March 2020 - FreeIPA-users - Fedora mailing-lists

Removal & clean up certificates from o=ipaca
by David Goudet 30 Sep '24

30 Sep '24

Hello all, I have to clean up lot of useless certificate in dirsrv database. Because of resubmit loop on Certmonger client, i have 99,9% of certificate in dirsrv database that are useless and not obsolete (expiration in 2020) (it represent ~85 000 certificates). These useless certificates produce some issues on FreeIPA: - decrease FreeIPA performances on CLI and GUI - increase the LDAP size - increase size and time of FreeIPA backup ... Is it possible to purge these certificates in dirsrv database and how? I found two branches in LDAP directory about these certificates: dn: cn=xxx,ou=ca,ou=requests,o=ipaca dn: cn=yyy,ou=certificateRepository,ou=ca,o=ipaca I can remove all requests and certificates entry from dirsrv database but how it is supported by PKI manager Dogtag (CRL, certificate generation, OCSP)? (This topic has already been discuss on https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost…) Thank you for you help -- David GOUDET LYRA NETWORK IT Operations service Tel : +33 (0)5 32 09 09 74 | Poste : 574

4 7

How to prevent non-admin users of FreeIPA from reading the list of users in the web interface?
by cdknight 16 Apr '24

16 Apr '24

When a user signs in to FreeIPA, I do not want them to be able to view the list of users in my LDAP server under the "Active users" link. I still want them to be able to administer self-service, so they can reset their password, add OTP tokens, etc. How would I go about doing this? The users will only be able to access the web interface, so it doesn't matter whether they can access it from other sources.

5 10

certmonger error on ubuntu
by Robson Francisco de Souza 07 Feb '24

07 Feb '24

Hello! I've been running FreeIPA 4.3.1 on Ubuntu 16.04 for almost two years and most certificates should expire within three weeks. As this deadline approaches, I noticed certmonger has been unable to renew certificates due to the error below. After googling for two days, I found this issue has been observed by many people before, mostly after expiration of the certificates, as in https://tinyurl.com/vajmocw Still, I couldn't find a solution to this problem. If it is impossible to fix this issue while using FreeIPA 4.3.1, I would like to: 1) Find a way to renew all certificates even if certmonger can't be fixed. This would allow me to postpone the solution to after the next OS and/or FreeIPA upgrade 2) Find out what version of FreeIPA I should upgrade to while the operating system remains Ubuntu 16.04 Any help would be appreciated! Thanks! Robson ======> Command: systemctl status certmonger Nov 17 20:53:08 ipa.cefapnet.icb.usp.br certmonger[3873125]: 2019-11-17 20:53:08 [3873125] Error 77 connecting to https://ipa.cefapnet.icb.usp.br:8443/ca/agent/ca/profileReview: Problem with the SSL CA cert (path? access rights?). Nov 17 21:10:13 ipa.cefapnet.icb.usp.br dogtag-ipa-ca-renew-agent-submit[3875188]: Forwarding request to dogtag-ipa-renew-agent Nov 17 21:10:13 ipa.cefapnet.icb.usp.br dogtag-ipa-ca-renew-agent-submit[3875188]: dogtag-ipa-renew-agent returned 3 Nov 17 21:10:13 ipa.cefapnet.icb.usp.br certmonger[3873125]: 2019-11-17 21:10:13 [3873125] Error 77 connecting to https://ipa.cefapnet.icb.usp.br:8443/ca/agent/ca/profileReview: Problem with the SSL CA cert (path? access rights?). Nov 17 21:25:20 ipa.cefapnet.icb.usp.br dogtag-ipa-ca-renew-agent-submit[3875738]: Forwarding request to dogtag-ipa-renew-agent Nov 17 21:25:20 ipa.cefapnet.icb.usp.br dogtag-ipa-ca-renew-agent-submit[3875738]: dogtag-ipa-renew-agent returned 3 Nov 17 21:25:21 ipa.cefapnet.icb.usp.br certmonger[3873125]: 2019-11-17 21:25:21 [3873125] Error 77 connecting to https://ipa.cefapnet.icb.usp.br:8443/ca/agent/ca/profileReview: Problem with the SSL CA cert (path? access rights?). Nov 17 21:25:31 ipa.cefapnet.icb.usp.br dogtag-ipa-ca-renew-agent-submit[3875766]: Forwarding request to dogtag-ipa-renew-agent Nov 17 21:25:31 ipa.cefapnet.icb.usp.br dogtag-ipa-ca-renew-agent-submit[3875766]: dogtag-ipa-renew-agent returned 3 Nov 17 21:25:31 ipa.cefapnet.icb.usp.br certmonger[3873125]: 2019-11-17 21:25:31 [3873125] Error 77 connecting to https://ipa.cefapnet.icb.usp.br:8443/ca/agent/ca/profileReview: Problem with the SSL CA cert (path? access rights?). -- Robson Francisco de Souza, PhD Laboratório de Estrutura e Evolução de Proteínas (LEEP/PSEL) Departamento de Microbiologia Instituto de Ciências Biomédicas Universidade de São Paulo Av. Prof. Lineu Prestes, 1374 - Ed. Biomédicas II - Sala 250 - 2o. andar Tel: 3091-0891 Cidade Universitária - CEP 05508-900 - São Paulo - SP - Brasil ---- Robson Francisco de Souza, PhD Protein Structure and Evolution Laboratory (LEEP/PSEL) Microbiology Departament Biomedical Sciences Institute University of Sao Paulo Av. Prof. Lineu Prestes, 1374 - Biomédicas II - Sala 250 Phone: 55-11-3091-0891 Cidade Universitária - ZIP 05508-900 - São Paulo - SP - Brazil

6 10

FreeIPA web session timeout
by Yuri Krysko 10 Jan '24

10 Jan '24

Hello, Could you please advise how to configure FreeIPA web UI user session timeout? Thanks, Yuri ________________________________ LEGAL DISCLAIMER: M.C. Dean, Inc. and its subsidiaries considers this e-mail and any files transmitted with it to be protected, proprietary or privileged information intended solely for the use of the named recipient(s). Any disclosure of this material or the information contained herein, in whole or in part, to anyone outside of the intended recipient or affiliates is strictly prohibited. M. C. Dean, Inc. accepts no liability for the content of this e-mail or for the consequences of any actions taken on the basis of the information contained in it, unless that information is subsequently confirmed in writing. Employees of M.C. Dean, Inc. are instructed not to infringe on any rights of the recipient; any such communication violates company policy. If you are not the intended recipient, any disclosure, copying, distribution, or action taken or omitted in reliance on this information is strictly prohibited by M.C. Dean, Inc.; please notify the sender immediately by return e-mail, delete this communication and destroy all copies.

4 4

Allow sysaccount to view its own entry
by Adam Bishop 09 Nov '23

09 Nov '23

I have a piece of software that tries to look up its own uid to check that LDAP is correctly configured. This check fails because the sysaccount cannot view anything under cn=etc,cn=sysaccounts. Is there an existing permission/privilege that I can use to allow it to read the sysaccounts tree (or better, just its own entry)? Many Thanks, Adam Bishop

4 3

kinit: KDC can't fulfill requested option while renewing credentials - which approach?
by Pieter Baele 19 Sep '23

19 Sep '23

I tried various approached to get Renewable tickets : modifying the kdc modifying krb5.conf using kadmin.local on every replica to modify the principal; which is not working - as designed (?)- in IPA What should I do to get a ticket with the correct R flag from IPA ? I don't think this is SSSD related (the service needing the renewable ticket this way is Apache Storm) Thanks a lot!

3 4

Do keytabs expire?
by Ronald Wimmer 07 Jun '23

07 Jun '23

Hi, today I found out that some entries in a keytab file seemed to have expired: Request ticket server HTTP/mwc.linux.mydomain.at(a)LINUX.MYDOMAIN.AT kvno 4 not found in keytab; keytab is likely out of date Fetching the keytab again with ipa-getkeytab fixed the problem. But why is this happening? Do keytab entries expire? I have not set any custom password or ticket policies. Regards, Ronald

4 13

ipa-replica-install -- cannot get past [26/41]: creating DS keytab
by Jonathon Jenkins 28 Mar '23

28 Mar '23

Greetings, I cannot get the ipa-replica-install to proceed past step 26/41 - creating DS keytab. I see the command that is to be run, and I can run that just fine before and after the ipa-replica-install command, and it creates the keytab. I am not sure how to proceed from here - the bug reports I see all pertain to earlier versions, and my files reflect those changes. I have also tried running this with all manner of password flags, which are correct, but still getting insufficient access rights. particulars: centos 7 3.10.0-957.1.3.el7.x86_64 ipa-server-4.6.4-10.el7.centos.x86_64 ipa-common-4.6.4-10.el7.centos.noarch ipa-server-common-4.6.4-10.el7.centos.noarch ipa-client-4.6.4-10.el7.centos.x86_64 ipa-server-dns-4.6.4-10.el7.centos.noarch ipa-client-common-4.6.4-10.el7.centos.noarch * Note: anonymized output below ipapython.ipautil: DEBUG stderr= ipalib.backend: DEBUG Created connection context.ldap2_139891568509776 ipaserver.install.service: DEBUG duration: 7 seconds ipaserver.install.service: DEBUG [26/41]: creating DS keytab [26/41]: creating DS keytab ipalib.frontend: DEBUG raw: service_add(u'ldap/<ipa-replica-host>@<domain>.NET', force=True, version=u'2.229') ipalib.frontend: DEBUG service_add(ipapython.kerberos.Principal('ldap/<ipa-replica-host>@<domain>.NET'), force=True, all=False, raw=False, version=u'2.229', no_members=False) ipalib.frontend: DEBUG raw: host_show(u'<ipa-replica-host>', version=u'2.229') ipalib.frontend: DEBUG host_show(u'<ipa-replica-host>', rights=False, all=False, raw=False, version=u'2.229', no_members=False) ipalib.install.sysrestore: DEBUG Backing up system configuration file '/etc/dirsrv/ds.keytab' ipalib.install.sysrestore: DEBUG -> Not backing up - '/etc/dirsrv/ds.keytab' doesn't exist ipapython.ipautil: DEBUG Starting external process ipapython.ipautil: DEBUG args=/usr/sbin/ipa-getkeytab -k /etc/dirsrv/ds.keytab -p ldap/<ipa-replica-host>@<domain>.NET -H ldaps://<ipa-replica-master> ipapython.ipautil: DEBUG Process finished, return code=9 ipapython.ipautil: DEBUG stdout= ipapython.ipautil: DEBUG stderr=Failed to parse result: Insufficient access rights Retrying with pre-4.0 keytab retrieval method... Failed to parse result: Insufficient access rights Failed to get keytab! Failed to get keytab ipaserver.install.service: DEBUG Traceback (most recent call last): File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 570, in start_creation run_step(full_msg, method) File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 560, in run_step method() File "/usr/lib/python2.7/site-packages/ipaserver/install/dsinstance.py", line 1308, in request_service_keytab super(DsInstance, self).request_service_keytab() File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 742, in request_service_keytab self.run_getkeytab(self.api.env.ldap_uri, self.keytab, self.principal) File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 732, in run_getkeytab ipautil.run(args, nolog=nolog) File "/usr/lib/python2.7/site-packages/ipapython/ipautil.py", line 562, in run raise CalledProcessError(p.returncode, arg_string, str(output)) CalledProcessError: Command '/usr/sbin/ipa-getkeytab -k /etc/dirsrv/ds.keytab -p ldap/<ipa-replica-host>@<domain>.NET -H ldaps://<ipa-replica-master>' returned non-zero exit status 9 ipaserver.install.service: DEBUG [error] CalledProcessError: Command '/usr/sbin/ipa-getkeytab -k /etc/dirsrv/ds.keytab -p ldap/<ipa-replica-host>@<domain>.NET -H ldaps://<ipa-replica-master>' returned non-zero exit status 9 [error] CalledProcessError: Command '/usr/sbin/ipa-getkeytab -k /etc/dirsrv/ds.keytab -p ldap/<ipa-replica-host>@<domain>.NET -H ldaps://<ipa-replica-master>' returned non-zero exit status 9 ipalib.backend: DEBUG Destroyed connection context.ldap2_139891548583120 ipalib.install.sysrestore: DEBUG Backing up system configuration file '/etc/ipa/default.conf' ipalib.install.sysrestore: DEBUG Saving Index File to '/var/lib/ipa/sysrestore/sysrestore.index' Your system may be partly configured. Run /usr/sbin/ipa-server-install --uninstall to clean up. ipapython.admintool: DEBUG File "/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 178, in execute return_value = self.run() File "/usr/lib/python2.7/site-packages/ipapython/install/cli.py", line 319, in run return cfgr.run() File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 364, in run return self.execute() File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 389, in execute for rval in self._executor(): File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 434, in __runner exc_handler(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 463, in _handle_execute_exception self._handle_exception(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 453, in _handle_exception six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 424, in __runner step() File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 421, in <lambda> step = lambda: next(self.__gen) File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from value = gen.send(prev_value) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 658, in _configure next(executor) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 434, in __runner exc_handler(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 463, in _handle_execute_exception self._handle_exception(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 521, in _handle_exception self.__parent._handle_exception(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 453, in _handle_exception six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 518, in _handle_exception super(ComponentBase, self)._handle_exception(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 453, in _handle_exception six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 424, in __runner step() File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 421, in <lambda> step = lambda: next(self.__gen) File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from value = gen.send(prev_value) File "/usr/lib/python2.7/site-packages/ipapython/install/common.py", line 65, in _install for unused in self._installer(self.parent): File "/usr/lib/python2.7/site-packages/ipaserver/install/server/__init__.py", line 622, in main replica_install(self) File "/usr/lib/python2.7/site-packages/ipaserver/install/server/replicainstall.py", line 406, in decorated func(installer) File "/usr/lib/python2.7/site-packages/ipaserver/install/server/replicainstall.py", line 1431, in install fstore=fstore) File "/usr/lib/python2.7/site-packages/ipaserver/install/server/replicainstall.py", line 113, in install_replica_ds setup_pkinit=not options.no_pkinit, File "/usr/lib/python2.7/site-packages/ipaserver/install/dsinstance.py", line 419, in create_replica self.start_creation(runtime=30) File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 570, in start_creation run_step(full_msg, method) File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 560, in run_step method() File "/usr/lib/python2.7/site-packages/ipaserver/install/dsinstance.py", line 1308, in request_service_keytab super(DsInstance, self).request_service_keytab() File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 742, in request_service_keytab self.run_getkeytab(self.api.env.ldap_uri, self.keytab, self.principal) File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 732, in run_getkeytab ipautil.run(args, nolog=nolog) File "/usr/lib/python2.7/site-packages/ipapython/ipautil.py", line 562, in run raise CalledProcessError(p.returncode, arg_string, str(output)) ipapython.admintool: DEBUG The ipa-replica-install command failed, exception: CalledProcessError: Command '/usr/sbin/ipa-getkeytab -k /etc/dirsrv/ds.keytab -p ldap/<ipa-replica-host>@<domain>.NET -H ldaps://<ipa-replica-master>' returned non-zero exit status 9 ipapython.admintool: ERROR Command '/usr/sbin/ipa-getkeytab -k /etc/dirsrv/ds.keytab -p ldap/<ipa-replica-host>@<domain>.NET -H ldaps://<ipa-replica-master>' returned non-zero exit status 9 ipapython.admintool: ERROR The ipa-replica-install command failed. See /var/log/ipareplica-install.log for more information

2 2

ipa-replica-install fails when I use custom certificates
by Peter Tselios 08 Feb '23

08 Feb '23

I have installed the ipa server by using the following command: --------- ipa-server-install --realm "EXAMPLE.COM" -p 'password' -a 'password' --hostname="server.example.com" -n example.com --ip-address="10.1.4.2" --dirsrv-cert-file=/etc/pki/tls/private/example.com.pem --dirsrv-cert-file=/etc/pki/tls/certs/example.com.crt --dirsrv-pin='' --http-cert-file=/etc/pki/tls/certs/example.com.crt --http-cert-file=/etc/pki/tls/private/example.com.pem --http-pin='' --ca-cert-file=/etc/pki/ca-trust/source/anchors/myca.pem --ca-cert-file=/etc/pki/ca-trust/source/anchors/mysubca.pem --mkhomedir -N --no-host-dns --unattended --------- Which works perfectly fine. However, I cannot make it work with ipa-replica-install since there is no option for --ca-cert-file. So, how can I install a replica with custom certificates?

6 12

Problem running IPA client on IPv6 only connection
by William Muriithi 26 Jul '22

26 Jul '22

Hello, I have an IPA clients that has both IPv4 and IPv6 addresses. One of the IPA client is in the office and hence can reach the IPA server on both IPv4 and IPv6. However, the client outside the LAN can only reach the IPA server over IPv6. I was able to enroll the external client fine over IPv6 and from the logs, all clean. However, when I attempted to ssh, its not able to retreave the user from IPA. The client in the office works fine. I can also make for example LDAP queries and they work over IPv6 fine. It looks like kerberos is somehow however using IPv4. I reached this conclusion after taking a tcpdump when attempting to ssh to the server and the kerberos traffic from the client to IPA is on IPv4. What would I need to do on the IPA client for it to prefer IPv6? I am aware I could remove IPv4 address from DNS, but that would break any communication from IPv4 only systems. Any assistance would be appreaciated. [william@ansible ~]$ ssh root(a)mars.external.example.com Last login: Mon Jan 7 17:19:49 2019 from 65.98.193.94 [root@mars ~]# kinit admin kinit: Cannot contact any KDC for realm 'EXTERNAL.EXAMPLE.COM <http://external.example.com/>' while getting initial credentials [root@mars ~]# ldapsearch -x -b cn=ftp,cn=groups,cn=compat,dc=external,dc=example,dc=com | tail -n 4 result: 0 Success # numResponses: 2 # numEntries: 1 [root@mars ~]# cat /etc/resolv.conf search external.example.com nameserver 2607:4860:6000:a::5 [root@mars ~]# Regards, William

5 10

Could not login with AD user
by Ronald Wimmer 20 Jul '22

20 Jul '22

Today I was not able to log in with an AD user to an IPA client within a test setup. IPA users worked fine. DNS is managed externally. I figured out that the DNS-Record of that particular IPA client has not been created correctly. After having corrected the DNS entry and having dropped the SSSD cache on that client I could login with my AD user. Do you have an explanation for that or was it just a coincidence? Cheers, Ronald

4 13

freeipa/certmonger for openvpn user certificates
by Patrick Spinler 27 Jun '22

27 Jun '22

Hi, I'm setting up an openvpn server and I'd like to use our already existing FreeIPA CA to issue user keys/certs for openvpn's use. Since our OpenVPN box is a freeipa client, I thought it'd be nice to use certmonger to issue and keep up to date these certs. Ergo, I've created a certificate profile: pat@apex-freeipa ~$ ipa certprofile-show --all OpenVPNUserCert dn: cn=OpenVPNUserCert,cn=certprofiles,cn=ca,dc=int,dc=apexmw,dc=com Profile ID: OpenVPNUserCert Profile description: OpenVPN User Certificates Store issued certificates: FALSE objectclass: ipacertprofile, top And also a CA acl. For experimentation (and working vs our test freeipa) I've left this as wide open as I can: [pat@apex-freeipa ~]$ ipa caacl-show --all OpenVPN_User_Certificate_ACL dn: ipaUniqueID=6dde33a6-7849-11e9-aa05-525400b52c7b,cn=caacls,cn=ca,dc=int,dc=apexmw,dc=com ACL name: OpenVPN_User_Certificate_ACL Enabled: TRUE CA category: all Profile category: all User category: all Host category: all Service category: all ipauniqueid: 6dde33a6-7849-11e9-aa05-525400b52c7b objectclass: ipaassociation, ipacaacl Then, on my openvpn server, I ask for a cert for use for one of my users (myself, in this case): root@apex-openvpn:~# ipa-getcert request -f /etc/openvpn/client/pat.crt -k /etc/openvpn/client/pat.key -r -N 'CN=pat,O=INT.APEXMW.COM' -K pat -g 4096 --profile OpenVPNUserCert New signing request "20190603014016" added. But, it fails due to an access err vs the 'userCertificate' attribute of my account: root@apex-openvpn:~# ipa-getcert list (...snippy snip excess...) Request ID '20190603014016': status: CA_REJECTED ca-error: Server at https://apex-freeipa.int.apexmw.com/ipa/xml denied our request, giving up: 2100 (RPC failed at server. Insufficient access: Insufficient 'write' privilege to the 'userCertificate' attribute of entry 'uid=pat,cn=users,cn=accounts,dc=int,dc=apexmw,dc=com'.). stuck: yes key pair storage: type=FILE,location='/etc/openvpn/client/pat.key' certificate: type=FILE,location='/etc/openvpn/client/pat.crt' CA: IPA issuer: subject: expires: unknown pre-save command: post-save command: track: yes auto-renew: yes If I look at the dirsrv log, here's the accesses I see for this request (trimmed off the date/time to make the lines a _little_ shorter): root@apex-freeipa slapd-INT-APEXMW-COM# grep conn=178 access | cut -d' ' -f3- conn=178 fd=114 slot=114 connection from 10.10.200.1 to 10.10.200.1 conn=178 op=0 BIND dn="" method=sasl version=3 mech=GSS-SPNEGO conn=178 op=0 RESULT err=0 tag=97 nentries=0 etime=0.0025554208 dn="fqdn=apex-openvpn.int.apexmw.com,cn=computers,cn=accounts,dc=int,dc=apexmw,dc=com" conn=178 op=1 SRCH base="cn=ipaconfig,cn=etc,dc=int,dc=apexmw,dc=com" scope=0 filter="(objectClass=*)" attrs=ALL conn=178 op=1 RESULT err=0 tag=101 nentries=1 etime=0.0001319554 conn=178 op=2 SRCH base="cn=masters,cn=ipa,cn=etc,dc=int,dc=apexmw,dc=com" scope=2 filter="(&(objectClass=ipaConfigObject)(cn=CA))" attrs=ALL conn=178 op=2 RESULT err=0 tag=101 nentries=1 etime=0.0000979573 conn=178 op=3 SRCH base="cn=masters,cn=ipa,cn=etc,dc=int,dc=apexmw,dc=com" scope=2 filter="(&(objectClass=ipaConfigObject)(cn=CA))" attrs=ALL conn=178 op=3 RESULT err=0 tag=101 nentries=1 etime=0.0000736730 conn=178 op=4 SRCH base="cn=cas,cn=ca,dc=int,dc=apexmw,dc=com" scope=2 filter="(&(objectClass=ipaca)(cn=ipa))" attrs="" conn=178 op=4 RESULT err=0 tag=101 nentries=1 etime=0.0000499142 conn=178 op=5 SRCH base="cn=ipa,cn=cas,cn=ca,dc=int,dc=apexmw,dc=com" scope=0 filter="(objectClass=*)" attrs="ipaCaId ipaCaSubjectDN cn ipaCaIssuerDN description" conn=178 op=5 RESULT err=0 tag=101 nentries=1 etime=0.0000482726 conn=178 op=6 SRCH base="cn=apex-freeipa.int.apexmw.com,cn=masters,cn=ipa,cn=etc,dc=int,dc=apexmw,dc=com" scope=2 filter="(&(objectClass=ipaConfigObject)(ipaConfigString=enabledService)(cn=CA))" attrs=ALL conn=178 op=6 RESULT err=0 tag=101 nentries=1 etime=0.0000950646 notes=U conn=178 op=7 SRCH base="cn=accounts,dc=int,dc=apexmw,dc=com" scope=2 filter="(&(objectClass=krbprincipalaux)(krbPrincipalName=pat(a)INT.APEXMW.COM))" attrs=ALL conn=178 op=7 RESULT err=0 tag=101 nentries=1 etime=0.0002747849 conn=178 op=8 EXT oid="1.3.6.1.4.1.4203.1.11.3" name="whoami-plugin" conn=178 op=8 RESULT err=0 tag=120 nentries=0 etime=0.0000135034 conn=178 op=9 SRCH base="cn=request certificate ignore caacl,cn=virtual operations,cn=etc,dc=int,dc=apexmw,dc=com" scope=0 filter="(objectClass=*)" attrs="objectClass" conn=178 op=9 RESULT err=0 tag=101 nentries=1 etime=0.0000932668 - entryLevelRights: none conn=178 op=10 SRCH base="uid=pat,cn=users,cn=accounts,dc=int,dc=apexmw,dc=com" scope=0 filter="(objectClass=*)" attrs="distinguishedName" conn=178 op=10 RESULT err=0 tag=101 nentries=1 etime=0.0000640289 conn=178 op=11 SRCH base="uid=pat,cn=users,cn=accounts,dc=int,dc=apexmw,dc=com" scope=0 filter="(objectClass=*)" attrs="telephoneNumber ipaSshPubKey uid krbCanonicalName ipatokenRadiusUserName ipaUserAuthType krbPrincipalExpiration homeDirectory nsAccountLock usercertificate;binary title loginShell uidNumber mail ipaCertMapData memberOf memberofindirect krbPrincipalName givenName gidNumber sn ou userClass ipatokenRadiusConfigLink" conn=178 op=11 RESULT err=0 tag=101 nentries=1 etime=0.0001401737 conn=178 op=12 SRCH base="dc=int,dc=apexmw,dc=com" scope=2 filter="(|(member=uid=pat,cn=users,cn=accounts,dc=int,dc=apexmw,dc=com)(memberUser=uid=pat,cn=users,cn=accounts,dc=int,dc=apexmw,dc=com)(memberHost=uid=pat,cn=users,cn=accounts,dc=int,dc=apexmw,dc=com))" attrs="" conn=178 op=12 RESULT err=0 tag=101 nentries=7 etime=0.0001492344 notes=P pr_idx=0 pr_cookie=-1 conn=178 op=13 SRCH base="uid=pat,cn=users,cn=accounts,dc=int,dc=apexmw,dc=com" scope=0 filter="(userPassword=*)" attrs="userPassword" conn=178 op=13 RESULT err=0 tag=101 nentries=1 etime=0.0000524838 conn=178 op=14 SRCH base="uid=pat,cn=users,cn=accounts,dc=int,dc=apexmw,dc=com" scope=0 filter="(krbPrincipalKey=*)" attrs="krbPrincipalKey" conn=178 op=14 RESULT err=0 tag=101 nentries=1 etime=0.0000597589 conn=178 op=15 SRCH base="ipaUniqueID=80b23b30-6a0c-11e9-baa3-525400b52c7b,cn=sudorules,cn=sudo,dc=int,dc=apexmw,dc=com" scope=0 filter="(objectClass=*)" attrs="cn" conn=178 op=15 RESULT err=0 tag=101 nentries=1 etime=0.0000379744 conn=178 op=16 SRCH base="ipaUniqueID=5fb3a640-705a-11e9-aa05-525400b52c7b,cn=hbac,dc=int,dc=apexmw,dc=com" scope=0 filter="(objectClass=*)" attrs="cn" conn=178 op=16 RESULT err=0 tag=101 nentries=1 etime=0.0000337904 conn=178 op=17 SRCH base="cn=caacls,cn=ca,dc=int,dc=apexmw,dc=com" scope=1 filter="(&(objectClass=ipaassociation)(objectClass=ipacaacl))" attrs="serviceCategory cn ipaMemberCertProfile ipaMemberCa ipaCertProfileCategory memberUser userCategory hostCategory memberHost ipaEnabledFlag ipaCaCategory memberService description" conn=178 op=17 RESULT err=0 tag=101 nentries=2 etime=0.0001647058 conn=178 op=18 EXT oid="1.3.6.1.4.1.4203.1.11.3" name="whoami-plugin" conn=178 op=18 RESULT err=0 tag=120 nentries=0 etime=0.0000138321 conn=178 op=19 SRCH base="uid=pat,cn=users,cn=accounts,dc=int,dc=apexmw,dc=com" scope=0 filter="(objectClass=*)" attrs="userCertificate" conn=178 op=19 RESULT err=0 tag=101 nentries=1 etime=0.0001475052 - entryLevelRights: none conn=178 op=20 UNBIND conn=178 op=20 fd=114 closed - U1 To begin with, I note that this session does a BIND with 'dn=""', right at the beginning, it's essentially an anonymous bind, yah? That operation near the end, here: op=17 SRCH base="cn=caacls,cn=ca,dc=int,dc=apexmw,dc=com" scope=1 filter="(&(objectClass=ipaassociation)(objectClass=ipacaacl))" seems like it might be kinda key. and indeed, if I attempt to run this by hand as an anonymous bind, I get no results: root@apex-freeipa slapd-INT-APEXMW-COM# ldapsearch -x -h localhost -b dc=int,dc=apexmw,dc=com -s sub "(|(objectClass=ipaassociation)(objectClass=ipacaacl))" # extended LDIF # # LDAPv3 # base <dc=int,dc=apexmw,dc=com> with scope subtree # filter: (|(objectClass=ipaassociation)(objectClass=ipacaacl)) # requesting: ALL # # search result search: 2 result: 0 Success # numResponses: 1 It's only if I run this as an _authenticated_ bind, that I can find my ACL: root@apex-freeipa slapd-INT-APEXMW-COM# ldapsearch -x -D "cn=Directory Manager" -W -h localhost -b dc=int,dc=apexmw,dc=com -s sub "(&(objectClass=ipaassociation)(objectClass=ipacaacl))" cn Enter LDAP Password: # extended LDIF # # LDAPv3 # base <dc=int,dc=apexmw,dc=com> with scope subtree # filter: (&(objectClass=ipaassociation)(objectClass=ipacaacl)) # requesting: cn # # c98b740c-6903-11e9-ad1b-525400b52c7b, caacls, ca, int.apexmw.com dn: ipaUniqueID=c98b740c-6903-11e9-ad1b-525400b52c7b,cn=caacls,cn=ca,dc=int,dc =apexmw,dc=com cn: hosts_services_caIPAserviceCert # 6dde33a6-7849-11e9-aa05-525400b52c7b, caacls, ca, int.apexmw.com dn: ipaUniqueID=6dde33a6-7849-11e9-aa05-525400b52c7b,cn=caacls,cn=ca,dc=int,dc =apexmw,dc=com cn: OpenVPN_User_Certificate_ACL # search result search: 2 result: 0 Success # numResponses: 3 # numEntries: 2 Is this (using certmonger to auto-issue signed certs/keys for my openvpn users) going to be essentially impossible to do, here? Do I need to go a more traditional route of creating a seperate keystore/certdb, issuing a CSR, and feeding that to FreeIPA to sign? Any advice appreciated, and thanks in advance, -- Pat

4 6

Broken ipa replica
by Giulio Casella 08 May '22

08 May '22

Hi everyone, I'm stuck with a broken replica. I had a setup with two ipa server in replica (ipa-server-4.6.4 on CentOS 7.6), let's say "idc01" and "idc02". Due to heavy load idc01 crashed many times, and was not working anymore. So I tried to redo the replica again. At first I tried to "ipa-replica-manage re-initialize", with no success. Now I'm trying to redo from scratch the replica setup: on idc02 I removed the segments (ipa topologysegment-del, for both ca and domain suffix), on idc01 I removed everything (ipa-server-install --uninstall), then I joined domain (ipa-client-install), and everything is working so far. When doing "ipa-replica-install" on idc01 I get: [...] [28/41]: setting up initial replication Starting replication, please wait until this has completed. Update in progress, 22 seconds elapsed [ldap://idc02.my.dom.ain:389] reports: Update failed! Status: [Error (-11) connection error: Unknown connection error (-11) - Total update aborted] And on idc02 (the working server), in /var/log/dirsrv/slapd-MY-DOM-AIN/errors I find lines stating: [20/Mar/2019:09:28:06.545187923 +0100] - INFO - NSMMReplicationPlugin - repl5_tot_run - Beginning total update of replica "agmt="cn=meToidc01.my.dom.ain" (idc01:389)". [20/Mar/2019:09:28:26.528046160 +0100] - ERR - NSMMReplicationPlugin - perform_operation - agmt="cn=meToidc01.my.dom.ain" (idc01:389): Failed to send extended operation: LDAP error -1 (Can't contact LDAP server) [20/Mar/2019:09:28:26.530763939 +0100] - ERR - NSMMReplicationPlugin - repl5_tot_log_operation_failure - agmt="cn=meToidc01.my.dom.ain" (idc01:389): Received error -1 (Can't contact LDAP server): for total update operation [20/Mar/2019:09:28:26.532678072 +0100] - ERR - NSMMReplicationPlugin - release_replica - agmt="cn=meToidc01.my.dom.ain" (idc01:389): Unable to send endReplication extended operation (Can't contact LDAP server) [20/Mar/2019:09:28:26.534307539 +0100] - ERR - NSMMReplicationPlugin - repl5_tot_run - Total update failed for replica "agmt="cn=meToidc01.my.dom.ain" (idc01:389)", error (-11) [20/Mar/2019:09:28:26.561763168 +0100] - INFO - NSMMReplicationPlugin - bind_and_check_pwp - agmt="cn=meToidc01.my.dom.ain" (idc01:389): Replication bind with GSSAPI auth resumed [20/Mar/2019:09:28:26.582389258 +0100] - WARN - NSMMReplicationPlugin - repl5_inc_run - agmt="cn=meToidc01.my.dom.ain" (idc01:389): The remote replica has a different database generation ID than the local database. You may have to reinitialize the remote replica, or the local replica. It seems that idc02 remembers something about the old replica. Any hint? Thank you in advance, Giulio

5 10

IPA CA allow CSR SAN names in external domains
by Steve Dainard 14 Mar '22

14 Mar '22

Hello I have a RHEL7 IPA server installed as a subordinate CA. I'd like to be able to add SAN's for a different dns domain than exists in the IPA realm. The dns for 'otherdomain.com' is handled by active directory which my IPA server has a cross-forest trust with. ie: host: client1.ipadomain.com certificate: CN = client1.ipadomain.com, SAN = client1.ipadomain.com, servicename.otherdomain.com When I try to submit this CSR with 'ipa-getcert request' the IPA server denies with: "The service principal for subject alt name servicename.otherdomain.com in certificate request does not exist" It seems that the default CAACL enforces a profile named 'caIPAserviceCert', but I'm having some trouble determining what can be modified (or cloned and changed in a new profile) that would allow the CA to sign a CSR that contains *.ipadomain.com and *.otherdomain.com in the SAN. This is the only section in the profile that contains SAN: policyset.serverCertSet.12.constraint.class_id=noConstraintImpl policyset.serverCertSet.12.constraint.name=No Constraint policyset.serverCertSet.12.default.class_id=commonNameToSANDefaultImpl policyset.serverCertSet.12.default.name=Copy Common Name to Subject Alternative Name Thanks, Steve

3 3

freeipa with sudo and 2FA (OTP)
by John Ratliff 31 Jan '22

31 Jan '22

I'm trying to setup freeipa with OTP. I created a TOTP under my user in freeipa and updated my user to use 2FA (password + OTP). When I try to do sudo, it only asks for my password and it fails every time (presumably because it isn't getting the OTP first). I didn't see anything useful in the sss_sudo logs, even after adding debug_level = 6 in the config. What can I do to further troubleshoot this? Thanks.

4 6

User in AD not found by IPA
by Marc Boorshtein 14 Oct '21

14 Oct '21

We added a new account to AD that has a domain trust with FreeIPA. This one user is having an issue where IPA can't find him. The user is in the same OU as other users that work fine. The user is unlocked (userAccountControl is 512) and the userprincipalname is set. When I try to add the user to an id view or an external group IPA gives me the error "trusted domain object not found" . Not really sure where to look next to figure out what's wrong. We see the user when we make LDAP calls to AD. Thanks Marc

4 14

Cannot add externally-signed IPA CA certificate
by Dmitry Perets 27 Aug '21

27 Aug '21

Hi, I am trying to configure FreeIPA as a SubCA, and the "RootCA" is self-made with openssl. So I've signed the FreeIPA's request with my self-signed "root ca" certificate, but it looks like FreeIPA doesn't like it: ipa-server-install --external-cert-file=/root/rootca/rootcacert.pem --external-cert-file=/root/rootca/certs/ipacert.pem <...skipped...> ipa.ipapython.install.cli.install_tool(CompatServerMasterInstall): ERROR CA certificate CN=RootCA,OU=PRJ,O=COMPANY,L=Bonn,C=DE in /root/rootca/rootcacert.pem, /root/rootca/certs/ipacert.pem is not valid: not a CA certificate ipa.ipapython.install.cli.install_tool(CompatServerMasterInstall): ERROR The ipa-server-install command failed. See /var/log/ipaserver-install.log for more information The subj above is my self-made root CA cert, so it looks like something is missing in it. But what...? Here is it below, it has the "Basic Constraint" set with CA:TRUE... What else is required, so that FreeIPA accepts it as a root CA? Should I add it somewhere first, before running the ipa-server-install? [root@ipa ~]# openssl x509 -text -noout -in /root/rootca/rootcacert.pem Certificate: Data: Version: 3 (0x2) Serial Number: 0 (0x0) Signature Algorithm: sha256WithRSAEncryption Issuer: C=DE, L=Bonn, O=COMPANY, OU=PRJ, CN=RootCA Validity Not Before: Oct 24 11:43:13 2018 GMT Not After : Oct 21 11:43:13 2028 GMT Subject: C=DE, L=Bonn, O=COMPANY, OU=PRJ, CN=RootCA Subject Public Key Info: Public Key Algorithm: rsaEncryption Public-Key: (4096 bit) Modulus: <...skipped...> Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Subject Key Identifier: B3:18:3B:CF:29:D2:A5:D4:AE:94:A5:42:65:A2:D8:12:7C:92:78:81 X509v3 Authority Key Identifier: keyid:B3:18:3B:CF:29:D2:A5:D4:AE:94:A5:42:65:A2:D8:12:7C:92:78:81 X509v3 Basic Constraints: CA:TRUE Signature Algorithm: sha256WithRSAEncryption <...skipped...> Thanks!!

2 2

Unable to install ipa client centos 7.5.1804 (Core)
by William Graboyes 16 Feb '21

16 Feb '21

Hello List, I have been searching around for the day and have found an answer for the error I am getting when I am trying to install the client on a brand new install: Version: ipa-client-4.5.4-10.el7.centos.3.x86_64 ipa-client-common-4.5.4-10.el7.centos.3.noarch The error is below (run as root, not via sudo): ipa-client-install Traceback (most recent call last): File "/sbin/ipa-client-install", line 22, in <module> from ipaclient.install import ipa_client_install File "/usr/lib/python2.7/site-packages/ipaclient/install/ipa_client_install.py", line 5, in <module> from ipaclient.install import client File "/usr/lib/python2.7/site-packages/ipaclient/install/client.py", line 34, in <module> from ipalib import api, errors, x509 File "/usr/lib/python2.7/site-packages/ipalib/x509.py", line 45, in <module> from pyasn1_modules import rfc2315, rfc2459 File "/usr/lib/python2.7/site-packages/pyasn1_modules/rfc2315.py", line 67, in <module> class DigestedData(univ.Sequence): File "/usr/lib/python2.7/site-packages/pyasn1_modules/rfc2315.py", line 72, in DigestedData namedtype.NamedType('digest', Digest) File "/usr/lib/python2.7/site-packages/pyasn1/type/namedtype.py", line 115, in __init__ self.__ambiguousTypes = 'terminal' not in kwargs and self.__computeAmbiguousTypes() or {} File "/usr/lib/python2.7/site-packages/pyasn1/type/namedtype.py", line 232, in __computeAmbiguousTypes ambigiousTypes[idx] = NamedTypes(*partialAmbigiousTypes, **dict(terminal=True)) File "/usr/lib/python2.7/site-packages/pyasn1/type/namedtype.py", line 114, in __init__ self.__tagToPosMap = self.__computeTagToPosMap() File "/usr/lib/python2.7/site-packages/pyasn1/type/namedtype.py", line 205, in __computeTagToPosMap for _tagSet in tagMap.presentTypes: AttributeError: 'property' object has no attribute 'presentTypes' Any help would be greatly appreciated. Thanks, Bill G.

