July 2020 - FreeIPA-users - Fedora mailing-lists

ldap_bind: Invalid credentials (49)
by Dwija D 20 Jul '20

20 Jul '20

Hi I am trying to search ldap user using the following command but with invalid credentials error: # ldapsearch -x -h ldap://ipm.example.net <http://ldaps//idm.example.net> -p 389 -b "*dc=example,dc=net*" -D " *uid=ldapbind,cn=users,cn=account,dc=example,dc=net*" uid=ambariadmin1 -W Enter LDAP Password: *ldap_bind: Invalid credentials (49)* I have double checked the password but the error still persists. Before that, i have added a ldap bind user with the following procedure *[root@example ~]# cat ldapbind.ldif* dn: uid=ldapbind,cn=users,cn=accounts,dc=example,dc=net changetype: add objectclass: account objectclass: simplesecurityobject uid: ambaribind userPassword: secret123 passwordExpirationTime: 20380119031407Z nsIdleTimeout: 0 *[root@example ~]# ldapmodify -h **example.net* <http://example.net/>* -p 389 -x -D "cn=Directory Manager" -w 'secret123' -f ldapbind.ldif* adding new entry "uid=ldapbind,cn=users,cn=accounts,dc=example,dc=net" *[root@example ~]# ipa user-show ambaribind --raw --all* dn: uid=ldapbind,cn=users,cn=accounts,dc=example,dc=net uid: ldapbind nsaccountlock: FALSE has_password: TRUE has_keytab: FALSE objectClass: account objectClass: simplesecurityobject objectClass: top Without bind user, i can search the user *[root@example ~]# ldapsearch -x -h * *ipa.example.net* <http://idm.infodetics.net/>* -p 389 -b "cn=ambari,dc=example,dc=net" uid=ambariadmin1* Can any one plz guide me where is the issue ? Regards

2 2

Re: Looking for help to get my IPA server running again
by Florence Blanc-Renaud 17 Jul '20

17 Jul '20

On 7/16/20 4:54 PM, Lorenz Braun wrote: > On 16.07.20 15:50, Florence Blanc-Renaud wrote: >> On 7/16/20 3:00 PM, Lorenz Braun via FreeIPA-users wrote: >>> I was thinking something similar. I tried >>> ``` >>> [root@ipa01 ~]# ipa-cacert-manage renew >>> Renewing CA certificate, please wait >>> Error resubmitting certmonger request '20200716071025', please check >>> the request manually >>> The ipa-cacert-manage command failed. >>> ``` >> >> Hi, >> this command is used to renew IPA CA certificate and not applicable to >> the current situation. IPA CA has ~20 years validity and this cert is >> unlikely to be expired. > Good to know, thanks! >>> ``` >>> [root@ipa01 ~]# getcert list >>> Number of certificates and requests being tracked: 9. >>> [...] >>> Request ID '20200716071025': >>> status: CA_UNREACHABLE >> This is expected in your case as pki is down, and won't be able to >> manage the certificate renewal request. >> >>> ca-error: Internal error >>> stuck: no >>> key pair storage: >>> type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert >>> cert-pki-ca',token='NSS Certificate DB',pin set >>> certificate: >>> type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert >>> cert-pki-ca',token='NSS Certificate DB' >>> CA: dogtag-ipa-ca-renew-agent >>> issuer: CN=Certificate Authority,O=EXAMPLE.COM >>> subject: CN=Certificate Authority,O=EXAMPLE.COM >>> expires: 2040-07-16 07:08:27 UTC >>> key usage: digitalSignature,nonRepudiation,keyCertSign,cRLSign >>> pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad >>> post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert >>> "caSigningCert cert-pki-ca" >>> track: yes >>> auto-renew: yes >>> [...] >>> ``` >>> >>> The other one are all MONITORING and expire at 2022. Since i tried to >>> force a new cert maybe this is still okay and the problem lies >>> somewhere else? >> >> Then the problem is different. Since the new certs will expire 2022 >> (in 2 years), I suspect that they were renewed recently but the >> renewal failed in the middle. >> >> You can refer to [1] in order to ensure that this is the root cause >> and fix the current situation. >> >> HTH, >> flo >> >> [1] >> https://floblanc.wordpress.com/2017/09/11/troubleshooting-freeipa-pki-tomca… >> > I have checked and the certificate from /etc/pki/pki-tomcat/alias and > ldap are the exactly the same. I attached > /var/log/pki/pki-tomcat/ca/debug. The error message there is different: > ``` > [16/Jul/2020:16:24:57][profileChangeMonitor]: SignedAuditLogger: event > CLIENT_ACCESS_SESSION_ESTABLISH > java.net.ConnectException: Connection refused (Connection refused) > at java.net.PlainSocketImpl.socketConnect(Native Method) > at > java.net.AbstractPlainSocketImpl.doConnect(AbstractPlainSocketImpl.java:350) > > at > java.net.AbstractPlainSocketImpl.connectToAddress(AbstractPlainSocketImpl.java:206) > > at > java.net.AbstractPlainSocketImpl.connect(AbstractPlainSocketImpl.java:188) > at java.net.SocksSocketImpl.connect(SocksSocketImpl.java:392) > at java.net.Socket.connect(Socket.java:607) > at java.net.Socket.connect(Socket.java:556) > at java.net.Socket.<init>(Socket.java:452) > at java.net.Socket.<init>(Socket.java:262) > at > com.netscape.cmscore.ldapconn.PKISocketFactory.makeSSLSocket(PKISocketFactory.java:120) > > at > com.netscape.cmscore.ldapconn.PKISocketFactory.makeSocket(PKISocketFactory.java:159) > > at netscape.ldap.LDAPConnSetupMgr.connectServer(Unknown Source) > at netscape.ldap.LDAPConnSetupMgr.openSerial(Unknown Source) > at netscape.ldap.LDAPConnSetupMgr.connect(Unknown Source) > at netscape.ldap.LDAPConnSetupMgr.openConnection(Unknown Source) > at netscape.ldap.LDAPConnThread.connect(Unknown Source) > at netscape.ldap.LDAPConnection.connect(Unknown Source) > at netscape.ldap.LDAPConnection.connect(Unknown Source) > at netscape.ldap.LDAPConnection.connect(Unknown Source) > at > com.netscape.cmscore.ldapconn.LdapBoundConnection.<init>(LdapBoundConnection.java:82) > > at > com.netscape.cmscore.ldapconn.LdapBoundConnFactory$BoundConnection.<init>(LdapBoundConnFactory.java:531) > > at > com.netscape.cmscore.ldapconn.LdapBoundConnFactory.makeConnection(LdapBoundConnFactory.java:187) > > at > com.netscape.cmscore.ldapconn.LdapBoundConnFactory.getConn(LdapBoundConnFactory.java:332) > > at > com.netscape.cmscore.ldapconn.LdapBoundConnFactory.getConn(LdapBoundConnFactory.java:295) > > at > com.netscape.cmscore.profile.LDAPProfileSubsystem.run(LDAPProfileSubsystem.java:426) > > at java.lang.Thread.run(Thread.java:748) > [...] > [16/Jul/2020:16:24:57][profileChangeMonitor]: Can't create master > connection in LdapBoundConnFactory::getConn! Could not connect to LDAP > server host ipa01.example.com port 636 Error > netscape.ldap.LDAPException: Unable to create socket: > java.net.ConnectException: Connection refused (Connection refused) (-1) > [16/Jul/2020:16:24:57][authorityMonitor]: Can't create master connection > in LdapBoundConnFactory::getConn! Could not connect to LDAP server host > ipa01.example.com port 636 Error netscape.ldap.LDAPException: Unable to > create socket: java.net.ConnectException: Connection refused (Connection > refused) (-1) > ``` > > Firewall is not restricting this and i am a bit puzzled on why the > connection fails. If the service is not running or the port not open > ldapsearch should also not work, right? > I might test a fresh ipa install without restoring any data. Maybe > something with my OS or network is wrong. > You can check with # netstat -tunpl | grep 636 if the ldap server is listening on this port. It's possible that the LDAP server is up but only listening to 389. To see if port 636 is enabled in the server config: # ldapsearch -x -D "cn=directory manager" -W -b cn=config -s base nsslapd-security The attribute value should be "nsslapd-security: on". flo > Best Regards > Lorenz

