April 2019 - FreeIPA-users - Fedora mailing-lists

Client SSH under AD trust not working
by D 29 Apr '19

29 Apr '19

Hello, This list helped solve a number of issues related to logging into clients under a cross-forest AD trust. I believe there is one final issue, I'm hoping one of the experts can have a look at the logs and configs. I can ssh into the IPA servers themselves using AD credentials just fine, however ipa clients do not permit sh Apr 29 18:14:28 va-prod-agent02 sshd[40951]: error: PAM: User not known to the underlying authentication module for illegal user bryantdj(a)splat.bt.com from va-admin.splat.bt.com 1.

1 1

[Announce] FreeIPA 4.7.90.pre1 released
by Alexander Bokovoy 29 Apr '19

29 Apr '19

The FreeIPA team would like to announce the first release candidate of FreeIPA 4.8.0 release! It can be downloaded from http://www.freeipa.org/page/Downloads. Builds for Fedora releases will be available in the official [https://copr.fedorainfracloud.org/coprs/g/freeipa/freeipa-4-8/ COPR repository]. A full release notes version can be read at https://www.freeipa.org/page/Releases/4.7.90.pre1 This mail only contains highlights and generic links due to large size of the pre-release changes: there are more than 220 bug-fixes. == Highlights in 4.7.90.pre1 == * 4580: FreeIPA's LDAP server requires SASL security strength factor of >= 56 FreeIPA LDAP server default configuration is improved to require SASL security strength factor higher than 56 bit. -------- * 4491: Use lib389 to install 389-ds instead of setup-ds.pl FreeIPA now utilizes Python-based installer of 389-ds directory server -------- * 4440: Add support for bounce_url to /ipa/ui/reset_password.html The /ipa/ui/reset_password.html page accepts url parameter to provide the user with a back link after successful password reset, to support resets initiated by external web applications. Additional parameter delay automatically redirects back after the specified number of seconds has elapsed. -------- * 5608: Tech preview: add Dogtag configuration extensions FreeIPA team started rewrite of the Certificate Authority configuration to make possible passing additional options when configuring Dogtag. This is required to allow use of hardware secure (HSM) modules within FreeIPA CA but also to allow tuning CA defaults. HSM configuration is not yet fully available due to a number of open issues in Dogtag itself. -------- * 5803: Add utility to promote CA replica to CRL master New utility was added to promote a CA replica to be the CRL master. [https://www.freeipa.org/page/V4/Promotion_to_CRL_generation_master Design page] provides more details and use examples. -------- * 6077: Support One-Way Trust authenticated by trust secret Samba integration was updated to allow establishing trust to Active Directory from Windows side using a Trust wizard. This allows to establish a one-way trust authenticated by a shared trust secret. Additionally, it allows to establish a trust with Samba AD DC 4.7 or later, initiated from Samba AD DC side. -------- * 6790: Allow creating IPA CA with 3084-bit key. CA key size default is raised to 3072 instead of 2048 because it's the recommended size by NIST. An extensibility feature added with ticket 5608 allows increasing the CA key size further buta 4096-bit key is considerably slower. The change only affects new deployments. There is no way to upgrade existing CA infrastructure other than issuing a new CA key and re-issuing new certificates to all existing users of the old root CA. In addition, lightweight sub-CAs are currently hard-coded to 2048 bit key size. All relevant public root CAs in the CA/B forum use 2048-bit RSA keys and SHA-256 PKCS#1 v1.5 signatures. -------- * 7193: Warn or adjust umask if it is too restrictive to break installation FreeIPA deployment now enforces own umask settings where required to allow deployment at hardened sites which follow some of STIG recommendations. -------- * 7200 ipa-pkinit-manage reports a switch from local pkinit to full pkinit configuration was successful although it was not The command ipa-pkinit-manage enable|disable is reporting success even though the PKINIT cert is not re-issued. The command triggers the request of a new certificate (signed by IPA CA when state=enable, selfsigned when disabled), but as the cert file is still present, certmonger does not create a new request and the existing certificate is kept. The fix consists in deleting the cert and key file before calling certmonger to request a new cert. -------- * 7206: Provide an option to include FQDN in IDM topology graph In the replication topology graph visualization, it is now possible to see a fully qualified name of the server. This change helps to reduce confusion when managing complex multi-datacenter topologies. -------- * 7365: make kdcproxy errors in httpd error log less annoying in case AD KDCs are not reachable Log level for technical messages of a KDC proxy was reduced to keep logs clean. -------- * 7451: Allow issuing certificates with IP addresses in subjectAltName FreeIPA now allows issuing certificates with IP addresses in the subject alternative name (SAN), if all of the following are true: ** One of the DNS names in the SAN resolves to the IP address (possibly through a CNAME). ** All of the DNS entries in the resolution chain are managed by this IPA instance. ** The IP address has a (correct) reverse DNS entry that is managed by this IPA instance -------- * 7568: FreeIPA no longer supports Python 2 Removed Python 2 related code and configuration from spec file, autoconf and CI infrastructure. From now on, FreeIPA 4.8 requires at least Python 3.6. Python 2 packages like python2-ipaserver or python2-ipaclient are no longer available. PR-CI, lint, and tox aren't testing Python 2 compatibility anymore. -------- * 7632: Allow IPA Services to Start After the IPA Backup Has Completed ipa-backup gathers all the files needed for the backup, then compresses the file and finally restarts the IPA services. When the backup is a large file, the compression may take time and widen the unavailabity window. This fix restarts the services as soon as all the required files are gathered, and compresses after services are restarted. -------- * 7619, 7640, 7641: UI migration, password reset and configuration pages support translations Static pages in FreeIPA web UI now allow translated content -------- * 7658: sysadm_r should be included in default SELinux user map order sysadm_r is a standard SELinux user role included in Red Hat Enterprise Linux. -------- * 7689: Domain Level 0 is no longer supported Code to support operation on Domain Level 0 is removed. In order to upgrade to FreeIPA 4.8.0 via replication, an existing deployment must first be brought up to Domain Level 1. -------- * 7747: Support interactive prompt for NTP options for FreeIPA FreeIPA now asks user for NTP source server or pool address in interactive mode if there is no server nor pool specified and autodiscovery has not found any NTP source in DNS records. -------- * 7892: Tech preview: hidden / unadvertised IPA replica A hidden replica is an IPA master server that is not advertised to clients or other masters. Hidden replicas have all services running and available, but none of the services has any DNS SRV records or enabled LDAP server roles. This makes hidden replicas invisible for service discovery. [https://pagure.io/freeipa/blob/master/f/doc/designs/hidden-replicas.md Design document] provides more details on use cases and management of hidden replicas. -------- * PyPI packages have fewer dependencies The official PyPI packages ipalib, ipapython, ipaplatform, and ipaclient no longer depend on the binary extensions netifaces and python-ldap by default. -------- === Bug fixes === There are more than 220 bug-fixes details of which can be seen in the list of resolved tickets at https://www.freeipa.org/page/Releases/4.7.90.pre1 == Upgrading == Upgrade instructions are available on [[Upgrade]] page. == Feedback == Please provide comments, bugs and other feedback via the freeipa-users mailing list (https://lists.fedoraproject.org/archives/list/freeipa-users@lists.fedorahos…) or #freeipa channel on Freenode. -- / Alexander Bokovoy Sr. Principal Software Engineer Security / Identity Management Engineering Red Hat Limited, Finland

