October 2020 - FreeIPA-users - Fedora mailing-lists

Is it possible to alter the default two-year expiration of derived certificates
by Bo Lind 20 Oct '20

20 Oct '20

I'm generating certificates for a bunch of not-enrolled, not-certmonger-feasible services (our printer, for example) and I'd like a little longer life cycle than the standard two years. I can't for the life of me figure out where I can set that. Thanks in advance.

2 1

Ticket expired
by Albert Szostkiewicz 19 Oct '20

19 Oct '20

Every time I restart on my workstation, I am getting errors with authentication $ ipa ipa: ERROR: Ticket expired $ kinit myuser Password for myuser(a)HOME.MYDOMAIN.COM: ****** $ ipa cert-show 1 Issuing CA: ipa Certificate: ####### Subject: CN=Certificate Authority,O=HOME.MYDOMAIN.COM Issuer: CN=Certificate Authority,O=HOME.MYDOMAIN.COM Not Before: Thu Sep 19 01:27:28 2019 UTC Not After: Mon Sep 19 01:27:28 2039 UTC Serial number: 1 Serial number (hex): 0x1 Revoked: False $ ipa pwpolicy-show global_policy Group: global_policy Max lifetime (days): 20000 Min lifetime (hours): 1 History size: 0 Character classes: 0 Min length: 8 Max failures: 21 Failure reset interval: 60 Lockout duration: 600 $ ipa Usage: ipa [global-options] COMMAND [command-options] Manage an IPA domain Options: ... Then, I have to restart services that failed (like autofs) in order to mount NFSv4 properly. Problem is - I have to do it every time I restart machine. Is there any additional step I should take on my workstation ? Thanks!

2 3

Migrating from LDAP to FreeIPA
by Per Qvindesland 19 Oct '20

19 Oct '20

Hi I am currently in the process of migrating from a LDAP server to IPA installed on a Centos 8 instance. I been following these instructions on importing users from the LDAP server https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/ht… but it's asking for the Directory Manager password, I took over position very recently and there is a password which is supposed to be for that account but it's not accepted. Is it possible with the ipa migrate-ds to specify another user, i'd say no since the docs doesn't mention anything but I thought that I ask, or is it possible to use a ldif file to import the users? Regards Per

2 1

Adding a KRA
by Ronald Wimmer 19 Oct '20

19 Oct '20

At the moment we only have KRA on one of our eight IPA servers. Is it sufficient to issue the ipa-kra-install command on a replica where the CA role is already present? Cheers, Ronald

2 3

Adding Host through FreeIPA web UI
by anilkumar panditi 19 Oct '20

19 Oct '20

I am trying to add a host through FreeIPA UI , and followed the below procedure. Click on Hosts Tab> Add> enter details like Hostname, IP , and checked force And ADD. My host is added but , under Enrollment section i see Kerberos Key not Present. How could i add this Kerberos Key. so i could login into this added host using LDAP user? Please help.

2 4

Adding subjectAltName when the certificate is signed
by Radosław Kujawa 15 Oct '20

15 Oct '20

Hi list. Is it possible to add email subjectAltName to a certificate when it is being signed by the IPA? My use case is that I have CSRs generated by the users. The tool used to generate the CSR does not allow to add me to include an email subjectAltName. The problem is that private key is held on the external device, so I am not easily able to manipulate the CSR using openssl. I already have a specific certificate profile added to IPA, used for this process. But I am not sure if it is possible to enforce adding SAN with user's email address when signing the certificate. I'd be grateful for any hints. Best regards, Radoslaw

4 5

FreeIPA, OSX, DockerDesktop
by james liu 14 Oct '20

14 Oct '20

PREP ==== git clone https://github.com/freeipa/freeipa-container.git cd freeipa-container mkdir /tmp/ipa-data docker run --name freeipa-server-container -ti -h ipa.example.test --read-only -v /tmp/ip-data :/data:Z freeipa-server --sysctl net.ipv6.conf.all.disable_ipv6=1 RESULT ====== tar: etc/sysconfig/selinux: Cannot utime: No such file or directory tar: Exiting with failure status due to previous errors QUESTION ========= I'm running DockerDesktop 2.0.4, OSX 10.13.6. Is there a set of commands that will work? Thanks

4 6

How to use the forms based login interface to give IPA admin access to selected federated users?
by Chris Dagdigian 12 Oct '20

12 Oct '20

Hi folks, I've got a three-node replicating FreeIPA cluster running in AWS with a one-way trust to an Active Directory domain. Things work well with respect to user overrides and RBAC rules affecting client machines but I can't for the life of me figure out the order of operations for allowing a couple of external AD users to have admin access to the FreeIPA webUI itself. There are 3 AD users I'd like to give WebUI admin access to. So far I've tried the standard stuff I've used for non-IPA clients: 1) make group "corp_admins_external" populated with external "username(a)domain.com" identities 2) Make group "corp_admins_posix" populated with the corp_admins_external group 3) Added corp_admins_posix group to the admin group Best I've been able to do so far is give myself login access to just the user self-service page and even then that failed until oddjob-mkhomedir() was running and enabled under authconfig Is there a guide or a documentation set specific to granting admin access to the webUI for forms-based login users? Thanks! Chris

3 8

Announcing SSSD 2.4.0
by Pavel Březina 12 Oct '20

12 Oct '20

# SSSD 2.4.0 The SSSD team is proud to announce the release of version 2.4.0 of the System Security Services Daemon. The tarball can be downloaded from: https://github.com/SSSD/sssd/releases/tag/sssd-2_4_0 See the full release notes at: https://sssd.io/docs/users/relnotes/notes_2_4_0 RPM packages will be made available for Fedora shortly. ## Feedback Please provide comments, bugs and other feedback via the sssd-devel or sssd-users mailing lists: https://lists.fedorahosted.org/mailman/listinfo/sssd-devel https://lists.fedorahosted.org/mailman/listinfo/sssd-users ## Highlights - `libnss` support was dropped, SSSD now supports only `openssl` cryptography ### New features - Session recording can now exclude specific users or groups when `scope` is set to `all` (see `exclude_users` and `exclude_groups` options) - Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery ### Packaging changes - python2 bindings are disable by default, use `--with-python2-bindings` to build it ### Documentation Changes - Default value of `client_idle_timeout` changed from 60 to 300 seconds for KCM, this allows more time for user interaction (e.g. during `kinit`) - Added `exclude_users` and `exclude_groups` option to `session_recording` section, this allows to exclude user or groups from session recording when `scope` is set to `all` - Added `ldap_library_debug_level` option to enable debug messages from `libldap` - Added `dyndns_auth_ptr` to set authentication mechanism for PTR DNS records update - Added `ad_allow_remote_domain_local_groups` to be compatible with other solutions