3 2

FreeIPA, OSX, DockerDesktop
by james liu 14 Oct '20

14 Oct '20

PREP ==== git clone https://github.com/freeipa/freeipa-container.git cd freeipa-container mkdir /tmp/ipa-data docker run --name freeipa-server-container -ti -h ipa.example.test --read-only -v /tmp/ip-data :/data:Z freeipa-server --sysctl net.ipv6.conf.all.disable_ipv6=1 RESULT ====== tar: etc/sysconfig/selinux: Cannot utime: No such file or directory tar: Exiting with failure status due to previous errors QUESTION ========= I'm running DockerDesktop 2.0.4, OSX 10.13.6. Is there a set of commands that will work? Thanks

4 6

yum update problem
by Natxo Asenjo 02 Oct '20

02 Oct '20

hi, after patching our centos 7 hosts to the latest version today, one of the two replicas is having trouble. [root@kdc2 ~]# ipactl status Directory Service: RUNNING krb5kdc Service: STOPPED kadmin Service: STOPPED named Service: STOPPED httpd Service: RUNNING ipa-custodia Service: STOPPED ntpd Service: STOPPED pki-tomcatd Service: RUNNING smb Service: STOPPED winbind Service: STOPPED ipa-otpd Service: STOPPED ipa-dnskeysyncd Service: STOPPED ipa: INFO: The ipactl command was successful and after digging in the logs I come across this in /var/log/ipaupgrade.log: 2019-11-20T18:18:29Z DEBUG stderr= 2019-11-20T18:18:31Z INFO Certmonger certificate renewal configuration already up-to-date 2019-11-20T18:18:31Z INFO [Enable PKIX certificate path discovery and validation] 2019-11-20T18:18:31Z DEBUG Loading StateFile from '/var/lib/ipa/sysupgrade/sysupgrade.state' 2019-11-20T18:18:31Z INFO PKIX already enabled 2019-11-20T18:18:31Z INFO [Authorizing RA Agent to modify profiles] 2019-11-20T18:18:31Z INFO [Authorizing RA Agent to manage lightweight CAs] 2019-11-20T18:18:31Z INFO [Ensuring Lightweight CAs container exists in Dogtag database] 2019-11-20T18:18:31Z DEBUG Created connection context.ldap2_139740162547472 2019-11-20T18:18:31Z DEBUG flushing ldapi://%2fvar%2frun%2fslapd-L-DOMAIN-IT.socket from SchemaCache 2019-11-20T18:18:31Z DEBUG retrieving schema for SchemaCache url=ldapi://%2fvar%2frun%2fslapd-L-DOMAIN-IT.socket conn=<ldap.ldapobject.SimpleLDAPObject instance at 0x7f17cc24b638> 2019-11-20T18:18:31Z DEBUG Destroyed connection context.ldap2_139740162547472 2019-11-20T18:18:31Z INFO [Adding default OCSP URI configuration] 2019-11-20T18:18:31Z INFO [Ensuring CA is using LDAPProfileSubsystem] 2019-11-20T18:18:31Z INFO [Migrating certificate profiles to LDAP] 2019-11-20T18:18:31Z DEBUG Created connection context.ldap2_139740160021648 2019-11-20T18:18:31Z DEBUG flushing ldapi://%2fvar%2frun%2fslapd-L-DOMAIN-IT.socket from SchemaCache 2019-11-20T18:18:31Z DEBUG retrieving schema for SchemaCache url=ldapi://%2fvar%2frun%2fslapd-L-DOMAIN-IT.socket conn=<ldap.ldapobject.SimpleLDAPObject instance at 0x7f17cc289b00> 2019-11-20T18:18:31Z DEBUG Destroyed connection context.ldap2_139740160021648 2019-11-20T18:18:31Z DEBUG request GET https://kdc2.l.domain.it:8443/ca/rest/account/login 2019-11-20T18:18:31Z DEBUG request body '' 2019-11-20T18:18:31Z DEBUG response status 401 2019-11-20T18:18:31Z DEBUG response headers Server: Apache-Coyote/1.1 Cache-Control: private Expires: Thu, 01 Jan 1970 01:00:00 CET WWW-Authenticate: Basic realm="Certificate Authority" Content-Type: text/html;charset=utf-8 Content-Language: en Content-Length: 951 Date: Wed, 20 Nov 2019 18:18:31 GMT 2019-11-20T18:18:31Z DEBUG response body '<html><head><title>Apache Tomcat/7.0.76 - Error report</title><style></style> </head><body><h1>HTTP Status 401 - </h1><HR size="1" noshade="noshade"><p><b>type</b> Status report</p><p><b>message</b> <u></u></p><p><b>description</b> <u>This request requires HTTP authentication.</u></p><HR size="1" noshade="noshade"><h3>Apache Tomcat/7.0.76</h3></body></html>' 2019-11-20T18:18:31Z ERROR IPA server upgrade failed: Inspect /var/log/ipaupgrade.log and run command ipa-server-upgrade manually. 2019-11-20T18:18:31Z DEBUG File "/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 178, in execute return_value = self.run() File "/usr/lib/python2.7/site-packages/ipaserver/install/ipa_server_upgrade.py", line 54, in run server.upgrade() File "/usr/lib/python2.7/site-packages/ipaserver/install/server/upgrade.py", line 2146, in upgrade upgrade_configuration() File "/usr/lib/python2.7/site-packages/ipaserver/install/server/upgrade.py", line 2018, in upgrade_configuration ca_enable_ldap_profile_subsystem(ca) File "/usr/lib/python2.7/site-packages/ipaserver/install/server/upgrade.py", line 406, in ca_enable_ldap_profile_subsystem cainstance.migrate_profiles_to_ldap() File "/usr/lib/python2.7/site-packages/ipaserver/install/cainstance.py", line 2027, in migrate_profiles_to_ldap _create_dogtag_profile(profile_id, profile_data, overwrite=False) File "/usr/lib/python2.7/site-packages/ipaserver/install/cainstance.py", line 2033, in _create_dogtag_profile with api.Backend.ra_certprofile as profile_api: File "/usr/lib/python2.7/site-packages/ipaserver/plugins/dogtag.py", line 1315, in __enter__ raise errors.RemoteRetrieveError(reason=_('Failed to authenticate to CA REST API')) 2019-11-20T18:18:31Z DEBUG The ipa-server-upgrade command failed, exception: RemoteRetrieveError: Failed to authenticate to CA REST API 2019-11-20T18:18:31Z ERROR Unexpected error - see /var/log/ipaupgrade.log for details: RemoteRetrieveError: Failed to authenticate to CA REST API In this kdc I see these errors in getcert list: Request ID '20190220182014': status: MONITORING ca-error: Invalid cookie: u'' stuck: no key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert cert-pki-ca',token='NSS Certificate DB',pin set certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert cert-pki-ca',token='NSS Certificate DB' CA: dogtag-ipa-ca-renew-agent issuer: CN=Certificate Authority,O=L.DOMAIN.IT subject: CN=CA Audit,O=L.DOMAIN.IT expires: 2019-12-05 13:58:24 UTC key usage: digitalSignature,nonRepudiation pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "auditSigningCert cert-pki-ca" track: yes auto-renew: yes Request ID '20190220182015': status: MONITORING ca-error: Invalid cookie: u'' stuck: no key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert cert-pki-ca',token='NSS Certificate DB',pin set certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert cert-pki-ca',token='NSS Certificate DB' CA: dogtag-ipa-ca-renew-agent issuer: CN=Certificate Authority,O=L.DOMAIN.IT subject: CN=OCSP Subsystem,O=L.DOMAIN.IT expires: 2019-12-05 13:58:24 UTC key usage: digitalSignature,nonRepudiation,keyCertSign,cRLSign eku: id-kp-OCSPSigning pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "ocspSigningCert cert-pki-ca" track: yes auto-renew: yes Request ID '20190220182016': status: MONITORING ca-error: Invalid cookie: u'' stuck: no key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert cert-pki-ca',token='NSS Certificate DB',pin set certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert cert-pki-ca',token='NSS Certificate DB' CA: dogtag-ipa-ca-renew-agent issuer: CN=Certificate Authority,O=L.DOMAIN.IT subject: CN=CA Subsystem,O=L.DOMAIN.IT expires: 2019-12-05 13:58:24 UTC key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment eku: id-kp-serverAuth,id-kp-clientAuth pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "subsystemCert cert-pki-ca" track: yes auto-renew: yes Request ID '20190220182018': status: MONITORING ca-error: Invalid cookie: u'' stuck: no key pair storage: type=FILE,location='/var/lib/ipa/ra-agent.key' certificate: type=FILE,location='/var/lib/ipa/ra-agent.pem' CA: dogtag-ipa-ca-renew-agent issuer: CN=Certificate Authority,O=L.DOMAIN.IT subject: CN=IPA RA,O=L.DOMAIN.IT expires: 2019-12-05 13:58:44 UTC key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment eku: id-kp-serverAuth,id-kp-clientAuth pre-save command: /usr/libexec/ipa/certmonger/renew_ra_cert_pre post-save command: /usr/libexec/ipa/certmonger/renew_ra_cert track: yes auto-renew: yes Request ID '20190220182019': status: MONITORING ca-error: Server at " https://kdc2.l.domain.it:8443/ca/agent/ca/profileProcess" replied: 1: Invalid Credential. stuck: no key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert cert-pki-ca',token='NSS Certificate DB',pin set certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert cert-pki-ca',token='NSS Certificate DB' CA: dogtag-ipa-ca-renew-agent issuer: CN=Certificate Authority,O=L.DOMAIN.IT subject: CN=kdc2.l.domain.it,O=L.DOMAIN.IT expires: 2019-12-10 10:57:52 UTC key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment eku: id-kp-serverAuth,id-kp-clientAuth,id-kp-emailProtection pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "Server-Cert cert-pki-ca" track: yes auto-renew: yes I still have a working replica, so I could just reinstall and have a working set in a couple of minutes, but I would like to find out what has gone wrong. The systems are running ipa-server-4.6.5-11.el7.centos.3.x86_64 Any help welcome ;-) Thanks, -- Groeten, natxo

4 12

Replica not renewing IPA certificates
by Roderick Johnstone 02 Oct '20

02 Oct '20

Hi This is freeipa (ipa-server-4.6.5-11.el7_7.3.x86_64) on RHEL7 with freeipa's own internal CA. One of my ipa server replicas (host3) has not renewed its IPA system certificates and is now showing ca-error: Invalid cookie: u'' in the 'getcert list' output for certificates: "auditSigningCert cert-pki-ca", "ocspSigningCert cert-pki-ca", "subsystemCert cert-pki-ca", and the certificate in the file /var/lib/ipa/ra-agent.pem As far as I can see, the sequence of events has been as follows: host3 noticed the certificates needed renewing at 30 Jan 2020 05:37 and certmonger initiated a renewal. The state of those certificates went from MONITORING to CA_WORKING but the certificates were not renewed. The CA renewal master (host1) noticed its same set of certificates (plus "Server-Cert cert-pki-ca") needed renewing at 30 Jan 2020 07:28 and renewed them successfully. Another replica (host2) noticed that its certificates needed renewing at 30 Jan 2020 07:32 and renewed them successfully. At 30 Jan 13:37 on host3 the certificates needing to be renewed went from CA_WORKING back to MONITORING, but 'getcert list' now shows them with: ca-error: Invalid cookie: u'' and they still haven't renewed. I haven't seen certmonger attempt to try the renewal again on host3 (nothing from certmonger in /var/log/messages since 30 Jan 13:37). While I could try a getcert resubmit on host3 to force it to try again, I'd like to know if what I am seeing is the expected behaviour when a replica tried to renew certificates before the renewal master. How long should I have to wait till certmonger on host3 tries again? - I couldn't find any reference to how often certmonger tries the renewal. Rob Crittenden's freeipa-healthcheck script is now showing the following for host3: ERROR: ipahealthcheck.ipa.certs.IPARAAgent: RA agent description does not match 2;16;CN=Certificate Authority,O=EXAMPLE.COM;CN=IPA RA,O=EXAMPLE.COM in LDAP and 2;7;CN=Certificate Authority,O=EXAMPLE.COM;CN=IPA RA,O=EXAMPLE.COM expected ERROR: ipahealthcheck.ipa.certs.IPACertRevocation.20180926040924: Request for certificate failed, Certificate operation cannot be completed: EXCEPTION (Invalid Credential.) ERROR: ipahealthcheck.ipa.certs.IPACertRevocation.20180926040920: Request for certificate failed, Certificate operation cannot be completed: EXCEPTION (Invalid Credential.) ERROR: ipahealthcheck.ipa.certs.IPACertRevocation.20180926040921: Request for certificate failed, Certificate operation cannot be completed: EXCEPTION (Invalid Credential.) ERROR: ipahealthcheck.ipa.certs.IPACertRevocation.20180926040922: Request for certificate failed, Certificate operation cannot be completed: EXCEPTION (Invalid Credential.) ERROR: ipahealthcheck.ipa.certs.IPACertRevocation.20180926040923: Request for certificate failed, Certificate operation cannot be completed: EXCEPTION (Invalid Credential.) ERROR: ipahealthcheck.ipa.certs.IPACertRevocation.20180926040925: Request for certificate failed, Certificate operation cannot be completed: EXCEPTION (Invalid Credential.) ERROR: ipahealthcheck.ipa.certs.IPACertRevocation.20180926040927: Request for certificate failed, Certificate operation cannot be completed: EXCEPTION (Invalid Credential.) ERROR: ipahealthcheck.ipa.certs.IPACertRevocation.20180926040926: Request for certificate failed, Certificate operation cannot be completed: EXCEPTION (Invalid Credential.) ERROR: ipahealthcheck.ipa.certs.IPACertRevocation.20180831064406: Request for certificate failed, Certificate operation cannot be completed: EXCEPTION (Invalid Credential.) ERROR: ipahealthcheck.dogtag.ca.DogtagCertsConnectivityCheck: Request for certificate failed, Certificate operation cannot be completed: EXCEPTION (Invalid Credential.) Each of host1, host2 and host3 are showing serial number 16 in ldap using: ldapsearch -D "cn=directory manager" -W -b uid=ipara,ou=people,o=ipaca description At this stage I'm not sure whether this will resolve itself when certmonger tries to renew certificates again or whether I need to be more proactive. I'm happy to supply more logs as necessary. Thanks Roderick

3 3

ipa-replica-install failing
by Mitchell Smith 25 Aug '20

25 Aug '20

Hi list, I wanted to repost this issue with a more appropriate subject line, in case anyone has come across this issue before and has a work around. To provide some context, I have two FreeIPA instances running FreeIPA 4.3.1 on Ubuntu 16.04 LTS. I want to migrate to FreeIPA 4.5.4 running on CentOS 7. I have a way to migrate by dumping all the users out with ldapsearch and adding them to the new instance with ldapadd but it is a bit messy and will result in all users having to reset their password, as it won't let me add in already encrypted passwords. My initial thought was to add the new instance as a replica and then eventually retire the old one. I ran in to some problems with the ‘ipa-replica-install’ command though. I was able to join as a client no problem, but when I went to run ‘ipa-replica-install’ it failed while configuring the directory server component. [25/42]: restarting directory server [26/42]: creating DS keytab [27/42]: ignore time skew for initial replication [28/42]: setting up initial replication [error] DatabaseError: Server is unwilling to perform: modification of attribute nsds5replicareleasetimeout is not allowed in replica entry Your system may be partly configured. Run /usr/sbin/ipa-server-install --uninstall to clean up. I thought this might have something to do with differences between 4.3.1 and 4.5.4 but I wasn’t entirely sure. If there is a work around for this issue, it would be a significantly easier transition to the new FreeIPA instance. Cheers, Mitch

3 4

IPA healthcheck for older versions
by Rob Crittenden 24 Aug '20

24 Aug '20

Over the summer we announced the freeipa-healthcheck project which is designed to look at an IdM cluster and look for common problems so you can have some level of assurance that the system is running as it should. It was built against the IPA 4.8.x branch and originally released only for Fedora 29+. It is also included in the newly released RHEL 8.1.0. My curious nature led me to see if it would also work in in the IPA 4.6.x branch. It was a bit of a challenge backing down to Python 2 but I was able to get something working. I tested primarily on Fedora 27 but it should also work in RHEL/CentOS 7 (I smoke tested 7.8). I made an EPEL 7 build in COPR, https://copr.fedorainfracloud.org/coprs/rcritten/ipa-healthcheck/ Enable the repo and do: yum install freeipa-healthcheck Then run: ipa-healthcheck --failures-only Ideally there will be no output but an empty list []. Otherwise the output is JSON and hopefully has enough information to point you in the right direction. Feel free to ask if need help. False positives are always a possibility and many of the checks run independently so it's possible to get multiple issues from a single root problem. It's hard to predict all possible installations so some fine-tuning may be required. I'd recommend running it every now and then at least, like prior to updating IPA packages, creating a new master, etc, if not daily. It will, for example, warn of impending cert expiration. The more feedback I get on it the better and more useful I can make it. This is my own personal backport and is not officially supported by anyone but me. It's preferred to report issues on this mailing list. I'll see them and others may be able to chime in as well. rob

10 32

kinit -n asking for password on clients
by John Ratliff 13 Jul '20

13 Jul '20

When trying to do pkinit, if I do kinit -n on one of the IdM servers, it works fine. If I try on a client machine, it asks me for the password for WELLKNOWN/ANONYMOUS@REALM. I have the pkinit_anchors setup for the realm. As I'm trying to do anonymous pkinit, I think I don't need a client certificate. On the server, I get this: $ KRB5_TRACE="/dev/stderr" kinit -n [13061] 1518402857.924212: Getting initial credentials for WELLKNOWN/ANONYMOUS(a)IDM.EXAMPLE.COM [13061] 1518402857.929673: Sending request (200 bytes) to IDM.EXAMPLE.COM [13061] 1518402857.931830: Initiating TCP connection to stream 10.77.9.101:88 [13061] 1518402857.932241: Sending TCP request to stream 10.77.9.101:88 [13061] 1518402857.939162: Received answer (359 bytes) from stream 10.77.9.101:88 [13061] 1518402857.939180: Terminating TCP connection to stream 10.77.9.101:88 [13061] 1518402857.939284: Response was from master KDC [13061] 1518402857.939380: Received error from KDC: -1765328359/Additional pre-authentication required [13061] 1518402857.939474: Processing preauth types: 16, 15, 14, 136, 19, 147, 2, 133 [13061] 1518402857.939499: Selected etype info: etype aes256-cts, salt "IDM.EXAMPLE.COMWELLKNOWNANONYMOUS", params "" [13061] 1518402857.939509: Received cookie: MIT [13061] 1518402857.939563: Preauth module pkinit (147) (info) returned: 0/Success [13061] 1518402857.940352: PKINIT client computed kdc-req-body checksum 9/D98A0144E7E4ACC66B63EBCA98379AB9F055D143 [13061] 1518402857.940369: PKINIT client making DH request [13061] 1518402858.935: Preauth module pkinit (16) (real) returned: 0/Success [13061] 1518402858.956: Produced preauth for next request: 133, 16 [13061] 1518402858.994: Sending request (1408 bytes) to IDM.EXAMPLE.COM [13061] 1518402858.1091: Initiating TCP connection to stream 10.77.9.101:88 [13061] 1518402858.1187: Sending TCP request to stream 10.77.9.101:88 [13061] 1518402858.43063: Received answer (2880 bytes) from stream 10.77.9.101:88 [13061] 1518402858.43088: Terminating TCP connection to stream 10.77.9.101:88 [13061] 1518402858.43198: Response was from master KDC [13061] 1518402858.43258: Processing preauth types: 17, 19, 147 [13061] 1518402858.43273: Selected etype info: etype aes256-cts, salt "IDM.EXAMPLE.COMWELLKNOWNANONYMOUS", params "" [13061] 1518402858.43300: Preauth module pkinit (147) (info) returned: 0/Success [13061] 1518402858.44150: PKINIT client verified DH reply [13061] 1518402858.44189: PKINIT client found id-pkinit-san in KDC cert: krbtgt/IDM.EXAMPLE.COM(a)IDM.EXAMPLE.COM [13061] 1518402858.44199: PKINIT client matched KDC principal krbtgt/IDM.EXAMPLE.COM(a)IDM.EXAMPLE.COM against id-pkinit-san; no EKU check required [13061] 1518402858.62345: PKINIT client used KDF 2B06010502030602 to compute reply key aes256-cts/00E0 [13061] 1518402858.62395: Preauth module pkinit (17) (real) returned: 0/Success [13061] 1518402858.62402: Produced preauth for next request: (empty) [13061] 1518402858.62414: AS key determined by preauth: aes256-cts/00E0 [13061] 1518402858.62547: Decrypted AS reply; session key is: aes256-cts/96F0 [13061] 1518402858.62589: FAST negotiation: available [13061] 1518402858.62692: Initializing KEYRING:persistent:760400007:krb_ccache_f3PFEy1 with default princ WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS [13061] 1518402858.62770: Storing WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS -> krbtgt/IDM.EXAMPLE.COM(a)IDM.EXAMPLE.COM in KEYRING:persistent:760400007:krb_ccache_f3PFEy1 [13061] 1518402858.62846: Storing config in KEYRING:persistent:760400007:krb_ccache_f3PFEy1 for krbtgt/IDM.EXAMPLE.COM(a)IDM.EXAMPLE.COM: fast_avail: yes [13061] 1518402858.62878: Storing WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS -> krb5_ccache_conf_data/fast_avail/krbtgt\/IDM.EXAMPLE.COM\@IDM.EXAMPLE.COM@X-CACHECONF: in KEYRING:persistent:760400007:krb_ccache_f3PFEy1 [13061] 1518402858.62933: Storing config in KEYRING:persistent:760400007:krb_ccache_f3PFEy1 for krbtgt/IDM.EXAMPLE.COM(a)IDM.EXAMPLE.COM: pa_type: 16 [13061] 1518402858.62954: Storing WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS -> krb5_ccache_conf_data/pa_type/krbtgt\/IDM.EXAMPLE.COM\@IDM.EXAMPLE.COM@X-CACHECONF: in KEYRING:persistent:760400007:krb_ccache_f3PFEy1 But on the client, I get this: $ KRB5_TRACE="/dev/stderr" kinit -n [2941] 1518402820.155827: Getting initial credentials for WELLKNOWN/ANONYMOUS(a)IDM.EXAMPLE.COM [2941] 1518402820.156298: Sending request (200 bytes) to IDM.EXAMPLE.COM [2941] 1518402820.158723: Resolving hostname paine.example.com. [2941] 1518402820.159975: Resolving hostname phantom.example.com. [2941] 1518402820.160757: Resolving hostname paine.example.com. [2941] 1518402820.161411: Initiating TCP connection to stream 204.89.253.101:88 [2941] 1518402820.162065: Sending TCP request to stream 204.89.253.101:88 [2941] 1518402820.168495: Received answer (359 bytes) from stream 204.89.253.101:88 [2941] 1518402820.168532: Terminating TCP connection to stream 204.89.253.101:88 [2941] 1518402820.169917: Response was from master KDC [2941] 1518402820.169974: Received error from KDC: -1765328359/Additional pre-authentication required [2941] 1518402820.170029: Processing preauth types: 16, 15, 14, 136, 19, 147, 2, 133 [2941] 1518402820.170051: Selected etype info: etype aes256-cts, salt "IDM.EXAMPLE.COMWELLKNOWNANONYMOUS", params "" [2941] 1518402820.170062: Received cookie: MIT Password for WELLKNOWN/ANONYMOUS(a)IDM.EXAMPLE.COM: [2941] 1518402833.34612: Preauth module encrypted_timestamp (2) (real) returned: -1765328252/Password read interrupted kinit: Pre-authentication failed: Password read interrupted while getting initial credentials Suggestions on what I'm missing? Thanks.

3 3

automember hostgroup by account?
by Amos 14 Jun '20

14 Jun '20

Is it possible to have an automember rule to add a host to a hostgroup based on the account used with ipa-install-client? Amos

3 6

IPA and legacy systems
by Ronald Wimmer 27 May '20

27 May '20

What would be a good solution to add systems where the FQDN cannot be changed? Would it make sense to add a second DNS A Record in the IPA domain for each of these systems? Is there any experience on how to deal with such a situation? Thanks a lot in advance! Cheers, Ronald

5 17

IPA CA renewal and duplicate CA certs
by Sigbjorn Lie 15 May '20

15 May '20

Hi, We recently renewed our IPA CA cert using the "ipa-cacert-manage renew” command. The renewal was successful, and our CA cert no longer expires in 2020, but in 2040. Running “ipa-certupdate” on existing IPA clients and ipa-client-install on new IPA clients also works, however both the new and the old CA cert is pulled down to the IPA client and stored in /etc/ipa/ca.crt. This creates some issues as most applications reading /etc/ipa/ca.crt only reads the first entry, which happens to be the old CA cert. For the moment everything works OK as the old CA cert is still valid, however this will become a major issue in a few months time. Is this expected? To continue to service both the old and the new CA certificate to old and new IPA clients? Will the old certificate be automatically removed at some point? If not, what is the safe steps to remove the old CA certificate from the IPA servers? Thanks. Regards, Siggi

5 17

Samba integration - access without Kerberos
by lejeczek 29 Apr '20

29 Apr '20

hi everybody. I see this subject might have been poked around many times, a couple times at least for sure. But, I thought I'll poke again and hopefully get some latest comments & thoughts on - how to make IPA's Samba allow password authentication to Win clients from outside of IPA/AD domains? Would there, by now, possibly be a semi-official (by IPA team) way of getting there, since the subject first came up a longer while ago? many thanks, L.

2 6

ipa-adtrust-install --unattended | did not quite work?
by lejeczek 28 Apr '20

28 Apr '20

hi everyone, I did something pretty vanilla: $ ipa-adtrust-install --unattended --admin-password=xxx Process showed first some warning about "unattended" but then this: Configuring CIFS [1/24]: validate server hostname [2/24]: stopping smbd [3/24]: creating samba domain object [4/24]: retrieve local idmap range [5/24]: creating samba config registry [6/24]: writing samba config file [7/24]: adding cifs Kerberos principal [8/24]: adding cifs and host Kerberos principals to the adtrust agents group [9/24]: check for cifs services defined on other replicas [10/24]: adding cifs principal to S4U2Proxy targets [11/24]: adding admin(group) SIDs [12/24]: adding RID bases [13/24]: updating Kerberos config 'dns_lookup_kdc' already set to 'true', nothing to do. [14/24]: activating CLDAP plugin [15/24]: activating sidgen task [16/24]: map BUILTIN\Guests to nobody group [17/24]: configuring smbd to start on boot [18/24]: adding special DNS service records [19/24]: restarting Directory Server to take MS PAC and LDAP plugins changes into account [20/24]: adding fallback group [21/24]: adding Default Trust View [22/24]: setting SELinux booleans [23/24]: starting CIFS services ipaserver.install.adtrustinstance: CRITICAL CIFS services failed to start [24/24]: restarting smbd Done configuring CIFS. Now, Samba would not start and I wonder what that might have to do with the above: tarting Samba SMB Daemon... [2020/02/14 11:21:34.801358, 0] ../../source3/passdb/pdb_interface.c:171(make_pdb_method_name) No builtin nor plugin backend for ipasam found smb.service: Main process exited, code=exited, status=1/FAILURE smb.service: Failed with result 'exit-code'. Failed to start Samba SMB Daemon. Or is is it unrelated? Hot to troubleshoot & fix it? I'm on Centos 8 with ipa-server-4.8.0-13.module_el8.1.0+265+e1e65be4.x86_64 many thanks, L.

2 4

ipa: ERROR: CIFS server communication error: code "3221225506", message "{Access Denied} A process has requested access to an object but has not been granted those access rights." (both may be "None")
by Bernard Lheureux 20 Apr '20

20 Apr '20

Hi all, After a fresh install of FreeIPA 4.6.5-11.el7.centos.x86_64, fully updated from update repo on a CentOS7 x64 server, it appears that it is totally impossible to establish a trust with an AD running on local AD servers, we did it a few times ago with exactly the same distribution and had really no problem, we tried to completely reinstall the machine and the IPA wit always the same results, ipa: ERROR: CIFS server communication error: code "3221225506", message "{Access Denied} A process has requested access to an object but has not been granted those access rights." (both may be "None") Could someone point me to the direction to look for, because we are going nuts on this ? We found some tips in the /var/log/httpd/errors, but nothing seems to provide sufficient infos... [Wed Oct 02 12:54:57.868830 2019] [:error] [pid 2036] ipa: INFO: [jsonserver_session] admin(a)DOMAIN.INTRA: trust_add/1(u'domain.intra', trust_type=u'ad', realm_admin=u'admin', realm_passwd=u'********', bidirectional=True, version=u'2.231'): RemoteRetrieveError The IPA server and the AD servers are in the same VLan with no firewall between them samba version on the IPA server is the latest available: 4.9.1-6.el7.noarch Thanks for your help...

3 7

Domain controllers switch to LDAPS
by Ronald Wimmer 08 Apr '20

08 Apr '20

Hi, will Microsofts decision to let domain controllers talk LDAPS only in the near future affect IPA sowehow? Cheers, Ronald

3 9

LDAP Server stop to response after a period of time
by Lays Dragon 31 Mar '20

31 Mar '20

I deployed a two replica FreeIPA Servers,it woks well until this month,it start at the service report the LDAP is Timeout,I try to restart the server,even reinstall two IPA server and maintain the data via replica from another server. And it still happen after several days. The 389ds server just simply stop to response to any connection ,the wierd thing is the connection is established but no response after the connection. LDAP server seems to blocked on something,even replica is dead because the ldap is blocked.simply restart not slove the problem,the ldap server will blocked really soon caused other service like IPA Web service or kinit dead too. I guess the blocked is caused via replica function somehow,since I figure out I have to close the ldap port on blocked server firewall to make it isolate,and restart the server,waiting for about 10 min after the server is start,reopen the ldap port on firewall to let replica recover,and everything will be fine...And I notice there some connection stuck at CLOSE_WAIT of ns-slapd may be related. Need some help . I not so familiar with of freeipa,and trying to deal this problem over the week but nothing works. FreeIPA server version:4.8.4 Server System: Fedora 31 (Cloud Edition) server1 access log ``` krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink krbAuthIndMaxTicke..." [08/Mar/2020:10:01:23.390837315 +0800] conn=4 op=6091 RESULT err=0 tag=101 nentries=1 etime=0.000276689 [08/Mar/2020:10:01:23.390906790 +0800] conn=4 op=6092 SRCH base="cn=ENMD.NET,cn=kerberos,dc=enmd,dc=net" scope=0 filter="(objectClass=krbticketpolicyaux)" attrs="krbMaxTicketLife krbMaxRenewableAge krbTicketFlags krbAuthIndMaxTicketLife krbAuthIndMaxRenewableAge" [08/Mar/2020:10:01:23.391302403 +0800] conn=4 op=6092 RESULT err=0 tag=101 nentries=1 etime=0.000432879 [08/Mar/2020:10:01:23.392418974 +0800] conn=3351 op=1 BIND dn="" method=sasl version=3 mech=GSSAPI [08/Mar/2020:10:01:25.953517485 +0800] conn=3352 fd=161 slot=161 connection from <masked>.152 to <masked>.165 [08/Mar/2020:10:01:27.007620375 +0800] conn=3353 fd=162 slot=162 connection from <masked>.154 to <masked>.165 [08/Mar/2020:10:01:27.151656148 +0800] conn=3354 fd=163 slot=163 connection from <masked>.150 to <masked>.165 [08/Mar/2020:10:01:27.559750675 +0800] conn=3355 fd=164 slot=164 connection from <masked>.153 to <masked>.165 [08/Mar/2020:10:01:39.015400434 +0800] conn=3356 fd=165 slot=165 connection from <masked>.154 to <masked>.165 [08/Mar/2020:10:01:51.582586229 +0800] conn=3357 fd=166 slot=166 connection from <masked>.153 to <masked>.165 [08/Mar/2020:10:01:52.513047687 +0800] conn=3358 fd=167 slot=167 connection from <masked>.150 to <masked>.165 [08/Mar/2020:10:01:53.573811317 +0800] conn=3359 fd=168 slot=168 connection from <masked>.152 to <masked>.165 [08/Mar/2020:10:02:44.012371005 +0800] conn=3360 fd=169 slot=169 connection from <masked>.160 to <masked>.165 [08/Mar/2020:10:02:44.419580574 +0800] conn=3361 fd=170 slot=170 connection from <masked>.151 to <masked>.165 [08/Mar/2020:10:02:45.548493596 +0800] conn=3362 fd=171 slot=171 connection from <masked>.153 to <masked>.165 [08/Mar/2020:10:02:50.018712852 +0800] conn=3363 fd=172 slot=172 connection from <masked>.160 to <masked>.165 [08/Mar/2020:10:02:51.081867407 +0800] conn=3364 fd=173 slot=173 connection from <masked>.152 to <masked>.165 [08/Mar/2020:10:03:04.062925765 +0800] conn=3365 fd=174 slot=174 connection from <masked>.154 to <masked>.165 [08/Mar/2020:10:03:06.223438080 +0800] conn=3366 fd=175 slot=175 connection from <masked>.150 to <masked>.165 [08/Mar/2020:10:03:10.063982993 +0800] conn=3367 fd=176 slot=176 connection from <masked>.154 to <masked>.165 [08/Mar/2020:10:03:52.027006125 +0800] conn=3368 fd=177 slot=177 connection from <masked>.153 to <masked>.165 [08/Mar/2020:10:03:57.005297121 +0800] conn=3369 fd=178 slot=178 connection from <masked>.152 to <masked>.165 [08/Mar/2020:10:04:01.001767909 +0800] conn=3370 fd=179 slot=179 connection from <masked>.150 to <masked>.165 [08/Mar/2020:10:04:08.003082421 +0800] conn=3371 fd=180 slot=180 connection from <masked>.154 to <masked>.165 [08/Mar/2020:10:04:12.014090964 +0800] conn=3372 fd=181 slot=181 connection from <masked>.151 to <masked>.165 [08/Mar/2020:10:04:18.140192092 +0800] conn=3373 fd=182 slot=182 connection from <masked>.166 to <masked>.165 [08/Mar/2020:10:04:20.007046774 +0800] conn=3374 fd=183 slot=183 connection from <masked>.154 to <masked>.165 [08/Mar/2020:10:04:24.040348027 +0800] conn=3375 fd=184 slot=184 connection from <masked>.160 to <masked>.165 [08/Mar/2020:10:04:30.139898749 +0800] conn=3376 fd=185 slot=185 connection from <masked>.160 to <masked>.165 [08/Mar/2020:10:05:22.043556910 +0800] conn=3377 fd=186 slot=186 connection from <masked>.160 to <masked>.165 [08/Mar/2020:10:05:34.140357676 +0800] conn=3378 fd=187 slot=187 connection from <masked>.160 to <masked>.165 [08/Mar/2020:10:05:36.006033007 +0800] conn=3379 fd=188 slot=188 connection from <masked>.165 to <masked>.165 [08/Mar/2020:10:06:07.002808000 +0800] conn=3380 fd=189 slot=189 connection from <masked>.150 to <masked>.165 [08/Mar/2020:10:06:12.043478717 +0800] conn=3381 fd=190 slot=190 connection from <masked>.152 to <masked>.165 [08/Mar/2020:10:06:15.007914045 +0800] conn=3382 fd=191 slot=191 connection from <masked>.153 to <masked>.165 [08/Mar/2020:10:06:17.005632290 +0800] conn=3383 fd=192 slot=192 connection from <masked>.154 to <masked>.165 [08/Mar/2020:10:06:19.016341572 +0800] conn=3384 fd=193 slot=193 connection from <masked>.165 to <masked>.165 [08/Mar/2020:10:06:23.007594584 +0800] conn=3385 fd=194 slot=194 connection from <masked>.154 to <masked>.165 [08/Mar/2020:10:06:27.026262632 +0800] conn=3386 fd=195 slot=195 connection from <masked>.165 to <masked>.165 [08/Mar/2020:10:06:30.031700186 +0800] conn=3387 fd=196 slot=196 SSL connection from <masked>.159 to <masked>.180 [08/Mar/2020:10:06:37.009611536 +0800] conn=3388 fd=197 slot=197 connection from <masked>.151 to <masked>.165 [08/Mar/2020:10:06:37.033108567 +0800] conn=3389 fd=198 slot=198 connection from <masked>.165 to <masked>.165 [08/Mar/2020:10:07:23.002813545 +0800] conn=3390 fd=199 slot=199 connection from <masked>.165 to <masked>.165 [08/Mar/2020:10:07:31.011795943 +0800] conn=3391 fd=200 slot=200 connection from <masked>.165 to <masked>.165 [08/Mar/2020:10:07:36.011894960 +0800] conn=3392 fd=201 slot=201 connection from <masked>.160 to <masked>.165 [08/Mar/2020:10:07:41.021108836 +0800] conn=3393 fd=202 slot=202 connection from <masked>.165 to <masked>.165 [08/Mar/2020:10:07:42.014874690 +0800] conn=3394 fd=203 slot=203 connection from <masked>.160 to <masked>.165 [08/Mar/2020:10:09:16.005883198 +0800] conn=3395 fd=204 slot=204 connection from <masked>.165 to <masked>.165 [08/Mar/2020:10:09:24.009940147 +0800] conn=3396 fd=205 slot=205 connection from <masked>.165 to <masked>.165 [08/Mar/2020:10:09:34.015154400 +0800] conn=3397 fd=206 slot=206 connection from <masked>.165 to <masked>.165 [08/Mar/2020:10:10:24.040398249 +0800] conn=3398 fd=207 slot=207 connection from <masked>.153 to <masked>.165 [08/Mar/2020:10:10:27.003675219 +0800] conn=3399 fd=208 slot=208 connection from <masked>.152 to <masked>.165 [08/Mar/2020:10:10:28.005336766 +0800] conn=3400 fd=209 slot=209 connection from <masked>.150 to <masked>.165 ``` server1 error log ``` [08/Mar/2020:09:30:52.966764268 +0800] - ERR - NSMMReplicationPlugin - repl5_inc_waitfor_async_results - Timed out waiting for responses: 0 3074 [08/Mar/2020:09:32:53.684831136 +0800] - ERR - NSMMReplicationPlugin - release_replica - agmt="cn=meToipa2.enmd.net" (ipa2:389): Attempting to release replica, but unable to receive endReplication extended operation response from the replica. Error -5 (Timed out) [08/Mar/2020:09:34:53.625806166 +0800] - WARN - NSMMReplicationPlugin - acquire_replica - agmt="cn=meToipa2.enmd.net" (ipa2:389): Unable to receive the response for a startReplication extended operation to consumer (Timed out). Will retry later. [08/Mar/2020:09:36:56.570809366 +0800] - WARN - NSMMReplicationPlugin - acquire_replica - agmt="cn=meToipa2.enmd.net" (ipa2:389): Unable to receive the response for a startReplication extended operation to consumer (Timed out). Will retry later. [08/Mar/2020:09:38:56.509924342 +0800] - WARN - NSMMReplicationPlugin - acquire_replica - agmt="cn=meToipa2.enmd.net" (ipa2:389): Unable to receive the response for a startReplication extended operation to consumer (Timed out). Will retry later. [08/Mar/2020:09:40:59.458123866 +0800] - WARN - NSMMReplicationPlugin - acquire_replica - agmt="cn=meToipa2.enmd.net" (ipa2:389): Unable to receive the response for a startReplication extended operation to consumer (Timed out). Will retry later. [08/Mar/2020:09:42:59.402931124 +0800] - WARN - NSMMReplicationPlugin - acquire_replica - agmt="cn=meToipa2.enmd.net" (ipa2:389): Unable to receive the response for a startReplication extended operation to consumer (Timed out). Will retry later. [08/Mar/2020:09:45:02.343312876 +0800] - WARN - NSMMReplicationPlugin - acquire_replica - agmt="cn=meToipa2.enmd.net" (ipa2:389): Unable to receive the response for a startReplication extended operation to consumer (Timed out). Will retry later. [08/Mar/2020:09:47:02.282487714 +0800] - WARN - NSMMReplicationPlugin - acquire_replica - agmt="cn=meToipa2.enmd.net" (ipa2:389): Unable to receive the response for a startReplication extended operation to consumer (Timed out). Will retry later. [08/Mar/2020:09:49:05.220734403 +0800] - WARN - NSMMReplicationPlugin - acquire_replica - agmt="cn=meToipa2.enmd.net" (ipa2:389): Unable to receive the response for a startReplication extended operation to consumer (Timed out). Will retry later. [08/Mar/2020:09:51:05.160565112 +0800] - WARN - NSMMReplicationPlugin - acquire_replica - agmt="cn=meToipa2.enmd.net" (ipa2:389): Unable to receive the response for a startReplication extended operation to consumer (Timed out). Will retry later. [08/Mar/2020:09:53:08.105641621 +0800] - WARN - NSMMReplicationPlugin - acquire_replica - agmt="cn=meToipa2.enmd.net" (ipa2:389): Unable to receive the response for a startReplication extended operation to consumer (Timed out). Will retry later. [08/Mar/2020:09:55:08.040503542 +0800] - WARN - NSMMReplicationPlugin - acquire_replica - agmt="cn=meToipa2.enmd.net" (ipa2:389): Unable to receive the response for a startReplication extended operation to consumer (Timed out). Will retry later. [08/Mar/2020:09:57:11.997307120 +0800] - WARN - NSMMReplicationPlugin - acquire_replica - agmt="cn=meToipa2.enmd.net" (ipa2:389): Unable to receive the response for a startReplication extended operation to consumer (Timed out). Will retry later. [08/Mar/2020:09:59:12.965695447 +0800] - WARN - NSMMReplicationPlugin - acquire_replica - agmt="cn=meToipa2.enmd.net" (ipa2:389): Unable to receive the response for a startReplication extended operation to consumer (Timed out). Will retry later. [08/Mar/2020:10:01:15.903578926 +0800] - WARN - NSMMReplicationPlugin - acquire_replica - agmt="cn=meToipa2.enmd.net" (ipa2:389): Unable to receive the response for a startReplication extended operation to consumer (Timed out). Will retry later. [08/Mar/2020:11:26:42.560167019 +0800] - INFO - slapd_extract_cert - CA CERT NAME: ENMD.NET IPA CA [08/Mar/2020:11:26:42.567890161 +0800] - WARN - Security Initialization - SSL alert: Sending pin request to SVRCore. You may need to run systemd-tty-ask-password-agent to provide the password. [08/Mar/2020:11:26:42.647668764 +0800] - INFO - slapd_extract_cert - SERVER CERT NAME: Server-Cert [08/Mar/2020:11:26:42.722748631 +0800] - INFO - Security Initialization - SSL info: Enabling default cipher set. [08/Mar/2020:11:26:42.726554182 +0800] - INFO - Security Initialization - SSL info: Configured NSS Ciphers [08/Mar/2020:11:26:42.730304776 +0800] - INFO - Security Initialization - SSL info: TLS_AES_128_GCM_SHA256: enabled [08/Mar/2020:11:26:42.733614343 +0800] - INFO - Security Initialization - SSL info: TLS_CHACHA20_POLY1305_SHA256: enabled [08/Mar/2020:11:26:42.740389595 +0800] - INFO - Security Initialization - SSL info: TLS_AES_256_GCM_SHA384: enabled [08/Mar/2020:11:26:42.743830864 +0800] - INFO - Security Initialization - SSL info: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256: enabled [08/Mar/2020:11:26:42.748868878 +0800] - INFO - Security Initialization - SSL info: TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256: enabled [08/Mar/2020:11:26:42.762016895 +0800] - INFO - Security Initialization - SSL info: TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256: enabled [08/Mar/2020:11:26:42.766962209 +0800] - INFO - Security Initialization - SSL info: TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256: enabled [08/Mar/2020:11:26:42.779721887 +0800] - INFO - Security Initialization - SSL info: TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384: enabled [08/Mar/2020:11:26:42.787619421 +0800] - INFO - Security Initialization - SSL info: TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384: enabled [08/Mar/2020:11:26:42.795024632 +0800] - INFO - Security Initialization - SSL info: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA: enabled [08/Mar/2020:11:26:42.799027752 +0800] - INFO - Security Initialization - SSL info: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA: enabled [08/Mar/2020:11:26:42.802532993 +0800] - INFO - Security Initialization - SSL info: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA: enabled [08/Mar/2020:11:26:42.806279559 +0800] - INFO - Security Initialization - SSL info: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256: enabled ```

5 14

Re: Running FreeIPA using IPv4
by Jessie James Bowman 31 Mar '20

31 Mar '20

I attempted to search through the discussions for an existing thread, but it seems I didn't search thoroughly enough. I appreciate the time taken to answer.

1 0

Running FreeIPA using IPv4
by Jessie James Bowman 31 Mar '20

31 Mar '20

Hello all, So I'm currently trying to install and test FreeIPA on one of my sandboxes. We are not allowed to use IPv6 per STIGs. Is it possible to run the application on IPv4? I've researched and have been unable to find an answer. Our team could really use some of the features the application provides, but we have to navigate the IPv6 STIG to do it. Thanks in advance!

2 1

2 factor authentication in Freeipa
by dmitriys 31 Mar '20

31 Mar '20

Hi! I use Freeipa VERSION: 4.8.0, API_VERSION: 2.233 I want use Freeipa as user store for other web services (like jira, jenkins,gitlab etc). For security reasons we need 2 factor authentication. I read about OTP in Freeipa but allmost post about host authentication ? How i can setup OTP for user login ?

