kernel: ns-slapd[5865]: segfault at 5603c0ee2000 ip 00007fe3ba3975ba sp 00007fe3bdbd28a8 error 4 in libc-2.17.so[7fe3ba242000
by TomK
Hey All,
I've upgrade one side of my two node cluster. However, the secondary
won't come even though the manual upgrade apparently went well.
[root@idmipa04 ~]# ipa-server-upgrade
Upgrading IPA:. Estimated time: 1 minute 30 seconds
[1/9]: saving configuration
[2/9]: disabling listeners
[3/9]: enabling DS global lock
[4/9]: disabling Schema Compat
[5/9]: starting directory server
[6/9]: updating schema
[7/9]: upgrading server
[8/9]: stopping directory server
[9/9]: restoring configuration
Done.
Update complete
Upgrading IPA services
Upgrading the configuration of the IPA services
IPA server upgrade failed: Inspect /var/log/ipaupgrade.log and run
command ipa-server-upgrade manually.
Unexpected error - see /var/log/ipaupgrade.log for details:
CalledProcessError: Command '/bin/systemctl start
dirsrv(a)MWS-MDS-XYZ.service' returned non-zero exit status 1
The ipa-server-upgrade command failed. See /var/log/ipaupgrade.log for
more information
[root@idmipa04 ~]#
Additional information:
[root@idmipa04 ~]# cat /var/log/ipaupgrade.log|tail -n 50
2020-05-19T04:18:10Z DEBUG Loading StateFile from
'/var/lib/ipa/sysrestore/sysrestore.state'
2020-05-19T04:18:10Z DEBUG Saving StateFile to
'/var/lib/ipa/sysrestore/sysrestore.state'
2020-05-19T04:18:10Z DEBUG Loading StateFile from
'/var/lib/ipa/sysrestore/sysrestore.state'
2020-05-19T04:18:10Z DEBUG Loading StateFile from
'/var/lib/ipa/sysrestore/sysrestore.state'
2020-05-19T04:18:10Z DEBUG Loading StateFile from
'/var/lib/ipa/sysrestore/sysrestore.state'
2020-05-19T04:18:10Z DEBUG Saving StateFile to
'/var/lib/ipa/sysrestore/sysrestore.state'
2020-05-19T04:18:10Z DEBUG duration: 0 seconds
2020-05-19T04:18:10Z DEBUG Done.
2020-05-19T04:18:10Z INFO Update complete
2020-05-19T04:18:10Z INFO Upgrading the configuration of the IPA services
2020-05-19T04:18:10Z DEBUG IPA version 4.6.6-11.el7.centos
2020-05-19T04:18:10Z DEBUG Loading Index file from
'/var/lib/ipa/sysrestore/sysrestore.index'
2020-05-19T04:18:10Z DEBUG Loading StateFile from
'/var/lib/ipa/sysrestore/sysrestore.state'
2020-05-19T04:18:10Z DEBUG Loading Index file from
'/var/lib/ipa/sysrestore/sysrestore.index'
2020-05-19T04:18:10Z DEBUG Starting external process
2020-05-19T04:18:10Z DEBUG args=/bin/systemctl is-active
dirsrv(a)MWS-MDS-XYZ.service
2020-05-19T04:18:10Z DEBUG Process finished, return code=3
2020-05-19T04:18:10Z DEBUG stdout=unknown
2020-05-19T04:18:10Z DEBUG stderr=
2020-05-19T04:18:10Z DEBUG Starting external process
2020-05-19T04:18:10Z DEBUG args=/bin/systemctl start
dirsrv(a)MWS-MDS-XYZ.service
2020-05-19T04:19:55Z DEBUG Process finished, return code=1
2020-05-19T04:19:55Z DEBUG stdout=
2020-05-19T04:19:55Z DEBUG stderr=Job for dirsrv(a)MWS-MDS-XYZ.service
failed because a fatal signal was delivered to the control process. See
"systemctl status dirsrv(a)MWS-MDS-XYZ.service" and "journalctl -xe" for
details.
2020-05-19T04:19:56Z ERROR IPA server upgrade failed: Inspect
/var/log/ipaupgrade.log and run command ipa-server-upgrade manually.
