April 2020 - FreeIPA-users - Fedora mailing-lists

IPA DNS ACL (respond with a different IP depending on the requester)
by Daniel PC 24 Oct '25

24 Oct '25

I would like to configure DNS to respond with a different IP depending on the requester source IP. Bind allow it using ACL. Do you know if it is possible to implement this feature on IPA integrated DNS? thank you

3 4

ipa-replica-install -- cannot get past [26/41]: creating DS keytab
by Jonathon Jenkins 10 Jun '25

10 Jun '25

Greetings, I cannot get the ipa-replica-install to proceed past step 26/41 - creating DS keytab. I see the command that is to be run, and I can run that just fine before and after the ipa-replica-install command, and it creates the keytab. I am not sure how to proceed from here - the bug reports I see all pertain to earlier versions, and my files reflect those changes. I have also tried running this with all manner of password flags, which are correct, but still getting insufficient access rights. particulars: centos 7 3.10.0-957.1.3.el7.x86_64 ipa-server-4.6.4-10.el7.centos.x86_64 ipa-common-4.6.4-10.el7.centos.noarch ipa-server-common-4.6.4-10.el7.centos.noarch ipa-client-4.6.4-10.el7.centos.x86_64 ipa-server-dns-4.6.4-10.el7.centos.noarch ipa-client-common-4.6.4-10.el7.centos.noarch * Note: anonymized output below ipapython.ipautil: DEBUG stderr= ipalib.backend: DEBUG Created connection context.ldap2_139891568509776 ipaserver.install.service: DEBUG duration: 7 seconds ipaserver.install.service: DEBUG [26/41]: creating DS keytab [26/41]: creating DS keytab ipalib.frontend: DEBUG raw: service_add(u'ldap/<ipa-replica-host>@<domain>.NET', force=True, version=u'2.229') ipalib.frontend: DEBUG service_add(ipapython.kerberos.Principal('ldap/<ipa-replica-host>@<domain>.NET'), force=True, all=False, raw=False, version=u'2.229', no_members=False) ipalib.frontend: DEBUG raw: host_show(u'<ipa-replica-host>', version=u'2.229') ipalib.frontend: DEBUG host_show(u'<ipa-replica-host>', rights=False, all=False, raw=False, version=u'2.229', no_members=False) ipalib.install.sysrestore: DEBUG Backing up system configuration file '/etc/dirsrv/ds.keytab' ipalib.install.sysrestore: DEBUG -> Not backing up - '/etc/dirsrv/ds.keytab' doesn't exist ipapython.ipautil: DEBUG Starting external process ipapython.ipautil: DEBUG args=/usr/sbin/ipa-getkeytab -k /etc/dirsrv/ds.keytab -p ldap/<ipa-replica-host>@<domain>.NET -H ldaps://<ipa-replica-master> ipapython.ipautil: DEBUG Process finished, return code=9 ipapython.ipautil: DEBUG stdout= ipapython.ipautil: DEBUG stderr=Failed to parse result: Insufficient access rights Retrying with pre-4.0 keytab retrieval method... Failed to parse result: Insufficient access rights Failed to get keytab! Failed to get keytab ipaserver.install.service: DEBUG Traceback (most recent call last): File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 570, in start_creation run_step(full_msg, method) File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 560, in run_step method() File "/usr/lib/python2.7/site-packages/ipaserver/install/dsinstance.py", line 1308, in request_service_keytab super(DsInstance, self).request_service_keytab() File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 742, in request_service_keytab self.run_getkeytab(self.api.env.ldap_uri, self.keytab, self.principal) File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 732, in run_getkeytab ipautil.run(args, nolog=nolog) File "/usr/lib/python2.7/site-packages/ipapython/ipautil.py", line 562, in run raise CalledProcessError(p.returncode, arg_string, str(output)) CalledProcessError: Command '/usr/sbin/ipa-getkeytab -k /etc/dirsrv/ds.keytab -p ldap/<ipa-replica-host>@<domain>.NET -H ldaps://<ipa-replica-master>' returned non-zero exit status 9 ipaserver.install.service: DEBUG [error] CalledProcessError: Command '/usr/sbin/ipa-getkeytab -k /etc/dirsrv/ds.keytab -p ldap/<ipa-replica-host>@<domain>.NET -H ldaps://<ipa-replica-master>' returned non-zero exit status 9 [error] CalledProcessError: Command '/usr/sbin/ipa-getkeytab -k /etc/dirsrv/ds.keytab -p ldap/<ipa-replica-host>@<domain>.NET -H ldaps://<ipa-replica-master>' returned non-zero exit status 9 ipalib.backend: DEBUG Destroyed connection context.ldap2_139891548583120 ipalib.install.sysrestore: DEBUG Backing up system configuration file '/etc/ipa/default.conf' ipalib.install.sysrestore: DEBUG Saving Index File to '/var/lib/ipa/sysrestore/sysrestore.index' Your system may be partly configured. Run /usr/sbin/ipa-server-install --uninstall to clean up. ipapython.admintool: DEBUG File "/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 178, in execute return_value = self.run() File "/usr/lib/python2.7/site-packages/ipapython/install/cli.py", line 319, in run return cfgr.run() File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 364, in run return self.execute() File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 389, in execute for rval in self._executor(): File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 434, in __runner exc_handler(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 463, in _handle_execute_exception self._handle_exception(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 453, in _handle_exception six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 424, in __runner step() File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 421, in <lambda> step = lambda: next(self.__gen) File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from value = gen.send(prev_value) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 658, in _configure next(executor) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 434, in __runner exc_handler(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 463, in _handle_execute_exception self._handle_exception(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 521, in _handle_exception self.__parent._handle_exception(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 453, in _handle_exception six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 518, in _handle_exception super(ComponentBase, self)._handle_exception(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 453, in _handle_exception six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 424, in __runner step() File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 421, in <lambda> step = lambda: next(self.__gen) File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from value = gen.send(prev_value) File "/usr/lib/python2.7/site-packages/ipapython/install/common.py", line 65, in _install for unused in self._installer(self.parent): File "/usr/lib/python2.7/site-packages/ipaserver/install/server/__init__.py", line 622, in main replica_install(self) File "/usr/lib/python2.7/site-packages/ipaserver/install/server/replicainstall.py", line 406, in decorated func(installer) File "/usr/lib/python2.7/site-packages/ipaserver/install/server/replicainstall.py", line 1431, in install fstore=fstore) File "/usr/lib/python2.7/site-packages/ipaserver/install/server/replicainstall.py", line 113, in install_replica_ds setup_pkinit=not options.no_pkinit, File "/usr/lib/python2.7/site-packages/ipaserver/install/dsinstance.py", line 419, in create_replica self.start_creation(runtime=30) File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 570, in start_creation run_step(full_msg, method) File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 560, in run_step method() File "/usr/lib/python2.7/site-packages/ipaserver/install/dsinstance.py", line 1308, in request_service_keytab super(DsInstance, self).request_service_keytab() File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 742, in request_service_keytab self.run_getkeytab(self.api.env.ldap_uri, self.keytab, self.principal) File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 732, in run_getkeytab ipautil.run(args, nolog=nolog) File "/usr/lib/python2.7/site-packages/ipapython/ipautil.py", line 562, in run raise CalledProcessError(p.returncode, arg_string, str(output)) ipapython.admintool: DEBUG The ipa-replica-install command failed, exception: CalledProcessError: Command '/usr/sbin/ipa-getkeytab -k /etc/dirsrv/ds.keytab -p ldap/<ipa-replica-host>@<domain>.NET -H ldaps://<ipa-replica-master>' returned non-zero exit status 9 ipapython.admintool: ERROR Command '/usr/sbin/ipa-getkeytab -k /etc/dirsrv/ds.keytab -p ldap/<ipa-replica-host>@<domain>.NET -H ldaps://<ipa-replica-master>' returned non-zero exit status 9 ipapython.admintool: ERROR The ipa-replica-install command failed. See /var/log/ipareplica-install.log for more information

3 4

Removal & clean up certificates from o=ipaca
by David Goudet 30 Sep '24

30 Sep '24

Hello all, I have to clean up lot of useless certificate in dirsrv database. Because of resubmit loop on Certmonger client, i have 99,9% of certificate in dirsrv database that are useless and not obsolete (expiration in 2020) (it represent ~85 000 certificates). These useless certificates produce some issues on FreeIPA: - decrease FreeIPA performances on CLI and GUI - increase the LDAP size - increase size and time of FreeIPA backup ... Is it possible to purge these certificates in dirsrv database and how? I found two branches in LDAP directory about these certificates: dn: cn=xxx,ou=ca,ou=requests,o=ipaca dn: cn=yyy,ou=certificateRepository,ou=ca,o=ipaca I can remove all requests and certificates entry from dirsrv database but how it is supported by PKI manager Dogtag (CRL, certificate generation, OCSP)? (This topic has already been discuss on https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost…) Thank you for you help -- David GOUDET LYRA NETWORK IT Operations service Tel : +33 (0)5 32 09 09 74 | Poste : 574

4 7

How to prevent non-admin users of FreeIPA from reading the list of users in the web interface?
by cdknight 16 Apr '24

16 Apr '24

When a user signs in to FreeIPA, I do not want them to be able to view the list of users in my LDAP server under the "Active users" link. I still want them to be able to administer self-service, so they can reset their password, add OTP tokens, etc. How would I go about doing this? The users will only be able to access the web interface, so it doesn't matter whether they can access it from other sources.

5 10

certmonger error on ubuntu
by Robson Francisco de Souza 07 Feb '24

07 Feb '24

Hello! I've been running FreeIPA 4.3.1 on Ubuntu 16.04 for almost two years and most certificates should expire within three weeks. As this deadline approaches, I noticed certmonger has been unable to renew certificates due to the error below. After googling for two days, I found this issue has been observed by many people before, mostly after expiration of the certificates, as in https://tinyurl.com/vajmocw Still, I couldn't find a solution to this problem. If it is impossible to fix this issue while using FreeIPA 4.3.1, I would like to: 1) Find a way to renew all certificates even if certmonger can't be fixed. This would allow me to postpone the solution to after the next OS and/or FreeIPA upgrade 2) Find out what version of FreeIPA I should upgrade to while the operating system remains Ubuntu 16.04 Any help would be appreciated! Thanks! Robson ======> Command: systemctl status certmonger Nov 17 20:53:08 ipa.cefapnet.icb.usp.br certmonger[3873125]: 2019-11-17 20:53:08 [3873125] Error 77 connecting to https://ipa.cefapnet.icb.usp.br:8443/ca/agent/ca/profileReview: Problem with the SSL CA cert (path? access rights?). Nov 17 21:10:13 ipa.cefapnet.icb.usp.br dogtag-ipa-ca-renew-agent-submit[3875188]: Forwarding request to dogtag-ipa-renew-agent Nov 17 21:10:13 ipa.cefapnet.icb.usp.br dogtag-ipa-ca-renew-agent-submit[3875188]: dogtag-ipa-renew-agent returned 3 Nov 17 21:10:13 ipa.cefapnet.icb.usp.br certmonger[3873125]: 2019-11-17 21:10:13 [3873125] Error 77 connecting to https://ipa.cefapnet.icb.usp.br:8443/ca/agent/ca/profileReview: Problem with the SSL CA cert (path? access rights?). Nov 17 21:25:20 ipa.cefapnet.icb.usp.br dogtag-ipa-ca-renew-agent-submit[3875738]: Forwarding request to dogtag-ipa-renew-agent Nov 17 21:25:20 ipa.cefapnet.icb.usp.br dogtag-ipa-ca-renew-agent-submit[3875738]: dogtag-ipa-renew-agent returned 3 Nov 17 21:25:21 ipa.cefapnet.icb.usp.br certmonger[3873125]: 2019-11-17 21:25:21 [3873125] Error 77 connecting to https://ipa.cefapnet.icb.usp.br:8443/ca/agent/ca/profileReview: Problem with the SSL CA cert (path? access rights?). Nov 17 21:25:31 ipa.cefapnet.icb.usp.br dogtag-ipa-ca-renew-agent-submit[3875766]: Forwarding request to dogtag-ipa-renew-agent Nov 17 21:25:31 ipa.cefapnet.icb.usp.br dogtag-ipa-ca-renew-agent-submit[3875766]: dogtag-ipa-renew-agent returned 3 Nov 17 21:25:31 ipa.cefapnet.icb.usp.br certmonger[3873125]: 2019-11-17 21:25:31 [3873125] Error 77 connecting to https://ipa.cefapnet.icb.usp.br:8443/ca/agent/ca/profileReview: Problem with the SSL CA cert (path? access rights?). -- Robson Francisco de Souza, PhD Laboratório de Estrutura e Evolução de Proteínas (LEEP/PSEL) Departamento de Microbiologia Instituto de Ciências Biomédicas Universidade de São Paulo Av. Prof. Lineu Prestes, 1374 - Ed. Biomédicas II - Sala 250 - 2o. andar Tel: 3091-0891 Cidade Universitária - CEP 05508-900 - São Paulo - SP - Brasil ---- Robson Francisco de Souza, PhD Protein Structure and Evolution Laboratory (LEEP/PSEL) Microbiology Departament Biomedical Sciences Institute University of Sao Paulo Av. Prof. Lineu Prestes, 1374 - Biomédicas II - Sala 250 Phone: 55-11-3091-0891 Cidade Universitária - ZIP 05508-900 - São Paulo - SP - Brazil

6 10

FreeIPA web session timeout
by Yuri Krysko 10 Jan '24

10 Jan '24

Hello, Could you please advise how to configure FreeIPA web UI user session timeout? Thanks, Yuri ________________________________ LEGAL DISCLAIMER: M.C. Dean, Inc. and its subsidiaries considers this e-mail and any files transmitted with it to be protected, proprietary or privileged information intended solely for the use of the named recipient(s). Any disclosure of this material or the information contained herein, in whole or in part, to anyone outside of the intended recipient or affiliates is strictly prohibited. M. C. Dean, Inc. accepts no liability for the content of this e-mail or for the consequences of any actions taken on the basis of the information contained in it, unless that information is subsequently confirmed in writing. Employees of M.C. Dean, Inc. are instructed not to infringe on any rights of the recipient; any such communication violates company policy. If you are not the intended recipient, any disclosure, copying, distribution, or action taken or omitted in reliance on this information is strictly prohibited by M.C. Dean, Inc.; please notify the sender immediately by return e-mail, delete this communication and destroy all copies.

4 4

Allow sysaccount to view its own entry
by Adam Bishop 09 Nov '23

09 Nov '23

I have a piece of software that tries to look up its own uid to check that LDAP is correctly configured. This check fails because the sysaccount cannot view anything under cn=etc,cn=sysaccounts. Is there an existing permission/privilege that I can use to allow it to read the sysaccounts tree (or better, just its own entry)? Many Thanks, Adam Bishop

4 3

kinit: KDC can't fulfill requested option while renewing credentials - which approach?
by Pieter Baele 19 Sep '23

19 Sep '23

I tried various approached to get Renewable tickets : modifying the kdc modifying krb5.conf using kadmin.local on every replica to modify the principal; which is not working - as designed (?)- in IPA What should I do to get a ticket with the correct R flag from IPA ? I don't think this is SSSD related (the service needing the renewable ticket this way is Apache Storm) Thanks a lot!

3 4

Do keytabs expire?
by Ronald Wimmer 07 Jun '23

07 Jun '23

Hi, today I found out that some entries in a keytab file seemed to have expired: Request ticket server HTTP/mwc.linux.mydomain.at(a)LINUX.MYDOMAIN.AT kvno 4 not found in keytab; keytab is likely out of date Fetching the keytab again with ipa-getkeytab fixed the problem. But why is this happening? Do keytab entries expire? I have not set any custom password or ticket policies. Regards, Ronald

4 13

ipa-replica-install fails when I use custom certificates
by Peter Tselios 08 Feb '23

08 Feb '23

I have installed the ipa server by using the following command: --------- ipa-server-install --realm "EXAMPLE.COM" -p 'password' -a 'password' --hostname="server.example.com" -n example.com --ip-address="10.1.4.2" --dirsrv-cert-file=/etc/pki/tls/private/example.com.pem --dirsrv-cert-file=/etc/pki/tls/certs/example.com.crt --dirsrv-pin='' --http-cert-file=/etc/pki/tls/certs/example.com.crt --http-cert-file=/etc/pki/tls/private/example.com.pem --http-pin='' --ca-cert-file=/etc/pki/ca-trust/source/anchors/myca.pem --ca-cert-file=/etc/pki/ca-trust/source/anchors/mysubca.pem --mkhomedir -N --no-host-dns --unattended --------- Which works perfectly fine. However, I cannot make it work with ipa-replica-install since there is no option for --ca-cert-file. So, how can I install a replica with custom certificates?

6 12

Problem running IPA client on IPv6 only connection
by William Muriithi 26 Jul '22

26 Jul '22

Hello, I have an IPA clients that has both IPv4 and IPv6 addresses. One of the IPA client is in the office and hence can reach the IPA server on both IPv4 and IPv6. However, the client outside the LAN can only reach the IPA server over IPv6. I was able to enroll the external client fine over IPv6 and from the logs, all clean. However, when I attempted to ssh, its not able to retreave the user from IPA. The client in the office works fine. I can also make for example LDAP queries and they work over IPv6 fine. It looks like kerberos is somehow however using IPv4. I reached this conclusion after taking a tcpdump when attempting to ssh to the server and the kerberos traffic from the client to IPA is on IPv4. What would I need to do on the IPA client for it to prefer IPv6? I am aware I could remove IPv4 address from DNS, but that would break any communication from IPv4 only systems. Any assistance would be appreaciated. [william@ansible ~]$ ssh root(a)mars.external.example.com Last login: Mon Jan 7 17:19:49 2019 from 65.98.193.94 [root@mars ~]# kinit admin kinit: Cannot contact any KDC for realm 'EXTERNAL.EXAMPLE.COM <http://external.example.com/>' while getting initial credentials [root@mars ~]# ldapsearch -x -b cn=ftp,cn=groups,cn=compat,dc=external,dc=example,dc=com | tail -n 4 result: 0 Success # numResponses: 2 # numEntries: 1 [root@mars ~]# cat /etc/resolv.conf search external.example.com nameserver 2607:4860:6000:a::5 [root@mars ~]# Regards, William

5 10

Could not login with AD user
by Ronald Wimmer 20 Jul '22

20 Jul '22

Today I was not able to log in with an AD user to an IPA client within a test setup. IPA users worked fine. DNS is managed externally. I figured out that the DNS-Record of that particular IPA client has not been created correctly. After having corrected the DNS entry and having dropped the SSSD cache on that client I could login with my AD user. Do you have an explanation for that or was it just a coincidence? Cheers, Ronald

