July 2019 - FreeIPA-users - Fedora mailing-lists

ipa ca renewal master and ipa replica
by Rob Verduijn 02 Aug '19

02 Aug '19

Hello, I was doing some rtfm for migration of an ipa ca-renewal master to a different system. I figured that the docs on migrating from rhel7 to rhel8 would be a nice help for me to migrate from one centos7 to another centos 7 system. Something in the docs gave me pause. In the doc in chapter 17.4 instruction 4 https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/ht… It states that on replicas at the bottom of the file /etc/httpd/conf.d/ipa-pki-proxy.conf you should uncomment the rewrite rule and ensure it points to the 'ca renewal master' However on the centos 7 freeipa replica it points to the replica. Is the configuration on the centos7 freeipa replica incorrect ? Or is the instruction from redhat in need of updates ? If it's the first, then the installation packages of freeipa on centos need some attention, because I didn't configure that line as such. Cheers Rob

2 4

ipa-replica-install ERROR
by Boudjoudad Abdelkader 01 Aug '19

01 Aug '19

Hi, I'm trying to install an IPA server replica from but i have the issue below, i did: - Remove the IP of ipa server master from /etc/hosts - Check if there is a problem with ipa-client-install (working fine) - dig IP-ipa-server (resolved) Non of these steps works! I did some researches and it looks like this is a bug, is there a workaround ? ERROR: WARNING: conflicting time&date synchronization service 'chronyd' will be disabled in favor of ntpd Your system may be partly configured. Run /usr/sbin/ipa-server-install --uninstall to clean up. ipapython.admintool: ERROR The host name freeipa-replica.example.com does not match the primary host name freeipa-replica.example.com.x.yy.zzz.in-addr.arpa. Please check /etc/hosts or DNS name resolution ipapython.admintool: ERROR The ipa-replica-install command failed. See /var/log/ipareplica-install.log for more information Thanks,

2 3

ipa-server-install: "does not match the primary host name" - unable to work around
by Florian Dahm 01 Aug '19

01 Aug '19

Hallo! I have been trying to install FreeIPA server and keep hitting this error message: "ipapython.admintool: ERROR The host name [hostname of the local machine] does not match the primary host name [hostname of ANOTHER machine]. Please check /etc/hosts or DNS name resolution" I am at my wits' end. The machine has two NICs, one public (which shall serve the FreeIPA UI) and one private (which shall serve the actual domain services). /etc/hosts has entries for the public name for both IPv4 and v6. No amount of fiddling with parameters to ipa-server-install lets me get past this issue. Most frustratingly, the second hostname in the message is from a wholly different machine, the only connection between the two is a private VLAN on the second NIC of the local machine. I have no clue where it gets that hostname from in the first place. /var/log/ipaserver-install.log gives me: " [...] File "/usr/lib/python2.7/site-packages/ipaserver/install/server/install.py", line 455, in install_check raise ScriptError(e) 2019-07-27T09:13:33Z DEBUG The ipa-server-install command failed, exception: ScriptError: The host name epicurus.cds-infra does not match the primary host name lucan.cds-infra.de. Please check /etc/hosts or DNS name resolution [...]" I tried under both Fedora 30 and CentOS 7.6, with no difference. Has anyone encountered a similar issue, and hopefully solved it? Thank you! Regards, Florian

2 2

FW: [EXTERNAL] Re: caUserCert
by Patterson, David 30 Jul '19

30 Jul '19

The profile: it literally was the caUserCert.cfg profile with a few minor changes: Removed rsa 1024 key length and removed MD5 encryption algorithms. Command sequence: Add the modified profile: ipa certprofile-import caUserCert --file caUserCert_mod.cfg --store TRUE --desc "User certificate used for authentication" Create a dpatte.conf file has the exact same entries like your instructions Requested a key and csr file: openssl req -new -key key.pem -out dpatte.csr -config dpatte.conf ipa cert-request dpatte.csr --principal dpatte --profile-id caUserCert Result: "Subject Name Not Found" The debug log shows a trace of a java error. Just a guess on my part, but I suspect that the caUserCert profile requires three inputs one of which is subjectNameinputImpl. I suspect what I'm providing isn't what is required hence the first line of the java trace in debug file: "at com.netscape.cms.profile.input.SubjectNameInput.populate(SubjectNameInput.java:269)" I've followed your blog post using caIPAserviceCert.cfg making modifications to some defaults/constraints (like above) and it works. Now my ssh keys don't work to permit access to systems. Can I have both a cert and ssh keys? When I have a cert, ssh logs say your sshkey has been rejected by the server. When I remove the cert, sshkey is accepted. Thanks for the insight and help! David Patterson -----Original Message----- From: Fraser Tweedale <ftweedal(a)redhat.com> Sent: Sunday, July 07, 2019 11:55 PM To: Patterson, David <dpatte(a)sandia.gov> Subject: [EXTERNAL] Re: caUserCert On Wed, Jul 03, 2019 at 08:42:41PM +0000, Patterson, David wrote: > Hello, > > I followed your blog post from 8-6-2015 about User Certificates and > Custom Profiles with FreeIPA 4.2 to attempt to create user > certificates. I'm trying to use the caUserCert template, instead of > the caIPAserviceCert template. > > I've tried variations on different CN=, even modified my ldap entry to > change my CN to dpatte, but always this error. ipa: > ERROR: Request failed with status 500: Non-2xx response from CA REST > API: 500. Subject Name Not Found > > I've done a bunch of googling to see what this error means, but > never found an answer. Can you shed some light? > > Thanks! > > David Patterson > Sandia National Laboratories > Hi David, Sorry for belated reply; I was on vacation last week. The "outer" part of the error comes from the FreeIPA server when an backend HTTP request to the Dogtag CA fails. The "inner" part ("Subject Name Not Found") is used by several Dogtag profile components, and usually indicates that something went wrong constructing the certificate Subject DN. Can you please provide more detail: what is the profile configuration, what is the exact sequence of commands leading to the failure? The debug log from /var/log/pki/pki-tomcat/ca/ may also shed some light. Do you want to Cc the public mailing list freeipa-users(a)lists.fedorahosted.org? Then others besides me could assist (and benefit from the solution). Up to you of course. Cheers, Fraser