2 2

Recommendations for FreeIPA implemenation in existing organization
by Thomas Schneider 16 Jul '20

16 Jul '20

Hello, I'm planning to implement FreeIPA in an existing organization that is providing services - DNS - Active Directory - LDAP - Certificates My question for the experts is: What is your best practice / recommendation for implementation of FreeIPA considering the existing services? Should I simply *not activate* services in FreeIPA that already exist, e.g. DNS, Certificates? Regards Thomas

2 1

Looking for help to get my IPA server running again
by Lorenz Braun 16 Jul '20

16 Jul '20

Hi there, i have been running an IPA install (4.5.0) on a CentOS 7 server for quite a while and had some problems with it. Eventually everything got worse and now it is not really usable anymore. It started with someone accidentally shutting down the server. From that point one of the services did not run anymore. Not 100% sure but i think it was pki-tomcat. I "fixed" it temporarily by using the '--ignore-service-failures' flag with ipactl. Everything seemed fine until about one or two weeks ago. Some Clients could sometimes not get kerberos tickets. I couldn't quite figure out why. I used 'ipa-backup --data' in hopes of restoring it on a fresh OS with everything working again. Had to upgrade to IPA 4.6.6. It worked with 'ipa-restore --data --backend=userRoot'. 'kinit' works, but i can't use any 'ipa ...' commands. Here an example: ``` [root@ipa01 ~]# ipa -v user-find --all ipa: INFO: trying https://ipa01.example.com/ipa/json ipa: INFO: [try 1]: Forwarding 'schema' to json server 'https://ipa01.example.com/ipa/json' ipa: ERROR: No valid Negotiate header in server response ``` /var/log/httpd/error_log: ``` [Thu Jul 16 10:40:27.007724 2020] [auth_gssapi:error] [pid 2210] [client xx.xx.xx.1:40920] GSS ERROR gss_acquire_cred[_from]() failed to get server creds: [Unspecified GSS failure. Minor code may provide more information ( SPNEGO cannot find mechanisms to negotiate)], referer: https://ipa01.example.com/ipa/xml ``` /var/log/messages: ``` [...] Jul 16 10:40:26 ipa01 gssproxy: [CID 14][2020/07/16 08:40:26]: gp_rpc_execute: executing 6 (GSSX_ACQUIRE_CRED) for service "ipa-httpd", euid: 48,socket: (null) Jul 16 10:40:26 ipa01 gssproxy: GSSX_ARG_ACQUIRE_CRED( call_ctx: { "" [ ] } input_cred_handle: <Null> add_cred: 0 desired_name: <Null> time_req: 4294967295 desired_mechs: { { 1 2 840 113554 1 2 2 } } cred_usage: BOTH initiator_time_req: 0 acceptor_time_req: 0 ) Jul 16 10:40:26 ipa01 gssproxy: gssproxy[2408]: (OID: { 1 2 840 113554 1 2 2 }) Unspecified GSS failure. Minor code may provide more information, Preauthentication failed Jul 16 10:40:26 ipa01 gssproxy: GSSX_RES_ACQUIRE_CRED( status: { 851968 { 1 2 840 113554 1 2 2 } 2529638936 "Unspecified GSS failure. Minor code may provide more information" "Preauthentication failed" [ ] } output_cred_handle: <Null> ) Jul 16 10:40:26 ipa01 gssproxy: [CID 14][2020/07/16 08:40:26]: gp_rpc_execute: executing 6 (GSSX_ACQUIRE_CRED) for service "ipa-httpd", euid: 48,socket: (null) Jul 16 10:40:26 ipa01 gssproxy: GSSX_ARG_ACQUIRE_CRED( call_ctx: { "" [ ] } input_cred_handle: <Null> add_cred: 0 desired_name: <Null> time_req: 4294967295 desired_mechs: { { 1 2 840 113554 1 2 2 } } cred_usage: BOTH initiator_time_req: 0 acceptor_time_req: 0 ) Jul 16 10:40:27 ipa01 gssproxy: gssproxy[2408]: (OID: { 1 2 840 113554 1 2 2 }) Unspecified GSS failure. Minor code may provide more information, Preauthentication failed Jul 16 10:40:27 ipa01 gssproxy: GSSX_RES_ACQUIRE_CRED( status: { 851968 { 1 2 840 113554 1 2 2 } 2529638936 "Unspecified GSS failure. Minor code may provide more information" "Preauthentication failed" [ ] } output_cred_handle: <Null> ) Jul 16 10:40:34 ipa01 [sssd[ldap_child[15047]]]: Failed to initialize credentials using keytab [MEMORY:/etc/krb5.keytab]: Preauthentication failed. Unable to create GSSAPI-encrypted LDAP connection. [...] ``` Does anyone know how to fix this or debug it further? I still have a snapshot of the old ipa machine if that helps. I am also thinking about just backing up the user database (usernames and passwords, everything else is nice but not required) and using a fresh install with just the user data. I how much different this would be from what i have done now to be honest. Re-installing the clients is not much work for me, because it is well automated and there are few clients anyway. I hope this was not too long and convoluted. I'll be glad about any help. Best regards Lorenz