2020-05-19T04:19:56Z DEBUG File
"/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 178, in
execute
return_value = self.run()
File
"/usr/lib/python2.7/site-packages/ipaserver/install/ipa_server_upgrade.py",
line 54, in run
server.upgrade()
File
"/usr/lib/python2.7/site-packages/ipaserver/install/server/upgrade.py",
line 2166, in upgrade
upgrade_configuration()
File
"/usr/lib/python2.7/site-packages/ipaserver/install/server/upgrade.py",
line 1791, in upgrade_configuration
ds.start(ds_serverid)
File
"/usr/lib/python2.7/site-packages/ipaserver/install/dsinstance.py", line
656, in start
super(DsInstance, self).start(*args, **kwargs)
File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py",
line 464, in start
self.service.start(instance_name, capture_output=capture_output,
wait=wait)
File
"/usr/lib/python2.7/site-packages/ipaplatform/redhat/services.py", line
136, in start
instance_name, capture_output=capture_output, wait=wait)
File "/usr/lib/python2.7/site-packages/ipaplatform/base/services.py",
line 303, in start
skip_output=not capture_output)
File "/usr/lib/python2.7/site-packages/ipapython/ipautil.py", line
563, in run
raise CalledProcessError(p.returncode, arg_string, str(output))
2020-05-19T04:19:56Z DEBUG The ipa-server-upgrade command failed,
exception: CalledProcessError: Command '/bin/systemctl start
dirsrv(a)MWS-MDS-XYZ.service' returned non-zero exit status 1
2020-05-19T04:19:56Z ERROR Unexpected error - see
/var/log/ipaupgrade.log for details:
CalledProcessError: Command '/bin/systemctl start
dirsrv(a)MWS-MDS-XYZ.service' returned non-zero exit status 1
2020-05-19T04:19:56Z ERROR The ipa-server-upgrade command failed. See
/var/log/ipaupgrade.log for more information
[root@idmipa04 ~]#
[root@idmipa04 ~]#
[root@idmipa04 ~]#
[root@idmipa04 ~]#
[root@idmipa04 ~]# /bin/systemctl start dirsrv(a)MWS-MDS-XYZ.service
[root@idmipa04 ~]#
[root@idmipa04 ~]#
[root@idmipa04 ~]# systemctl status dirsrv(a)MWS-MDS-XYZ.service
● dirsrv(a)MWS-MDS-XYZ.service - 389 Directory Server MWS-MDS-XYZ.
Loaded: loaded (/usr/lib/systemd/system/dirsrv@.service; enabled;
vendor preset: disabled)
Active: active (running) since Tue 2020-05-19 00:21:49 EDT; 10s ago
Process: 4657 ExecStartPre=/usr/sbin/ds_systemd_ask_password_acl
/etc/dirsrv/slapd-%i/dse.ldif (code=exited, status=0/SUCCESS)
Main PID: 4664 (ns-slapd)
Status: "slapd started: Ready to process requests"
CGroup: /system.slice/system-dirsrv.slice/dirsrv(a)MWS-MDS-XYZ.service
└─4664 /usr/sbin/ns-slapd -D /etc/dirsrv/slapd-MWS-MDS-XYZ
-i /var/run/dirsrv/slapd-MWS-MDS-XYZ.pid
May 19 00:21:49 idmipa04.mws.mds.xyz ns-slapd[4664]:
[19/May/2020:00:21:49.380321307 -0400] - ERR - set_krb5_creds - ...ealm)
May 19 00:21:49 idmipa04.mws.mds.xyz ns-slapd[4664]:
[19/May/2020:00:21:49.381268146 -0400] - ERR - NSMMReplicationPl...r) ()
May 19 00:21:49 idmipa04.mws.mds.xyz ns-slapd[4664]:
[19/May/2020:00:21:49.602418963 -0400] - ERR - schema-compat-plu...onds!