1 0

How to disable NTP on an ipa-server
by Christopher Lamb 09 Oct '20

09 Oct '20

2 4

Re: Stop/Disable Apache on IdM servers
by Rob Crittenden 09 Oct '20

09 Oct '20

Angus Clarke via FreeIPA-users wrote: > Hello > > We have a single mesh of FreeIPA servers in several different locations, > we capture logs (apache ErrorLog directive) to a log server in each of > those locations. When auditors ask us questions we have to trawl log > servers from all locations as our IdM administrators might have used any > of the IdM servers to make changes. > > To limit that access to one site, I am considering stopping and > disabling apache on all IdM servers at other sites and just wanted to > check there are no unintended consequences in that action. > > I'm not looking for enforcement, merely a means of persuading the team > to use the web interface or command line tools at one site. It's completely untested so if something went wrong you'd be pretty far out on the ledge. You're purposely creating a single-point-of-failure. You'd need to work out some system to transition the web server to another server. The chosen server would need to run a CA, otherwise it will try to find one and fail at connecting since the CA connect is proxied through Apache. Establishing a new CA would likewise almost certainly be problematic. The ipa-ca CNAME is used so clients can use OCSP. You'd have to manually limit this value to only the available web server. Same with CRL. Running other administrative commands on those hosts would fail miserably (ipa-certupdate, ipa-cacert-manage for sure). I'm not certain if ipa-server-upgrade which is also run at package installation needs local API access. IPA servers make certain assumptions about what basic services are available. So this could well be the kind of thing that seems to work, you relax and forget about it, then all heck breaks loose. Either way, masking/stopping the service wouldn't really work since it is managed via ipactl. You'd have to mark the service as disabled in IPA, and I'm not sure you can do that to an IPA service so you'd probably have to do it manually using ldapmodify. rob

2 1

permanent service account keys for kerberos NFS share
by Kevin Vasko 09 Oct '20

09 Oct '20

Hello, We have an application that does some data processing on our NFS server. Users typically just ssh into a box which then has a kerberos key generated for them, which allows them access the NFS share and run the script. We are wanting to set this up in a more automated fashion. Such as running the script in the background as a service. However, after a few days the kerberos keys become invalid killing access to the NFS share and the data. Is there a way to generate some account/keys that will have permanent access for service level stuff like this? -Kevin

3 3

slapd-IPA-MYDOMAIN-COM missing configuration.
by Albert Szostkiewicz 08 Oct '20

08 Oct '20

Hi! My dirsrv(a)IPA-MYDOMAIN-COM.service on IPA server fails to start due to missing configuration. How can I re-create one ? journalctl: ds_systemd_ask_password_acl[10117]: grep: /etc/dirsrv/slapd-IPA-MYDOMAIN-COM/dse.ldif: No such file or directory ns-slapd[10122]: INFO - dse_check_file - The config /etc/dirsrv/slapd-IPA-MYDOMAIN-COM/dse.ldif can not be accessed. Attempting restore ... (reason: 0) ns-slapd[10122]: INFO - dse_check_file - The backup /etc/dirsrv/slapd-IPA-MYDOMAIN-COM/dse.ldif.bak can not be accessed. Check it exists and permissions. ns-slapd[10122]: ERR - slapd_bootstrap_config - No valid configurations can be accessed! You must restore /etc/dirsrv/slapd-IPA-MYDOMAIN-COM/dse.ldif from ba> ns-slapd[10122]: EMERG - main - The configuration files in directory /etc/dirsrv/slapd-IPA-MYDOMAIN-COM could not be read or were not found. Please refer to> systemd[1]: dirsrv(a)IPA-MYDOMAIN-COM.service: Main process exited, code=exited, status=1/FAILURE systemd[1]: dirsrv(a)IPA-MYDOMAIN-COM.service: Failed with result 'exit-code'. systemd[1]: Failed to start 389 Directory Server IPA-MYDOMAIN-COM.. -- Subject: Unit dirsrv(a)IPA-MYDOMAIN-COM.service has failed $ ls /etc/dirsrv/ drwxr-xr-x 2 root root 82 Nov 13 2019 config -rw------- 1 dirsrv dirsrv 570 Sep 18 2019 ds.keytab drwxr-xr-x 2 root root 25 Nov 13 2019 schema drwxr-x--- 4 dirsrv dirsrv 4096 Oct 7 21:26 slapd-HOME-MYDOMAIN-COM drwxr-x--- 2 dirsrv dirsrv 37 Sep 18 2019 slapd-HOME-MYDOMAIN-COM.removed drwxr-x--- 2 dirsrv dirsrv 37 Feb 18 2019 slapd-IPA-MYDOMAIN-COM.removed There is one ".removed" - not sure why and if i can maybe re-use it ? Cheers!

3 5

Stop/Disable Apache on IdM servers
by Angus Clarke 08 Oct '20

08 Oct '20

Hello We have a single mesh of FreeIPA servers in several different locations, we capture logs (apache ErrorLog directive) to a log server in each of those locations. When auditors ask us questions we have to trawl log servers from all locations as our IdM administrators might have used any of the IdM servers to make changes. To limit that access to one site, I am considering stopping and disabling apache on all IdM servers at other sites and just wanted to check there are no unintended consequences in that action. I'm not looking for enforcement, merely a means of persuading the team to use the web interface or command line tools at one site. Thanks! Angus