4 13

freeipa/certmonger for openvpn user certificates
by Patrick Spinler 27 Jun '22

27 Jun '22

Hi, I'm setting up an openvpn server and I'd like to use our already existing FreeIPA CA to issue user keys/certs for openvpn's use. Since our OpenVPN box is a freeipa client, I thought it'd be nice to use certmonger to issue and keep up to date these certs. Ergo, I've created a certificate profile: pat@apex-freeipa ~$ ipa certprofile-show --all OpenVPNUserCert dn: cn=OpenVPNUserCert,cn=certprofiles,cn=ca,dc=int,dc=apexmw,dc=com Profile ID: OpenVPNUserCert Profile description: OpenVPN User Certificates Store issued certificates: FALSE objectclass: ipacertprofile, top And also a CA acl. For experimentation (and working vs our test freeipa) I've left this as wide open as I can: [pat@apex-freeipa ~]$ ipa caacl-show --all OpenVPN_User_Certificate_ACL dn: ipaUniqueID=6dde33a6-7849-11e9-aa05-525400b52c7b,cn=caacls,cn=ca,dc=int,dc=apexmw,dc=com ACL name: OpenVPN_User_Certificate_ACL Enabled: TRUE CA category: all Profile category: all User category: all Host category: all Service category: all ipauniqueid: 6dde33a6-7849-11e9-aa05-525400b52c7b objectclass: ipaassociation, ipacaacl Then, on my openvpn server, I ask for a cert for use for one of my users (myself, in this case): root@apex-openvpn:~# ipa-getcert request -f /etc/openvpn/client/pat.crt -k /etc/openvpn/client/pat.key -r -N 'CN=pat,O=INT.APEXMW.COM' -K pat -g 4096 --profile OpenVPNUserCert New signing request "20190603014016" added. But, it fails due to an access err vs the 'userCertificate' attribute of my account: root@apex-openvpn:~# ipa-getcert list (...snippy snip excess...) Request ID '20190603014016': status: CA_REJECTED ca-error: Server at https://apex-freeipa.int.apexmw.com/ipa/xml denied our request, giving up: 2100 (RPC failed at server. Insufficient access: Insufficient 'write' privilege to the 'userCertificate' attribute of entry 'uid=pat,cn=users,cn=accounts,dc=int,dc=apexmw,dc=com'.). stuck: yes key pair storage: type=FILE,location='/etc/openvpn/client/pat.key' certificate: type=FILE,location='/etc/openvpn/client/pat.crt' CA: IPA issuer: subject: expires: unknown pre-save command: post-save command: track: yes auto-renew: yes If I look at the dirsrv log, here's the accesses I see for this request (trimmed off the date/time to make the lines a _little_ shorter): root@apex-freeipa slapd-INT-APEXMW-COM# grep conn=178 access | cut -d' ' -f3- conn=178 fd=114 slot=114 connection from 10.10.200.1 to 10.10.200.1 conn=178 op=0 BIND dn="" method=sasl version=3 mech=GSS-SPNEGO conn=178 op=0 RESULT err=0 tag=97 nentries=0 etime=0.0025554208 dn="fqdn=apex-openvpn.int.apexmw.com,cn=computers,cn=accounts,dc=int,dc=apexmw,dc=com" conn=178 op=1 SRCH base="cn=ipaconfig,cn=etc,dc=int,dc=apexmw,dc=com" scope=0 filter="(objectClass=*)" attrs=ALL conn=178 op=1 RESULT err=0 tag=101 nentries=1 etime=0.0001319554 conn=178 op=2 SRCH base="cn=masters,cn=ipa,cn=etc,dc=int,dc=apexmw,dc=com" scope=2 filter="(&(objectClass=ipaConfigObject)(cn=CA))" attrs=ALL conn=178 op=2 RESULT err=0 tag=101 nentries=1 etime=0.0000979573 conn=178 op=3 SRCH base="cn=masters,cn=ipa,cn=etc,dc=int,dc=apexmw,dc=com" scope=2 filter="(&(objectClass=ipaConfigObject)(cn=CA))" attrs=ALL conn=178 op=3 RESULT err=0 tag=101 nentries=1 etime=0.0000736730 conn=178 op=4 SRCH base="cn=cas,cn=ca,dc=int,dc=apexmw,dc=com" scope=2 filter="(&(objectClass=ipaca)(cn=ipa))" attrs="" conn=178 op=4 RESULT err=0 tag=101 nentries=1 etime=0.0000499142 conn=178 op=5 SRCH base="cn=ipa,cn=cas,cn=ca,dc=int,dc=apexmw,dc=com" scope=0 filter="(objectClass=*)" attrs="ipaCaId ipaCaSubjectDN cn ipaCaIssuerDN description" conn=178 op=5 RESULT err=0 tag=101 nentries=1 etime=0.0000482726 conn=178 op=6 SRCH base="cn=apex-freeipa.int.apexmw.com,cn=masters,cn=ipa,cn=etc,dc=int,dc=apexmw,dc=com" scope=2 filter="(&(objectClass=ipaConfigObject)(ipaConfigString=enabledService)(cn=CA))" attrs=ALL conn=178 op=6 RESULT err=0 tag=101 nentries=1 etime=0.0000950646 notes=U conn=178 op=7 SRCH base="cn=accounts,dc=int,dc=apexmw,dc=com" scope=2 filter="(&(objectClass=krbprincipalaux)(krbPrincipalName=pat(a)INT.APEXMW.COM))" attrs=ALL conn=178 op=7 RESULT err=0 tag=101 nentries=1 etime=0.0002747849 conn=178 op=8 EXT oid="1.3.6.1.4.1.4203.1.11.3" name="whoami-plugin" conn=178 op=8 RESULT err=0 tag=120 nentries=0 etime=0.0000135034 conn=178 op=9 SRCH base="cn=request certificate ignore caacl,cn=virtual operations,cn=etc,dc=int,dc=apexmw,dc=com" scope=0 filter="(objectClass=*)" attrs="objectClass" conn=178 op=9 RESULT err=0 tag=101 nentries=1 etime=0.0000932668 - entryLevelRights: none conn=178 op=10 SRCH base="uid=pat,cn=users,cn=accounts,dc=int,dc=apexmw,dc=com" scope=0 filter="(objectClass=*)" attrs="distinguishedName" conn=178 op=10 RESULT err=0 tag=101 nentries=1 etime=0.0000640289 conn=178 op=11 SRCH base="uid=pat,cn=users,cn=accounts,dc=int,dc=apexmw,dc=com" scope=0 filter="(objectClass=*)" attrs="telephoneNumber ipaSshPubKey uid krbCanonicalName ipatokenRadiusUserName ipaUserAuthType krbPrincipalExpiration homeDirectory nsAccountLock usercertificate;binary title loginShell uidNumber mail ipaCertMapData memberOf memberofindirect krbPrincipalName givenName gidNumber sn ou userClass ipatokenRadiusConfigLink" conn=178 op=11 RESULT err=0 tag=101 nentries=1 etime=0.0001401737 conn=178 op=12 SRCH base="dc=int,dc=apexmw,dc=com" scope=2 filter="(|(member=uid=pat,cn=users,cn=accounts,dc=int,dc=apexmw,dc=com)(memberUser=uid=pat,cn=users,cn=accounts,dc=int,dc=apexmw,dc=com)(memberHost=uid=pat,cn=users,cn=accounts,dc=int,dc=apexmw,dc=com))" attrs="" conn=178 op=12 RESULT err=0 tag=101 nentries=7 etime=0.0001492344 notes=P pr_idx=0 pr_cookie=-1 conn=178 op=13 SRCH base="uid=pat,cn=users,cn=accounts,dc=int,dc=apexmw,dc=com" scope=0 filter="(userPassword=*)" attrs="userPassword" conn=178 op=13 RESULT err=0 tag=101 nentries=1 etime=0.0000524838 conn=178 op=14 SRCH base="uid=pat,cn=users,cn=accounts,dc=int,dc=apexmw,dc=com" scope=0 filter="(krbPrincipalKey=*)" attrs="krbPrincipalKey" conn=178 op=14 RESULT err=0 tag=101 nentries=1 etime=0.0000597589 conn=178 op=15 SRCH base="ipaUniqueID=80b23b30-6a0c-11e9-baa3-525400b52c7b,cn=sudorules,cn=sudo,dc=int,dc=apexmw,dc=com" scope=0 filter="(objectClass=*)" attrs="cn" conn=178 op=15 RESULT err=0 tag=101 nentries=1 etime=0.0000379744 conn=178 op=16 SRCH base="ipaUniqueID=5fb3a640-705a-11e9-aa05-525400b52c7b,cn=hbac,dc=int,dc=apexmw,dc=com" scope=0 filter="(objectClass=*)" attrs="cn" conn=178 op=16 RESULT err=0 tag=101 nentries=1 etime=0.0000337904 conn=178 op=17 SRCH base="cn=caacls,cn=ca,dc=int,dc=apexmw,dc=com" scope=1 filter="(&(objectClass=ipaassociation)(objectClass=ipacaacl))" attrs="serviceCategory cn ipaMemberCertProfile ipaMemberCa ipaCertProfileCategory memberUser userCategory hostCategory memberHost ipaEnabledFlag ipaCaCategory memberService description" conn=178 op=17 RESULT err=0 tag=101 nentries=2 etime=0.0001647058 conn=178 op=18 EXT oid="1.3.6.1.4.1.4203.1.11.3" name="whoami-plugin" conn=178 op=18 RESULT err=0 tag=120 nentries=0 etime=0.0000138321 conn=178 op=19 SRCH base="uid=pat,cn=users,cn=accounts,dc=int,dc=apexmw,dc=com" scope=0 filter="(objectClass=*)" attrs="userCertificate" conn=178 op=19 RESULT err=0 tag=101 nentries=1 etime=0.0001475052 - entryLevelRights: none conn=178 op=20 UNBIND conn=178 op=20 fd=114 closed - U1 To begin with, I note that this session does a BIND with 'dn=""', right at the beginning, it's essentially an anonymous bind, yah? That operation near the end, here: op=17 SRCH base="cn=caacls,cn=ca,dc=int,dc=apexmw,dc=com" scope=1 filter="(&(objectClass=ipaassociation)(objectClass=ipacaacl))" seems like it might be kinda key. and indeed, if I attempt to run this by hand as an anonymous bind, I get no results: root@apex-freeipa slapd-INT-APEXMW-COM# ldapsearch -x -h localhost -b dc=int,dc=apexmw,dc=com -s sub "(|(objectClass=ipaassociation)(objectClass=ipacaacl))" # extended LDIF # # LDAPv3 # base <dc=int,dc=apexmw,dc=com> with scope subtree # filter: (|(objectClass=ipaassociation)(objectClass=ipacaacl)) # requesting: ALL # # search result search: 2 result: 0 Success # numResponses: 1 It's only if I run this as an _authenticated_ bind, that I can find my ACL: root@apex-freeipa slapd-INT-APEXMW-COM# ldapsearch -x -D "cn=Directory Manager" -W -h localhost -b dc=int,dc=apexmw,dc=com -s sub "(&(objectClass=ipaassociation)(objectClass=ipacaacl))" cn Enter LDAP Password: # extended LDIF # # LDAPv3 # base <dc=int,dc=apexmw,dc=com> with scope subtree # filter: (&(objectClass=ipaassociation)(objectClass=ipacaacl)) # requesting: cn # # c98b740c-6903-11e9-ad1b-525400b52c7b, caacls, ca, int.apexmw.com dn: ipaUniqueID=c98b740c-6903-11e9-ad1b-525400b52c7b,cn=caacls,cn=ca,dc=int,dc =apexmw,dc=com cn: hosts_services_caIPAserviceCert # 6dde33a6-7849-11e9-aa05-525400b52c7b, caacls, ca, int.apexmw.com dn: ipaUniqueID=6dde33a6-7849-11e9-aa05-525400b52c7b,cn=caacls,cn=ca,dc=int,dc =apexmw,dc=com cn: OpenVPN_User_Certificate_ACL # search result search: 2 result: 0 Success # numResponses: 3 # numEntries: 2 Is this (using certmonger to auto-issue signed certs/keys for my openvpn users) going to be essentially impossible to do, here? Do I need to go a more traditional route of creating a seperate keystore/certdb, issuing a CSR, and feeding that to FreeIPA to sign? Any advice appreciated, and thanks in advance, -- Pat

4 6

Broken ipa replica
by Giulio Casella 08 May '22

08 May '22

Hi everyone, I'm stuck with a broken replica. I had a setup with two ipa server in replica (ipa-server-4.6.4 on CentOS 7.6), let's say "idc01" and "idc02". Due to heavy load idc01 crashed many times, and was not working anymore. So I tried to redo the replica again. At first I tried to "ipa-replica-manage re-initialize", with no success. Now I'm trying to redo from scratch the replica setup: on idc02 I removed the segments (ipa topologysegment-del, for both ca and domain suffix), on idc01 I removed everything (ipa-server-install --uninstall), then I joined domain (ipa-client-install), and everything is working so far. When doing "ipa-replica-install" on idc01 I get: [...] [28/41]: setting up initial replication Starting replication, please wait until this has completed. Update in progress, 22 seconds elapsed [ldap://idc02.my.dom.ain:389] reports: Update failed! Status: [Error (-11) connection error: Unknown connection error (-11) - Total update aborted] And on idc02 (the working server), in /var/log/dirsrv/slapd-MY-DOM-AIN/errors I find lines stating: [20/Mar/2019:09:28:06.545187923 +0100] - INFO - NSMMReplicationPlugin - repl5_tot_run - Beginning total update of replica "agmt="cn=meToidc01.my.dom.ain" (idc01:389)". [20/Mar/2019:09:28:26.528046160 +0100] - ERR - NSMMReplicationPlugin - perform_operation - agmt="cn=meToidc01.my.dom.ain" (idc01:389): Failed to send extended operation: LDAP error -1 (Can't contact LDAP server) [20/Mar/2019:09:28:26.530763939 +0100] - ERR - NSMMReplicationPlugin - repl5_tot_log_operation_failure - agmt="cn=meToidc01.my.dom.ain" (idc01:389): Received error -1 (Can't contact LDAP server): for total update operation [20/Mar/2019:09:28:26.532678072 +0100] - ERR - NSMMReplicationPlugin - release_replica - agmt="cn=meToidc01.my.dom.ain" (idc01:389): Unable to send endReplication extended operation (Can't contact LDAP server) [20/Mar/2019:09:28:26.534307539 +0100] - ERR - NSMMReplicationPlugin - repl5_tot_run - Total update failed for replica "agmt="cn=meToidc01.my.dom.ain" (idc01:389)", error (-11) [20/Mar/2019:09:28:26.561763168 +0100] - INFO - NSMMReplicationPlugin - bind_and_check_pwp - agmt="cn=meToidc01.my.dom.ain" (idc01:389): Replication bind with GSSAPI auth resumed [20/Mar/2019:09:28:26.582389258 +0100] - WARN - NSMMReplicationPlugin - repl5_inc_run - agmt="cn=meToidc01.my.dom.ain" (idc01:389): The remote replica has a different database generation ID than the local database. You may have to reinitialize the remote replica, or the local replica. It seems that idc02 remembers something about the old replica. Any hint? Thank you in advance, Giulio

5 10

IPA CA allow CSR SAN names in external domains
by Steve Dainard 14 Mar '22

14 Mar '22

Hello I have a RHEL7 IPA server installed as a subordinate CA. I'd like to be able to add SAN's for a different dns domain than exists in the IPA realm. The dns for 'otherdomain.com' is handled by active directory which my IPA server has a cross-forest trust with. ie: host: client1.ipadomain.com certificate: CN = client1.ipadomain.com, SAN = client1.ipadomain.com, servicename.otherdomain.com When I try to submit this CSR with 'ipa-getcert request' the IPA server denies with: "The service principal for subject alt name servicename.otherdomain.com in certificate request does not exist" It seems that the default CAACL enforces a profile named 'caIPAserviceCert', but I'm having some trouble determining what can be modified (or cloned and changed in a new profile) that would allow the CA to sign a CSR that contains *.ipadomain.com and *.otherdomain.com in the SAN. This is the only section in the profile that contains SAN: policyset.serverCertSet.12.constraint.class_id=noConstraintImpl policyset.serverCertSet.12.constraint.name=No Constraint policyset.serverCertSet.12.default.class_id=commonNameToSANDefaultImpl policyset.serverCertSet.12.default.name=Copy Common Name to Subject Alternative Name Thanks, Steve

3 3

freeipa with sudo and 2FA (OTP)
by John Ratliff 31 Jan '22

31 Jan '22

I'm trying to setup freeipa with OTP. I created a TOTP under my user in freeipa and updated my user to use 2FA (password + OTP). When I try to do sudo, it only asks for my password and it fails every time (presumably because it isn't getting the OTP first). I didn't see anything useful in the sss_sudo logs, even after adding debug_level = 6 in the config. What can I do to further troubleshoot this? Thanks.

4 6

Problems after replacing SSL certificates
by Andreas Bulling 21 Oct '21

21 Oct '21

Dear all, I have recently started using FreeIPA (4.8.1 on Ubuntu) and now wanted to replace the original SSL certificates for the web UI and the LDAP server with official ones issued by our university. I've followed the procedure described here (no errors): https://www.freeipa.org/page/Using_3rd_part_certificates_for_HTTP/LDAP I could confirm in the browser that the certificate for the web UI has been replaced and I therefore assume so has the LDAP certificate. Authentication from other hosts/services using LDAP still works but in the server log file I see errors like these for all hosts in the domain: Apr 20 19:57:11 auth krb5kdc[24895]: AS_REQ (8 etypes {18 17 20 19 16 23 25 26}) X: NEEDED_PREAUTH: host/X@X for krbtgt/X@X, Additional pre-authentication required Apr 20 19:57:11 auth krb5kdc[24895]: closing down fd 12 Apr 20 19:57:11 auth krb5kdc[24895]: AS_REQ (8 etypes {18 17 20 19 16 23 25 26}) X: ISSUE: authtime 1587405431, etypes {rep=18 tkt=18 ses=18}, host/X@X for krbtgt/X@X Apr 20 19:57:11 auth krb5kdc[24895]: closing down fd 12 Apr 20 19:57:11 auth krb5kdc[24895]: TGS_REQ (8 etypes {18 17 20 19 16 23 25 26}) X: ISSUE: authtime 1587405431, etypes {rep=18 tkt=18 ses=18}, host/X@X for ldap/X@X Apr 20 19:57:11 auth krb5kdc[24895]: closing down fd 12 Also, ipa-certupdate on the respective clients shows ipa-certupdate trying https://X/ipa/json [try 1]: Forwarding 'schema' to json server 'https://X/ipa/json' cannot connect to 'https://X/ipa/json': [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:727) The ipa-certupdate command failed. Also, I can't login to the web UI anymore. I tried ipa-getkeytab -s X -p HTTP/X@X -k /var/lib/ipa/gssproxy/http.keytab on the freeipa server (followed by ipactl restart) but this didn't help. Any idea/suggestions for how to get everything working again? Thanks a lot!

6 15

User in AD not found by IPA
by Marc Boorshtein 14 Oct '21

14 Oct '21

We added a new account to AD that has a domain trust with FreeIPA. This one user is having an issue where IPA can't find him. The user is in the same OU as other users that work fine. The user is unlocked (userAccountControl is 512) and the userprincipalname is set. When I try to add the user to an id view or an external group IPA gives me the error "trusted domain object not found" . Not really sure where to look next to figure out what's wrong. We see the user when we make LDAP calls to AD. Thanks Marc

4 14

Cannot add externally-signed IPA CA certificate
by Dmitry Perets 27 Aug '21

27 Aug '21

Hi, I am trying to configure FreeIPA as a SubCA, and the "RootCA" is self-made with openssl. So I've signed the FreeIPA's request with my self-signed "root ca" certificate, but it looks like FreeIPA doesn't like it: ipa-server-install --external-cert-file=/root/rootca/rootcacert.pem --external-cert-file=/root/rootca/certs/ipacert.pem <...skipped...> ipa.ipapython.install.cli.install_tool(CompatServerMasterInstall): ERROR CA certificate CN=RootCA,OU=PRJ,O=COMPANY,L=Bonn,C=DE in /root/rootca/rootcacert.pem, /root/rootca/certs/ipacert.pem is not valid: not a CA certificate ipa.ipapython.install.cli.install_tool(CompatServerMasterInstall): ERROR The ipa-server-install command failed. See /var/log/ipaserver-install.log for more information The subj above is my self-made root CA cert, so it looks like something is missing in it. But what...? Here is it below, it has the "Basic Constraint" set with CA:TRUE... What else is required, so that FreeIPA accepts it as a root CA? Should I add it somewhere first, before running the ipa-server-install? [root@ipa ~]# openssl x509 -text -noout -in /root/rootca/rootcacert.pem Certificate: Data: Version: 3 (0x2) Serial Number: 0 (0x0) Signature Algorithm: sha256WithRSAEncryption Issuer: C=DE, L=Bonn, O=COMPANY, OU=PRJ, CN=RootCA Validity Not Before: Oct 24 11:43:13 2018 GMT Not After : Oct 21 11:43:13 2028 GMT Subject: C=DE, L=Bonn, O=COMPANY, OU=PRJ, CN=RootCA Subject Public Key Info: Public Key Algorithm: rsaEncryption Public-Key: (4096 bit) Modulus: <...skipped...> Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Subject Key Identifier: B3:18:3B:CF:29:D2:A5:D4:AE:94:A5:42:65:A2:D8:12:7C:92:78:81 X509v3 Authority Key Identifier: keyid:B3:18:3B:CF:29:D2:A5:D4:AE:94:A5:42:65:A2:D8:12:7C:92:78:81 X509v3 Basic Constraints: CA:TRUE Signature Algorithm: sha256WithRSAEncryption <...skipped...> Thanks!!

2 2

dirsrv hangs soon after reboot
by Kees Bakker 17 May '21

17 May '21

Hey, I'm looking for advice how to analyse/debug this. On one of the masters the dirsrv is unresponsive. It runs, but every attempt to connect it hangs. The command "systemctl status" does not show anything alarming ● dirsrv(a)EXAMPLE-COM.service - 389 Directory Server EXAMPLE-COM. Loaded: loaded (/usr/lib/systemd/system/dirsrv@.service; enabled; vendor preset: disabled) Active: active (running) since vr 2020-04-17 13:46:25 CEST; 1h 33min ago Process: 3123 ExecStartPre=/usr/sbin/ds_systemd_ask_password_acl /etc/dirsrv/slapd-%i/dse.ldif (code=exited, status=0/SUCCESS) Main PID: 3134 (ns-slapd) Status: "slapd started: Ready to process requests" CGroup: /system.slice/system-dirsrv.slice/dirsrv(a)EXAMPLE-COM.service └─3134 /usr/sbin/ns-slapd -D /etc/dirsrv/slapd-EXAMPLE-COM -i /var/run/dirsrv/slapd-EXAMPLE-COM.pid apr 17 15:13:54 linge.example.com ns-slapd[3134]: GSSAPI client step 1 apr 17 15:13:54 linge.example.com ns-slapd[3134]: GSSAPI client step 1 apr 17 15:13:54 linge.example.com ns-slapd[3134]: GSSAPI client step 1 apr 17 15:13:54 linge.example.com ns-slapd[3134]: GSSAPI client step 1 apr 17 15:13:54 linge.example.com ns-slapd[3134]: GSSAPI client step 2 apr 17 15:18:54 linge.example.com ns-slapd[3134]: GSSAPI client step 1 apr 17 15:18:54 linge.example.com ns-slapd[3134]: GSSAPI client step 1 apr 17 15:18:55 linge.example.com ns-slapd[3134]: GSSAPI client step 1 apr 17 15:18:55 linge.example.com ns-slapd[3134]: GSSAPI client step 1 apr 17 15:18:55 linge.example.com ns-slapd[3134]: GSSAPI client step 2 However, an ldapsearch command hangs forever [root@rotte ~]# ldapsearch -H ldaps://linge.example.com -D uid=keesbtest,cn=users,cn=accounts,dc=example,dc=com -W -LLL -o ldif-wrap=no -b cn=users,cn=accounts,dc=example,dc=com '(&(objectClass=person)(memberOf=cn=admins,cn=groups,cn=accounts,dc=example,dc=com))' uid Enter LDAP Password: Even if I use the socket (ldapi://%2fvar%2frun%2fslapd-EXAMPLE-COM.socket) the ldapsearch command hangs. "ipactl status" hangs "kinit" hangs -- Kees Bakker

5 16

DNS - trusted-keys via IPA's tools - ?
by lejeczek 03 May '21

03 May '21

hi everybody I want to ask if we have a way of adding trusted-keys? Official/recommended VS by fiddling/non-recommended ? many thanks, L.