May 19 00:21:52 idmipa04.mws.mds.xyz ns-slapd[4664]:
[19/May/2020:00:21:52.607265030 -0400] - ERR - set_krb5_creds - ...ealm)
May 19 00:21:52 idmipa04.mws.mds.xyz ns-slapd[4664]:
[19/May/2020:00:21:52.609340757 -0400] - ERR - set_krb5_creds - ...ealm)
May 19 00:21:54 idmipa04.mws.mds.xyz ns-slapd[4664]:
[19/May/2020:00:21:54.625706606 -0400] - ERR - schema-compat-plu...c=xyz
May 19 00:21:54 idmipa04.mws.mds.xyz ns-slapd[4664]:
[19/May/2020:00:21:54.758965595 -0400] - ERR - schema-compat-plu...c=xyz
May 19 00:21:54 idmipa04.mws.mds.xyz ns-slapd[4664]:
[19/May/2020:00:21:54.759530547 -0400] - ERR - schema-compat-plu...tion.
May 19 00:21:58 idmipa04.mws.mds.xyz ns-slapd[4664]:
[19/May/2020:00:21:58.612054116 -0400] - ERR - set_krb5_creds - ...ealm)
May 19 00:21:58 idmipa04.mws.mds.xyz ns-slapd[4664]:
[19/May/2020:00:21:58.613830783 -0400] - ERR - set_krb5_creds - ...ealm)
Hint: Some lines were ellipsized, use -l to show in full.
[root@idmipa04 ~]#
[root@idmipa04 ~]#
[root@idmipa04 ~]#
[root@idmipa04 ~]# systemctl status dirsrv(a)MWS-MDS-XYZ.service -l
● dirsrv(a)MWS-MDS-XYZ.service - 389 Directory Server MWS-MDS-XYZ.
Loaded: loaded (/usr/lib/systemd/system/dirsrv@.service; enabled;
vendor preset: disabled)
Active: active (running) since Tue 2020-05-19 00:21:49 EDT; 16s ago
Process: 4657 ExecStartPre=/usr/sbin/ds_systemd_ask_password_acl
/etc/dirsrv/slapd-%i/dse.ldif (code=exited, status=0/SUCCESS)
Main PID: 4664 (ns-slapd)
Status: "slapd started: Ready to process requests"
CGroup: /system.slice/system-dirsrv.slice/dirsrv(a)MWS-MDS-XYZ.service
└─4664 /usr/sbin/ns-slapd -D /etc/dirsrv/slapd-MWS-MDS-XYZ
-i /var/run/dirsrv/slapd-MWS-MDS-XYZ.pid
May 19 00:21:52 idmipa04.mws.mds.xyz ns-slapd[4664]:
[19/May/2020:00:21:52.607265030 -0400] - ERR - set_krb5_creds - Could
not get initial credentials for principal
[ldap/idmipa04.mws.mds.xyz(a)MWS.MDS.XYZ] in keytab
[FILE:/etc/dirsrv/ds.keytab]: -1765328228 (Cannot contact any KDC for
requested realm)
May 19 00:21:52 idmipa04.mws.mds.xyz ns-slapd[4664]:
[19/May/2020:00:21:52.609340757 -0400] - ERR - set_krb5_creds - Could
not get initial credentials for principal
[ldap/idmipa04.mws.mds.xyz(a)MWS.MDS.XYZ] in keytab
[FILE:/etc/dirsrv/ds.keytab]: -1765328228 (Cannot contact any KDC for
requested realm)
May 19 00:21:54 idmipa04.mws.mds.xyz ns-slapd[4664]:
[19/May/2020:00:21:54.625706606 -0400] - ERR - schema-compat-plugin -
warning: no entries set up under cn=ng, cn=compat,dc=mws,dc=mds,dc=xyz
May 19 00:21:54 idmipa04.mws.mds.xyz ns-slapd[4664]:
[19/May/2020:00:21:54.758965595 -0400] - ERR - schema-compat-plugin -
warning: no entries set up under cn=computers,
cn=compat,dc=mws,dc=mds,dc=xyz
May 19 00:21:54 idmipa04.mws.mds.xyz ns-slapd[4664]:
[19/May/2020:00:21:54.759530547 -0400] - ERR - schema-compat-plugin -
Finished plugin initialization.