1 0

pki-tomcatd failed to start after I replace the 3rd SSL certificate for httpd and dirsrv.
by luckydog xf 28 Apr '19

28 Apr '19

Hi, list, I replace http and dirsrv with the 3rd SSL certificated signed by Comodo, whose Root and intermediate certs are 3 files. Below is my step. 1. remove ALL certs against httpd and dirsrv, I'll write httpd only and skip dirsrv. # And I also removed /etc/pki/nssdb by the same way. certutil -D -d /etc/http/alias -n 'XXX' certutil -F -d /etc/http/alias -n 'xxxx' 2. import ca bundle.( 3 files provided by Comodo.) certutil -A -d /etc/http/alias -n 'xxx.com IPA CA' -t CT,C,C -a -i ca-bundle.crt 3. import server key and cert. cat server.key server.crt > server.all # convert it to p12. openssl pkcs12 -export -chain -CAfile ca-bundle.crt -in server.all -out Server-Cert.p12 -name "Server-Cert" pk12util -i Server-Cert.p12 -d /etc/httpd/alias/ -n Server-Cert I repeat it again for dirsrv. and did Nothing against /etc/pki/nssdb. Here are certs for httpd and dirsrv, I skip dirsrv as it's the same as httpd's. # certutil -d /etc/httpd/alias/ -L xxx.com IPA CA CT,C,C Server-Cert u,u,u COMODO RSA Organization Validation Secure Server CA - COMODO CA Limited ,, COMODO RSA Certification Authority - AddTrust AB ,, Here are certs for pki-tomcat, 3 ca bundle file don't exist, I added it by certutil. ############################### Server-Cert cert-pki-ca u,u,u auditSigningCert cert-pki-ca u,u,Pu caSigningCert cert-pki-ca CTu,Cu,Cu xxx.com IPA CA CT,C,C COMODO RSA Organization Validation Secure Server CA - COMODO CA Limited CT,C,C ocspSigningCert cert-pki-ca u,u,u subsystemCert cert-pki-ca u,u,u COMODO RSA Certification Authority - AddTrust AB CT,C,C Last, I restart service by ` ipactl restart', pki-tomcat fails to start. Below is the debug log. [26/Apr/2019:14:19:18][localhost-startStop-1]: SSLClientCertificateSelectionCB: Setting desired cert nickname to: subsystemCert cert-pki-ca [26/Apr/2019:14:19:18][localhost-startStop-1]: LdapJssSSLSocket: set client auth cert nickname subsystemCert cert-pki-ca [26/Apr/2019:14:19:18][localhost-startStop-1]: SSLClientCertificatSelectionCB: Entering! [26/Apr/2019:14:19:18][localhost-startStop-1]: SSLClientCertificateSelectionCB: returning: null [26/Apr/2019:14:19:18][localhost-startStop-1]: SSL handshake happened ######### I added it on purpose ########### Could not connect to LDAP server host wocfreeipa.sap.wingon.hk port 636 Error netscape.ldap.LDAPException: Authentication failed (48) I search a post https://floblanc.wordpress.com/2017/09/11/troubleshooting-freeipa-pki-tomca… and read it carefully, but turns out it has nothing to do with it. So can someone offer me an idea? thanks.