2 3

certmapdata issue
by Shane Frasier 16 Jul '20

16 Jul '20

Hello, I have users who kinit using their PIV (smartcard) certificates. Everything works great for users who happen to be "full" employees, but contractors' certificates never match. "Full" employees have certificates issues by: OU=DHS CA4,OU=Certification Authorities,OU=Department of Homeland Security,O=U.S. Government,C=US Their certificates are issued to, for example: CN=JOHN J SMITH+UID=0123456789.DHS HQ,OU=People,OU=DHS HQ,OU=Department of Homeland Security,O=U.S. Government,C=US Contractors have certificates issued by: OU=DHS CA4,OU=Certification Authorities,OU=Department of Homeland Security,O=U.S. Government,C=US Their certificates are issued to, for example: CN=MAX M MUSTERMANN (affiliate)+UID=0123456789.DHS HQ,OU=People,OU=DHS HQ,OU=Department of Homeland Security,O=U.S. Government,C=US I have the usual certificate mapping rule: (ipacertmapdata=X509:{issuer_dn!nss_x500}<S>{subject_dn!nss_x500}) I also have a simple matching rule: <ISSUER>O=U.S. Government I currently have the following four certificate mapping data entries for each user: * X509:C=US,O=U.S. Government,OU=Department of Homeland Security,OU=Certification Authorities,OU=DHS CA4<S>C=US,O=U.S. Government,OU=Department of Homeland Security,OU=DHS HQ,OU=People,CN=MAX M MUSTERMANN (affiliate)+UID=0123456789.DHS HQ * X509:C=US,O=U.S. Government,OU=Department of Homeland Security,OU=Certification Authorities,OU=DHS CA4<S>C=US,O=U.S. Government,OU=Department of Homeland Security,OU=DHS HQ,OU=People,CN=MAX M MUSTERMANN (affiliate),UID=0123456789.DHS HQ * X509:C=US,O=U.S. Government,OU=Department of Homeland Security,OU=Certification Authorities,OU=DHS CA4<S>C=US,O=U.S. Government,OU=Department of Homeland Security,OU=DHS HQ,OU=People,UID=0123456789.DHS HQ+CN=MAX M MUSTERMANN (affiliate) * X509:C=US,O=U.S. Government,OU=Department of Homeland Security,OU=Certification Authorities,OU=DHS CA4<S>C=US,O=U.S. Government,OU=Department of Homeland Security,OU=DHS HQ,OU=People,UID=0123456789.DHS HQ,CN=MAX M MUSTERMANN (affiliate) Any thoughts as to why the contractors' certificates never match? I assume it has something to do with the "(affiliate)" that appears in their CN. Thanks, Shane Frasier

4 9

LDAP conflicts and ldapsubentry
by David Harvey 16 Jul '20

16 Jul '20

Dear list, I noted from TFM <https://access.redhat.com/documentation/en-us/red_hat_directory_server/10/h…> that conflicting values have ldapSubEntry and nsds5ReplConflict attributes, however it only mentioned removing the latter. Should we in fact remove ldapsubentry as well when resolving these conflicts? For the two conflicts I had, I noted: 1. cn: ipservices was identical apart from the aforementioned attributes. *laregly resolved but ldapsubentry still in place taking the newer version over old 2. I had a subtly different "cn: System: Read POSIX details of SMB services". Conflicting entries (ipaPermDefaultAttr: uid vs ipaPermDefaultAttr: uidnumber) which I assume to be a schema change during upgrade that borked somehow? * I haven't actioned this one yet given the discrepancy. Recently upgraded packages in centos which took us from 4.7.6 (IIRC) to 4.8.4. Thanks as ever, David