1 0

pki-tomcat wont start; LDAP auth failure
by Arjen Heidinga 08 Oct '20

08 Oct '20

Hello all! Since sime time my pki-tomcat deamon can't connect to the LDAP., ging me an error (below). The root-CA was expired in the meantime, I fixed it with some hack-n-slashwork. I am not sure what credentials (none, client cert?) are used to connect. Does anyone have pointers? Hope I have not snipped too much log. Thanks, Arjen Heidinga freeipa-server-common-4.8.9-2.fc32.noarch 2020-10-08 12:46:35 [main] FINEST: Getting internaldb.doCloning=true 2020-10-08 12:46:35 [main] FINE: LdapBoundConnFactory: doCloning: true 2020-10-08 12:46:35 [main] FINE: LdapBoundConnFactory: mininum: 3 2020-10-08 12:46:35 [main] FINE: LdapBoundConnFactory: maximum: 15 2020-10-08 12:46:35 [main] FINE: LdapBoundConnFactory: host: starkey.platypusnet.org 2020-10-08 12:46:35 [main] FINE: LdapBoundConnFactory: port: 636 2020-10-08 12:46:35 [main] FINE: LdapBoundConnFactory: secure: true 2020-10-08 12:46:35 [main] FINE: LdapBoundConnFactory: authentication: 2 2020-10-08 12:46:35 [main] FINE: LdapBoundConnFactory: makeConnection(true) 2020-10-08 12:46:35 [main] FINEST: Getting internaldb.ldapauth.clientCertNickname=subsystemCert cert-pki-ca 2020-10-08 12:46:35 [main] FINEST: Property tcp.keepAlive not found 2020-10-08 12:46:35 [main] FINEST: Getting tcp.keepAlive=true 2020-10-08 12:46:35 [main] FINE: TCP Keep-Alive: true 2020-10-08 12:46:35 [main] FINE: LdapBoundConnection: Connecting to starkey.platypusnet.org:636 with client cert auth 2020-10-08 12:46:35 [main] FINE: ldapconn/PKISocketFactory.makeSSLSocket: begins 2020-10-08 12:46:35 [main] FINE: SSLClientCertificateSelectionCB: Setting desired cert nickname to: subsystemCert cert-pki-ca 2020-10-08 12:46:35 [main] FINE: LdapJssSSLSocket: set client auth cert nickname subsystemCert cert-pki-ca 2020-10-08 12:46:35 [main] FINE: SSLClientCertificatSelectionCB: Entering! 2020-10-08 12:46:35 [main] FINE: Candidate cert: Server-Cert cert-pki-ca 2020-10-08 12:46:35 [main] FINE: Candidate cert: caSigningCert cert-pki-ca 2020-10-08 12:46:35 [main] FINE: SSLClientCertificateSelectionCB: returning: null 2020-10-08 12:46:35 [main] FINE: PKIClientSocketListener.handshakeCompleted: begins 2020-10-08 12:46:35 [main] FINE: Handshake completed: 2020-10-08 12:46:35 [main] FINE: - client: 192.168.124.201 2020-10-08 12:46:35 [main] FINE: - server: 192.168.124.201 2020-10-08 12:46:35 [main] FINE: - subject: SYSTEM 2020-10-08 12:46:35 [main] FINE: SignedAuditLogger: event CLIENT_ACCESS_SESSION_ESTABLISH 2020-10-08 12:46:35 [main] FINE: LogFile: event type not selected: CLIENT_ACCESS_SESSION_ESTABLISH 2020-10-08 12:46:35 [main] FINE: PKIClientSocketListener.handshakeCompleted: CS_CLIENT_ACCESS_SESSION_ESTABLISH_SUCCESS 2020-10-08 12:46:35 [main] FINE: PKIClientSocketListener.handshakeCompleted: clientIP=192.168.124.201 serverIP=192.168.124.201 serverPort=31746 2020-10-08 12:46:35 [main] FINE: SSL handshake happened 2020-10-08 12:46:35 [main] SEVERE: LdapBoundConnFactory: Unable to connect to LDAP server: Authentication failed netscape.ldap.LDAPException: Authentication failed (48) at netscape.ldap.LDAPSaslBind.checkForSASLBindCompletion(Unknown Source) at netscape.ldap.LDAPSaslBind.bind(Unknown Source) at netscape.ldap.LDAPSaslBind.bind(Unknown Source) at netscape.ldap.LDAPConnection.authenticate(Unknown Source) at netscape.ldap.LDAPConnection.authenticate(Unknown Source) at netscape.ldap.LDAPConnection.checkClientAuth(Unknown Source) at netscape.ldap.LDAPConnection.connect(Unknown Source) at netscape.ldap.LDAPConnection.connect(Unknown Source) at netscape.ldap.LDAPConnection.connect(Unknown Source) at com.netscape.cmscore.ldapconn.LdapBoundConnection.<init>(LdapBoundConnection.java:105) at com.netscape.cmscore.ldapconn.LdapBoundConnFactory.makeConnection(LdapBoundConnFactory.java:285) at com.netscape.cmscore.ldapconn.LdapBoundConnFactory.init(LdapBoundConnFactory.java:261)

2 1

IPA and JQuery 1.2 < 3.5.0 XSS
by Christopher Lamb 07 Oct '20

07 Oct '20

3 3

Replace Web UI Cert
by Chuck Musser 07 Oct '20

07 Oct '20

Hi, We operate our own certificate authority for our internal infrastructure and I'd like to replace the certificate that comes with the FreeIPA installation with one we've generated for this host. This is FreeIPA, version: 4.6.6, running on CentOS Linux release 7.8.2003 (Core). I looked around in the docs and couldn't see anything for this particular task. I did add a certificate to the FreeIPA host (under Identity->Host), but that doesn't seem to be the correct (or only) thing to do. In the certificates area, it appears, but has incomplete information and isn't marked VALID. What is the procedure for doing this? Thanks, Chuck

3 6

FreeIPA web UI Login issue.
by Randall Hodges 07 Oct '20

07 Oct '20

I just started working for a new company and they handed me this IPA replication server with an issue logging on to the web UI. I get errors when we try to login. I have been all over the web looking for answers. I have check the permission of all the certs and they are correct all have 0644 on them. I have done strace on the WSGI pids with no answers. I have no idea if this ever worked from the install since I just started working for the company last week and the guy who built it is no longer there. I have noticed that since it cannot authenticate it will not write to ccache in /var/run/ipa/ccaches. Everything works from the command line with no issue. I can also run kinit admin and put the password in with no issues. If I run a curl from command it works no issues. Just cant login in from the browser. I have restart ipa using ipactl restart. All the services are running just fine. However I noticed in the log file for the install there were errors. I don't know if this ever worked or not. This is replicating back to known working servers just fine. I was added and it shows up in the server. stderr=kinit: Client 'WELLKNOWN/ANONYMOUS@.example.us' not found in Kerberos database while getting initial credentials CalledProcessError: Command '/usr/bin/kinit -n -c /var/run/ipa/ccaches/armor_25969 -X X509_anchors=FILE:/var/kerberos/krb5kdc/kdc.crt -X X509_anchors=FILE:/var/lib/ipa-client/pki/kdc-ca-bundle.pem' returned non-zero exit status 1 [root@Server ccaches]# klist Ticket cache: KEYRING:persistent:0:0 Default principal: admin(a)example.us Valid starting Expires Service principal 10/06/2020 15:09:44 10/06/2020 20:56:18 HTTP/Server.US 10/05/2020 20:56:30 10/06/2020 20:56:18

2 6

UPPERCASE usernames
by Pieter Baele 07 Oct '20

07 Oct '20

Hi , Current IPA environment is using lowercase usernames. But we also have a LDAP environment in which usernames are in UPPERCASE. This is used for "some" krb tickets possibilities. Imagine we add users to the Default Trust View and adapt login to UPPERCASE. Can we expect some troubles or nuisances (think SSO, SSH, Kerberos...) I remember very good some installers don't like adding local users on installation with a login in uppercase. We can use other override(s), but maybe this is not feasible from a user management perspective. Especially regarding the normal typical POSIX way, which was also described in the username restrictions thread (10/2018) [1] https://paulgorman.org/technical/presentations/linux_username_conventions.p… Sincerely, Pieter