4 7

Looking for guidance with FreeIPA integration with Foreman/Puppet/Katello
by Jim Rice 26 Apr '19

26 Apr '19

I am looking for documentation/tutorial/personal experience advice on the proper way to integrate FreeIPA into a Foreman/Puppet/Katello environment. I am interested in the possibility of auto-provisioning of hosts (VMs mostly) using Foreman, and user account/access control via FreeIPA. But the documentation on the Foreman side is lacking, and the users there suggested I try the FreeIPA list. So, here I am ... Initial questions within our development team started with "hostgroups", and ended there, since no one knew enough about the topic to proceed. My searches here for "foreman" and "puppet" produces a dozen or so threads from a while back. But I need to take a deep dive and do my homework. I was just hoping someone out there has done this, and could point me in the right direction. Thanks!

1 0

ipa-getkeytab: PrincipalName not found
by Harald Dunkel 26 Apr '19

26 Apr '19

Hi folks, maybe I missed something, but shouldn't admin have sufficient privileges to run # ipa-client-install --hostname stretch1.vs.example.de --no-ssh --no-sshd --no-nisdomain --no-sudo --no-ntp --no-dns-sshfp # reboot : : # kinit admin # ipa-getkeytab -s ipa1.example.de -p HTTP/stretch1.vs.example.de -k /etc/apache2/apache2.keytab ? ipa-getkeytab failed with Failed to parse result: PrincipalName not found. I would have expected it to create the principal on the fly. "admin" was created at freeipa install time on the first server, AFAIR. It is member of the "admins" and "trust admins" groups. I am concerned that I corrupted something. Every helpful comment is highly appreciated. Harri

3 5

install failed on RedHat7.4
by michael_ly＠sina.cn 25 Apr '19

25 Apr '19

Dear, I encountered an error when installing freeipa using command "ipa-server-install". Error as below. Can anyone give some idea about how to solve this issue? Is this a FreeIPA bug on RH7.4 linux version? Thanks ahead. ...Done configuring Kerberos KDC (krb5kdc).Applying LDAP updatesUpgrading IPA:. Estimated time: 1 minute 30 seconds [1/9]: stopping directory server [2/9]: saving configuration [3/9]: disabling listeners [4/9]: enabling DS global lock [5/9]: starting directory server [6/9]: upgrading server [7/9]: stopping directory server [8/9]: restoring configuration [9/9]: starting directory serverDone.Restarting the KDCipa : ERROR DNS query for dev04.esgyn.cn. 1 failed: The DNS operation timed out after 30.0005099773 secondsipa : ERROR DNS query for dev04.esgyn.cn. 1 failed: The DNS operation timed out after 30.0006871223 secondsipa : ERROR DNS query for dev04.esgyn.cn. 1 failed: The DNS operation timed out after 30.0000970364 secondsipa : ERROR DNS query for dev04.esgyn.cn. 1 failed: The DNS operation timed out after 30.0009949207 secondsipa : ERROR unable to resolve host name dev04.esgyn.cn. to IP address, ipa-ca DNS record will be incompletePlease add records in this file to your DNS system: /tmp/ipa.system.records.U1YtQQ.dbConfiguring client side componentsUsing existing certificate '/etc/ipa/ca.crt'.Client hostname: dev04.esgyn.cnRealm: ESGYN.CNDNS Domain: esgyn.cnIPA Server: dev04.esgyn.cnBaseDN: dc=esgyn,dc=cn Skipping synchronizing time with NTP server.New SSSD config will be createdConfigured sudoers in /etc/nsswitch.confConfigured /etc/sssd/sssd.conftrying https://dev04.esgyn.cn/ipa/json[try 1]: Forwarding 'schema' to json server 'https://dev04.esgyn.cn/ipa/json'cannot connect to 'https://dev04.esgyn.cn/ipa/json': Internal Server ErrorThe ipa-client-install command failed. See /var/log/ipaclient-install.log for more informationipa.ipapython.install.cli.install_tool(CompatServerMasterInstall): ERROR Configuration of client side components failed!ipa.ipapython.install.cli.install_tool(CompatServerMasterInstall): ERROR The ipa-server-install command failed. See /var/log/ipaserver-install.log for more information