2 2

freshly installed FreeIPA server dies
by Tony Brian Albers 13 Jul '20

13 Jul '20

Hi guys, This is a new install, software used is: ipa-server.x86_64 4.8.4-7.module+el8.2.0+6046+aaa49f96 389-ds-base.x86_64 1.4.2.4-8.module+el8.2.0+5959+cfcaedbd I followed the install instructions in the documentation, and everything went fine. I haven't added any users or groups yet. I have a master and a replica. The master dies, but the replica seems totally happy. I restarted the master yesterday at 13:25. However, after a short time running, the log files in /var/log/pki/pki-tomcat/ca/debug.. starts filling up with java SocketExceptions like these: 2020-07-08 13:57:49 [profileChangeMonitor] SEVERE: Profile change monitor: Caught exception: netscape.ldap.LDAPException: Server or network error (81) netscape.ldap.LDAPException: Server or network error (81) at netscape.ldap.LDAPConnThread.networkError(Unknown Source) at netscape.ldap.LDAPConnThread.run(Unknown Source) at java.lang.Thread.run(Thread.java:748) 2020-07-08 13:57:49 [AuthorityMonitor] WARNING: AuthorityMonitor: Failed to execute LDAP search for lightweight CAs: netscape.ldap.LDAPException: Server or network error (81) netscape.ldap.LDAPException: Server or network error (81) at netscape.ldap.LDAPConnThread.networkError(Unknown Source) at netscape.ldap.LDAPConnThread.run(Unknown Source) at java.lang.Thread.run(Thread.java:748) 2020-07-08 13:57:49 [profileChangeMonitor] SEVERE: Unable to create socket: java.net.SocketException: Network is unreachable (connect failed) java.net.SocketException: Network is unreachable (connect failed) ... So it's pretty obvious that the LDAP server is not working properly. In /var/log/dirsrv/slapd-YAK2-NET/errors I see: 389-Directory/1.4.2.4 B2020.121.2358 fipa001.yak2.net:636 (/etc/dirsrv/slapd-YAK2-NET) [08/Jul/2020:13:25:36.982866396 +0200] - INFO - slapd_extract_cert - CA CERT NAME: YAK2.NET IPA CA [08/Jul/2020:13:25:37.002136210 +0200] - WARN - Security Initialization - SSL alert: Sending pin request to SVRCore. You may need to run systemd-tty-ask-password-agent to provide the password. [08/Jul/2020:13:25:37.030257707 +0200] - INFO - slapd_extract_cert - SERVER CERT NAME: Server-Cert [08/Jul/2020:13:25:37.049921505 +0200] - INFO - Security Initialization - SSL info: Enabling default cipher set. [08/Jul/2020:13:25:37.074564197 +0200] - INFO - Security Initialization - SSL info: Configured NSS Ciphers [08/Jul/2020:13:25:37.091262372 +0200] - INFO - Security Initialization - SSL info: TLS_AES_128_GCM_SHA256: enabled ... All ciphers enabled ... [08/Jul/2020:13:25:37.601009917 +0200] - INFO - Security Initialization - slapd_ssl_init2 - Configured SSL version range: min: TLS1.0, ma x: TLS1.2 [08/Jul/2020:13:25:37.616336615 +0200] - INFO - Security Initialization - slapd_ssl_init2 - NSS adjusted SSL version range: min: TLS1.2, max: TLS1.2 ... [08/Jul/2020:13:25:38.547791102 +0200] - NOTICE - bdb_start - Detected Disorderly Shutdown last time Directory Server was running, recovering database. [08/Jul/2020:13:25:38.792474100 +0200] - ERR - attrcrypt_unwrap_key - Failed to unwrap key for cipher AES [08/Jul/2020:13:25:38.817182778 +0200] - ERR - attrcrypt_cipher_init - Symmetric key failed to unwrap with the private key; Cert might have been renewed since the key is wrapped. To recover the encrypted contents, keep the wrapped symmetric key value. [08/Jul/2020:13:25:38.852524974 +0200] - ERR - attrcrypt_unwrap_key - Failed to unwrap key for cipher 3DES [08/Jul/2020:13:25:38.871423186 +0200] - ERR - attrcrypt_cipher_init - Symmetric key failed to unwrap with the private key; Cert might have been renewed since the key is wrapped. To recover the encrypted contents, keep the wrapped symmetric key value. [08/Jul/2020:13:25:38.880537833 +0200] - ERR - attrcrypt_init - All prepared ciphers are not available. Please disable attribute encryption. [08/Jul/2020:13:25:38.891681971 +0200] - ERR - attrcrypt_unwrap_key - Failed to unwrap key for cipher AES [08/Jul/2020:13:25:38.916694998 +0200] - ERR - attrcrypt_cipher_init - Symmetric key failed to unwrap with the private key; Cert might have been renewed since the key is wrapped. To recover the encrypted contents, keep the wrapped symmetric key value. [08/Jul/2020:13:25:38.925787580 +0200] - ERR - attrcrypt_unwrap_key - Failed to unwrap key for cipher 3DES [08/Jul/2020:13:25:38.934688993 +0200] - ERR - attrcrypt_cipher_init - Symmetric key failed to unwrap with the private key; Cert might have been renewed since the key is wrapped. To recover the encrypted contents, keep the wrapped symmetric key value. [08/Jul/2020:13:25:38.943696327 +0200] - ERR - attrcrypt_init - All prepared ciphers are not available. Please disable attribute encryption. [08/Jul/2020:13:25:38.963177992 +0200] - ERR - schema-compat-plugin - scheduled schema-compat-plugin tree scan in about 5 seconds after the server startup! [08/Jul/2020:13:25:39.005290186 +0200] - WARN - NSACLPlugin - acl_parse - The ACL target cn=dns,dc=yak2,dc=net does not exist [08/Jul/2020:13:25:39.016002719 +0200] - WARN - NSACLPlugin - acl_parse - The ACL target cn=dns,dc=yak2,dc=net does not exist [08/Jul/2020:13:25:39.025021142 +0200] - WARN - NSACLPlugin - acl_parse - The ACL target cn=keys,cn=sec,cn=dns,dc=yak2,dc=net does not exist [08/Jul/2020:13:25:39.034249703 +0200] - WARN - NSACLPlugin - acl_parse - The ACL target cn=dns,dc=yak2,dc=net does not exist [08/Jul/2020:13:25:39.043141171 +0200] - WARN - NSACLPlugin - acl_parse - The ACL target cn=dns,dc=yak2,dc=net does not exist [08/Jul/2020:13:25:39.052203339 +0200] - WARN - NSACLPlugin - acl_parse - The ACL target cn=groups,cn=compat,dc=yak2,dc=net does not exist [08/Jul/2020:13:25:39.061377434 +0200] - WARN - NSACLPlugin - acl_parse - The ACL target cn=computers,cn=compat,dc=yak2,dc=net does not exist [08/Jul/2020:13:25:39.070224153 +0200] - WARN - NSACLPlugin - acl_parse - The ACL target cn=ng,cn=compat,dc=yak2,dc=net does not exist [08/Jul/2020:13:25:39.079482188 +0200] - WARN - NSACLPlugin - acl_parse - The ACL target ou=sudoers,dc=yak2,dc=net does not exist [08/Jul/2020:13:25:39.088423317 +0200] - WARN - NSACLPlugin - acl_parse - The ACL target cn=users,cn=compat,dc=yak2,dc=net does not exist [08/Jul/2020:13:25:39.097485949 +0200] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=yak2,dc=net does not exist [08/Jul/2020:13:25:39.106344275 +0200] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=yak2,dc=net does not exist [08/Jul/2020:13:25:39.115510556 +0200] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=yak2,dc=net does not exist [08/Jul/2020:13:25:39.124588060 +0200] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=yak2,dc=net does not exist [08/Jul/2020:13:25:39.133557279 +0200] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=yak2,dc=net does not exist [08/Jul/2020:13:25:39.142529788 +0200] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=yak2,dc=net does not exist [08/Jul/2020:13:25:39.151543892 +0200] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=yak2,dc=net does not exist [08/Jul/2020:13:25:39.160697059 +0200] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=yak2,dc=net does not exist [08/Jul/2020:13:25:39.169730169 +0200] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=yak2,dc=net does not exist [08/Jul/2020:13:25:39.178596620 +0200] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=yak2,dc=net does not exist [08/Jul/2020:13:25:39.187737945 +0200] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=yak2,dc=net does not exist [08/Jul/2020:13:25:39.200014978 +0200] - WARN - NSACLPlugin - acl_parse - The ACL target cn=ad,cn=etc,dc=yak2,dc=net does not exist [08/Jul/2020:13:25:39.215529397 +0200] - WARN - NSACLPlugin - acl_parse - The ACL target cn=casigningcert cert-pki- ca,cn=ca_renewal,cn=ipa,cn=etc,dc=yak2,dc=net does not exist [08/Jul/2020:13:25:39.223802735 +0200] - WARN - NSACLPlugin - acl_parse - The ACL target cn=casigningcert cert-pki- ca,cn=ca_renewal,cn=ipa,cn=etc,dc=yak2,dc=net does not exist [08/Jul/2020:13:25:39.223802735 +0200] - WARN - NSACLPlugin - acl_parse - The ACL target cn=casigningcert cert-pki- ca,cn=ca_renewal,cn=ipa,cn=etc,dc=yak2,dc=net does not exist [08/Jul/2020:13:25:39.295259710 +0200] - WARN - NSACLPlugin - acl_parse - The ACL target cn=automember rebuild membership,cn=tasks,cn=config does not exist [08/Jul/2020:13:25:39.307599195 +0200] - ERR - cos-plugin - cos_dn_defs_cb - Skipping CoS Definition cn=Password Policy,cn=accounts,dc=yak2,dc=net--no CoS Templates found, which should be added before the CoS Definition. ... [08/Jul/2020:13:25:39.414188379 +0200] - WARN - NSMMReplicationPlugin - replica_check_for_data_reload - Disorderly shutdown for replica dc=yak2,dc=net. Check if DB RUV needs to be updated [08/Jul/2020:13:25:39.422657691 +0200] - ERR - set_krb5_creds - Could not get initial credentials for principal [ ldap/fipa001.yak2.net(a)YAK2.NET] in keytab [FILE:/etc/dirsrv/ds.keytab]: -1765328228 (Cannot contact any KDC for requested realm) [08/Jul/2020:13:25:39.431578492 +0200] - WARN - NSMMReplicationPlugin - replica_check_for_data_reload - Disorderly shutdown for replica o=ipaca. Check if DB RUV needs to be updated [08/Jul/2020:13:25:39.441463670 +0200] - ERR - NSMMReplicationPlugin - bind_and_check_pwp - agmt="cn=caTofipa002.yak2.net" (fipa002:389) - Replication bind with GSSAPI auth failed: LDAP error -1 (Can't contact LDAP server) () [08/Jul/2020:13:25:39.458768924 +0200] - ERR - set_krb5_creds - Could not get initial credentials for principal [ ldap/fipa001.yak2.net(a)YAK2.NET] in keytab [FILE:/etc/dirsrv/ds.keytab]: -1765328228 (Cannot contact any KDC for requested realm) [08/Jul/2020:13:25:39.477747370 +0200] - ERR - NSMMReplicationPlugin - bind_and_check_pwp - agmt="cn=meTofipa002.yak2.net" (fipa002:389) - Replication bind with GSSAPI auth failed: LDAP error -1 (Can't contact LDAP server) () [08/Jul/2020:13:25:39.494528440 +0200] - INFO - slapd_daemon - slapd started. Listening on All Interfaces port 389 for LDAP requests [08/Jul/2020:13:25:39.503748199 +0200] - INFO - slapd_daemon - Listening on All Interfaces port 636 for LDAPS requests [08/Jul/2020:13:25:39.512913530 +0200] - INFO - slapd_daemon - Listening on /var/run/slapd-YAK2-NET.socket for LDAPI requests [08/Jul/2020:13:25:39.521834655 +0200] - ERR - schema-compat-plugin - schema-compat-plugin tree scan will start in about 5 seconds! [08/Jul/2020:13:25:42.619282707 +0200] - ERR - set_krb5_creds - Could not get initial credentials for principal [ ldap/fipa001.yak2.net(a)YAK2.NET] in keytab [FILE:/etc/dirsrv/ds.keytab]: -1765328228 (Cannot contact any KDC for requested realm) [08/Jul/2020:13:25:42.660769148 +0200] - ERR - set_krb5_creds - Could not get initial credentials for principal [ ldap/fipa001.yak2.net(a)YAK2.NET] in keytab [FILE:/etc/dirsrv/ds.keytab]: -1765328228 (Cannot contact any KDC for requested realm) [08/Jul/2020:13:25:44.517541271 +0200] - ERR - schema-compat-plugin - warning: no entries set up under ou=sudoers,dc=yak2,dc=net [08/Jul/2020:13:25:44.570564330 +0200] - ERR - schema-compat-plugin - warning: no entries set up under cn=ng, cn=compat,dc=yak2,dc=net [08/Jul/2020:13:25:44.614807034 +0200] - ERR - schema-compat-plugin - warning: no entries set up under cn=computers, cn=compat,dc=yak2,dc=net [08/Jul/2020:13:25:44.635448724 +0200] - ERR - schema-compat-plugin - Finished plugin initialization. [08/Jul/2020:13:25:48.807433248 +0200] - INFO - NSMMReplicationPlugin - bind_and_check_pwp - agmt="cn=meTofipa002.yak2.net" (fipa002:389): Replication bind with GSSAPI auth resumed [08/Jul/2020:13:25:48.853993542 +0200] - INFO - NSMMReplicationPlugin - bind_and_check_pwp - agmt="cn=caTofipa002.yak2.net" (fipa002:389): Replication bind with GSSAPI auth resumed [08/Jul/2020:15:00:49.240767214 +0200] - ERR - NSMMReplicationPlugin - bind_and_check_pwp - agmt="cn=caTofipa002.yak2.net" (fipa002:389) - Replication bind with GSSAPI auth failed: LDAP error -1 (Can't contact LDAP server) () [09/Jul/2020:07:42:10.753040947 +0200] - INFO - NSMMReplicationPlugin - bind_and_check_pwp - agmt="cn=caTofipa002.yak2.net" (fipa002:389): Replication bind with GSSAPI auth resumed The log files grow to huge sizes very quickly and fills up the /var filesystem which stops the server. It's not clear to me why this is happening, any advice and tips to get it fixed are appreciated. /tony -- Tony Albers - Systems Architect - IT Development Royal Danish Library, Victor Albecks Vej 1, 8000 Aarhus C, Denmark Tel: +45 2566 2383 - CVR/SE: 2898 8842 - EAN: 5798000792142