1 0

Replica setup fails for Centos 8 Stream
by Uzor Ide 07 Oct '20

07 Oct '20

Hi All, I have a curious issue where ipa-replica-install fails or rather crashes just as it is about for complete. Both the master and the replica are Centos 8 Stream. I have also tested a replica on fedora 32 with the same result. Just after ipa-custodia setup is complete I get the following error ERROR CalledProcessError(Command ['/usr/bin/PKCS12Export', '-d', '/tmp/tmpdysxuo2a', '-p', '/tmp/tmpdysxuo2a/pwdfile.txt', '-w', '/tmp/tmpdysxuo2a/crtpwfile', '-o', '/tmp/tmpii01v5iyipa/cacert.p12'] returned non-zero exit status 134: '/usr/bin/PKCS12Export: line 94: 9156 Aborted (core dumped) ${JAVA} ${JAVA_OPTIONS} -cp "${PKI_LIB}/*" -Djava.util.logging.config.file=${PKI_LOGGING_CONFIG} com.netscape.cmstools.${COMMAND} "$@"\n') 2020-10-06T03:32:12Z ERROR The ipa-replica-install command failed. See /var/log/ipareplica-install.log for more information From replica-install-log, It appears that is trying to export some certificates 2020-10-06T03:32:09Z DEBUG Starting external process 2020-10-06T03:32:09Z DEBUG args=['/usr/bin/PKCS12Export', '-d', '/tmp/tmpdysxuo2a', '-p', '/tmp/tmpdysxuo2a/pwdfile.txt', '-w', '/tmp/tmpdysxuo2a/crtpwfile', '-o', '/tmp/tmpii01v5iyipa/cacert.p12'] 2020-10-06T03:32:12Z DEBUG Process finished, return code=134 2020-10-06T03:32:12Z DEBUG stdout=# # A fatal error has been detected by the Java Runtime Environment: # # SIGSEGV (0xb) at pc=0x00007f479d6ce313, pid=9156, tid=0x00007f479ed46700 # # JRE version: OpenJDK Runtime Environment (8.0_265-b01) (build 1.8.0_265-b01) # Java VM: OpenJDK 64-Bit Server VM (25.265-b01 mixed mode linux-amd64 compressed oops) # Problematic frame: # V [libjvm.so+0x818313] LinkResolver::runtime_resolve_virtual_method(CallInfo&, methodHandle, KlassHandle, Handle, KlassHandle, bool, Thread*)+0x83 # # Core dump written. Default location: /root/core or core.9156 # # An error report file with more information is saved as: # /root/hs_err_pid9156.log # # If you would like to submit a bug report, please visit: # http://bugreport.java.com/bugreport/crash.jsp # 2020-10-06T03:32:12Z DEBUG stderr=/usr/bin/PKCS12Export: line 94: 9156 Aborted (core dumped) ${JAVA} ${JAVA_OPTIONS} -cp "${PKI_LIB}/*" -Djava.util.logging.config.file=${PKI_LOGGING_CONFIG} com.netscape.cmstools.${COMMAND} "$@" 2020-10-06T03:32:12Z DEBUG File "/usr/lib/python3.6/site-packages/ipapython/admintool.py", line 179, in execute return_value = self.run() File "/usr/lib/python3.6/site-packages/ipapython/install/cli.py", line 340, in run return cfgr.run() File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 360, in run return self.execute() File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 386, in execute for rval in self._executor(): File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 431, in __runner exc_handler(exc_info) File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 460, in _handle_execute_exception self._handle_exception(exc_info) File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 450, in _handle_exception six.reraise(*exc_info) File "/usr/lib/python3.6/site-packages/six.py", line 693, in reraise raise value File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 421, in __runner step() File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 418, in <lambda> step = lambda: next(self.__gen) File "/usr/lib/python3.6/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from six.reraise(*exc_info) File "/usr/lib/python3.6/site-packages/six.py", line 693, in reraise raise value File "/usr/lib/python3.6/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from value = gen.send(prev_value) File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 655, in _configure next(executor) File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 431, in __runner exc_handler(exc_info) File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 460, in _handle_execute_exception self._handle_exception(exc_info) File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 518, in _handle_exception self.__parent._handle_exception(exc_info) File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 450, in _handle_exception six.reraise(*exc_info) File "/usr/lib/python3.6/site-packages/six.py", line 693, in reraise raise value File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 515, in _handle_exception super(ComponentBase, self)._handle_exception(exc_info) File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 450, in _handle_exception six.reraise(*exc_info) File "/usr/lib/python3.6/site-packages/six.py", line 693, in reraise raise value File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 421, in __runner step() File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 418, in <lambda> step = lambda: next(self.__gen) File "/usr/lib/python3.6/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from six.reraise(*exc_info) File "/usr/lib/python3.6/site-packages/six.py", line 693, in reraise raise value File "/usr/lib/python3.6/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from value = gen.send(prev_value) File "/usr/lib/python3.6/site-packages/ipapython/install/common.py", line 65, in _install for unused in self._installer(self.parent): File "/usr/lib/python3.6/site-packages/ipaserver/install/server/__init__.py", line 602, in main replica_install(self) File "/usr/lib/python3.6/site-packages/ipaserver/install/server/replicainstall.py", line 402, in decorated func(installer) File "/usr/lib/python3.6/site-packages/ipaserver/install/server/replicainstall.py", line 1318, in install ca.install(False, config, options, custodia=custodia) File "/usr/lib/python3.6/site-packages/ipaserver/install/ca.py", line 270, in install install_step_0(standalone, replica_config, options, custodia=custodia) File "/usr/lib/python3.6/site-packages/ipaserver/install/ca.py", line 308, in install_step_0 replica_config.dirman_password) File "/usr/lib/python3.6/site-packages/ipaserver/install/custodiainstance.py", line 305, in get_ca_keys self._get_keys(cacerts_file, cacerts_pwd, data) File "/usr/lib/python3.6/site-packages/ipaserver/install/custodiainstance.py", line 295, in _get_keys '-o', cacerts_file File "/usr/lib/python3.6/site-packages/ipapython/ipautil.py", line 598, in run p.returncode, arg_string, output_log, error_log 2020-10-06T03:32:12Z DEBUG The ipa-replica-install command failed, exception: CalledProcessError: CalledProcessError(Command ['/usr/bin/PKCS12Export', '-d', '/tmp/tmpdysxuo2a', '-p', '/tmp/tmpdysxuo2a/pwdfile.txt', '-w', '/tmp/tmpdysxuo2a/crtpwfile', '-o', '/tmp/tmpii01v5iyipa/cacert.p12'] returned non-zero exit status 134: '/usr/bin/PKCS12Export: line 94: 9156 Aborted (core dumped) ${JAVA} ${JAVA_OPTIONS} -cp "${PKI_LIB}/*" -Djava.util.logging.config.file=${PKI_LOGGING_CONFIG} com.netscape.cmstools.${COMMAND} "$@"\n') It also core dumps Master/Replica IPA Packages ================= ipa-healthcheck-core-0.4-6.module_el8.3.0+482+9e103aab.noarch ipa-server-trust-ad-4.8.7-12.module_el8.3.0+511+8a502f20.x86_64 libipa_hbac-2.3.0-9.el8.x86_64 python3-ipalib-4.8.7-12.module_el8.3.0+511+8a502f20.noarch python3-ipaserver-4.8.7-12.module_el8.3.0+511+8a502f20.noarch ipa-client-common-4.8.7-12.module_el8.3.0+511+8a502f20.noarch ipa-selinux-4.8.7-12.module_el8.3.0+511+8a502f20.noarch ipa-client-4.8.7-12.module_el8.3.0+511+8a502f20.x86_64 ipa-server-dns-4.8.7-12.module_el8.3.0+511+8a502f20.noarch ipa-common-4.8.7-12.module_el8.3.0+511+8a502f20.noarch ipa-server-common-4.8.7-12.module_el8.3.0+511+8a502f20.noarch python3-ipaclient-4.8.7-12.module_el8.3.0+511+8a502f20.noarch ipa-server-4.8.7-12.module_el8.3.0+511+8a502f20.x86_64 python3-libipa_hbac-2.3.0-9.el8.x86_64.