May 19 00:21:58 idmipa04.mws.mds.xyz ns-slapd[4664]:
[19/May/2020:00:21:58.612054116 -0400] - ERR - set_krb5_creds - Could
not get initial credentials for principal
[ldap/idmipa04.mws.mds.xyz(a)MWS.MDS.XYZ] in keytab
[FILE:/etc/dirsrv/ds.keytab]: -1765328228 (Cannot contact any KDC for
requested realm)
May 19 00:21:58 idmipa04.mws.mds.xyz ns-slapd[4664]:
[19/May/2020:00:21:58.613830783 -0400] - ERR - set_krb5_creds - Could
not get initial credentials for principal
[ldap/idmipa04.mws.mds.xyz(a)MWS.MDS.XYZ] in keytab
[FILE:/etc/dirsrv/ds.keytab]: -1765328228 (Cannot contact any KDC for
requested realm)
May 19 00:22:03 idmipa04.mws.mds.xyz ns-slapd[4664]: GSSAPI server step 1
May 19 00:22:03 idmipa04.mws.mds.xyz ns-slapd[4664]: GSSAPI server step 2
May 19 00:22:03 idmipa04.mws.mds.xyz ns-slapd[4664]: GSSAPI server step 3
[root@idmipa04 ~]#
[root@idmipa04 ~]#
---------------------------------------------------------------------
Looking at the service, appears libc hit a SEGFAULT.
[root@idmipa04 ~]# journalctl -xe
May 19 00:34:03 idmipa04.mws.mds.xyz Keepalived_vrrp[5424]:
/usr/bin/killall -0 haproxy exited with status 1
May 19 00:34:05 idmipa04.mws.mds.xyz Keepalived_vrrp[5424]:
/usr/bin/killall -0 haproxy exited with status 1
May 19 00:34:06 idmipa04.mws.mds.xyz ns-slapd[5745]:
[19/May/2020:00:34:06.272901079 -0400] - NOTICE - NSMMReplicationPlugin
- changelog program - _cl5ConstructRU
May 19 00:34:06 idmipa04.mws.mds.xyz kernel: ns-slapd[5865]: segfault at
5603c0ee2000 ip 00007fe3ba3975ba sp 00007fe3bdbd28a8 error 4 in
libc-2.17.so[7fe3ba242000
May 19 00:34:06 idmipa04.mws.mds.xyz systemd[1]:
dirsrv(a)MWS-MDS-XYZ.service: main process exited, code=killed, status=11/SEGV
May 19 00:34:06 idmipa04.mws.mds.xyz systemd[1]: Failed to start 389
Directory Server MWS-MDS-XYZ..
-- Subject: Unit dirsrv(a)MWS-MDS-XYZ.service has failed
-- Defined-By: systemd
-- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
--
-- Unit dirsrv(a)MWS-MDS-XYZ.service has failed.
--
-- The result is failed.
Wondering what should my next steps be from here?
--
Thx,
TK.
3 years, 11 months
Error migrating LDAP passwords using sssd
by Pierre Ossman
Hi,
We're in the process of migrating from an OpenLDAP server to FreeIPA. As
such the issue of password migration of course shows up. Unfortunately
the automatic migration in sssd is not working and we could use some help.
Server is a RHEL 8 set up using ipa-server-install and data migrated
from OpenLDAP using ipa migrate-ds.
Client is a Fedora 32 set up using ipa-client-install.
User lookup works fine, but trying to authenticate gives us this:
> May 22 15:11:26 samuel.lkpg.cendio.se sshd[3213]: pam_sss(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=::1 user=ossman
> May 22 15:11:26 samuel.lkpg.cendio.se sshd[3213]: pam_sss(sshd:auth): received for user ossman: 17 (Failure setting user credentials)
Nothing in the journal from sssd or in its own log files when this happens.
Turning up the logging to 6 gives me a lot more, among it this:
> (Fri May 22 15:12:45 2020) [[sssd[krb5_child[3262]]]] [get_and_save_tgt] (0x0400): Attempting kinit for realm [CENDIO.SE]
> (Fri May 22 15:12:45 2020) [[sssd[krb5_child[3262]]]] [get_and_save_tgt] (0x0020): 1704: [-1765328174][Generic preauthentication failure]
> (Fri May 22 15:12:45 2020) [[sssd[krb5_child[3262]]]] [map_krb5_error] (0x0020): [1432158222][Failure setting user credentials].