1 1

Unable to install ipa client centos 7.5.1804 (Core)
by William Graboyes 16 Feb '21

16 Feb '21

Hello List, I have been searching around for the day and have found an answer for the error I am getting when I am trying to install the client on a brand new install: Version: ipa-client-4.5.4-10.el7.centos.3.x86_64 ipa-client-common-4.5.4-10.el7.centos.3.noarch The error is below (run as root, not via sudo): ipa-client-install Traceback (most recent call last): File "/sbin/ipa-client-install", line 22, in <module> from ipaclient.install import ipa_client_install File "/usr/lib/python2.7/site-packages/ipaclient/install/ipa_client_install.py", line 5, in <module> from ipaclient.install import client File "/usr/lib/python2.7/site-packages/ipaclient/install/client.py", line 34, in <module> from ipalib import api, errors, x509 File "/usr/lib/python2.7/site-packages/ipalib/x509.py", line 45, in <module> from pyasn1_modules import rfc2315, rfc2459 File "/usr/lib/python2.7/site-packages/pyasn1_modules/rfc2315.py", line 67, in <module> class DigestedData(univ.Sequence): File "/usr/lib/python2.7/site-packages/pyasn1_modules/rfc2315.py", line 72, in DigestedData namedtype.NamedType('digest', Digest) File "/usr/lib/python2.7/site-packages/pyasn1/type/namedtype.py", line 115, in __init__ self.__ambiguousTypes = 'terminal' not in kwargs and self.__computeAmbiguousTypes() or {} File "/usr/lib/python2.7/site-packages/pyasn1/type/namedtype.py", line 232, in __computeAmbiguousTypes ambigiousTypes[idx] = NamedTypes(*partialAmbigiousTypes, **dict(terminal=True)) File "/usr/lib/python2.7/site-packages/pyasn1/type/namedtype.py", line 114, in __init__ self.__tagToPosMap = self.__computeTagToPosMap() File "/usr/lib/python2.7/site-packages/pyasn1/type/namedtype.py", line 205, in __computeTagToPosMap for _tagSet in tagMap.presentTypes: AttributeError: 'property' object has no attribute 'presentTypes' Any help would be greatly appreciated. Thanks, Bill G.

3 2

FreeIPA, OSX, DockerDesktop
by james liu 14 Oct '20

14 Oct '20

PREP ==== git clone https://github.com/freeipa/freeipa-container.git cd freeipa-container mkdir /tmp/ipa-data docker run --name freeipa-server-container -ti -h ipa.example.test --read-only -v /tmp/ip-data :/data:Z freeipa-server --sysctl net.ipv6.conf.all.disable_ipv6=1 RESULT ====== tar: etc/sysconfig/selinux: Cannot utime: No such file or directory tar: Exiting with failure status due to previous errors QUESTION ========= I'm running DockerDesktop 2.0.4, OSX 10.13.6. Is there a set of commands that will work? Thanks

4 6

yum update problem
by Natxo Asenjo 02 Oct '20

02 Oct '20

hi, after patching our centos 7 hosts to the latest version today, one of the two replicas is having trouble. [root@kdc2 ~]# ipactl status Directory Service: RUNNING krb5kdc Service: STOPPED kadmin Service: STOPPED named Service: STOPPED httpd Service: RUNNING ipa-custodia Service: STOPPED ntpd Service: STOPPED pki-tomcatd Service: RUNNING smb Service: STOPPED winbind Service: STOPPED ipa-otpd Service: STOPPED ipa-dnskeysyncd Service: STOPPED ipa: INFO: The ipactl command was successful and after digging in the logs I come across this in /var/log/ipaupgrade.log: 2019-11-20T18:18:29Z DEBUG stderr= 2019-11-20T18:18:31Z INFO Certmonger certificate renewal configuration already up-to-date 2019-11-20T18:18:31Z INFO [Enable PKIX certificate path discovery and validation] 2019-11-20T18:18:31Z DEBUG Loading StateFile from '/var/lib/ipa/sysupgrade/sysupgrade.state' 2019-11-20T18:18:31Z INFO PKIX already enabled 2019-11-20T18:18:31Z INFO [Authorizing RA Agent to modify profiles] 2019-11-20T18:18:31Z INFO [Authorizing RA Agent to manage lightweight CAs] 2019-11-20T18:18:31Z INFO [Ensuring Lightweight CAs container exists in Dogtag database] 2019-11-20T18:18:31Z DEBUG Created connection context.ldap2_139740162547472 2019-11-20T18:18:31Z DEBUG flushing ldapi://%2fvar%2frun%2fslapd-L-DOMAIN-IT.socket from SchemaCache 2019-11-20T18:18:31Z DEBUG retrieving schema for SchemaCache url=ldapi://%2fvar%2frun%2fslapd-L-DOMAIN-IT.socket conn=<ldap.ldapobject.SimpleLDAPObject instance at 0x7f17cc24b638> 2019-11-20T18:18:31Z DEBUG Destroyed connection context.ldap2_139740162547472 2019-11-20T18:18:31Z INFO [Adding default OCSP URI configuration] 2019-11-20T18:18:31Z INFO [Ensuring CA is using LDAPProfileSubsystem] 2019-11-20T18:18:31Z INFO [Migrating certificate profiles to LDAP] 2019-11-20T18:18:31Z DEBUG Created connection context.ldap2_139740160021648 2019-11-20T18:18:31Z DEBUG flushing ldapi://%2fvar%2frun%2fslapd-L-DOMAIN-IT.socket from SchemaCache 2019-11-20T18:18:31Z DEBUG retrieving schema for SchemaCache url=ldapi://%2fvar%2frun%2fslapd-L-DOMAIN-IT.socket conn=<ldap.ldapobject.SimpleLDAPObject instance at 0x7f17cc289b00> 2019-11-20T18:18:31Z DEBUG Destroyed connection context.ldap2_139740160021648 2019-11-20T18:18:31Z DEBUG request GET https://kdc2.l.domain.it:8443/ca/rest/account/login 2019-11-20T18:18:31Z DEBUG request body '' 2019-11-20T18:18:31Z DEBUG response status 401 2019-11-20T18:18:31Z DEBUG response headers Server: Apache-Coyote/1.1 Cache-Control: private Expires: Thu, 01 Jan 1970 01:00:00 CET WWW-Authenticate: Basic realm="Certificate Authority" Content-Type: text/html;charset=utf-8 Content-Language: en Content-Length: 951 Date: Wed, 20 Nov 2019 18:18:31 GMT 2019-11-20T18:18:31Z DEBUG response body '<html><head><title>Apache Tomcat/7.0.76 - Error report</title><style></style> </head><body><h1>HTTP Status 401 - </h1><HR size="1" noshade="noshade"><p><b>type</b> Status report</p><p><b>message</b> <u></u></p><p><b>description</b> <u>This request requires HTTP authentication.</u></p><HR size="1" noshade="noshade"><h3>Apache Tomcat/7.0.76</h3></body></html>' 2019-11-20T18:18:31Z ERROR IPA server upgrade failed: Inspect /var/log/ipaupgrade.log and run command ipa-server-upgrade manually. 2019-11-20T18:18:31Z DEBUG File "/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 178, in execute return_value = self.run() File "/usr/lib/python2.7/site-packages/ipaserver/install/ipa_server_upgrade.py", line 54, in run server.upgrade() File "/usr/lib/python2.7/site-packages/ipaserver/install/server/upgrade.py", line 2146, in upgrade upgrade_configuration() File "/usr/lib/python2.7/site-packages/ipaserver/install/server/upgrade.py", line 2018, in upgrade_configuration ca_enable_ldap_profile_subsystem(ca) File "/usr/lib/python2.7/site-packages/ipaserver/install/server/upgrade.py", line 406, in ca_enable_ldap_profile_subsystem cainstance.migrate_profiles_to_ldap() File "/usr/lib/python2.7/site-packages/ipaserver/install/cainstance.py", line 2027, in migrate_profiles_to_ldap _create_dogtag_profile(profile_id, profile_data, overwrite=False) File "/usr/lib/python2.7/site-packages/ipaserver/install/cainstance.py", line 2033, in _create_dogtag_profile with api.Backend.ra_certprofile as profile_api: File "/usr/lib/python2.7/site-packages/ipaserver/plugins/dogtag.py", line 1315, in __enter__ raise errors.RemoteRetrieveError(reason=_('Failed to authenticate to CA REST API')) 2019-11-20T18:18:31Z DEBUG The ipa-server-upgrade command failed, exception: RemoteRetrieveError: Failed to authenticate to CA REST API 2019-11-20T18:18:31Z ERROR Unexpected error - see /var/log/ipaupgrade.log for details: RemoteRetrieveError: Failed to authenticate to CA REST API In this kdc I see these errors in getcert list: Request ID '20190220182014': status: MONITORING ca-error: Invalid cookie: u'' stuck: no key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert cert-pki-ca',token='NSS Certificate DB',pin set certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert cert-pki-ca',token='NSS Certificate DB' CA: dogtag-ipa-ca-renew-agent issuer: CN=Certificate Authority,O=L.DOMAIN.IT subject: CN=CA Audit,O=L.DOMAIN.IT expires: 2019-12-05 13:58:24 UTC key usage: digitalSignature,nonRepudiation pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "auditSigningCert cert-pki-ca" track: yes auto-renew: yes Request ID '20190220182015': status: MONITORING ca-error: Invalid cookie: u'' stuck: no key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert cert-pki-ca',token='NSS Certificate DB',pin set certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert cert-pki-ca',token='NSS Certificate DB' CA: dogtag-ipa-ca-renew-agent issuer: CN=Certificate Authority,O=L.DOMAIN.IT subject: CN=OCSP Subsystem,O=L.DOMAIN.IT expires: 2019-12-05 13:58:24 UTC key usage: digitalSignature,nonRepudiation,keyCertSign,cRLSign eku: id-kp-OCSPSigning pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "ocspSigningCert cert-pki-ca" track: yes auto-renew: yes Request ID '20190220182016': status: MONITORING ca-error: Invalid cookie: u'' stuck: no key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert cert-pki-ca',token='NSS Certificate DB',pin set certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert cert-pki-ca',token='NSS Certificate DB' CA: dogtag-ipa-ca-renew-agent issuer: CN=Certificate Authority,O=L.DOMAIN.IT subject: CN=CA Subsystem,O=L.DOMAIN.IT expires: 2019-12-05 13:58:24 UTC key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment eku: id-kp-serverAuth,id-kp-clientAuth pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "subsystemCert cert-pki-ca" track: yes auto-renew: yes Request ID '20190220182018': status: MONITORING ca-error: Invalid cookie: u'' stuck: no key pair storage: type=FILE,location='/var/lib/ipa/ra-agent.key' certificate: type=FILE,location='/var/lib/ipa/ra-agent.pem' CA: dogtag-ipa-ca-renew-agent issuer: CN=Certificate Authority,O=L.DOMAIN.IT subject: CN=IPA RA,O=L.DOMAIN.IT expires: 2019-12-05 13:58:44 UTC key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment eku: id-kp-serverAuth,id-kp-clientAuth pre-save command: /usr/libexec/ipa/certmonger/renew_ra_cert_pre post-save command: /usr/libexec/ipa/certmonger/renew_ra_cert track: yes auto-renew: yes Request ID '20190220182019': status: MONITORING ca-error: Server at " https://kdc2.l.domain.it:8443/ca/agent/ca/profileProcess" replied: 1: Invalid Credential. stuck: no key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert cert-pki-ca',token='NSS Certificate DB',pin set certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert cert-pki-ca',token='NSS Certificate DB' CA: dogtag-ipa-ca-renew-agent issuer: CN=Certificate Authority,O=L.DOMAIN.IT subject: CN=kdc2.l.domain.it,O=L.DOMAIN.IT expires: 2019-12-10 10:57:52 UTC key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment eku: id-kp-serverAuth,id-kp-clientAuth,id-kp-emailProtection pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "Server-Cert cert-pki-ca" track: yes auto-renew: yes I still have a working replica, so I could just reinstall and have a working set in a couple of minutes, but I would like to find out what has gone wrong. The systems are running ipa-server-4.6.5-11.el7.centos.3.x86_64 Any help welcome ;-) Thanks, -- Groeten, natxo

4 12

Replica not renewing IPA certificates
by Roderick Johnstone 02 Oct '20

02 Oct '20

Hi This is freeipa (ipa-server-4.6.5-11.el7_7.3.x86_64) on RHEL7 with freeipa's own internal CA. One of my ipa server replicas (host3) has not renewed its IPA system certificates and is now showing ca-error: Invalid cookie: u'' in the 'getcert list' output for certificates: "auditSigningCert cert-pki-ca", "ocspSigningCert cert-pki-ca", "subsystemCert cert-pki-ca", and the certificate in the file /var/lib/ipa/ra-agent.pem As far as I can see, the sequence of events has been as follows: host3 noticed the certificates needed renewing at 30 Jan 2020 05:37 and certmonger initiated a renewal. The state of those certificates went from MONITORING to CA_WORKING but the certificates were not renewed. The CA renewal master (host1) noticed its same set of certificates (plus "Server-Cert cert-pki-ca") needed renewing at 30 Jan 2020 07:28 and renewed them successfully. Another replica (host2) noticed that its certificates needed renewing at 30 Jan 2020 07:32 and renewed them successfully. At 30 Jan 13:37 on host3 the certificates needing to be renewed went from CA_WORKING back to MONITORING, but 'getcert list' now shows them with: ca-error: Invalid cookie: u'' and they still haven't renewed. I haven't seen certmonger attempt to try the renewal again on host3 (nothing from certmonger in /var/log/messages since 30 Jan 13:37). While I could try a getcert resubmit on host3 to force it to try again, I'd like to know if what I am seeing is the expected behaviour when a replica tried to renew certificates before the renewal master. How long should I have to wait till certmonger on host3 tries again? - I couldn't find any reference to how often certmonger tries the renewal. Rob Crittenden's freeipa-healthcheck script is now showing the following for host3: ERROR: ipahealthcheck.ipa.certs.IPARAAgent: RA agent description does not match 2;16;CN=Certificate Authority,O=EXAMPLE.COM;CN=IPA RA,O=EXAMPLE.COM in LDAP and 2;7;CN=Certificate Authority,O=EXAMPLE.COM;CN=IPA RA,O=EXAMPLE.COM expected ERROR: ipahealthcheck.ipa.certs.IPACertRevocation.20180926040924: Request for certificate failed, Certificate operation cannot be completed: EXCEPTION (Invalid Credential.) ERROR: ipahealthcheck.ipa.certs.IPACertRevocation.20180926040920: Request for certificate failed, Certificate operation cannot be completed: EXCEPTION (Invalid Credential.) ERROR: ipahealthcheck.ipa.certs.IPACertRevocation.20180926040921: Request for certificate failed, Certificate operation cannot be completed: EXCEPTION (Invalid Credential.) ERROR: ipahealthcheck.ipa.certs.IPACertRevocation.20180926040922: Request for certificate failed, Certificate operation cannot be completed: EXCEPTION (Invalid Credential.) ERROR: ipahealthcheck.ipa.certs.IPACertRevocation.20180926040923: Request for certificate failed, Certificate operation cannot be completed: EXCEPTION (Invalid Credential.) ERROR: ipahealthcheck.ipa.certs.IPACertRevocation.20180926040925: Request for certificate failed, Certificate operation cannot be completed: EXCEPTION (Invalid Credential.) ERROR: ipahealthcheck.ipa.certs.IPACertRevocation.20180926040927: Request for certificate failed, Certificate operation cannot be completed: EXCEPTION (Invalid Credential.) ERROR: ipahealthcheck.ipa.certs.IPACertRevocation.20180926040926: Request for certificate failed, Certificate operation cannot be completed: EXCEPTION (Invalid Credential.) ERROR: ipahealthcheck.ipa.certs.IPACertRevocation.20180831064406: Request for certificate failed, Certificate operation cannot be completed: EXCEPTION (Invalid Credential.) ERROR: ipahealthcheck.dogtag.ca.DogtagCertsConnectivityCheck: Request for certificate failed, Certificate operation cannot be completed: EXCEPTION (Invalid Credential.) Each of host1, host2 and host3 are showing serial number 16 in ldap using: ldapsearch -D "cn=directory manager" -W -b uid=ipara,ou=people,o=ipaca description At this stage I'm not sure whether this will resolve itself when certmonger tries to renew certificates again or whether I need to be more proactive. I'm happy to supply more logs as necessary. Thanks Roderick

3 3

ipa-replica-install failing
by Mitchell Smith 25 Aug '20

25 Aug '20

Hi list, I wanted to repost this issue with a more appropriate subject line, in case anyone has come across this issue before and has a work around. To provide some context, I have two FreeIPA instances running FreeIPA 4.3.1 on Ubuntu 16.04 LTS. I want to migrate to FreeIPA 4.5.4 running on CentOS 7. I have a way to migrate by dumping all the users out with ldapsearch and adding them to the new instance with ldapadd but it is a bit messy and will result in all users having to reset their password, as it won't let me add in already encrypted passwords. My initial thought was to add the new instance as a replica and then eventually retire the old one. I ran in to some problems with the ‘ipa-replica-install’ command though. I was able to join as a client no problem, but when I went to run ‘ipa-replica-install’ it failed while configuring the directory server component. [25/42]: restarting directory server [26/42]: creating DS keytab [27/42]: ignore time skew for initial replication [28/42]: setting up initial replication [error] DatabaseError: Server is unwilling to perform: modification of attribute nsds5replicareleasetimeout is not allowed in replica entry Your system may be partly configured. Run /usr/sbin/ipa-server-install --uninstall to clean up. I thought this might have something to do with differences between 4.3.1 and 4.5.4 but I wasn’t entirely sure. If there is a work around for this issue, it would be a significantly easier transition to the new FreeIPA instance. Cheers, Mitch

3 4

IPA healthcheck for older versions
by Rob Crittenden 24 Aug '20

24 Aug '20

Over the summer we announced the freeipa-healthcheck project which is designed to look at an IdM cluster and look for common problems so you can have some level of assurance that the system is running as it should. It was built against the IPA 4.8.x branch and originally released only for Fedora 29+. It is also included in the newly released RHEL 8.1.0. My curious nature led me to see if it would also work in in the IPA 4.6.x branch. It was a bit of a challenge backing down to Python 2 but I was able to get something working. I tested primarily on Fedora 27 but it should also work in RHEL/CentOS 7 (I smoke tested 7.8). I made an EPEL 7 build in COPR, https://copr.fedorainfracloud.org/coprs/rcritten/ipa-healthcheck/ Enable the repo and do: yum install freeipa-healthcheck Then run: ipa-healthcheck --failures-only Ideally there will be no output but an empty list []. Otherwise the output is JSON and hopefully has enough information to point you in the right direction. Feel free to ask if need help. False positives are always a possibility and many of the checks run independently so it's possible to get multiple issues from a single root problem. It's hard to predict all possible installations so some fine-tuning may be required. I'd recommend running it every now and then at least, like prior to updating IPA packages, creating a new master, etc, if not daily. It will, for example, warn of impending cert expiration. The more feedback I get on it the better and more useful I can make it. This is my own personal backport and is not officially supported by anyone but me. It's preferred to report issues on this mailing list. I'll see them and others may be able to chime in as well. rob