2 2

Re: Expired Certificates, rolling back time didn't help
by Bhavin Vaidya 30 Mar '20

30 Mar '20

Hello, [root@srv01 lib]# certutil -L -d /etc/pki/pki-tomcat/alias Certificate Nickname Trust Attributes SSL,S/MIME,JAR/XPI Server-Cert cert-pki-ca u,u,u auditSigningCert cert-pki-ca u,u,Pu subsystemCert cert-pki-ca u,u,u Certificate Authority - EXAMPLE.COM CTu,Cu,Cu ocspSigningCert cert-pki-ca u,u,u caSigningCert cert-pki-ca CTu,Cu,Cu [root@ds01 lib]# certutil -L -d /etc/pki/pki-tomcat/alias -n 'Certificate Authority - EXAMPLE.COM' | grep -i after Not After : Thu Aug 03 19:28:18 2034 Is "Certificate Authority - EXAMPLE.COM" valid entry here? this Not After date is of our older CA certificate, which we was replaced couple years ago. can this entry be deleted? the "caSigningCert cert-pki-ca" is the current CA with valid dates. thank you for your help. Rgwards, Bhavin ________________________________ From: Bhavin Vaidya via FreeIPA-users <freeipa-users(a)lists.fedorahosted.org> Sent: Monday, March 23, 2020 1:28 PM To: Florence Blanc-Renaud <flo(a)redhat.com>; FreeIPA users list <freeipa-users(a)lists.fedorahosted.org> Cc: Bhavin Vaidya <bvaidya(a)hotmail.com> Subject: [Freeipa-users] Re: Expired Certificates, rolling back time didn't help Hello, We carried out following steps, but certificates will still not renew. stop ntpd fall back to 2018-05-11 (Mar 11th, 2018) ipactl stop started all but ntpd service manually systemctl restart certomonger Waited for more than an hour, but certificates still didn't get update. Now our other IPA server's some certiicated also expired. I'm seeing 2 IPA certificates in following output, as earlier we had issue with loosing master CA server and we retain older certificate it seems. Can this be an issue? [root@srv01 log]# /usr/bin/certutil -d /etc/httpd/alias/ -L Certificate Nickname Trust Attributes SSL,S/MIME,JAR/XPI Server-Cert u,u,u EXAMPLE.COM IPA CA-0 CT,C,C EXAMPLE.COM IPA CA CT,C,C [root@srv01 log]# [root@srv01 ~]# certutil -d /etc/dirsrv/slapd-EXAMPLE-COM/ -L Certificate Nickname Trust Attributes SSL,S/MIME,JAR/XPI Server-Cert CTu,Cu,Cu EXAMPLE.COM IPA CA CT,C,C [root@srv01 ~]# thank you for your support. regards, Bhavin ________________________________ From: Florence Blanc-Renaud <flo(a)redhat.com> Sent: Tuesday, March 17, 2020 4:26 AM To: FreeIPA users list <freeipa-users(a)lists.fedorahosted.org> Cc: Bhavin Vaidya <bvaidya(a)hotmail.com> Subject: Re: [Freeipa-users] Re: Expired Certificates, rolling back time didn't help On 3/17/20 11:44 AM, Bhavin Vaidya via FreeIPA-users wrote: > Hello Flo, > > thank you for your response. > > [root@srv01 ~]# ipa config-show | grep renewal > IPA CA renewal master: srv01.arteris.com > > We followed following step, but Certificates will not renew. > > Stopped NTP and went back to 2018-05-11 > systemctl restart certmonger.service > > no luck, so we did > > Stopped NTP and went back to 2018-05-11 > systemctl restart certmonger.service > stopped FreeIPA - ipactl stop > Started services manually as per this RedHat doc > <https://access.redhat.com/solutions/3146271>. > getcert list ---- shows either SUBMITTING, CA_UNREACHABLE or > NEED_TO_SUBMIT > Hi, you need to wait a while for certmonger to renew all the certs. As the new output shows, some progress was made: the LDAP certificate was renewed. You can try: getcert resubmit -i 20180315021503 then wait for the RA cert to move to MONITORING and do the same for each cert that needs to be renewed (resubmit, wait for the cert to move to MONITORING, etc...). flo > [root@srv01 ~]# getcert list > > Number of certificates and requests being tracked: 8. > > Request ID '20180228053337': > > status: MONITORING > > stuck: no > > key pair storage: type=FILE,location='/var/kerberos/krb5kdc/kdc.key' > > certificate: type=FILE,location='/var/kerberos/krb5kdc/kdc.crt' > > CA: SelfSign > > issuer: CN=srv01.example.com,O=EXAMPLE.COM > > subject: CN=srv01.example.com,O=EXAMPLE.COM > > expires: 2021-01-11 21:56:57 UTC > > principal name: krbtgt/EXAMPLE.COM(a)EXAMPLE.COM > <mailto:krbtgt/EXAMPLE.COM@EXAMPLE.COM> > > certificate template/profile: KDCs_PKINIT_Certs > > pre-save command: > > post-save command: /usr/libexec/ipa/certmonger/renew_kdc_cert > > track: yes > > auto-renew: yes > > Request ID '20180315021457': > > status: SUBMITTING > > stuck: no > > key pair storage: > type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert > cert-pki-ca',token='NSS Certificate DB',pin set > > certificate: > type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert > cert-pki-ca',token='NSS Certificate DB' > > CA: dogtag-ipa-ca-renew-agent > > issuer: CN=Certificate Authority,O=EXAMPLE.COM > > subject: CN=CA Audit,O=EXAMPLE.COM > > expires: 2020-02-25 04:27:49 UTC > > key usage: digitalSignature,nonRepudiation > > pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad > > post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert > "auditSigningCert cert-pki-ca" > > track: yes > > auto-renew: yes > > Request ID '20180315021500': > > status: SUBMITTING > > stuck: no > > key pair storage: > type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert cert-pki-ca',token='NSS > Certificate DB',pin set > > certificate: > type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert cert-pki-ca',token='NSS > Certificate DB' > > CA: dogtag-ipa-ca-renew-agent > > issuer: CN=Certificate Authority,O=EXAMPLE.COM > > subject: CN=OCSP Subsystem,O=EXAMPLE.COM > > expires: 2020-02-25 04:28:38 UTC > > eku: id-kp-OCSPSigning > > pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad > > post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert > "ocspSigningCert cert-pki-ca" > > track: yes > > auto-renew: yes > > Request ID '20180315021501': > > status: SUBMITTING > > stuck: no > > key pair storage: > type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert > cert-pki-ca',token='NSS Certificate DB',pin set > > certificate: > type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert > cert-pki-ca',token='NSS Certificate DB' > > CA: dogtag-ipa-ca-renew-agent > > issuer: CN=Certificate Authority,O=EXAMPLE.COM > > subject: CN=CA Subsystem,O=EXAMPLE.COM > > expires: 2020-02-25 04:31:47 UTC > > key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment > > eku: id-kp-serverAuth,id-kp-clientAuth > > pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad > > post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert > "subsystemCert cert-pki-ca" > > track: yes > > auto-renew: yes > > Request ID '20180315021502': > > status: MONITORING > > stuck: no > > key pair storage: > type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert > cert-pki-ca',token='NSS Certificate DB',pin set > > certificate: > type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert > cert-pki-ca',token='NSS Certificate DB' > > CA: dogtag-ipa-ca-renew-agent-reuse > > issuer: CN=Certificate Authority,O=EXAMPLE.COM > > subject: CN=Certificate Authority,O=EXAMPLE.COM > > expires: 2038-03-07 03:47:46 UTC > > key usage: digitalSignature,nonRepudiation,keyCertSign,cRLSign > > pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad > > post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert > "caSigningCert cert-pki-ca" > > track: yes > > auto-renew: yes > > Request ID '20180315021503': > > status: CA_UNREACHABLE > > ca-error: Error 28 connecting to > https://srv01.example.com:8443/ca/agent/ca/profileReview: Timeout was > reached. > > stuck: no > > key pair storage: type=FILE,location='/var/lib/ipa/ra-agent.key' > > certificate: type=FILE,location='/var/lib/ipa/ra-agent.pem' > > CA: dogtag-ipa-ca-renew-agent > > issuer: CN=Certificate Authority,O=EXAMPLE.COM > > subject: CN=IPA RA,O=EXAMPLE.COM > > expires: 2018-06-15 23:15:23 UTC > > key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment > > eku: id-kp-serverAuth,id-kp-clientAuth > > pre-save command: /usr/libexec/ipa/certmonger/renew_ra_cert_pre > > post-save command: /usr/libexec/ipa/certmonger/renew_ra_cert > > track: yes > > auto-renew: yes > > Request ID '20180315021505': > > status: MONITORING > > stuck: no > > key pair storage: > type=NSSDB,location='/etc/dirsrv/slapd-EXAMPLE-COM',nickname='Server-Cert',token='NSS > Certificate DB',pinfile='/etc/dirsrv/slapd-EXAMPLE-COM/pwdfile.txt' > > certificate: > type=NSSDB,location='/etc/dirsrv/slapd-EXAMPLE-COM',nickname='Server-Cert',token='NSS > Certificate DB' > > CA: IPA > > issuer: CN=Certificate Authority,O=EXAMPLE.COM > > subject: CN=srv01.example.com,O=EXAMPLE.COM > > expires: 2020-05-12 01:41:53 UTC > > principal name: ldap/srv01.example.com(a)EXAMPLE.COM > <mailto:ldap/srv01.example.com@EXAMPLE.COM> > > key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment > > eku: id-kp-serverAuth,id-kp-clientAuth > > pre-save command: > > post-save command: /usr/libexec/ipa/certmonger/restart_dirsrv EXAMPLE-COM > > track: yes > > auto-renew: yes > > Request ID '20180315021510': > > status: NEED_TO_SUBMIT > > ca-error: Server at https://srv01.example.com/ipa/xmlfailed request, > will retry: -504 (libcurl failed to execute the HTTP POST transaction, > explaining:Peer's Certificate has expired.). > > stuck: no > > key pair storage: > type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS > Certificate DB',pinfile='/etc/httpd/alias/pwdfile.txt' > > certificate: > type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS > Certificate DB' > > CA: IPA > > issuer: CN=Certificate Authority,O=EXAMPLE.COM > > subject: CN=srv01.example.com,O=EXAMPLE.COM > > expires: 2020-03-07 08:49:51 UTC > > principal name: HTTP/srv01.example.com(a)EXAMPLE.COM > <mailto:HTTP/srv01.example.com@EXAMPLE.COM> > > key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment > > eku: id-kp-serverAuth,id-kp-clientAuth > > pre-save command: > > post-save command: /usr/libexec/ipa/certmonger/restart_httpd > > track: yes > > auto-renew: yes > > > > Thank you and with regards, > Bhavin > > > > ------------------------------------------------------------------------ > *From:* Florence Blanc-Renaud <flo(a)redhat.com> > *Sent:* Tuesday, March 17, 2020 1:17 AM > *To:* FreeIPA users list <freeipa-users(a)lists.fedorahosted.org> > *Cc:* Bhavin Vaidya <bvaidya(a)hotmail.com> > *Subject:* Re: [Freeipa-users] Expired Certificates, rolling back time > didn't help > On 3/16/20 11:44 PM, Bhavin Vaidya via FreeIPA-users wrote: >> Hello, >> >> We had similar issue 2 yrs back, and resurface as it didn't auto-renew. >> Went back in time to 2016-06-11 as well as 2020-02-20, restarted >> "certmonger", didn't update. >> > Hi, > > you need to check first which server is your renewal master: > > $ kinit admin > > $ ipa config-show | grep renewal > > > The output should display the name of the renewal master. This host is > the first server that needs to be fixed. > > > In the getcert list output that you provided, we can see that: > > - the PKI certificates shared between the servers expired on 2020-02-25 > (auditSigningCert cert-pki-ca, ocspSigningCert cert-pki-ca, > subsystemCert cert-ki-ca) > > - the CA cert is still valid > > - the RA cert expired on 2018-06-15 > > - the HTTP and LDAP server certs expired on 2020-03-07 > > > You need to carefully pick the date you go back in time: at that given > date, all the certs must be valid (not expired yet but *already valid*). > From your output, the date needs to be before 2018-06-15 but after > 2018-03-08 (=the validFrom date for the PKI certs). > > > HTH, > > flo > >> FreeIPA Master:*CentOS 7.4.1708, FreeIPA Version: **4.5.0, >> API_VERSION: 2.228* >> >> whileipactl start, it will not start pki-tomcat with >> message,pki-tomcatd Service: STOPPED. >> >> Referring toRob's blog >> <https://rcritten.wordpress.com/2017/09/20/peer-certificate-cannot-be-authen…> >> >> [root@srv01 ~]# curl --cacert /etc/ipa/ca.crt >> -v[https://%60hostname%60:8443/ca/ww/ca/getCertChain]https://`hostname`:8443/ca/ww/ca/getCertChain >> >> * About to connect() to srv01.example.com port 8443 (#0) >> >> *Trying 192.168.10.146... >> >> * Connected to srv01.example.com (192.168.10.146) port 8443 (#0) >> >> * Initializing NSS with certpath: sql:/etc/pki/nssdb >> >> *CAfile: /etc/ipa/ca.crt >> >> CApath: none >> >> * Server certificate: >> >> *subject: CN=srv01.example.com,O=EXAMPLE.COM >> >> *start date: Dec 26 21:02:44 2016 GMT >> >> *expire date: Dec 16 21:02:44 2018 GMT >> >> *common name: srv01.example.com >> >> *issuer: CN=Certificate Authority,O=EXAMPLE.COM >> >> * NSS error -8172 (SEC_ERROR_UNTRUSTED_ISSUER) >> >> * Peer's certificate issuer has been marked as not trusted by the user. >> >> * Closing connection 0 >> >> curl: (60) Peer's certificate issuer has been marked as not trusted by >> the user. >> >> More details here:http://curl.haxx.se/docs/sslcerts.html >> >> curl performs SSL certificate verification by default, using a "bundle" >> >> of Certificate Authority (CA) public keys (CA certs). If the >> defaultbundle file isn't adequate, you can specify an alternate >> fileusing the --cacert option. >> >> If this HTTPS server uses a certificate signed by a CA represented >> inthe bundle, the certificate verification probably failed due to >> aproblem with the certificate (it might be expired, or the name >> mightnot match the domain name in the URL). >> >> If you'd like to turn off curl's verification of the certificate, >> usethe -k (or --insecure) option. >> >> >> While, CA cert check asper >> <https://www.freeipa.org/page/V4/CA_certificate_renewal>, >> >> [root@srv01 ~]# getcert list -d /etc/pki/pki-tomcat/alias -n >> 'caSigningCert cert-pki-ca' >> >> Number of certificates and requests being tracked: 8. >> >> Request ID '20180315021502': >> >> status: MONITORING >> >> stuck: no >> >> key pair storage: >> type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert cert-pki-ca',token='NSS >> Certificate DB',pin set >> >> certificate: >> type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert cert-pki-ca',token='NSS >> Certificate DB' >> >> CA: dogtag-ipa-ca-renew-agent >> >> issuer: CN=Certificate Authority,O=EXAMPLE.COM >> >> subject: CN=Certificate Authority,O=EXAMPLE.COM >> >> expires: 2038-03-07 03:47:46 UTC >> >> key usage: digitalSignature,nonRepudiation,keyCertSign,cRLSign >> >> pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad >> >> post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert >> "caSigningCert cert-pki-ca" >> >> track: yes >> >> auto-renew: yes >> >> We also have few others certificates, which are not renewed. >> >> >> [root@srv01 ~]# getcert list >> >> Number of certificates and requests being tracked: 8. >> >> Request ID '20180228053337': >> >> status: MONITORING >> >> stuck: no >> >> key pair storage: type=FILE,location='/var/kerberos/krb5kdc/kdc.key' >> >> certificate: type=FILE,location='/var/kerberos/krb5kdc/kdc.crt' >> >> CA: SelfSign >> >> issuer: CN=srv01.example.com,O=EXAMPLE.COM >> >> subject: CN=srv01.example.com,O=EXAMPLE.COM >> >> expires: 2021-01-11 21:56:57 UTC >> >> principal name:krbtgt/EXAMPLE.COM@EXAMPLE.COM >> <mailto:krbtgt/EXAMPLE.COM@EXAMPLE.COM> >> >> certificate template/profile: KDCs_PKINIT_Certs >> >> pre-save command: >> >> post-save command: /usr/libexec/ipa/certmonger/renew_kdc_cert >> >> track: yes >> >> auto-renew: yes >> >> Request ID '20180315021457': >> >> status: MONITORING >> >> stuck: no >> >> key pair storage: >> type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert >> cert-pki-ca',token='NSS Certificate DB',pin set >> >> certificate: >> type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert >> cert-pki-ca',token='NSS Certificate DB' >> >> CA: dogtag-ipa-ca-renew-agent >> >> issuer: CN=Certificate Authority,O=EXAMPLE.COM >> >> subject: CN=CA Audit,O=EXAMPLE.COM >> >> expires: 2020-02-25 04:27:49 UTC >> >> key usage: digitalSignature,nonRepudiation >> >> pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad >> >> post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert >> "auditSigningCert cert-pki-ca" >> >> track: yes >> >> auto-renew: yes >> >> Request ID '20180315021500': >> >> status: MONITORING >> >> stuck: no >> >> key pair storage: >> type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert >> cert-pki-ca',token='NSS Certificate DB',pin set >> >> certificate: >> type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert >> cert-pki-ca',token='NSS Certificate DB' >> >> CA: dogtag-ipa-ca-renew-agent >> >> issuer: CN=Certificate Authority,O=EXAMPLE.COM >> >> subject: CN=OCSP Subsystem,O=EXAMPLE.COM >> >> expires: 2020-02-25 04:28:38 UTC >> >> eku: id-kp-OCSPSigning >> >> pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad >> >> post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert >> "ocspSigningCert cert-pki-ca" >> >> track: yes >> >> auto-renew: yes >> >> Request ID '20180315021501': >> >> status: MONITORING >> >> stuck: no >> >> key pair storage: >> type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert cert-pki-ca',token='NSS >> Certificate DB',pin set >> >> certificate: >> type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert cert-pki-ca',token='NSS >> Certificate DB' >> >> CA: dogtag-ipa-ca-renew-agent >> >> issuer: CN=Certificate Authority,O=EXAMPLE.COM >> >> subject: CN=CA Subsystem,O=EXAMPLE.COM >> >> expires: 2020-02-25 04:31:47 UTC >> >> key usage: >> digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment >> >> eku: id-kp-serverAuth,id-kp-clientAuth >> >> pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad >> >> post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert >> "subsystemCert cert-pki-ca" >> >> track: yes >> >> auto-renew: yes >> >> Request ID '20180315021502': >> >> status: MONITORING >> >> stuck: no >> >> key pair storage: >> type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert cert-pki-ca',token='NSS >> Certificate DB',pin set >> >> certificate: >> type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert cert-pki-ca',token='NSS >> Certificate DB' >> >> CA: dogtag-ipa-ca-renew-agent >> >> issuer: CN=Certificate Authority,O=EXAMPLE.COM >> >> subject: CN=Certificate Authority,O=EXAMPLE.COM >> >> expires: 2038-03-07 03:47:46 UTC >> >> key usage: digitalSignature,nonRepudiation,keyCertSign,cRLSign >> >> pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad >> >> post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert >> "caSigningCert cert-pki-ca" >> >> track: yes >> >> auto-renew: yes >> >> Request ID '20180315021503': >> >> status: CA_UNREACHABLE >> >> ca-error: Error 60 connecting >> tohttps://srv01.example.com:8443/ca/agent/ca/profileReview: Peer >> certificate cannot be authenticated with given CA certificates. >> >> stuck: no >> >> key pair storage: type=FILE,location='/var/lib/ipa/ra-agent.key' >> >> certificate: type=FILE,location='/var/lib/ipa/ra-agent.pem' >> >> CA: dogtag-ipa-ca-renew-agent >> >> issuer: CN=Certificate Authority,O=EXAMPLE.COM >> >> subject: CN=IPA RA,O=EXAMPLE.COM >> >> expires: 2018-06-15 23:15:23 UTC >> >> key usage: >> digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment >> >> eku: id-kp-serverAuth,id-kp-clientAuth >> >> pre-save command: /usr/libexec/ipa/certmonger/renew_ra_cert_pre >> >> post-save command: /usr/libexec/ipa/certmonger/renew_ra_cert >> >> track: yes >> >> auto-renew: yes >> >> Request ID '20180315021505': >> >> status: CA_UNREACHABLE >> >> ca-error: Server athttps://srv01.example.com/ipa/xmlfailed request, >> will retry: 4016 (RPC failed at server.Failed to authenticate to CA >> REST API). >> >> stuck: no >> >> key pair storage: >> type=NSSDB,location='/etc/dirsrv/slapd-EXAMPLE-COM',nickname='Server-Cert',token='NSS >> Certificate DB',pinfile='/etc/dirsrv/slapd-EXAMPLE-COM/pwd >> >> file.txt' >> >> certificate: >> type=NSSDB,location='/etc/dirsrv/slapd-EXAMPLE-COM',nickname='Server-Cert',token='NSS >> Certificate DB' >> >> CA: IPA >> >> issuer: CN=Certificate Authority,O=EXAMPLE.COM >> >> subject: CN=srv01.example.com,O=EXAMPLE.COM >> >> expires: 2020-03-07 08:49:36 UTC >> >> principal name:ldap/srv01.example.com@EXAMPLE.COM >> <mailto:ldap/srv01.example.com@EXAMPLE.COM> >> >> key usage: >> digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment >> >> eku: id-kp-serverAuth,id-kp-clientAuth >> >> pre-save command: >> >> post-save command: /usr/libexec/ipa/certmonger/restart_dirsrv EXAMPLE-COM >> >> track: yes >> >> auto-renew: yes >> >> Request ID '20180315021510': >> >> status: CA_UNREACHABLE >> >> ca-error: Server athttps://srv01.example.com/ipa/xmlfailed request, >> will retry: 4016 (RPC failed at server.Failed to authenticate to CA >> REST API). >> >> stuck: no >> >> key pair storage: >> type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS >> Certificate DB',pinfile='/etc/httpd/alias/pwdfile.txt' >> >> certificate: >> type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS >> Certificate DB' >> >> CA: IPA >> >> issuer: CN=Certificate Authority,O=EXAMPLE.COM >> >> subject: CN=srv01.example.com,O=EXAMPLE.COM >> >> expires: 2020-03-07 08:49:51 UTC >> >> principal name:HTTP/srv01.example.com@EXAMPLE.COM >> <mailto:HTTP/srv01.example.com@EXAMPLE.COM> >> >> key usage: >> digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment >> >> eku: id-kp-serverAuth,id-kp-clientAuth >> >> pre-save command: >> >> post-save command: /usr/libexec/ipa/certmonger/restart_httpd >> >> track: yes >> >> auto-renew: yes >> >> >> thank you for your help. >> Bhavin >> >> >> >> _______________________________________________ >> FreeIPA-users mailing list --freeipa-users(a)lists.fedorahosted.org <mailto:freeipa-users@lists.fedorahosted.org> >> To unsubscribe send an email tofreeipa-users-leave(a)lists.fedorahosted.org <mailto:freeipa-users-leave@lists.fedorahosted.org> >> Fedora Code of Conduct:https://docs.fedoraproject.org/en-US/project/code-of-conduct/ >> List Guidelines:https://fedoraproject.org/wiki/Mailing_list_guidelines >> List Archives:https://lists.fedorahosted.org/archives/list/freeipa-users@lists.f… > > > > _______________________________________________ > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org > To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org > Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost… >

1 0

New IPA server
by Andrew Meyer 30 Mar '20

30 Mar '20

I am building out a new IPA server environment and I am getting the following error: [user@freeipa001 ~]$ sudo ipa-server-install --setup-dns --setup-kra --setup-adtrust --auto-reverse --ssh-trust-dns --auto-forwarders --allow-zone-overlap IPv6 stack has to be enabled in the kernel and some interface has to have ::1 address assigned. Typically this is 'lo' interface. If you do not wish to use IPv6 globally, disable it on the specific interfaces in sysctl.conf except 'lo' interface. The ipa-server-install command failed. See /var/log/ipaserver-install.log for more information [user@freeipa001 ~]$ [root@freeipa001 ~]# sudo sysctl -w net.ipv6.conf.lo.disable_ipv6=0 sysctl: cannot stat /proc/sys/net/ipv6/conf/lo/disable_ipv6: No such file or directory [root@freeipa001 ~]# I am using the latest CentOS 8

2 5

centos 6.9 with freeipa client 3.0 version Non-interactive
by Faraz Younus 30 Mar '20

30 Mar '20

Hi Team, I'm getting below error when running this command. would you help in that ? *IPA Server:* - name: Adding host to IPA server command: ipa host-add ipacentos.example.com --password=abc123 --force *Client: * name: Installing FreeIPA client command: /usr/sbin/ipa-client-install --domain example.com --mkhomedir --password abc123 " --server ipa9.example.com --unattended e, "cmd": ["/usr/sbin/ipa-client-install", "--domain", "fixedandmobile.com", "--mkhomedir", "--password", "abc123", "--server", "ipa9.example.com", "--unattended"], "delta": "0:01:03.451321", "end": "2020-03-29 05:57:22.013451", "msg": "non-zero return code", "rc": 1, "start": "2020-03-29 05:56:18.562130", "stderr": "Hostname: ipacentos.example.com\nRealm: EXAMPLE.COM\nDNS Domain: example.com\nIPA Server: ipa9.example.com\nBaseDN: dc=example,dc=com\nSynchronizing time with KDC...\nUnable to sync time with IPA NTP server, assuming the time is in sync. Please check that 123 UDP port is opened.\nOTP case, CA cert preexisted, use it\nJoining realm failed: Incorrect password.\n\nInstallation failed. Rolling back changes.\nIPA client is not configured on this system.", "stderr_lines": ["Hostname: ipacentos.example.com", "Realm:EXAMPLE.COM", "DNS Domain: example.com", "IPA Server: ipa9.example.com", "BaseDN: dc=example,dc=com", "Synchronizing time with KDC...", "Unable to sync time with IPA NTP server, assuming the time is in sync. Please check that 123 UDP port is opened.", "OTP case, CA cert preexisted, use it", "Joining realm failed: Incorrect password.", "", "Installation failed. Rolling back changes.", "IPA client is not configured on this system."], "stdout": "\u001b[?1034h", "stdout_lines": ["\u001b[?1034h"]}

3 6

FreeIPA 4.8.6 released
by Alexander Bokovoy 27 Mar '20

27 Mar '20

The FreeIPA team would like to announce FreeIPA 4.8.6 release! It can be downloaded from http://www.freeipa.org/page/Downloads. Builds for Fedora distributions will be available from the official repository soon. == Highlights in 4.8.6 * 5662: ID Views: do not allow custom Views for the masters Custom ID views cannot be applied to IPA masters. A check was added to both IPA CLI and Web UI to prevent applying custom ID views to avoid confusion and unintended side-effects. * 7181: ipa-replica-prepare fails for 2nd replica when passwordHistory is enabled FreeIPA password policy plugin in 389-ds was extended to exempt non-Kerberos LDAP objects from checking Kerberos policy during password changes by the Directory Manager or a password synchronization manager. This issue affected, among others, an integrated CA administrator account during deployment of more than one replica in some cases. * 8233: 4.8.5 master Installation error On Debian and ALT Linux setup of AJP connector did restart Apache instance before it was configured. The restart wasn't actually needed and thus was removed. * 8236: Enforce a check to prevent adding objects from IPA as external members of external groups Command 'ipa group-add-member' allowed to specify any user or group for '--external' option. A stricter check is added to verify that a group or user to be added as an external member does not come from IPA domain. * 8239: Actualize Bootstrap version Bootstrap Javascript framework used by FreeIPA web UI was updated to version 3.4.1. * 8241: Build fails on Fedora 30 SELinux rules for ipa-custodia were merged into FreeIPA SELinux policy. The policy relied on an SELinux interface that is not available in Fedora 30. The logic was changed to allow better portability across SELinux versions. === Enhancements === Known Issues * 8240: KRA install fails if all KRA members are Hidden Replicas If the first KRA instance is installed on a hidden replica, more KRA instances cannot be added to the cluster. As a workaround, temporarily make the the hidden replica with the KRA role visible before adding more KRA instances. The previously-hidden replica can be hidden again as soon as ipa-kra-install is complete. === Bug fixes FreeIPA 4.8.6 is a stabilization release for the features delivered as a part of 4.8 version series. There are more than 10 bug-fixes details of which can be seen in the list of resolved tickets below. == Upgrading Upgrade instructions are available on Upgrade page. == Feedback Please provide comments, bugs and other feedback via the freeipa-users mailing list (https://lists.fedoraproject.org/archives/list/freeipa-users@lists.fedorahos…) or #freeipa channel on Freenode. == Resolved tickets * https://pagure.io/freeipa/issue/5662[#5662] ID Views: do not allow custom Views for the masters * https://pagure.io/freeipa/issue/6891[#6891] Move FreeIPA SELinux policy from system policy to project policy * https://pagure.io/freeipa/issue/7181[#7181] ipa-replica-prepare fails for 2nd replica when passwordHistory is enabled * https://pagure.io/freeipa/issue/7895[#7895] ipa trust fetch-domains, server parameter ignored * https://pagure.io/freeipa/issue/8159[#8159] please migrate to the new Fedora translation platform * https://pagure.io/freeipa/issue/8193[#8193] Re-order 50-externalmembers.update to be after 80-schema_compat.update * https://pagure.io/freeipa/issue/8228[#8228] Nightly failure in backup/restore while calling 'id admin' * https://pagure.io/freeipa/issue/8233[#8233] 4.8.5 master Installation error * https://pagure.io/freeipa/issue/8236[#8236] Enforce a check to prevent adding objects from IPA as external members of external groups * https://pagure.io/freeipa/issue/8239[#8239] Actualize Bootstrap version * https://pagure.io/freeipa/issue/8240[#8240] KRA install fails if all KRA members are Hidden Replicas * https://pagure.io/freeipa/issue/8241[#8241] Build fails on Fedora 30 == Detailed changelog since 4.8.5 === Alexander Bokovoy (35) * Become FreeIPA 4.8.6 https://pagure.io/freeipa/c/75d04b5e0e5709d98440209f803175242a52d119[commit] * ipa-pwd-extop: don't check password policy for non-Kerberos account set by DM or a passsync manager https://pagure.io/freeipa/c/bcbf64b1bf287d2b0b23bc7ac0cca9e8b789ba4a[commit] https://pagure.io/freeipa/issue/7181[#7181] * ipa-pwd-extop: use SLAPI_BIND_TARGET_SDN https://pagure.io/freeipa/c/5bae736bc81eaa1167ec64a69a32506dad2ca286[commit] https://pagure.io/freeipa/issue/7181[#7181] * ipatests: test sysaccount password change with a password policy applied https://pagure.io/freeipa/c/313542e8a125c4904750826ef9eabdead7d874bd[commit] https://pagure.io/freeipa/issue/7181[#7181] * ipatests: allow changing sysaccount passwords as cn=Directory Manager https://pagure.io/freeipa/c/f4dc10b8caac44f5c2a8edbb4c647e6dcf71c3bd[commit] https://pagure.io/freeipa/issue/7181[#7181] * Fix indentation levels https://pagure.io/freeipa/c/c62b9e7f6ab0dec54540dc6cd389fe58f8858275[commit] * ipatests: always skip additional input for group-add-member --external https://pagure.io/freeipa/c/74f36e7c2f7f6d17b56e06b5f05205edb8a286d7[commit] https://pagure.io/freeipa/issue/8236[#8236] * po: update Chinese (China) translation https://pagure.io/freeipa/c/c6adee04068ce946f8c9b8ad5db19721db13c602[commit] * po: update Ukrainian translation https://pagure.io/freeipa/c/855a36b6c093fd21af7cf87524acc5d297692de3[commit] * po: update Tajik translation timestamp https://pagure.io/freeipa/c/3d411cf29f29e1d391ed8f6eb159b88d450a332b[commit] * po: update Slovak translation timestamp https://pagure.io/freeipa/c/3c15e47a7c2212aab0ecdc320093bee2afa0bfdc[commit] * po: update Russian translation https://pagure.io/freeipa/c/db433fbe4e521d08dee2cdc2e65344d8203e03a4[commit] * po: update Portuguese (Brazil) translation timestamp https://pagure.io/freeipa/c/eab195ff3884b482279279326b3a84ced4723b7e[commit] * po: update Portuguese translation timestamp https://pagure.io/freeipa/c/31a9da8efa793d492352f646fc804b902beec088[commit] * po: update Polish translation https://pagure.io/freeipa/c/4e3867fcc49a8d2ff1085e630abd77666a06d838[commit] * po: update Punjabi translation timestamp https://pagure.io/freeipa/c/e4dfb7409bd25dc5bc2cc1e99562f912a98509f8[commit] * po: update Dutch translation timestamp https://pagure.io/freeipa/c/e7945284906998da0a798a1ff15a42dd3fdb96d9[commit] * po: update Marathi translation timestamp https://pagure.io/freeipa/c/28a963eed0f27c214543b02fc34e15182e6fcc04[commit] * po: update Kannada translation timestamp https://pagure.io/freeipa/c/89b048d1408834dde38321ac4f402083ebd30247[commit] * po: update Japanese translation timestamp https://pagure.io/freeipa/c/89dbf88abb108cad7f44f92b4e94e66f21746cd3[commit] * po: update Indonesian translation timestamp https://pagure.io/freeipa/c/124a563eb64d7f9a2190a13e9d68a7b608be2d22[commit] * po: update Hungarian translation timestamp https://pagure.io/freeipa/c/595d5062b9e770a946156f69df2fe522d4745d9e[commit] * po: update Hindi translation timestamp https://pagure.io/freeipa/c/c4dd8b226ae97011bcc0546209f8473fbcd75ab8[commit] * po: update French translation https://pagure.io/freeipa/c/a2ca393d35a1f34b2dbbd54c9c1d24b9f20960f0[commit] * po: update Basque translation timestamp https://pagure.io/freeipa/c/92fb5c5268b8b1b02b7a1d12b9a6417c893a18f1[commit] * po: update Spanish translation https://pagure.io/freeipa/c/7af52df7a8e54afe36649c5436fcfce759111751[commit] * po: update English (United Kingdom) translation timestamp https://pagure.io/freeipa/c/37a1e927a1f123b8b9fdbaf815003cb04726f72c[commit] * po: update German translation https://pagure.io/freeipa/c/0d053d8b1df33f5602ae0e154743f1d1dce2c72d[commit] * po: update Czech translation timestamp https://pagure.io/freeipa/c/c8ba436c0dad467bf12dec4d4f141916d0b3fbbd[commit] * po: update Catalan translation timestamp https://pagure.io/freeipa/c/29e3ade05c8bea23c07ed1a1b5612af01f924d2d[commit] * po: update Bengali translation timestamp https://pagure.io/freeipa/c/16d9556c6f3d19f73256d6698a7659f78961a378[commit] * po: update ipa.pot template https://pagure.io/freeipa/c/e23ba779d3aefd871e348b91e7b0fa003d97c96e[commit] * Update translation infrastructure https://pagure.io/freeipa/c/831f4dd320a93d01df6b06058c3ab618a98c9fd8[commit] https://pagure.io/freeipa/issue/8159[#8159] * Keep ipa.pot translation file in git for weblate https://pagure.io/freeipa/c/9ff7b4a411d13ca148d2f53603dbcc812d92380a[commit] https://pagure.io/freeipa/issue/8159[#8159] * Prevent adding IPA objects as external members of external groups https://pagure.io/freeipa/c/127b8d9cf23bf65aa42e6ee9ed8d7f8628bbac19[commit] https://pagure.io/freeipa/issue/8236[#8236] === Christian Heimes (5) * po: fix LINGUAS to use whitespace separation https://pagure.io/freeipa/c/616ad399c99292542638e9e8f0995873e5c4f311[commit] https://pagure.io/freeipa/issue/8159[#8159] * SELinux: apache_manage_pid_files for F30 https://pagure.io/freeipa/c/f08ced1b25e14f91526c82610a8219ae8ed898a3[commit] https://pagure.io/freeipa/issue/8241[#8241] * Add pytest OpenSSH transport with password https://pagure.io/freeipa/c/42aa86fadd7a7f2209e05291be9c76a8497998dd[commit] * Move freeipa-selinux dependency to freeipa-common https://pagure.io/freeipa/c/7d525ab4308060435808a311de55a76fb26a28c6[commit] https://pagure.io/freeipa/issue/6891[#6891] * Integrate ipa_custodia policy https://pagure.io/freeipa/c/04cc0450125e3c9e989c3e769a25ba2f1f336060[commit] https://pagure.io/freeipa/issue/6891[#6891] === François Cami (1) * ipatests: test_replica_promotion.py: test KRA on Hidden Replica https://pagure.io/freeipa/c/a692212e3bee36fbccba73ed21f7825381eeade4[commit] https://pagure.io/freeipa/issue/8240[#8240] === Florence Blanc-Renaud (3) * ipatests: wait for SSSD to become online in backup/restore tests https://pagure.io/freeipa/c/ebb3c22ddb998997eb05e7bd4da2157e88b6c8f3[commit] https://pagure.io/freeipa/issue/8228[#8228] * xmlrpc tests: add a test for idview-apply on a master https://pagure.io/freeipa/c/c37a84628601d369f83546085b7e29be8fe11a59[commit] https://pagure.io/freeipa/issue/5662[#5662] * idviews: prevent applying to a master https://pagure.io/freeipa/c/7905891341197cb90faf635cf93ce63ae7a7a38b[commit] https://pagure.io/freeipa/issue/5662[#5662] === Mohammad Rizwan Yusuf (3) * ipatests: Skip test using paramiko when FIPS is enabled https://pagure.io/freeipa/c/45507c1e86b634507fdc21dbb88ea9edd43e4166[commit] * Test if schema-compat-entry-attribute is set https://pagure.io/freeipa/c/3f3fa403a944035cf5531939fe3a2e338da99612[commit] https://pagure.io/freeipa/issue/8193[#8193] * Test if schema-compat-entry-attribute is set https://pagure.io/freeipa/c/210619a98f0d8a042a181bab5891bdd595aa5351[commit] https://pagure.io/freeipa/issue/8193[#8193] === Rob Crittenden (4) * Test that pwpolicy only applied on Kerberos entries https://pagure.io/freeipa/c/b34063e700ac4c65b117705bafb0255c26bca060[commit] * Add ability to change a user password as the Directory Manager https://pagure.io/freeipa/c/840671b1cdc508ea86f8412e6423f00b8c3bf809[commit] * Don't save password history on non-Kerberos accounts https://pagure.io/freeipa/c/8b7bb96b327207284c8c0a45cf2979843482cf48[commit] * Test that ipa-healthcheck human output translates error strings https://pagure.io/freeipa/c/7974ac9f8c7969df85f689d94f5b30c18e661daa[commit] === Stanislav Levin (1) * pki-proxy: Don't rely on running apache until it's configured https://pagure.io/freeipa/c/24c6ea3c9f2df757b3d714044c16083716e377ca[commit] https://pagure.io/freeipa/issue/8233[#8233] === Sergey Orlov (2) * ipatests: provide AD admin password when trying to establish trust https://pagure.io/freeipa/c/814b47e85c87bc3c80c91ebd0aa9085ac06b521e[commit] https://pagure.io/freeipa/issue/7895[#7895] * ipatests: remove test_ordering https://pagure.io/freeipa/c/0e9b020db201ff5797f0dabff05c3fc16a9bf79a[commit] === Serhii Tsymbaliuk (1) * Web UI: Upgrade Bootstrap version 3.3.7 -> 3.4.1 https://pagure.io/freeipa/c/f1855dd51e1544a77f1b4a3d4c90f173c29fbed4[commit] https://pagure.io/freeipa/issue/8239[#8239] === sumenon (1) * ipatests: Added testcase to check logrotate is added for healthcheck tool https://pagure.io/freeipa/c/7d4687926e9866c378db8075dd7b55b3c40e71a9[commit] === Vit Mojzis (1) * selinux: disable ipa_custodia when installing custom policy https://pagure.io/freeipa/c/f99cfa1443dfa33422eb4a7613d3dd9e921ccacd[commit] https://pagure.io/freeipa/issue/6891[#6891] -- / Alexander Bokovoy Sr. Principal Software Engineer Security / Identity Management Engineering Red Hat Limited, Finland

1 1

Allow AD users to manage FreeIPA
by White, David 27 Mar '20

27 Mar '20

I'm reviewing the documentation at https://www.freeipa.org/page/V4/Allow_AD_users_to_manage_FreeIPA, as I am hoping to allow members of certain AD groups to login to FreeIPA from the web GUI. Does this documentation only apply to the FreeIPA CLI, or does it also affect access to manage through the web GUI? Let's say we have an AD group named "engineers", and I want those engineers to have admin access over FreeIPA. If the above documentation only affects the CLI, that feels a little bit redundant, because we can of course easily create Sudo / Su rules to allow members of "engineers" to have control over the FreeIPA nodes using HBAC rules and such. (This is already done and working -- members of `engineers` already have CLI admin access over FreeIPA -- I now want them to have GUI admin access). I'm also a little bit confused why the documentation says to add a domain user to the AD "administrators" group (as an ID Override). That feels like a security risk, because I don't want the user to be considered an Active Directory administrator -- I only want the person (well, any members of the `engineers` group) to have admin access over FreeIPA. It sounds like this would have to be done on a user-by-user basis (and is not something we could apply to an entire AD group that already exists)? I ran: `id administrator(a)ad.domain.com` and verified that I do have stdout. But then I ran: `ipa group-show administrator(a)ad.domain.com` and stdout included: ipa: ERROR: administrator(a)ad.domain.com: group not found Is there any way to accomplish what I want? ----- David White Engineer II, Fiber Systems Engineering

3 8

Replaced IPA server - now cannot ssh to it from ipa clients
by Russ Long 27 Mar '20

27 Mar '20

In my homelab, where I only have a single IPA server, I have had to rebuild / replace it due to issues outside of IPA. I was unable to restore the VM from a snapshot, however I was able to rebuild and use a backup created by ipa-backup to perform a restore. Everything appeared to work fine, and IPA clients are working, as well as LDAP and other services. The only issue I'm encountering is that when I try to ssh to the IPA server from one of the clients, SSH hangs here: $ ssh -vvvvv master OpenSSH_8.1p1, OpenSSL 1.1.1d FIPS 10 Sep 2019 debug1: Reading configuration data /etc/ssh/ssh_config debug3: /etc/ssh/ssh_config line 51: Including file /etc/ssh/ssh_config.d/05-redhat.conf depth 0 debug1: Reading configuration data /etc/ssh/ssh_config.d/05-redhat.conf debug2: checking match for 'final all' host master originally master debug3: /etc/ssh/ssh_config.d/05-redhat.conf line 3: not matched 'final' debug2: match not found debug3: /etc/ssh/ssh_config.d/05-redhat.conf line 5: Including file /etc/crypto-policies/back-ends/openssh.config depth 1 (parse only) debug1: Reading configuration data /etc/crypto-policies/back-ends/openssh.config debug3: gss kex names ok: [gss-gex-sha1-,gss-group14-sha1-,gss-group1-sha1-] debug3: kex names ok: [curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1] debug1: configuration requests final Match pass debug1: re-parsing configuration debug1: Reading configuration data /etc/ssh/ssh_config debug3: /etc/ssh/ssh_config line 51: Including file /etc/ssh/ssh_config.d/05-redhat.conf depth 0 debug1: Reading configuration data /etc/ssh/ssh_config.d/05-redhat.conf debug2: checking match for 'final all' host master originally master debug3: /etc/ssh/ssh_config.d/05-redhat.conf line 3: matched 'final' debug2: match found debug3: /etc/ssh/ssh_config.d/05-redhat.conf line 5: Including file /etc/crypto-policies/back-ends/openssh.config depth 1 debug1: Reading configuration data /etc/crypto-policies/back-ends/openssh.config debug3: gss kex names ok: [gss-gex-sha1-,gss-group14-sha1-,gss-group1-sha1-] debug3: kex names ok: [curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1] debug1: Executing proxy command: exec /usr/bin/sss_ssh_knownhostsproxy -p 22 master debug1: identity file /home/rlong/.ssh/id_rsa type -1 debug1: identity file /home/rlong/.ssh/id_rsa-cert type -1 debug1: identity file /home/rlong/.ssh/id_dsa type -1 debug1: identity file /home/rlong/.ssh/id_dsa-cert type -1 debug1: identity file /home/rlong/.ssh/id_ecdsa type -1 debug1: identity file /home/rlong/.ssh/id_ecdsa-cert type -1 debug1: identity file /home/rlong/.ssh/id_ed25519 type -1 debug1: identity file /home/rlong/.ssh/id_ed25519-cert type -1 debug1: identity file /home/rlong/.ssh/id_xmss type -1 debug1: identity file /home/rlong/.ssh/id_xmss-cert type -1 debug1: Local version string SSH-2.0-OpenSSH_8.1 I'm assuming it has something to do with the knownhostsproxy setup, but I can't find any information on how to confirm that or what to do to resolve it. I am able to ssh to the IPA server from any system that is not enrolled as an IPA client. Any ideas?

