNNING
krb5kdc Service: RUNNING
kadmin Service: RUNNING
httpd Service: RUNNING
ipa-custodia Service: RUNNING
ntpd Service: RUNNING
ipa-otpd Service: STOPPED
ipa: INFO: The ipactl command was successful
# systemctl status ipa-otpd.socket -l
● ipa-otpd.socket - ipa-otpd socket
Loaded: loaded (/usr/lib/systemd/system/ipa-otpd.socket; disabled;
vendor preset: disabled)
Active: failed (Result: resources) since Tue 2019-11-05 08:19:04 GMT; 1h
31min ago
Listen: /var/run/krb5kdc/DEFAULT.socket (Stream)
Accepted: 2; Connected: 0
Nov 05 07:42:53 ipa2.xxxx.xxxx.com systemd[1]: Listening on ipa-otpd socket.
Nov 05 08:19:04 ipa2.xxxx.xxxx.com systemd[1]: ipa-otpd.socket failed to
queue service startup job (Maybe the service file is missing or not a
template unit?): Resource temporarily unavailable
Nov 05 08:19:04 ipa2.xxxx.xxxx.com systemd[1]: Unit ipa-otpd.socket entered
failed state.
# cat /usr/lib/systemd/system/ipa-otpd.socket
[Unit]
Description=ipa-otpd socket
[Socket]
ListenStream=/var/run/krb5kdc/DEFAULT.socket
RemoveOnStop=true
SocketMode=0600
Accept=true
[Install]
WantedBy=krb5kdc.service
We see that data replication is broken between the 2 IPA servers, as the
changes made on IPA2 is not reflecting on IPA1
We the below errors as well.
IPA1
Nov 05 10:09:23 ipa1.xxx.xxxx.com krb5kdc[28021](info): TGS_REQ (8 etypes
{18 17 20 19 16 23 25 26}) x.x.x.x: ISSUE: authtime 1572948563, etypes
{rep=18 tkt=18 ses=18}, ldap/ipa1.xxxxx.xxxx.com(a)xxxx.xxxxx.COM for ldap/
ipa2.xxxx.xxxx.com(a)xxxx.xxxx.COM
Nov 05 10:14:24 ipa1.corp.endurance.com krb5kdc[28021](info): TGS_REQ (8
etypes {18 17 20 19 16 23 25 26}) x.x.x.x: ISSUE: authtime 1572948863,
etypes {rep=18 tkt=18 ses=18}, ldap/ipa1.xxxx.xxx.com(a)xxxx.xxxx.COM for
ldap/ipa2.xxxx.xxxx.com(a)xxxx.xxxx.COM
IPA2
# tailf krb5kdc.log
Nov 05 09:59:25 ipa2.xxxx.xxxx.com krb5kdc[2451](info): AS_REQ (8 etypes
{18 17 20 19 16 23 25 26}) y.y.y.y: NEEDED_PREAUTH: ldap/
ipa2.xxxx.xxxx.com(a)xxx.xxxx.COM for krbtgt/xxxx.xxxx.COM(a)xxxx.xxxx.COM,
Additional pre-authentication required
Nov 05 09:59:25 ipa2.xxxx.xxxx.com krb5kdc[2451](info): closing down fd 11
Nov 05 09:59:25 ipa2.xxxx.xxxx.com krb5kdc[2451](info): AS_REQ (8 etypes
{18 17 20 19 16 23 25 26}) y.y.y.y: ISSUE: authtime 1572947965, etypes
{rep=18 tkt=18 ses=18}, ldap/ipa2.xxxx.xxxx.com(a)xxx.xxxx.COM for krbtgt/
xxx.xxxx.COM(a)xxx.xxxx.COM
Nov 05 09:59:25 ipa2.xxxx.xxxx.com krb5kdc[2451](info): closing down fd 11
Nov 05 09:59:25 ipa2.xxxx.xxxx.com krb5kdc[2451](info): TGS_REQ (8 etypes
{18 17 20 19 16 23 25 26}) y.y.y.y: ISSUE: authtime 1572947965, etypes
{rep=18 tkt=18 ses=18}, ldap/ipa2.xxxx.xxxx.com(a)xxxx.xxxx.COM for ldap/
ipa2.xxxx.xxxx.com(a)xxx.xxxx.COM
Nov 05 09:59:25 ipa2.xxxx.xxxx.com krb5kdc[2451](info): closing down fd 11
Regards
Nikita S
4 years, 5 months
[Announce] FreeIPA 4.8.2 released
by Alexander Bokovoy
Hello!