2 4

Re: ipa migrate-ds not updating group memberships
by Rob Crittenden 06 Oct '20

06 Oct '20

Alfred Victor wrote: > Hi Rob, > > Thanks for confirming. Is there any way to simply accomplish a sync, or > will we need to achieve this by adding/removing groups using ipa > commands based on an ldapsearch? There is no IPA tool to do a sync like this. If you add/remove groups in IPA to achieve it you run the risk of losing changes some IPA admin has made. What is it you're syncing from? rob > > Paul > > On Tue, Oct 6, 2020 at 12:42 PM Rob Crittenden <rcritten(a)redhat.com > <mailto:rcritten@redhat.com>> wrote: > > Alfred Victor via FreeIPA-users wrote: > > Hi FreeIPA, > > > > Maybe I've misunderstood how migrate-ds should work, worth mentioning > > the source directory is RFC2307 - if ipa migrate-ds migrates a user, > > then later that user is added more groups and the same migrate-ds > > command is run again, should it not add the user into the > corresponding > > groups on IPA which did not have its memberUid prior? > > It isn't a sync tool. If an entry already exists then it is considered > migrated and skipped. > > rob >

2 1

Health Checks for RHEL7
by White, David 06 Oct '20

06 Oct '20

Are any of you aware of any way to get these health checks working on a RHEL 7 system? https://github.com/freeipa/freeipa-healthcheck IIRC, these checks weren't really introduced until a newer version of FreeIPA, so they are only included on RHEL 8 and above, but I'm wondering if there's a way to get these installed manually. Is this possible on RHEL 7? I tried doing the following a lab environment: - Downloaded the code and extracted it - pip3 install pytest-runner - python3 setup.py install Now, I do have an executable at /usr/local/bin/ipa-healthcheck However, when I go to run that, I'm getting the following error: [root@cha-cop-lab-mgt-ath-001 freeipa-healthcheck-master]# /usr/local/bin/ipa-healthcheck Traceback (most recent call last): File "/usr/local/bin/ipa-healthcheck", line 11, in <module> load_entry_point('ipahealthcheck==0.6', 'console_scripts', 'ipa-healthcheck')() File "/usr/lib/python3.6/site-packages/pkg_resources/__init__.py", line 476, in load_entry_point return get_distribution(dist).load_entry_point(group, name) File "/usr/lib/python3.6/site-packages/pkg_resources/__init__.py", line 2700, in load_entry_point return ep.load() File "/usr/lib/python3.6/site-packages/pkg_resources/__init__.py", line 2318, in load return self.resolve() File "/usr/lib/python3.6/site-packages/pkg_resources/__init__.py", line 2324, in resolve module = __import__(self.module_name, fromlist=['__name__'], level=0) ModuleNotFoundError: No module named 'ipahealthcheck'

2 3

ipa migrate-ds not updating group memberships
by Alfred Victor 06 Oct '20

06 Oct '20

Hi FreeIPA, Maybe I've misunderstood how migrate-ds should work, worth mentioning the source directory is RFC2307 - if ipa migrate-ds migrates a user, then later that user is added more groups and the same migrate-ds command is run again, should it not add the user into the corresponding groups on IPA which did not have its memberUid prior? Alfred

2 1

Get list of IPA users
by Dominik Vogt 06 Oct '20

06 Oct '20

To get a list of Ipa users one can type something like $ ipa user-find | grep "User login:" | sed -e "/.* //" This works on any ipa client, but can take a couple of seconds. This is a bit clumsy when scripting because scripts are slow to respond. Is there a quicker way to get that list? Ciao Dominik ^_^ ^_^ -- Dominik Vogt

2 2

Privileges needed for ipa-client-install
by Ronald Wimmer 05 Oct '20

05 Oct '20

What are the least privileges an IPA user would need to run ipa-client-install? I added the permission "System: Add Hosts" to the "Host Enrollment" privilege but unfortunately that was not sufficient. Cheers, Ronald

2 1

Login "System error"
by Dominik Vogt 05 Oct '20

05 Oct '20

Somehow I've managed to damage the ipa server configuration so that ipal users cannot login anymore. Local users work fine. Using the console on the ipa server: Login: ... Password: ... System error Messages in /var/log/secure say: -- ... login[25478]: pam_sss(login:auth): authentication failure; logname=LOGIN uid=0 euid=0 tty=tty1 ruser= rhost= user=USERNAME ... login[25478]: pam_sss(login:auth): received for user USERNAME: 12 (Authentication token is no longer valid; new one required) ... login[25478]: pam_sss(login:account): Access denied for user USERNAME: 4 (System error) ... login[25478]: System error -- I've no idea what the problem could be. (The "no longer valid" message is because it's the initial password that needs to be changed.) Ciao Dominik ^_^ ^_^ -- Dominik Vogt

1 1

POSIX ids of all AD users
by Ronald Wimmer 03 Oct '20

03 Oct '20

How could I possibly find the POSIX ids of all mapped Active Directory users? I do neither see them in LDAP nor do I find them with IPA user find. Cheers, Ronald

4 6

Re: POSIX ids of all AD users
by Ronald Wimmer 03 Oct '20

03 Oct '20

On 03.10.20 08:45, Angus Clarke wrote: > Hi Ronald > > Look at the "Attribute Editor" tab against a user account in "Active > Directory users and computers." It should be in the list there > (uidNumber) amongst other useful things. > > I'm no Microsoft administrator but am aware that this "Attribute > Editor" tab is not listed if you search for the user; rather you have > to browse to the user through the tree. Unfortunately, I do only have LDAP access to our AD. AD is managed by a separate department.