2 5

Create accounts for integration
by dmitriys 27 Mar '20

27 Mar '20

Hi! I need create accounts for integrations with different system. I don`t wont use standart accounts. So i tried create system user as discribe here Use a system account, created like this:. # ldapmodify -x -D 'cn=Directory Manager' -W after this command i get Enter LDAP Password: (witch password i need put here ?) ldap_bind: Invalid credentials (49) Where i can find right cn ?

2 1

FreeIPA 4.7.5 released, last release in 4.7 series
by Alexander Bokovoy 27 Mar '20

27 Mar '20

2 1

How Set authentication for ldapsearch
by dmitriys 27 Mar '20

27 Mar '20

Hi! When i use command ldapsearch -h ldap.exemple.com -p 389 -x -b dc=exemple,dc=com -L I get all information about my instance without any authentication How i can set authentication to this action ? When i change port ldapsearch -h ldap.exemple.com -p 636 -x -b dc=exemple,dc=com -L I didnt get any response why is that so ? Thank you!

3 2

Issue with replication freeipa
by dmitriys 26 Mar '20

26 Mar '20

Hi! I try to setup replication. Freeipa version - 4.8.0, API_VERSION: 2.233 I have installed free ipa server and tried connect replica as describe in https://www.freeipa.org/page/V4/Replica_Setup Aftet this command ipa-client-install --domain=example.test --realm=EXAMPLE.TEST --server=ipa-server.example.test i get an error (full log) : [root@ldap-replica1 ~]# cat /var/log/ipaclient-install.log 2020-03-26T14:15:39Z DEBUG Logging to /var/log/ipaclient-install.log 2020-03-26T14:15:39Z DEBUG ipa-client-install was invoked with arguments [] and options: {'unattended': False, 'principal': None, 'prompt_password': False, 'on_master': False, 'ca_cert_files': None, 'force': False, 'configure_firefox': False, 'firefox_dir': None, 'keytab': None, 'mkhomedir': False, 'force_join': False, 'ntp_servers': None, 'ntp_pool': None, 'no_ntp': False, 'force_ntpd': False, 'nisdomain': None, 'no_nisdomain': False, 'ssh_trust_dns': False, 'no_ssh': False, 'no_sshd': False, 'no_sudo': False, 'no_dns_sshfp': False, 'kinit_attempts': None, 'request_cert': False, 'ip_addresses': None, 'all_ip_addresses': False, 'fixed_primary': False, 'permit': False, 'enable_dns_updates': False, 'no_krb5_offline_passwords': False, 'preserve_sssd': False, 'automount_location': None, 'domain_name': 'araxio.tech', 'servers': ['ldap.araxio.tech'], 'realm_name': 'ARAXIO.TECH', 'host_name': None, 'verbose': False, 'quiet': False, 'log_file': None, 'uninstall': False} 2020-03-26T14:15:39Z DEBUG IPA version 4.8.0-13.module_el8.1.0+265+e1e65be4 2020-03-26T14:15:39Z DEBUG Loading Index file from '/var/lib/ipa-client/sysrestore/sysrestore.index' 2020-03-26T14:15:39Z DEBUG Starting external process 2020-03-26T14:15:39Z DEBUG args=['/usr/sbin/selinuxenabled'] 2020-03-26T14:15:39Z DEBUG Process finished, return code=0 2020-03-26T14:15:39Z DEBUG stdout= 2020-03-26T14:15:39Z DEBUG stderr= 2020-03-26T14:15:39Z DEBUG Starting external process 2020-03-26T14:15:39Z DEBUG args=['/bin/systemctl', 'is-enabled', 'ntpd.service'] 2020-03-26T14:15:39Z DEBUG Process finished, return code=1 2020-03-26T14:15:39Z DEBUG stdout= 2020-03-26T14:15:39Z DEBUG stderr=Failed to get unit file state for ntpd.service: No such file or directory 2020-03-26T14:15:39Z DEBUG Starting external process 2020-03-26T14:15:39Z DEBUG args=['/bin/systemctl', 'is-active', 'ntpd.service'] 2020-03-26T14:15:39Z DEBUG Process finished, return code=3 2020-03-26T14:15:39Z DEBUG stdout=inactive 2020-03-26T14:15:39Z DEBUG stderr= 2020-03-26T14:15:39Z DEBUG Deleting invalid keytab: '/etc/krb5.keytab'. 2020-03-26T14:15:39Z DEBUG [IPA Discovery] 2020-03-26T14:15:39Z DEBUG Starting IPA discovery with domain=araxio.tech, servers=['ldap.araxio.tech'], hostname=ldap-replica1.araxio.tech 2020-03-26T14:15:39Z DEBUG Server and domain forced 2020-03-26T14:15:39Z DEBUG [Kerberos realm search] 2020-03-26T14:15:39Z DEBUG Kerberos realm forced 2020-03-26T14:15:39Z DEBUG [LDAP server check] 2020-03-26T14:15:39Z DEBUG Verifying that ldap.araxio.tech (realm ARAXIO.TECH) is an IPA server 2020-03-26T14:15:39Z DEBUG Init LDAP connection to: ldap://ldap.araxio.tech:389 2020-03-26T14:15:40Z DEBUG Search LDAP server for IPA base DN 2020-03-26T14:15:40Z DEBUG Check if naming context 'dc=araxio,dc=tech' is for IPA 2020-03-26T14:15:40Z DEBUG Naming context 'dc=araxio,dc=tech' is a valid IPA context 2020-03-26T14:15:40Z DEBUG Search for (objectClass=krbRealmContainer) in dc=araxio,dc=tech (sub) 2020-03-26T14:15:40Z DEBUG Found: cn=ARAXIO.TECH,cn=kerberos,dc=araxio,dc=tech 2020-03-26T14:15:40Z DEBUG Discovery result: Success; server=ldap.araxio.tech, domain=araxio.tech, kdc=ldap.araxio.tech, basedn=dc=araxio,dc=tech 2020-03-26T14:15:40Z DEBUG Validated servers: ldap.araxio.tech 2020-03-26T14:15:40Z DEBUG will use discovered domain: araxio.tech 2020-03-26T14:15:40Z DEBUG Using servers from command line, disabling DNS discovery 2020-03-26T14:15:40Z DEBUG will use provided server: ldap.araxio.tech 2020-03-26T14:15:40Z INFO Autodiscovery of servers for failover cannot work with this configuration. 2020-03-26T14:15:40Z INFO If you proceed with the installation, services will be configured to always access the discovered server for all operations and will not fail over to other servers in case of failure. 2020-03-26T14:15:41Z DEBUG File "/usr/lib/python3.6/site-packages/ipapython/admintool.py", line 179, in execute return_value = self.run() File "/usr/lib/python3.6/site-packages/ipapython/install/cli.py", line 340, in run return cfgr.run() File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 358, in run self.validate() File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 368, in validate for _nothing in self._validator(): File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 431, in __runner exc_handler(exc_info) File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 455, in _handle_validate_exception self._handle_exception(exc_info) File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 450, in _handle_exception six.reraise(*exc_info) File "/usr/lib/python3.6/site-packages/six.py", line 693, in reraise raise value File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 421, in __runner step() File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 418, in <lambda> step = lambda: next(self.__gen) File "/usr/lib/python3.6/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from six.reraise(*exc_info) File "/usr/lib/python3.6/site-packages/six.py", line 693, in reraise raise value File "/usr/lib/python3.6/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from value = gen.send(prev_value) File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 633, in _configure next(validator) File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 431, in __runner exc_handler(exc_info) File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 455, in _handle_validate_exception self._handle_exception(exc_info) File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 518, in _handle_exception self.__parent._handle_exception(exc_info) File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 450, in _handle_exception six.reraise(*exc_info) File "/usr/lib/python3.6/site-packages/six.py", line 693, in reraise raise value File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 515, in _handle_exception super(ComponentBase, self)._handle_exception(exc_info) File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 450, in _handle_exception six.reraise(*exc_info) File "/usr/lib/python3.6/site-packages/six.py", line 693, in reraise raise value File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 421, in __runner step() File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 418, in <lambda> step = lambda: next(self.__gen) File "/usr/lib/python3.6/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from six.reraise(*exc_info) File "/usr/lib/python3.6/site-packages/six.py", line 693, in reraise raise value File "/usr/lib/python3.6/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from value = gen.send(prev_value) File "/usr/lib/python3.6/site-packages/ipapython/install/common.py", line 65, in _install for unused in self._installer(self.parent): File "/usr/lib/python3.6/site-packages/ipaclient/install/client.py", line 3772, in main install_check(self) File "/usr/lib/python3.6/site-packages/ipaclient/install/client.py", line 2311, in install_check raise ScriptError(rval=CLIENT_INSTALL_ERROR) 2020-03-26T14:15:41Z DEBUG The ipa-client-install command failed, exception: ScriptError: 2020-03-26T14:15:41Z ERROR The ipa-client-install command failed. See /var/log/ipaclient-install.log for more information How i can fix it ?

2 1

Issue with Using 3rd part certificates for HTTP/LDAP
by dmitriys 26 Mar '20

26 Mar '20

Hi! I use freeipa-server 4.7.0~pre1+git20180411-2ubuntu2 on Ubuntu 18.04.4 LTS I installed freeipa-serve in default mode ( ipa-server-install ) Now i try change certificate on Comodo as write in this article https://www.freeipa.org/page/Using_3rd_part_certificates_for_HTTP/LDAP my steps: 1 ipa-cacert-manage -p 'password' -n COMODO -t C,, install addtrustexternalcaroot2.crt Installing CA certificate, please wait CA certificate successfully installed The ipa-cacert-manage command was successful 2 ipa-server-certinstall -w -d /home/xattab/ldap_comodo.key ldap_comodo.pem -vvv get error ipapython.ipautil: DEBUG: stderr= ipapython.ipautil: DEBUG: Starting external process ipapython.ipautil: DEBUG: args=['/usr/bin/certutil', '-d', 'dbm:/tmp/tmpPsRUhs', '-V', '-n', 'CN=ldap.soft2bet.com', '-u', 'V', '-f', '/tmp/tmpPsRUhs/pwdfile.txt'] ipapython.ipautil: DEBUG: Process finished, return code=255 ipapython.ipautil: DEBUG: stdout=certutil: certificate is invalid: Peer's Certificate issuer is not recognized. ipapython.ipautil: DEBUG: stderr= ipapython.admintool: DEBUG: File "/usr/lib/python2.7/dist-packages/ipapython/admintool.py", line 174, in execute return_value = self.run() File "/usr/lib/python2.7/dist-packages/ipaserver/install/ipa_server_certinstall.py", line 113, in run self.install_dirsrv_cert() File "/usr/lib/python2.7/dist-packages/ipaserver/install/ipa_server_certinstall.py", line 139, in install_dirsrv_cert 'restart_dirsrv %s' % serverid) File "/usr/lib/python2.7/dist-packages/ipaserver/install/ipa_server_certinstall.py", line 291, in import_cert self.check_chain(pkcs12_file.name, pin, cdb) File "/usr/lib/python2.7/dist-packages/ipaserver/install/ipa_server_certinstall.py", line 277, in check_chain "to install the CA certificate." % str(e)) ipapython.admintool: DEBUG: The ipa-server-certinstall command failed, exception: ScriptError: Peer's certificate issuer is not trusted (certutil: certificate is invalid: Peer's Certificate issuer is not recognized. ). Please run ipa-cacert-manage install and ipa-certupdate to install the CA certificate. ipapython.admintool: ERROR: Peer's certificate issuer is not trusted (certutil: certificate is invalid: Peer's Certificate issuer is not recognized. ). Please run ipa-cacert-manage install and ipa-certupdate to install the CA certificate. ipapython.admintool: ERROR: The ipa-server-certinstall command failed. How to fix it ? Can anybody help me ))) ?

4 10

Freeipa unicodepwd generator
by LUCAS GUILHERME DIEDRICH 26 Mar '20

26 Mar '20

Hello guys, is there any change for storing the password over freeipa it generate an password with the unicodepwd format? I'm still trying to replicate some users from freeipa to AD, i would like to mantain my Freeipa as the principal manager for users and groups. thanks.

5 9

AD trust external group in the foreman
by Natxo Asenjo 25 Mar '20

25 Mar '20

hi, the foreman can not authenticate using external authentication using the api endpoints, apparently, which is a bit of a bummer. It can do ldap, though, so the question is: can I authenticate AD users using the compat tree in Idm? (rhel 7.7 by the way). -- -- Groeten, natxo

2 2

Script deletion of a host?
by aaronhcarr＠gmail.com 25 Mar '20

25 Mar '20

This may be a bit of a strange scenario. Environment is a compute cluster (running xCAT 2.15) FreeIPA server is running on the cluster master node. FreeIPA clients are installed on all other nodes. Compute nodes, login nodes, storage nodes, GPU nodes, etc. I created a script that installs the client packages and joins the realm after provisioning the OS. That all works great on new hosts. My issue is that compute nodes are reinstalled on occasion. Normally, that is a simple process. Tell the cluster master to mark that host for install. During the next PXE boot, that happens. Problem is, if the node has already been part of the realm, it can't join, so that command fails. If I manually go into FreeIPA server and remove the node while it's reinstalling the OS, then the client script runs fine when that is complete. Is there a way to have a client execute a command to remove it's previous information before joining? Thanks in advance.

2 2

Add new Identity Settings for users Freeipa
by dmitriys 25 Mar '20

25 Mar '20

Good day! I setup integration Freeipa with Jamf. I mapped default user attributes from Identity Settings like: Job Title First name Last name Email In Jamf i have more user attributes (Department, Building). My question is How i can mapping user attributes form Employee Information to attributes in Jamf or maybe i need create new field in Identity Settings

2 1

Fail to login to IPA server after installation with IPA accounts
by Scott Reed 24 Mar '20

24 Mar '20

Hi, I'm running a single server with multiple clients. The OS is Centos 7. When I installed the server, I created the accounts and then installed the clients. Overall, the installations went great, and I checked the clients that I could login with the new accounts that were created. All was going great. Time is synced with the server. When I try to login to the FreeIPA server locally. It fails. I go to the login screen, type in my account name with domain, ex. admin1(a)MY.DOMAIN. It appears to be logging in, it tells me that there were no previous failed logins, etc., but then the screen goes back to the original login screen. No appearance of a failure other than it won't let me login. Any thoughts? What logs should I be looking at? I can still login with the local accounts. Thanks!

3 7

IPA DNS ACL (respond with a different IP depending on the requester)
by Daniel PC 24 Mar '20

24 Mar '20

I would like to configure DNS to respond with a different IP depending on the requester source IP. Bind allow it using ACL. Do you know if it is possible to implement this feature on IPA integrated DNS? thank you

2 2

Re: Getting shell to IdM client via AD credentials takes very long time
by White, David 24 Mar '20

24 Mar '20

> When I ssh, it takes about that long before it even prompts me for my username. > Then it takes a few more seconds to authenticate me after I type in my password. I need to correct myself here. When I SSH, it prompts for a username immediately. When I enter the username, it then takes 15-20+ seconds to prompt for the password. Then it takes a few more seconds before logging me in. From: "White, David via FreeIPA-users" <freeipa-users(a)lists.fedorahosted.org> Reply-To: FreeIPA users list <freeipa-users(a)lists.fedorahosted.org> Date: Tuesday, March 24, 2020 at 11:09 AM To: "freeipa-users(a)lists.fedorahosted.org" <freeipa-users(a)lists.fedorahosted.org> Cc: "White, David" <whitedm(a)epb.net> Subject: [Freeipa-users] Getting shell to IdM client via AD credentials takes very long time We have a large AD environment, which our IdM / FreeIPA servers authenticate users out of. The issue I'm trying to address is that it takes a very long time (upwards of 15-20+ seconds) to get a shell on any IdM client server. Our IdM servers are RHEL 7 boxes, using RHEL repositories: Installed Packages Name : ipa-server Arch : x86_64 Version : 4.6.5 Release : 11.el7_7.4 When I ssh, it takes about that long before it even prompts me for my username. Then it takes a few more seconds to authenticate me after I type in my password. I have worked through the documents at https://jhrozek.wordpress.com/2015/08/19/performance-tuning-sssd-for-large-… and https://access.redhat.com/articles/2133801 (which seem to be mostly word-for-word the same article). I have implemented the recommended settings onto the IdM servers, namely, the following is now in the IdM server's sssd.conf file: [domain/domname] subdomain_inherit = ignore_group_members, ldap_purge_cache_timeout ignore_group_members = True ldap_purge_cache_timeout = 0 This seems to have fixed the delays I noticed whenever I would run "id my-user(a)mydomain.com" from any server enrolled in IdM. The "id" command now seems to be very snappy, and responds almost immediately. However, it still takes the same 15-20 seconds+ to get a shell on an IdM client. Reading the above article(s) on what to do with the client, I'm concerned that the recommended changes won't fix my underlying issue. The articles recommend adding the following to the client's sssd.conf file: [pam] pam_id_timeout = N [domain/domname] krb5_auth_timeout = N I've made the recommended changes to 1 of my clients, but it is still seeing a significant delay. So, the issue I'm trying to address is the time it takes to login. It would seem to me that the above options don't actually address the "time to login" issue. Any additional suggestions on this? _______________________________________________ FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost…

2 1

Getting shell to IdM client via AD credentials takes very long time
by White, David 24 Mar '20

24 Mar '20

We have a large AD environment, which our IdM / FreeIPA servers authenticate users out of. The issue I'm trying to address is that it takes a very long time (upwards of 15-20+ seconds) to get a shell on any IdM client server. Our IdM servers are RHEL 7 boxes, using RHEL repositories: Installed Packages Name : ipa-server Arch : x86_64 Version : 4.6.5 Release : 11.el7_7.4 When I ssh, it takes about that long before it even prompts me for my username. Then it takes a few more seconds to authenticate me after I type in my password. I have worked through the documents at https://jhrozek.wordpress.com/2015/08/19/performance-tuning-sssd-for-large-… and https://access.redhat.com/articles/2133801 (which seem to be mostly word-for-word the same article). I have implemented the recommended settings onto the IdM servers, namely, the following is now in the IdM server's sssd.conf file: [domain/domname] subdomain_inherit = ignore_group_members, ldap_purge_cache_timeout ignore_group_members = True ldap_purge_cache_timeout = 0 This seems to have fixed the delays I noticed whenever I would run "id my-user(a)mydomain.com" from any server enrolled in IdM. The "id" command now seems to be very snappy, and responds almost immediately. However, it still takes the same 15-20 seconds+ to get a shell on an IdM client. Reading the above article(s) on what to do with the client, I'm concerned that the recommended changes won't fix my underlying issue. The articles recommend adding the following to the client's sssd.conf file: [pam] pam_id_timeout = N [domain/domname] krb5_auth_timeout = N I've made the recommended changes to 1 of my clients, but it is still seeing a significant delay. So, the issue I'm trying to address is the time it takes to login. It would seem to me that the above options don't actually address the "time to login" issue. Any additional suggestions on this?

1 0

FreeIPA translations system is moving to Weblate
by Alexander Bokovoy 24 Mar '20

24 Mar '20

Hi, this is mostly a message to all kind people who help us to localize FreeIPA interfaces. Fedora Project decided to switch from Zanata to Weblate for their translation project. This means we are asked to migrate from Zanata server too. As of yesterday, we made the last cut of content from the Zanata server and I submitted an update to FreeIPA that includes those changes. Unfortunately, there were updates in the set of strings translated in FreeIPA itself which made some of the translations invalid and I had to drop them. This effort is tracked in https://pagure.io/freeipa/issue/8159 Pull request with translations is at https://github.com/freeipa/freeipa/pull/4419 Once the pull request accepted, we'll proceed with weblate project setup. I'll send another notification once that is done. More details on how to work with Weblate are available in the original description of https://github.com/freeipa/freeipa/pull/4419 The turnaround of updates should improve. Weblate will be automatically opening a pull request against FreeIPA on github once in a while for a group of edits accepted by the project. So we should see translations coming faster to the upstream tree. -- / Alexander Bokovoy Sr. Principal Software Engineer Security / Identity Management Engineering Red Hat Limited, Finland

1 0

Keycloak with FreeIPA federation / expired Password
by Jonatan Zint 24 Mar '20

24 Mar '20

Hello! I have a simple setup running keycloak 9.0.0 setup with LDAP user federation to my FreeIPA instance (4.8). Runs smooth so far, but everytime a user changes his password in keycloak it is marked expired in FreeIPA and gets prompted to change it once trying to login in FreeIPA. The very same issue popped up in this mail thread: https://www.redhat.com/archives/freeipa-users/2017-January/msg00393.html The answer does not seem to be valid for freeipa 4.8 though, as the described DN doesn't even exist anymore. Searching through the RedHat docs i can see several configuration guides for windows AD password sync but not a mention how to fix it for keycloak.... Any hint what I could try here? Best regards, Jonatan

2 4

Re: Expired Certificates, rolling back time didn't help
by Florence Blanc-Renaud 23 Mar '20

23 Mar '20

On 3/17/20 11:44 AM, Bhavin Vaidya via FreeIPA-users wrote: > Hello Flo, > > thank you for your response. > > [root@srv01 ~]# ipa config-show | grep renewal > IPA CA renewal master: srv01.arteris.com > > We followed following step, but Certificates will not renew. > > Stopped NTP and went back to 2018-05-11 > systemctl restart certmonger.service > > no luck, so we did > > Stopped NTP and went back to 2018-05-11 > systemctl restart certmonger.service > stopped FreeIPA - ipactl stop > Started services manually as per this RedHat doc > <https://access.redhat.com/solutions/3146271>. > getcert list ---- shows either SUBMITTING, CA_UNREACHABLE or > NEED_TO_SUBMIT > Hi, you need to wait a while for certmonger to renew all the certs. As the new output shows, some progress was made: the LDAP certificate was renewed. You can try: getcert resubmit -i 20180315021503 then wait for the RA cert to move to MONITORING and do the same for each cert that needs to be renewed (resubmit, wait for the cert to move to MONITORING, etc...). flo > [root@srv01 ~]# getcert list > > Number of certificates and requests being tracked: 8. > > Request ID '20180228053337': > > status: MONITORING > > stuck: no > > key pair storage: type=FILE,location='/var/kerberos/krb5kdc/kdc.key' > > certificate: type=FILE,location='/var/kerberos/krb5kdc/kdc.crt' > > CA: SelfSign > > issuer: CN=srv01.example.com,O=EXAMPLE.COM > > subject: CN=srv01.example.com,O=EXAMPLE.COM > > expires: 2021-01-11 21:56:57 UTC > > principal name: krbtgt/EXAMPLE.COM(a)EXAMPLE.COM > <mailto:krbtgt/EXAMPLE.COM@EXAMPLE.COM> > > certificate template/profile: KDCs_PKINIT_Certs > > pre-save command: > > post-save command: /usr/libexec/ipa/certmonger/renew_kdc_cert > > track: yes > > auto-renew: yes > > Request ID '20180315021457': > > status: SUBMITTING > > stuck: no > > key pair storage: > type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert > cert-pki-ca',token='NSS Certificate DB',pin set > > certificate: > type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert > cert-pki-ca',token='NSS Certificate DB' > > CA: dogtag-ipa-ca-renew-agent > > issuer: CN=Certificate Authority,O=EXAMPLE.COM > > subject: CN=CA Audit,O=EXAMPLE.COM > > expires: 2020-02-25 04:27:49 UTC > > key usage: digitalSignature,nonRepudiation > > pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad > > post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert > "auditSigningCert cert-pki-ca" > > track: yes > > auto-renew: yes > > Request ID '20180315021500': > > status: SUBMITTING > > stuck: no > > key pair storage: > type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert cert-pki-ca',token='NSS > Certificate DB',pin set > > certificate: > type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert cert-pki-ca',token='NSS > Certificate DB' > > CA: dogtag-ipa-ca-renew-agent > > issuer: CN=Certificate Authority,O=EXAMPLE.COM > > subject: CN=OCSP Subsystem,O=EXAMPLE.COM > > expires: 2020-02-25 04:28:38 UTC > > eku: id-kp-OCSPSigning > > pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad > > post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert > "ocspSigningCert cert-pki-ca" > > track: yes > > auto-renew: yes > > Request ID '20180315021501': > > status: SUBMITTING > > stuck: no > > key pair storage: > type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert > cert-pki-ca',token='NSS Certificate DB',pin set > > certificate: > type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert > cert-pki-ca',token='NSS Certificate DB' > > CA: dogtag-ipa-ca-renew-agent > > issuer: CN=Certificate Authority,O=EXAMPLE.COM > > subject: CN=CA Subsystem,O=EXAMPLE.COM > > expires: 2020-02-25 04:31:47 UTC > > key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment > > eku: id-kp-serverAuth,id-kp-clientAuth > > pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad > > post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert > "subsystemCert cert-pki-ca" > > track: yes > > auto-renew: yes > > Request ID '20180315021502': > > status: MONITORING > > stuck: no > > key pair storage: > type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert > cert-pki-ca',token='NSS Certificate DB',pin set > > certificate: > type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert > cert-pki-ca',token='NSS Certificate DB' > > CA: dogtag-ipa-ca-renew-agent-reuse > > issuer: CN=Certificate Authority,O=EXAMPLE.COM > > subject: CN=Certificate Authority,O=EXAMPLE.COM > > expires: 2038-03-07 03:47:46 UTC > > key usage: digitalSignature,nonRepudiation,keyCertSign,cRLSign > > pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad > > post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert > "caSigningCert cert-pki-ca" > > track: yes > > auto-renew: yes > > Request ID '20180315021503': > > status: CA_UNREACHABLE > > ca-error: Error 28 connecting to > https://srv01.example.com:8443/ca/agent/ca/profileReview: Timeout was > reached. > > stuck: no > > key pair storage: type=FILE,location='/var/lib/ipa/ra-agent.key' > > certificate: type=FILE,location='/var/lib/ipa/ra-agent.pem' > > CA: dogtag-ipa-ca-renew-agent > > issuer: CN=Certificate Authority,O=EXAMPLE.COM > > subject: CN=IPA RA,O=EXAMPLE.COM > > expires: 2018-06-15 23:15:23 UTC > > key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment > > eku: id-kp-serverAuth,id-kp-clientAuth > > pre-save command: /usr/libexec/ipa/certmonger/renew_ra_cert_pre > > post-save command: /usr/libexec/ipa/certmonger/renew_ra_cert > > track: yes > > auto-renew: yes > > Request ID '20180315021505': > > status: MONITORING > > stuck: no > > key pair storage: > type=NSSDB,location='/etc/dirsrv/slapd-EXAMPLE-COM',nickname='Server-Cert',token='NSS > Certificate DB',pinfile='/etc/dirsrv/slapd-EXAMPLE-COM/pwdfile.txt' > > certificate: > type=NSSDB,location='/etc/dirsrv/slapd-EXAMPLE-COM',nickname='Server-Cert',token='NSS > Certificate DB' > > CA: IPA > > issuer: CN=Certificate Authority,O=EXAMPLE.COM > > subject: CN=srv01.example.com,O=EXAMPLE.COM > > expires: 2020-05-12 01:41:53 UTC > > principal name: ldap/srv01.example.com(a)EXAMPLE.COM > <mailto:ldap/srv01.example.com@EXAMPLE.COM> > > key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment > > eku: id-kp-serverAuth,id-kp-clientAuth > > pre-save command: > > post-save command: /usr/libexec/ipa/certmonger/restart_dirsrv EXAMPLE-COM > > track: yes > > auto-renew: yes > > Request ID '20180315021510': > > status: NEED_TO_SUBMIT > > ca-error: Server at https://srv01.example.com/ipa/xmlfailed request, > will retry: -504 (libcurl failed to execute the HTTP POST transaction, > explaining:Peer's Certificate has expired.). > > stuck: no > > key pair storage: > type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS > Certificate DB',pinfile='/etc/httpd/alias/pwdfile.txt' > > certificate: > type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS > Certificate DB' > > CA: IPA > > issuer: CN=Certificate Authority,O=EXAMPLE.COM > > subject: CN=srv01.example.com,O=EXAMPLE.COM > > expires: 2020-03-07 08:49:51 UTC > > principal name: HTTP/srv01.example.com(a)EXAMPLE.COM > <mailto:HTTP/srv01.example.com@EXAMPLE.COM> > > key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment > > eku: id-kp-serverAuth,id-kp-clientAuth > > pre-save command: > > post-save command: /usr/libexec/ipa/certmonger/restart_httpd > > track: yes > > auto-renew: yes > > > > Thank you and with regards, > Bhavin > > > > ------------------------------------------------------------------------ > *From:* Florence Blanc-Renaud <flo(a)redhat.com> > *Sent:* Tuesday, March 17, 2020 1:17 AM > *To:* FreeIPA users list <freeipa-users(a)lists.fedorahosted.org> > *Cc:* Bhavin Vaidya <bvaidya(a)hotmail.com> > *Subject:* Re: [Freeipa-users] Expired Certificates, rolling back time > didn't help > On 3/16/20 11:44 PM, Bhavin Vaidya via FreeIPA-users wrote: >> Hello, >> >> We had similar issue 2 yrs back, and resurface as it didn't auto-renew. >> Went back in time to 2016-06-11 as well as 2020-02-20, restarted >> "certmonger", didn't update. >> > Hi, > > you need to check first which server is your renewal master: > > $ kinit admin > > $ ipa config-show | grep renewal > > > The output should display the name of the renewal master. This host is > the first server that needs to be fixed. > > > In the getcert list output that you provided, we can see that: > > - the PKI certificates shared between the servers expired on 2020-02-25 > (auditSigningCert cert-pki-ca, ocspSigningCert cert-pki-ca, > subsystemCert cert-ki-ca) > > - the CA cert is still valid > > - the RA cert expired on 2018-06-15 > > - the HTTP and LDAP server certs expired on 2020-03-07 > > > You need to carefully pick the date you go back in time: at that given > date, all the certs must be valid (not expired yet but *already valid*). > From your output, the date needs to be before 2018-06-15 but after > 2018-03-08 (=the validFrom date for the PKI certs). > > > HTH, > > flo > >> FreeIPA Master:*CentOS 7.4.1708, FreeIPA Version: **4.5.0, >> API_VERSION: 2.228* >> >> whileipactl start, it will not start pki-tomcat with >> message,pki-tomcatd Service: STOPPED. >> >> Referring toRob's blog >> <https://rcritten.wordpress.com/2017/09/20/peer-certificate-cannot-be-authen…> >> >> [root@srv01 ~]# curl --cacert /etc/ipa/ca.crt >> -v[https://%60hostname%60:8443/ca/ww/ca/getCertChain]https://`hostname`:8443/ca/ww/ca/getCertChain >> >> * About to connect() to srv01.example.com port 8443 (#0) >> >> *Trying 192.168.10.146... >> >> * Connected to srv01.example.com (192.168.10.146) port 8443 (#0) >> >> * Initializing NSS with certpath: sql:/etc/pki/nssdb >> >> *CAfile: /etc/ipa/ca.crt >> >> CApath: none >> >> * Server certificate: >> >> *subject: CN=srv01.example.com,O=EXAMPLE.COM >> >> *start date: Dec 26 21:02:44 2016 GMT >> >> *expire date: Dec 16 21:02:44 2018 GMT >> >> *common name: srv01.example.com >> >> *issuer: CN=Certificate Authority,O=EXAMPLE.COM >> >> * NSS error -8172 (SEC_ERROR_UNTRUSTED_ISSUER) >> >> * Peer's certificate issuer has been marked as not trusted by the user. >> >> * Closing connection 0 >> >> curl: (60) Peer's certificate issuer has been marked as not trusted by >> the user. >> >> More details here:http://curl.haxx.se/docs/sslcerts.html >> >> curl performs SSL certificate verification by default, using a "bundle" >> >> of Certificate Authority (CA) public keys (CA certs). If the >> defaultbundle file isn't adequate, you can specify an alternate >> fileusing the --cacert option. >> >> If this HTTPS server uses a certificate signed by a CA represented >> inthe bundle, the certificate verification probably failed due to >> aproblem with the certificate (it might be expired, or the name >> mightnot match the domain name in the URL). >> >> If you'd like to turn off curl's verification of the certificate, >> usethe -k (or --insecure) option. >> >> >> While, CA cert check asper >> <https://www.freeipa.org/page/V4/CA_certificate_renewal>, >> >> [root@srv01 ~]# getcert list -d /etc/pki/pki-tomcat/alias -n >> 'caSigningCert cert-pki-ca' >> >> Number of certificates and requests being tracked: 8. >> >> Request ID '20180315021502': >> >> status: MONITORING >> >> stuck: no >> >> key pair storage: >> type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert cert-pki-ca',token='NSS >> Certificate DB',pin set >> >> certificate: >> type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert cert-pki-ca',token='NSS >> Certificate DB' >> >> CA: dogtag-ipa-ca-renew-agent >> >> issuer: CN=Certificate Authority,O=EXAMPLE.COM >> >> subject: CN=Certificate Authority,O=EXAMPLE.COM >> >> expires: 2038-03-07 03:47:46 UTC >> >> key usage: digitalSignature,nonRepudiation,keyCertSign,cRLSign >> >> pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad >> >> post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert >> "caSigningCert cert-pki-ca" >> >> track: yes >> >> auto-renew: yes >> >> We also have few others certificates, which are not renewed. >> >> >> [root@srv01 ~]# getcert list >> >> Number of certificates and requests being tracked: 8. >> >> Request ID '20180228053337': >> >> status: MONITORING >> >> stuck: no >> >> key pair storage: type=FILE,location='/var/kerberos/krb5kdc/kdc.key' >> >> certificate: type=FILE,location='/var/kerberos/krb5kdc/kdc.crt' >> >> CA: SelfSign >> >> issuer: CN=srv01.example.com,O=EXAMPLE.COM >> >> subject: CN=srv01.example.com,O=EXAMPLE.COM >> >> expires: 2021-01-11 21:56:57 UTC >> >> principal name:krbtgt/EXAMPLE.COM@EXAMPLE.COM >> <mailto:krbtgt/EXAMPLE.COM@EXAMPLE.COM> >> >> certificate template/profile: KDCs_PKINIT_Certs >> >> pre-save command: >> >> post-save command: /usr/libexec/ipa/certmonger/renew_kdc_cert >> >> track: yes >> >> auto-renew: yes >> >> Request ID '20180315021457': >> >> status: MONITORING >> >> stuck: no >> >> key pair storage: >> type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert >> cert-pki-ca',token='NSS Certificate DB',pin set >> >> certificate: >> type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert >> cert-pki-ca',token='NSS Certificate DB' >> >> CA: dogtag-ipa-ca-renew-agent >> >> issuer: CN=Certificate Authority,O=EXAMPLE.COM >> >> subject: CN=CA Audit,O=EXAMPLE.COM >> >> expires: 2020-02-25 04:27:49 UTC >> >> key usage: digitalSignature,nonRepudiation >> >> pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad >> >> post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert >> "auditSigningCert cert-pki-ca" >> >> track: yes >> >> auto-renew: yes >> >> Request ID '20180315021500': >> >> status: MONITORING >> >> stuck: no >> >> key pair storage: >> type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert >> cert-pki-ca',token='NSS Certificate DB',pin set >> >> certificate: >> type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert >> cert-pki-ca',token='NSS Certificate DB' >> >> CA: dogtag-ipa-ca-renew-agent >> >> issuer: CN=Certificate Authority,O=EXAMPLE.COM >> >> subject: CN=OCSP Subsystem,O=EXAMPLE.COM >> >> expires: 2020-02-25 04:28:38 UTC >> >> eku: id-kp-OCSPSigning >> >> pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad >> >> post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert >> "ocspSigningCert cert-pki-ca" >> >> track: yes >> >> auto-renew: yes >> >> Request ID '20180315021501': >> >> status: MONITORING >> >> stuck: no >> >> key pair storage: >> type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert cert-pki-ca',token='NSS >> Certificate DB',pin set >> >> certificate: >> type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert cert-pki-ca',token='NSS >> Certificate DB' >> >> CA: dogtag-ipa-ca-renew-agent >> >> issuer: CN=Certificate Authority,O=EXAMPLE.COM >> >> subject: CN=CA Subsystem,O=EXAMPLE.COM >> >> expires: 2020-02-25 04:31:47 UTC >> >> key usage: >> digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment >> >> eku: id-kp-serverAuth,id-kp-clientAuth >> >> pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad >> >> post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert >> "subsystemCert cert-pki-ca" >> >> track: yes >> >> auto-renew: yes >> >> Request ID '20180315021502': >> >> status: MONITORING >> >> stuck: no >> >> key pair storage: >> type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert cert-pki-ca',token='NSS >> Certificate DB',pin set >> >> certificate: >> type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert cert-pki-ca',token='NSS >> Certificate DB' >> >> CA: dogtag-ipa-ca-renew-agent >> >> issuer: CN=Certificate Authority,O=EXAMPLE.COM >> >> subject: CN=Certificate Authority,O=EXAMPLE.COM >> >> expires: 2038-03-07 03:47:46 UTC >> >> key usage: digitalSignature,nonRepudiation,keyCertSign,cRLSign >> >> pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad >> >> post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert >> "caSigningCert cert-pki-ca" >> >> track: yes >> >> auto-renew: yes >> >> Request ID '20180315021503': >> >> status: CA_UNREACHABLE >> >> ca-error: Error 60 connecting >> tohttps://srv01.example.com:8443/ca/agent/ca/profileReview: Peer >> certificate cannot be authenticated with given CA certificates. >> >> stuck: no >> >> key pair storage: type=FILE,location='/var/lib/ipa/ra-agent.key' >> >> certificate: type=FILE,location='/var/lib/ipa/ra-agent.pem' >> >> CA: dogtag-ipa-ca-renew-agent >> >> issuer: CN=Certificate Authority,O=EXAMPLE.COM >> >> subject: CN=IPA RA,O=EXAMPLE.COM >> >> expires: 2018-06-15 23:15:23 UTC >> >> key usage: >> digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment >> >> eku: id-kp-serverAuth,id-kp-clientAuth >> >> pre-save command: /usr/libexec/ipa/certmonger/renew_ra_cert_pre >> >> post-save command: /usr/libexec/ipa/certmonger/renew_ra_cert >> >> track: yes >> >> auto-renew: yes >> >> Request ID '20180315021505': >> >> status: CA_UNREACHABLE >> >> ca-error: Server athttps://srv01.example.com/ipa/xmlfailed request, >> will retry: 4016 (RPC failed at server.Failed to authenticate to CA >> REST API). >> >> stuck: no >> >> key pair storage: >> type=NSSDB,location='/etc/dirsrv/slapd-EXAMPLE-COM',nickname='Server-Cert',token='NSS >> Certificate DB',pinfile='/etc/dirsrv/slapd-EXAMPLE-COM/pwd >> >> file.txt' >> >> certificate: >> type=NSSDB,location='/etc/dirsrv/slapd-EXAMPLE-COM',nickname='Server-Cert',token='NSS >> Certificate DB' >> >> CA: IPA >> >> issuer: CN=Certificate Authority,O=EXAMPLE.COM >> >> subject: CN=srv01.example.com,O=EXAMPLE.COM >> >> expires: 2020-03-07 08:49:36 UTC >> >> principal name:ldap/srv01.example.com@EXAMPLE.COM >> <mailto:ldap/srv01.example.com@EXAMPLE.COM> >> >> key usage: >> digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment >> >> eku: id-kp-serverAuth,id-kp-clientAuth >> >> pre-save command: >> >> post-save command: /usr/libexec/ipa/certmonger/restart_dirsrv EXAMPLE-COM >> >> track: yes >> >> auto-renew: yes >> >> Request ID '20180315021510': >> >> status: CA_UNREACHABLE >> >> ca-error: Server athttps://srv01.example.com/ipa/xmlfailed request, >> will retry: 4016 (RPC failed at server.Failed to authenticate to CA >> REST API). >> >> stuck: no >> >> key pair storage: >> type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS >> Certificate DB',pinfile='/etc/httpd/alias/pwdfile.txt' >> >> certificate: >> type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS >> Certificate DB' >> >> CA: IPA >> >> issuer: CN=Certificate Authority,O=EXAMPLE.COM >> >> subject: CN=srv01.example.com,O=EXAMPLE.COM >> >> expires: 2020-03-07 08:49:51 UTC >> >> principal name:HTTP/srv01.example.com@EXAMPLE.COM >> <mailto:HTTP/srv01.example.com@EXAMPLE.COM> >> >> key usage: >> digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment >> >> eku: id-kp-serverAuth,id-kp-clientAuth >> >> pre-save command: >> >> post-save command: /usr/libexec/ipa/certmonger/restart_httpd >> >> track: yes >> >> auto-renew: yes >> >> >> thank you for your help. >> Bhavin >> >> >> >> _______________________________________________ >> FreeIPA-users mailing list --freeipa-users(a)lists.fedorahosted.org <mailto:freeipa-users@lists.fedorahosted.org> >> To unsubscribe send an email tofreeipa-users-leave(a)lists.fedorahosted.org <mailto:freeipa-users-leave@lists.fedorahosted.org> >> Fedora Code of Conduct:https://docs.fedoraproject.org/en-US/project/code-of-conduct/ >> List Guidelines:https://fedoraproject.org/wiki/Mailing_list_guidelines >> List Archives:https://lists.fedorahosted.org/archives/list/freeipa-users@lists.f… > > > > _______________________________________________ > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org > To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org > Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost… >