The FreeIPA team would like to announce FreeIPA 4.8.1 release!
It can be downloaded from http://www.freeipa.org/page/Downloads. Builds for
Fedora 30 will be available in the official Fedora repository soon.
== Highlights in 4.8.2 ==
--------
* 5608: [RFE] Add Dogtag configuration extensions
Dogtag CA allows to specify additional options in the configuration file used
to deploy CA. FreeIPA installers can now pass through an overlay configuration
file to fine-tune the CA.
--------
* 7971: [RFE] Include hint for replication_wait_timeout if timeout fails
In case replica set up times out, suggest increasing replication_wait_timeout
option before running the replica installation.
--------
=== Enhancements ===
* 8001 Need default authentication indicators for SPAKE, PKINIT and encrypted challenge preauth
When Kerberos authentication is performed with the help of SPAKE or PKINIT
pre-authentication methods, add authentication indicator to resulting tickets.
This allows filtering access to resources by a wider variety of
pre-authentication methods.
--------
* 8110 Enable AES SHA 256 and 384 Kerberos enctypes
Allow use of AES SHA 256 and 384 Kerberos encryption types by default for new Kerberos principals.
--------
* 8111 [FIPS] Don't add camellia KRB5 encsalttypes in FIPS mode
Expose only encryption types allowed in FIPS mode when creating a master in FIPS mode.
--------
* 8020 support AES in LWCA key replication
Sub-CA key replication between CA replicas now can use AES encryption to wrap the secrets.
--------
* 8044 Extdom plugin should not return LDAP_NO_SUCH_OBJECT if there are timeout or other errors
An LDAP control used by SSSD for retrieval of information about AD users and
groups was extended to properly differentiate lack of information and its
unavailability.
--------
=== Known Issues ===
=== Bug fixes ===
FreeIPA 4.8.2 is a stabilization release for the features delivered as a
part of '''FIXME''' 4.7.0 '''END FIXME'''.
There are more than 40 bug-fixes details of which can be seen in
the list of resolved tickets below.
== Upgrading ==
Upgrade instructions are available on [[Upgrade]] page.
== Feedback ==
Please provide comments, bugs and other feedback via the freeipa-users mailing
list (https://lists.fedoraproject.org/archives/list/freeipa-users@lists.fedorah...)
or #freeipa channel on Freenode.
== Resolved tickets ==
* 2018 Change hostname length limit to 64
* 3999 [RFE] Fix and Document how to set up Samba File Server with IPA
* 4972 check for existence of private group is done even if UPG definition is disabled
* 5062 [WebUI] Unlock option is enabled for all user.
* 5608 [RFE] Add Dogtag configuration extensions
* 5879 Attempt to fix capitalization fails with ipa: ERROR: Type or value exists:
* 6210 When master's IP address does not resolve to its name, ipa-replica-install fails
* 6843 ipa-backup does not create log file at /var/log/
* 7307 RFE: Extend IPA to support unadvertised replicas
* 7522 Disable cert publishing in dogtag
* 7566 Installation of replica against a specific master
* 7725 ipa-restore set wrong file permissions and ownership for /var/log/dirsrv/slapd-<instance> directory
* 7870 [certmonger][upgrade] "Failed to get request: bus, object_path and dbus_interface must not be None."
* 7961 [WebUI] Identity Manager WebUI requires you to save changes after changing specifications before making other change
* 7971 [RFE] Include hint for replication_wait_timeout if timeout fails
* 7987 Python shebang: Use isolated mode
* 7995 Removing TLSv1.0, TLSv1.1 from nss.conf
* 8001 Need default authentication indicators for SPAKE, PKINIT and encrypted challenge preauth
* 8017 host-add --password logs cleartext userpassword to Apache error log
* 8020 support AES in LWCA key replication
* 8031 HBAC Test Validation error when running the HBAC test the second time round via the IPA Web GUI
* 8034 Existing p11-kit config file is not restored on uninstall
* 8038 ipa-client-automount --uninstall is not restoring nsswitch.conf
* 8044 Extdom plugin should not return LDAP_NO_SUCH_OBJECT if there are timeout or other errors
* 8048 Travis-CI sometimes fails at dnf
* 8052 test failure in test_integration/test_sudo.py::TestSudo::()::test_domain_resolution_order on fedora29
* 8053 [WebUI] Fix login screen loading issue in test_loginscreen
* 8054 ipa-client-install calls "authselect select sssd --force" at uninstall time before restoring user-nsswitch.conf
* 8055 Test for PG6843: ipa-backup does not create log file at /var/log is failing
* 8056 BuildRequires is not compatible with %{_libdir}
* 8057 Running ipa-server-install produces SyntaxWarning: "is not" with a literal. Did you mean "!="?