10 32

Replication issue with CSN generator
by Morgan Marodin 11 Aug '20

11 Aug '20

Hi. Into my environment I have two IPA server, replicating each other. They are both 7.6 OS systems, ipa-server RPM version is 4.6.4-10.0.1.el7_6.2.x86_64. The first server installed was srv01 (many years ago), then I installed the replica into srv02 (like a year later the 1st node). When I had a single server I did also a trust with my corporate Active Directory. VMs are running in 2 different hypervisor clusters. Now the replication doesn't works. Into log files I have this error: *[16/Apr/2020:12:25:36.856632697 +0200] - ERR - csngen_adjust_time - Adjustment limit exceeded; value - 23221226, limit - 86400[16/Apr/2020:12:25:36.857909222 +0200] - ERR - NSMMReplicationPlugin - repl5_inc_run - agmt="cn=meTosrv01.ipa.mydomain.com <http://meTosrv01.ipa.mydomain.com>" (srv01:389): Fatal error - too much time skew between replicas![16/Apr/2020:12:25:36.862233147 +0200] - ERR - NSMMReplicationPlugin - repl5_inc_run - agmt="cn=meTosrv01.ipa.mydomain.com <http://meTosrv01.ipa.mydomain.com>" (srv01:389): Incremental update failed and requires administrator action* I tried to force the replica, but the limit exceeded problem doesn't allow the sync. I know that the problem is that CSN generator has become grossly skewed. Using the external script readNsState.py I found that there was as offset time for about a month, so ... I waited for a month and then the issue disappeared. But now the offset is about 9 months ... I can't wait so much time :) *[root@srv01 scripts]# ./readNsState.py /etc/dirsrv/slapd-IPA-MYDOMAIN-COM/dse.ldifnsState is BAAAAAAAAACCN/xfAAAAAHbiBAAAAAAABCgAAAAAAAANdQAAAAAAAA==Little EndianFor replica cn=replica,cn=dc\3Dipa\2Cdc\3Dmydomain\2Cdc\3Dcom,cn=mapping tree,cn=con fmtstr=[H6x3QH6x] size=40 len of nsstate is 40 CSN generator state: Replica ID : 4 Sampled Time : 1610364802 Gen as csn : 5ffc37822996500040000 Time as str : Mon Jan 11 12:33:22 2021 Local Offset : 320118 Remote Offset : 10244 Seq. num : 29965 System time : Tue Apr 21 15:03:45 2020 Diff in sec. : -22890577 Day:sec diff : -265:5423nsState is YAAAAAAAAAADLZheAAAAAAAAAAAAAAAAXSgAAAAAAAATAAAAAAAAAA==Little EndianFor replica cn=replica,cn=o\3Dipaca,cn=mapping tree,cn=config fmtstr=[H6x3QH6x] size=40 len of nsstate is 40 CSN generator state: Replica ID : 96 Sampled Time : 1587031299 Gen as csn : 5e982d03001900960000 Time as str : Thu Apr 16 12:01:39 2020 Local Offset : 0 Remote Offset : 10333 Seq. num : 19 System time : Tue Apr 21 15:03:45 2020 Diff in sec. : 442926 Day:sec diff : 5:10926[root@srv02 scripts]# ./readNsState.py /etc/dirsrv/slapd-IPA-MYDOMAIN-COM/dse.ldifnsState is AwAAAAAAAABU7p5eAAAAAAAAAAAAAAAAsVNiAQAAAAAAAAAAAAAAAA==Little EndianFor replica cn=replica,cn=dc\3Dipa\2Cdc\3Dmydomain\2Cdc\3Dcom,cn=mapping tree,cn=con fmtstr=[H6x3QH6x] size=40 len of nsstate is 40 CSN generator state: Replica ID : 3 Sampled Time : 1587474004 Gen as csn : 5e9eee54000000030000 Time as str : Tue Apr 21 15:00:04 2020 Local Offset : 0 Remote Offset : 23221169 Seq. num : 0 System time : Tue Apr 21 15:02:38 2020 Diff in sec. : 154 Day:sec diff : 0:154nsState is YQAAAAAAAAAuLZheAAAAAEUBAAAAAAAA7SYAAAAAAAASAAAAAAAAAA==Little EndianFor replica cn=replica,cn=o\3Dipaca,cn=mapping tree,cn=config fmtstr=[H6x3QH6x] size=40 len of nsstate is 40 CSN generator state: Replica ID : 97 Sampled Time : 1587031342 Gen as csn : 5e982d2e001800970000 Time as str : Thu Apr 16 12:02:22 2020 Local Offset : 325 Remote Offset : 9965 Seq. num : 18 System time : Tue Apr 21 15:02:38 2020 Diff in sec. : 442816 Day:sec diff : 5:10816* As you can see in the 1st node the Time as str is Jan 11 of 2021. With timedatectl command I see that both VMs use the same Time zone and the clock is correct. I found this old article to fix my issue: *https://www.redhat.com/archives/freeipa-users/2014-February/msg00007.html <https://www.redhat.com/archives/freeipa-users/2014-February/msg00007.html>* But ... I had the same issue in the past, always in the 1st server. So, in my mind I don't want to try to use that fix. I have a new hypervisor cluster, so I would prefer to reinstall the 1st server, using these steps: 1) check if all roles (also the CA) is installed in srv02 You can find here some data about the VMs: *[root@srv01 ~]# ipa server-show srv01.ipa.mydomain.com <http://srv01.ipa.mydomain.com> Server name: srv01.ipa.mydomain.com <http://srv01.ipa.mydomain.com> Managed suffixes: domain, ca Min domain level: 0 Max domain level: 1 Enabled server roles: CA server, IPA master, DNS server, NTP server, AD trust controller[root@srv02 ~]# ipa server-show srv02.ipa.mydomain.com <http://srv02.ipa.mydomain.com> Server name: srv02.ipa.mydomain.com <http://srv02.ipa.mydomain.com> Managed suffixes: domain, ca Min domain level: 0 Max domain level: 1 Enabled server roles: CA server, IPA master, DNS server, NTP server[root@srv01 ~]# ipa config-show Maximum username length: 32 Home directory base: /home Default shell: /bin/bash Default users group: ipausers Default e-mail domain: ipa.mydomain.com <http://ipa.mydomain.com> Search time limit: 2 Search size limit: 100 User search fields: uid,givenname,sn,telephonenumber,ou,title Group search fields: cn,description Enable migration mode: FALSE Certificate Subject base: O=IPA.MYDOMAIN.COM <http://IPA.MYDOMAIN.COM> Password Expiration Notification (days): 4 Password plugin features: AllowNThash SELinux user map order: guest_u:s0$xguest_u:s0$user_u:s0$staff_u:s0-s0:c0.c1023$unconfined_u:s0-s0:c0.c1023 Default SELinux user: unconfined_u:s0-s0:c0.c1023 Default PAC types: MS-PAC, nfs:NONE IPA masters: srv01.ipa.mydomain.com <http://srv01.ipa.mydomain.com>, srv02.ipa.mydomain.com <http://srv02.ipa.mydomain.com> IPA CA servers: srv01.ipa.mydomain.com <http://srv01.ipa.mydomain.com>, srv02.ipa.mydomain.com <http://srv02.ipa.mydomain.com> IPA NTP servers: srv01.ipa.mydomain.com <http://srv01.ipa.mydomain.com>, srv02.ipa.mydomain.com <http://srv02.ipa.mydomain.com> IPA CA renewal master: srv01.ipa.mydomain.com <http://srv01.ipa.mydomain.com>[root@srv02 ~]# ipa config-show Maximum username length: 32 Home directory base: /home Default shell: /bin/bash Default users group: ipausers Default e-mail domain: ipa.mydomain.com <http://ipa.mydomain.com> Search time limit: 2 Search size limit: 100 User search fields: uid,givenname,sn,telephonenumber,ou,title Group search fields: cn,description Enable migration mode: FALSE Certificate Subject base: O=IPA.MYDOMAIN.COM <http://IPA.MYDOMAIN.COM> Password Expiration Notification (days): 4 Password plugin features: AllowNThash SELinux user map order: guest_u:s0$xguest_u:s0$user_u:s0$staff_u:s0-s0:c0.c1023$unconfined_u:s0-s0:c0.c1023 Default SELinux user: unconfined_u:s0-s0:c0.c1023 Default PAC types: MS-PAC, nfs:NONE IPA masters: srv01.ipa.mydomain.com <http://srv01.ipa.mydomain.com>, srv02.ipa.mydomain.com <http://srv02.ipa.mydomain.com> IPA CA servers: srv01.ipa.mydomain.com <http://srv01.ipa.mydomain.com>, srv02.ipa.mydomain.com <http://srv02.ipa.mydomain.com> IPA NTP servers: srv01.ipa.mydomain.com <http://srv01.ipa.mydomain.com>, srv02.ipa.mydomain.com <http://srv02.ipa.mydomain.com> IPA CA renewal master: srv01.ipa.mydomain.com <http://srv01.ipa.mydomain.com>[root@srv01 ~]# ipactl statusDirectory Service: RUNNINGkrb5kdc Service: RUNNINGkadmin Service: RUNNINGnamed Service: RUNNINGhttpd Service: RUNNINGipa-custodia Service: RUNNINGntpd Service: RUNNINGpki-tomcatd Service: STOPPEDsmb Service: RUNNINGwinbind Service: RUNNINGipa-otpd Service: RUNNINGipa-dnskeysyncd Service: RUNNINGipa: INFO: The ipactl command was successful[root@srv02 ~]# ipactl statusDirectory Service: RUNNINGkrb5kdc Service: RUNNINGkadmin Service: RUNNINGnamed Service: RUNNINGhttpd Service: RUNNINGipa-custodia Service: RUNNINGntpd Service: RUNNINGpki-tomcatd Service: STOPPEDipa-otpd Service: RUNNINGipa-dnskeysyncd Service: RUNNINGipa: INFO: The ipactl command was successful[root@srv01 ~]# certutil -L -d /etc/pki/pki-tomcat/aliasCertificate Nickname Trust Attributes SSL,S/MIME,JAR/XPIServer-Cert cert-pki-ca u,u,usubsystemCert cert-pki-ca u,u,ucaSigningCert cert-pki-ca CTu,Cu,CuocspSigningCert cert-pki-ca u,u,uauditSigningCert cert-pki-ca u,u,Pu[root@srv02 ~]# certutil -L -d /etc/pki/pki-tomcat/aliasCertificate Nickname Trust Attributes SSL,S/MIME,JAR/XPIServer-Cert cert-pki-ca u,u,usubsystemCert cert-pki-ca u,u,ucaSigningCert cert-pki-ca CTu,u,uocspSigningCert cert-pki-ca u,u,uauditSigningCert cert-pki-ca u,u,Pu* It seems that AD trust controller role, IPA CA renewal master, smb and windbind are only in the 1st server. And also caSigningCert cert-pki-ca entry is different (CTu,Cu,Cu vs CTu,u,u). I can see only in the 1st server these DNS records: *_kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs SRV 0 100 88 srv01_kerberos._tcp.dc._msdcs SRV 0 100 88 srv01_kerberos._udp.Default-First-Site-Name._sites.dc._msdcs SRV 0 100 88 srv01_kerberos._udp.dc._msdcs SRV 0 100 88 srv01_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs 0 100 389 srv01_ldap._tcp.dc._msdcs 0 100 389 srv01* Srv01 is the first master, I know, but is the server VM that has clock problems, in both situations. So I want to keep srv02 and install a new one. What do I have to do to let the 2nd VM be a single server? Could I use these URLs? *https://www.freeipa.org/page/Backup_and_Restore#One_Server_Loss_-_First_Master <https://www.freeipa.org/page/Backup_and_Restore#One_Server_Loss_-_First_Mas…>https://www.freeipa.org/page/V4/Server_Roles#Upgrade <https://www.freeipa.org/page/V4/Server_Roles#Upgrade>* 2) uninstall ipa-server from the 1st server (srv01) and then powering off it, assuming that all data into the 2nd one are ok (srv02) 3) update freeipa and all other RPM packages into the VM srv02 4) install a new fresh VM, always with 7 release, and create a new replica Could I use the same old hostname (srv01) and IP address for this new VM? Or is better to use the same IP but a new name, like srv03? Do you think this is the right way to solve my issue? Or do you have any better idea? Please let me know, thanks. Bye, Morgan

3 8

kinit -n asking for password on clients
by John Ratliff 13 Jul '20

13 Jul '20

When trying to do pkinit, if I do kinit -n on one of the IdM servers, it works fine. If I try on a client machine, it asks me for the password for WELLKNOWN/ANONYMOUS@REALM. I have the pkinit_anchors setup for the realm. As I'm trying to do anonymous pkinit, I think I don't need a client certificate. On the server, I get this: $ KRB5_TRACE="/dev/stderr" kinit -n [13061] 1518402857.924212: Getting initial credentials for WELLKNOWN/ANONYMOUS(a)IDM.EXAMPLE.COM [13061] 1518402857.929673: Sending request (200 bytes) to IDM.EXAMPLE.COM [13061] 1518402857.931830: Initiating TCP connection to stream 10.77.9.101:88 [13061] 1518402857.932241: Sending TCP request to stream 10.77.9.101:88 [13061] 1518402857.939162: Received answer (359 bytes) from stream 10.77.9.101:88 [13061] 1518402857.939180: Terminating TCP connection to stream 10.77.9.101:88 [13061] 1518402857.939284: Response was from master KDC [13061] 1518402857.939380: Received error from KDC: -1765328359/Additional pre-authentication required [13061] 1518402857.939474: Processing preauth types: 16, 15, 14, 136, 19, 147, 2, 133 [13061] 1518402857.939499: Selected etype info: etype aes256-cts, salt "IDM.EXAMPLE.COMWELLKNOWNANONYMOUS", params "" [13061] 1518402857.939509: Received cookie: MIT [13061] 1518402857.939563: Preauth module pkinit (147) (info) returned: 0/Success [13061] 1518402857.940352: PKINIT client computed kdc-req-body checksum 9/D98A0144E7E4ACC66B63EBCA98379AB9F055D143 [13061] 1518402857.940369: PKINIT client making DH request [13061] 1518402858.935: Preauth module pkinit (16) (real) returned: 0/Success [13061] 1518402858.956: Produced preauth for next request: 133, 16 [13061] 1518402858.994: Sending request (1408 bytes) to IDM.EXAMPLE.COM [13061] 1518402858.1091: Initiating TCP connection to stream 10.77.9.101:88 [13061] 1518402858.1187: Sending TCP request to stream 10.77.9.101:88 [13061] 1518402858.43063: Received answer (2880 bytes) from stream 10.77.9.101:88 [13061] 1518402858.43088: Terminating TCP connection to stream 10.77.9.101:88 [13061] 1518402858.43198: Response was from master KDC [13061] 1518402858.43258: Processing preauth types: 17, 19, 147 [13061] 1518402858.43273: Selected etype info: etype aes256-cts, salt "IDM.EXAMPLE.COMWELLKNOWNANONYMOUS", params "" [13061] 1518402858.43300: Preauth module pkinit (147) (info) returned: 0/Success [13061] 1518402858.44150: PKINIT client verified DH reply [13061] 1518402858.44189: PKINIT client found id-pkinit-san in KDC cert: krbtgt/IDM.EXAMPLE.COM(a)IDM.EXAMPLE.COM [13061] 1518402858.44199: PKINIT client matched KDC principal krbtgt/IDM.EXAMPLE.COM(a)IDM.EXAMPLE.COM against id-pkinit-san; no EKU check required [13061] 1518402858.62345: PKINIT client used KDF 2B06010502030602 to compute reply key aes256-cts/00E0 [13061] 1518402858.62395: Preauth module pkinit (17) (real) returned: 0/Success [13061] 1518402858.62402: Produced preauth for next request: (empty) [13061] 1518402858.62414: AS key determined by preauth: aes256-cts/00E0 [13061] 1518402858.62547: Decrypted AS reply; session key is: aes256-cts/96F0 [13061] 1518402858.62589: FAST negotiation: available [13061] 1518402858.62692: Initializing KEYRING:persistent:760400007:krb_ccache_f3PFEy1 with default princ WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS [13061] 1518402858.62770: Storing WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS -> krbtgt/IDM.EXAMPLE.COM(a)IDM.EXAMPLE.COM in KEYRING:persistent:760400007:krb_ccache_f3PFEy1 [13061] 1518402858.62846: Storing config in KEYRING:persistent:760400007:krb_ccache_f3PFEy1 for krbtgt/IDM.EXAMPLE.COM(a)IDM.EXAMPLE.COM: fast_avail: yes [13061] 1518402858.62878: Storing WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS -> krb5_ccache_conf_data/fast_avail/krbtgt\/IDM.EXAMPLE.COM\@IDM.EXAMPLE.COM@X-CACHECONF: in KEYRING:persistent:760400007:krb_ccache_f3PFEy1 [13061] 1518402858.62933: Storing config in KEYRING:persistent:760400007:krb_ccache_f3PFEy1 for krbtgt/IDM.EXAMPLE.COM(a)IDM.EXAMPLE.COM: pa_type: 16 [13061] 1518402858.62954: Storing WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS -> krb5_ccache_conf_data/pa_type/krbtgt\/IDM.EXAMPLE.COM\@IDM.EXAMPLE.COM@X-CACHECONF: in KEYRING:persistent:760400007:krb_ccache_f3PFEy1 But on the client, I get this: $ KRB5_TRACE="/dev/stderr" kinit -n [2941] 1518402820.155827: Getting initial credentials for WELLKNOWN/ANONYMOUS(a)IDM.EXAMPLE.COM [2941] 1518402820.156298: Sending request (200 bytes) to IDM.EXAMPLE.COM [2941] 1518402820.158723: Resolving hostname paine.example.com. [2941] 1518402820.159975: Resolving hostname phantom.example.com. [2941] 1518402820.160757: Resolving hostname paine.example.com. [2941] 1518402820.161411: Initiating TCP connection to stream 204.89.253.101:88 [2941] 1518402820.162065: Sending TCP request to stream 204.89.253.101:88 [2941] 1518402820.168495: Received answer (359 bytes) from stream 204.89.253.101:88 [2941] 1518402820.168532: Terminating TCP connection to stream 204.89.253.101:88 [2941] 1518402820.169917: Response was from master KDC [2941] 1518402820.169974: Received error from KDC: -1765328359/Additional pre-authentication required [2941] 1518402820.170029: Processing preauth types: 16, 15, 14, 136, 19, 147, 2, 133 [2941] 1518402820.170051: Selected etype info: etype aes256-cts, salt "IDM.EXAMPLE.COMWELLKNOWNANONYMOUS", params "" [2941] 1518402820.170062: Received cookie: MIT Password for WELLKNOWN/ANONYMOUS(a)IDM.EXAMPLE.COM: [2941] 1518402833.34612: Preauth module encrypted_timestamp (2) (real) returned: -1765328252/Password read interrupted kinit: Pre-authentication failed: Password read interrupted while getting initial credentials Suggestions on what I'm missing? Thanks.

3 3

Plans for integrating DHCP
by Ronald Wimmer 07 Jul '20

07 Jul '20

Hi there, are there any plans to integrate a DHCP server into FreeIPA. We have several environments where a lack of DHCP is a showstopper at the moment. Cheers, Ronald

10 9

automember hostgroup by account?
by Amos 14 Jun '20

14 Jun '20

Is it possible to have an automember rule to add a host to a hostgroup based on the account used with ipa-install-client? Amos

3 6

IPA and legacy systems
by Ronald Wimmer 27 May '20

27 May '20

What would be a good solution to add systems where the FQDN cannot be changed? Would it make sense to add a second DNS A Record in the IPA domain for each of these systems? Is there any experience on how to deal with such a situation? Thanks a lot in advance! Cheers, Ronald

5 17

IPA CA renewal and duplicate CA certs
by Sigbjorn Lie 15 May '20

15 May '20

Hi, We recently renewed our IPA CA cert using the "ipa-cacert-manage renew” command. The renewal was successful, and our CA cert no longer expires in 2020, but in 2040. Running “ipa-certupdate” on existing IPA clients and ipa-client-install on new IPA clients also works, however both the new and the old CA cert is pulled down to the IPA client and stored in /etc/ipa/ca.crt. This creates some issues as most applications reading /etc/ipa/ca.crt only reads the first entry, which happens to be the old CA cert. For the moment everything works OK as the old CA cert is still valid, however this will become a major issue in a few months time. Is this expected? To continue to service both the old and the new CA certificate to old and new IPA clients? Will the old certificate be automatically removed at some point? If not, what is the safe steps to remove the old CA certificate from the IPA servers? Thanks. Regards, Siggi

5 17

Plugin problem after upgrade
by Frederic AYRAULT 13 May '20

13 May '20

Bonjour, I upgraded my Centos servers from 7.7.1908 to 7.8.2003 and ipa upgrades from 4.6.5 to 4.6.6 In the directory /usr/share/ipa/ui/js/plugins/bureau , I am using the enclosed file bureau.js to show the room number field in the gui. But after the upgrade, the field is there, but empty. I deleted one of my servers, downgrade ipa packages et reinstall ipa, and the plugin is working, I can see the value in the field. Do you have any idea ? Thank you Regards, Frederic Frédéric AYRAULT Administrateur Systèmes et Réseaux Laboratoire d'Informatique de l'Ecole polytechnique <http://www.lix.polytechnique.fr> fred(a)lix.polytechnique.fr

1 3

failed to verify krb5 credentials: Server not found in Kerberos database
by Faraz Younus 01 May '20

01 May '20

HI Team, I'm getting subjected on when enrolled to new FreeIPA how can it be fixed ?