1 0

IPA's mechanism/way equivalent to pam_exec - how?
by lejeczek 30 Jul '19

30 Jul '19

hi guys, I probably expect too much I realize - is something like pam_exec available/feasible in freeIPA? many thanks, L.

1 0

mapping freeipa to local users and group
by Andrew Meyer 30 Jul '19

30 Jul '19

I want to map my freeipa users to local users on a particular server. I have read a few sites that say to do sss_override. However I am running into a problem: [andrew.meyer@server01 ~]$ sudo sss_override user-add andrew.meyer -n ameyer Other than LOCAL view already exists in domain freeipa.local. But I remember seeing this somewhere as well:group: files [SUCCESS=merge] sss Will doing the merge satisfy what I want? Thanks,Andrew

3 3

`users` command shows `user user@domain` when logging in with a smartcard
by Khurrum Maqb 30 Jul '19

30 Jul '19

If a user logs in to a Centos 7.6 system with ipa 4.6.4-10 using a Smartcard (gdm-greeter), the output of the `users` command is user user(a)dom.ain If a user logs in to the same system with a username and password, the output of the `users` command is user user Where could user(a)dom.ain be showing up from? it doesn't show up anywhere else as far as I can tell. It's been a non-issue, but our Cisco AnyConnect VPN configs mandate that only one user be logged in when connecting to VPN. When a user logs in with a username and password, the VPN connects. But when a user logs in with a smartcard + pin, anyConnect complains multiple users logged in and disconnects. I believe AnyConnect is looking at the output of `users` and is seeing `user user(a)dom.ain` and treating that as two different users. Why does logging on with a smartcard on this system result in a user called user(a)dom.ain and how can I change it so that either all of them are just called user, or all of them are just called user(a)dom.ain. Thank you so much!

2 3

trust AD - kerberos - how it works?
by lejeczek 30 Jul '19

30 Jul '19

hi guys I've been having my IPA deployment trusting AD for a while now and it's been behaving pretty good I must say, except for one thing - kerberos, in some places at least. What I've needed really, or mainly that trust for, was ssh with gssapi and that is what I'd like to ask about - interaction between IPA and AD when it comes to kerberos - my AD win-clients sometimes would have tickets and be able to ssh with gssapi, some other time it would not work and ssh would ask for passwords. I cannot really spot any pattern there and I hope some expert could decipher this for me and help to understand what and why that happens. many thanks, L.

3 4

Intermitent AD atribute fetch
by Jo Domsic 30 Jul '19

30 Jul '19

Hi freeipa-users! My IPA users occasionally report these issues: 1. Unable to login (failed pub key) via ssh on linux server 2. Missing shell (defaulted to sh, instead of bash or zsh) after ssh login on linux server 3. Missing home directory after ssh login on linux server All of the users are present in ActiveDirectory (domain=ad.lan), and attributes are set (sshPublicKey and loginShell). AD and FreeIPA are trusting each other. Linux servers are joined to domain (domain=ipa.lan). I can confirm (1) fails when I run: /usr/bin/sss_ssh_authorizedkeys user(a)ad.lan. It returns empty. Repeated runs return the same result - nothing. And both (2) and (3) happen without noticeable correlation to any other event. I can confirm it by running getent passwd user(a)ad.lan. It displays some fields (either home folder or shell) as empty. Issue (1) can be fixed with restarting sssd service and sss_cache -E. Issue (2) mostly fixes itself after X amount of time (sometimes a minute, something an hour). Issue (3) can be fixed same as (1), but sometimes also when repeating ssh connection (logout/login). And as you might think: it's tiresome. :) Does it make sense to you? Which logs would be most useful to get the bottom of this? Note: AD servers 2016 Freeipa version v4.6.4 (both servers and clients) on Centos 7.

4 5

External CA
by Christian Reiss 30 Jul '19

30 Jul '19

Hey folks, Would it be possible to get FreeIPA to sign an arbitrary, non IPA managed CA? Background: Before FreeIPA we enrolled our own CA for internal services and imported the CA into the browsers, which worked like a charm. Now with FreeIPA we would have to import two CAs into the browsers and would like to have the external CA as an intermediate. It's okay to roll out a new CA & certificates. I also tried to add a 2nd CA via the web-Gui, which worked. But I could not figure out how to get that private key. So in short: The way doesn't matter. In the end I would like to have an intermediate CA, signed by FreeIPA main CA which a 10+ year validity that I can externally use. Any approach to that? Thanks, Chris. -- Christian Reiss - email(a)christian-reiss.de /"\ ASCII Ribbon support(a)alpha-labs.net \ / Campaign X against HTML WEB alpha-labs.net / \ in eMails GPG Retrieval https://gpg.christian-reiss.de GPG ID ABCD43C5, 0x44E29126ABCD43C5 GPG fingerprint = 9549 F537 2596 86BA 733C A4ED 44E2 9126 ABCD 43C5 "It's better to reign in hell than to serve in heaven.", John Milton, Paradise lost.

3 2

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users July 2019