> (Fri May 22 15:12:45 2020) [[sssd[krb5_child[3262]]]] [k5c_send_data] (0x0200): Received error code 1432158222
Red Hat's documentation suggest an error called "key type is not
supported" should be given, so is this perhaps the issue?
Not sure where to continue here. I've checked the ldap entries an they
lack "krbprincipalkey" but have "userpassword", which I understand is
correct for my situation.
Regards
--
Pierre Ossman Software Development
Cendio AB https://cendio.com
Teknikringen 8 https://twitter.com/ThinLinc
583 30 Linköping https://facebook.com/ThinLinc
Phone: +46-13-214600
A: Because it messes up the order in which people normally read text.
Q: Why is top-posting such a bad thing?
3 years, 11 months
Auditing screensavers
by Bret Wortman
I have a need to set up an audit rule that will track whenever a user's screensaver is unlocked via password. I've tried setting a watch on pam_sss.so but that gets a lot more than what I strictly need and that also, strangely, had a tendency to audit when the screensaver was activated but not when it was deactivated.
Has anyone done this successfully in a way that can be shared? Our users are on both gnome & kde and could potentially be using one of several screensavers.
Thanks,
--
Bret Wortman
bret.wortman(a)damascusgrp.com
3 years, 11 months
Question regarding DNSSEC + AD Trust
by Vinícius Ferrão
Hello,
This may sound like a noobish question, but how can I make DNSSEC play nicely when the external domain have DNSSEC enabled and this makes internal zones failing when creating an AD trust, since we are using subdomains for our LAN?
Our case:
example.com (External DNS name with DNSSEC enabled)
win.example.com (Active Directory Zone)
nix.example.com (FreeIPA Zone)
Even with the correct conditional forwarders set up in Windows DNS and FreeIPA DNS, DNSSEC kicks in and fail resolutions.
I _MUST_ disable DNSSEC? There’s another way?
Thanks,
3 years, 11 months
Standard Linux Tools and Indirect Group Membership
by Mark Potter
While I have seen similar posts to the list while digging through the
archive, I cannot find this question specifically answered. We are coming
from OpenLDAP and migrating to FreeIPA on CentOS 7.5. We are using indirect
memberships to make this migration easier as we are moving from an
organically grown OpenLDAP to a very structured FreeIPA implementation.
What seems to be happening is that indirect memberships don't show using
the standard Linux tools. Using either "id" or "groups" doesn't show any
indirect memberships yet the permissions seem to still work properly. This
is causing some confusion with our team.
Group B is a member of Group A and the user is also a direct member of
groups C and D. When using "id" for a given user it returns B, C, D and
not A. However I can create a file owned by user root and group A with 550
permissions and the user can view the contents of the file. "ipa user-show"
shows the proper memberships with A being an indirect membership.
Is this the expected behavior when using indirect memberships? If so, does
one abandon the standard CLI tool and use only ipa commands? I am fully
aware this could be a configuration issue but I have yet to find the
correct configuration to expose indirect membership to the standard Linux
tools.
--
Regards,
Mark L. Potter
3 years, 11 months
Announcing SSSD 2.3.0
by Pavel Březina
# SSSD 2.3.0
The SSSD team is proud to announce the release of version 2.3.0 of the
System Security Services Daemon. The tarball can be downloaded from:
https://github.com/SSSD/sssd/releases/tag/sssd-2_3_0
See the full release notes at:
https://sssd.github.io/docs/users/relnotes/notes_2_3_0
RPM packages will be made available for Fedora shortly.