* 8062 Re-add configure_nsswitch_database, configure_nsswitch, ... to ipaclient.install
* 8066 Don't use -t option to klist in adtrust code when timestamp is not needed
* 8067 add default access control configuration to trusted domain objects
* 8070 Test failure in test_integration/test_replica_promotion.py::TestHiddenReplicaPromotion::()::test_hidden_replica_install
* 8073 Backup/restore does not restore /etc/pkcs11/modules/softhsm2.module
* 8075 Don't create log file for helper scripts
* 8077 New pylint 2.4.0 errors
* 8079 [Security] By default, DNS recursion is open, breaking best practices
* 8084 KRA authentication fails when IPA CA has custom Subject DN
* 8086 ipa-server-certinstall man page does not match built-in help.
* 8099 ipa-backup command is failing on rhel-7.8
* 8102 Pylint 2.4.3 + Astroid 2.3.2 errors
* 8105 getcert with -F option returns before cacert file is created
* 8110 Enable AES SHA 256 and 384 Kerberos enctypes
* 8111 [FIPS] Don't add camellia KRB5 encsalttypes in FIPS mode
* 8113 ipa-advise on a RHEL7 IdM server is not able to generate a configuration script for a RHEL8 IdM client
* 8114 [RFE] Delegate group membership management
* 8115 Nightly test failure in fedora-30/test_smb and fedora-29/test_smb
== Detailed changelog since 4.8.1 ==
=== Armando Neto (4) ===
* prci: bump template version
* prci: increase timeout argument for test_sssd.py
* prci: increase timeout for jobs that required AD
* prci: Update box used in branch ipa-4-8
=== Alexander Bokovoy (9) ===
* Become FreeIPA 4.8.2
* Update list of contributors
* Update translations
* Add local helpers to handle unixid structure
* adtrust: add default read_keys permission for TDO objects
* add default access control when migrating trust objects
* adtrust: avoid using timestamp in klist output
* Mark failing test as xfail for use of python-dns make_ds method
* ipa-extdom-extop: test timed out getgrgid_r
=== Alexandre Mulatinho (1) ===
* ipa-scripts: fix all ipa command line scripts to operate with -I
=== Anuja More (1) ===
* Extdom plugin should not return error (32)/'No such object'
=== Christian Heimes (12) ===
* Add tests for member management
* Add group membership management
* Skip commented lines after substitution
* Block camellia in krbenctypes update in FIPS
* Don't install a preexec_fn by default
* Don't create log files from help scripts
* Fix ca_initialize_hsm_state
* Add new env vars to pylint plugin
* Fix wrong use of identity operation
* Enable literal-comparison linter again
* Replace %{_libdir} macro in BuildRequires
* Store HSM token and state
=== Cédric Jeanneret (1) ===
* Prevents DNS Amplification Attack and allow to customize named
=== Changmin Teng (5) ===
* Add design document
* Modify webUI to adhere to new IPA server API
* Implement user pre-authentication control with kdcpolicy plugin
* Extend the list of supported pre-auth mechanisms in IPA server API
* Add new authentication indicators in kdc.conf.template
=== François Cami (8) ===
* ipatests: temporarily remove test_smb from gating
* ipa_client_automount.py: fix typo (idmap.conf => idmapd.conf)
* ipapython/ipachangeconf.py: change "is not 0" for "!= 0"
* travis-ci: make dnf invocations more resilient
* authconfig.py: restore user-nsswitch.conf at uninstall time
* ipatests: remove xfail in TestIpaClientAutomountFileRestore
* ipa-client-automount: always restore nsswitch.conf at uninstall time
* ipatests: check that ipa-client-automount restores nsswitch.conf at uninstall time