2 7

OTP Radius 5 seconds timeout
by Sergiy Genyuk 13 Jul '20

13 Jul '20

Hello I have setup radius proxy (DUO) and associate user with it. Everything works except radius timeout. It is 5 seconds and you have to be blazing fast to push the button :-) I did adjust radius timeout in freeipa to 30 seconds but it is still 5 seconds. As well I have tried a trick with krb.conf [otp] settings, same still 5 seconds. Please point me to proper way to change radius timeout. Tested on Centos 8. Freeipa 4.8.4 ipa radiusproxy-find ----------------------------- 1 RADIUS proxy server matched ----------------------------- RADIUS proxy server name: duo2 Server: x.x.x.x Timeout: 30 Retries: 0 ---------------------------- Number of entries returned 1 ---------------------------- Thank you. Sergiy

3 7

kinit -n asking for password on clients
by John Ratliff 13 Jul '20

13 Jul '20

When trying to do pkinit, if I do kinit -n on one of the IdM servers, it works fine. If I try on a client machine, it asks me for the password for WELLKNOWN/ANONYMOUS@REALM. I have the pkinit_anchors setup for the realm. As I'm trying to do anonymous pkinit, I think I don't need a client certificate. On the server, I get this: $ KRB5_TRACE="/dev/stderr" kinit -n [13061] 1518402857.924212: Getting initial credentials for WELLKNOWN/ANONYMOUS(a)IDM.EXAMPLE.COM [13061] 1518402857.929673: Sending request (200 bytes) to IDM.EXAMPLE.COM [13061] 1518402857.931830: Initiating TCP connection to stream 10.77.9.101:88 [13061] 1518402857.932241: Sending TCP request to stream 10.77.9.101:88 [13061] 1518402857.939162: Received answer (359 bytes) from stream 10.77.9.101:88 [13061] 1518402857.939180: Terminating TCP connection to stream 10.77.9.101:88 [13061] 1518402857.939284: Response was from master KDC [13061] 1518402857.939380: Received error from KDC: -1765328359/Additional pre-authentication required [13061] 1518402857.939474: Processing preauth types: 16, 15, 14, 136, 19, 147, 2, 133 [13061] 1518402857.939499: Selected etype info: etype aes256-cts, salt "IDM.EXAMPLE.COMWELLKNOWNANONYMOUS", params "" [13061] 1518402857.939509: Received cookie: MIT [13061] 1518402857.939563: Preauth module pkinit (147) (info) returned: 0/Success [13061] 1518402857.940352: PKINIT client computed kdc-req-body checksum 9/D98A0144E7E4ACC66B63EBCA98379AB9F055D143 [13061] 1518402857.940369: PKINIT client making DH request [13061] 1518402858.935: Preauth module pkinit (16) (real) returned: 0/Success [13061] 1518402858.956: Produced preauth for next request: 133, 16 [13061] 1518402858.994: Sending request (1408 bytes) to IDM.EXAMPLE.COM [13061] 1518402858.1091: Initiating TCP connection to stream 10.77.9.101:88 [13061] 1518402858.1187: Sending TCP request to stream 10.77.9.101:88 [13061] 1518402858.43063: Received answer (2880 bytes) from stream 10.77.9.101:88 [13061] 1518402858.43088: Terminating TCP connection to stream 10.77.9.101:88 [13061] 1518402858.43198: Response was from master KDC [13061] 1518402858.43258: Processing preauth types: 17, 19, 147 [13061] 1518402858.43273: Selected etype info: etype aes256-cts, salt "IDM.EXAMPLE.COMWELLKNOWNANONYMOUS", params "" [13061] 1518402858.43300: Preauth module pkinit (147) (info) returned: 0/Success [13061] 1518402858.44150: PKINIT client verified DH reply [13061] 1518402858.44189: PKINIT client found id-pkinit-san in KDC cert: krbtgt/IDM.EXAMPLE.COM(a)IDM.EXAMPLE.COM [13061] 1518402858.44199: PKINIT client matched KDC principal krbtgt/IDM.EXAMPLE.COM(a)IDM.EXAMPLE.COM against id-pkinit-san; no EKU check required [13061] 1518402858.62345: PKINIT client used KDF 2B06010502030602 to compute reply key aes256-cts/00E0 [13061] 1518402858.62395: Preauth module pkinit (17) (real) returned: 0/Success [13061] 1518402858.62402: Produced preauth for next request: (empty) [13061] 1518402858.62414: AS key determined by preauth: aes256-cts/00E0 [13061] 1518402858.62547: Decrypted AS reply; session key is: aes256-cts/96F0 [13061] 1518402858.62589: FAST negotiation: available [13061] 1518402858.62692: Initializing KEYRING:persistent:760400007:krb_ccache_f3PFEy1 with default princ WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS [13061] 1518402858.62770: Storing WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS -> krbtgt/IDM.EXAMPLE.COM(a)IDM.EXAMPLE.COM in KEYRING:persistent:760400007:krb_ccache_f3PFEy1 [13061] 1518402858.62846: Storing config in KEYRING:persistent:760400007:krb_ccache_f3PFEy1 for krbtgt/IDM.EXAMPLE.COM(a)IDM.EXAMPLE.COM: fast_avail: yes [13061] 1518402858.62878: Storing WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS -> krb5_ccache_conf_data/fast_avail/krbtgt\/IDM.EXAMPLE.COM\@IDM.EXAMPLE.COM@X-CACHECONF: in KEYRING:persistent:760400007:krb_ccache_f3PFEy1 [13061] 1518402858.62933: Storing config in KEYRING:persistent:760400007:krb_ccache_f3PFEy1 for krbtgt/IDM.EXAMPLE.COM(a)IDM.EXAMPLE.COM: pa_type: 16 [13061] 1518402858.62954: Storing WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS -> krb5_ccache_conf_data/pa_type/krbtgt\/IDM.EXAMPLE.COM\@IDM.EXAMPLE.COM@X-CACHECONF: in KEYRING:persistent:760400007:krb_ccache_f3PFEy1 But on the client, I get this: $ KRB5_TRACE="/dev/stderr" kinit -n [2941] 1518402820.155827: Getting initial credentials for WELLKNOWN/ANONYMOUS(a)IDM.EXAMPLE.COM [2941] 1518402820.156298: Sending request (200 bytes) to IDM.EXAMPLE.COM [2941] 1518402820.158723: Resolving hostname paine.example.com. [2941] 1518402820.159975: Resolving hostname phantom.example.com. [2941] 1518402820.160757: Resolving hostname paine.example.com. [2941] 1518402820.161411: Initiating TCP connection to stream 204.89.253.101:88 [2941] 1518402820.162065: Sending TCP request to stream 204.89.253.101:88 [2941] 1518402820.168495: Received answer (359 bytes) from stream 204.89.253.101:88 [2941] 1518402820.168532: Terminating TCP connection to stream 204.89.253.101:88 [2941] 1518402820.169917: Response was from master KDC [2941] 1518402820.169974: Received error from KDC: -1765328359/Additional pre-authentication required [2941] 1518402820.170029: Processing preauth types: 16, 15, 14, 136, 19, 147, 2, 133 [2941] 1518402820.170051: Selected etype info: etype aes256-cts, salt "IDM.EXAMPLE.COMWELLKNOWNANONYMOUS", params "" [2941] 1518402820.170062: Received cookie: MIT Password for WELLKNOWN/ANONYMOUS(a)IDM.EXAMPLE.COM: [2941] 1518402833.34612: Preauth module encrypted_timestamp (2) (real) returned: -1765328252/Password read interrupted kinit: Pre-authentication failed: Password read interrupted while getting initial credentials Suggestions on what I'm missing? Thanks.