2 1

Re: External & Letsencrypt Certificate | Failed on IPA update.
by Florence Blanc-Renaud 23 Mar '20

23 Mar '20

On 3/23/20 10:47 AM, Faraz Younus wrote: > Yes that worked i removed the old ca then it worked Glad to see your issue was solved, thanks for the confirmation. flo > > On Mon, Mar 23, 2020 at 2:28 PM Florence Blanc-Renaud <flo(a)redhat.com > <mailto:flo@redhat.com>> wrote: > > On 3/19/20 12:51 PM, Faraz Younus via FreeIPA-users wrote: > > Thanks for the swift response Flo > > I dont have any certificate in /etc/pki/nssdb but i have ca > certificate > > in /etc/ipa/ca.crt > > > If /etc/ipa/ca.crt contains the old cert, you can remove the file. > ipa-client-install will get the CA cert from the server during the > installation. > > flo > > certutil -L -d /etc/pki/nssdb > > > > > > Certificate Nickname Trust Attributes > > > > SSL,S/MIME,JAR/XPI > > > > > > On Thu, Mar 19, 2020 at 4:46 PM Florence Blanc-Renaud > <flo(a)redhat.com <mailto:flo@redhat.com> > > <mailto:flo@redhat.com <mailto:flo@redhat.com>>> wrote: > > > > On 3/19/20 11:29 AM, Faraz Younus via FreeIPA-users wrote: > > > Thanks now we decided to go with self signed certificate. > > > currently i'm migrating my old ipa-client to new ipa > server but > > getting > > > below error while I allowed all ports on ipaserver. > > > > > > My IPA client version is 3.0 and my latest version is 4.6 > & IPA > > > NUM_VERSION for client is 300 while on new freeipa 40605. > > > > > > **ipa-client-install --password 'abc123' --domain > > fixedandmobile.com <http://fixedandmobile.com> > <http://fixedandmobile.com> > > > <http://fixedandmobile.com> --server > ipa1.fixedandmobile.com <http://ipa1.fixedandmobile.com> > > <http://ipa1.fixedandmobile.com> > > > <http://ipa1.fixedandmobile.com> --unattended --force-join > > > > > > LDAP Error: Connect error: TLS error -8054:You are > attempting to > > import > > > a cert with the same issuer/serial as an existing cert, > but that > > is not > > > the same cert. > > > > > Hi, > > > > you need to check the content of /etc/pki/nssdb and > /etc/http/alias and > > remove the previous CA certificate. The client installer is > adding the > > CA cert in this database but if you already have a cert with > the same > > subject/issuer/serial it will complain. > > For instance: > > $ certutil -L -d /etc/pki/nssdb > > > > If needed, remove the existing cert with: > > $ certutil -D -n <nickname> -d /etc/pki/nssdb > > > > HTH, > > flo > > > > > LDAP Error: Connect error: TLS error -8054:You are > attempting to > > import > > > a cert with the same issuer/serial as an existing cert, > but that > > is not > > > the same cert. > > > > > > Failed to verify that ipa1.fixedandmobile.com > <http://ipa1.fixedandmobile.com> > > <http://ipa1.fixedandmobile.com> > > > <http://ipa1.fixedandmobile.com> is an IPA Server. > > > > > > This may mean that the remote server is not up or is not > > reachable due > > > to network or firewall settings. > > > > > > Please make sure the following ports are opened in the > firewall > > settings: > > > > > > TCP: 80, 88, 389 > > > > > > UDP: 88 (at least one of TCP/UDP ports 88 has to be open) > > > > > > Also note that following ports are necessary for > ipa-client working > > > properly after enrollment: > > > > > > TCP: 464 > > > > > > UDP: 464, 123 (if NTP enabled) > > > > > > Installation failed. Rolling back changes. > > > > > > IPA client is not configured on this system. > > > > > > > > > On Mon, Mar 16, 2020 at 8:16 PM Rob Crittenden > > <rcritten(a)redhat.com <mailto:rcritten@redhat.com> > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com>> > > > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com> > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com>>>> wrote: > > > > > > Faraz Younus via FreeIPA-users wrote: > > > > The fix you suggested is started the LDAP service > but it > > got down two > > > > services Krb5kdc & kadmin > > > > > > You'll need to look at /var/log/krb5kdc.log to > determine why > > it failed > > > to start. > > > > > > OR maybe systemctl status krb5kdc will be enlightening. > > > > > > rob > > > > > > > > > > > [root@sg ansible]# ipactl restart > --ignore-service-failure > > > > > > > > Starting Directory Service > > > > > > > > Starting krb5kdc Service > > > > > > > > Failed to start krb5kdc Service > > > > > > > > Forced start, ignoring krb5kdc Service, continuing > normal > > operation > > > > > > > > Starting kadmin Service > > > > > > > > Failed to start kadmin Service > > > > > > > > Forced start, ignoring kadmin Service, continuing > normal > > operation > > > > > > > > Starting httpd Service > > > > > > > > Starting ipa-custodia Service > > > > > > > > Starting ntpd Service > > > > > > > > Starting pki-tomcatd Service > > > > > > > > Starting ipa-otpd Service > > > > > > > > ipa: INFO: The ipactl command was successful > > > > > > > > > > > > On Mon, Mar 16, 2020 at 2:27 AM Faraz Younus > > <farazby(a)gmail.com <mailto:farazby@gmail.com> > <mailto:farazby@gmail.com <mailto:farazby@gmail.com>> > > > <mailto:farazby@gmail.com <mailto:farazby@gmail.com> > <mailto:farazby@gmail.com <mailto:farazby@gmail.com>>> > > > > <mailto:farazby@gmail.com > <mailto:farazby@gmail.com> <mailto:farazby@gmail.com > <mailto:farazby@gmail.com>> > > <mailto:farazby@gmail.com <mailto:farazby@gmail.com> > <mailto:farazby@gmail.com <mailto:farazby@gmail.com>>>>> wrote: > > > > > > > > I'll try to add this suggested config and > restart ipactl > > > > > > > > But as per you it should not have been the case > to install > > > client on > > > > master why is that ? > > > > > > > > The procedure which I'm following I'm setting > master > > server with > > > > setup ca self signed then after that I'm > replacing self > > > signed with > > > > external certificate, is this the right way? > > > > > > > > > > > > > > > > On Mon, Mar 16, 2020, 2:18 AM Rob Crittenden > > > <rcritten(a)redhat.com <mailto:rcritten@redhat.com> > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com>> > > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com> > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com>>> > > > > <mailto:rcritten@redhat.com > <mailto:rcritten@redhat.com> > > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com>> > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com> > > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com>>>>> > wrote: > > > > > > > > Faraz Younus via FreeIPA-users wrote: > > > > > no I did not modify the file , this is > from ipa > > master > > > server, > > > > i also > > > > > installed ipa client on master bcoz i was > > getting sssd > > > no cache > > > > > credentials error, when i install client on > > master it fixed > > > > that error, > > > > > now I'm getting ldap error after that > sssd error > > > > > > > > It should not have been possible to run > > > ipa-client-install on a > > > > master. > > > > I don't know what you did to force it, or > what the > > full > > > > consequences may > > > > be, but I'd try adding the things that Flo > > suggested to > > > > /etc/ipa/default.conf and restarting httpd > to see > > if it > > > helps. > > > > > > > > ldap_uri = > > > ldapi://%2fvar%2frun%2fslapd-FIXEDANDMOBILE-COM.socket > > > > ra_plugin = dogtag > > > > dogtag_version = 10 > > > > mode = production > > > > > > > > rob > > > > > > > > > > > > > > On Fri, Mar 13, 2020, 7:17 PM Florence > Blanc-Renaud > > > > <flo(a)redhat.com <mailto:flo@redhat.com> > <mailto:flo@redhat.com <mailto:flo@redhat.com>> > > <mailto:flo@redhat.com <mailto:flo@redhat.com> > <mailto:flo@redhat.com <mailto:flo@redhat.com>>> > > > <mailto:flo@redhat.com <mailto:flo@redhat.com> > <mailto:flo@redhat.com <mailto:flo@redhat.com>> > > <mailto:flo@redhat.com <mailto:flo@redhat.com> > <mailto:flo@redhat.com <mailto:flo@redhat.com>>>> > > > > > <mailto:flo@redhat.com > <mailto:flo@redhat.com> <mailto:flo@redhat.com <mailto:flo@redhat.com>> > > <mailto:flo@redhat.com <mailto:flo@redhat.com> > <mailto:flo@redhat.com <mailto:flo@redhat.com>>> > > > <mailto:flo@redhat.com <mailto:flo@redhat.com> > <mailto:flo@redhat.com <mailto:flo@redhat.com>> > > <mailto:flo@redhat.com <mailto:flo@redhat.com> > <mailto:flo@redhat.com <mailto:flo@redhat.com>>>>>> wrote: > > > > > > > > > > On 3/13/20 8:43 AM, Faraz Younus via > > FreeIPA-users > > > wrote: > > > > > > cat /etc/ipa/default.conf > > > > > > > > > > > > #File modified by ipa-client-install > > > > > > > > > > > > > > > > > > [global] > > > > > > > > > > > > basedn = dc=fixedandmobile,dc=com > > > > > > > > > > > > realm = FIXEDANDMOBILE.COM > <http://FIXEDANDMOBILE.COM> > > <http://FIXEDANDMOBILE.COM> > > > <http://FIXEDANDMOBILE.COM> <http://FIXEDANDMOBILE.COM> > > > > <http://FIXEDANDMOBILE.COM> > > > > > <http://FIXEDANDMOBILE.COM> > > > > > > > > > > > > domain = fixedandmobile.com > <http://fixedandmobile.com> > > <http://fixedandmobile.com> > > > <http://fixedandmobile.com> <http://fixedandmobile.com> > > > > <http://fixedandmobile.com> > > > > > <http://fixedandmobile.com> > > > > > > > > > > > > server = sg.fixedandmobile.com > <http://sg.fixedandmobile.com> > > <http://sg.fixedandmobile.com> > > > <http://sg.fixedandmobile.com> > > > > <http://sg.fixedandmobile.com> > > <http://sg.fixedandmobile.com> > > > > > <http://sg.fixedandmobile.com> > > > > > > > > > > > > host = sg.fixedandmobile.com > <http://sg.fixedandmobile.com> > > <http://sg.fixedandmobile.com> > > > <http://sg.fixedandmobile.com> > > > > <http://sg.fixedandmobile.com> > > <http://sg.fixedandmobile.com> > > > > > <http://sg.fixedandmobile.com> > > > > > > > > > > > > xmlrpc_uri = > > https://sg.fixedandmobile.com/ipa/xml > > > > > > > > > > > > enable_ra = True > > > > > > > > > > Hi, > > > > > > > > > > looks like you are trying to run "ipactl > > status" on a > > > > FreeIPA client, > > > > > because on a server I would expect > the file > > to also > > > contain: > > > > > > > > > > ldap_uri = > > > > > ldapi://%2Fvar%2Frun%2Fslapd-FIXEDANDMOBILE-COM.socket > > > > > mode = production > > > > > ra_plugin = dogtag > > > > > dogtag_version = 10 > > > > > > > > > > But on a client, the host and server > values > > would be > > > > different. > > > > > Did you manually modify the file? > > > > > > > > > > flo > > > > > > > > > > > > > > > > > > On Fri, Mar 13, 2020 at 12:02 PM > Florence > > > Blanc-Renaud > > > > > <flo(a)redhat.com > <mailto:flo@redhat.com> <mailto:flo@redhat.com <mailto:flo@redhat.com>> > > <mailto:flo@redhat.com <mailto:flo@redhat.com> > <mailto:flo@redhat.com <mailto:flo@redhat.com>>> > > > <mailto:flo@redhat.com <mailto:flo@redhat.com> > <mailto:flo@redhat.com <mailto:flo@redhat.com>> > > <mailto:flo@redhat.com <mailto:flo@redhat.com> > <mailto:flo@redhat.com <mailto:flo@redhat.com>>>> > > > > <mailto:flo@redhat.com > <mailto:flo@redhat.com> <mailto:flo@redhat.com <mailto:flo@redhat.com>> > > <mailto:flo@redhat.com <mailto:flo@redhat.com> > <mailto:flo@redhat.com <mailto:flo@redhat.com>>> > > > <mailto:flo@redhat.com <mailto:flo@redhat.com> > <mailto:flo@redhat.com <mailto:flo@redhat.com>> > > <mailto:flo@redhat.com <mailto:flo@redhat.com> > <mailto:flo@redhat.com <mailto:flo@redhat.com>>>>> > > > > > > <mailto:flo@redhat.com > <mailto:flo@redhat.com> > > <mailto:flo@redhat.com <mailto:flo@redhat.com>> > <mailto:flo@redhat.com <mailto:flo@redhat.com> > <mailto:flo@redhat.com <mailto:flo@redhat.com>>> > > > <mailto:flo@redhat.com <mailto:flo@redhat.com> > <mailto:flo@redhat.com <mailto:flo@redhat.com>> > > <mailto:flo@redhat.com <mailto:flo@redhat.com> > <mailto:flo@redhat.com <mailto:flo@redhat.com>>>> > > > > <mailto:flo@redhat.com > <mailto:flo@redhat.com> <mailto:flo@redhat.com <mailto:flo@redhat.com>> > > <mailto:flo@redhat.com <mailto:flo@redhat.com> > <mailto:flo@redhat.com <mailto:flo@redhat.com>>> > > > <mailto:flo@redhat.com <mailto:flo@redhat.com> > <mailto:flo@redhat.com <mailto:flo@redhat.com>> > > <mailto:flo@redhat.com <mailto:flo@redhat.com> > <mailto:flo@redhat.com <mailto:flo@redhat.com>>>>>>> wrote: > > > > > > > > > > > > On 3/13/20 6:42 AM, Faraz > Younus via > > > FreeIPA-users > > > > wrote: > > > > > > > I can have the update on > below LDAP > > error ? > > > > > > > > > > > > What is the content of the > > > /etc/ipa/default.conf file? > > > > > Especially, is > > > > > > there a value for "ldap_uri" > and does it > > > start with > > > > "ldap_uri = > > > > > > ldapi://..." ? > > > > > > > > > > > > flo > > > > > > > > > > > > > > On Wed, Mar 11, 2020 at 6:34 PM > > Faraz Younus > > > > > <farazby(a)gmail.com > <mailto:farazby@gmail.com> > > <mailto:farazby@gmail.com <mailto:farazby@gmail.com>> > <mailto:farazby@gmail.com <mailto:farazby@gmail.com> > > <mailto:farazby@gmail.com <mailto:farazby@gmail.com>>> > > > <mailto:farazby@gmail.com <mailto:farazby@gmail.com> > <mailto:farazby@gmail.com <mailto:farazby@gmail.com>> > > <mailto:farazby@gmail.com <mailto:farazby@gmail.com> > <mailto:farazby@gmail.com <mailto:farazby@gmail.com>>>> > > > > <mailto:farazby@gmail.com > <mailto:farazby@gmail.com> > > <mailto:farazby@gmail.com <mailto:farazby@gmail.com>> > <mailto:farazby@gmail.com <mailto:farazby@gmail.com> > > <mailto:farazby@gmail.com <mailto:farazby@gmail.com>>> > > > <mailto:farazby@gmail.com <mailto:farazby@gmail.com> > <mailto:farazby@gmail.com <mailto:farazby@gmail.com>> > > <mailto:farazby@gmail.com <mailto:farazby@gmail.com> > <mailto:farazby@gmail.com <mailto:farazby@gmail.com>>>>> > > > > > > <mailto:farazby@gmail.com > <mailto:farazby@gmail.com> > > <mailto:farazby@gmail.com <mailto:farazby@gmail.com>> > > > <mailto:farazby@gmail.com <mailto:farazby@gmail.com> > <mailto:farazby@gmail.com <mailto:farazby@gmail.com>>> > > <mailto:farazby@gmail.com <mailto:farazby@gmail.com> > <mailto:farazby@gmail.com <mailto:farazby@gmail.com>> > > > <mailto:farazby@gmail.com <mailto:farazby@gmail.com> > <mailto:farazby@gmail.com <mailto:farazby@gmail.com>>>> > > > > <mailto:farazby@gmail.com > <mailto:farazby@gmail.com> > > <mailto:farazby@gmail.com <mailto:farazby@gmail.com>> > <mailto:farazby@gmail.com <mailto:farazby@gmail.com> > > <mailto:farazby@gmail.com <mailto:farazby@gmail.com>>> > > > <mailto:farazby@gmail.com <mailto:farazby@gmail.com> > <mailto:farazby@gmail.com <mailto:farazby@gmail.com>> > > <mailto:farazby@gmail.com <mailto:farazby@gmail.com> > <mailto:farazby@gmail.com <mailto:farazby@gmail.com>>>>>> > > > > > > > <mailto:farazby@gmail.com > <mailto:farazby@gmail.com> > > <mailto:farazby@gmail.com <mailto:farazby@gmail.com>> > > > <mailto:farazby@gmail.com <mailto:farazby@gmail.com> > <mailto:farazby@gmail.com <mailto:farazby@gmail.com>>> > > > > <mailto:farazby@gmail.com > <mailto:farazby@gmail.com> > > <mailto:farazby@gmail.com <mailto:farazby@gmail.com>> > <mailto:farazby@gmail.com <mailto:farazby@gmail.com> > > <mailto:farazby@gmail.com <mailto:farazby@gmail.com>>>> > > > <mailto:farazby@gmail.com <mailto:farazby@gmail.com> > <mailto:farazby@gmail.com <mailto:farazby@gmail.com>> > > <mailto:farazby@gmail.com <mailto:farazby@gmail.com> > <mailto:farazby@gmail.com <mailto:farazby@gmail.com>>> > > > > <mailto:farazby@gmail.com > <mailto:farazby@gmail.com> > > <mailto:farazby@gmail.com <mailto:farazby@gmail.com>> > <mailto:farazby@gmail.com <mailto:farazby@gmail.com> > > <mailto:farazby@gmail.com <mailto:farazby@gmail.com>>>>> > > > > > <mailto:farazby@gmail.com > <mailto:farazby@gmail.com> > > <mailto:farazby@gmail.com <mailto:farazby@gmail.com>> > > > <mailto:farazby@gmail.com <mailto:farazby@gmail.com> > <mailto:farazby@gmail.com <mailto:farazby@gmail.com>>> > > <mailto:farazby@gmail.com <mailto:farazby@gmail.com> > <mailto:farazby@gmail.com <mailto:farazby@gmail.com>> > > > <mailto:farazby@gmail.com <mailto:farazby@gmail.com> > <mailto:farazby@gmail.com <mailto:farazby@gmail.com>>>> > > > > <mailto:farazby@gmail.com > <mailto:farazby@gmail.com> > > <mailto:farazby@gmail.com <mailto:farazby@gmail.com>> > <mailto:farazby@gmail.com <mailto:farazby@gmail.com> > > <mailto:farazby@gmail.com <mailto:farazby@gmail.com>>> > > > <mailto:farazby@gmail.com <mailto:farazby@gmail.com> > <mailto:farazby@gmail.com <mailto:farazby@gmail.com>> > > <mailto:farazby@gmail.com <mailto:farazby@gmail.com> > <mailto:farazby@gmail.com <mailto:farazby@gmail.com>>>>>>>> wrote: > > > > > > > > > > > > > > I have added freeipa > users list > > as well to > > > > this thread > > > > > > > > > > > > > > On Wed, Mar 11, 2020 at > 6:31 PM Rob > > > Crittenden > > > > > > <rcritten(a)redhat.com > <mailto:rcritten@redhat.com> > > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com>> > > > <mailto:rcritten@redhat.com > <mailto:rcritten@redhat.com> <mailto:rcritten@redhat.com > <mailto:rcritten@redhat.com>>> > > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com> > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com>> > > > <mailto:rcritten@redhat.com > <mailto:rcritten@redhat.com> <mailto:rcritten@redhat.com > <mailto:rcritten@redhat.com>>>> > > > > <mailto:rcritten@redhat.com > <mailto:rcritten@redhat.com> > > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com>> > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com> > > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com>>> > > > <mailto:rcritten@redhat.com > <mailto:rcritten@redhat.com> <mailto:rcritten@redhat.com > <mailto:rcritten@redhat.com>> > > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com> > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com>>>>> > > > > > <mailto:rcritten@redhat.com > <mailto:rcritten@redhat.com> > > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com>> > > > <mailto:rcritten@redhat.com > <mailto:rcritten@redhat.com> <mailto:rcritten@redhat.com > <mailto:rcritten@redhat.com>>> > > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com> > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com>> > > > <mailto:rcritten@redhat.com > <mailto:rcritten@redhat.com> <mailto:rcritten@redhat.com > <mailto:rcritten@redhat.com>>>> > > > > <mailto:rcritten@redhat.com > <mailto:rcritten@redhat.com> > > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com>> > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com> > > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com>>> > > > <mailto:rcritten@redhat.com > <mailto:rcritten@redhat.com> <mailto:rcritten@redhat.com > <mailto:rcritten@redhat.com>> > > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com> > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com>>>>>> > > > > > > > > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com> > > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com>> > > > <mailto:rcritten@redhat.com > <mailto:rcritten@redhat.com> <mailto:rcritten@redhat.com > <mailto:rcritten@redhat.com>>> > > > > <mailto:rcritten@redhat.com > <mailto:rcritten@redhat.com> > > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com>> > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com> > > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com>>>> > > > > > <mailto:rcritten@redhat.com > <mailto:rcritten@redhat.com> > > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com>> > > > <mailto:rcritten@redhat.com > <mailto:rcritten@redhat.com> <mailto:rcritten@redhat.com > <mailto:rcritten@redhat.com>>> > > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com> > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com>> > > > <mailto:rcritten@redhat.com > <mailto:rcritten@redhat.com> <mailto:rcritten@redhat.com > <mailto:rcritten@redhat.com>>>>> > > > > <mailto:rcritten@redhat.com > <mailto:rcritten@redhat.com> > > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com>> > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com> > > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com>>> > > > <mailto:rcritten@redhat.com > <mailto:rcritten@redhat.com> <mailto:rcritten@redhat.com > <mailto:rcritten@redhat.com>> > > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com> > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com>>>> > > > > > <mailto:rcritten@redhat.com > <mailto:rcritten@redhat.com> > > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com>> > > > <mailto:rcritten@redhat.com > <mailto:rcritten@redhat.com> <mailto:rcritten@redhat.com > <mailto:rcritten@redhat.com>>> > > > > <mailto:rcritten@redhat.com > <mailto:rcritten@redhat.com> > > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com>> > > > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com> > > <mailto:rcritten@redhat.com > <mailto:rcritten@redhat.com>>>>>>>> wrote: > > > > > > > > > > > > > > Faraz Younus wrote: > > > > > > > > Thanks pasted the > text > > instead of > > > > screenshots. > > > > > > > > > > > > > > This will work. Can you > > post this > > > to the > > > > > freeipa-users list? > > > > > > > > > > > > > > rob > > > > > > > > > > > > > > > > > > > > > > > First failed then > successful > > > but after > > > > that LDAP > > > > > broken. > > > > > > > > > > > > > > > > > > palib.install.certmonger: DEBUG: > > > > certmonger > > > > > request is > > > > > > in state > > > > > > > > > > dbus.String(u'CA_UNREACHABLE', > > > > variant_level=1) > > > > > > > > > > > > > > > > ipapython.admintool: > > DEBUG: File > > > > > > > > > > > > > > > > > "/usr/lib/python2.7/site-packages/ipapython/admintool.py", > > > > > > > line 178, in > > > > > > > > execute > > > > > > > > > > > > > > > > return_value = > > self.run() > > > > > > > > > > > > > > > > File > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > "/usr/lib/python2.7/site-packages/ipaclient/install/ipa_certupdate.py", > > > > > > > > line 62, in run > > > > > > > > > > > > > > > > > run_with_args(api) > > > > > > > > > > > > > > > > File > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > "/usr/lib/python2.7/site-packages/ipaclient/install/ipa_certupdate.py", > > > > > > > > line 112, in > run_with_args > > > > > > > > > > > > > > > > > update_server(certs) > > > > > > > > > > > > > > > > File > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > "/usr/lib/python2.7/site-packages/ipaclient/install/ipa_certupdate.py", > > > > > > > > line 192, in > update_server > > > > > > > > > > > > > > > > "please check the > > request > > > manually" % > > > > > request_id) > > > > > > > > > > > > > > > > > > > > > > > > ipapython.admintool: > > DEBUG: The > > > > ipa-certupdate > > > > > command > > > > > > failed, > > > > > > > > exception: > ScriptError: > > Error > > > resubmitting > > > > > certmonger > > > > > > request > > > > > > > > '20200311065837', > please > > check the > > > > request manually > > > > > > > > > > > > > > > > ipapython.admintool: > > ERROR: Error > > > > resubmitting > > > > > > certmonger request > > > > > > > > '20200311065837', > please > > check the > > > > request manually > > > > > > > > > > > > > > > > ipapython.admintool: > > ERROR: The > > > > ipa-certupdate > > > > > command > > > > > > failed. > > > > > > > > > > > > > > > > [root@sg > ansible]# kinit > > admin > > > > > > > > > > > > > > > > Password for > > > admin(a)FIXEDANDMOBILE.COM <mailto:admin@FIXEDANDMOBILE.COM> > <mailto:admin@FIXEDANDMOBILE.COM <mailto:admin@FIXEDANDMOBILE.COM>> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>> > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>>> > > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>> > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>>>> > > > > > > > <mailto:admin@FIXEDANDMOBILE.COM <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>> > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>>> > > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>> > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>>>>> > > > > > > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>> > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>>> > > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>> > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>>>> > > > > > > > <mailto:admin@FIXEDANDMOBILE.COM <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>> > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>>> > > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>> > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>>>>>> > > > > > > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>> > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>>> > > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>> > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>>>> > > > > > > > <mailto:admin@FIXEDANDMOBILE.COM <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>> > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>>> > > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>> > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>>>>> > > > > > > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>> > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>>> > > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>> > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>>>> > > > > > > > <mailto:admin@FIXEDANDMOBILE.COM <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>> > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>>> > > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>> > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>>>>>>>: > > > �� > > > > > > > > > > > > > > > > > > > > > [root@sg > ansible]# klist -kt > > > > /etc/krb5.keytab > > > > > > > > > > > > > > > > Keytab name: > > FILE:/etc/krb5.keytab > > > > > > > > > > > > > > > > KVNO Timestamp > > Principal > > > > > > > > > > > > > > > > ---- > ----------------- > > > > > > > > > > > > > > > > -------------------------------------------------------- > > > > > > > > > > > > > > > > 3 03/11/20 > 07:15:51 > > > > > > > > > > > > host/sg.fixedandmobile.com(a)FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>> > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>>> > > > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>> > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>>>> > > > > > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>> > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>>> > > > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>> > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>>>>> > > > > > > > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>> > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>>> > > > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>> > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>>>> > > > > > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>> > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>>> > > > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>> > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>>>>>> > > > > > > > > > > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>> > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>>> > > > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>> > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>>>> > > > > > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>> > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>>> > > > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>> > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>>>>> > > > > > > > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>> > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>>> > > > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>> > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>>>> > > > > > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>> > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>>> > > > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>> > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>>>>>>> > > > > > > > > > > > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>> > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>>> > > > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>> > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>>>> > > > > > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>> > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>>> > > > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>> > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>>>>> > > > > > > > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>> > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>>> > > > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>> > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>>>> > > > > > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>> > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>>> > > > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>> > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>>>>>> > > > > > > > > > > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>> > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>>> > > > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>> > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>>>> > > > > > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>> > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>>> > > > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>> > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>>>>> > > > > > > > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>> > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>>> > > > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>> > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>>>> > > > > > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>> > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>>> > > > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>> > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>>>>>>>> > > > > > > > > > > > > > > > > 3 03/11/20 > 07:15:51 > > > > > > > > > > > > host/sg.fixedandmobile.com(a)FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>> > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>>> > > > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>> > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>>>> > > > > > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>> > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>>> > > > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>> > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>>>>> > > > > > > > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>> > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>>> > > > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>> > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>>>> > > > > > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>> > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>>> > > > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>> > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>>>>>> > > > > > > > > > > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>> > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>>> > > > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>> > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>>>> > > > > > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>> > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>>> > > > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>> > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>>>>> > > > > > > > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>> > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>>> > > > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>> > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>>>> > > > > > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>> > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>>> > > > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>> > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>>>>>>> > > > > > > > > > > > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>> > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>>> > > > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>> > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>>>> > > > > > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>> > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>>> > > > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>> > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>>>>> > > > > > > > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>> > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>>> > > > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>> > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>>>> > > > > > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>> > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>>> > > > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>> > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>>>>>> > > > > > > > > > > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>> > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>>> > > > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>> > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>>>> > > > > > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>> > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>>> > > > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>> > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>>>>> > > > > > > > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>> > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>>> > > > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>> > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>>>> > > > > > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>> > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>>> > > > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>> > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>>>>>>>> > > > > > > > > > > > > > > > > [root@sg ansible]# > > > ipa-certupdate -v > > > > > > > > > > > > > > > > ipapython.admintool: > > DEBUG: Not > > > > logging to a file > > > > > > > > > > > > > > > > ipalib.plugable: > DEBUG: > > > importing all > > > > plugin > > > > > modules in > > > > > > > > > > > > ipaclient.remote_plugins.schema$79e69edd... > > > > > > > > > > > > > > > > ipalib.plugable: > DEBUG: > > importing > > > > plugin module > > > > > > > > > > > > > ipaclient.remote_plugins.schema$79e69edd.plugins > > > > > > > > > > > > > > > > ipalib.plugable: > DEBUG: > > > importing all > > > > plugin > > > > > modules in > > > > > > > ipaclient.plugins... > > > > > > > > > > > > > > > > ipalib.plugable: > DEBUG: > > importing > > > > plugin module > > > > > > > > ipaclient.plugins.automember > > > > > > > > > > > > > > > > ipalib.plugable: > DEBUG: > > importing > > > > plugin module > > > > > > > > ipaclient.plugins.automount > > > > > > > > > > > > > > > > ipalib.plugable: > DEBUG: > > importing > > > > plugin module > > > > > > > ipaclient.plugins.ca > <http://ipaclient.plugins.ca> > > <http://ipaclient.plugins.ca> > > > <http://ipaclient.plugins.ca> > > > > <http://ipaclient.plugins.ca> > > <http://ipaclient.plugins.ca> > > > > > <http://ipaclient.plugins.ca> > > > > > > <http://ipaclient.plugins.ca> > > > > > > > > > > <http://ipaclient.plugins.ca> > > > > > > > > > > > > > > > > ipalib.plugable: > DEBUG: > > importing > > > > plugin module > > > > > > > ipaclient.plugins.cert > > > > > > > > > > > > > > > > ipalib.plugable: > DEBUG: > > importing > > > > plugin module > > > > > > > > ipaclient.plugins.certmap > > > > > > > > > > > > > > > > ipalib.plugable: > DEBUG: > > importing > > > > plugin module > > > > > > > > > > ipaclient.plugins.certprofile > > > > > > > > > > > > > > > > ipalib.plugable: > DEBUG: > > importing > > > > plugin module > > > > > > > ipaclient.plugins.csrgen > > > > > > > > > > > > > > > > ipalib.plugable: > DEBUG: > > importing > > > > plugin module > > > > > > > ipaclient.plugins.dns > > > > > > > > > > > > > > > > ipalib.plugable: > DEBUG: > > importing > > > > plugin module > > > > > > > > ipaclient.plugins.hbacrule > > > > > > > > > > > > > > > > ipalib.plugable: > DEBUG: > > importing > > > > plugin module > > > > > > > > ipaclient.plugins.hbactest > > > > > > > > > > > > > > > > ipalib.plugable: > DEBUG: > > importing > > > > plugin module > > > > > > > ipaclient.plugins.host > > > > > > > > > > > > > > > > ipalib.plugable: > DEBUG: > > importing > > > > plugin module > > > > > > > > ipaclient.plugins.idrange > > > > > > > > > > > > > > > > ipalib.plugable: > DEBUG: > > importing > > > > plugin module > > > > > > > > ipaclient.plugins.internal > > > > > > > > > > > > > > > > ipalib.plugable: > DEBUG: > > importing > > > > plugin module > > > > > > > > ipaclient.plugins.location > > > > > > > > > > > > > > > > ipalib.plugable: > DEBUG: > > importing > > > > plugin module > > > > > > > > ipaclient.plugins.migration > > > > > > > > > > > > > > > > ipalib.plugable: > DEBUG: > > importing > > > > plugin module > > > > > > > ipaclient.plugins.misc > > > > > > > > > > > > > > > > ipalib.plugable: > DEBUG: > > importing > > > > plugin module > > > > > > > > ipaclient.plugins.otptoken > > > > > > > > > > > > > > > > ipalib.plugable: > DEBUG: > > importing > > > > plugin module > > > > > > > > > > ipaclient.plugins.otptoken_yubikey > > > > > > > > > > > > > > > > ipalib.plugable: > DEBUG: > > importing > > > > plugin module > > > > > > > ipaclient.plugins.passwd > > > > > > > > > > > > > > > > ipalib.plugable: > DEBUG: > > importing > > > > plugin module > > > > > > > > ipaclient.plugins.permission > > > > > > > > > > > > > > > > ipalib.plugable: > DEBUG: > > importing > > > > plugin module > > > > > > > > ipaclient.plugins.rpcclient > > > > > > > > > > > > > > > > ipalib.plugable: > DEBUG: > > importing > > > > plugin module > > > > > > > ipaclient.plugins.server > > > > > > > > > > > > > > > > ipalib.plugable: > DEBUG: > > importing > > > > plugin module > > > > > > > > ipaclient.plugins.service > > > > > > > > > > > > > > > > ipalib.plugable: > DEBUG: > > importing > > > > plugin module > > > > > > > > ipaclient.plugins.sudorule > > > > > > > > > > > > > > > > ipalib.plugable: > DEBUG: > > importing > > > > plugin module > > > > > > > > ipaclient.plugins.topology > > > > > > > > > > > > > > > > ipalib.plugable: > DEBUG: > > importing > > > > plugin module > > > > > > > ipaclient.plugins.trust > > > > > > > > > > > > > > > > ipalib.plugable: > DEBUG: > > importing > > > > plugin module > > > > > > > ipaclient.plugins.user > > > > > > > > > > > > > > > > ipalib.plugable: > DEBUG: > > importing > > > > plugin module > > > > > > > ipaclient.plugins.vault > > > > > > > > > > > > > > > > ipalib.rpc: DEBUG: > > failed to find > > > > session_cookie in > > > > > > > persistent storage > > > > > > > > for principal > > > > 'admin(a)FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>> <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>>> > > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>> > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>>>> > > > > > > > <mailto:admin@FIXEDANDMOBILE.COM <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>> > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>>> > > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>> > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>>>>> > > > > > > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>> > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>>> > > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>> > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>>>> > > > > > > > <mailto:admin@FIXEDANDMOBILE.COM <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>> > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>>> > > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>> > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>>>>>> > > > > > > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>> > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>>> > > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>> > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>>>> > > > > > > > <mailto:admin@FIXEDANDMOBILE.COM <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>> > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>>> > > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>> > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>>>>> > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>> <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>>> > > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>> > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>>>> > > > > > > > <mailto:admin@FIXEDANDMOBILE.COM <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>> > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>>> > > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>> > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>>>>>>>' > > > > > > > > > > > > > > > > ipalib.rpc: INFO: > trying > > > > > > https://sg.fixedandmobile.com/ipa/json > > > > > > > > > > > > > > > > ipalib.rpc: > DEBUG: New HTTP > > > connection > > > > > > (sg.fixedandmobile.com > <http://sg.fixedandmobile.com> > > <http://sg.fixedandmobile.com> > > > <http://sg.fixedandmobile.com> > > > > <http://sg.fixedandmobile.com> > > <http://sg.fixedandmobile.com> > > > > > <http://sg.fixedandmobile.com> > > > > > > > > <http://sg.fixedandmobile.com> > > > > > > > > > > <http://sg.fixedandmobile.com>) > > > > > > > > > > > > > > > > ipalib.rpc: > DEBUG: received > > > Set-Cookie > > > > (<type > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > 'list'>)'['ipa_session=MagBearerToken=a5woxNPqwGkbOIbov2siCoVxMmHwiE4IDTv1Q14Cyvb4h2a3Xy9PoQnQfe%2fWUvLCppJSxeVB9Q4kiQMeaWwhrwyjUfdmf%2bzjVmujGelpW%2b1FFY1ErOXKfR%2bSHWBaZUC2DSFxBDZ8xYS237VtX%2f0OkZrBMlUJc2mvioG5vkeKKvmoeBoIjFztlxlTHRh80vvfnRejxZUkvJkzmYuKJT39rw%3d%3d;path=/ipa;httponly;secure;']' > > > > > > > > > > > > > > > > ipalib.rpc: DEBUG: > > storing cookie > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > 'ipa_session=MagBearerToken=a5woxNPqwGkbOIbov2siCoVxMmHwiE4IDTv1Q14Cyvb4h2a3Xy9PoQnQfe%2fWUvLCppJSxeVB9Q4kiQMeaWwhrwyjUfdmf%2bzjVmujGelpW%2b1FFY1ErOXKfR%2bSHWBaZUC2DSFxBDZ8xYS237VtX%2f0OkZrBMlUJc2mvioG5vkeKKvmoeBoIjFztlxlTHRh80vvfnRejxZUkvJkzmYuKJT39rw%3d%3d;' > > > > > > > > for principal > > > admin(a)FIXEDANDMOBILE.COM <mailto:admin@FIXEDANDMOBILE.COM> > <mailto:admin@FIXEDANDMOBILE.COM <mailto:admin@FIXEDANDMOBILE.COM>> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>> > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>>> > > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>> > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>>>> > > > > > > > <mailto:admin@FIXEDANDMOBILE.COM <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>> > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>>> > > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>> > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>>>>> > > > > > > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>> > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>>> > > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>> > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>>>> > > > > > > > <mailto:admin@FIXEDANDMOBILE.COM <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>> > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>>> > > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>> > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>>>>>> > > > > > > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>> > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>>> > > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>> > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>>>> > > > > > > > <mailto:admin@FIXEDANDMOBILE.COM <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>> > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>>> > > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>> > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>>>>> > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>> <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>>> > > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>> > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>>>> > > > > > > > <mailto:admin@FIXEDANDMOBILE.COM <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>> > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>>> > > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>> > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>>>>>>> > > > > > > > > > > > > > > > > ipalib.backend: > DEBUG: > > Created > > > connection > > > > > > > > > context.rpcclient_139702145432656 > > > > > > > > > > > > > > > > > ipalib.install.kinit: DEBUG: > > > > Initializing principal > > > > > > > > > > > > > host/sg.fixedandmobile.com(a)FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>> > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>>> > > > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>> > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>>>> > > > > > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>> > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>>> > > > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>> > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>>>>> > > > > > > > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>> > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>>> > > > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>> > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>>>> > > > > > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>> > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>>> > > > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>> > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>>>>>> > > > > > > > > > > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>> > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>>> > > > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>> > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>>>> > > > > > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>> > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>>> > > > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>> > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>>>>> > > > > > > > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>> > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>>> > > > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>> > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>>>> > > > > > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>> > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>>> > > > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>> > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>>>>>>> > > > > > > > > > > > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>> > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>>> > > > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>> > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>>>> > > > > > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>> > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>>> > > > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>> > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>>>>> > > > > > > > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>> > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>>> > > > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>> > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>>>> > > > > > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>> > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>>> > > > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>> > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>>>>>> > > > > > > > > > > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>> > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>>> > > > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>> > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>>>> > > > > > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>> > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>>> > > > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>> > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>>>>> > > > > > > > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>> > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>>> > > > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>> > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>>>> > > > > > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>> > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>>> > > > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>> > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>>>>>>>> using keytab > > > > > > > > /etc/krb5.keytab > > > > > > > > > > > > > > > > > ipalib.install.kinit: DEBUG: > > > using ccache > > > > > > /tmp/tmp-v__2gr/ccache > > > > > > > > > > > > > > > > > ipalib.install.kinit: DEBUG: > > > Attempt > > > > 1/1: success > > > > > > > > > > > > > > > > ipalib.frontend: > DEBUG: raw: > > > > > > ca_is_enabled(version=u'2.107') > > > > > > > > > > > > > > > > ipalib.frontend: > DEBUG: > > > > > ca_is_enabled(version=u'2.107') > > > > > > > > > > > > > > > > ipalib.rpc: INFO: > [try 1]: > > > Forwarding > > > > > 'ca_is_enabled/1' to > > > > > > > json server > > > > > > > > > > > 'https://sg.fixedandmobile.com/ipa/json' > > > > > > > > > > > > > > > > ipalib.rpc: > DEBUG: HTTP > > connection > > > > keep-alive > > > > > > > > (sg.fixedandmobile.com <http://sg.fixedandmobile.com> > > <http://sg.fixedandmobile.com> > > > <http://sg.fixedandmobile.com> > > > > <http://sg.fixedandmobile.com> > > > > > <http://sg.fixedandmobile.com> > > > <http://sg.fixedandmobile.com> > > > > > > <http://sg.fixedandmobile.com> > > > > > > > > > > <http://sg.fixedandmobile.com>) > > > > > > > > > > > > > > > > ipalib.rpc: > DEBUG: received > > > Set-Cookie > > > > (<type > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > 'list'>)'['ipa_session=MagBearerToken=k3UeW0CBhnYQxsMjGQXZlMLMoykL9MpMuAlwz%2bIEzsTnqSJd%2frxLN4adiTkmXRmg%2b%2b2fm75Y0YkLgQUVEG6MgbO03zo%2fulI27VKCdl8y4zhSzZXN5pfXCEf6bTU3OCdGWkLiH11iw41BWSAt2Oz5dSAFrvhHKLyzf%2bZe84BgIaLNkXPPLzs4yVlP7ysBxb1BmOjA9Zy6B6FlJf0rUAKx68RVbLPM5nCWvj7xcl0sYxFamesj%2fvA64frAlJyKuhwSUMfxwTRJQMCpuwjXjBqdZ2GO74447LXf3KUE4Pra4Do%3d;path=/ipa;httponly;secure;']' > > > > > > > > > > > > > > > > ipalib.rpc: DEBUG: > > storing cookie > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > 'ipa_session=MagBearerToken=k3UeW0CBhnYQxsMjGQXZlMLMoykL9MpMuAlwz%2bIEzsTnqSJd%2frxLN4adiTkmXRmg%2b%2b2fm75Y0YkLgQUVEG6MgbO03zo%2fulI27VKCdl8y4zhSzZXN5pfXCEf6bTU3OCdGWkLiH11iw41BWSAt2Oz5dSAFrvhHKLyzf%2bZe84BgIaLNkXPPLzs4yVlP7ysBxb1BmOjA9Zy6B6FlJf0rUAKx68RVbLPM5nCWvj7xcl0sYxFamesj%2fvA64frAlJyKuhwSUMfxwTRJQMCpuwjXjBqdZ2GO74447LXf3KUE4Pra4Do%3d;' > > > > > > > > for principal > > > admin(a)FIXEDANDMOBILE.COM <mailto:admin@FIXEDANDMOBILE.COM> > <mailto:admin@FIXEDANDMOBILE.COM <mailto:admin@FIXEDANDMOBILE.COM>> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>> > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>>> > > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>> > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>>>> > > > > > > > <mailto:admin@FIXEDANDMOBILE.COM <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>> > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>>> > > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>> > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>>>>> > > > > > > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>> > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>>> > > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>> > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>>>> > > > > > > > <mailto:admin@FIXEDANDMOBILE.COM <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>> > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>>> > > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>> > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>>>>>> > > > > > > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>> > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>>> > > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>> > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>>>> > > > > > > > <mailto:admin@FIXEDANDMOBILE.COM <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>> > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>>> > > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>> > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>>>>> > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>> <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>>> > > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>> > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>>>> > > > > > > > <mailto:admin@FIXEDANDMOBILE.COM <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>> > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>>> > > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>> > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>>>>>>> > > > > > > > > > > > > > > > > > ipapython.ipaldap: DEBUG: > > > retrieving > > > > schema for > > > > > > SchemaCache > > > > > > > > > > > url=ldap://sg.fixedandmobile.com:389 > <http://sg.fixedandmobile.com:389> > > <http://sg.fixedandmobile.com:389> > <http://sg.fixedandmobile.com:389> > > > > <http://sg.fixedandmobile.com:389> > > > > > <http://sg.fixedandmobile.com:389> > > > > > > <http://sg.fixedandmobile.com:389> > > > > > > > > > <http://sg.fixedandmobile.com:389> > > > > > > > > > <http://sg.fixedandmobile.com:389> > > > > > > > > > > > conn=<ldap.ldapobject.SimpleLDAPObject > > > > instance at > > > > > > > 0x7f0ef07b8c68> > > > > > > > > > > > > > > > > ipalib.frontend: > DEBUG: raw: > > > ca_find(None, > > > > > > version=u'2.231') > > > > > > > > > > > > > > > > ipalib.frontend: > DEBUG: > > > ca_find(None, > > > > > version=u'2.231') > > > > > > > > > > > > > > > > ipalib.rpc: INFO: > [try 1]: > > > Forwarding > > > > 'ca_find/1' to > > > > > > json server > > > > > > > > > > > 'https://sg.fixedandmobile.com/ipa/json' > > > > > > > > > > > > > > > > ipalib.rpc: > DEBUG: HTTP > > connection > > > > keep-alive > > > > > > > > (sg.fixedandmobile.com <http://sg.fixedandmobile.com> > > <http://sg.fixedandmobile.com> > > > <http://sg.fixedandmobile.com> > > > > <http://sg.fixedandmobile.com> > > > > > <http://sg.fixedandmobile.com> > > > <http://sg.fixedandmobile.com> > > > > > > <http://sg.fixedandmobile.com> > > > > > > > > > > <http://sg.fixedandmobile.com>) > > > > > > > > > > > > > > > > ipalib.rpc: > DEBUG: received > > > Set-Cookie > > > > (<type > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > 'list'>)'['ipa_session=MagBearerToken=Nz2iaoFY1%2f9u4dZOG4va33r391H7RiJXQG4r6eIu825JBLHn8tuA78JX4dNwXeOcZ9lr0LhBRmHrYnSanDlBjjfB%2bGljqkyTdpif3AkFzbIO7YDPUXCO0aYc5tMlO4BJdr3yCoPvcZi1Qxshf7aEQoYhsswwAx%2batp3%2f8noK8yps4hn%2fZzbfrdzkQRRSNZzbz4bzOFhVbNFIgJMm%2f8KtEpnhyi6Guluq7RRXe0N3RO%2bXuQa1%2fyfBLnSsUzGGpEGxfu28PM6i9os2Ly2tZJpzxjsM%2bmrDY1BfwyxLiTXlCgQ%3d;path=/ipa;httponly;secure;']' > > > > > > > > > > > > > > > > ipalib.rpc: DEBUG: > > storing cookie > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > 'ipa_session=MagBearerToken=Nz2iaoFY1%2f9u4dZOG4va33r391H7RiJXQG4r6eIu825JBLHn8tuA78JX4dNwXeOcZ9lr0LhBRmHrYnSanDlBjjfB%2bGljqkyTdpif3AkFzbIO7YDPUXCO0aYc5tMlO4BJdr3yCoPvcZi1Qxshf7aEQoYhsswwAx%2batp3%2f8noK8yps4hn%2fZzbfrdzkQRRSNZzbz4bzOFhVbNFIgJMm%2f8KtEpnhyi6Guluq7RRXe0N3RO%2bXuQa1%2fyfBLnSsUzGGpEGxfu28PM6i9os2Ly2tZJpzxjsM%2bmrDY1BfwyxLiTXlCgQ%3d;' > > > > > > > > for principal > > > admin(a)FIXEDANDMOBILE.COM <mailto:admin@FIXEDANDMOBILE.COM> > <mailto:admin@FIXEDANDMOBILE.COM <mailto:admin@FIXEDANDMOBILE.COM>> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>> > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>>> > > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>> > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>>>> > > > > > > > <mailto:admin@FIXEDANDMOBILE.COM <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>> > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>>> > > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>> > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>>>>> > > > > > > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>> > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>>> > > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>> > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>>>> > > > > > > > <mailto:admin@FIXEDANDMOBILE.COM <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>> > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>>> > > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>> > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>>>>>> > > > > > > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>> > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>>> > > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>> > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>>>> > > > > > > > <mailto:admin@FIXEDANDMOBILE.COM <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>> > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>>> > > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>> > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>>>>> > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>> <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>>> > > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>> > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>>>> > > > > > > > <mailto:admin@FIXEDANDMOBILE.COM <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>> > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>>> > > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>> > > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>> > > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM> > > <mailto:admin@FIXEDANDMOBILE.COM > <mailto:admin@FIXEDANDMOBILE.COM>>>>>>>> > > > > > > > > > > > > > > > > > > ipalib.install.sysrestore: DEBUG: > > > > Loading Index > > > > > file from > > > > > > > > > > > '/var/lib/ipa/sysrestore/sysrestore.index' > > > > > > > > > > > > > > > > ipapython.ipautil: > > DEBUG: Starting > > > > external process > > > > > > > > > > > > > > > > > ipapython.ipautil: DEBUG: > > > > args=/usr/bin/certutil -d > > > > > > > > > > > > dbm:/etc/dirsrv/slapd-FIXEDANDMOBILE-COM -A -n > > > > > > > FIXEDANDMOBILE.COM > <http://FIXEDANDMOBILE.COM> > > <http://FIXEDANDMOBILE.COM> > > > <http://FIXEDANDMOBILE.COM> <http://FIXEDANDMOBILE.COM> > > > > <http://FIXEDANDMOBILE.COM> > > > > > <http://FIXEDANDMOBILE.COM> > > > > > > <http://FIXEDANDMOBILE.COM> > > > > > > > > > > <http://FIXEDANDMOBILE.COM> IPA > > > CA -t > > > > CT,C,C -a -f > > > > > > > > > > > > > /etc/dirsrv/slapd-FIXEDANDMOBILE-COM/pwdfile.txt > > > > > > > > > > > > > > > > ipapython.ipautil: > > DEBUG: Process > > > > finished, > > > > > return code=0 > > > > > > > > > > > > > > > > ipapython.ipautil: > > DEBUG: stdout= > > > > > > > > > > > > > > > > ipapython.ipautil: > > DEBUG: stderr= > > > > > > > > > > > > > > > > ipapython.ipautil: > > DEBUG: Starting > > > > external process > > > > > > > > > > > > > > > > > ipapython.ipautil: DEBUG: > > > > args=/usr/bin/certutil -d > > > > > > > > > > > > dbm:/etc/dirsrv/slapd-FIXEDANDMOBILE-COM -A -n > > > > > > > > > > E=support(a)fixedandmobile.com > <mailto:support@fixedandmobile.com> > <mailto:support@fixedandmobile.com <mailto:support@fixedandmobile.com>> > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>>> > > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>> > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>>>> > > > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>> > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>>> > > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>> > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>>>>> > > > > > > > <mailto:support@fixedandmobile.com <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>> > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>>> > > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>> > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>>>> > > > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>> > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>>> > > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>> > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>>>>>> > > > > > > > <mailto:support@fixedandmobile.com <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>> > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>>> > > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>> > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>>>> > > > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>> > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>>> > > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>> > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>>>>> > > > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>> > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>>> > > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>> > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>>>> > > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>> > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>>> > > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>> > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>>>>>>> > > > > > > > > > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > <mailto:support@fixedandmobile.com <mailto:support@fixedandmobile.com>>> > > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>> > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>>>> > > > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>> > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>>> > > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>> > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>>>>> > > > > > > > <mailto:support@fixedandmobile.com <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>> > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>>> > > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>> > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>>>> > > > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>> > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>>> > > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>> > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>>>>>> > > > > > > > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > <mailto:support@fixedandmobile.com <mailto:support@fixedandmobile.com>> > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>>> > > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>> > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>>>> > > > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>> > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>>> > > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>> > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>>>>> > > > > > > > <mailto:support@fixedandmobile.com <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>> > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>>> > > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>> > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>>>> > > > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>> > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>>> > > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>> > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>>>>>>>>,CN=sg.fixedandmobile.com > <http://sg.fixedandmobile.com> > > <http://sg.fixedandmobile.com> > > > <http://sg.fixedandmobile.com> > > > > <http://sg.fixedandmobile.com> > > > > > <http://sg.fixedandmobile.com> > > > > > > <http://sg.fixedandmobile.com> > > > > > > > > <http://sg.fixedandmobile.com> > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > <http://sg.fixedandmobile.com>,OU=IT,O=Fixed&Mobile,L=Singapore,ST=Singapore,C=SG > > > > > > > > -t C,, -a -f > > > > > > > > /etc/dirsrv/slapd-FIXEDANDMOBILE-COM/pwdfile.txt > > > > > > > > > > > > > > > > ipapython.ipautil: > > DEBUG: Process > > > > finished, > > > > > return code=0 > > > > > > > > > > > > > > > > ipapython.ipautil: > > DEBUG: stdout= > > > > > > > > > > > > > > > > ipapython.ipautil: > > DEBUG: stderr= > > > > > > > > > > > > > > > > ipapython.ipautil: > > DEBUG: Starting > > > > external process > > > > > > > > > > > > > > > > > ipapython.ipautil: DEBUG: > > > > args=/bin/systemctl > > > > > is-active > > > > > > > > > > dirsrv(a)FIXEDANDMOBILE-COM.service > > > > > > > > > > > > > > > > ipapython.ipautil: > > DEBUG: Process > > > > finished, > > > > > return code=0 > > > > > > > > > > > > > > > > > ipapython.ipautil: DEBUG: > > > stdout=active > > > > > > > > > > > > > > > > > > > > > > > > ipapython.ipautil: > > DEBUG: stderr= > > > > > > > > > > > > > > > > ipapython.ipautil: > > DEBUG: Starting > > > > external process > > > > > > > > > > > > > > > > > ipapython.ipautil: DEBUG: > > > > args=/bin/systemctl > > > > > --system > > > > > > > daemon-reload > > > > > > > > > > > > > > > > ipapython.ipautil: > > DEBUG: Process > > > > finished, > > > > > return code=0 > > > > > > > > > > > > > > > > ipapython.ipautil: > > DEBUG: stdout= > > > > > > > > > > > > > > > > ipapython.ipautil: > > DEBUG: stderr= > > > > > > > > > > > > > > > > ipapython.ipautil: > > DEBUG: Starting > > > > external process > > > > > >�� > > > > > > > > > > > ipapython.ipautil: DEBUG: > > > > args=/bin/systemctl > > > > > restart > > > > > > > > > > dirsrv(a)FIXEDANDMOBILE-COM.service > > > > > > > > > > > > > > > > ipapython.ipautil: > > DEBUG: Process > > > > finished, > > > > > return code=0 > > > > > > > > > > > > > > > > ipapython.ipautil: > > DEBUG: stdout= > > > > > > > > > > > > > > > > ipapython.ipautil: > > DEBUG: stderr= > > > > > > > > > > > > > > > > ipapython.ipautil: > > DEBUG: Starting > > > > external process > > > > > > > > > > > > > > > > > ipapython.ipautil: DEBUG: > > > > args=/bin/systemctl > > > > > is-active > > > > > > > > > > dirsrv(a)FIXEDANDMOBILE-COM.service > > > > > > > > > > > > > > > > ipapython.ipautil: > > DEBUG: Process > > > > finished, > > > > > return code=0 > > > > > > > > > > > > > > > > > ipapython.ipautil: DEBUG: > > > stdout=active > > > > > > > > > > > > > > > > > > > > > > > > ipapython.ipautil: > > DEBUG: stderr= > > > > > > > > > > > > > > > > > ipapython.ipautil: DEBUG: > > > > wait_for_open_ports: > > > > > localhost > > > > > > > [389] timeout 300 > > > > > > > > > > > > > > > > > ipapython.ipautil: DEBUG: > > > waiting for > > > > port: 389 > > > > > > > > > > > > > > > > ipapython.ipautil: > > DEBUG: SUCCESS: > > > > port: 389 > > > > > > > > > > > > > > > > > > ipaplatform.base.services: DEBUG: > > > > Restart of > > > > > > > > > > > dirsrv(a)FIXEDANDMOBILE-COM.service complete > > > > > > > > > > > > > > > > ipapython.ipautil: > > DEBUG: Starting > > > > external process > > > > > > > > > > > > > > > > > ipapython.ipautil: DEBUG: > > > > args=/usr/bin/certutil -d > > > > > > > dbm:/etc/httpd/alias > > > > > > > > -A -n > FIXEDANDMOBILE.COM <http://FIXEDANDMOBILE.COM> > > <http://FIXEDANDMOBILE.COM> > > > <http://FIXEDANDMOBILE.COM> > > > > <http://FIXEDANDMOBILE.COM> > > > > > <http://FIXEDANDMOBILE.COM> > > <http://FIXEDANDMOBILE.COM> > > > > > > <http://FIXEDANDMOBILE.COM> > > > > > > > > <http://FIXEDANDMOBILE.COM> > > IPA CA -t > > > > CT,C,C -a > > > > > > > > -f > > /etc/httpd/alias/pwdfile.txt > > > > > > > > > > > > > > > > ipapython.ipautil: > > DEBUG: Process > > > > finished, > > > > > return code=0 > > > > > > > > > > > > > > > > ipapython.ipautil: > > DEBUG: stdout= > > > > > > > > > > > > > > > > ipapython.ipautil: > > DEBUG: stderr= > > > > > > > > > > > > > > > > ipapython.ipautil: > > DEBUG: Starting > > > > external process > > > > > > > > > > > > > > > > > ipapython.ipautil: DEBUG: > > > > args=/usr/bin/certutil -d > > > > > > > dbm:/etc/httpd/alias > > > > > > > > -A -n > > > E=support(a)fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > <mailto:support@fixedandmobile.com <mailto:support@fixedandmobile.com>>> > > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>> > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>>>> > > > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>> > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>>> > > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>> > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>>>>> > > > > > > > <mailto:support@fixedandmobile.com <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>> > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>>> > > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>> > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>>>> > > > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>> > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>>> > > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>> > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>>>>>> > > > > > > > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > <mailto:support@fixedandmobile.com <mailto:support@fixedandmobile.com>> > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>>> > > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>> > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>>>> > > > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>> > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>>> > > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>> > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>>>>> > > > > > > > <mailto:support@fixedandmobile.com <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>> > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>>> > > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>> > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>>>> > > > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>> > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>>> > > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>> > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>>>>>>> > > > > > > > > > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > <mailto:support@fixedandmobile.com <mailto:support@fixedandmobile.com>>> > > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>> > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>>>> > > > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>> > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>>> > > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>> > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>>>>> > > > > > > > <mailto:support@fixedandmobile.com <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>> > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>>> > > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>> > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>>>> > > > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>> > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>>> > > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>> > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>>>>>> > > > > > > > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > <mailto:support@fixedandmobile.com <mailto:support@fixedandmobile.com>> > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>>> > > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>> > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>>>> > > > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>> > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>>> > > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>> > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>>>>> > > > > > > > <mailto:support@fixedandmobile.com <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>> > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>>> > > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>> > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>>>> > > > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>> > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>>> > > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>> > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>>>>>>>>,CN=sg.fixedandmobile.com > <http://sg.fixedandmobile.com> > > <http://sg.fixedandmobile.com> > > > <http://sg.fixedandmobile.com> > > > > <http://sg.fixedandmobile.com> > > > > > <http://sg.fixedandmobile.com> > > > > > > <http://sg.fixedandmobile.com> > > > > > > > > <http://sg.fixedandmobile.com> > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > <http://sg.fixedandmobile.com>,OU=IT,O=Fixed&Mobile,L=Singapore,ST=Singapore,C=SG > > > > > > > > -t C,, -a -f > > > /etc/httpd/alias/pwdfile.txt > > > > > > > > > > > > > > > > ipapython.ipautil: > > DEBUG: Process > > > > finished, > > > > > return code=0 > > > > > > > > > > > > > > > > ipapython.ipautil: > > DEBUG: stdout= > > > > > > > > > > > > > > > > ipapython.ipautil: > > DEBUG: stderr= > > > > > > > > > > > > > > > > ipapython.ipautil: > > DEBUG: Starting > > > > external process > > > > > > > > > > > > > > > > > ipapython.ipautil: DEBUG: > > > > args=/bin/systemctl > > > > > is-active > > > > > > > httpd.service > > > > > > > > > > > > > > > > ipapython.ipautil: > > DEBUG: Process > > > > finished, > > > > > return code=0 > > > > > > > > > > > > > > > > > ipapython.ipautil: DEBUG: > > > stdout=active > > > > > > > > > > > > > > > > > > > > > > > > ipapython.ipautil: > > DEBUG: stderr= > > > > > > > > > > > > > > > > ipapython.ipautil: > > DEBUG: Starting > > > > external process > > > > > > > > > > > > > > > > > ipapython.ipautil: DEBUG: > > > > args=/bin/systemctl > > > > > restart > > > > > > > httpd.service > > > > > > > > > > > > > > > > ipapython.ipautil: > > DEBUG: Process > > > > finished, > > > > > return code=0 > > > > > > > > > > > > > > > > ipapython.ipautil: > > DEBUG: stdout= > > > > > > > > > > > > > > > > ipapython.ipautil: > > DEBUG: stderr= > > > > > > > > > > > > > > > > ipapython.ipautil: > > DEBUG: Starting > > > > external process > > > > > > > > > > > > > > > > > ipapython.ipautil: DEBUG: > > > > args=/bin/systemctl > > > > > is-active > > > > > > > httpd.service > > > > > > > > > > > > > > > > ipapython.ipautil: > > DEBUG: Process > > > > finished, > > > > > return code=0 > > > > > > > > > > > > > > > > > ipapython.ipautil: DEBUG: > > > stdout=active > > > > > > > > > > > > > > > > > > > > > > > > ipapython.ipautil: > > DEBUG: stderr= > > > > > > > > > > > > > > > > > > ipaplatform.base.services: DEBUG: > > > > Restart of > > > > > httpd.service > > > > > > > complete > > > > > > > �� > > > > > > > > > ipapython.ipautil: > > DEBUG: Starting > > > > external process > > > > > > > > > > > > > > > > > ipapython.ipautil: DEBUG: > > > > args=/usr/bin/certutil -d > > > > > > > dbm:/etc/ipa/nssdb > > > > > > > > -L -n IPA CA -a -f > > > > /etc/ipa/nssdb/pwdfile.txt > > > > > > > > > > > > > > > > ipapython.ipautil: > > DEBUG: Process > > > > finished, return > > > > > > code=255 > > > > > > > > > > > > > > > > ipapython.ipautil: > > DEBUG: stdout= > > > > > > > > > > > > > > > > > ipapython.ipautil: DEBUG: > > > > stderr=certutil: Could > > > > > not find > > > > > > > cert: IPA CA > > > > > > > > > > > > > > > > : > > PR_FILE_NOT_FOUND_ERROR: File > > > not found > > > > > > > > > > > > > > > > > > > > > > > > ipapython.ipautil: > > DEBUG: Starting > > > > external process > > > > > > > > > > > > > > > > > ipapython.ipautil: DEBUG: > > > > args=/usr/bin/certutil -d > > > > > > > dbm:/etc/ipa/nssdb > > > > > > > > -L -n External CA > cert -a -f > > > > > /etc/ipa/nssdb/pwdfile.txt > > > > > > > > > > > > > > > > ipapython.ipautil: > > DEBUG: Process > > > > finished, return > > > > > > code=255 > > > > > > > > > > > > > > > > ipapython.ipautil: > > DEBUG: stdout= > > > > > > > > > > > > > > > > > ipapython.ipautil: DEBUG: > > > > stderr=certutil: Could > > > > > not find > > > > > > > cert: External > > > > > > > > CA cert > > > > > > > > > > > > > > > > : > > PR_FILE_NOT_FOUND_ERROR: File > > > not found > > > > > > > > > > > > > > > > > > > > > > > > ipapython.ipautil: > > DEBUG: Starting > > > > external process > > > > > > > > > > > > > > > > > ipapython.ipautil: DEBUG: > > > > args=/usr/bin/certutil -d > > > > > > > dbm:/etc/ipa/nssdb > > > > > > > > -A -n > FIXEDANDMOBILE.COM <http://FIXEDANDMOBILE.COM> > > <http://FIXEDANDMOBILE.COM> > > > <http://FIXEDANDMOBILE.COM> > > > > <http://FIXEDANDMOBILE.COM> > > > > > <http://FIXEDANDMOBILE.COM> > > <http://FIXEDANDMOBILE.COM> > > > > > > <http://FIXEDANDMOBILE.COM> > > > > > > > > <http://FIXEDANDMOBILE.COM> > > IPA CA -t > > > > CT,C,C -a > > > > > > > > -f > > /etc/ipa/nssdb/pwdfile.txt > > > > > > > > > > > > > > > > ipapython.ipautil: > > DEBUG: Process > > > > finished, > > > > > return code=0 > > > > > > > > > > > > > > > > ipapython.ipautil: > > DEBUG: stdout= > > > > > > > > > > > > > > > > ipapython.ipautil: > > DEBUG: stderr= > > > > > > > > > > > > > > > > ipapython.ipautil: > > DEBUG: Starting > > > > external process > > > > > > > > > > > > > > > > > ipapython.ipautil: DEBUG: > > > > args=/usr/bin/certutil -d > > > > > > > dbm:/etc/ipa/nssdb > > > > > > > > -A -n > > > E=support(a)fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > <mailto:support@fixedandmobile.com <mailto:support@fixedandmobile.com>>> > > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>> > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>>>> > > > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>> > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>>> > > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>> > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>>>>> > > > > > > > <mailto:support@fixedandmobile.com <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>> > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>>> > > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>> > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>>>> > > > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>> > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>>> > > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>> > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>>>>>> > > > > > > > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > <mailto:support@fixedandmobile.com <mailto:support@fixedandmobile.com>> > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>>> > > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>> > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>>>> > > > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>> > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>>> > > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>> > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>>>>> > > > > > > > <mailto:support@fixedandmobile.com <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>> > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>>> > > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>> > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>>>> > > > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>> > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>>> > > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>> > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>>>>>>> > > > > > > > > > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > <mailto:support@fixedandmobile.com <mailto:support@fixedandmobile.com>>> > > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>> > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>>>> > > > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>> > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>>> > > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>> > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>>>>> > > > > > > > <mailto:support@fixedandmobile.com <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>> > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>>> > > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>> > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>>>> > > > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>> > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>>> > > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>> > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>>>>>> > > > > > > > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > <mailto:support@fixedandmobile.com <mailto:support@fixedandmobile.com>> > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>>> > > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>> > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>>>> > > > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>> > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>>> > > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>> > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>>>>> > > > > > > > <mailto:support@fixedandmobile.com <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>> > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>>> > > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>> > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>>>> > > > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>> > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>>> > > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>> > > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com> > > <mailto:support@fixedandmobile.com > <mailto:support@fixedandmobile.com>>>>>>>>,CN=sg.fixedandmobile.com > <http://sg.fixedandmobile.com> > > <http://sg.fixedandmobile.com> > > > <http://sg.fixedandmobile.com> > > > > <http://sg.fixedandmobile.com> > > > > > <http://sg.fixedandmobile.com> > > > > > > <http://sg.fixedandmobile.com> > > > > > > > > <http://sg.fixedandmobile.com> > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > <http://sg.fixedandmobile.com>,OU=IT,O=Fixed&Mobile,L=Singapore,ST=Singapore,C=SG > > > > > > > > -t C,, -a -f > > > /etc/ipa/nssdb/pwdfile.txt > > > > > > > > > > > > > > > > ipapython.ipautil: > > DEBUG: Process > > > > finished, > > > > > return code=0 > > > > > > > > > > > > > > > > ipapython.ipautil: > > DEBUG: stdout= > > > > > > > > > > > > > > > > ipapython.ipautil: > > DEBUG: stderr= > > > > > > > > > > > > > > > > ipapython.ipautil: > > DEBUG: Starting > > > > external process > > > > > > > > > > > > > > > > > ipapython.ipautil: DEBUG: > > > > > args=/usr/bin/update-ca-trust > > > > > > > > > > > > > > > > ipapython.ipautil: > > DEBUG: Process > > > > > > > > > > > > _______________________________________________ > > > > FreeIPA-users mailing list -- > > > freeipa-users(a)lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org> > > <mailto:freeipa-users@lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org>> > > > <mailto:freeipa-users@lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org> > > <mailto:freeipa-users@lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org>>> > > > > To unsubscribe send an email to > > > freeipa-users-leave(a)lists.fedorahosted.org > <mailto:freeipa-users-leave@lists.fedorahosted.org> > > <mailto:freeipa-users-leave@lists.fedorahosted.org > <mailto:freeipa-users-leave@lists.fedorahosted.org>> > > > <mailto:freeipa-users-leave@lists.fedorahosted.org > <mailto:freeipa-users-leave@lists.fedorahosted.org> > > <mailto:freeipa-users-leave@lists.fedorahosted.org > <mailto:freeipa-users-leave@lists.fedorahosted.org>>> > > > > Fedora Code of Conduct: > > > https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > > > > List Guidelines: > > > https://fedoraproject.org/wiki/Mailing_list_guidelines > > > > List Archives: > > > > > > https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost… > > > > > > > > > > > > > _______________________________________________ > > > FreeIPA-users mailing list -- > > freeipa-users(a)lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org> > > <mailto:freeipa-users@lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org>> > > > To unsubscribe send an email to > > freeipa-users-leave(a)lists.fedorahosted.org > <mailto:freeipa-users-leave@lists.fedorahosted.org> > > <mailto:freeipa-users-leave@lists.fedorahosted.org > <mailto:freeipa-users-leave@lists.fedorahosted.org>> > > > Fedora Code of Conduct: > > https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > > > List Guidelines: > > https://fedoraproject.org/wiki/Mailing_list_guidelines > > > List Archives: > > > https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost… > > > > > > > > > _______________________________________________ > > FreeIPA-users mailing list -- > freeipa-users(a)lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org> > > To unsubscribe send an email to > freeipa-users-leave(a)lists.fedorahosted.org > <mailto:freeipa-users-leave@lists.fedorahosted.org> > > Fedora Code of Conduct: > https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > > List Guidelines: > https://fedoraproject.org/wiki/Mailing_list_guidelines > > List Archives: > https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost… > > >