=== Florence Blanc-Renaud (11) ===
* smartcard: make the ipa-advise script compatible with authselect/authconfig
* ipa-backup: fix python2 issue with os.mkdir
* ipa-server-certinstall manpage: add missing options
* ipatests: fix test_replica_promotion.py::TestHiddenReplicaPromotion
* ipatests: add XMLRPC test for user-add when UPG plugin is disabled
* ipa user_add: do not check group if UPG is disabled
* replica install: enforce --server arg
* ipatests: ensure that backup/restore restores pkcs 11 modules config file
* ipa-backup: backup the PKCS module config files setup by IPA
* config plugin: replace 'is 0' with '== 0'
* ipatests: fix wrong xfail in test_domain_resolution_order
=== Francisco Trivino (1) ===
* prci: increase gating tasks priority
=== Fraser Tweedale (7) ===
* test_integration: add tests for custom CA subject DN
* upgrade: fix ipakra people entry 'description' attribute
* krainstance: set correct issuer DN in uid=ipakra entry
* Bump Dogtag min version to 10.7.3
* ipa-pki-retrieve-key: request AES encryption (with fallback)
* NSSWrappedCertDB: accept optional symmetric algorithm
* IPASecStore: support extra key arguments
=== Michal Polovka (3) ===
* ipatests: add tests for ipa host-add with non-default maxhostnamelength
* ipatests: fix topology for TestIpaNotConfigured in PR-CI nightly definitions
* ipatests: Test for ipa-backup with ipa not configured
=== Mohammad Rizwan Yusuf (3) ===
* Add test to nightly yamls.
* Installation of replica against a specific server
* Check file ownership and permission for dirsrv log instance
=== ndehadra (1) ===
* Hidden Replica: Add a test for Automatic CRL configuration
=== Spencer E. Olson (1) ===
* Fixes debian path for IPA_CUSTODIA_HANDLER
=== Rob Crittenden (16) ===
* Conditionally restart certmonger after client installation
* Add conditional restart (try-restart) capability to services
* Enable AES SHA 256 and 384-bit enctypes in Kerberos
* Add missing timeout option to logging statement
* Log dogtag auth timeout in install, provide hint to increase it
* Log the replication wait timeout for debugging purposes
* Replace replication_wait_timeout with certmonger_wait_timeout
* Disable dogtag cert publishing
* ipa-restore: Restore ownership and perms on 389-ds log directory
* Report if a certmonger CA is missing
* Re-order tasks.restore_pkcs11_modules() to run earlier
* Don't log host passwords when they are set/modified
* Skip lock and fork in ipa-server-guard on unsupported ops
* Defer initializing the API in dogtag-ipa-ca-renew-agent-submit
* Use tasks to configure automount nsswitch settings
* Move ipachangeconf from ipaclient.install to ipapython
=== Robbie Harwood (7) ===
* Provide modern example enctypes in ipa-getkeytab(1)
* Fix segfault in ipadb_parse_ldap_entry()
* Add a skeleton kdcpolicy plugin
* Move certauth configuration into a server krb5.conf template
* Enable krb5 snippet updates on client update
* Fix NULL pointer dereference in maybe_require_preauth()
* Log INFO message when LDAP connection fails on startup
=== Rafael Guterres Jeffman (1) ===
* Fixes pylint errors introduced by version 2.4.0.
=== Rafael Guterres Jeffman (6) ===
* Removed unnecessary imports after code review.
* Removes several pylint warnings.
* Removed unnecessary imports after code review.
* Removes several pylint warnings.
* Removes rpmlint warning on freeipa.spec.
* Re-add function façades removed by commit 2da9088.