1 1

yum update problem
by Natxo Asenjo 02 Oct '20

02 Oct '20

hi, after patching our centos 7 hosts to the latest version today, one of the two replicas is having trouble. [root@kdc2 ~]# ipactl status Directory Service: RUNNING krb5kdc Service: STOPPED kadmin Service: STOPPED named Service: STOPPED httpd Service: RUNNING ipa-custodia Service: STOPPED ntpd Service: STOPPED pki-tomcatd Service: RUNNING smb Service: STOPPED winbind Service: STOPPED ipa-otpd Service: STOPPED ipa-dnskeysyncd Service: STOPPED ipa: INFO: The ipactl command was successful and after digging in the logs I come across this in /var/log/ipaupgrade.log: 2019-11-20T18:18:29Z DEBUG stderr= 2019-11-20T18:18:31Z INFO Certmonger certificate renewal configuration already up-to-date 2019-11-20T18:18:31Z INFO [Enable PKIX certificate path discovery and validation] 2019-11-20T18:18:31Z DEBUG Loading StateFile from '/var/lib/ipa/sysupgrade/sysupgrade.state' 2019-11-20T18:18:31Z INFO PKIX already enabled 2019-11-20T18:18:31Z INFO [Authorizing RA Agent to modify profiles] 2019-11-20T18:18:31Z INFO [Authorizing RA Agent to manage lightweight CAs] 2019-11-20T18:18:31Z INFO [Ensuring Lightweight CAs container exists in Dogtag database] 2019-11-20T18:18:31Z DEBUG Created connection context.ldap2_139740162547472 2019-11-20T18:18:31Z DEBUG flushing ldapi://%2fvar%2frun%2fslapd-L-DOMAIN-IT.socket from SchemaCache 2019-11-20T18:18:31Z DEBUG retrieving schema for SchemaCache url=ldapi://%2fvar%2frun%2fslapd-L-DOMAIN-IT.socket conn=<ldap.ldapobject.SimpleLDAPObject instance at 0x7f17cc24b638> 2019-11-20T18:18:31Z DEBUG Destroyed connection context.ldap2_139740162547472 2019-11-20T18:18:31Z INFO [Adding default OCSP URI configuration] 2019-11-20T18:18:31Z INFO [Ensuring CA is using LDAPProfileSubsystem] 2019-11-20T18:18:31Z INFO [Migrating certificate profiles to LDAP] 2019-11-20T18:18:31Z DEBUG Created connection context.ldap2_139740160021648 2019-11-20T18:18:31Z DEBUG flushing ldapi://%2fvar%2frun%2fslapd-L-DOMAIN-IT.socket from SchemaCache 2019-11-20T18:18:31Z DEBUG retrieving schema for SchemaCache url=ldapi://%2fvar%2frun%2fslapd-L-DOMAIN-IT.socket conn=<ldap.ldapobject.SimpleLDAPObject instance at 0x7f17cc289b00> 2019-11-20T18:18:31Z DEBUG Destroyed connection context.ldap2_139740160021648 2019-11-20T18:18:31Z DEBUG request GET https://kdc2.l.domain.it:8443/ca/rest/account/login 2019-11-20T18:18:31Z DEBUG request body '' 2019-11-20T18:18:31Z DEBUG response status 401 2019-11-20T18:18:31Z DEBUG response headers Server: Apache-Coyote/1.1 Cache-Control: private Expires: Thu, 01 Jan 1970 01:00:00 CET WWW-Authenticate: Basic realm="Certificate Authority" Content-Type: text/html;charset=utf-8 Content-Language: en Content-Length: 951 Date: Wed, 20 Nov 2019 18:18:31 GMT 2019-11-20T18:18:31Z DEBUG response body '<html><head><title>Apache Tomcat/7.0.76 - Error report</title><style></style> </head><body><h1>HTTP Status 401 - </h1><HR size="1" noshade="noshade"><p><b>type</b> Status report</p><p><b>message</b> <u></u></p><p><b>description</b> <u>This request requires HTTP authentication.</u></p><HR size="1" noshade="noshade"><h3>Apache Tomcat/7.0.76</h3></body></html>' 2019-11-20T18:18:31Z ERROR IPA server upgrade failed: Inspect /var/log/ipaupgrade.log and run command ipa-server-upgrade manually. 2019-11-20T18:18:31Z DEBUG File "/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 178, in execute return_value = self.run() File "/usr/lib/python2.7/site-packages/ipaserver/install/ipa_server_upgrade.py", line 54, in run server.upgrade() File "/usr/lib/python2.7/site-packages/ipaserver/install/server/upgrade.py", line 2146, in upgrade upgrade_configuration() File "/usr/lib/python2.7/site-packages/ipaserver/install/server/upgrade.py", line 2018, in upgrade_configuration ca_enable_ldap_profile_subsystem(ca) File "/usr/lib/python2.7/site-packages/ipaserver/install/server/upgrade.py", line 406, in ca_enable_ldap_profile_subsystem cainstance.migrate_profiles_to_ldap() File "/usr/lib/python2.7/site-packages/ipaserver/install/cainstance.py", line 2027, in migrate_profiles_to_ldap _create_dogtag_profile(profile_id, profile_data, overwrite=False) File "/usr/lib/python2.7/site-packages/ipaserver/install/cainstance.py", line 2033, in _create_dogtag_profile with api.Backend.ra_certprofile as profile_api: File "/usr/lib/python2.7/site-packages/ipaserver/plugins/dogtag.py", line 1315, in __enter__ raise errors.RemoteRetrieveError(reason=_('Failed to authenticate to CA REST API')) 2019-11-20T18:18:31Z DEBUG The ipa-server-upgrade command failed, exception: RemoteRetrieveError: Failed to authenticate to CA REST API 2019-11-20T18:18:31Z ERROR Unexpected error - see /var/log/ipaupgrade.log for details: RemoteRetrieveError: Failed to authenticate to CA REST API In this kdc I see these errors in getcert list: Request ID '20190220182014': status: MONITORING ca-error: Invalid cookie: u'' stuck: no key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert cert-pki-ca',token='NSS Certificate DB',pin set certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert cert-pki-ca',token='NSS Certificate DB' CA: dogtag-ipa-ca-renew-agent issuer: CN=Certificate Authority,O=L.DOMAIN.IT subject: CN=CA Audit,O=L.DOMAIN.IT expires: 2019-12-05 13:58:24 UTC key usage: digitalSignature,nonRepudiation pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "auditSigningCert cert-pki-ca" track: yes auto-renew: yes Request ID '20190220182015': status: MONITORING ca-error: Invalid cookie: u'' stuck: no key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert cert-pki-ca',token='NSS Certificate DB',pin set certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert cert-pki-ca',token='NSS Certificate DB' CA: dogtag-ipa-ca-renew-agent issuer: CN=Certificate Authority,O=L.DOMAIN.IT subject: CN=OCSP Subsystem,O=L.DOMAIN.IT expires: 2019-12-05 13:58:24 UTC key usage: digitalSignature,nonRepudiation,keyCertSign,cRLSign eku: id-kp-OCSPSigning pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "ocspSigningCert cert-pki-ca" track: yes auto-renew: yes Request ID '20190220182016': status: MONITORING ca-error: Invalid cookie: u'' stuck: no key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert cert-pki-ca',token='NSS Certificate DB',pin set certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert cert-pki-ca',token='NSS Certificate DB' CA: dogtag-ipa-ca-renew-agent issuer: CN=Certificate Authority,O=L.DOMAIN.IT subject: CN=CA Subsystem,O=L.DOMAIN.IT expires: 2019-12-05 13:58:24 UTC key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment eku: id-kp-serverAuth,id-kp-clientAuth pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "subsystemCert cert-pki-ca" track: yes auto-renew: yes Request ID '20190220182018': status: MONITORING ca-error: Invalid cookie: u'' stuck: no key pair storage: type=FILE,location='/var/lib/ipa/ra-agent.key' certificate: type=FILE,location='/var/lib/ipa/ra-agent.pem' CA: dogtag-ipa-ca-renew-agent issuer: CN=Certificate Authority,O=L.DOMAIN.IT subject: CN=IPA RA,O=L.DOMAIN.IT expires: 2019-12-05 13:58:44 UTC key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment eku: id-kp-serverAuth,id-kp-clientAuth pre-save command: /usr/libexec/ipa/certmonger/renew_ra_cert_pre post-save command: /usr/libexec/ipa/certmonger/renew_ra_cert track: yes auto-renew: yes Request ID '20190220182019': status: MONITORING ca-error: Server at " https://kdc2.l.domain.it:8443/ca/agent/ca/profileProcess" replied: 1: Invalid Credential. stuck: no key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert cert-pki-ca',token='NSS Certificate DB',pin set certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert cert-pki-ca',token='NSS Certificate DB' CA: dogtag-ipa-ca-renew-agent issuer: CN=Certificate Authority,O=L.DOMAIN.IT subject: CN=kdc2.l.domain.it,O=L.DOMAIN.IT expires: 2019-12-10 10:57:52 UTC key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment eku: id-kp-serverAuth,id-kp-clientAuth,id-kp-emailProtection pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "Server-Cert cert-pki-ca" track: yes auto-renew: yes I still have a working replica, so I could just reinstall and have a working set in a couple of minutes, but I would like to find out what has gone wrong. The systems are running ipa-server-4.6.5-11.el7.centos.3.x86_64 Any help welcome ;-) Thanks, -- Groeten, natxo