2 2

pam_subuid for automatic /etc/subuid and /etc/subgid entry creation
by Sam Morris 30 Apr '20

30 Apr '20

If you've tried to use container engines such as podman, and other tools that rely on newuidmap/newgidmap for the configuration of user namespaces on systems where users are defined in FreeIPA, you've probably had to create entries in /etc/subuid and /etc/subgid manually. I created a PAM module that automatically creates /etc/subuid and /etc/subgid entries when a user logs in. It can be found at <https://github.com/yrro/pam_subuid>. It's pretty rudimentary, but it does work on my machines; I hope other users of FreeIPA may find it useful, and maybe even send bug reports and pull requests. :) I hope this isn't considered spamming--I created it in order to use it as a stopgap measure until shadow/sssd/FreeIPA are able to manage subordinate user/group IDs themselves. -- Sam Morris <https://robots.org.uk/>

2 1

what service does en 'enrollment administrator' role user use
by Rob Verduijn 30 Apr '20

30 Apr '20

Hello, I've encountered a minor annoyance when using the 'enrollement administrator' role I created a user for ipa-client enrolment and made the user a member of the 'enrollement administrator' role. I've tested it and it was capable of enrolling clients. After this I disabled the allow_all policy. Cleared the sssd cache on the ipa server and tried again. Now the user get's a 'No permission to join this host to the IPA domain.' It works for ipa admin accounts. I guess I need to allow a service for the 'enrollement administrator' role. But I don't know which one. What service do I need to allow for the 'enrollement administrator' role to function properly ? Rob Verduijn

1 0

Re: Administration delegation for multiple hosts services
by Julien Rische 30 Apr '20

30 Apr '20

Hello Alexander, Thank you for answering this quickly. -----Original message----- >From: Alexander Bokovoy <abokovoy(a)redhat.com> >Sent: Wednesday 29th April 2020 15:48 >To: FreeIPA users list <freeipa-users(a)lists.fedorahosted.org> >Cc: Julien Rische <julien.rische(a)cern.ch> >Subject: Re: [Freeipa-users] Administration delegation for multiple hosts services > >On ke, 29 huhti 2020, Julien Rische via FreeIPA-users wrote: >>Hello everyone, >> >>To properly support load-balanced services, we need FreeIPA-managed service >>hosts to be able to retrieve the following elements, without the intervention >>of any user (only starting with the host keytab): >> >>- Keytab containing keys for: >> - Service canonical principal >> - When accessed via service DNS alias (Kerberos rDNS lookup disabled) >> - Service principal alias for host >> - When accessed via service DNS alias (Kerberos rDNS lookup enabled) >> - When accessed via host canonical FQDN >>- X.509 certificate for: >> - Service alias FQDN >> - Host actual FQDN >> >>In order to obtain each element of this list, we need to: >> >>- Allow the host to retrieve the service key >> - Creation/reset of the key should be forbidden >>- Allow the host to request a certificate for both its own FQDN and the service >> DNS alias (which matches the service canonical principal) >> - Preferably only these 2 subject names should be allowed >>- Create a service principal alias matching the host's FQDN >> >>We are managing hundreds of services spread across tens of thousands of hosts. >>Each service is managed by a different user group, hence we can't afford to >>grant all these users the "Service Administrators" privilege. >> >>Ideally, each service would be configured just once (with just maybe a few >>exceptional updates). On the contrary, hostgroup(s) containing the service >>hosts would be continuously updated. This way, FreeIPA administrator would give >>their blessing at service creation, and then let service administrators manage >>hosts membership. >> >>We think the following configuration could be applied for each service: >> >>- A hostgroup containing all the service hosts, allowed to: >> - Retrieve the service key >> - Request certificate with alternative suject name by: >> - Being assigned the to "managedBy" service attribute >> - Or being granted the permission to write the "userCertificate" >> service attribute >>- A service administrators group, allowed to: >> - Write the "member" attribute of the hostgroup >> - Create/reset the service key >> >>The keytab creation/retrieval part is quite straight forward to deal with. But >>this is not necessarily the case for certificates and service principal aliases: >> >>We observed the "managedBy" setting has 2 downsides: >> >>- It grants the host the permission to request a certificate with subject >> alternative names, but it also grants the permission to create/reset the key, >> which we don't want. >>- It consists of a list of hosts that must be continuously maintained, since it >> cannot refer to the hostgroup directly. >> >>Therefore it seems that a permission granting the hostgroup to update the >>service's "userCertificate" attribute sounds more flexible. But both options >>have the downside of granting any host from the hostgroup to request any other >>as the alternative subject name. >> >>Regarding the service principal aliases, we haven't found any way to >>dynamically update the list as the service hostgroup changes. We could either >>grant the service hostgroup the permission to update the "krbPrincipalName" >>service attribute, but it sounds like an excessive permission. We could also >>implement a background service continuously updating principal alias list of >>services according to their associated hostgroups. >> >>So I would summarise my questions this way: >> >>- Are assumptions used in this message true? >Yes. Quite good summary, thanks for that. > >>- Is granting write permissions on "userCertificate" service attribute the best >> alternative to "managedBy" for our use case? > >With FreeIPA 4.8.4+ we have support for member managers which define who >can write to the member attribute of the group. See >https://freeipa.readthedocs.io/en/latest/designs/membermanager.html for >more details. Since this applies to any group, you can have a service >administrators group to manage a hostgroup membership and to define a >group that has write permissions to userCertificate through the normal >role/permissions mechanism. > The "member manager" feature looks convenient indeed to avoid configuring an extra role and permission for the service administrators group. That's especially something less to cleanup in case the hostgroup is deleted. I would have 2 extra questions about the "managedBy" attribute: - What is the exact list of the permissions it is granting (in addition to write permission on "userCertificate" service attribute and service key creation)? - Would it make sense to extend its scope to hostgroups? > >>- What is the best way to keep a service principal alias list up-to-date with a >> hostgroup? >To add a KrbPrincipalName alias to a specific service principal on a hostgroup >change, it is probably would be easier to extend automember feature (see >details in 'ipa help automember'). Right now it is hard-coded to use two >types: hostgroup and group even though automember plugin in 389-ds >allows to define an attribute that would be used for grouping feature >and define what entry's attribute to use to populate the value. > >The problem is that it only takes a value as it is from the entry, there >is no way to transform it to some other value. If you'd look into >install/updates/40-automember.update file, you'll see that hostgroup >poluation is taking a 'dn' value of an entry and asks to add that as a >'member' of a hostgroup: > >dn: cn=Hostgroup,cn=automember,cn=etc,$SUFFIX >default: objectclass: autoMemberDefinition >default: cn: Hostgroup >default: autoMemberScope: cn=computers,cn=accounts,$SUFFIX >default: autoMemberFilter: objectclass=ipaHost >default: autoMemberGroupingAttr: member:dn > >So I would imagine that one could do something like that for >krbPrincipalName:some-attribute. And that 'some-attribute' needs to be >populated in the (host) entry itself to be used by the automember >plugin. This is not implemented right now in the 389-ds automember >plugin. > >To dive deeper into a rabbit hole, we can generate krbPrincipalName in >the service entries with the help of CoS plugin. This is a bit more >weird plugin and you need to read a lot of details about it in RHDS >documentation, but you can see how I did desktop profile rules pull into >a host entry with https://github.com/abbra/freeipa-desktop-profile. >Specifically, https://github.com/abbra/freeipa-desktop-profile/blob/master/plugin/updates… >defines CoS configuration that pulls ipaDeskData attribute into the host >entry. > So relying on the automember plugin we could import the principal alias from an attribute of the member host. Here also, I guess the main advantage is there would be no need to cleanup the service principal alias list whenever a host is removed from the hostgroup. It's a shame we cannot generate the service principal alias itself, but I suppose it would require some sort of string composition plugin: === dn: krbCanonicalName=HTTP/web.example.com,cn=services,cn=accounts,dc=example,dc=com service: HTTP ... dn: fqdn=web01.example.com,cn=computers,cn=accounts,dc=example,dc=com memberof: cn=webservers,cn=hostgroups,cn=accounts,dc=example,dc=com ... dn: cn=webservers,cn=hostgroups,cn=accounts,dc=example,dc=com member: fqdn=web01.example.com,cn=computers,cn=accounts,dc=example,dc=com ... dn: cn=web-krb-aliases,... format: "%/%(a)EXAMPLE.COM" replace: % nparam: 2 param1dn: krbCanonicalName=HTTP/web.example.com(a)EXAMPLE.COM,cn=services,cn=accounts,dc=example,dc=com param1attr: service param2dn: cn=computers,cn=accounts,dc=example,dc=com param2attr: fqdn param2filter: (memberof=cn=webservers,cn=hostgroups,cn=accounts,dc=example,dc=com) targetdn: krbCanonicalName=HTTP/web.example.com,cn=services,cn=accounts,dc=example,dc=com targetattr: krbPrincipalName === I had a look at RHDS documentation about CoS[1], it looks like a kind of template engine. I am not sure to understand if it can be used to concatenate multiple values. Is it the case? >> >>Since it is my first message on this mailing list, I would like to pay tribute >>to the development team of FreeIPA and its community. Even if there is still >>work to do, FreeIPA is a quite impressive piece of work given the complexity of >>the environment it is trying to integrate into, and the variety of use cases it >>has to support. >> >>Kind regards, >> >>--- >>Julien Rische >>Systems engineer >>CERN > >-- >/ Alexander Bokovoy >Sr. Principal Software Engineer >Security / Identity Management Engineering >Red Hat Limited, Finland Best regards, --- Julien Rische Systems engineer CERN [1] https://access.redhat.com/documentation/en-us/red_hat_directory_server/11/h…

1 0

IPA and external DNS
by Ronald Wimmer 30 Apr '20

30 Apr '20

Hi, In the company I am working for DNS is managed by a separate department. Delegating the linux.mydomain.at zone is not an option. Entering DNS entries (for IPA servers) is done by clicking around in a web interface. Entries have to be entered manually one by one. An alternative would be to use nsupdate for the linux.mydomain.at zone (and subzones). Does IPA provide a way for using nsupdate in combination with all the required DNS entries upon a IPA server/replica installation? Cheers, Ronald

3 4

Samba and winbind not starting
by Ronald Wimmer 30 Apr '20

30 Apr '20

I've managed to successfully migrate my ipa server #1 (including CA renewal master) to RHEL8. After a few checks I found out that the trust controller role was missing on the new system. So I ran ipa-adtrust-install. However, the command "id myuser(a)ad.domain" did not return any results. ipactl status revealed that smbd and winbind were not running. ipactl restart did not help. Any ideas on how to get the trust controller role working again on the new machine? Cheers, Ronald

2 3

Samba integration - access without Kerberos
by lejeczek 29 Apr '20

29 Apr '20

hi everybody. I see this subject might have been poked around many times, a couple times at least for sure. But, I thought I'll poke again and hopefully get some latest comments & thoughts on - how to make IPA's Samba allow password authentication to Win clients from outside of IPA/AD domains? Would there, by now, possibly be a semi-official (by IPA team) way of getting there, since the subject first came up a longer while ago? many thanks, L.

2 6

Prevent admin user lock
by Petar Kozić 29 Apr '20

29 Apr '20

Hi folks, My free iPA server works on public IP and need to be public. Because of that I have problem because admin user is often locked becuase too many incorrect logins. Can I filter admin user login to some IP and how? Thank you.

2 3

Client part of server install failing - KRB5CCNAME not defined in HTTP request environment
by Simon Williams 29 Apr '20

29 Apr '20

I am having an issue attempting to install IPA Server. The server component install processes correctly, but when it comes to set up the client components it fails: 2020-04-28T22:41:42Z DEBUG failed to find session_cookie in persistent storage for principal 'host/ipa.mydomain.com(a)MYDOMAIN.COM' 2020-04-28T22:41:42Z INFO trying https://ipa.mydomain.com/ipa/json 2020-04-28T22:41:42Z DEBUG Created connection context.rpcclient_1954644240 2020-04-28T22:41:42Z INFO [try 1]: Forwarding 'schema' to json server 'https://ipa.mydomain.com/ipa/json' 2020-04-28T22:41:42Z DEBUG New HTTP connection (ipa.mydomain.com) 2020-04-28T22:41:53Z DEBUG HTTP connection destroyed (ipa.mydomain.com) Traceback (most recent call last): File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 732, in single_request response.msg) ProtocolError: <ProtocolError for ipa.mydomain.com/ipa/json: 500 Internal Server Error> 2020-04-28T22:41:53Z DEBUG Destroyed connection context.rpcclient_1954644240 2020-04-28T22:41:53Z DEBUG File "/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 178, in execute return_value = self.run() File "/usr/lib/python2.7/site-packages/ipapython/install/cli.py", line 319, in run return cfgr.run() File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 360, in run return self.execute() File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 386, in execute for rval in self._executor(): File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 431, in __runner exc_handler(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 460, in _handle_execute_exception self._handle_exception(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 450, in _handle_exception six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 421, in __runner step() File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 418, in <lambda> step = lambda: next(self.__gen) File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from value = gen.send(prev_value) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 655, in _configure next(executor) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 431, in __runner exc_handler(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 460, in _handle_execute_exception self._handle_exception(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 518, in _handle_exception self.__parent._handle_exception(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 450, in _handle_exception six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 515, in _handle_exception super(ComponentBase, self)._handle_exception(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 450, in _handle_exception six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 421, in __runner step() File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 418, in <lambda> step = lambda: next(self.__gen) File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from value = gen.send(prev_value) File "/usr/lib/python2.7/site-packages/ipapython/install/common.py", line 65, in _install for unused in self._installer(self.parent): File "/usr/lib/python2.7/site-packages/ipaclient/install/client.py", line 3671, in main install(self) File "/usr/lib/python2.7/site-packages/ipaclient/install/client.py", line 2392, in install _install(options) File "/usr/lib/python2.7/site-packages/ipaclient/install/client.py", line 2734, in _install api.finalize() File "/usr/lib/python2.7/site-packages/ipalib/plugable.py", line 739, in finalize self.__do_if_not_done('load_plugins') File "/usr/lib/python2.7/site-packages/ipalib/plugable.py", line 431, in __do_if_not_done getattr(self, name)() File "/usr/lib/python2.7/site-packages/ipalib/plugable.py", line 619, in load_plugins for package in self.packages: File "/usr/lib/python2.7/site-packages/ipalib/__init__.py", line 949, in packages ipaclient.remote_plugins.get_package(self), File "/usr/lib/python2.7/site-packages/ipaclient/remote_plugins/__init__.py", line 134, in get_package plugins = schema.get_package(server_info, client) File "/usr/lib/python2.7/site-packages/ipaclient/remote_plugins/schema.py", line 553, in get_package schema = Schema(client) File "/usr/lib/python2.7/site-packages/ipaclient/remote_plugins/schema.py", line 401, in __init__ fingerprint, ttl = self._fetch(client, ignore_cache=read_failed) File "/usr/lib/python2.7/site-packages/ipaclient/remote_plugins/schema.py", line 426, in _fetch schema = client.forward(u'schema', **kwargs)['result'] File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 1190, in forward raise NetworkError(uri=server, error=e.errmsg) 2020-04-28T22:41:53Z DEBUG The ipa-client-install command failed, exception: NetworkError: cannot connect to 'https://ipa.mydomain.com/ipa/json': Internal Server Error The relevant services appear to be running certmonger.service loaded active running Certificate monitoring and dirsrv(a)MYDOMAIN-COM.service loaded active running 389 Directory S gssproxy.service loaded active running GSSAPI Proxy Daemon httpd.service loaded active running The Apache HTTP Server ipa-custodia.service loaded active running IPA Custodia Service ipa-dnskeysyncd.service loaded active running IPA key daemon ipa.service loaded active exited Identity, Policy, Audit kadmin.service loaded active running Kerberos 5 Password-changin krb5kdc.service loaded active running Kerberos 5 KDC named-pkcs11.service loaded active running Berkeley Internet Name Doma ntpd.service loaded active running Network Time Service oddjobd.service loaded active running privileged operations for u pki-tomcatd(a)pki-tomcat.service loaded active running PKI Tomcat Server pki-t I can use kinit to obtain a ticket for admin, but any ipa command that I attempt to run gives an error along the following lines ipa: DEBUG: failed to find session_cookie in persistent storage for principal 'admin(a)MYDOMAIN.COM' ipa: INFO: trying https://ipa.mydomain.com/ipa/json ipa: DEBUG: Created connection context.rpcclient_1964217648 ipa: INFO: [try 1]: Forwarding 'schema' to json server 'https://ipa.mydomain .com/ipa/json' ipa: DEBUG: New HTTP connection (ipa.mydomain.com) ipa: DEBUG: HTTP connection destroyed (ipa.mydomain.com) Traceback (most recent call last): File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 732, in single_request response.msg) ProtocolError: <ProtocolError for ipa.mydomain.com/ipa/json: 500 Internal Server Error> ipa: DEBUG: Destroyed connection context.rpcclient_1964217648 ipa: ERROR: cannot connect to 'https://ipa.mydomain.com/ipa/json': Internal Server Error In the httpd error log, I see the same error for every ipa command issued [Wed Apr 29 14:51:19.119357 2020] [:error] [pid 8505] ipa: ERROR: 500 Internal Server Error: KerberosWSGIExecutioner.__call__: KRB5CCNAME not defined in HTTP request environment [Wed Apr 29 14:51:19.120223 2020] [:error] [pid 8505] [remote 192.168.0.2:16498] mod_wsgi (pid=8505): Exception occurred processing WSGI script '/usr/share/ipa/wsgi.py'. [Wed Apr 29 14:51:19.120335 2020] [:error] [pid 8505] [remote 192.168.0.2:16498] RuntimeError: response has not been started The same error is present at the time the install failed. The Kerberos ticket is valid as ldapsearch works using it [root@ipa1 ~]# ldapsearch -h ipa.mydomain.com -b ou=people,o=ipaca -Y GSSAPI -s sub "(uid=admin)" dn uid SASL/GSSAPI authentication started SASL username: admin(a)MYDOMAIN.COM SASL SSF: 256 SASL data security layer installed. # extended LDIF # # LDAPv3 # base <ou=people,o=ipaca> with scope subtree # filter: (uid=admin) # requesting: dn uid # # admin, people, ipaca dn: uid=admin,ou=people,o=ipaca uid: admin # search result search: 4 result: 0 Success # numResponses: 2 # numEntries: 1 but doesn't without it [root@ipa1 ~]# ldapsearch -h ipa.mydomain.com -b ou=people,o=ipaca -s sub "(uid=admin)" dn uid SASL/EXTERNAL authentication started ldap_sasl_interactive_bind_s: Unknown authentication method (-6) additional info: SASL(-4): no mechanism available: Does anyone have any ideas? I'm tearing my hair out here!

1 0

HBAC Rule to allow anonymous NFS mounts from specific subnets
by White, David 29 Apr '20

29 Apr '20

Is it possible to allow hosts in specific subnets to connect to a FreeIPA-connected server over NFS anonymously? e.g. I'm wondering if I could setup a HBAC rule by doing something like the following: ipa hbacsvc-add nfs-mount ipahbacrule-add allow_nfs_mount Then attach that to the NFS server And then allow "anyone" to connect over NFS to that server Bonus points if there's a way to restrict the source NFS connection by IP address or subnet Is this possible?