1 0

Re: External & Letsencrypt Certificate | Failed on IPA update.
by Faraz Younus 23 Mar '20

23 Mar '20

I have added freeipa users list as well to this thread On Wed, Mar 11, 2020 at 6:31 PM Rob Crittenden <rcritten(a)redhat.com> wrote: > Faraz Younus wrote: > > Thanks pasted the text instead of screenshots. > > This will work. Can you post this to the freeipa-users list? > > rob > > > > > First failed then successful but after that LDAP broken. > > > > palib.install.certmonger: DEBUG: certmonger request is in state > > dbus.String(u'CA_UNREACHABLE', variant_level=1) > > > > ipapython.admintool: DEBUG: File > > "/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 178, in > > execute > > > > return_value = self.run() > > > > File > > "/usr/lib/python2.7/site-packages/ipaclient/install/ipa_certupdate.py", > > line 62, in run > > > > run_with_args(api) > > > > File > > "/usr/lib/python2.7/site-packages/ipaclient/install/ipa_certupdate.py", > > line 112, in run_with_args > > > > update_server(certs) > > > > File > > "/usr/lib/python2.7/site-packages/ipaclient/install/ipa_certupdate.py", > > line 192, in update_server > > > > "please check the request manually" % request_id) > > > > > > ipapython.admintool: DEBUG: The ipa-certupdate command failed, > > exception: ScriptError: Error resubmitting certmonger request > > '20200311065837', please check the request manually > > > > ipapython.admintool: ERROR: Error resubmitting certmonger request > > '20200311065837', please check the request manually > > > > ipapython.admintool: ERROR: The ipa-certupdate command failed. > > > > [root@sg ansible]# kinit admin > > > > Password for admin(a)FIXEDANDMOBILE.COM <mailto:admin@FIXEDANDMOBILE.COM > >: > > > > > > [root@sg ansible]# klist -kt /etc/krb5.keytab > > > > Keytab name: FILE:/etc/krb5.keytab > > > > KVNO Timestamp Principal > > > > ---- ----------------- > > -------------------------------------------------------- > > > > 3 03/11/20 07:15:51 host/sg.fixedandmobile.com(a)FIXEDANDMOBILE.COM > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > > > 3 03/11/20 07:15:51 host/sg.fixedandmobile.com(a)FIXEDANDMOBILE.COM > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > > > [root@sg ansible]# ipa-certupdate -v > > > > ipapython.admintool: DEBUG: Not logging to a file > > > > ipalib.plugable: DEBUG: importing all plugin modules in > > ipaclient.remote_plugins.schema$79e69edd... > > > > ipalib.plugable: DEBUG: importing plugin module > > ipaclient.remote_plugins.schema$79e69edd.plugins > > > > ipalib.plugable: DEBUG: importing all plugin modules in > ipaclient.plugins... > > > > ipalib.plugable: DEBUG: importing plugin module > ipaclient.plugins.automember > > > > ipalib.plugable: DEBUG: importing plugin module > ipaclient.plugins.automount > > > > ipalib.plugable: DEBUG: importing plugin module ipaclient.plugins.ca > > <http://ipaclient.plugins.ca> > > > > ipalib.plugable: DEBUG: importing plugin module ipaclient.plugins.cert > > > > ipalib.plugable: DEBUG: importing plugin module ipaclient.plugins.certmap > > > > ipalib.plugable: DEBUG: importing plugin module > > ipaclient.plugins.certprofile > > > > ipalib.plugable: DEBUG: importing plugin module ipaclient.plugins.csrgen > > > > ipalib.plugable: DEBUG: importing plugin module ipaclient.plugins.dns > > > > ipalib.plugable: DEBUG: importing plugin module > ipaclient.plugins.hbacrule > > > > ipalib.plugable: DEBUG: importing plugin module > ipaclient.plugins.hbactest > > > > ipalib.plugable: DEBUG: importing plugin module ipaclient.plugins.host > > > > ipalib.plugable: DEBUG: importing plugin module ipaclient.plugins.idrange > > > > ipalib.plugable: DEBUG: importing plugin module > ipaclient.plugins.internal > > > > ipalib.plugable: DEBUG: importing plugin module > ipaclient.plugins.location > > > > ipalib.plugable: DEBUG: importing plugin module > ipaclient.plugins.migration > > > > ipalib.plugable: DEBUG: importing plugin module ipaclient.plugins.misc > > > > ipalib.plugable: DEBUG: importing plugin module > ipaclient.plugins.otptoken > > > > ipalib.plugable: DEBUG: importing plugin module > > ipaclient.plugins.otptoken_yubikey > > > > ipalib.plugable: DEBUG: importing plugin module ipaclient.plugins.passwd > > > > ipalib.plugable: DEBUG: importing plugin module > ipaclient.plugins.permission > > > > ipalib.plugable: DEBUG: importing plugin module > ipaclient.plugins.rpcclient > > > > ipalib.plugable: DEBUG: importing plugin module ipaclient.plugins.server > > > > ipalib.plugable: DEBUG: importing plugin module ipaclient.plugins.service > > > > ipalib.plugable: DEBUG: importing plugin module > ipaclient.plugins.sudorule > > > > ipalib.plugable: DEBUG: importing plugin module > ipaclient.plugins.topology > > > > ipalib.plugable: DEBUG: importing plugin module ipaclient.plugins.trust > > > > ipalib.plugable: DEBUG: importing plugin module ipaclient.plugins.user > > > > ipalib.plugable: DEBUG: importing plugin module ipaclient.plugins.vault > > > > ipalib.rpc: DEBUG: failed to find session_cookie in persistent storage > > for principal 'admin(a)FIXEDANDMOBILE.COM <mailto:admin@FIXEDANDMOBILE.COM > >' > > > > ipalib.rpc: INFO: trying https://sg.fixedandmobile.com/ipa/json > > > > ipalib.rpc: DEBUG: New HTTP connection (sg.fixedandmobile.com > > <http://sg.fixedandmobile.com>) > > > > ipalib.rpc: DEBUG: received Set-Cookie (<type > > > 'list'>)'['ipa_session=MagBearerToken=a5woxNPqwGkbOIbov2siCoVxMmHwiE4IDTv1Q14Cyvb4h2a3Xy9PoQnQfe%2fWUvLCppJSxeVB9Q4kiQMeaWwhrwyjUfdmf%2bzjVmujGelpW%2b1FFY1ErOXKfR%2bSHWBaZUC2DSFxBDZ8xYS237VtX%2f0OkZrBMlUJc2mvioG5vkeKKvmoeBoIjFztlxlTHRh80vvfnRejxZUkvJkzmYuKJT39rw%3d%3d;path=/ipa;httponly;secure;']' > > > > ipalib.rpc: DEBUG: storing cookie > > > 'ipa_session=MagBearerToken=a5woxNPqwGkbOIbov2siCoVxMmHwiE4IDTv1Q14Cyvb4h2a3Xy9PoQnQfe%2fWUvLCppJSxeVB9Q4kiQMeaWwhrwyjUfdmf%2bzjVmujGelpW%2b1FFY1ErOXKfR%2bSHWBaZUC2DSFxBDZ8xYS237VtX%2f0OkZrBMlUJc2mvioG5vkeKKvmoeBoIjFztlxlTHRh80vvfnRejxZUkvJkzmYuKJT39rw%3d%3d;' > > for principal admin(a)FIXEDANDMOBILE.COM <mailto:admin@FIXEDANDMOBILE.COM> > > > > ipalib.backend: DEBUG: Created connection > context.rpcclient_139702145432656 > > > > ipalib.install.kinit: DEBUG: Initializing principal > > host/sg.fixedandmobile.com(a)FIXEDANDMOBILE.COM > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> using keytab > > /etc/krb5.keytab > > > > ipalib.install.kinit: DEBUG: using ccache /tmp/tmp-v__2gr/ccache > > > > ipalib.install.kinit: DEBUG: Attempt 1/1: success > > > > ipalib.frontend: DEBUG: raw: ca_is_enabled(version=u'2.107') > > > > ipalib.frontend: DEBUG: ca_is_enabled(version=u'2.107') > > > > ipalib.rpc: INFO: [try 1]: Forwarding 'ca_is_enabled/1' to json server > > 'https://sg.fixedandmobile.com/ipa/json' > > > > ipalib.rpc: DEBUG: HTTP connection keep-alive (sg.fixedandmobile.com > > <http://sg.fixedandmobile.com>) > > > > ipalib.rpc: DEBUG: received Set-Cookie (<type > > > 'list'>)'['ipa_session=MagBearerToken=k3UeW0CBhnYQxsMjGQXZlMLMoykL9MpMuAlwz%2bIEzsTnqSJd%2frxLN4adiTkmXRmg%2b%2b2fm75Y0YkLgQUVEG6MgbO03zo%2fulI27VKCdl8y4zhSzZXN5pfXCEf6bTU3OCdGWkLiH11iw41BWSAt2Oz5dSAFrvhHKLyzf%2bZe84BgIaLNkXPPLzs4yVlP7ysBxb1BmOjA9Zy6B6FlJf0rUAKx68RVbLPM5nCWvj7xcl0sYxFamesj%2fvA64frAlJyKuhwSUMfxwTRJQMCpuwjXjBqdZ2GO74447LXf3KUE4Pra4Do%3d;path=/ipa;httponly;secure;']' > > > > ipalib.rpc: DEBUG: storing cookie > > > 'ipa_session=MagBearerToken=k3UeW0CBhnYQxsMjGQXZlMLMoykL9MpMuAlwz%2bIEzsTnqSJd%2frxLN4adiTkmXRmg%2b%2b2fm75Y0YkLgQUVEG6MgbO03zo%2fulI27VKCdl8y4zhSzZXN5pfXCEf6bTU3OCdGWkLiH11iw41BWSAt2Oz5dSAFrvhHKLyzf%2bZe84BgIaLNkXPPLzs4yVlP7ysBxb1BmOjA9Zy6B6FlJf0rUAKx68RVbLPM5nCWvj7xcl0sYxFamesj%2fvA64frAlJyKuhwSUMfxwTRJQMCpuwjXjBqdZ2GO74447LXf3KUE4Pra4Do%3d;' > > for principal admin(a)FIXEDANDMOBILE.COM <mailto:admin@FIXEDANDMOBILE.COM> > > > > ipapython.ipaldap: DEBUG: retrieving schema for SchemaCache > > url=ldap://sg.fixedandmobile.com:389 <http://sg.fixedandmobile.com:389> > > conn=<ldap.ldapobject.SimpleLDAPObject instance at 0x7f0ef07b8c68> > > > > ipalib.frontend: DEBUG: raw: ca_find(None, version=u'2.231') > > > > ipalib.frontend: DEBUG: ca_find(None, version=u'2.231') > > > > ipalib.rpc: INFO: [try 1]: Forwarding 'ca_find/1' to json server > > 'https://sg.fixedandmobile.com/ipa/json' > > > > ipalib.rpc: DEBUG: HTTP connection keep-alive (sg.fixedandmobile.com > > <http://sg.fixedandmobile.com>) > > > > ipalib.rpc: DEBUG: received Set-Cookie (<type > > > 'list'>)'['ipa_session=MagBearerToken=Nz2iaoFY1%2f9u4dZOG4va33r391H7RiJXQG4r6eIu825JBLHn8tuA78JX4dNwXeOcZ9lr0LhBRmHrYnSanDlBjjfB%2bGljqkyTdpif3AkFzbIO7YDPUXCO0aYc5tMlO4BJdr3yCoPvcZi1Qxshf7aEQoYhsswwAx%2batp3%2f8noK8yps4hn%2fZzbfrdzkQRRSNZzbz4bzOFhVbNFIgJMm%2f8KtEpnhyi6Guluq7RRXe0N3RO%2bXuQa1%2fyfBLnSsUzGGpEGxfu28PM6i9os2Ly2tZJpzxjsM%2bmrDY1BfwyxLiTXlCgQ%3d;path=/ipa;httponly;secure;']' > > > > ipalib.rpc: DEBUG: storing cookie > > > 'ipa_session=MagBearerToken=Nz2iaoFY1%2f9u4dZOG4va33r391H7RiJXQG4r6eIu825JBLHn8tuA78JX4dNwXeOcZ9lr0LhBRmHrYnSanDlBjjfB%2bGljqkyTdpif3AkFzbIO7YDPUXCO0aYc5tMlO4BJdr3yCoPvcZi1Qxshf7aEQoYhsswwAx%2batp3%2f8noK8yps4hn%2fZzbfrdzkQRRSNZzbz4bzOFhVbNFIgJMm%2f8KtEpnhyi6Guluq7RRXe0N3RO%2bXuQa1%2fyfBLnSsUzGGpEGxfu28PM6i9os2Ly2tZJpzxjsM%2bmrDY1BfwyxLiTXlCgQ%3d;' > > for principal admin(a)FIXEDANDMOBILE.COM <mailto:admin@FIXEDANDMOBILE.COM> > > > > ipalib.install.sysrestore: DEBUG: Loading Index file from > > '/var/lib/ipa/sysrestore/sysrestore.index' > > > > ipapython.ipautil: DEBUG: Starting external process > > > > ipapython.ipautil: DEBUG: args=/usr/bin/certutil -d > > dbm:/etc/dirsrv/slapd-FIXEDANDMOBILE-COM -A -n FIXEDANDMOBILE.COM > > <http://FIXEDANDMOBILE.COM> IPA CA -t CT,C,C -a -f > > /etc/dirsrv/slapd-FIXEDANDMOBILE-COM/pwdfile.txt > > > > ipapython.ipautil: DEBUG: Process finished, return code=0 > > > > ipapython.ipautil: DEBUG: stdout= > > > > ipapython.ipautil: DEBUG: stderr= > > > > ipapython.ipautil: DEBUG: Starting external process > > > > ipapython.ipautil: DEBUG: args=/usr/bin/certutil -d > > dbm:/etc/dirsrv/slapd-FIXEDANDMOBILE-COM -A -n > > E=support(a)fixedandmobile.com > > <mailto:support@fixedandmobile.com>,CN=sg.fixedandmobile.com > > <http://sg.fixedandmobile.com > >,OU=IT,O=Fixed&Mobile,L=Singapore,ST=Singapore,C=SG > > -t C,, -a -f /etc/dirsrv/slapd-FIXEDANDMOBILE-COM/pwdfile.txt > > > > ipapython.ipautil: DEBUG: Process finished, return code=0 > > > > ipapython.ipautil: DEBUG: stdout= > > > > ipapython.ipautil: DEBUG: stderr= > > > > ipapython.ipautil: DEBUG: Starting external process > > > > ipapython.ipautil: DEBUG: args=/bin/systemctl is-active > > dirsrv(a)FIXEDANDMOBILE-COM.service > > > > ipapython.ipautil: DEBUG: Process finished, return code=0 > > > > ipapython.ipautil: DEBUG: stdout=active > > > > > > ipapython.ipautil: DEBUG: stderr= > > > > ipapython.ipautil: DEBUG: Starting external process > > > > ipapython.ipautil: DEBUG: args=/bin/systemctl --system daemon-reload > > > > ipapython.ipautil: DEBUG: Process finished, return code=0 > > > > ipapython.ipautil: DEBUG: stdout= > > > > ipapython.ipautil: DEBUG: stderr= > > > > ipapython.ipautil: DEBUG: Starting external process > > > > ipapython.ipautil: DEBUG: args=/bin/systemctl restart > > dirsrv(a)FIXEDANDMOBILE-COM.service > > > > ipapython.ipautil: DEBUG: Process finished, return code=0 > > > > ipapython.ipautil: DEBUG: stdout= > > > > ipapython.ipautil: DEBUG: stderr= > > > > ipapython.ipautil: DEBUG: Starting external process > > > > ipapython.ipautil: DEBUG: args=/bin/systemctl is-active > > dirsrv(a)FIXEDANDMOBILE-COM.service > > > > ipapython.ipautil: DEBUG: Process finished, return code=0 > > > > ipapython.ipautil: DEBUG: stdout=active > > > > > > ipapython.ipautil: DEBUG: stderr= > > > > ipapython.ipautil: DEBUG: wait_for_open_ports: localhost [389] timeout > 300 > > > > ipapython.ipautil: DEBUG: waiting for port: 389 > > > > ipapython.ipautil: DEBUG: SUCCESS: port: 389 > > > > ipaplatform.base.services: DEBUG: Restart of > > dirsrv(a)FIXEDANDMOBILE-COM.service complete > > > > ipapython.ipautil: DEBUG: Starting external process > > > > ipapython.ipautil: DEBUG: args=/usr/bin/certutil -d dbm:/etc/httpd/alias > > -A -n FIXEDANDMOBILE.COM <http://FIXEDANDMOBILE.COM> IPA CA -t CT,C,C -a > > -f /etc/httpd/alias/pwdfile.txt > > > > ipapython.ipautil: DEBUG: Process finished, return code=0 > > > > ipapython.ipautil: DEBUG: stdout= > > > > ipapython.ipautil: DEBUG: stderr= > > > > ipapython.ipautil: DEBUG: Starting external process > > > > ipapython.ipautil: DEBUG: args=/usr/bin/certutil -d dbm:/etc/httpd/alias > > -A -n E=support(a)fixedandmobile.com > > <mailto:support@fixedandmobile.com>,CN=sg.fixedandmobile.com > > <http://sg.fixedandmobile.com > >,OU=IT,O=Fixed&Mobile,L=Singapore,ST=Singapore,C=SG > > -t C,, -a -f /etc/httpd/alias/pwdfile.txt > > > > ipapython.ipautil: DEBUG: Process finished, return code=0 > > > > ipapython.ipautil: DEBUG: stdout= > > > > ipapython.ipautil: DEBUG: stderr= > > > > ipapython.ipautil: DEBUG: Starting external process > > > > ipapython.ipautil: DEBUG: args=/bin/systemctl is-active httpd.service > > > > ipapython.ipautil: DEBUG: Process finished, return code=0 > > > > ipapython.ipautil: DEBUG: stdout=active > > > > > > ipapython.ipautil: DEBUG: stderr= > > > > ipapython.ipautil: DEBUG: Starting external process > > > > ipapython.ipautil: DEBUG: args=/bin/systemctl restart httpd.service > > > > ipapython.ipautil: DEBUG: Process finished, return code=0 > > > > ipapython.ipautil: DEBUG: stdout= > > > > ipapython.ipautil: DEBUG: stderr= > > > > ipapython.ipautil: DEBUG: Starting external process > > > > ipapython.ipautil: DEBUG: args=/bin/systemctl is-active httpd.service > > > > ipapython.ipautil: DEBUG: Process finished, return code=0 > > > > ipapython.ipautil: DEBUG: stdout=active > > > > > > ipapython.ipautil: DEBUG: stderr= > > > > ipaplatform.base.services: DEBUG: Restart of httpd.service complete > > > > ipapython.ipautil: DEBUG: Starting external process > > > > ipapython.ipautil: DEBUG: args=/usr/bin/certutil -d dbm:/etc/ipa/nssdb > > -L -n IPA CA -a -f /etc/ipa/nssdb/pwdfile.txt > > > > ipapython.ipautil: DEBUG: Process finished, return code=255 > > > > ipapython.ipautil: DEBUG: stdout= > > > > ipapython.ipautil: DEBUG: stderr=certutil: Could not find cert: IPA CA > > > > : PR_FILE_NOT_FOUND_ERROR: File not found > > > > > > ipapython.ipautil: DEBUG: Starting external process > > > > ipapython.ipautil: DEBUG: args=/usr/bin/certutil -d dbm:/etc/ipa/nssdb > > -L -n External CA cert -a -f /etc/ipa/nssdb/pwdfile.txt > > > > ipapython.ipautil: DEBUG: Process finished, return code=255 > > > > ipapython.ipautil: DEBUG: stdout= > > > > ipapython.ipautil: DEBUG: stderr=certutil: Could not find cert: External > > CA cert > > > > : PR_FILE_NOT_FOUND_ERROR: File not found > > > > > > ipapython.ipautil: DEBUG: Starting external process > > > > ipapython.ipautil: DEBUG: args=/usr/bin/certutil -d dbm:/etc/ipa/nssdb > > -A -n FIXEDANDMOBILE.COM <http://FIXEDANDMOBILE.COM> IPA CA -t CT,C,C -a > > -f /etc/ipa/nssdb/pwdfile.txt > > > > ipapython.ipautil: DEBUG: Process finished, return code=0 > > > > ipapython.ipautil: DEBUG: stdout= > > > > ipapython.ipautil: DEBUG: stderr= > > > > ipapython.ipautil: DEBUG: Starting external process > > > > ipapython.ipautil: DEBUG: args=/usr/bin/certutil -d dbm:/etc/ipa/nssdb > > -A -n E=support(a)fixedandmobile.com > > <mailto:support@fixedandmobile.com>,CN=sg.fixedandmobile.com > > <http://sg.fixedandmobile.com > >,OU=IT,O=Fixed&Mobile,L=Singapore,ST=Singapore,C=SG > > -t C,, -a -f /etc/ipa/nssdb/pwdfile.txt > > > > ipapython.ipautil: DEBUG: Process finished, return code=0 > > > > ipapython.ipautil: DEBUG: stdout= > > > > ipapython.ipautil: DEBUG: stderr= > > > > ipapython.ipautil: DEBUG: Starting external process > > > > ipapython.ipautil: DEBUG: args=/usr/bin/update-ca-trust > > > > ipapython.ipautil: DEBUG: Process finished, return code=0 > > > > ipapython.ipautil: DEBUG: stdout= > > > > ipapython.ipautil: DEBUG: stderr= > > > > ipaplatform.redhat.tasks: INFO: Systemwide CA database updated. > > > > ipapython.ipautil: DEBUG: Starting external process > > > > ipapython.ipautil: DEBUG: args=/usr/bin/update-ca-trust > > > > ipapython.ipautil: DEBUG: Process finished, return code=0 > > > > ipapython.ipautil: DEBUG: stdout= > > > > ipapython.ipautil: DEBUG: stderr= > > > > ipaplatform.redhat.tasks: INFO: Systemwide CA database updated. > > > > ipalib.backend: DEBUG: Destroyed connection > > context.rpcclient_139702145432656 > > > > ipapython.admintool: INFO: The ipa-certupdate command was successful > > > > [root@sg ansible]# ipactl status > > > > *Unknown error when retrieving list of services from LDAP: need more > > than 1 value to unpack* > > > > *[root@sg ansible]# ipactl restart* > > > > *Failed to read data from Directory Service: Unknown error when > > retrieving list of services from LDAP: need more than 1 value to unpack* > > > > *Shutting down* > > > > > > On Wed, Mar 11, 2020 at 5:36 PM Rob Crittenden <rcritten(a)redhat.com > > <mailto:rcritten@redhat.com>> wrote: > > > > Faraz Younus wrote: > > > > > > Kindly approve this email, please > > > > It is nearly 5MB due to the screen shots. Please either reduce their > > size or preferably just copy/paste the text. > > > > rob > > > > > > > > On Wed, Mar 11, 2020 at 12:28 PM Faraz Younus <farazby(a)gmail.com > > <mailto:farazby@gmail.com> > > > <mailto:farazby@gmail.com <mailto:farazby@gmail.com>>> wrote: > > > > > > I fixed that error ipaclient is required on master server, I > > created > > > new master with ipaclient > > > > > > [root@sg ansible]# klist -kt /etc/krb5.keytab > > > > > > Keytab name: FILE:/etc/krb5.keytab > > > > > > KVNO Timestamp Principal > > > > > > ---- ----------------- > > > -------------------------------------------------------- > > > > > > 3 03/11/20 07:15:51 > > host/sg.fixedandmobile.com(a)FIXEDANDMOBILE.COM > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>> > > > > > > 3 03/11/20 07:15:51 > > host/sg.fixedandmobile.com(a)FIXEDANDMOBILE.COM > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM> > > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM > > <mailto:sg.fixedandmobile.com@FIXEDANDMOBILE.COM>> > > > > > > > > > > > > But Now Issue is that when I updating the external certificate > > it is > > > failing first time then it got successful however it broke the > > LDAP. > > > Screenshots are attached > > > > > > [root@sg ansible]# ipactl restart > > > > > > Failed to read data from Directory Service: Unknown error when > > > retrieving list of services from LDAP: need more than 1 value > > to unpack > > > > > > Shutting down > > > > > > > > > Screen Shot 2020-03-11 at 12.22.40 PM.png > > > > > > Screen Shot 2020-03-11 at 12.23.36 PM.png > > > > > > On Tue, Mar 10, 2020 at 7:33 PM Robbie Harwood > > <rharwood(a)redhat.com <mailto:rharwood@redhat.com> > > > <mailto:rharwood@redhat.com <mailto:rharwood@redhat.com>>> > wrote: > > > > > > Faraz Younus <farazby(a)gmail.com <mailto:farazby@gmail.com> > > <mailto:farazby@gmail.com <mailto:farazby@gmail.com>>> writes: > > > > > > > Yes /tmp is writable for everyone. > > > > > > > > drwxrwxrwt. root root 4.0K tmp > > > > > > > > [root@ipa5 centos]# kinit admin > > > > > > > > Password for admin(a)FIXEDANDMOBILE.COM > > <mailto:admin@FIXEDANDMOBILE.COM> > > > <mailto:admin@FIXEDANDMOBILE.COM > > <mailto:admin@FIXEDANDMOBILE.COM>>: > > > > > > > > > > > > The output for /etc/krb5.keytab > > > > > > > > > > > > [root@ipa5 centos]# klist -kt /etc/krb5.keytab > > > > > > > > Keytab name: FILE:/etc/krb5.keytab > > > > > > > > KVNO Timestamp Principal > > > > > > > > ---- ----------------- > > > > -------------------------------------------------------- > > > > > > Did you obfuscate this output? Can you not? > > > > > > It should contain an entry for > > > host/ipa5.fixedandmobile.com(a)FIXEDANDMOBILE.COM > > <mailto:ipa5.fixedandmobile.com@FIXEDANDMOBILE.COM> > > > <mailto:ipa5.fixedandmobile.com@FIXEDANDMOBILE.COM > > <mailto:ipa5.fixedandmobile.com@FIXEDANDMOBILE.COM>> . The next > > > question is > > > whether it matches the output of `kvno > > > host/ipa5.fixedandmobile.com(a)FIXEDANDMOBILE.COM > > <mailto:ipa5.fixedandmobile.com@FIXEDANDMOBILE.COM> > > > <mailto:ipa5.fixedandmobile.com@FIXEDANDMOBILE.COM > > <mailto:ipa5.fixedandmobile.com@FIXEDANDMOBILE.COM>>` (kinit first). > > > > > > Thanks, > > > --Robbie > > > > > > >