3 3

It ain't easy to dig a user's last login time info out of IdM/FreeIPA
by White, Daniel E. (GSFC-770.0)[NICS] 10 Jul '20

10 Jul '20

I want to get createtimestamp, krbLastSuccessfulAuth, and krbLastPwdChange for all active users The "ipa user-find" or "ipa user-show" commands only give krbLastPwdChange and failed login count/date The "ipa user-status" command shows "Last successful authentication", but it has to be run for each user I found this suggestion https://www.redhat.com/archives/freeipa-users/2016-May/msg00213.html Could you use ldapsearch? # ldapsearch -Y GSSAPI -b "cn=users,cn=accounts,dc=rhel72" createtimestamp krbLastSuccessfulAuth and tried it adding in krbLastPwdChange, and using a service account as described here https://www.freeipa.org/page/HowTo/LDAP#System_Accounts but it did not return any krbLastSuccessfulAuth values. A bit of tinkering revealed that I have to use the Directory Manager to get back the krbLastSuccessfulAuth. Is it possible to tweak the service account to allow it to read krbLastSuccessfulAuth ? ______________________________________________________________________________________________ Daniel E. White daniel.e.white(a)nasa.gov NICS Linux Engineer NASA Goddard Space Flight Center 8800 Greenbelt Road Building 14, Room E175 Greenbelt, MD 20771 Office: (301) 286-6919 Mobile: (240) 513-5290

3 3

Applying Custom Object Classes to New Computer Entries
by Anabela Mazurek 10 Jul '20

10 Jul '20

How can i define default classes for newly created Computer objects?

2 3

Looking for current Python API information
by White, Daniel E. (GSFC-770.0)[NICS] 10 Jul '20

10 Jul '20

Most seems to be before Python 2's EOL including https://www.freeipa.org/page/API_Examples This one seems current: https://github.com/opennode/python-freeipa https://python-freeipa.readthedocs.io/en/latest/ Anyone recommend it or one better ? ______________________________________________________________________________________________ Daniel E. White daniel.e.white(a)nasa.gov NICS Linux Engineer NASA Goddard Space Flight Center 8800 Greenbelt Road Building 14, Room E175 Greenbelt, MD 20771 Office: (301) 286-6919 Mobile: (240) 513-5290

1 0

IMPORTANT: DigiCert is revoking some intermediate CAs July 11, 2020
by Rob Crittenden 10 Jul '20

10 Jul '20

In case anyone is using certificates from DigiCert they are revoking 14 intermediate CA's after an audit of DigitCert's intermediate CAs for extended validation certificates (EV) has revealed an inconsistency. This revocation is going to happen by Saturday July 11, 2020 at 18:00 UTC. See https://knowledge.digicert.com/alerts/DigiCert-ICA-Replacement for details. rob

1 0

Re: FreeIPA/PKI CA/KRA Subsystem Certificate Renewal Failure (not yet expired)
by Ilya Kogan 09 Jul '20