2 1

Administration delegation for multiple hosts services
by Julien Rische 29 Apr '20

29 Apr '20

Hello everyone, To properly support load-balanced services, we need FreeIPA-managed service hosts to be able to retrieve the following elements, without the intervention of any user (only starting with the host keytab): - Keytab containing keys for: - Service canonical principal - When accessed via service DNS alias (Kerberos rDNS lookup disabled) - Service principal alias for host - When accessed via service DNS alias (Kerberos rDNS lookup enabled) - When accessed via host canonical FQDN - X.509 certificate for: - Service alias FQDN - Host actual FQDN In order to obtain each element of this list, we need to: - Allow the host to retrieve the service key - Creation/reset of the key should be forbidden - Allow the host to request a certificate for both its own FQDN and the service DNS alias (which matches the service canonical principal) - Preferably only these 2 subject names should be allowed - Create a service principal alias matching the host's FQDN We are managing hundreds of services spread across tens of thousands of hosts. Each service is managed by a different user group, hence we can't afford to grant all these users the "Service Administrators" privilege. Ideally, each service would be configured just once (with just maybe a few exceptional updates). On the contrary, hostgroup(s) containing the service hosts would be continuously updated. This way, FreeIPA administrator would give their blessing at service creation, and then let service administrators manage hosts membership. We think the following configuration could be applied for each service: - A hostgroup containing all the service hosts, allowed to: - Retrieve the service key - Request certificate with alternative suject name by: - Being assigned the to "managedBy" service attribute - Or being granted the permission to write the "userCertificate" service attribute - A service administrators group, allowed to: - Write the "member" attribute of the hostgroup - Create/reset the service key The keytab creation/retrieval part is quite straight forward to deal with. But this is not necessarily the case for certificates and service principal aliases: We observed the "managedBy" setting has 2 downsides: - It grants the host the permission to request a certificate with subject alternative names, but it also grants the permission to create/reset the key, which we don't want. - It consists of a list of hosts that must be continuously maintained, since it cannot refer to the hostgroup directly. Therefore it seems that a permission granting the hostgroup to update the service's "userCertificate" attribute sounds more flexible. But both options have the downside of granting any host from the hostgroup to request any other as the alternative subject name. Regarding the service principal aliases, we haven't found any way to dynamically update the list as the service hostgroup changes. We could either grant the service hostgroup the permission to update the "krbPrincipalName" service attribute, but it sounds like an excessive permission. We could also implement a background service continuously updating principal alias list of services according to their associated hostgroups. So I would summarise my questions this way: - Are assumptions used in this message true? - Is granting write permissions on "userCertificate" service attribute the best alternative to "managedBy" for our use case? - What is the best way to keep a service principal alias list up-to-date with a hostgroup? Since it is my first message on this mailing list, I would like to pay tribute to the development team of FreeIPA and its community. Even if there is still work to do, FreeIPA is a quite impressive piece of work given the complexity of the environment it is trying to integrate into, and the variety of use cases it has to support. Kind regards, --- Julien Rische Systems engineer CERN

2 1

Cannot delete old server after migration
by Ronald Wimmer 29 Apr '20

29 Apr '20

I followed the guide at https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/ht… to migrate my server (including CA renewal master). When I try to uninstall tho old server according to https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/ht… I get the following error message: ipa server-del idm1.linux.mydomain.at Removing ipa1.linux.mydomain.at from replication topology, please wait... ipa: ERROR: Server removal aborted: Removal of 'ipa1.linux.mydomain.at' leads to disconnected topology in suffix 'ca': Topology does not allow server idm1.linux.mydomain.at to replicate with servers: ipa5.linux.mydomain.at ipa2.linux.mydomain.at ipa6.linux.mydomain.at Topology does not allow server ipa2.linux.mydomain.at to replicate with servers: ipa5.linux.mydomain.at idm1.linux.mydomain.at Topology does not allow server ipa5.linux.mydomain.at to replicate with servers: ipa2.linux.mydomain.at idm1.linux.mydomain.at ipa6.linux.mydomain.at Topology does not allow server ipa6.linux.mydomain.at to replicate with servers: ipa5.linux.mydomain.at idm1.linux.mydomain.at. How do I get rid of the remaining replication agreements? Cheers, Ronald

2 1

SERVFAIL for one hostname
by Tiemen Ruiten 29 Apr '20

29 Apr '20

Hello, Since a few days ago, we're having issues with resolution of this hostname: download.wisselkoersenvoorjeadministratie.nl Our FreeIPA DNS servers return SERVFAIL for that particular hostname. What's funny, after I do a (successful) lookup directly at one of the configured forwarders, 1.1.1.1, resolution works, until the TTL expires. Other hostnames work fine. How can I troubleshoot this? FreeIPA versions: ipa-server-4.6.5-11.el7.centos.4.x86_64 ipa-server-dns-4.6.5-11.el7.centos.4.noarch [ter@i.rdmedia.com@zinc ~]$ dig download.wisselkoersenvoorjeadministratie.nl ; <<>> DiG 9.11.4-P2-RedHat-9.11.4-9.P2.el7 <<>> download.wisselkoersenvoorjeadministratie.nl ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 48732 ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4096 ;; QUESTION SECTION: ;download.wisselkoersenvoorjeadministratie.nl. IN A ;; Query time: 40 msec ;; SERVER: 10.100.110.36#53(10.100.110.36) ;; WHEN: Tue Apr 21 11:58:51 CEST 2020 ;; MSG SIZE rcvd: 73 [ter@i.rdmedia.com@zinc ~]$ dig download.wisselkoersenvoorjeadministratie.nl @1.1.1.1 ; <<>> DiG 9.11.4-P2-RedHat-9.11.4-9.P2.el7 <<>> download.wisselkoersenvoorjeadministratie.nl @1.1.1.1 ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 58424 ;; flags: qr rd ra ad; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 1452 ;; QUESTION SECTION: ;download.wisselkoersenvoorjeadministratie.nl. IN A ;; ANSWER SECTION: download.wisselkoersenvoorjeadministratie.nl. 3600 IN A 185.87.187.229 ;; Query time: 43 msec ;; SERVER: 1.1.1.1#53(1.1.1.1) ;; WHEN: Tue Apr 21 11:58:59 CEST 2020 ;; MSG SIZE rcvd: 133 [ter@i.rdmedia.com@zinc ~]$ dig download.wisselkoersenvoorjeadministratie.nl ; <<>> DiG 9.11.4-P2-RedHat-9.11.4-9.P2.el7 <<>> download.wisselkoersenvoorjeadministratie.nl ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 57208 ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4096 ;; QUESTION SECTION: ;download.wisselkoersenvoorjeadministratie.nl. IN A ;; ANSWER SECTION: download.wisselkoersenvoorjeadministratie.nl. 3600 IN A 185.87.187.229 ;; Query time: 24 msec ;; SERVER: 10.100.110.36#53(10.100.110.36) ;; WHEN: Tue Apr 21 11:59:01 CEST 2020 ;; MSG SIZE rcvd: 89 -- Tiemen Ruiten Infrastructure Engineer

3 7

Migrate CA from 7 to 8
by Ronald Wimmer 29 Apr '20

29 Apr '20

According to https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/ht… I should do a "ipa-csreplica-manage list" on the new server after having run "ipa-replica-install" The verbose output in the RedHat-Document has a different output of "ipa-csreplica-manage" than mine. The document says "Incremental update succeeded" whereas mine reports "No replication sessions started since server startup". Is this a problem or should replication not have already taken place at this migration step? Cheers, Ronald

1 1

Apparently transient error cl5DBData2Entry - Invalid data version
by Roderick Johnstone 29 Apr '20

29 Apr '20

Hi We have 3 IPA servers which we are in the process of updating from RHEL 7.7 to RHEL 7.8. Servers X, Z are at: ipa-server-4.6.6-11.el7.x86_64 (RHEL 7.8) Server W is at: ipa-server-4.6.5-11.el7_7.3.x86_64 (RHEL 7.7) Server X was updated some time ago, and server Z was updated last Thursday. I was doing some checks of the log files before our planned update of server W to RHEL 7.8 tomorrow and found the following in /var/log/dirsrv/slapd-REALM/errors: [26/Apr/2020:22:00:21.704887592 +0100] - INFO - dblayer_copy_directory - Backing up file 119 (/var/lib/dirsrv/slapd-REALM/bak/REALM/ipaca/vlv#cacompleterenewalpkitomcatindex.db) [26/Apr/2020:22:00:23.627421118 +0100] - ERR - NSMMReplicationPlugin - changelog program - cl5DBData2Entry - Invalid data version [26/Apr/2020:22:00:24.760704543 +0100] - INFO - dblayer_copyfile - Copying /var/lib/dirsrv/slapd-REALM/db/ipaca/vlv#cacompleterenewalpkitomcatindex.db to /var/lib/dirsrv/slapd-REALM/bak/REALM/ipaca/vlv#cacompleterenewalpkitomcatindex.db [26/Apr/2020:22:00:24.776815976 +0100] - ERR - NSMMReplicationPlugin - changelog program - cl5DBData2Entry - Invalid data version The errors were generated during our cronjob that runs this each night: /sbin/ipa-backup --data --online The errors don't seem to have been present the last two nights. Would I be right to assume that this is just some transient inconsistency caused by doing the online backup or should I be more worried even though the error hasn't occurred since? Thanks for any insights on this. Roderick Johnstone

1 0

DNSSEC between two topologically disjoint domains - ?
by lejeczek 28 Apr '20

28 Apr '20

hi everyone, I want to ask if it's possible setup and if so then how, IPA's DNSes forward directly to each other (let be only two or however many you might have) while those IPAs "fqdn" are "disconnected" - and all this without disabling DNSSEC? In most basic example: private.dom <=> domain.priv many thanks, L.

1 0

ipa-adtrust-install --unattended | did not quite work?
by lejeczek 28 Apr '20

28 Apr '20

hi everyone, I did something pretty vanilla: $ ipa-adtrust-install --unattended --admin-password=xxx Process showed first some warning about "unattended" but then this: Configuring CIFS [1/24]: validate server hostname [2/24]: stopping smbd [3/24]: creating samba domain object [4/24]: retrieve local idmap range [5/24]: creating samba config registry [6/24]: writing samba config file [7/24]: adding cifs Kerberos principal [8/24]: adding cifs and host Kerberos principals to the adtrust agents group [9/24]: check for cifs services defined on other replicas [10/24]: adding cifs principal to S4U2Proxy targets [11/24]: adding admin(group) SIDs [12/24]: adding RID bases [13/24]: updating Kerberos config 'dns_lookup_kdc' already set to 'true', nothing to do. [14/24]: activating CLDAP plugin [15/24]: activating sidgen task [16/24]: map BUILTIN\Guests to nobody group [17/24]: configuring smbd to start on boot [18/24]: adding special DNS service records [19/24]: restarting Directory Server to take MS PAC and LDAP plugins changes into account [20/24]: adding fallback group [21/24]: adding Default Trust View [22/24]: setting SELinux booleans [23/24]: starting CIFS services ipaserver.install.adtrustinstance: CRITICAL CIFS services failed to start [24/24]: restarting smbd Done configuring CIFS. Now, Samba would not start and I wonder what that might have to do with the above: tarting Samba SMB Daemon... [2020/02/14 11:21:34.801358, 0] ../../source3/passdb/pdb_interface.c:171(make_pdb_method_name) No builtin nor plugin backend for ipasam found smb.service: Main process exited, code=exited, status=1/FAILURE smb.service: Failed with result 'exit-code'. Failed to start Samba SMB Daemon. Or is is it unrelated? Hot to troubleshoot & fix it? I'm on Centos 8 with ipa-server-4.8.0-13.module_el8.1.0+265+e1e65be4.x86_64 many thanks, L.

2 4

Pausing replication or another approach to testing whilst limiting blast radius
by David Harvey 25 Apr '20

25 Apr '20

Dear list, I'd like to do a test run of a script that I use to sync our HR data with our freeipa infrastructure. Is it possible to pause replication, or essentially fence a server off, so that if I run the updated script against it, I can limit the changes to that target server until I've checked the changes look sound? Thanks as always, David

2 2

Ansible tasks for certprofiles and ca-acls
by pleusmann＠conet.de 24 Apr '20

24 Apr '20

Hi, I'd like to issue wildcard-certificates following this guide: https://www.freeipa.org/page/Howto/Wildcard_certificates Is there any way to manage certprofiles and ca-acls using ansible? Cheers, Philipp

3 2

User private groups
by Mary Georgiou 24 Apr '20

24 Apr '20

Hello, I'm a bit confused with the private user groups. If I set a user's A uidNumber to the gidNumber of another group B (not a private user one) then the user will have the same uidNumber with two groups' gidNumbers the group B and their own private group. How does this affect ldapsearch if I'd like to retrieve the group B and not the private group based on gid? Are there going to be other side effects? Also, from what I've understood the private user groups are used to manage rights, so I guess we cannot choose to delete them or at least chose to have them created as non POSIX, right? Thank you very much, Mary

2 2

Ipa-client-install ldaps
by Per Qvindesland 24 Apr '20

24 Apr '20

HI Is it possible to run ipa-client-install when the host only listens to ldaps (636)? We have a policy that all traffic must be sent encrypted hence using ldap (389) is not possible. Regards Per

1 0

Authentication taking too long
by Raul Dias 23 Apr '20

23 Apr '20

Hello, Authenticating a user is taking about 30s. This sounds like a dns timeout or something like this. How can I debug where the problem is? Thank you, -rsd

2 2

Samba integration ROLLBACK ?
by lejeczek 23 Apr '20

23 Apr '20

hi guys, I year or so ago it was _not_ possible to rollback Samba integration in official, orderly fashion. Would you know if it is still the case or maybe IPA evolution brought some tools for that? many thanks, L.

2 1

AD trust nested AD groups
by Natxo Asenjo 23 Apr '20

23 Apr '20

hi, we have a working one way trust between an AD forest and a RHEL 7 forest. In order to use AD nested groups, do we need to add an external IDM group for every nested group? -- Groeten, natxo

2 5

CSR in PRINTABLESTRING enc when docs says UTF8STRING is default
by Fredrik Arneving 23 Apr '20

23 Apr '20

Hi, I've tried to setup my freeIPA server on a freshly installed CentOS8 as a sub_CA of my existing PKI with private root-CA. My signing-CA has a match policy for (C)ountry and (O)rganizationName. When trying to sign the CSR generated from freeIPA with command below it fails on a string encryption mismatch. The string encryption on my organizationName, as well as my server DN is in PRINTABLESTRING encoding but my openssl generated signing cert needs it to be UTF8STRING. I was under the impression UTF8STRING is default for freeIPA CSR's. What do I miss and how can I force it to be UTF8STRING? CSR was generated with command: ipa-server-install -r MYREALM.AS.UPPERCASE.DNSDOMAIN \ --external-ca \ --ca-subject CN=ipa-server-fqdn,C=SE,O=MyOrganizationName \ --ca-base C=SE,O=MyOrganizationName Installation is successful and I'm supposed to sign the CSR and finalize ipa-install with second step. However, the signing fails because MyOranizationName != MyOrganizationName due to different encodings. When looking at the CSR with "openssl req -noout -text -in ipa.csr" everything looks OK but when using "openssl asn1parse -in ipa.csr" it shows the mismatch of the organizationName PRINTABLESTRING compared to my successfully signed CSR's UTF8STRING. Any ideas? kernel version: 4.18.0-147.5.1.el8_1.x86_64 ipa-server: ipa-server-4.8.0-13.module_el8.1.0+265+e1e65be4.x86_64 openssl: openssl-1.1.1c-2.el8.x86_64 Regards, /Fredrik

4 7

Re: EL7 Upgrades
by Rob Crittenden 21 Apr '20

21 Apr '20

Angus Clarke via FreeIPA-users wrote: > Hello > > Our environment has grown and as additional IPA servers have been added, > different versions have been deployed. I am looking to bring IPA servers > up to the latest version for EL7 and wanted some guidance or reassurance. > > Here are my versions, they are all VMWare VMs: > > idm001 ipa-server-4.5.4-10.0.1.el7.x86_64 Red Hat Enterprise Linux > Server release 7.4 (Maipo) * UPGRADED * > idm002 ipa-server-4.5.0-22.0.1.el7_4.x86_64 Red Hat Enterprise Linux > Server release 7.4 (Maipo) * CA MASTER * > idm003 ipa-server-4.5.0-22.0.1.el7_4.x86_64 Red Hat Enterprise Linux > Server release 7.4 (Maipo) > idm004 ipa-server-4.5.0-22.0.1.el7_4.x86_64 Red Hat Enterprise Linux > Server release 7.4 (Maipo) > idm005 ipa-server-4.6.5-11.0.1.el7_7.4.x86_64 Red Hat Enterprise Linux > Server release 7.7 (Maipo) > idm006 ipa-server-4.6.5-11.0.1.el7_7.4.x86_64 Red Hat Enterprise Linux > Server release 7.7 (Maipo) > idm007 ipa-server-4.6.5-11.0.1.el7_7.3.x86_64 Red Hat Enterprise Linux > Server release 7.7 (Maipo) > idm008 ipa-server-4.6.5-11.0.1.el7_7.3.x86_64 Red Hat Enterprise Linux > Server release 7.7 (Maipo) > idm009 ipa-server-4.6.4-10.0.1.el7_6.6.x86_64 Red Hat Enterprise Linux > Server release 7.6 (Maipo) > idm010 ipa-server-4.6.4-10.0.1.el7_6.6.x86_64 Red Hat Enterprise Linux > Server release 7.6 (Maipo) > > I have upgraded idm001 without issue, the path was: > > 1) take VMWare snapshot > 2) ipactl stop > 3) yum update (channel with latest EL versions) > 4) reboot > 5) after a day or so, remove VMWare snapshot > > and it now shows: > > idm001 ipa-server-4.6.5-11.0.1.el7_7.4.x86_64Red Hat Enterprise Linux > Server release 7.7 (Maipo) > > Post upgrade checks on idm001: > > I see network connections to port 88 and 389 > I can obtain a kerberos ticket through kinit > I can login through the web interface and issue ipa commands. > I don't see anything particularly alarming in log files. > > I understand the distributed LDAP schema was already up-to-date due to > the roll out of idm005-006 on EL7.7/ipa-server-4.6.5-11.0.1.el7_7.4. > > I'm particularly concerned about upgrading idm002, my CA server - > perhaps I should upgrade through each EL iteration? Are VMWare snapshots > a suitable roll back mechanism for IPA (and IPA CA master) server upgrades? Yes and yes, especially given your already mixed versions. Given you have other CAs in your network there is nothing too special about idm002 other than it has the additional role as CA renewal master. > I was reading Rob's reply to Christian Reiss regarding his upgrade path > to EL8 (bookmarked for future reference,) I don't have the > ipa-crlgen-manage command on my CA server (presumably due to older > version) to check if it is the CRL generator - I assume it is though, > although in any case I'm unsure of the relevance with this EL7 series of > ipa-server. There are instructions at https://www.freeipa.org/page/Howto/Promote_CA_to_Renewal_and_CRL_Master which can tell you which one is doing it. If you aren't using CRLs at all then this is probably not super important but you want to avoid having 2 or more masters generating one since there is a race condition where separate CA's could generate different, but otherwise valid, CRLs. > All my IPA servers have CA capability except for idm001 - I presume I > deployed it incorrectly in the first place. I would like to add CA > facility to it, perhaps this is for a different thread though ... ipa-ca-install should do it but yeah, I'd probably focus on getting the other masters up to 7.7 or 7.8 before trying to add on the CA. You don't necessarily need a CA on every master. You want to avoid single point of failure but you don't need it everywhere. rob

2 1

Sudo command not working
by Faraz Younus 21 Apr '20

21 Apr '20

Hi Team, I'm getting error when executing sudo su on client server what can be the issue sudo command is there [faraz.younus@england-web-dev ~]$ sudo su [sudo] password for faraz.younus: faraz.younus is not allowed to run sudo on england-web-dev. This incident will be reported.

3 3

replica install fails
by Alexandru David 21 Apr '20

21 Apr '20

Hi all I have two centos 8 servers. One is installed and configured as master and AD trust controller. The second one, I'm trying to configure it as a replica, but what ever I do, the replica server fails to start. Environment : OS - CentOS Linux release 8.1.1911 (Core) ipa-server: ipa-server-4.8.0-13.module_el8.1.0+265+e1e65be4.x86_64 Replica install is started with : #ipa-replica-install -v --principal admin -p XXXXX --domain ipamaster01.example.com --server ipamaster01.example.com --setup-ca --setup-adtrust The client install goes well, but the server stops at : Starting replication, please wait until this has completed. Update in progress, 15 seconds elapsed [ldap://ipamaster01.example.com:389] reports: Update failed! Status: [Error (-2) - LDAP error: Local error - no response received] On the ipareplica-install.log, last entries are: 2020-04-14T08:29:13Z DEBUG Created connection context.ldap2_139862275887680 2020-04-14T08:29:13Z DEBUG Fetching nsDS5ReplicaId from master [attempt 1/5] 2020-04-14T08:29:13Z DEBUG retrieving schema for SchemaCache url=ldap://ipamaster01.example.com:389 conn=<ldap.ldapobject.SimpleLDAPObject object at 0x7f34367c7080> 2020-04-14T08:29:13Z DEBUG Successfully updated nsDS5ReplicaId. 2020-04-14T08:29:13Z DEBUG Add or update replica config cn=replica,cn=dc\=ipamaster01\,dc\=example\,dc\=com,cn=mapping tree,cn=config 2020-04-14T08:29:13Z DEBUG Added replica config cn=replica,cn=dc\=ipamaster01\,dc\=example\,dc\=com,cn=mapping tree,cn=config 2020-04-14T08:29:13Z DEBUG Add or update replica config cn=replica,cn=dc\=ipamaster01\,dc\=example\,dc\=com,cn=mapping tree,cn=config 2020-04-14T08:29:13Z DEBUG No update to cn=replica,cn=dc\=ipamaster01\,dc\=example\,dc\=com,cn=mapping tree,cn=config necessary 2020-04-14T08:29:13Z DEBUG Waiting for replication (ldapi://%2Fvar%2Frun%2Fslapd-IPAMASTER01-EXAMPLE-COM.socket) cn=meToipamaster01.example.com,cn=replica,cn=dc\=ipamaster01\,dc\=example\,dc\=com,cn=mapping tree ,cn=config (objectclass=*) 2020-04-14T08:29:13Z DEBUG Entry found [LDAPEntry(ipapython.dn.DN('cn=meToipamaster01.example.com,cn=replica,cn=dc\=ipamaster01\,dc\=example\,dc\=com,cn=mapping tree,cn=config'), {'objectClass': [b'nsds5replicat ionagreement', b'top'], 'cn': [b'meToipamaster01.example.com'], 'nsDS5ReplicaHost': [b'ipamaster01.example.com'], 'nsDS5ReplicaPort': [b'389'], 'nsds5replicaTimeout': [b'120'], 'nsDS5ReplicaRoot': [b'dc=ipamaste r01,dc=example,dc=com'], 'description': [b'me to ipamaster01.example.com'], 'nsDS5ReplicatedAttributeList': [b'(objectclass=*) $ EXCLUDE memberof idnssoaserial entryusn krblastsuccessfulauth krblastfailedauth kr bloginfailedcount'], 'nsDS5ReplicaTransportInfo': [b'LDAP'], 'nsDS5ReplicaBindMethod': [b'SASL/GSSAPI'], 'nsds5ReplicaStripAttrs': [b'modifiersName modifyTimestamp internalModifiersName internalModifyTimestamp'] , 'nsDS5ReplicatedAttributeListTotal': [b'(objectclass=*) $ EXCLUDE entryusn krblastsuccessfulauth krblastfailedauth krbloginfailedcount'], 'nsds5replicareapactive': [b'0'], 'nsds5replicaLastUpdateStart': [b'197 00101000000Z'], 'nsds5replicaLastUpdateEnd': [b'19700101000000Z'], 'nsds5replicaChangesSentSinceStartup': [b''], 'nsds5replicaLastUpdateStatus': [b'Error (0) No replication sessions started since server startup' ], 'nsds5replicaLastUpdateStatusJSON': [b'{"state": "green", "ldap_rc": "0", "ldap_rc_text": "success", "repl_rc": "0", "repl_rc_text": "replica acquired", "date": "2020-04-14T08:29:13Z", "message": "Error (0) N o replication sessions started since server startup"}'], 'nsds5replicaUpdateInProgress': [b'FALSE'], 'nsds5replicaLastInitStart': [b'19700101000000Z'], 'nsds5replicaLastInitEnd': [b'19700101000000Z']})] 2020-04-14T08:29:29Z DEBUG Traceback (most recent call last): File "/usr/lib/python3.6/site-packages/ipaserver/install/service.py", line 603, in start_creation run_step(full_msg, method) File "/usr/lib/python3.6/site-packages/ipaserver/install/service.py", line 589, in run_step method() File "/usr/lib/python3.6/site-packages/ipaserver/install/dsinstance.py", line 427, in __setup_replica cacert=self.ca_file File "/usr/lib/python3.6/site-packages/ipaserver/install/replication.py", line 1860, in setup_promote_replication raise RuntimeError("Failed to start replication") RuntimeError: Failed to start replication I can query both ldap servers on the master and replica with : ldapsearch -h ldap://ipamaster01.example.com -p 389 -Y GSSAPI -b "" -s base -W ldapsearch -h ldap://ipareplica01.example.com -p 389 -Y GSSAPI -b "" -s base -W in this point, I'm really run out of options. Could someone tell me what I'm doing wrong? Cheers Alex

3 9

ipa: ERROR: CIFS server communication error: code "3221225506", message "{Access Denied} A process has requested access to an object but has not been granted those access rights." (both may be "None")
by Bernard Lheureux 20 Apr '20

20 Apr '20

Hi all, After a fresh install of FreeIPA 4.6.5-11.el7.centos.x86_64, fully updated from update repo on a CentOS7 x64 server, it appears that it is totally impossible to establish a trust with an AD running on local AD servers, we did it a few times ago with exactly the same distribution and had really no problem, we tried to completely reinstall the machine and the IPA wit always the same results, ipa: ERROR: CIFS server communication error: code "3221225506", message "{Access Denied} A process has requested access to an object but has not been granted those access rights." (both may be "None") Could someone point me to the direction to look for, because we are going nuts on this ? We found some tips in the /var/log/httpd/errors, but nothing seems to provide sufficient infos... [Wed Oct 02 12:54:57.868830 2019] [:error] [pid 2036] ipa: INFO: [jsonserver_session] admin(a)DOMAIN.INTRA: trust_add/1(u'domain.intra', trust_type=u'ad', realm_admin=u'admin', realm_passwd=u'********', bidirectional=True, version=u'2.231'): RemoteRetrieveError The IPA server and the AD servers are in the same VLan with no firewall between them samba version on the IPA server is the latest available: 4.9.1-6.el7.noarch Thanks for your help...