3 14

Managing different Sub CAs in FreeIPA without their shared Root CA
by Alexander Petrenz 23 Mar '20

23 Mar '20

Hi, I'm new to FreeIPA and I have a conceptual question. I have an existing PKI-Infrastructure with one root CA and three derived Sub-CAs. Now I want to change the PKI-Management to FreeIPA without replacing the already existing Sub-CAs. My first question is: Is it possible to have more then one external CAs (by the installation with "external-ca") in FreeIPA? The goal is to import the three existing external Sub-CAs with their keys in FreeIPA. I have found various sources from around 2015 that such a feature will be implemented later but I didn't found any information if it is implemented yet - or not. Furthermore I don't want to import the root CA with its key into FreeIPA. As far I understood this would be a security benefit if the ipa server would be compromised. If that idea is wrong, I would be happy to get some advice on this. Thanks Alexander

4 8

FreeIPA ReadTheDocs site
by Alexander Bokovoy 23 Mar '20

23 Mar '20

Hi, Thanks to Christian Heimes' work, we now have auto-generated FreeIPA documentation at https://freeipa.readthedocs.io/en/latest/. It currently only includes in-tree design documents and FreeIPA workshop but more to come as older design pages and HOW TOs get converted to upstream git tree. If anyone wants to help with the conversion, please don't hesitate to contact me or Christian. -- / Alexander Bokovoy Sr. Principal Software Engineer Security / Identity Management Engineering Red Hat Limited, Finland

2 2

Can't SSH to client after migrate
by Faraz Younus 23 Mar '20

23 Mar '20

Hello Team, I migrated freeipa client which is having 3.0 version to new freeipa server version 4.6 and host is successfully enrolled on new IPA server but I can not ssh into the client machine. ssh faraz.younus(a)client.example.com faraz.younus(a)client.example.com's password: Permission denied, please try again. Is this the version issue due to which I can't login via ssh ? Looking forward to your reply. Thanks Faraz

2 15

Samba file server authentication issues
by Michael Deffenbaugh 21 Mar '20

21 Mar '20

Hey all, I'm having issues getting a setting up a Samba file server using IPA as an authentication source on my network. I followed the guide based off of the mailing list chatter <https://www.freeipa.org/page/Howto/Integrating_a_Samba_File_Server_With_IPA>. No success. When I try to authenticate using kerberos (or password), I get an access denied error on the client when running "smbclient -k -L fs01.svr.ipa.domain": session setup failed: NT_STATUS_ACCESS_DENIED And it tries to revert to local user lookup on the server: [2020/03/20 02:47:32.669898, 3] ../auth/kerberos/gssapi_pac.c:123(gssapi_obtain_pac_blob) gssapi_obtain_pac_blob: obtaining PAC via GSSAPI gss_get_name_attribute failed: The operation or option is not available or unsupported: No such file or directory [2020/03/20 02:47:32.670131, 3] ../auth/gensec/gensec_util.c:55(gensec_generate_session_info_pac) gensec_generate_session_info_pac: Unable to find PAC for mddeff@<IPA.DOMAIN>, resorting to local user lookup ------ Server Config ----- [global] workgroup = SVR realm = SVR.IPA.DOMAIN dedicated keytab file = /etc/samba/samba.keytab kerberos method = dedicated keytab use kerberos keytab = true log file = /var/log/samba/log.%m log level = 3 security = ads ---------- Client: Fedora 30 File Server: CentOS 7.7, Samba 4.9.1, ipa-client 4.6.5 selinux is enabled. Any thoughts? Thanks in advance! Regards, Mike

2 8

Web UI is slow and unresponsive
by Boyd Ako 20 Mar '20

20 Mar '20

So, I have a server setup with just three users and less than 10 systems attached to it. But, for some reason when I try to login via the webui it normally just hangs at the "Authenticating..." point. Sometimes if I'm lucky I actually get in to the interface. However, anything that I click on has the "working..." wheel of death and if it does load the data for the page it takes forever. Environment: -"At home" no production environment. - Home router is set to use internal BIND DNS server and the IPA server for DNS - IPA server is set to use the BIND DNS server for forwarding - BIND DNS server's primary function is Blackhole DNS forwarding server - IPA server is set to be an internal self-signed CA/RA Things I've tried: 1) reboot the server Result: No Change. 2) Tried using Chrome, Firefox, Safari, and Opera with cache clearing. Result: No Change 3) Tried logging in via User Name and password. Result: No change 4) Tried logging in via PKCS#11 soft-token. Result: No change 5) login to the IPA server, start kerberos session, and run `ipa user-find`. Result: command hangs 6) login to the IPA client, start kerberos session, and run `ipa user-find`. Result: command hangs When monitoring `journalctl -xf` when doing so the only things I see is things like the following: Mar 20 17:25:33 ipa.neverland.ddns.me named-pkcs11[2857]: resolver priming query complete Mar 20 17:25:43 ipa.neverland.ddns.me named-pkcs11[2857]: resolver priming query complete Mar 20 17:25:52 ipa.neverland.ddns.me named-pkcs11[2857]: resolver priming query complete Mar 20 17:25:54 ipa.neverland.ddns.me ns-slapd[2810]: GSSAPI server step 1 Mar 20 17:25:54 ipa.neverland.ddns.me ns-slapd[2810]: GSSAPI server step 2 Mar 20 17:25:54 ipa.neverland.ddns.me ns-slapd[2810]: GSSAPI server step 3 Mar 20 17:25:57 ipa.neverland.ddns.me named-pkcs11[2857]: resolver priming query complete Mar 20 17:25:59 ipa.neverland.ddns.me named-pkcs11[2857]: resolver priming query complete Mar 20 17:26:05 ipa.neverland.ddns.me named-pkcs11[2857]: resolver priming query complete Mar 20 17:26:25 ipa.neverland.ddns.me named-pkcs11[2857]: resolver priming query complete Mar 20 17:26:27 ipa.neverland.ddns.me named-pkcs11[2857]: resolver priming query complete Mar 20 17:26:28 ipa.neverland.ddns.me named-pkcs11[2857]: resolver priming query complete 7) Tried to understand the log output of `journalctl -xf` when I do `systemctl restart ipa`, which can be found at https://pastebin.com/7sMAp7Zh 8) Tried using curl with kerberos to access Web API. Result: No change. Note: This and all other web-based access sometimes errors out with a vague "Internal Error" message.

1 0

Re: freeIPA in a complex multi-subnet, multi-domain, multi-identity provider lab environment
by Todd Grayson 20 Mar '20

20 Mar '20

Thanks Rob, Thanks Angus, I am aware of how to point the client to the specific IPA server, what I'm struggling more with is freeIPA in an environment where its not using DNS for domain and realm resolution for kerberos, which does work today. I should have limited my question to the following: Is it possible to use ipaClient but manage static mappings in the krb5.conf [realm] and [domain realm] and run with dns_lookup_kdc=false and dns_lookup_realm=false (including the krb5.conf on the ipa server itself so its aware of all). The question from Angus makes me believe that having the dns_lookup* = false is a unsupported context in an IPA environment. Thanks for your feedback.

6 8

Ansible and Kerberos
by Kimmo Rantala 20 Mar '20

20 Mar '20

Hi, I searched the interwebs but didn't find definite answer. We are enrolling clients with ansible like this: shell: ipa-client-install -U {{ ipa_extra_params }} --domain={{ ipa_domain }} --principal={{ ipa_admin_user }} --password={{ ipa_admin_password }} --mkhomedir --force-join --hostname={{ instance_hostname.stdout }}.{{ ipa_domain }} This works fine. After enrolling we want to edit the attributes of the newly enrolled host. We do that like this: shell: echo {{ ipa_admin_password }} | kinit enroller@{{ ipa_domain|upper }} && ipa host-mod --setattr=userclass="{{ host_user_class }}" {{ instance_hostname.stdout }}.{{ ipa_domain }} This also works fine but we don't love the fact that we echo the password to kinit. I know that there is the keytab route but that would require moving the keytab file to the host first. While this is not in any way impossible, we would like to "see all the cards". What would be the best practice(tm) for this?

4 5

Ubuntu client: Kerberos works, authentication does not
by Nicholas DeMarco 20 Mar '20

20 Mar '20

Hello, I've worked through many issues learning and implementing FreeIPA in my realm. Thanks to many for the helpful direction. One Ubuntu client is not behaving. It joined successfully, but will not authenticate. Kerberos works: # kinit ndemarco # klist Ticket cache: KEYRING:persistent:0:0 Default principal: ndemarco(a)PCHEM.PRO Valid starting Expires Service principal 03/07/2020 12:20:20 03/08/2020 13:20:17 krbtgt/PCHEM.PRO(a)PCHEM.PRO However, I cannot login as the same user. The password is not recognized. No local user with the same name: # getent passwd | grep ndemarco None of the SSSD logs show anything interesting. I'm a learner. Please give me a hint++ on where to look next. Sincerely, Nick

3 2

external users trust AD in the foreman
by Natxo Asenjo 19 Mar '20

19 Mar '20

hi, according to the satellite documentation ( https://access.redhat.com/documentation/en-us/red_hat_satellite/6.4/html/ad…) this should work, but it's a bit unclear as to how. Let's see, we have a cross realm trust between an AD (2016) and RHEL 7.7. I have an external group mapped in IdM to an AD group, I can login using ssh with my AD user to the host running the foreman which is member of IdM (not satellite, I know, but we require some functionality in the foreman not available in satellite). So far so good. But what exactly do I need to do now? According to the manual: https://access.redhat.com/documentation/en-us/red_hat_satellite/6.4/html/ad… 13.3.6. Configuring the IdM Server to Use Cross-Forest Trust On the IdM server, configure the server to use cross-forest trust. *Procedure* 1. Enable HBAC: 1. Create an external group and add the AD group to it. 2. Add the new external group to a POSIX group. 3. Use the POSIX group in a HBAC rule. 2. Configure sssd to transfer additional attributes of AD users. - Add the AD user attributes to the *nss* and *domain* sections in /etc/sssd/sssd.conf. For example: [nss] user_attributes=+mail, +sn, +givenname [domain/EXAMPLE] ldap_user_extra_attrs=mail, sn, givenname So I have the external group mapped to a posix group, I can login with my AD user so that takes care of 1. a) 1 b) and 1 c). Point 2 means I need to modify sssd.conf in the foreman host, I think. And then? -- Groeten, natxo

1 1

A fix for stuck certificates with the "NEWLY_ADDED_NEED_KEYINFO_READ_PIN" status
by Sam Morris 19 Mar '20

19 Mar '20

I noticed that a certificate request on a CentOS 8 server (running ipa- server 4.8.0-13.module_el8.1.0+265+e1e65be4) got stuck: Request ID '20200123083218': status: NEWLY_ADDED_NEED_KEYINFO_READ_PIN stuck: yes key pair storage: type=FILE,location='/var/lib/ipa/private/httpd.key' certificate: type=FILE,location='/var/lib/ipa/certs/httpd.crt' CA: IPA issuer: CN=Certificate Authority,O=IPA.EXAMPLE.COM subject: CN=ipa2.ipa.example.com,O=IPA.EXAMPLE.COM expires: 2021-12-19 18:32:27 UTC dns: ipa2.ipa.example.com principal name: HTTP/ipa2.ipa.example.com(a)IPA.EXAMPLE.COM key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment eku: id-kp-serverAuth,id-kp-clientAuth pre-save command: post-save command: /usr/libexec/ipa/certmonger/restart_httpd track: yes auto-renew: yes I was able to fix this with the following command: # ipa-getcert start-tracking -i 20200123083218 -p /var/lib/ipa/passwds/ipa2.ipa.example.com-443-RSA Hopefully someone else will find that useful. (Thanks to Rob for his advice in [0]; the command I used modified the existing request without having to delete and re-create it from scratch.) [0] https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost… -- Sam Morris <https://robots.org.uk/> PGP: rsa4096/CAAA AA1A CA69 A83A 892B 1855 D20B 4202 5CDA 27B9

1 0

Vault API failure on CentOS 8 unless TLSv1.3 is disabled
by Sam Morris 19 Mar '20

19 Mar '20

I noticed that one of my FreeIPA servers is missing the Vault tab in the web UI. I've got a workaround but it seems a bit fishy and I wondered if someone else could suggest a better fix. The server in question is the only one that runs CentOS 8 (ipa-server 4.8.0-13.module_el8.1.0+265+e1e65be4). My other servers are running CentOS 7 and work fine. The command 'ipa vaultconfig-show' fails when run against the bad server with: [admin@client ~]$ ipa -vv vaultconfig-show [...] ipa: INFO: Request: { "id": 0, "method": "vaultconfig_show/1", "params": [ [], { "version": "2.233" } ] } ipa: INFO: Response: { "error": { "code": 903, "data": {}, "message": "an internal error has occurred", "name": "InternalError" }, "id": 0, "principal": "admin(a)IPA.EXAMPLE.COM", "result": null, "version": "4.8.0" } ipa: ERROR: an internal error has occurred The corresponding httpd logs on the server (192.0.2.1 is my client, the server is [2001:db8::1]) contain: ==> /var/log/httpd/access_log <== 192.0.2.1 - admin(a)IPA.EXAMPLE.COM [18/Mar/2020:08:31:50 +0000] "POST /ipa/json HTTP/1.1" 200 210 ==> /var/log/httpd/error_log <== [Wed Mar 18 08:31:51.760354 2020] [:warn] [pid 22279:tid 139671875061504] [client 192.0.2.1:62546] failed to set perms (3140) on file (/run/ipa/ccaches/admin(a)IPA.EXAMPLE.COM) referer: https://ipa2.ipa.example.com/ipa/xml [Wed Mar 18 08:31:51.807084 2020] [wsgi:error] [pid 22274:tid 139672253028096] [remote 192.0.2.1:62546] ipa: INFO: [jsonserver_session] admin(a)IPA.EXAMPLE.COM: ping(): SUCCESS ==> /var/log/httpd/access_log <== 192.0.2.1 - admin(a)IPA.EXAMPLE.COM [18/Mar/2020:08:31:51 +0000] "POST /ipa/session/json HTTP/1.1" 200 276 ==> /var/log/httpd/error_log <== [Wed Mar 18 08:31:51.917275 2020] [:warn] [pid 22279:tid 139671891846912] [client 192.0.2.1:62546] failed to set perms (3140) on file (/run/ipa/ccaches/admin(a)IPA.EXAMPLE.COM) referer: https://ipa2.ipa.example.com/ipa/xml ==> /var/log/httpd/access_log <== 2001:db8::1 - - [18/Mar/2020:08:31:52 +0000] "GET /pki/rest/info HTTP/1.1" 404 211 ==> /var/log/httpd/error_log <== [Wed Mar 18 08:31:52.582003 2020] [ssl:error] [pid 23219:tid 139671598266112] [client 2001:db8::1:44620] AH: verify client post handshake [Wed Mar 18 08:31:52.582101 2020] [ssl:error] [pid 23219:tid 139671598266112] [client 2001:db8::1:44620] AH10158: cannot perform post-handshake authentication [Wed Mar 18 08:31:52.582207 2020] [ssl:error] [pid 23219:tid 139671598266112] SSL Library Error: error:14268117:SSL routines:SSL_verify_client_post_handshake:extension not received ==> /var/log/httpd/access_log <== 2001:db8::1 - - [18/Mar/2020:08:31:52 +0000] "GET /kra/rest/config/cert/transport HTTP/1.1" 403 298 ==> /var/log/httpd/error_log <== [Wed Mar 18 08:31:52.586053 2020] [wsgi:error] [pid 22275:tid 139672253028096] [remote 192.0.2.1:62546] ipa: ERROR: non-public: HTTPError: 403 Client Error: Forbidden for url: https://ipa2.ipa.example.com:443/kra/rest/config/cert/transport [Wed Mar 18 08:31:52.586100 2020] [wsgi:error] [pid 22275:tid 139672253028096] [remote 192.0.2.1:62546] Traceback (most recent call last): [Wed Mar 18 08:31:52.586106 2020] [wsgi:error] [pid 22275:tid 139672253028096] [remote 192.0.2.1:62546] File "/usr/lib/python3.6/site-packages/pki/__init__.py", line 429, in handler [Wed Mar 18 08:31:52.586112 2020] [wsgi:error] [pid 22275:tid 139672253028096] [remote 192.0.2.1:62546] json = exc_val.response.json() [Wed Mar 18 08:31:52.586116 2020] [wsgi:error] [pid 22275:tid 139672253028096] [remote 192.0.2.1:62546] File "/usr/lib/python3.6/site-packages/requests/models.py", line 897, in json [Wed Mar 18 08:31:52.586121 2020] [wsgi:error] [pid 22275:tid 139672253028096] [remote 192.0.2.1:62546] return complexjson.loads(self.text, **kwargs) [Wed Mar 18 08:31:52.586127 2020] [wsgi:error] [pid 22275:tid 139672253028096] [remote 192.0.2.1:62546] File "/usr/lib64/python3.6/json/__init__.py", line 354, in loads [Wed Mar 18 08:31:52.586133 2020] [wsgi:error] [pid 22275:tid 139672253028096] [remote 192.0.2.1:62546] return _default_decoder.decode(s) [Wed Mar 18 08:31:52.586137 2020] [wsgi:error] [pid 22275:tid 139672253028096] [remote 192.0.2.1:62546] File "/usr/lib64/python3.6/json/decoder.py", line 339, in decode [Wed Mar 18 08:31:52.586142 2020] [wsgi:error] [pid 22275:tid 139672253028096] [remote 192.0.2.1:62546] obj, end = self.raw_decode(s, idx=_w(s, 0).end()) [Wed Mar 18 08:31:52.586146 2020] [wsgi:error] [pid 22275:tid 139672253028096] [remote 192.0.2.1:62546] File "/usr/lib64/python3.6/json/decoder.py", line 357, in raw_decode [Wed Mar 18 08:31:52.586151 2020] [wsgi:error] [pid 22275:tid 139672253028096] [remote 192.0.2.1:62546] raise JSONDecodeError("Expecting value", s, err.value) from None [Wed Mar 18 08:31:52.586156 2020] [wsgi:error] [pid 22275:tid 139672253028096] [remote 192.0.2.1:62546] json.decoder.JSONDecodeError: Expecting value: line 1 column 1 (char 0) [Wed Mar 18 08:31:52.586160 2020] [wsgi:error] [pid 22275:tid 139672253028096] [remote 192.0.2.1:62546] [Wed Mar 18 08:31:52.586165 2020] [wsgi:error] [pid 22275:tid 139672253028096] [remote 192.0.2.1:62546] During handling of the above exception, another exception occurred: [Wed Mar 18 08:31:52.586169 2020] [wsgi:error] [pid 22275:tid 139672253028096] [remote 192.0.2.1:62546] [Wed Mar 18 08:31:52.586174 2020] [wsgi:error] [pid 22275:tid 139672253028096] [remote 192.0.2.1:62546] Traceback (most recent call last): [Wed Mar 18 08:31:52.586179 2020] [wsgi:error] [pid 22275:tid 139672253028096] [remote 192.0.2.1:62546] File "/usr/lib/python3.6/site-packages/ipaserver/rpcserver.py", line 368, in wsgi_execute [Wed Mar 18 08:31:52.586184 2020] [wsgi:error] [pid 22275:tid 139672253028096] [remote 192.0.2.1:62546] result = command(*args, **options) [Wed Mar 18 08:31:52.586189 2020] [wsgi:error] [pid 22275:tid 139672253028096] [remote 192.0.2.1:62546] File "/usr/lib/python3.6/site-packages/ipalib/frontend.py", line 450, in __call__ [Wed Mar 18 08:31:52.586194 2020] [wsgi:error] [pid 22275:tid 139672253028096] [remote 192.0.2.1:62546] return self.__do_call(*args, **options) [Wed Mar 18 08:31:52.586199 2020] [wsgi:error] [pid 22275:tid 139672253028096] [remote 192.0.2.1:62546] File "/usr/lib/python3.6/site-packages/ipalib/frontend.py", line 478, in __do_call [Wed Mar 18 08:31:52.586204 2020] [wsgi:error] [pid 22275:tid 139672253028096] [remote 192.0.2.1:62546] ret = self.run(*args, **options) [Wed Mar 18 08:31:52.586209 2020] [wsgi:error] [pid 22275:tid 139672253028096] [remote 192.0.2.1:62546] File "/usr/lib/python3.6/site-packages/ipalib/frontend.py", line 800, in run [Wed Mar 18 08:31:52.586214 2020] [wsgi:error] [pid 22275:tid 139672253028096] [remote 192.0.2.1:62546] return self.execute(*args, **options) [Wed Mar 18 08:31:52.586252 2020] [wsgi:error] [pid 22275:tid 139672253028096] [remote 192.0.2.1:62546] File "/usr/lib/python3.6/site-packages/ipaserver/plugins/vault.py", line 1003, in execute [Wed Mar 18 08:31:52.586258 2020] [wsgi:error] [pid 22275:tid 139672253028096] [remote 192.0.2.1:62546] transport_cert = kra_client.system_certs.get_transport_cert() [Wed Mar 18 08:31:52.586263 2020] [wsgi:error] [pid 22275:tid 139672253028096] [remote 192.0.2.1:62546] File "/usr/lib/python3.6/site-packages/pki/__init__.py", line 434, in handler [Wed Mar 18 08:31:52.586267 2020] [wsgi:error] [pid 22275:tid 139672253028096] [remote 192.0.2.1:62546] six.reraise(exc_type, exc_val, exc_tb) [Wed Mar 18 08:31:52.586272 2020] [wsgi:error] [pid 22275:tid 139672253028096] [remote 192.0.2.1:62546] File "/usr/lib/python3.6/site-packages/six.py", line 693, in reraise [Wed Mar 18 08:31:52.586277 2020] [wsgi:error] [pid 22275:tid 139672253028096] [remote 192.0.2.1:62546] raise value [Wed Mar 18 08:31:52.586281 2020] [wsgi:error] [pid 22275:tid 139672253028096] [remote 192.0.2.1:62546] File "/usr/lib/python3.6/site-packages/pki/__init__.py", line 423, in handler [Wed Mar 18 08:31:52.586286 2020] [wsgi:error] [pid 22275:tid 139672253028096] [remote 192.0.2.1:62546] return fn_call(inst, *args, **kwargs) [Wed Mar 18 08:31:52.586290 2020] [wsgi:error] [pid 22275:tid 139672253028096] [remote 192.0.2.1:62546] File "/usr/lib/python3.6/site-packages/pki/systemcert.py", line 54, in get_transport_cert [Wed Mar 18 08:31:52.586295 2020] [wsgi:error] [pid 22275:tid 139672253028096] [remote 192.0.2.1:62546] response = self.connection.get(url, self.headers) [Wed Mar 18 08:31:52.586300 2020] [wsgi:error] [pid 22275:tid 139672253028096] [remote 192.0.2.1:62546] File "/usr/lib/python3.6/site-packages/pki/client.py", line 46, in wrapper [Wed Mar 18 08:31:52.586305 2020] [wsgi:error] [pid 22275:tid 139672253028096] [remote 192.0.2.1:62546] return func(self, *args, **kwargs) [Wed Mar 18 08:31:52.586309 2020] [wsgi:error] [pid 22275:tid 139672253028096] [remote 192.0.2.1:62546] File "/usr/lib/python3.6/site-packages/pki/client.py", line 165, in get [Wed Mar 18 08:31:52.586314 2020] [wsgi:error] [pid 22275:tid 139672253028096] [remote 192.0.2.1:62546] r.raise_for_status() [Wed Mar 18 08:31:52.586319 2020] [wsgi:error] [pid 22275:tid 139672253028096] [remote 192.0.2.1:62546] File "/usr/lib/python3.6/site-packages/requests/models.py", line 940, in raise_for_status [Wed Mar 18 08:31:52.586324 2020] [wsgi:error] [pid 22275:tid 139672253028096] [remote 192.0.2.1:62546] raise HTTPError(http_error_msg, response=self) [Wed Mar 18 08:31:52.586330 2020] [wsgi:error] [pid 22275:tid 139672253028096] [remote 192.0.2.1:62546] requests.exceptions.HTTPError: 403 Client Error: Forbidden for url: https://ipa2.ipa.example.com:443/kra/rest/config/cert/transport [Wed Mar 18 08:31:52.586340 2020] [wsgi:error] [pid 22275:tid 139672253028096] [remote 192.0.2.1:62546] [Wed Mar 18 08:31:52.586647 2020] [wsgi:error] [pid 22275:tid 139672253028096] [remote 192.0.2.1:62546] ipa: INFO: [jsonserver_session] admin(a)IPA.EXAMPLE.COM: vaultconfig_show/1(version='2.235'): InternalError ==> /var/log/httpd/access_log <== 192.0.2.1 - admin(a)IPA.EXAMPLE.COM [18/Mar/2020:08:31:51 +0000] "POST /ipa/session/json HTTP/1.1" 200 173 It looks like the ipa api server requests /kra/rest/config/cert/transport, which httpd normally proxies through to tomcat; but there's something about the request that causes mod_ssl to reject it ("cannot perform post-handshake authentication"). Unauthenticated requests to that URL work fine: # curl -s https://ipa2.ipa.example.com/kra/rest/config/cert/transport | head -n1 <?xml version="1.0" encoding="UTF-8" standalone="yes"?><CertData xmlns:ns2="http://www.w3.org/2005/Atom" id="0xb"><Encoded>-----BEGIN CERTIFICATE----- If I reconfigure httpd with "SSLProtocol +TLSv1.2 -TLSv1.3" then the problem goes away. As far as I know, the default in RHEL 8 is to _not_ include an SSLProtocol line so that the system-wide crypto-policies(5) will be used. Hence this feels like the wrong solution to me. Interestingly, "SSLProtocol -TLSv1.3" causes httpd to fail to start with "AH02231: No SSL protocols available [hint: SSLProtocol]"... even though (testing with sslyze), no SSLProtocol directive leaves only TLSv1.2 and TLSv1.3 enabled... -- Sam Morris <https://robots.org.uk/> PGP: rsa4096/CAAA AA1A CA69 A83A 892B 1855 D20B 4202 5CDA 27B9

2 2

Re: ipa-restore and the issues
by Rob Crittenden 18 Mar '20

18 Mar '20

Please keep responses on the list. Ian Kumlien wrote: > ipa find-user admin > ipa: ERROR: No valid Negotiate header in server response > > And a lot of krb issues according to the http logs I think we need to see the logs to diagnose. > > I wasn't expecting this - since all keys should be the same as the one > installed - which is why i asked about any changes to the ldap data It could happen, for example, if you had gotten a new keytab for one or more service and restored old data. Unlikely, but possible. Comparing the klist output with kvno for all the keytabs and principals will tell you. rob > If there is something more specific you want me to look at, just let me know > > On Wed, Feb 5, 2020 at 4:54 PM Rob Crittenden <rcritten(a)redhat.com> wrote: >> >> Ian Kumlien via FreeIPA-users wrote: >>> Hi, >>> >>> Due to issues, I'm trying to do a partial restore of all the "important bits" >>> >>> But if I do ipa-restore --online --data --backend=userRoot $BACKUP >>> >>> I end up in a semiworking environment - the webui doen't work - kinit does... >>> >>> ipa doesn't etc.. >>> >> >> It doesn't work how? What have you done to troubleshoot? What do the >> logs say? >> >> rob >> >

2 3

Re: automount failed FreeIPA, Version: 4.6.5
by Markus Roth 18 Mar '20

18 Mar '20

2 5

add freeipa root cert to chrome on a non ipa client system.
by Kendrick . 18 Mar '20

18 Mar '20

I have a manjorao desktop in the environment that i need to be able to access the freeipa based systems and not get cert errors every where. I will probably attempt to build the client on that system in the future but right now i just need the certs freeipa made to be valid. how does one go about exporting the root cert and then importing it in a way chrome will accept its validity or is that a matter of getting the enterprise tools to force it to work?