2 1

Multi Enrollment possible ?
by Karim Bourenane 23 Apr '19

23 Apr '19

Hello All, I need your help. I have a small projet, finale design no fixed yet : 2 IPA server in dedicat network (no link between), but with the same REALM: IPA.EXAMPLE.COM I want to deploy some IPA-client with 2 interfaces, each host interface managed by each IPA server. Can you confirm me, that its possible to enroll 2 time the ipa-client in each servers ? If yes, i need to configure well the SSSD + KRB5 (kerberos). Can you help me about this configuration ? Thanks you in advance. Bien à vous Krims

3 3

RefererError: Missing or invalid HTTP Referer
by Manuki San 23 Apr '19

23 Apr '19

I have just installed FreeIPA. When opening the main page, I get a blank page (completely blank) with the following error in the console: Error: Couldn't receive translations app.js:3:14945 translations http://freeipa.home.lan/ipa/ui/js/freeipa/app.js?40702:3 I figured out that all files of the page were loaded correctly (loader.js, jsquery.js, dojo.js etc ..) except file /ipa/i18n_messages which failed with the following error: { "error": { "code": 911, "data": { "referer": "http://freeipa.home.lan/ipa/ui/" }, "message": "Missing or invalid HTTP Referer, http://freeipa.home.lan/ipa/ui/", "name": "RefererError" }, "id": null, "principal": "UNKNOWN", "result": null, "version": "4.7.2" } The request to fetch this particular file is built as the following: Host: freeipa.home.lan User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:66.0) Gecko/20100101 Firefox/66.0 Accept: application/json, text/javascript, */*; q=0.01 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Referer: http://freeipa.home.lan/ipa/ui/ Content-Type: application/json X-Requested-With: XMLHttpRequest Content-Length: 60 DNT: 1 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache Now, when calling the same with Referer: https://freeipa.home.lan/ipa/ui/ (please not the "s" of https), I get what I suppose is the correct response, a json of size 13.68KB with different texts inside. QUESTION: Why is the loading of all components of the page with Referer: http://freeipa.home.lan/ipa/ui/ works correctly except for /ipa/i18n_messages ?

2 4

KDE administration not working for freeipa user
by Brian Watson | Watsontech.net 20 Apr '19

20 Apr '19

Hello, I have freeipa server (centos7) setup. I installed freeipa-client on my KDE Neon laptop. I can sign in with my freeipa user and am able to use sudo. But when asked for password whilst doing KDE administration, it does not work. Any logs I should check?

3 5

enable dns updates is applied but no dns updates
by Rob Verduijn 19 Apr '19

19 Apr '19

Hello, I have this laptop that is an ipa domain member. And the login/sudo/automount all works fine. However the dns entries of the laptop are not updated when the laptop starts up and gets a new ipaddress. I've looked in several configs and compared to other systems that work but can't seem to find it. Anybody got an idea where to look ? Rob my sssd.conf [domain/example.com] id_provider = ipa ipa_server = _srv_, freeipa01.example.com ipa_domain = example.com ipa_hostname = laptop.example.com auth_provider = ipa chpass_provider = ipa access_provider = ipa cache_credentials = True ldap_tls_cacert = /etc/ipa/ca.crt dyndns_update = True dyndns_iface = * krb5_store_password_if_offline = True autofs_provider = ipa ipa_automount_location = laptop [sssd] services = nss, pam, ssh, sudo, autofs domains = example.com [nss] homedir_substring = /home [pam] [sudo] [autofs] [ssh] [pac] [ifp] [secrets] [session_recording]

3 8

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users April 2019