09 Jul '20

Hi, I seem to be facing a similar issue with one of my KRAs. My KRA certificates were, for some reason, not automatically renewed when they expired last month. Using `ipa-cert-fix` correctly fixed them on _one_ host. On the other, they seem to be stuck in the renewal state and `ipa-cert-fix` claims there's nothing to do: ``` Request ID '20191031183458': status: MONITORING ca-error: Server at " http://ipa-one.mydomain.org:8080/ca/ee/ca/profileSubmit" replied: Missing credential: sessionID stuck: no key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert cert-pki-kra',token='NSS Certificate DB',pin set certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert cert-pki-kra',token='NSS Certificate DB' CA: dogtag-ipa-ca-renew-agent issuer: CN=Certificate Authority,O=MYDOMAIN.ORG subject: CN=KRA Audit,O=MYDOMAIN.ORG expires: 2020-06-27 01:54:34 EDT key usage: digitalSignature,nonRepudiation pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "auditSigningCert cert-pki-kra" track: yes auto-renew: yes Request ID '20191031183459': status: MONITORING ca-error: Server at " http://ipa-one.mydomain.org:8080/ca/ee/ca/profileSubmit" replied: Missing credential: sessionID stuck: no key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='transportCert cert-pki-kra',token='NSS Certificate DB',pin set certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='transportCert cert-pki-kra',token='NSS Certificate DB' CA: dogtag-ipa-ca-renew-agent issuer: CN=Certificate Authority,O=MYDOMAIN.ORG subject: CN=KRA Transport Certificate,O=MYDOMAIN.ORG expires: 2020-06-27 01:54:30 EDT key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment eku: id-kp-clientAuth pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "transportCert cert-pki-kra" track: yes auto-renew: yes Request ID '20191031183500': status: MONITORING ca-error: Server at " http://ipa-one.mydomain.org:8080/ca/ee/ca/profileSubmit" replied: Missing credential: sessionID stuck: no key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='storageCert cert-pki-kra',token='NSS Certificate DB',pin set certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='storageCert cert-pki-kra',token='NSS Certificate DB' CA: dogtag-ipa-ca-renew-agent issuer: CN=Certificate Authority,O=MYDOMAIN.ORG subject: CN=KRA Storage Certificate,O=MYDOMAIN.ORG expires: 2020-06-27 01:54:32 EDT key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment eku: id-kp-clientAuth pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "storageCert cert-pki-kra" track: yes auto-renew: yes ``` Here are the sequence of events that seem to have led to this: 1. Install FreeIPA Master many years ago and continue to upgrade it from time to time. 2. Install FreeIPA Replica a few years after and continue to upgrade it from time to time. 3. Allow the certificates to expire on both nodes. 4. Attempt to patch the replica via `yum upgrade` on the second node. 5. Notice after reboot that `pki-tomcatd` is having trouble and discover certificate issues. 5. Issue `ipa-cert-fix`, reboot again, and notice that things are working. Try and create a key in the vault. 6. Attempt to patch the master via `yum upgrade` on the first node. 7. Notice after reboot that everything seems to be ok. Try and create a key in the vault. 8. Notice a few days later that renewal seems to be broken on the first node. At this point `ipa-cert-fix` just shows that everything is fine. If I run it with -v, and then check the "storageCert cert-pki-kra" certificate with `openssl x509 -text -in`, I'm shown: Validity Not Before: Jun 29 00:52:33 2020 GMT Not After : Jun 19 00:52:33 2022 GMT On the second known, `getcert list` shows correct expirations for those certificates: Request ID '20191206005909': status: MONITORING stuck: no key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='storageCert cert-pki-kra',token='NSS Certificate DB',pin set certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='storageCert cert-pki-kra',token='NSS Certificate DB' CA: dogtag-ipa-ca-renew-agent issuer: CN=Certificate Authority,O=MYDOMAIN.ORG subject: CN=KRA Storage Certificate,O=MYDOMAIN.ORG expires: 2022-06-18 20:52:33 EDT key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment eku: id-kp-clientAuth pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "storageCert cert-pki-kra" track: yes auto-renew: yes It seems like _something_, perhaps `ipa-cert-fix` somehow renewed these certificates but...outside of certmonger? Is this some other version of https://bugzilla.redhat.com/show_bug.cgi?id=1788907? The certificates are not in CA_WORKING though, they're in MONITORING. What can I do to get myself out of this state as it seems like I'm in a "this could explode at any moment" situation? This is on Fedora 30 with IP version: Last metadata expiration check: 0:23:05 ago on Sat 04 Jul 2020 07:59:16 PM EDT. Installed Packages Name : certmonger Version : 0.79.9 Release : 1.fc30 Architecture : x86_64 Size : 3.4 M Source : certmonger-0.79.9-1.fc30.src.rpm Repository : @System From repo : updates .. snip .. Name : freeipa-server Version : 4.8.3 Release : 1.fc30 Architecture : x86_64 Size : 1.3 M Source : freeipa-4.8.3-1.fc30.src.rpm Repository : @System From repo : updates .. snip .. Thanks! Ilya Kogan w: github.com/ikogan e: ikogan(a)mythicnet.org <http://twitter.com/ilkogan> <https://www.linkedin.com/in/ilyakogan/>

3 8

Password Policy Question
by White, Daniel E. (GSFC-770.0)[NICS] 09 Jul '20

09 Jul '20

Are there settings in FreeIPA similar to the setting available from the chage command ? I am specifically looking for a setting for the time after a password expires to allow the user to update it. I am looking for the same "grace period" that the non-IPA shell password has. From the change man page: -M, --maxdays MAX_DAYS Set the maximum number of days during which a password is valid. When MAX_DAYS plus LAST_DAY is less than the current day, the user will be required to change his/her password before being able to use his/her account. -I, --inactive INACTIVE Set the number of days of inactivity after a password has expired before the account is locked. The INACTIVE option is the number of days of inactivity. A user whose account is locked must contact the system administrator before being able to use the system again. I find nothing like this in the documentation. I do know, however, that when a user is initially created, the password expire time is set to the current clock time. When the user logs in for the first time, they are prompted to change their password. I am looking for a parameter -- like chage's INACTIVE -- that defines a grace period from the time the password expires until the account is locked and requires admin intervention. Or does that only happen for the account creation ? ______________________________________________________________________________________________ Daniel E. White daniel.e.white(a)nasa.gov<mailto:daniel.e.white@nasa.gov> NICS Linux Engineer NASA Goddard Space Flight Center 8800 Greenbelt Road Building 14, Room E175 Greenbelt, MD 20771 Office: (301) 286-6919 Mobile: (240) 513-5290

3 10

Can't Add Replica: The changelog directory CLDB already exists and is not empty
by Andrey Ptashnik 09 Jul '20

09 Jul '20

Team, I'm trying to install FreeIPA replica and constantly hitting this error below. OS where replica is being installed is a fresh install. IPA version 4.6.6 After this error Master does not have any record of replica anyway. Can someone please shed some light why on the machine with fresh OS install I can see error such "directory [/var/lib/dirsrv/slapd-EXAMPLE-COM/cldb] already exists and is not empty" Command that I'm using from a client machine that is already in the domain: [root@server-02] # kinit admin [root@server-02] # ipa-replica-install --server server-01.example.com --domain example.com --setup-dns --setup-ca --forwarder 10.1xx.1xx.10 ---8<------8<------8<------8<------8<------8<------8<------8<--- [28/42]: ignore time skew for initial replication [29/42]: setting up initial replication [error] DatabaseError: Operations error: The changelog directory [/var/lib/dirsrv/slapd-EXAMPLE-COM/cldb] already exists and is not empty. Please choose a directory that does not exist or is empty. Your system may be partly configured. Run /usr/sbin/ipa-server-install --uninstall to clean up. ---8<------8<------8<------8<------8<------8<------8<------8<--- Regards, Andrey

2 3

Options to deploy FreeIPA without domain delegation
by john doe 08 Jul '20

08 Jul '20

Are there any options to deploy it within an existing domain with the constraints being: - no domain delegation - write access to the applicable zone file prohibited - registering/using an external domain impossible; also no external nameserver access - FreeIPA allowing for no single label domain; hack to override not sensible if multi-forest windows connection where to be necessary in the future - apparently no alternative to DNS as for Kerberos config files?