2 1

How to authenticate samba shares with ipa ?
by Diadormu ZMJ 18 Mar '20

18 Mar '20

I want to authenticate the samba share user by ipa, but it failed root@ubuntu:/var/log# smbclient //xxx.xxx.xxx.xxx/test -U ipatest -L WARNING: The "syslog" option is deprecated Enter ipatest's password: krb5_init_context failed (Invalid argument) smb_krb5_context_init_basic failed (Invalid argument) session setup failed: NT_STATUS_LOGON_FAILURE Is there something wrong with my configuration file ? root@ubutu:/var/log# cat /etc/samba/smb.conf [global] workgroup = WORKGROUP server string = %h server (Samba, Ubuntu) log file = /var/log/samba/log.%m max log size = 1000 syslog = 0 panic action = /usr/share/samba/panic-action %d server role = standalone server security = user passdb backend = ldapsam:ldap://freeipa.rnd.net ldap admin dn = cn=Directory Manager ldap suffix = cn=accounts,dc=rnd,dc=net ldap user suffix = cn=users ldap machine suffix = cn=computers ldap group suffix = cn=groups ldap passwd sync = yes load printers = no [test] comment = test path = /data/ipatest available = yes guest ok = no valid users = ipatest browseable = yes public = yes writable = yes create mask = 0777 directory mask = 0777

1 0

Certificates for embeded devices and old equipment.
by Kendrick . 17 Mar '20

17 Mar '20

I have a older kvm that is requiring an unencrypted pem for its cert from freeipa. I have also tried signing a csr from an older ilo product and the cert manager started giving a 404 check your services after trying to import it. any suggestions on how best to aproch these issues. I did notice in the logs Feb 19 20:49:40 ipa server[3225]: java.util.TimerThread.run(Timer.java:505) Feb 19 20:49:40 ipa server[3225]: WARNING: The web application [ca] appears to have started a thread named [AsyncLoader watchdog] but has failed to stop it. This is very likely to create a memory leak. Stack trace of thread:

3 3

How to add options to api.Command of python ipalib module
by Diadormu ZMJ 17 Mar '20

17 Mar '20

example: api.Command.user_show(u'admin') I want to add a --all option like the command line I want to process freeipa users and host information with python

3 3

FreeIPA 4.8.5 released
by Alexander Bokovoy 17 Mar '20

17 Mar '20

Hello! The FreeIPA team would like to announce FreeIPA 4.8.5 release! It can be downloaded from http://www.freeipa.org/page/Downloads. Builds for Fedora 30-32 versions will be available soon. == Highlights in 4.8.5 == - [8214] openDNSSEC 2.1 support - [8221] AJP connector protection for Dogtag/FreeIPA communication for CVE-2020-1938 mitigation. Fedora and RHEL do not force encrypted AJP connector by default with 9.0.31 but FreeIPA 4.8.5 will convert to encrypted AJP channel on upgrade or at a new deployment. Use of AJP is limited to localhost connections with integrated CA already. - Default authentication indicators are now documented in FreeIPA workshop, https://github.com/freeipa/freeipa-workshop/blob/master/11-kerberos-ticket-… - [6891] FreeIPA SELinux policy is now part of the upstream packaging and replaces distribution-wide policies. - New internal mechanism to promote Trust Agents in ipa-adtrust-install, to allow configuring schema compatibility plugin on remote replicas. - [8124] New "ipa-cacert-manage delete" command to allow pruning a CA certificate from LDAP store === Enhancements === - Backup / restore tools now check whether packages for various optional IPA master features installed before restore - IPA CLI commands for DNS operations display additional attributes and handle optional parameters when a record is removed - Additional checks for external CA certificate properties during installation - Minor content improvements in ipa-client-samba's tool output - Preliminary support for building with MIT Kerberos 1.18 - Increased test coverage in upstream test suite - Ability to test multi-host scenarios in upstream CI using Azure Pipelines === Known Issues === === Bug fixes === FreeIPA 4.8.5 is a stabilization release for the features delivered as a part of 4.8.0 release series. There are more than 50 bug-fixes details of which can be seen in the list of resolved tickets below. == Upgrading == Upgrade instructions are available on [[Upgrade]] page. == Feedback == Please provide comments, bugs and other feedback via the freeipa-users mailing list (https://lists.fedoraproject.org/archives/list/freeipa-users@lists.fedorahos…) or #freeipa channel on Freenode. == Resolved tickets == * [https://pagure.io/freeipa/issue/6891 #6891] Move FreeIPA SELinux policy from system policy to project policy * [https://pagure.io/freeipa/issue/7522 #7522] Disable cert publishing in dogtag * [https://pagure.io/freeipa/issue/7537 #7537] PR-CI: external_ca tests are hitting timeout * [https://pagure.io/freeipa/issue/7600 #7600] Enable compat tree to provide information about AD users and groups on trust agents * [https://pagure.io/freeipa/issue/7630 #7630] ipa-restore should check that optional feature packages are installed before restoring a backup using a feature * [https://pagure.io/freeipa/issue/7744 #7744] ipa-replica-install picks wrong replica for CA initial replication * [https://pagure.io/freeipa/issue/7830 #7830] FreeIPA installation fails with 389-DS 1.4.0.20-1 * [https://pagure.io/freeipa/issue/7856 #7856] Nightly test failure in test_uninstallation.py::TestUninstallBase::()::test_failed_uninstall * [https://pagure.io/freeipa/issue/7861 #7861] Make IPADiscovery available in PyPI packages * [https://pagure.io/freeipa/issue/7909 #7909] Wrong evaluation of replication update status * [https://pagure.io/freeipa/issue/7917 #7917] Occasional 'whoami.data is undefined' error in FreeIPA web UI * [https://pagure.io/freeipa/issue/7938 #7938] 'ipa dnszone-show/find' should display "Dynamic Update" and "Bind update policy" by default * [https://pagure.io/freeipa/issue/7941 #7941] ipapython/dn_ctypes.py: libldap_r shared library missing * [https://pagure.io/freeipa/issue/7942 #7942] WebUI test for automount is broken * [https://pagure.io/freeipa/issue/7948 #7948] [FIPS] Use 3DES for certificate encryption when creating a PKCS#12 * [https://pagure.io/freeipa/issue/7953 #7953] ipa-pwd-extop: do not remove MagicRegen mod, replace it * [https://pagure.io/freeipa/issue/7965 #7965] Stop using 389-ds legacy tools for backup and restore * [https://pagure.io/freeipa/issue/7974 #7974] Nightly test failure in ipatests.test_integration.test_user_permissions.TestUserPermissions * [https://pagure.io/freeipa/issue/7984 #7984] make sure 'make fastlint' processes Python .in files * [https://pagure.io/freeipa/issue/7987 #7987] Python shebang: Use isolated mode * [https://pagure.io/freeipa/issue/7989 #7989] Pytest4.2+ errors * [https://pagure.io/freeipa/issue/7990 #7990] Assumptions about systemd name of `named` * [https://pagure.io/freeipa/issue/7998 #7998] Use system-wide crypto policy in TLS client * [https://pagure.io/freeipa/issue/8001 #8001] Need default authentication indicators for SPAKE, PKINIT and encrypted challenge preauth * [https://pagure.io/freeipa/issue/8004 #8004] RHEL 8 uses nis-domainname instead of rhel-domainname * [https://pagure.io/freeipa/issue/8029 #8029] ipa host-find --pkey-only includes SSH keys in output * [https://pagure.io/freeipa/issue/8079 #8079] [Security] By default, DNS recursion is open, breaking best practices * [https://pagure.io/freeipa/issue/8098 #8098] Host principals lack ACI to look up DNS objects in LDAP * [https://pagure.io/freeipa/issue/8105 #8105] getcert with -F option returns before cacert file is created * [https://pagure.io/freeipa/issue/8110 #8110] Enable AES SHA 256 and 384 Kerberos enctypes * [https://pagure.io/freeipa/issue/8116 #8116] Pylint parallel execution with custom plugin * [https://pagure.io/freeipa/issue/8124 #8124] Add option to ipa-cacert-manage to delete certificates * [https://pagure.io/freeipa/issue/8135 #8135] When Service weight is set as 0 for server in IPA location "IPA Error 903: InternalError" is displayed * [https://pagure.io/freeipa/issue/8142 #8142] check Not Before / Not After in externally signed CA sanity check * [https://pagure.io/freeipa/issue/8149 #8149] SIDs of AD domains do not display in ipa-client-samba installer * [https://pagure.io/freeipa/issue/8150 #8150] IPA Server install fail * [https://pagure.io/freeipa/issue/8151 #8151] test_commands timing-out * [https://pagure.io/freeipa/issue/8153 #8153] Kerberos ticket policy reset does not reset per-indicator policies * [https://pagure.io/freeipa/issue/8157 #8157] NIghtly test failure in fedora-rawhide/test_webui_network * [https://pagure.io/freeipa/issue/8163 #8163] "Internal Server Error" reported for minor issues implies IPA is broken [IdmHackfest2019] * [https://pagure.io/freeipa/issue/8164 #8164] Renewed certs are not picked up by IPA CAs * [https://pagure.io/freeipa/issue/8169 #8169] NIghtly test failure in fedora-rawhide/test_webui_policy * [https://pagure.io/freeipa/issue/8170 #8170] Nightly test failure in fedora-rawhide/test_backup_and_restore_TestBackupReinstallRestoreWithDNS * [https://pagure.io/freeipa/issue/8173 #8173] Broken -k argument parsing in ipa-run-tests 4.8.4-1 package * [https://pagure.io/freeipa/issue/8176 #8176] External CA is tracked for renewals and replaced with a self-signed certificate * [https://pagure.io/freeipa/issue/8179 #8179] Tests broken with python version < 3.7 (module 're' has no attribute 'Pattern') * [https://pagure.io/freeipa/issue/8190 #8190] ipa-client-automount fails after repeated installation/uninstallation * [https://pagure.io/freeipa/issue/8192 #8192] ipa-adtrust-install does not list service records for manual addition to DNS zone * [https://pagure.io/freeipa/issue/8193 #8193] Re-order 50-externalmembers.update to be after 80-schema_compat.update * [https://pagure.io/freeipa/issue/8196 #8196] API: dnsrecord_del failure with empty list aaaarecord * [https://pagure.io/freeipa/issue/8200 #8200] ipa krb5kdc db: krb5kdc coredump * [https://pagure.io/freeipa/issue/8201 #8201] update ssbrowser.html * [https://pagure.io/freeipa/issue/8202 #8202] Azure: add support for multi-container tests * [https://pagure.io/freeipa/issue/8214 #8214] Support for opendnssec 2.1.6 * [https://pagure.io/freeipa/issue/8219 #8219] ipatests: unify editing of sssd.conf * [https://pagure.io/freeipa/issue/8221 #8221] Secure AJP connector between Dogtag and Apache proxy * [https://pagure.io/freeipa/issue/8226 #8226] ipa-restore does not restart httpd == Detailed changelog since 4.8.4 == === Armando Neto (4) === * prci: update fedora used for testing ipa-4-8 [https://pagure.io/freeipa/c/c1660a4c023a28cdad40720fd91d7e57870b4808 commit] * prci: Bump template version [https://pagure.io/freeipa/c/59593194d3eaf646ae757b88dc8a9231c21301c2 commit] * ipatests: Skip test_sss_ssh_authorizedkeys method [https://pagure.io/freeipa/c/011734279c37ca1e9a013694525563b4e77ace78 commit] [https://pagure.io/freeipa/issue/8151 #8151] * ipatests: Improve test_commands reliability [https://pagure.io/freeipa/c/5431dd9706253ea7cd75f62f5cd387bbf25ac878 commit] === Alexander Bokovoy (11) === * Become FreeIPA 4.8.5 [https://pagure.io/freeipa/c/5f49e6d1aaab56f8dd72e991f16ff575b7f4c9ee commit] * Add new contributors to the list [https://pagure.io/freeipa/c/1af953680ba95d7a9da382e05f373375d1e6a35d commit] * Add more contributor emails to the mailmap [https://pagure.io/freeipa/c/b598982520891d2907070101c8953019613a4694 commit] * Secure AJP connector between Dogtag and Apache proxy [https://pagure.io/freeipa/c/d4d8b98c3588b212db6a26610e690cccb3af84ca commit] [https://pagure.io/freeipa/issue/8221 #8221] * Tighten permissions on PKI proxy configuration [https://pagure.io/freeipa/c/1deb1010b245df6c363c5655f9a548bdf4dbc040 commit] [https://pagure.io/freeipa/issue/8221 #8221] * Azure Pipelines: re-enable nodejs:12 stream for Fedora 31+ [https://pagure.io/freeipa/c/4eb48492b354ecc30ffe1dd9654dcc0e0e833d64 commit] * kdb: make sure audit_as_req callback signature change is preserved [https://pagure.io/freeipa/c/30b8c8b9985a5eb41e700b80fd03f95548e45fba commit] [https://pagure.io/freeipa/issue/8200 #8200] * adtrust: print DNS records for external DNS case after role is enabled [https://pagure.io/freeipa/c/936e27f75961c67e619ecfa641e256ce80662d68 commit] [https://pagure.io/freeipa/issue/8192 #8192] * Update Azure Pipelines to use Fedora 31 [https://pagure.io/freeipa/c/f4e2acd1333f0f3d88da81d3fda80e85c9c418c2 commit] * install/updates: move external members past schema compat update [https://pagure.io/freeipa/c/14dbf04148c6284b176eca34aa70df4bef09b857 commit] [https://pagure.io/freeipa/issue/8193 #8193] * Reset per-indicator Kerberos policy [https://pagure.io/freeipa/c/a8b52eaf3cf56c90e3d94fdef0b9e426052634ea commit] [https://pagure.io/freeipa/issue/8153 #8153] === Anuja More (11) === * Mark test to skip sssd-2.2.2 [https://pagure.io/freeipa/c/a9922639f3541fe25cadbba79a94de7ada29c7f3 commit] * ipatests: User and group with same name should not break reading AD user data. [https://pagure.io/freeipa/c/c3053e287b8d29da40ef9c36fbe8915f616f8501 commit] * ipatests: Added test when 2FA prompting configurations is set. [https://pagure.io/freeipa/c/dcdcbe37f42a219541716938fd34ac1df7d8170c commit] * ipatests: SSSD should fetch external groups without any limit. [https://pagure.io/freeipa/c/d4b8081e6c0a745451ff314f7a42d5ff344ac327 commit] * ipatests: Add test for ipa-extdom-extop plugin should allow @ in group name [https://pagure.io/freeipa/c/985c99fc7ad6fdd30d428d099e006b1a0836a87d commit] * Update topology for test_integration/test_sssd.py [https://pagure.io/freeipa/c/2d0da2f9aff2e6256ae9f43838ca24335381e7e8 commit] * After mounting "Unspecified GSS failure" should not be in logs. [https://pagure.io/freeipa/c/4d7eac93b0249d6f4081bb4857079875afa21423 commit] * Add xmlrpc test with input validation check for kerberos ticket policy. [https://pagure.io/freeipa/c/acbbc52999f8c7694d549b709bc8caea801dc94c commit] * Fix fedora version for xfail for sssd test [https://pagure.io/freeipa/c/2b19749a3769bbac5f11aa901bf6291b6240dddb commit] * Add integration test for otp kerberos ticket policy. [https://pagure.io/freeipa/c/27a6920d50e5d63afbfc198e64885a2cd3fadc48 commit] [https://pagure.io/freeipa/issue/8001 #8001] * ipatests: filter_users should be applied correctly. [https://pagure.io/freeipa/c/71a4d574bd94eda3cb7490a2254ce764fe9bcdb1 commit] === Christian Heimes (7) === * Allow hosts to read DNS records for IP SAN [https://pagure.io/freeipa/c/e4a611aee8ca839c59798210b56e65f21a24e965 commit] [https://pagure.io/freeipa/issue/8098 #8098] * Cleanup SELinux policy [https://pagure.io/freeipa/c/87e0d82dd4409cdecaacee1fa27d27033aa65f7a commit] [https://pagure.io/freeipa/issue/6891 #6891] * Integrate SELinux policy into build system [https://pagure.io/freeipa/c/18ce2033c04aed2c4a34f61b9ee3642b01f53017 commit] * dnsrecord: Treat empty list arguments correctly [https://pagure.io/freeipa/c/2ade60ac63ff9a626ae1ec17196121fe694ee212 commit] [https://pagure.io/freeipa/issue/8196 #8196] * Remove dependency on custodia package [https://pagure.io/freeipa/c/b240b54bb4ff160851c7681914eb210934ae2abc commit] * Make assert_error compatible with Python 3.6 [https://pagure.io/freeipa/c/e9ed8e78454f12fcfc3d0484dd36995cbef65961 commit] [https://pagure.io/freeipa/issue/8179 #8179] * Print LDAP diagnostic messages on error [https://pagure.io/freeipa/c/4fe1f7701a616c17167f75e1e81f3a479a2ee50f commit] === Dinesh Prasanth M K (1) === * Adding auto COPR builds [https://pagure.io/freeipa/c/21fb038c9bdfa05fa96ac2a0fc6f4cc1e74ce916 commit] === François Cami (5) === * ipa-restore: restart services at the end [https://pagure.io/freeipa/c/8d6a609d6e55dc11b4768ee54da46393228660f9 commit] [https://pagure.io/freeipa/issue/8226 #8226] * ipatests: make sure ipa-client-automount reverts sssd.conf [https://pagure.io/freeipa/c/7ae804c726970ae467a7f76efa21bae40405551d commit] [https://pagure.io/freeipa/issue/8190 #8190] * ipa-client-automount: call save_domain() for each change [https://pagure.io/freeipa/c/6332aed9ba67e2ee759a9d988ba92139486469d4 commit] [https://pagure.io/freeipa/issue/8190 #8190] * ipatests: expect "Dynamic Update" and "Bind update policy" in default dnszone* output [https://pagure.io/freeipa/c/578bdce292c142b7fca6e237ccb3f5cec641e618 commit] [https://pagure.io/freeipa/issue/7938 #7938] * ipaserver/plugins/dns.py: add "Dynamic Update" and "Bind update policy" to default dnszone* output [https://pagure.io/freeipa/c/e3cff5d152fc36802f7ddfcd0730696e154d1b4c commit] [https://pagure.io/freeipa/issue/7938 #7938] === Florence Blanc-Renaud (16) === * opendnssec2.1 support: move all ods tasks to specific file [https://pagure.io/freeipa/c/799ebc8be681165e622778848a9b2989434a29dd commit] [https://pagure.io/freeipa/issue/8214 #8214] * DnsSecMaster migration: move the call to zonelist export later [https://pagure.io/freeipa/c/598c55cc0dc884aa780ac2dc2f3adfd8299e6ea0 commit] [https://pagure.io/freeipa/issue/8214 #8214] * Support OpenDNSSEC 2.1: new ods-signer protocol [https://pagure.io/freeipa/c/fc4ccfa5c3a7ecd7c9e5539595e0440965d62336 commit] [https://pagure.io/freeipa/issue/8214 #8214] * With opendnssec 2, read the zone list from file [https://pagure.io/freeipa/c/6cb3b11a61d5b9b7df93130188c7feef83398090 commit] [https://pagure.io/freeipa/issue/8214 #8214] * Remove the <Interval> from opendnssec conf [https://pagure.io/freeipa/c/5716c3b78f43391d2ab7b4b1fd672135f3b55bdb commit] [https://pagure.io/freeipa/issue/8214 #8214] * Support opendnssec 2.1.6 [https://pagure.io/freeipa/c/23993f58e1da98e537b03b9274d91308cbc63a6c commit] [https://pagure.io/freeipa/issue/8214 #8214] * selinux policy: add the right context for org.freeipa.server.trust-enable-agent [https://pagure.io/freeipa/c/df0df14bf31dba5800747aa08824b24b8be41eab commit] [https://pagure.io/freeipa/issue/7600 #7600] * ipa-adtrust-install: remote command fails if ipa-server-trust-ad pkg missing [https://pagure.io/freeipa/c/21c923c4cf21f30f20ec4b21c488db6f6fa92b67 commit] [https://pagure.io/freeipa/issue/7600 #7600] * ipatests: fix TestSubCAkeyReplication [https://pagure.io/freeipa/c/c444f7a35ada0dcb4f565557b7c71f3644fdd446 commit] * ipatests: add test for ipa-adtrust-install --add-agents [https://pagure.io/freeipa/c/4afd6e5e07061dde6e30b5352668bdf23cd6dedd commit] [https://pagure.io/freeipa/issue/7600 #7600] * ipa-adtrust-install: run remote configuration for new agents [https://pagure.io/freeipa/c/5edc674e7262ce4506c40b8c066207f9e5f55c33 commit] [https://pagure.io/freeipa/issue/7600 #7600] * Privilege: add a helper checking if a principal has a given privilege [https://pagure.io/freeipa/c/66154f8bf79584b8fa6792e3d2ca534900dfa481 commit] [https://pagure.io/freeipa/issue/7600 #7600] * Part2: Don't fully quality the FQDN in ssbrowser.html for Chrome [https://pagure.io/freeipa/c/8a5bfaba83da700bed29fc82ef1d280bfabb8379 commit] [https://pagure.io/freeipa/issue/8201 #8201] * ipatests: fix modify_sssd_conf() [https://pagure.io/freeipa/c/8e527507c0971ed1a8468e10246232491b1ef36c commit] * ipatests: fix backup and restore [https://pagure.io/freeipa/c/1b7cf51e292b917a18ec7959708cb62ceddd44b7 commit] [https://pagure.io/freeipa/issue/8170 #8170] * AD user without override receive InternalServerError with API [https://pagure.io/freeipa/c/4db18be5467c0b8f7633b281c724f469f907e573 commit] [https://pagure.io/freeipa/issue/8163 #8163] === Fraser Tweedale (4) === * Do not renew externally-signed CA as self-signed [https://pagure.io/freeipa/c/4b5513660cb73ee685e09c4f84634ac9d1fa792d commit] [https://pagure.io/freeipa/issue/8176 #8176] * ipatests: add test for certinstall with notBefore in the future [https://pagure.io/freeipa/c/25310105da0540eb84b6d0ee4c30649750583703 commit] [https://pagure.io/freeipa/issue/8142 #8142] * Fix test regressions caused by certificate validation changes [https://pagure.io/freeipa/c/d833b5ba607f79a495e0245722e8ccef7cefbd7a commit] [https://pagure.io/freeipa/issue/8142 #8142] * ipatests: assert_error: allow regexp match [https://pagure.io/freeipa/c/44fca092ead0316084d68917032e28e5cbb20ad4 commit] [https://pagure.io/freeipa/issue/8142 #8142] === Gaurav Talreja (1) === * Normalize test definations titles [https://pagure.io/freeipa/c/875769c7c0a66a217a152b7c8cb064c3ceabf541 commit] === Isaac Boukris (2) === * Fix legacy S4U2Proxy in DAL v8 support [https://pagure.io/freeipa/c/0806c1582b2f1dfaf04eb2e8fa222c190e24d818 commit] * Fix DAL v8 support [https://pagure.io/freeipa/c/99a920cb69e213d211a6ff9622950e81c3e71c8d commit] === Jayesh (3) === * Test for ipa-ca-install on replica [https://pagure.io/freeipa/c/e1ff95fc618f22886b505a8dbfdfa7651e1a3b9b commit] * Test ipa-getkeytab quiet mode, encryptons [https://pagure.io/freeipa/c/631054a1c9aff849378278f99722a8711d6bacf3 commit] * Test if ipactl starts services stopped by systemctl [https://pagure.io/freeipa/c/acbd90d9fb16e76964d36b3d6e8e542a30631172 commit] === Kaleemullah Siddiqui (1) === * Tests for backup-restore when pkg required is missing [https://pagure.io/freeipa/c/3ced5532576779ee7bb2e7f15ff4b5039ba4daba commit] [https://pagure.io/freeipa/issue/7630 #7630] === Mohammad Rizwan Yusuf (6) === * Test if getcert creates cacert file with -F option [https://pagure.io/freeipa/c/937fb1d9518c54bf9c05bc0b7d6f43b29971eb3c commit] [https://pagure.io/freeipa/issue/8105 #8105] * Move wait_for_request() method to tasks.py [https://pagure.io/freeipa/c/5d8d9198ce1ddfd44eb7c0268c397359e6239fca commit] * Test if server installer lock Bind9 recursion [https://pagure.io/freeipa/c/3fbbd02b0e8bc5e4f196e8d26ecfa8c989dadabb commit] [https://pagure.io/freeipa/issue/8079 #8079] * Add certmonger wait_for_request that uses run_command [https://pagure.io/freeipa/c/84ae778c8731b0934e011155b668acbb97d775c2 commit] * Test if certmonger reads the token in HSM [https://pagure.io/freeipa/c/eaf9e79c8000118317527caad4cf6aa521fd0028 commit] * Test AES SHA 256 and 384 Kerberos enctypes enabled [https://pagure.io/freeipa/c/61577c851e81beabc65e5b96603b88e9f7ec973b commit] [https://pagure.io/freeipa/issue/8110 #8110] === Rob Crittenden (7) === * Move execution of ipa-healthcheck to a separate function [https://pagure.io/freeipa/c/f36b8697a1d7dcf0f698147b3791c8ed338863d7 commit] * Fix div-by-zero when svc weight is 0 for all masters in location [https://pagure.io/freeipa/c/12d6864b6dc30155414e2483f7634684ccc9ee3e commit] [https://pagure.io/freeipa/issue/8135 #8135] * Don't fully quality the FQDN in ssbrowser.html for Chrome [https://pagure.io/freeipa/c/f356d5734662d0a20f06702353b2f10f29b9f55d commit] [https://pagure.io/freeipa/issue/8201 #8201] * Add tests for ipa-cacert-manage delete command [https://pagure.io/freeipa/c/78827db1aa561613d3fb40f39525f7e8fcae2b98 commit] [https://pagure.io/freeipa/issue/8124 #8124] * ipa-certupdate removes all CA certs from db before adding new ones [https://pagure.io/freeipa/c/7d81a3458c266a1e0c4baa07717aac110c435e59 commit] [https://pagure.io/freeipa/issue/8124 #8124] * Add delete option to ipa-cacert-manage to remove CA certificates [https://pagure.io/freeipa/c/37f81cc566cc37a47b7d1b0d900a53273eae01ac commit] [https://pagure.io/freeipa/issue/8124 #8124] * Allow an empty cookie in dogtag-ipa-ca-renew-agent-submit [https://pagure.io/freeipa/c/3d7d58d8214f3c899c0afd1a3a6a6678f38b7b39 commit] [https://pagure.io/freeipa/issue/8164 #8164] === Robbie Harwood (6) === * Drop support for DAL version 5.0 [https://pagure.io/freeipa/c/196350444ccab2b99e86accf7eb19ff8327a1e95 commit] * Support DAL version 8.0 [https://pagure.io/freeipa/c/089c47e212ac077dcd27bc60013d7ac7bf2270ee commit] * Handle the removal of KRB5_KDB_FLAG_ALIAS_OK [https://pagure.io/freeipa/c/d97cfd72721ed2f7e77f5c397a0ca7b389ea6d72 commit] * Fix several leaks in ipadb_find_principal [https://pagure.io/freeipa/c/6bdd6b3d265ffc2f437e2a69707978758c2efdd8 commit] * Use separate variable for client fetch in kdcpolicy [https://pagure.io/freeipa/c/01c1b270cd83ab6573dc0a502ac37d0182503c3d commit] * Make the coding style explicit [https://pagure.io/freeipa/c/86a8d9480aa402f885c72ccbcfeeb2bac488f268 commit] === Stanislav Levin (24) === * spec: Take the ownership over '/usr/libexec/ipa/custodia' [https://pagure.io/freeipa/c/5df2f5d856f15c6283644a00004fad5873eb1671 commit] * Azure: Report elapsed time [https://pagure.io/freeipa/c/8fd1eacfb5c49738f9a26124cfa7a2423244637b commit] * Azure: Rebalance tests [https://pagure.io/freeipa/c/1fe5c04cdd2f5f998f92debc7f3f46f2807ddc88 commit] * Azure: Skip tests requiring external DNS [https://pagure.io/freeipa/c/ec21ecc5c6677f9e87fc8ffa5652645469865230 commit] * Azure: Free Docker resources after usage [https://pagure.io/freeipa/c/4b2cdeef29094dd6b3e4f485993ad5f69c8d84b5 commit] * Azure: Preliminary check for provided limits [https://pagure.io/freeipa/c/4e6e0c88bb2831b65c1a5a6f1f4a7f09c0b112cf commit] * Azure: Sync Gating definitions to current PR-CI [https://pagure.io/freeipa/c/0fbdb1357ca3e861bba14d21ceb6e2a6e753a14c commit] * pylint: Run Pylint over Azure Python scripts [https://pagure.io/freeipa/c/3fff86757cfc7a78db33801e3c75e208b01660f7 commit] [https://pagure.io/freeipa/issue/8202 #8202] * Azure: Add support for testing multi IPA environments [https://pagure.io/freeipa/c/245a9dc93f086b685b09984ea4a3395b93fd5789 commit] [https://pagure.io/freeipa/issue/8202 #8202] * Azure: Don't collect twice systemd_journal.log [https://pagure.io/freeipa/c/685d902ca4cf10c8c440036016c2dd3e05d76222 commit] [https://pagure.io/freeipa/issue/8202 #8202] * yamllint: Lint all the YAML files [https://pagure.io/freeipa/c/2988f5f30c9379f8ac7cbfc56af382f2779479cf commit] [https://pagure.io/freeipa/issue/8202 #8202] * Azure: Make it possible to configure distro-specific stuff [https://pagure.io/freeipa/c/198cd506592c8dc078e7956a42d0d4e0342cf86d commit] [https://pagure.io/freeipa/issue/8202 #8202] * Azure: Allow to run integration tests [https://pagure.io/freeipa/c/d33b7d61fc8e012ecfd0354a6d3431301a66d768 commit] [https://pagure.io/freeipa/issue/8202 #8202] * Azure: Allow SSH for Docker environments [https://pagure.io/freeipa/c/6a6e3f2339c5773f051aaea08922f6853ef5942d commit] [https://pagure.io/freeipa/issue/8202 #8202] * Azure: Allow to not provide tests to be ignored [https://pagure.io/freeipa/c/11d145300dcd1b9b986f259efa57eddcca9b2e32 commit] [https://pagure.io/freeipa/issue/8202 #8202] * ipatests: Allow zero-length arguments [https://pagure.io/freeipa/c/c35c066a6d7b7a493e22a4af3043d5d2a72133d4 commit] [https://pagure.io/freeipa/issue/8173 #8173] * lint: Make Pylint-2.4 happy again [https://pagure.io/freeipa/c/44a59ff39a3f481e90043e546c892c9108231d67 commit] [https://pagure.io/freeipa/issue/8116 #8116] * pylint: Clean up comment [https://pagure.io/freeipa/c/6f48848562f4e9ab9584154fd85e6ad1ac331ecd commit] [https://pagure.io/freeipa/issue/8116 #8116] * pylint: Synchronize pylint plugin to ipatests code [https://pagure.io/freeipa/c/3460db4ee7c7ce6c9a639a644a39c4df09ce31ac commit] [https://pagure.io/freeipa/issue/8116 #8116] * pylint: Teach Pylint how to handle request.context [https://pagure.io/freeipa/c/5939c90752db9da1adaf8c0bfe6bec3d6c1e2ad6 commit] [https://pagure.io/freeipa/issue/8116 #8116] * ipatests: Properly kill gpg-agent [https://pagure.io/freeipa/c/294694ad69fa909e2f699cb2dad0f36b966a246f commit] [https://pagure.io/freeipa/issue/7989 #7989] * pytest: Warn about unittest/nose/xunit tests [https://pagure.io/freeipa/c/3659b46d6aeea06b4875860ec69a9215afcbdd91 commit] [https://pagure.io/freeipa/issue/7989 #7989] * pytest: Migrate unittest/nose to Pytest fixtures [https://pagure.io/freeipa/c/356f907fc255ab3a9f93ff2808646b92a6652aec commit] [https://pagure.io/freeipa/issue/7989 #7989] * pytest: Migrate xunit-style setups to Pytest fixtures [https://pagure.io/freeipa/c/87bc31464b6133af9befd412af54403665c22628 commit] [https://pagure.io/freeipa/issue/7989 #7989] === Sergey Orlov (9) === * ipatests: add test for SSSD updating expired cache items [https://pagure.io/freeipa/c/40fd96f27d2512212ac99fff9ace0fef1f5a57d4 commit] * ipatests: provide docstrings instead of imporperly placed comments [https://pagure.io/freeipa/c/1d416a5a5ceaaf3fff9df423cea9114f1918aad2 commit] * ipatests: remove invalid parameter from sssd.conf [https://pagure.io/freeipa/c/a1695722125674204b6e880b6ac652d78b783c88 commit] [https://pagure.io/freeipa/issue/8219 #8219] * ipatests: use remote_sssd_config to modify sssd.conf [https://pagure.io/freeipa/c/32584ed34f466e8f474e22d778e3e964d0fcd2c4 commit] [https://pagure.io/freeipa/issue/8219 #8219] * ipatests: replace utility for editing sssd.conf [https://pagure.io/freeipa/c/5ff9b6e2a506c3ef1179655ae2d2e479005ec99e commit] [https://pagure.io/freeipa/issue/8219 #8219] * ipatests: update docstring to reflect changes in FileBackup.restore() [https://pagure.io/freeipa/c/9cb8984112ff31721b71dcdd4febcc23c2641691 commit] * ipatests: add test_trust suite to nightly runs [https://pagure.io/freeipa/c/0ff0ab85a8b1d90fb94e09bdbb3e9eeeb11d191a commit] * ipatests: add check for output contents of ipa-client-samba [https://pagure.io/freeipa/c/577dd1e47a092cf7e4527707111d28297bb58f53 commit] [https://pagure.io/freeipa/issue/8149 #8149] * ipatests: add test_winsyncmigrate suite to nightly runs [https://pagure.io/freeipa/c/72e1b135b3862a16df4e8b5a1a7c2bbfcd5b08c9 commit] === Sumedh Sidhaye (1) === * Added a test to check if ipa host-find --pkey-only does not return SSH public key [https://pagure.io/freeipa/c/2cd67d5a9a22c009f050e493d4b3e2882dbfd81f commit] [https://pagure.io/freeipa/issue/8029 #8029] === Serhii Tsymbaliuk (2) === * WebUI tests: Fix broken reference to parent facet in table record check [https://pagure.io/freeipa/c/4e1d27c22a90d579a9019829f8ffd0bed51c2e5f commit] [https://pagure.io/freeipa/issue/8157 #8157] * WebUI tests: Fix 'Button is not displayed' exception [https://pagure.io/freeipa/c/664eed7d0885791a3b16ad082d56f9a14682673e commit] [https://pagure.io/freeipa/issue/8169 #8169] === sumenon (3) === * ipatests: check that ipa-healthcheck warns if no dna range is set [https://pagure.io/freeipa/c/59bd2fec85a49ff75fbcad05cfd5a641a67c5d56 commit] * Nightly definition for ipa-healthcheck tool [https://pagure.io/freeipa/c/7a45cd179f846920ffa91df7f28f21e7de09f328 commit] * Tier-1 test for ipa-healthcheck tool [https://pagure.io/freeipa/c/a6dae4843c2fbaba984bf6bd3add6e2b62b1f59f commit] === Thomas Woerner (2) === * ipaserver/plugins/hbacrule: Add HBAC to memberservice_hbacsvc* labels [https://pagure.io/freeipa/c/8b5dc6a29e5e1893f9ec864bdde1f769ad6efc39 commit] * DNS install check: Fix overlapping DNS zone from the master itself [https://pagure.io/freeipa/c/2c2cef7063315766d893b275185b422be3f3c019 commit] [https://pagure.io/freeipa/issue/8150 #8150] === Vit Mojzis (3) === * selinux: Remove obsolete memcached access [https://pagure.io/freeipa/c/96565414b3fd1e2c946b21f205a3ac3c4b5bad0c commit] * selinux: move BUILD_SELINUX_POLICY definition [https://pagure.io/freeipa/c/bb6a5a5d9f850bde9b8d81c2dd51d41263c22cd4 commit] * Add freeipa-selinux subpackage [https://pagure.io/freeipa/c/4ca100999b691c22ff63154edd32af0e8040ef1f commit] -- / Alexander Bokovoy Sr. Principal Software Engineer Security / Identity Management Engineering Red Hat Limited, Finland

1 1

Re: Some users unable to log in to host
by Kristian Petersen 17 Mar '20

17 Mar '20

I ran that and the sshd service shows access granted True even though ssh-ing in doesn't work. Does the user have to have both login and sshd to login via ssh? Other users that have the same permissions are able to get in OK which is why this is so confusing. On Tue, Mar 17, 2020 at 1:04 AM Angus Clarke <post(a)angusclarke.com> wrote: > Hello > > I suggest running the hbactest function, somrthing like: > > ipa hbactest --user=user1 --host=fqdn.of.target.server --service=login > > Regards > Angus > > ------------------------------ > *From:* Kristian Petersen via FreeIPA-users < > freeipa-users(a)lists.fedorahosted.org> > *Sent:* 16 March 2020 21:57 > *To:* FreeIPA users list <freeipa-users(a)lists.fedorahosted.org> > *Cc:* Kristian Petersen <nesretep(a)chem.byu.edu> > *Subject:* [Freeipa-users] Some users unable to log in to host > > Hey all, > > I have a user that is trying to log into a host that is configured to have > access restricted via an HBAC rule. This user is a member of one of the > groups defined in the HBAC rule that should be granted access. When this > user tries to SSH in to this host, they get 3 consecutive password prompts > like "Password:" and then one like "username@domain's password:" and then > they get a response of "Permission denied, please try again." I am not > seeing any entries in the messages log or secure log for this user from > these log in attempts. Anyone have any thoughts about why this is > happening? > -- > Kristian Petersen > System Administrator > BYU Dept. of Chemistry and Biochemistry > -- Kristian Petersen System Administrator BYU Dept. of Chemistry and Biochemistry

2 1

setup_pr_read_pds - Not listening for new connections - too many fds open
by Lukasz Jaworski 17 Mar '20

17 Mar '20

Hi, I've upgraded freeipa 4.6.x environment on Fedora 27 to 4.8.4 on fedora 31. - remove old replica - install fedora 31 - connect as new replica... now: 389-ds-base-1.4.2.8-3.fc31.x86_64 freeipa-server-4.8.4-2.fc31.x86_64 after that, I have many errors: setup_pr_read_pds - Not listening for new connections - too many fds open It looks like fd limit 1024 I've checked: nsslapd-maxdescriptors: ldapsearch -xLLL -b "cn=config" -D 'cn=Directory Manager' -W cn=config nsslapd-maxdescriptors Enter LDAP Password: dn: cn=config nsslapd-maxdescriptors: 524288 /proc/limits: cat /proc/2164872/limits Limit Soft Limit Hard Limit Units Max cpu time unlimited unlimited seconds Max file size unlimited unlimited bytes Max data size unlimited unlimited bytes Max stack size 8388608 unlimited bytes Max core file size unlimited unlimited bytes Max resident set unlimited unlimited bytes Max processes 515206 515206 processes Max open files 524288 524288 files Max locked memory 65536 65536 bytes Max address space unlimited unlimited bytes Max file locks unlimited unlimited locks Max pending signals 515206 515206 signals Max msgqueue size 819200 819200 bytes Max nice priority 0 0 Max realtime priority 0 0 Max realtime timeout unlimited unlimited us dirsrv log: [17/Mar/2020:09:12:18.119324801 +0100] - INFO - main - Setting the maximum file descriptor limit to: 524288 find /proc/2164872/fd | wc -l 1037 It looks like 1024 is connection limit. Any idea what I've done wrong? Best regards, Ender - Lukasz Jaworski

2 3

Re: Expired Certificates, rolling back time didn't help
by Florence Blanc-Renaud 17 Mar '20

17 Mar '20

On 3/16/20 11:44 PM, Bhavin Vaidya via FreeIPA-users wrote: > Hello, > > We had similar issue 2 yrs back, and resurface as it didn't auto-renew. > Went back in time to 2016-06-11 as well as 2020-02-20, restarted > "certmonger", didn't update. > Hi, you need to check first which server is your renewal master: $ kinit admin $ ipa config-show | grep renewal The output should display the name of the renewal master. This host is the first server that needs to be fixed. In the getcert list output that you provided, we can see that: - the PKI certificates shared between the servers expired on 2020-02-25 (auditSigningCert cert-pki-ca, ocspSigningCert cert-pki-ca, subsystemCert cert-ki-ca) - the CA cert is still valid - the RA cert expired on 2018-06-15 - the HTTP and LDAP server certs expired on 2020-03-07 You need to carefully pick the date you go back in time: at that given date, all the certs must be valid (not expired yet but *already valid*). From your output, the date needs to be before 2018-06-15 but after 2018-03-08 (=the validFrom date for the PKI certs). HTH, flo > FreeIPA Master:*CentOS 7.4.1708, FreeIPA Version: **4.5.0, > API_VERSION: 2.228* > > whileipactl start, it will not start pki-tomcat with > message,pki-tomcatd Service: STOPPED. > > Referring toRob's blog > <https://rcritten.wordpress.com/2017/09/20/peer-certificate-cannot-be-authen…> > > [root@srv01 ~]# curl --cacert /etc/ipa/ca.crt > -v[https://%60hostname%60:8443/ca/ww/ca/getCertChain]https://`hostname`:8443/ca/ww/ca/getCertChain > > * About to connect() to srv01.example.com port 8443 (#0) > > *Trying 192.168.10.146... > > * Connected to srv01.example.com (192.168.10.146) port 8443 (#0) > > * Initializing NSS with certpath: sql:/etc/pki/nssdb > > *CAfile: /etc/ipa/ca.crt > > CApath: none > > * Server certificate: > > *subject: CN=srv01.example.com,O=EXAMPLE.COM > > *start date: Dec 26 21:02:44 2016 GMT > > *expire date: Dec 16 21:02:44 2018 GMT > > *common name: srv01.example.com > > *issuer: CN=Certificate Authority,O=EXAMPLE.COM > > * NSS error -8172 (SEC_ERROR_UNTRUSTED_ISSUER) > > * Peer's certificate issuer has been marked as not trusted by the user. > > * Closing connection 0 > > curl: (60) Peer's certificate issuer has been marked as not trusted by > the user. > > More details here:http://curl.haxx.se/docs/sslcerts.html > > curl performs SSL certificate verification by default, using a "bundle" > > of Certificate Authority (CA) public keys (CA certs). If the > defaultbundle file isn't adequate, you can specify an alternate > fileusing the --cacert option. > > If this HTTPS server uses a certificate signed by a CA represented > inthe bundle, the certificate verification probably failed due to > aproblem with the certificate (it might be expired, or the name > mightnot match the domain name in the URL). > > If you'd like to turn off curl's verification of the certificate, > usethe -k (or --insecure) option. > > > While, CA cert check asper > <https://www.freeipa.org/page/V4/CA_certificate_renewal>, > > [root@srv01 ~]# getcert list -d /etc/pki/pki-tomcat/alias -n > 'caSigningCert cert-pki-ca' > > Number of certificates and requests being tracked: 8. > > Request ID '20180315021502': > > status: MONITORING > > stuck: no > > key pair storage: > type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert > cert-pki-ca',token='NSS Certificate DB',pin set > > certificate: > type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert > cert-pki-ca',token='NSS Certificate DB' > > CA: dogtag-ipa-ca-renew-agent > > issuer: CN=Certificate Authority,O=EXAMPLE.COM > > subject: CN=Certificate Authority,O=EXAMPLE.COM > > expires: 2038-03-07 03:47:46 UTC > > key usage: digitalSignature,nonRepudiation,keyCertSign,cRLSign > > pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad > > post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert > "caSigningCert cert-pki-ca" > > track: yes > > auto-renew: yes > > We also have few others certificates, which are not renewed. > > > [root@srv01 ~]# getcert list > > Number of certificates and requests being tracked: 8. > > Request ID '20180228053337': > > status: MONITORING > > stuck: no > > key pair storage: type=FILE,location='/var/kerberos/krb5kdc/kdc.key' > > certificate: type=FILE,location='/var/kerberos/krb5kdc/kdc.crt' > > CA: SelfSign > > issuer: CN=srv01.example.com,O=EXAMPLE.COM > > subject: CN=srv01.example.com,O=EXAMPLE.COM > > expires: 2021-01-11 21:56:57 UTC > > principal name:krbtgt/EXAMPLE.COM@EXAMPLE.COM > <mailto:krbtgt/EXAMPLE.COM@EXAMPLE.COM> > > certificate template/profile: KDCs_PKINIT_Certs > > pre-save command: > > post-save command: /usr/libexec/ipa/certmonger/renew_kdc_cert > > track: yes > > auto-renew: yes > > Request ID '20180315021457': > > status: MONITORING > > stuck: no > > key pair storage: > type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert > cert-pki-ca',token='NSS Certificate DB',pin set > > certificate: > type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert > cert-pki-ca',token='NSS Certificate DB' > > CA: dogtag-ipa-ca-renew-agent > > issuer: CN=Certificate Authority,O=EXAMPLE.COM > > subject: CN=CA Audit,O=EXAMPLE.COM > > expires: 2020-02-25 04:27:49 UTC > > key usage: digitalSignature,nonRepudiation > > pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad > > post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert > "auditSigningCert cert-pki-ca" > > track: yes > > auto-renew: yes > > Request ID '20180315021500': > > status: MONITORING > > stuck: no > > key pair storage: > type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert > cert-pki-ca',token='NSS Certificate DB',

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users March 2020