=== Sumit Bose (1) ===
* extdom: unify error code handling especially LDAP_NO_SUCH_OBJECT
=== Stanislav Levin (5) ===
* Fix errors found by Pylint-2.4.3
* Install language packs for tests
* Restore running of 'test_ipaserver' tests on Azure
* Setup DNS for AP Docker container
* Fixed errors newly exposed by pylint 2.4.0
=== Sergey Orlov (14) ===
* ipatests: enable test_smb.py in gating.yaml
* ipatests: replace ad hoc backup with FileBackup helper
* ipatests: refactor FileBackup helper
* ipatests: in DNS zone file add A record for name server
* ipatests: strip newline character when getting name of temp file
* ipatests: add test to check that only TLS 1.2 is enabled in Apache
* ipatests: fix DNS forwarders setup for AD trust tests with non-root domains
* ipatests: add tests for cached_auth_timeout in sssd.conf
* ipatests: refactoring: use library function to check if selinux is enabled
* ipatests: add new utilities for file management
* ipatests: refactor and extend tests for IPA-Samba integration
* ipatests: modify run_command to allow specify successful return codes
* ipatests: add utility functions related to using and managing user accounts
* ipatests: allow to pass additional options for clients installation
=== Serhii Tsymbaliuk (4) ===
* WebUI: Fix new test initialization on "HBAC Test" page
* WebUI: Fix changing category on HBAC/Sudo/etc Rule pages
* WebUI: Make 'Unlock' option is available only on locked user page
* WebUI tests: Fix login screen loading issue
=== Sudhir Menon (1) ===
* Added testcase to check capitalization fix while running ipa user-mod
=== Tibor Dudlák (1) ===
* Add container environment check to replicainstall
=== Tomas Halman (4) ===
* extdom: add extdom protocol documentation
* extdom: use sss_nss_*_timeout calls
* extdom: plugin doesn't use timeout in blocking call
* extdom: plugin doesn't allow @ in group name
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland
4 years, 5 months
what is the difference between idm:client and idm:DL1
by Charles Hedrick
In Centos 8, there are two streams for idm software. You need DL1 for a server. But it seems to have client software as well. Is that the same in both streams? We have a web server with the KDC proxy. It appears that we would need DL1 to get that. Is that reasonable for a system that isn’t a KDC?
4 years, 5 months
DHCP integration
by Charles Hedrick
We’re in the process of moving DHCP service to our IPA LDAP server. IN our environment it makes sense to include DHCP as part of our centralized system management scheme, which is based on IPA. We seem to be getting about a DHCP request per second, so I don’t see this causing a performance problem.
As part of this I’ve created a plugin file that defines most of the DHCP commands (global config, subnets, hosts, groups, and pools — not IPV6, classes or subclasses, but they wouldn’t be hard to add following the examples in the file). Because adding a subnet requires restarting the server, I’m concerned about changes in LDAP having errors that would prevent a server start. For that reason, the plugin writes a file with the object whose configuration is changing, and calls dhcpd in test mode to verify that the configuration is OK. If not, the error information is returned to the user. This isn’t necessary for host entries, as they are read directly from LDAP. So changes that have to be checked are comparatively rare.
We don’t currently using dynamic address allocation, so we don’t have to worry about coordinating leases. If we did, we’d using the DHCP server’s standard mechanism, and wouldn’t try to put leases into LDAP.
4 years, 5 months
FreeIPA having problem after upgrading from Fedora 30 to 31
by Patrick Dung
Hello,
I got problem upgrading from FC30 to FC31.
Before upgrade the FreeIPA in FC30 is running fine.
After OS upgrade, IPA cannot start and checked that it stuck at the CA part.
I run ipa-server-upgrade manually but there is problem.
2019-10-29T21:03:58Z DEBUG request GET
https://home.local.nonet:8443/ca/rest/account/login
2019-10-29T21:03:58Z DEBUG request body ''
2019-10-29T21:03:58Z DEBUG response status 500
2019-10-29T21:03:58Z DEBUG response headers Content-Type:
text/html;charset=utf-8
Content-Language: en
Content-Length: 2481
Date: Tue, 29 Oct 2019 21:03:58 GMT
Connection: close
2019-10-29T21:03:58Z DEBUG response body (decoded): b'<!doctype html><html
lang="en"><head><title>HTTP Status 500 \xe2\x80\x93 Internal Server
Error</title><style type="text/css">h1
{font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:22px;}
h2
{font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:16px;}
h3
{font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:14px;}
body
{font-family:Tahoma,Arial,sans-serif;color:black;background-color:white;} b
{font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;}
p
{font-family:Tahoma,Arial,sans-serif;background:white;color:black;font-size:12px;}
a {color:black;} a.name {color:black;} .line
{height:1px;background-color:#525D76;border:none;}</style></head><body><h1>HTTP
Status 500 \xe2\x80\x93 Internal Server Error</h1><hr class="line"
/><p><b>Type</b> Exception Report</p><p><b>Message</b> Subsystem
unavailable</p><p><b>Description</b> The server encountered an unexpected
condition that prevented it from fulfilling the
request.</p><p><b>Exception</b></p><pre>javax.ws.rs.ServiceUnavailableException:
Subsystem
unavailable\n\tcom.netscape.cms.tomcat.ProxyRealm.findSecurityConstraints(ProxyRealm.java:150)\n\torg.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:515)\n\tcom.netscape.cms.tomcat.ExternalAuthenticationValve.invoke(ExternalAuthenticationValve.java:82)\n\torg.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:92)\n\torg.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:678)\n\torg.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:343)\n\torg.apache.coyote.http11.Http11Processor.service(Http11Processor.java:408)\n\torg.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:66)\n\torg.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:860)\n\torg.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1589)\n\torg.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)\n\tjava.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)\n\tjava.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)\n\torg.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)\n\tjava.lang.Thread.run(Thread.java:748)\n</pre><p><b>Note</b>
The full stack trace of the root cause is available in the server
logs.</p><hr class="line" /><h3>Apache Tomcat/9.0.26</h3></body></html>'
2019-10-29T21:03:58Z ERROR IPA server upgrade failed: Inspect
/var/log/ipaupgrade.log and run command ipa-server-upgrade manually.