4 12

Principal name change
by Kobus Bensch 02 Oct '20

02 Oct '20

Hi I can find anything on search so here goes: I installed freeipa with domain: company.com, but this now needs to change to newcompany.net Can someone please direct me to docs that i can read to make this change? Thank you Kobus

2 1

Re: Renewing a failed to auto-renewal certificate
by Stuart McRobert 02 Oct '20

02 Oct '20

Dear flo, Thanks for the helpful links. To check whether replication is possible between the three freeipa servers, via the web interface on each, I have successfully created three new users: + On server 1 create a new user 1 and check they appear on servers 2 & 3 - yes + On server 2 create a new user 2 and check they appear on servers 1 & 3 - yes + On server 3 create a new user 3 and check they appear on servers 1 & 2 - yes Then for each user remove them from a different server to where they were created. This worked as expected. However I do appear to have one user whose information failed to correctly replicate some time ago, causing an inconsistency that I am uncertain on the best way to fix. On server 1 via web attempt to view this specific user: Operations Error Some operations failed. XXX: user not found which should be displayed as a preserved user entry but lacks any details shown other than the "user login". On server 2 this user appears as an active user, with details, status disabled. On server 3 this user appears as a preserved user, with full details, and a note I added to the Class field a few days ago to see whether it would then just replicate but failed. In logs, searching for the user in question on server 1 ./httpd/error_log:[Sun Sep 20 10:34:14.256333 2020] [wsgi:error] [pid 29637] [remote IP_ADDRESS:56930] ipa: INFO: [jsonserver_session] sm@OUR_DOMAIN: user_find(u'USER_XXX', sizelimit=0, version=u'2.215', pkey_only=True): SUCCESS ./httpd/error_log:[Sun Sep 20 10:34:28.721951 2020] [wsgi:error] [pid 29637] [remote IP_ADDRESS:56932] ipa: INFO: [jsonserver_session] sm@OUR_DOMAIN: user_find(u'USER_XXX', preserved=True, sizelimit=0, version=u'2.215', pkey_only=True): SUCCESS ./httpd/error_log:[Sun Sep 20 10:34:28.738772 2020] [wsgi:error] [pid 29636] [remote IP_ADDRESS:56932] ipa: INFO: sm@OUR_DOMAIN: batch: user_show(u'USER_XXX', no_members=True): NotFound ./httpd/error_log:[Sun Sep 20 10:34:28.738952 2020] [wsgi:error] [pid 29636] [remote IP_ADDRESS:56932] ipa: INFO: [jsonserver_session] sm@OUR_DOMAIN: batch(({u'params': ((u'USER_XXX',), {u'no_members': True}), u'method': u'user_show'},), version=u'2.215'): SUCCESS Which just confirms what was seen via the web interface. Next go looking in /var/log/dirsrv/slapd-OUR-DOMAIN/errors and find lots of these messages: [20/Sep/2020:11:18:12.449932996 +0100] - ERR - NSMMReplicationPlugin - changelog program - repl_plugin_name_cl - agmt="cn=caToserver2" (server2:389): CSN 5bb473ef000000070000 not found, we aren't as up to date, or we purged [20/Sep/2020:11:18:12.452051936 +0100] - ERR - NSMMReplicationPlugin - send_updates - agmt="cn=caToserver2" (server2:389): Data required to update replica has been purged from the changelog. If the error persists the replica must be reinitialized. [20/Sep/2020:11:18:15.479226915 +0100] - ERR - agmt="cn=caToserver2" (server2:389) - clcache_load_buffer - Can't locate CSN 5bb473ef000000070000 in the changelog (DB rc=-30988). If replication stops, the consumer may need to be reinitialized. [20/Sep/2020:11:18:15.481677959 +0100] - ERR - NSMMReplicationPlugin - changelog program - repl_plugin_name_cl - agmt="cn=caToserver2" (server2:389): CSN 5bb473ef000000070000 not found, we aren't as up to date, or we purged [20/Sep/2020:11:18:15.483458741 +0100] - ERR - NSMMReplicationPlugin - send_updates - agmt="cn=caToserver2" (server2:389): Data required to update replica has been purged from the changelog. If the error persists the replica must be reinitialized. But is that the only CSN found to be missing, seems to be based on this search: grep -v 5bb473ef000000070000 ./dirsrv/slapd-OUR-DOMAIN/errors | grep -v "If the error persists" 389-Directory/1.3.6.6 B2017.145.2031 server1.OUR-DOMAIN:636 (/etc/dirsrv/slapd-OUR-DOMAIN) [18/Sep/2020:05:57:26.038958649 +0100] - ERR - NSMMReplicationPlugin - release_replica - agmt="cn=meToserver3" (server3:389): Unable to parse the response to the endReplication extended operation. [18/Sep/2020:17:45:55.236862951 +0100] - ERR - NSMMReplicationPlugin - release_replica - agmt="cn=caToserver2" (server2:389): Unable to parse the response to the endReplication extended operation. Turning next to server 2 and the dirsrv logs there, lots of messages of the form: [17/Sep/2020:19:33:24.075845464 +0100] - ERR - DSRetroclPlugin - delete_changerecord: could not delete change record 6773158 (rc: 32) [17/Sep/2020:19:33:24.076296207 +0100] - ERR - DSRetroclPlugin - delete_changerecord: could not delete change record 6773159 (rc: 32) [17/Sep/2020:19:33:24.077311010 +0100] - ERR - DSRetroclPlugin - delete_changerecord: could not delete change record 6773160 (rc: 32) [17/Sep/2020:19:33:24.077830624 +0100] - ERR - DSRetroclPlugin - delete_changerecord: could not delete change record 6773161 (rc: 32) [19/Sep/2020:19:59:28.091654453 +0100] - ERR - NSMMReplicationPlugin - release_replica - agmt="cn=meToserver1" (server1:389): Unable to parse the response to the endReplication extended operation. Finally for server 3, dirsrv logs appear to be more about getting started after certificate problems the other day, rather than issues seen on the other servers, but this server does appear to display the user fully as would be desired everywhere. Our old version appears to lack the 389 command dsconf so not been able to use that to help. Summary: + Replication appears to work for e.g. new users + I guess one entry has failed to be replicated correctly causing the inconsistent state on the other two servers + This should ideally be corrected to avoid further issues??? + Uncertain about the best way to do this, suggestions very welcome as first time fixing such problems and I don't want to make it any worse, after all replications seems to be working for everything else. Thanks Best wishes Stuart