3 7

Bizarre behavior (SSO+MFA) asking for credentials on some servers, but with extra "specialness"
by Michael S. Moody 20 Apr '20

20 Apr '20

Good evening, First, thank you, again, for FreeIPA. I know I say it every time I send a message to the list, but it's magic. We're running into an interesting situation where some of our hosts are requesting a first/second factor, even once authenticated. Essentially, we SSH into a bastion host using MFA (PW+TOTP at the moment). Once we're in, we're able to pretty reliably SSH to other hosts without issue. However, we've got a few hosts that prompt for "First Factor/Second Factor". We're able to authenticate against those hosts if we provide credentials, but if we logout and log back in, we have to do it again. Interestingly, there's a host we can SSH to (bastion01 to dev-server02) which we can then SSH to another (dev-server02 to dev-server01) and not be prompted for credentials, but if we attempt to authenticate against it directly from the bastion host, we get prompted (bastion01 to dev-server01). Similarly, we can hop onto other servers, no issues. I can SSH from a host to another and then try to SSH again back (a circle) and get prompted (bastion01 too dev-server02 to dev-server01 to bastion01) and it might work, or it might not, depending on the host in question. It's the most bizarre behavior I've ever seen with FreeIPA. Any guidance that you can provide is appreciated. Thanks in advance, Michael S. Moody

2 1

Re: Maybe use FreeIPA to manage user certificates for Apache/Nginx access?
by Joseph Flynn 17 Apr '20

17 Apr '20

Thank you Alexander.

1 0

Re: Maybe use FreeIPA to manage user certificates for Apache/Nginx access?
by Joseph Flynn 17 Apr '20

17 Apr '20

Thanks for the pointer Rob.

1 0

Maybe use FreeIPA to manage user certificates for Apache/Nginx access?
by Henery Hawk 17 Apr '20

17 Apr '20

I've tinkered with FreeIPA a while ago when I was investigating various ways to control WiFi access but have not been very active lately with it. I have a new topic that popped up where I need to create user certificates for access to a specific web site hosted behind an Nginx Reverse Proxy. I have manually created a (forgive my incorrect terms) ca cert and pointed nginx to it and then I created user certs for each user that needs to be granted access. This was done manually using openssh in the pilot phase. Would FreeIPA be able to do this at scale? I see some chatter about FreeIPA 4.x introducing user certs, but that chatter hasn't specifically covered how to get the master ca cert linked to nginx/apache. The noob question might be useful for someone doing similar research. I am not mission critical in this investigation, just trying to minimize my manual management of user certs. Thanks, Henery Hawk

3 2

Centos 6 FreeIPA Client install Error
by Faraz Younus 17 Apr '20

17 Apr '20

Hi Team, I'm trying to add client with hostname abc.example.com on freeip server( ipa1.idm.example.com) but on centos 7 it works fine. All ports are allowed and accessible from client side Can you please share what the exactly problem is and how it can be fixed ? TASK [Enroll host to FreeIPA] ************************************************************************************************************************** failed: [sherwin-centos6-test.example.com] (item=ipa1.idm.example.com) => {"ansible_loop_var": "item", "changed": false, "cmd": ["ipa-client-install", "-U", "-w", "8ekh0Y", "--mkhomedir", "--hostname", " sherwin-centos6-test.example.com", "--ntp-server", "169.254.169.123", "--domain", "idm.example.com", "--realm", "IDM.EXAMPLE.COM", "--server", " ipa1.idm.example.com"], "delta": "0:00:00.202857", "end": "2020-04-16 10:29:37.411081", "failed_when_result": true, "item": "ipa1.idm.example.com", "msg": "non-zero return code", "rc": 1, "start": "2020-04-16 10:29:37.208224", "stderr": "LDAP Error: Connect error: TLS error -8172:Peer's certificate issuer has been marked as not trusted by the user.\nLDAP Error: Connect error: TLS error -8172:Peer's certificate issuer has been marked as not trusted by the user.\nFailed to verify that ipa1.idm.example.com is an IPA Server.\nThis may mean that the remote server is not up or is not reachable due to network or firewall settings.\nPlease make sure the following ports are opened in the firewall settings:\n TCP: 80, 88, 389\n UDP: 88 (at least one of TCP/UDP ports 88 has to be open)\nAlso note that following ports are necessary for ipa-client working properly after enrollment:\n TCP: 464\n UDP: 464, 123 (if NTP enabled)\nInstallation failed. Rolling back changes.\nIPA client is not configured on this system.", "stderr_lines": ["LDAP Error: Connect error: TLS error -8172:Peer's certificate issuer has been marked as not trusted by the user.", "LDAP Error: Connect error: TLS error -8172:Peer's certificate issuer has been marked as not trusted by the user.", "Failed to verify that ipa1.idm.example.com is an IPA Server.", "This may mean that the remote server is not up or is not reachable due to network or firewall settings.", "Please make sure the following ports are opened in the firewall settings:", " TCP: 80, 88, 389", " UDP: 88 (at least one of TCP/UDP ports 88 has to be open)", "Also note that following ports are necessary for ipa-client working properly after enrollment:", " TCP: 464", " UDP: 464, 123 (if NTP enabled)", "Installation failed. Rolling back changes.", "IPA client is not configured on this system."], "stdout": "\u001b[?1034h", "stdout_lines": ["\u001b[?1034h"]}

3 4

How to set up kerberized web service with access control?
by Dominik Vogt 16 Apr '20

16 Apr '20

Hi folks, on RHEL8.0, we've set up a small cluster with a FreeIPA server and two clients, one running a browser (Firefox) and the other running a web server (tomcat). (IdM is still configured with the defaults.) Now, what is the proper way to tackle fine grained access control to the web service? We want to do something like the IdM server GUI, i.e. some users are authorized to use all the functions of the GUI, others are restricted to editing or viewing a limited set of pages, and others are locked out. So far I've looked into host based authentication, but that doen't seem to solve the task at hand. All access control should be done through Kerberos tickets. A pointer to related documentation would also help. Ciao Dominik ^_^ ^_^ -- Dominik Vogt

4 4

Brand new server install fails - [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate
by Chris Moody 15 Apr '20

15 Apr '20

Trying to stand up a brand new IPA Server install on a brand new VM. I am lightly obfuscating some strings out of respect for the client so their domain-name will say 'DOMAIN' in my email. ========== ~# cat /etc/lsb-release DISTRIB_ID=Ubuntu DISTRIB_RELEASE=19.10 DISTRIB_CODENAME=eoan DISTRIB_DESCRIPTION="Ubuntu 19.10" ========== ~# ipa --version VERSION: 4.8.1, API_VERSION: 2.233 ========== Having built a number of IPA Servers for various entities in the past, I've already got the requisite setup/prep stuff configured. - DNS Resolution in functioning forward/reverse - /etc/hosts is set correctly to point to the public IPv4 and IPv6 interface IPs. - hostname is set to fqdn. - time is current and sync'd before any IPA commands are run Issuing the following command to kick off the ipa-server-install process: ========== ipa-server-install --allow-zone-overlap -v -d --setup-dns --mkhomedir --auto-reverse -p XXXXX -a YYYYY --forwarder=2604:ZZZ::AAA -n ipa.DOMAIN.com -r IPA.DOMAIN.COM --hostname=`hostname` --ntp-pool=pool.ntp.org ========== The server install process proceeds and succeeds up to the point: ========== [6/7]: creating replica keys [7/7]: configuring ipa-dnskeysyncd to start on boot Starting external process ===== Which is kicking off: ===== 2020-04-15T20:15:46Z DEBUG args=['/usr/sbin/ipa-client-install', '--on-master', '--unattended', '--domain', 'ipa.DOMAIN.com', '--server', 'sfca-do-ipa-1.ipa.DOMAIN.com', '--realm', 'IPA.DOMAIN.COM', '--hostname', 'sfca-do-ipa-1.ipa.DOMAIN.com', '--no-ntp', '--mkhomedir'] ===== The client setup portion fails every single time with the following error: ===== 2020-04-15T20:15:48Z ERROR cannot connect to 'https://sfca-do-ipa-1.ipa.DOMAIN.com/ipa/json': [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1076) ===== I've done some searching to see how other people have dealt with python throwing the CERTIFICATE_VERIFY_FAILED error, but nothing seems to make any difference in telling the ipa-client-install to respect the locally issued IPA Certs that are read during the setup process. Since some threads mention it helping, I've ensured the python-certifi package is installed and up to date. I've tried toggling between the version of python being used [the system default of python2.7 or python3.7]. Even though it should not make any difference, since the client is reading an IPA generated cert and complaining, but I've also rebuilt the /etc/ssl/certs store since some threads have mentioned this error having some relations [update-ca-certificates -f -v]. Any thoughts on how to get past the ipa-client-install section failing on this? This server setup is -so- close to being complete. Cheers, -Chris

1 0

[4.8.6] External CA installation failed with ldap.NO_SUCH_OBJECT: {'desc': 'No such object', 'matched': 'cn=cas,cn=ca, <baseDN>'}
by Luginbash Hiyajo 13 Apr '20

13 Apr '20

Hi all, I'm trying to setup a FreeIPA at home, and sign it with an external CA. The setup was fairly simple: CA Chain: depth=2 description=The mind of man can imagine nothing which has not really existed. - Edgar Allan Poe, CN = Finis Chaldea PKI Root G2, O = Finis Chaldea depth=1 description=The mind of man can imagine nothing which has not really existed. - Edgar Allan Poe, CN = Unseen University PKI Root, O = Unseen University Archchancelor's Office depth=0 CN = Unseen University PKI Octinity ,O =Unseen University, OU =Unseen University Archchancellor's Office The CA 2 and 1 are on another generated on HSM, if it does matter. Both have OCSP and CRL URI. CA 0 is the IPA's own CA. I have overridden some of the pki configuraitons as follow: ``` # CA OVERRIDES #/etc/ipa/override.ini [DEFAULT] ipa_key_algorithm=SHA256withEC ipa_key_size=nistp384 ipa_key_type=ecc ipa_signing_algorithm=SHA256withEC [CA] pki_ca_signing_key_size=nistp384 ``` /etc/hosts: 192.168.88.99 ipa.lug.sh ipa And hostname hat set to `ipa.lug.sh` already. The installation was done by following commands: ```bash $ export IPA_DOMAIN=lug.sh $ export IPA-COMMON_NAME="CN=Unseen University PKI Octinity,O=Unseen University,OU=Unseen University Archchancellor's Office" ``` ``` # Step ONE ipa-server-install -U \ -n $( awk 'BEGIN {print tolower(ENVIRON["IPA_DOMAIN"])}' ) \ -r $( awk 'BEGIN {print toupper(ENVIRON["IPA_DOMAIN"])}' ) \ -a `pass ipa/admin` \ -p `pass ipa/dm` \ --ca-subject="${IPA_COMMON_NAME}" \ --setup-dns \ --no-forwarders --auto-reverse --allow-zone-overlap \ --pki-config-override=/etc/ipa/override.ini \ --external-ca ``` ```Step TWO ipa-server-install -U \ -n $( awk 'BEGIN {print tolower(ENVIRON["IPA_DOMAIN"])}' ) \ -r $( awk 'BEGIN {print toupper(ENVIRON["IPA_DOMAIN"])}' ) \ -a `pass ipa/admin` \ -p `pass ipa/dm` \ --ca-subject="${IPA_COMMON_NAME}" \ --setup-dns \ --no-forwarders --auto-reverse --allow-zone-overlap \ --pki-config-override=/etc/ipa/override.ini \ --external-cert-file=/root/ipa.pem ``` The installer chocked at: [29/30]: adding 'ipa' CA entry ... The ipa-server-install command failed, exception: InvalidSyntax: ipaCaIssuerDN: value #0 invalid per syntax: Invalid syntax. ... Log file says: (See attached for complete log. Please don't mind my previous attempts, as they are also included.) ... ldap.NO_SUCH_OBJECT: {'desc': 'No such object', 'matched': 'cn=cas,cn=ca,dc=lug,dc=sh'} ... ipalib.errors.NotFound: no such entry ... ldap.INVALID_SYNTAX: {'desc': 'Invalid syntax', 'info': 'ipaCaIssuerDN: value #0 invalid per syntax\n'} I also tried once without O= in the IPA_CA DN, but ends up the same. Best Regards, - lug

1 0

Generating a session_key for API call
by Seth Malone 10 Apr '20

10 Apr '20

I am having trouble generating a session key to emulate the client call `ipa vault-retrieve testVault --shared`. I am currently using python and need to interact with the IPA vault. Is there a library I can import, or an example I can reference, that can walk me through generating a session key? I can issue the `ipa vault-retrieve testVault --shared` and harvest the session_key used in that call I am able to successfully get a response (No need to decode yet, just a test). I am unable to successfully generate a session_key, offer it to the IPA server, and get a successful response. OS: RHEL 7.7 FreeIPA, version: 4.6.5 API Version: 2.231

2 1

Re: Minimal ipa configuration (inside docker)
by Seth A Malone 09 Apr '20

09 Apr '20

1 0

Domain controllers switch to LDAPS
by Ronald Wimmer 08 Apr '20

08 Apr '20

Hi, will Microsofts decision to let domain controllers talk LDAPS only in the near future affect IPA sowehow? Cheers, Ronald

3 9

ca replication for hosts with different dns domains
by askstack＠yahoo.com 08 Apr '20

08 Apr '20

Hi IDM domain: "fist.domain" Host name: host1.first.domain host2.second.domain I was able to run "ipa-client-install" on host2 and promoted it to a domain replica. After I verified domain replication was working, I tried to run ipa-ca-install. It failed on host2. Redhat support said host1 and host2 are on two different dns domains so replication is not supported. I am not sure that is the case since two hosts are in the same and onlyIDM domain replication group. Is redhat support correct? Thanks.

3 3

Migration (in place)
by Christian Reiss 07 Apr '20

07 Apr '20

Hey folks, Running a 3-node FreeIPA Installation. All is well, but I am now upgrading all VMs, including my three IPA Servers from Centos 7 to 8. As the Upgrade for Centos 7 to 8 is a complete reinstall I would need to, one at a time, upgrade an IPA server. The IP and FQDN would remain the same. - I read several documents out there and some say decommission one, reinstall and add it again. - Others go for replica-prepare and go from there. - What about simply backup up the data direcory and restore that? Maybe there is a recommended way? I tried doing this some months ago for a failed server, and I got an issue about replication agreement already existing which I only was able to resolve by reinstalling. The proposed "modify ldap" was way, way above me ;) Thank you all and stay healthy! -- with kind regards, mit freundlichen Gruessen, Christian Reiss

3 4

EL7 Upgrades
by Angus Clarke 07 Apr '20

07 Apr '20

Hello Our environment has grown and as additional IPA servers have been added, different versions have been deployed. I am looking to bring IPA servers up to the latest version for EL7 and wanted some guidance or reassurance. Here are my versions, they are all VMWare VMs: idm001 ipa-server-4.5.4-10.0.1.el7.x86_64 Red Hat Enterprise Linux Server release 7.4 (Maipo) * UPGRADED * idm002 ipa-server-4.5.0-22.0.1.el7_4.x86_64 Red Hat Enterprise Linux Server release 7.4 (Maipo) * CA MASTER * idm003 ipa-server-4.5.0-22.0.1.el7_4.x86_64 Red Hat Enterprise Linux Server release 7.4 (Maipo) idm004 ipa-server-4.5.0-22.0.1.el7_4.x86_64 Red Hat Enterprise Linux Server release 7.4 (Maipo) idm005 ipa-server-4.6.5-11.0.1.el7_7.4.x86_64 Red Hat Enterprise Linux Server release 7.7 (Maipo) idm006 ipa-server-4.6.5-11.0.1.el7_7.4.x86_64 Red Hat Enterprise Linux Server release 7.7 (Maipo) idm007 ipa-server-4.6.5-11.0.1.el7_7.3.x86_64 Red Hat Enterprise Linux Server release 7.7 (Maipo) idm008 ipa-server-4.6.5-11.0.1.el7_7.3.x86_64 Red Hat Enterprise Linux Server release 7.7 (Maipo) idm009 ipa-server-4.6.4-10.0.1.el7_6.6.x86_64 Red Hat Enterprise Linux Server release 7.6 (Maipo) idm010 ipa-server-4.6.4-10.0.1.el7_6.6.x86_64 Red Hat Enterprise Linux Server release 7.6 (Maipo) I have upgraded idm001 without issue, the path was: 1) take VMWare snapshot 2) ipactl stop 3) yum update (channel with latest EL versions) 4) reboot 5) after a day or so, remove VMWare snapshot and it now shows: idm001 ipa-server-4.6.5-11.0.1.el7_7.4.x86_64 Red Hat Enterprise Linux Server release 7.7 (Maipo) Post upgrade checks on idm001: I see network connections to port 88 and 389 I can obtain a kerberos ticket through kinit I can login through the web interface and issue ipa commands. I don't see anything particularly alarming in log files. I understand the distributed LDAP schema was already up-to-date due to the roll out of idm005-006 on EL7.7/ipa-server-4.6.5-11.0.1.el7_7.4. I'm particularly concerned about upgrading idm002, my CA server - perhaps I should upgrade through each EL iteration? Are VMWare snapshots a suitable roll back mechanism for IPA (and IPA CA master) server upgrades? I was reading Rob's reply to Christian Reiss regarding his upgrade path to EL8 (bookmarked for future reference,) I don't have the ipa-crlgen-manage command on my CA server (presumably due to older version) to check if it is the CRL generator - I assume it is though, although in any case I'm unsure of the relevance with this EL7 series of ipa-server. All my IPA servers have CA capability except for idm001 - I presume I deployed it incorrectly in the first place. I would like to add CA facility to it, perhaps this is for a different thread though ... Thank you for any feedback. Regards Angus

1 0

FreeIPA 4.6.8 released
by Alexander Bokovoy 03 Apr '20

03 Apr '20

1 0

configure encryption types on Free IPA UI
by Hernán Fernández 02 Apr '20

02 Apr '20

Hello, How can I configure the available encryption types on a FreeIPA?. I'm using the version 4.6.5 Thanks -- Hernán Fernández +56994752172