2019-10-29T21:03:58Z DEBUG File
"/usr/lib/python3.7/site-packages/ipapython/admintool.py", line 179, in
execute
return_value = self.run()
File
"/usr/lib/python3.7/site-packages/ipaserver/install/ipa_server_upgrade.py",
line 54, in run
server.upgrade()
File
"/usr/lib/python3.7/site-packages/ipaserver/install/server/upgrade.py",
line 2223, in upgrade
upgrade_configuration()
File
"/usr/lib/python3.7/site-packages/ipaserver/install/server/upgrade.py",
line 2093, in upgrade_configuration
ca_enable_ldap_profile_subsystem(ca)
File
"/usr/lib/python3.7/site-packages/ipaserver/install/server/upgrade.py",
line 414, in ca_enable_ldap_profile_subsystem
cainstance.migrate_profiles_to_ldap()
File "/usr/lib/python3.7/site-packages/ipaserver/install/cainstance.py",
line 1937, in migrate_profiles_to_ldap
_create_dogtag_profile(profile_id, profile_data, overwrite=False)
File "/usr/lib/python3.7/site-packages/ipaserver/install/cainstance.py",
line 1943, in _create_dogtag_profile
with api.Backend.ra_certprofile as profile_api:
File "/usr/lib/python3.7/site-packages/ipaserver/plugins/dogtag.py", line
1315, in __enter__
raise errors.RemoteRetrieveError(reason=_('Failed to authenticate to CA
REST API'))
2019-10-29T21:03:58Z DEBUG The ipa-server-upgrade command failed,
exception: RemoteRetrieveError: Failed to authenticate to CA REST API
2019-10-29T21:03:58Z ERROR Unexpected error - see /var/log/ipaupgrade.log
for details:
RemoteRetrieveError: Failed to authenticate to CA REST API
2019-10-29T21:03:58Z ERROR The ipa-server-upgrade command failed. See
/var/log/ipaupgrade.log for more information
From /var/log/pki/pki-tomcat/ca/debug log file:
2019-10-30 05:03:50 [main] FINE: LdapAuthInfo: init()
2019-10-30 05:03:50 [main] FINE: LdapAuthInfo: init begins
2019-10-30 05:03:50 [main] FINEST: Getting
internaldb.ldapauth.authtype=SslClientAuth
2019-10-30 05:03:50 [main] FINE: LdapAuthInfo: init ends
2019-10-30 05:03:50 [main] FINEST: Property internaldb.errorIfDown not found
2019-10-30 05:03:50 [main] FINEST: Getting internaldb.errorIfDown=true
2019-10-30 05:03:50 [main] FINEST: Property internaldb.doCloning not found
2019-10-30 05:03:50 [main] FINEST: Getting internaldb.doCloning=true
2019-10-30 05:03:50 [main] FINE: LdapBoundConnFactory: doCloning: true
2019-10-30 05:03:50 [main] FINE: LdapBoundConnFactory: mininum: 3
2019-10-30 05:03:50 [main] FINE: LdapBoundConnFactory: maximum: 15
2019-10-30 05:03:50 [main] FINE: LdapBoundConnFactory: host:
home.local.nonet
2019-10-30 05:03:50 [main] FINE: LdapBoundConnFactory: port: 636
2019-10-30 05:03:50 [main] FINE: LdapBoundConnFactory: secure: true
2019-10-30 05:03:50 [main] FINE: LdapBoundConnFactory: authentication: 2
2019-10-30 05:03:50 [main] FINE: LdapBoundConnFactory: makeConnection(true)
2019-10-30 05:03:50 [main] FINEST: Getting
internaldb.ldapauth.clientCertNickname=subsystemCert cert-pki-ca
2019-10-30 05:03:50 [main] FINEST: Property tcp.keepAlive not found
2019-10-30 05:03:50 [main] FINEST: Getting tcp.keepAlive=true
2019-10-30 05:03:50 [main] FINE: TCP Keep-Alive: true
2019-10-30 05:03:50 [main] FINE: LdapBoundConnection: Connecting to
home.local.nonet:636 with client cert auth