2 1

OK_AS_DELEGATE by default
by Ronald Wimmer 02 Oct '20

02 Oct '20

Is it possible to set this flag by default for all new IPA hosts? Cheers, Ronald

3 5

Replica not renewing IPA certificates
by Roderick Johnstone 02 Oct '20

02 Oct '20

Hi This is freeipa (ipa-server-4.6.5-11.el7_7.3.x86_64) on RHEL7 with freeipa's own internal CA. One of my ipa server replicas (host3) has not renewed its IPA system certificates and is now showing ca-error: Invalid cookie: u'' in the 'getcert list' output for certificates: "auditSigningCert cert-pki-ca", "ocspSigningCert cert-pki-ca", "subsystemCert cert-pki-ca", and the certificate in the file /var/lib/ipa/ra-agent.pem As far as I can see, the sequence of events has been as follows: host3 noticed the certificates needed renewing at 30 Jan 2020 05:37 and certmonger initiated a renewal. The state of those certificates went from MONITORING to CA_WORKING but the certificates were not renewed. The CA renewal master (host1) noticed its same set of certificates (plus "Server-Cert cert-pki-ca") needed renewing at 30 Jan 2020 07:28 and renewed them successfully. Another replica (host2) noticed that its certificates needed renewing at 30 Jan 2020 07:32 and renewed them successfully. At 30 Jan 13:37 on host3 the certificates needing to be renewed went from CA_WORKING back to MONITORING, but 'getcert list' now shows them with: ca-error: Invalid cookie: u'' and they still haven't renewed. I haven't seen certmonger attempt to try the renewal again on host3 (nothing from certmonger in /var/log/messages since 30 Jan 13:37). While I could try a getcert resubmit on host3 to force it to try again, I'd like to know if what I am seeing is the expected behaviour when a replica tried to renew certificates before the renewal master. How long should I have to wait till certmonger on host3 tries again? - I couldn't find any reference to how often certmonger tries the renewal. Rob Crittenden's freeipa-healthcheck script is now showing the following for host3: ERROR: ipahealthcheck.ipa.certs.IPARAAgent: RA agent description does not match 2;16;CN=Certificate Authority,O=EXAMPLE.COM;CN=IPA RA,O=EXAMPLE.COM in LDAP and 2;7;CN=Certificate Authority,O=EXAMPLE.COM;CN=IPA RA,O=EXAMPLE.COM expected ERROR: ipahealthcheck.ipa.certs.IPACertRevocation.20180926040924: Request for certificate failed, Certificate operation cannot be completed: EXCEPTION (Invalid Credential.) ERROR: ipahealthcheck.ipa.certs.IPACertRevocation.20180926040920: Request for certificate failed, Certificate operation cannot be completed: EXCEPTION (Invalid Credential.) ERROR: ipahealthcheck.ipa.certs.IPACertRevocation.20180926040921: Request for certificate failed, Certificate operation cannot be completed: EXCEPTION (Invalid Credential.) ERROR: ipahealthcheck.ipa.certs.IPACertRevocation.20180926040922: Request for certificate failed, Certificate operation cannot be completed: EXCEPTION (Invalid Credential.) ERROR: ipahealthcheck.ipa.certs.IPACertRevocation.20180926040923: Request for certificate failed, Certificate operation cannot be completed: EXCEPTION (Invalid Credential.) ERROR: ipahealthcheck.ipa.certs.IPACertRevocation.20180926040925: Request for certificate failed, Certificate operation cannot be completed: EXCEPTION (Invalid Credential.) ERROR: ipahealthcheck.ipa.certs.IPACertRevocation.20180926040927: Request for certificate failed, Certificate operation cannot be completed: EXCEPTION (Invalid Credential.) ERROR: ipahealthcheck.ipa.certs.IPACertRevocation.20180926040926: Request for certificate failed, Certificate operation cannot be completed: EXCEPTION (Invalid Credential.) ERROR: ipahealthcheck.ipa.certs.IPACertRevocation.20180831064406: Request for certificate failed, Certificate operation cannot be completed: EXCEPTION (Invalid Credential.) ERROR: ipahealthcheck.dogtag.ca.DogtagCertsConnectivityCheck: Request for certificate failed, Certificate operation cannot be completed: EXCEPTION (Invalid Credential.) Each of host1, host2 and host3 are showing serial number 16 in ldap using: ldapsearch -D "cn=directory manager" -W -b uid=ipara,ou=people,o=ipaca description At this stage I'm not sure whether this will resolve itself when certmonger tries to renew certificates again or whether I need to be more proactive. I'm happy to supply more logs as necessary. Thanks Roderick

3 3

Re: SSL/TLS Server Support for TLDv1.0 on port(s) other than 443
by Ian Pilcher 01 Oct '20

01 Oct '20

On 10/1/20 12:42 PM, Auerbach, Steven via FreeIPA-users wrote: > What is the proper way to change the overall openssl configuration to > set the ssl_min toTLSv1.2? https://directory.fedoraproject.org/docs/389ds/howto/howto-ssl.html You can see your current settings with: ldapsearch -x -D 'cn=Directory Manager' -W -b 'cn=encryption,cn=config' -- ======================================================================== In Soviet Russia, Google searches you! ========================================================================

1 0

SSL/TLS Server Support for TLDv1.0 on port(s) other than 443
by Auerbach, Steven 01 Oct '20

01 Oct '20

I have been able to force NSSProtocol to TLSv1.2 on the web service of this IPA server in the nss.conf. But I am receiving a Threat Assessment Hit (SecureWorks) that TLSv1.0 is open on port 636/TCP. I attempted to manually edit the /etc/dirsrv/slapd-<domain>/dse.ldif file, but once I made that change it broke the 389Directory and it would not start. What is the proper way to change the overall openssl configuration to set the ssl_min toTLSv1.2? Thanks. Steven Auerbach Assistant Director of Information Systems Information Technology & Security State University System of Florida Board of Governors 325 W. Gaines Street Tallahassee, Florida 32399 (850) 245-9592 www.flbog.edu<http://www.flbog.edu/>

1 0

Modify LDAP/HTTP to add alternative names
by Willie Lima 01 Oct '20

01 Oct '20

Hi guys, I have 12 freeipa servers deployed with integrated DNS and CA (realm and domain int.example.com) I would like to make a DNS round-robin, for instance: request ldap.int.example.com and forward for one of the servers and also an external domain ldap.example.com The problem is with the certificate, the TLS handshake fails because there's no alternative name with ldap.int.example.com or ldap.example.com. I read the redhat documentation about certificate manipulation, but I got very confused in fact how it works. How can I do that? Are there another recommendation?

4 8

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users October 2020