2 2

Update FreeIPA 4.8.6 on PI 4
by Dirk Streubel 02 Apr '20

02 Apr '20

Hello everybody, i am using a PI4 with Fedora 32 Beta and the latest Packages of IPA. Everything is working fine, but after an update this Afternoon my IPA Server would not start any more. I updated following packages: 389-ds-base-1.4.3.4-1.fc32.aarch64 and 389-ds-base-libs-1.4.3.4-1.fc32.aarch64 The following error message i get: [root@pifour ~]# systemctl status dirsrv(a)XXX.service ● dirsrv(a)XXX.service - 389 Directory Server XXX. Loaded: loaded (/usr/lib/systemd/system/dirsrv@.service; enabled; vendor preset: disabled) Drop-In: /usr/lib/systemd/system/dirsrv@.service.d └─custom.conf /etc/systemd/system/dirsrv(a)XXX.service.d └─ipa-env.conf Active: failed (Result: exit-code) since Thu 2020-04-02 21:50:43 CEST; 21min ago Process: 6894 ExecStartPre=/usr/libexec/dirsrv/ds_systemd_ask_password_acl /etc/dirsrv/slapd-XXX/dse.ldif (code=exited, status=0/SUCCESS) Process: 6899 ExecStart=/usr/sbin/ns-slapd -D /etc/dirsrv/slapd-XXX -i /run/dirsrv/slapd-XXX.pid (code=exited, status=1/FAILURE) Main PID: 6899 (code=exited, status=1/FAILURE) CPU: 433ms Apr 02 21:50:42 pifour.linux.schnell.er systemd[1]: Starting 389 Directory Server XXX.... Apr 02 21:50:43 pifour.linux.schnell.er ns-slapd[6899]: [02/Apr/2020:21:50:43.097278875 +0200] - ERR - dse_read_one_file - The entry cn=schema in file /etc/dirsrv/slapd-XXX/schema/15rfc2307bis.ldif (lineno: 1) is invalid, error code 20 (Type or value exists) - attribute type nisDomain: Does not match the OID "1.3.6.1.4.1.1.1.1.12". Another attribute type is already using the name or OID. Apr 02 21:50:43 pifour.linux.schnell.er ns-slapd[6899]: [02/Apr/2020:21:50:43.113521126 +0200] - ERR - setup_internal_backends - Please edit the file to correct the reported problems and then restart the server. Apr 02 21:50:43 pifour.linux.schnell.er systemd[1]: dirsrv(a)XXX.service: Main process exited, code=exited, status=1/FAILURE Apr 02 21:50:43 pifour.linux.schnell.er systemd[1]: dirsrv(a)XXX.service: Failed with result 'exit-code'. Apr 02 21:50:43 pifour.linux.schnell.er systemd[1]: Failed to start 389 Directory Server XXX.. [root@pifour ~]# Hope, somebody can help me, maybe a bug in the new packages? Regards Dirk

2 4

Spacewalk and FreeIPA
by Ronald Wimmer 02 Apr '20

02 Apr '20

Hi, anyone here successfully configured Spacewalk authentication for FreeIPA users? I followed every step on https://github.com/spacewalkproject/spacewalk/wiki/SpacewalkAndIPA and can see that Kerberos auth seemed to have worked according to the ssl_access.log of Spacewalk but after clicking on login Spacewalk gives me an HTTP 403 error and I cannot find anything helpful in any log I am aware of. Cheers, Ronald

1 0

Integration Freeipa with Keycloak
by dmitriys 02 Apr '20

02 Apr '20

Hi! I tried connect freeipa to Keycloak. And hove some questions about attribute and filters I filled in this way: * Username LDAP attribute uid * RDN LDAP attribute uid * UUID LDAP attribute uid * User Object Classes memberOf * Connection URL ldap://ldap.example.com * Users DN cn=users,cn=accounts,dc=example,dc=com * Bind Type simple Enable StartTLS (when set enable cant login) * Bind DN uid=test,cn=users,cn=compat,dc=example,dc=com * Bind Credential ********** Custom User LDAP Filter (memberOf=cn=users,cn=compat,dc=example,dc=com) With this settings keycloak can connect to freeipa but cant sync any users 2020-04-01 13:20:26,810 INFO [org.keycloak.storage.ldap.LDAPIdentityStoreRegistry] (default task-29) Creating new LDAP Store for the LDAP storage provider: 'freeipa_dev', LDAP Configuration: {pagination=[true], fullSyncPeriod=[-1], startTls=[false], connectionPooling=[true], usersDn=[cn=users,cn=accounts,dc=example,dc=com], cachePolicy=[DEFAULT], useKerberosForPasswordAuthentication=[false], importEnabled=[true], enabled=[true], bindDn=[uid=admin,cn=users,cn=compat,dc=example,dc=com], changedSyncPeriod=[-1], usernameLDAPAttribute=[uid], lastSync=[1585747226], vendor=[other], uuidLDAPAttribute=[uid], allowKerberosAuthentication=[false], connectionUrl=[ldap://ldap2.example.com], syncRegistrations=[true], authType=[simple], customUserSearchFilter=[(memberOf=cn=users,cn=compat,dc=example,dc=com)], debug=[false], searchScope=[1], useTruststoreSpi=[ldapsOnly], trustEmail=[false], priority=[0], userObjectClasses=[memberOf], rdnLDAPAttribute=[uid], editMode=[READ_ONLY], validatePasswordPoli cy=[false], batchSizeForSync=[1000]}, binaryAttributes: [] 2020-04-01 13:20:26,812 INFO [org.keycloak.storage.ldap.LDAPStorageProviderFactory] (default task-29) Sync all users from LDAP to local store: realm: example, federation provider: freeipa_dev 2020-04-01 13:20:26,894 INFO [org.keycloak.storage.ldap.LDAPStorageProviderFactory] (default task-29) Sync all users finished: 0 imported users, 0 updated users When try enable SSL/TLS get this error for connection 2020-04-01 13:23:26,179 ERROR [org.keycloak.services] (default task-40) KC-SERVICES0055: Error when connecting to LDAP: null: java.lang.NullPointerException How i can resolve this issue ? thank you

4 4

LDAP Server stop to response after a period of time
by Lays Dragon 01 Apr '20

01 Apr '20

I deployed a two replica FreeIPA Servers,it woks well until this month,it start at the service report the LDAP is Timeout,I try to restart the server,even reinstall two IPA server and maintain the data via replica from another server. And it still happen after several days. The 389ds server just simply stop to response to any connection ,the wierd thing is the connection is established but no response after the connection. LDAP server seems to blocked on something,even replica is dead because the ldap is blocked.simply restart not slove the problem,the ldap server will blocked really soon caused other service like IPA Web service or kinit dead too. I guess the blocked is caused via replica function somehow,since I figure out I have to close the ldap port on blocked server firewall to make it isolate,and restart the server,waiting for about 10 min after the server is start,reopen the ldap port on firewall to let replica recover,and everything will be fine...And I notice there some connection stuck at CLOSE_WAIT of ns-slapd may be related. Need some help . I not so familiar with of freeipa,and trying to deal this problem over the week but nothing works. FreeIPA server version:4.8.4 Server System: Fedora 31 (Cloud Edition) server1 access log ``` krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink krbAuthIndMaxTicke..." [08/Mar/2020:10:01:23.390837315 +0800] conn=4 op=6091 RESULT err=0 tag=101 nentries=1 etime=0.000276689 [08/Mar/2020:10:01:23.390906790 +0800] conn=4 op=6092 SRCH base="cn=ENMD.NET,cn=kerberos,dc=enmd,dc=net" scope=0 filter="(objectClass=krbticketpolicyaux)" attrs="krbMaxTicketLife krbMaxRenewableAge krbTicketFlags krbAuthIndMaxTicketLife krbAuthIndMaxRenewableAge" [08/Mar/2020:10:01:23.391302403 +0800] conn=4 op=6092 RESULT err=0 tag=101 nentries=1 etime=0.000432879 [08/Mar/2020:10:01:23.392418974 +0800] conn=3351 op=1 BIND dn="" method=sasl version=3 mech=GSSAPI [08/Mar/2020:10:01:25.953517485 +0800] conn=3352 fd=161 slot=161 connection from <masked>.152 to <masked>.165 [08/Mar/2020:10:01:27.007620375 +0800] conn=3353 fd=162 slot=162 connection from <masked>.154 to <masked>.165 [08/Mar/2020:10:01:27.151656148 +0800] conn=3354 fd=163 slot=163 connection from <masked>.150 to <masked>.165 [08/Mar/2020:10:01:27.559750675 +0800] conn=3355 fd=164 slot=164 connection from <masked>.153 to <masked>.165 [08/Mar/2020:10:01:39.015400434 +0800] conn=3356 fd=165 slot=165 connection from <masked>.154 to <masked>.165 [08/Mar/2020:10:01:51.582586229 +0800] conn=3357 fd=166 slot=166 connection from <masked>.153 to <masked>.165 [08/Mar/2020:10:01:52.513047687 +0800] conn=3358 fd=167 slot=167 connection from <masked>.150 to <masked>.165 [08/Mar/2020:10:01:53.573811317 +0800] conn=3359 fd=168 slot=168 connection from <masked>.152 to <masked>.165 [08/Mar/2020:10:02:44.012371005 +0800] conn=3360 fd=169 slot=169 connection from <masked>.160 to <masked>.165 [08/Mar/2020:10:02:44.419580574 +0800] conn=3361 fd=170 slot=170 connection from <masked>.151 to <masked>.165 [08/Mar/2020:10:02:45.548493596 +0800] conn=3362 fd=171 slot=171 connection from <masked>.153 to <masked>.165 [08/Mar/2020:10:02:50.018712852 +0800] conn=3363 fd=172 slot=172 connection from <masked>.160 to <masked>.165 [08/Mar/2020:10:02:51.081867407 +0800] conn=3364 fd=173 slot=173 connection from <masked>.152 to <masked>.165 [08/Mar/2020:10:03:04.062925765 +0800] conn=3365 fd=174 slot=174 connection from <masked>.154 to <masked>.165 [08/Mar/2020:10:03:06.223438080 +0800] conn=3366 fd=175 slot=175 connection from <masked>.150 to <masked>.165 [08/Mar/2020:10:03:10.063982993 +0800] conn=3367 fd=176 slot=176 connection from <masked>.154 to <masked>.165 [08/Mar/2020:10:03:52.027006125 +0800] conn=3368 fd=177 slot=177 connection from <masked>.153 to <masked>.165 [08/Mar/2020:10:03:57.005297121 +0800] conn=3369 fd=178 slot=178 connection from <masked>.152 to <masked>.165 [08/Mar/2020:10:04:01.001767909 +0800] conn=3370 fd=179 slot=179 connection from <masked>.150 to <masked>.165 [08/Mar/2020:10:04:08.003082421 +0800] conn=3371 fd=180 slot=180 connection from <masked>.154 to <masked>.165 [08/Mar/2020:10:04:12.014090964 +0800] conn=3372 fd=181 slot=181 connection from <masked>.151 to <masked>.165 [08/Mar/2020:10:04:18.140192092 +0800] conn=3373 fd=182 slot=182 connection from <masked>.166 to <masked>.165 [08/Mar/2020:10:04:20.007046774 +0800] conn=3374 fd=183 slot=183 connection from <masked>.154 to <masked>.165 [08/Mar/2020:10:04:24.040348027 +0800] conn=3375 fd=184 slot=184 connection from <masked>.160 to <masked>.165 [08/Mar/2020:10:04:30.139898749 +0800] conn=3376 fd=185 slot=185 connection from <masked>.160 to <masked>.165 [08/Mar/2020:10:05:22.043556910 +0800] conn=3377 fd=186 slot=186 connection from <masked>.160 to <masked>.165 [08/Mar/2020:10:05:34.140357676 +0800] conn=3378 fd=187 slot=187 connection from <masked>.160 to <masked>.165 [08/Mar/2020:10:05:36.006033007 +0800] conn=3379 fd=188 slot=188 connection from <masked>.165 to <masked>.165 [08/Mar/2020:10:06:07.002808000 +0800] conn=3380 fd=189 slot=189 connection from <masked>.150 to <masked>.165 [08/Mar/2020:10:06:12.043478717 +0800] conn=3381 fd=190 slot=190 connection from <masked>.152 to <masked>.165 [08/Mar/2020:10:06:15.007914045 +0800] conn=3382 fd=191 slot=191 connection from <masked>.153 to <masked>.165 [08/Mar/2020:10:06:17.005632290 +0800] conn=3383 fd=192 slot=192 connection from <masked>.154 to <masked>.165 [08/Mar/2020:10:06:19.016341572 +0800] conn=3384 fd=193 slot=193 connection from <masked>.165 to <masked>.165 [08/Mar/2020:10:06:23.007594584 +0800] conn=3385 fd=194 slot=194 connection from <masked>.154 to <masked>.165 [08/Mar/2020:10:06:27.026262632 +0800] conn=3386 fd=195 slot=195 connection from <masked>.165 to <masked>.165 [08/Mar/2020:10:06:30.031700186 +0800] conn=3387 fd=196 slot=196 SSL connection from <masked>.159 to <masked>.180 [08/Mar/2020:10:06:37.009611536 +0800] conn=3388 fd=197 slot=197 connection from <masked>.151 to <masked>.165 [08/Mar/2020:10:06:37.033108567 +0800] conn=3389 fd=198 slot=198 connection from <masked>.165 to <masked>.165 [08/Mar/2020:10:07:23.002813545 +0800] conn=3390 fd=199 slot=199 connection from <masked>.165 to <masked>.165 [08/Mar/2020:10:07:31.011795943 +0800] conn=3391 fd=200 slot=200 connection from <masked>.165 to <masked>.165 [08/Mar/2020:10:07:36.011894960 +0800] conn=3392 fd=201 slot=201 connection from <masked>.160 to <masked>.165 [08/Mar/2020:10:07:41.021108836 +0800] conn=3393 fd=202 slot=202 connection from <masked>.165 to <masked>.165 [08/Mar/2020:10:07:42.014874690 +0800] conn=3394 fd=203 slot=203 connection from <masked>.160 to <masked>.165 [08/Mar/2020:10:09:16.005883198 +0800] conn=3395 fd=204 slot=204 connection from <masked>.165 to <masked>.165 [08/Mar/2020:10:09:24.009940147 +0800] conn=3396 fd=205 slot=205 connection from <masked>.165 to <masked>.165 [08/Mar/2020:10:09:34.015154400 +0800] conn=3397 fd=206 slot=206 connection from <masked>.165 to <masked>.165 [08/Mar/2020:10:10:24.040398249 +0800] conn=3398 fd=207 slot=207 connection from <masked>.153 to <masked>.165 [08/Mar/2020:10:10:27.003675219 +0800] conn=3399 fd=208 slot=208 connection from <masked>.152 to <masked>.165 [08/Mar/2020:10:10:28.005336766 +0800] conn=3400 fd=209 slot=209 connection from <masked>.150 to <masked>.165 ``` server1 error log ``` [08/Mar/2020:09:30:52.966764268 +0800] - ERR - NSMMReplicationPlugin - repl5_inc_waitfor_async_results - Timed out waiting for responses: 0 3074 [08/Mar/2020:09:32:53.684831136 +0800] - ERR - NSMMReplicationPlugin - release_replica - agmt="cn=meToipa2.enmd.net" (ipa2:389): Attempting to release replica, but unable to receive endReplication extended operation response from the replica. Error -5 (Timed out) [08/Mar/2020:09:34:53.625806166 +0800] - WARN - NSMMReplicationPlugin - acquire_replica - agmt="cn=meToipa2.enmd.net" (ipa2:389): Unable to receive the response for a startReplication extended operation to consumer (Timed out). Will retry later. [08/Mar/2020:09:36:56.570809366 +0800] - WARN - NSMMReplicationPlugin - acquire_replica - agmt="cn=meToipa2.enmd.net" (ipa2:389): Unable to receive the response for a startReplication extended operation to consumer (Timed out). Will retry later. [08/Mar/2020:09:38:56.509924342 +0800] - WARN - NSMMReplicationPlugin - acquire_replica - agmt="cn=meToipa2.enmd.net" (ipa2:389): Unable to receive the response for a startReplication extended operation to consumer (Timed out). Will retry later. [08/Mar/2020:09:40:59.458123866 +0800] - WARN - NSMMReplicationPlugin - acquire_replica - agmt="cn=meToipa2.enmd.net" (ipa2:389): Unable to receive the response for a startReplication extended operation to consumer (Timed out). Will retry later. [08/Mar/2020:09:42:59.402931124 +0800] - WARN - NSMMReplicationPlugin - acquire_replica - agmt="cn=meToipa2.enmd.net" (ipa2:389): Unable to receive the response for a startReplication extended operation to consumer (Timed out). Will retry later. [08/Mar/2020:09:45:02.343312876 +0800] - WARN - NSMMReplicationPlugin - acquire_replica - agmt="cn=meToipa2.enmd.net" (ipa2:389): Unable to receive the response for a startReplication extended operation to consumer (Timed out). Will retry later. [08/Mar/2020:09:47:02.282487714 +0800] - WARN - NSMMReplicationPlugin - acquire_replica - agmt="cn=meToipa2.enmd.net" (ipa2:389): Unable to receive the response for a startReplication extended operation to consumer (Timed out). Will retry later. [08/Mar/2020:09:49:05.220734403 +0800] - WARN - NSMMReplicationPlugin - acquire_replica - agmt="cn=meToipa2.enmd.net" (ipa2:389): Unable to receive the response for a startReplication extended operation to consumer (Timed out). Will retry later. [08/Mar/2020:09:51:05.160565112 +0800] - WARN - NSMMReplicationPlugin - acquire_replica - agmt="cn=meToipa2.enmd.net" (ipa2:389): Unable to receive the response for a startReplication extended operation to consumer (Timed out). Will retry later. [08/Mar/2020:09:53:08.105641621 +0800] - WARN - NSMMReplicationPlugin - acquire_replica - agmt="cn=meToipa2.enmd.net" (ipa2:389): Unable to receive the response for a startReplication extended operation to consumer (Timed out). Will retry later. [08/Mar/2020:09:55:08.040503542 +0800] - WARN - NSMMReplicationPlugin - acquire_replica - agmt="cn=meToipa2.enmd.net" (ipa2:389): Unable to receive the response for a startReplication extended operation to consumer (Timed out). Will retry later. [08/Mar/2020:09:57:11.997307120 +0800] - WARN - NSMMReplicationPlugin - acquire_replica - agmt="cn=meToipa2.enmd.net" (ipa2:389): Unable to receive the response for a startReplication extended operation to consumer (Timed out). Will retry later. [08/Mar/2020:09:59:12.965695447 +0800] - WARN - NSMMReplicationPlugin - acquire_replica - agmt="cn=meToipa2.enmd.net" (ipa2:389): Unable to receive the response for a startReplication extended operation to consumer (Timed out). Will retry later. [08/Mar/2020:10:01:15.903578926 +0800] - WARN - NSMMReplicationPlugin - acquire_replica - agmt="cn=meToipa2.enmd.net" (ipa2:389): Unable to receive the response for a startReplication extended operation to consumer (Timed out). Will retry later. [08/Mar/2020:11:26:42.560167019 +0800] - INFO - slapd_extract_cert - CA CERT NAME: ENMD.NET IPA CA [08/Mar/2020:11:26:42.567890161 +0800] - WARN - Security Initialization - SSL alert: Sending pin request to SVRCore. You may need to run systemd-tty-ask-password-agent to provide the password. [08/Mar/2020:11:26:42.647668764 +0800] - INFO - slapd_extract_cert - SERVER CERT NAME: Server-Cert [08/Mar/2020:11:26:42.722748631 +0800] - INFO - Security Initialization - SSL info: Enabling default cipher set. [08/Mar/2020:11:26:42.726554182 +0800] - INFO - Security Initialization - SSL info: Configured NSS Ciphers [08/Mar/2020:11:26:42.730304776 +0800] - INFO - Security Initialization - SSL info: TLS_AES_128_GCM_SHA256: enabled [08/Mar/2020:11:26:42.733614343 +0800] - INFO - Security Initialization - SSL info: TLS_CHACHA20_POLY1305_SHA256: enabled [08/Mar/2020:11:26:42.740389595 +0800] - INFO - Security Initialization - SSL info: TLS_AES_256_GCM_SHA384: enabled [08/Mar/2020:11:26:42.743830864 +0800] - INFO - Security Initialization - SSL info: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256: enabled [08/Mar/2020:11:26:42.748868878 +0800] - INFO - Security Initialization - SSL info: TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256: enabled [08/Mar/2020:11:26:42.762016895 +0800] - INFO - Security Initialization - SSL info: TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256: enabled [08/Mar/2020:11:26:42.766962209 +0800] - INFO - Security Initialization - SSL info: TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256: enabled [08/Mar/2020:11:26:42.779721887 +0800] - INFO - Security Initialization - SSL info: TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384: enabled [08/Mar/2020:11:26:42.787619421 +0800] - INFO - Security Initialization - SSL info: TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384: enabled [08/Mar/2020:11:26:42.795024632 +0800] - INFO - Security Initialization - SSL info: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA: enabled [08/Mar/2020:11:26:42.799027752 +0800] - INFO - Security Initialization - SSL info: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA: enabled [08/Mar/2020:11:26:42.802532993 +0800] - INFO - Security Initialization - SSL info: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA: enabled [08/Mar/2020:11:26:42.806279559 +0800] - INFO - Security Initialization - SSL info: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256: enabled ```

5 14

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users April 2020