2019-10-30 05:03:50 [main] FINE: ldapconn/PKISocketFactory.makeSSLSocket:
begins
2019-10-30 05:03:50 [main] SEVERE: Unable to create socket:
java.net.ConnectException: Connection refused (Connection refused)
java.net.ConnectException: Connection refused (Connection refused)
at java.net.PlainSocketImpl.socketConnect(Native Method)
at
java.net.AbstractPlainSocketImpl.doConnect(AbstractPlainSocketImpl.java:350)
at
java.net.AbstractPlainSocketImpl.connectToAddress(AbstractPlainSocketImpl.java:206)
at
java.net.AbstractPlainSocketImpl.connect(AbstractPlainSocketImpl.java:188)
at java.net.SocksSocketImpl.connect(SocksSocketImpl.java:392)
at java.net.Socket.connect(Socket.java:607)
at java.net.Socket.connect(Socket.java:556)
at java.net.Socket.<init>(Socket.java:452)
at java.net.Socket.<init>(Socket.java:262)
Some error is logged to /var/log/messages:
Oct 30 05:26:50 home server[65722]: WARNING: Exception processing realm
[com.netscape.cms.tomcat.ProxyRealm@5647a92b] background process
Oct 30 05:26:50 home server[65722]:
javax.ws.rs.ServiceUnavailableException: Subsystem unavailable
Oct 30 05:26:50 home server[65722]: #011at
com.netscape.cms.tomcat.ProxyRealm.backgroundProcess(ProxyRealm.java:142)
Oct 30 05:26:50 home server[65722]: #011at
org.apache.catalina.core.ContainerBase.backgroundProcess(ContainerBase.java:1137)
Oct 30 05:26:50 home server[65722]: #011at
org.apache.catalina.core.StandardContext.backgroundProcess(StandardContext.java:5566)
Oct 30 05:26:50 home server[65722]: #011at
org.apache.catalina.core.ContainerBase$ContainerBackgroundProcessor.processChildren(ContainerBase.java:1353)
Oct 30 05:26:50 home server[65722]: #011at
org.apache.catalina.core.ContainerBase$ContainerBackgroundProcessor.processChildren(ContainerBase.java:1357)
Oct 30 05:26:50 home server[65722]: #011at
org.apache.catalina.core.ContainerBase$ContainerBackgroundProcessor.run(ContainerBase.java:1335)
Oct 30 05:26:50 home server[65722]: #011at
java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)
Oct 30 05:26:50 home server[65722]: #011at
java.util.concurrent.FutureTask.runAndReset(FutureTask.java:308)
Oct 30 05:26:50 home server[65722]: #011at
java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$301(ScheduledThreadPoolExecutor.java:180)
Oct 30 05:26:50 home server[65722]: #011at
java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:294)
Oct 30 05:26:50 home server[65722]: #011at
java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
Oct 30 05:26:50 home server[65722]: #011at
java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
Oct 30 05:26:50 home server[65722]: #011at
org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
Oct 30 05:26:50 home server[65722]: #011at
java.lang.Thread.run(Thread.java:748)
I am able to connect to my ldap server port 636 with TLS without problem.
Thanks,
Patrick
4 years, 5 months
number of topology segments for 3 servers clean setup?
by lejeczek
hi everyone,
I wanted to ask about number of segments after a clean IPA setup with 3
servers.
I see for both 'domain' & 'ca' two segments created by master/replica
installations, which makes me wonder - should there not be three? no/yes
& why?
many thanks, L.
4 years, 5 months