## Feedback
Please provide comments, bugs and other feedback via the sssd-devel
or sssd-users mailing lists:
https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
https://lists.fedorahosted.org/mailman/listinfo/sssd-users
## Highlights
### New features
- SSSD can now handle `hosts` and `networks` nsswitch databases (see
`resolve_provider` option)
- By default, authentication request only refresh user's initgroups if
it is expired or there is not active user's session (see
`pam_initgroups_scheme` option)
- OpenSSL is used as default crypto provider, NSS is deprecated
- Active Directory provider now defaults to GSS-SPNEGO SASL mechanism
(see `ldap_sasl_mech` option)
- Active Directory provider can now be configured to use only `ldaps`
port (see `ad_use_ldaps` option)
- SSSD now accepts host entries from GPO's security filter
- Format of debug messages has changed to be shorter and better sortable
- New debug level (`0x10000`) was added for low level ldb messages only
(see `sssd.conf` man page)
### Packaging changes
- New configure option `--enable-gss-spnego-for-zero-maxssf`
### Documentation Changes
- Default value of `ldap_sasl_mech` has changed to `GSS-SPNEGO` for AD
provider
- Return code of `pam_sss.so` are documented in `pam_sss` manpage
- Added option `ad_update_samba_machine_account_password`
- Added option `ad_use_ldaps`
- Added option `ldap_iphost_object_class`
- Added option `ldap_iphost_name`
- Added option `ldap_iphost_number`
- Added option `ldap_ipnetwork_object_class`
- Added option `ldap_ipnetwork_name`
- Added option `ldap_ipnetwork_number`
- Added option `ldap_iphost_search_base`
- Added option `ldap_ipnetwork_search_base`
- Added option `ldap_connection_expire_offset`
- Added option `ldap_sasl_maxssf`
- Added option `pam_initgroups_scheme`
- Added option `entry_cache_resolver_timeout`
- Added option `entry_cache_computer_timeout`
- Added option `resolver_provider`
- Added option `proxy_resolver_lib_name`
- Minor text improvements
3 years, 11 months
ssh bash completion (no known_hosts)
by Klaus Vink Slott
Hi
I am playing around in my lab with a set of centos 8 and centos 7 VM's
trying to make automount do some magic. All client VM's is fully IPA
integrated - and that it seems to make bash completion unavailable when
I hit TAB to complete the fqdn after ssh [hostname]..
I guess that this is due to there is no .ssh/known_hosts in a ipa
integrated client. But at the same time it is really annoying that to
satisfy kerberos, I have to type the fqdn at the ssh prompt every time.
So before I start building my own bash completion something, I would
like to know if any of you have knowledge of a easy solution, some
pre-boiled howto, rpm or else?
--
Regards
Klaus
3 years, 11 months
IPA CA renewal and duplicate CA certs
by Sigbjorn Lie
Hi,
We recently renewed our IPA CA cert using the "ipa-cacert-manage renew” command. The renewal was successful, and our CA cert no longer expires in 2020, but in 2040.
Running “ipa-certupdate” on existing IPA clients and ipa-client-install on new IPA clients also works, however both the new and the old CA cert is pulled down to the IPA client and stored in /etc/ipa/ca.crt.
This creates some issues as most applications reading /etc/ipa/ca.crt only reads the first entry, which happens to be the old CA cert.
For the moment everything works OK as the old CA cert is still valid, however this will become a major issue in a few months time.
Is this expected? To continue to service both the old and the new CA certificate to old and new IPA clients?
Will the old certificate be automatically removed at some point?
If not, what is the safe steps to remove the old CA certificate from the IPA servers?
Thanks.
Regards,
Siggi
3 years, 11 months
3rd Party OTP for LDAP and Kerberos
by Russ Long
I'm being forced by management to use a 3rd part OTP service for all authentication in our FreeIPA system, including LDAP connections. I know this can be at least partially done with Radius, however I'm not having much luck with that.
I've got a radius proxy setup, and user assigned to it, however it is not ever prompting for the MFA through RADIUS.
Additionally the tooltips for auth types state that radius does not work with LDAP connections.
3 years, 11 months
How to get certificate containing full chain
by Philipp Leusmann
Hi,
I need to receive a certificate containing the full CA chain.
Since ipa-getcert doesn't seem to offer a prebuilt option to do so (or does it?), I was looking at the post-save-command of ipa-getcert to merge the received certificate and the chain.
Unfortunately the command never gets invoked.
I cannot find a way how to find out the reason.
Are there any prerequisites for the commands? I understand certmonger offers debug options. But I have no idea how and where certmonger is started. I also do not understand possible argument values for the DEBUG.
Any help is appreciated.
Regards,
Philipp
3 years, 11 months