2 1

Logging of ipa migrate-ds
by Alfred Victor 08 Jul '20

08 Jul '20

Hi FreeIPA, We are testing an IPA deployment and regularly using expect to perform ipa migrate-ds commands to keep the IPA environment refreshed. However, I cannot seem to get any log trail of the migrates...it is proving difficult in expect to capture/log the output, and there appears to be no logfile location option for migrate-ds. What would be the best way to capture the output of the commands? Alfred

2 1

idm ad integration question
by Rob Verduijn 08 Jul '20

08 Jul '20

Hello, I've been working with idm ad integration for some time now. But one thing has always confused me. In all the docs it will tell you to check the dns to see if the dns records resolve. dig +short -t SRV _kerberos._udp.idm.example.com. dig +short -t SRV _ldap._tcp.idm.example.com. dig +short -t TXT _kerberos.idm.example.com. dig +short -t SRV _ldap._tcp.dc._msdcs.ad.example.com. dig +short -t SRV _kerberos._udp.dc._msdcs.ad.example.com. The last one will always fail because by default ms-ad does not generate such a record. However there is always a tcp record. dig +short -t SRV _kerberos._tcp.dc._msdcs.ad.example.com. Can freeipa work with the tcp record as well, or is it vital that you create a udp record for freeipa to work properly? Rob Verduijn

1 0

Adding new replica with CA fails.
by Guillermo Fuentes 07 Jul '20

07 Jul '20

Hi all, I'm having an issue creating a new replica with CA. The Directory Service installation works fine but adding the CA clone fails with a java.lang.NumberFormatException when getting the serial number range. This is the error logged in /var/log/pki/pki-tomcat/ca/debug: ###### ... [20/Jun/2020:15:09:55][localhost-startStop-1]: DBSubsystem: retrieving ou=ca, ou=requests,o=ipaca [20/Jun/2020:15:09:55][localhost-startStop-1]: DBSubsystem: updating nextRange from 80000001 to 90000001 [20/Jun/2020:15:09:55][localhost-startStop-1]: DBSubsystem: adding new range object: cn=80000001,ou=requests, ou=ranges,o=ipaca [20/Jun/2020:15:09:55][localhost-startStop-1]: DBSubsystem: getNextRange Next range has been added: 80000001 - 90000000 [20/Jun/2020:15:09:55][localhost-startStop-1]: Releasing ldap connection [20/Jun/2020:15:09:55][localhost-startStop-1]: returnConn: mNumConns now 3 [20/Jun/2020:15:09:55][localhost-startStop-1]: Repository: next range: 80000001 [20/Jun/2020:15:09:55][localhost-startStop-1]: Repository: Next min serial number: 80000001 [20/Jun/2020:15:09:55][localhost-startStop-1]: DBSubsystem: Setting next min requests number: 80000001 [20/Jun/2020:15:09:55][localhost-startStop-1]: DBSubsystem: Setting next max requests number: 90000000 [20/Jun/2020:15:09:55][localhost-startStop-1]: Checking for a range conflict [20/Jun/2020:15:09:55][localhost-startStop-1]: In LdapBoundConnFactory::getConn() [20/Jun/2020:15:09:55][localhost-startStop-1]: masterConn is connected: true [20/Jun/2020:15:09:55][localhost-startStop-1]: getConn: conn is connected true [20/Jun/2020:15:09:55][localhost-startStop-1]: getConn: mNumConns now 2 [20/Jun/2020:15:09:55][localhost-startStop-1]: Releasing ldap connection [20/Jun/2020:15:09:55][localhost-startStop-1]: returnConn: mNumConns now 3 [20/Jun/2020:15:09:55][localhost-startStop-1]: CMSEngine: checking certificate serial number ranges [20/Jun/2020:15:09:55][localhost-startStop-1]: Repository: Serial numbers left in range: 65536 [20/Jun/2020:15:09:55][localhost-startStop-1]: Repository: Last serial number: 2415656960 [20/Jun/2020:15:09:55][localhost-startStop-1]: Repository: Serial numbers available: 65536 [20/Jun/2020:15:09:55][localhost-startStop-1]: Repository: Low water mark: 33554432 [20/Jun/2020:15:09:55][localhost-startStop-1]: Repository: Requesting next range [20/Jun/2020:15:09:55][localhost-startStop-1]: In LdapBoundConnFactory::getConn() [20/Jun/2020:15:09:55][localhost-startStop-1]: masterConn is connected: true [20/Jun/2020:15:09:55][localhost-startStop-1]: getConn: conn is connected true [20/Jun/2020:15:09:55][localhost-startStop-1]: getConn: mNumConns now 2 [20/Jun/2020:15:09:55][localhost-startStop-1]: DBSubsystem: retrieving ou=certificateRepository, ou=ca,o=ipaca java.lang.NumberFormatException: For input string: "e0000001" at java.lang.NumberFormatException.forInputString(NumberFormatException.java:65) at java.lang.Integer.parseInt(Integer.java:580) at java.math.BigInteger.<init>(BigInteger.java:470) at java.math.BigInteger.<init>(BigInteger.java:606) at com.netscape.cmscore.dbs.DBSubsystem.getNextRange(DBSubsystem.java:417) at com.netscape.cmscore.dbs.Repository.checkRanges(Repository.java:546) at com.netscape.cmscore.apps.CMSEngine.startup(CMSEngine.java:1268) at com.netscape.certsrv.apps.CMS.startup(CMS.java:204) at com.netscape.certsrv.apps.CMS.start(CMS.java:1459) at com.netscape.cms.servlet.base.CMSStartServlet.init(CMSStartServlet.java:117) at javax.servlet.GenericServlet.init(GenericServlet.java:158) at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.lang.reflect.Method.invoke(Method.java:498) at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:288) at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:285) at java.security.AccessController.doPrivileged(Native Method) at javax.security.auth.Subject.doAsPrivileged(Subject.java:549) at org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:320) ... ###### This is logged in /var/log/pki/pki-ca-spawn.20200620150752.log: ###### ... 2020-06-20 15:09:47 pkispawn : INFO ....... executing 'systemctl stop pki-tomcatd(a)pki-tomcat.service' 2020-06-20 15:09:48 pkispawn : INFO ....... removing temp SSL server cert from internal token: Server-Cert cert-pki-ca 2020-06-20 15:09:48 pki.nssdb : DEBUG Command: certutil -D -d /var/lib/pki/pki-tomcat/alias -f /tmp/tmptjRzW6/password.txt -n Server-Cert cert-pki-ca 2020-06-20 15:09:48 pkispawn : INFO ....... importing permanent SSL server cert into internal token: Server-Cert cert-pki-ca 2020-06-20 15:09:48 pki.nssdb : DEBUG Command: certutil -A -d /var/lib/pki/pki-tomcat/alias -f /tmp/tmplJLOg8/internal_password.txt -n Server-Cert cert-pki-ca -a -i /tmp/tmpeCzA_b/sslserver.crt -t ,, 2020-06-20 15:09:48 pkispawn : INFO ....... executing 'systemctl daemon-reload' 2020-06-20 15:09:48 pkispawn : INFO ....... executing 'systemctl start pki-tomcatd(a)pki-tomcat.service' 2020-06-20 15:09:48 pkispawn : INFO ........... FIPS mode is NOT enabled on this operating system. 2020-06-20 15:09:48 pkispawn : DEBUG ........... No connection - server may still be down 2020-06-20 15:09:48 pkispawn : DEBUG ........... No connection - exception thrown: ('Connection aborted.', error(111, 'Connection refused')) 2020-06-20 15:09:49 pkispawn : DEBUG ........... No connection - server may still be down 2020-06-20 15:09:49 pkispawn : DEBUG ........... No connection - exception thrown: ('Connection aborted.', error(111, 'Connection refused')) 2020-06-20 15:09:56 pkispawn : DEBUG ........... No connection - server may still be down 2020-06-20 15:09:56 pkispawn : DEBUG ........... No connection - exception thrown: 500 Server Error: Internal Server Error 2020-06-20 15:09:57 pkispawn : DEBUG ........... No connection - server may still be down 2020-06-20 15:09:57 pkispawn : DEBUG ........... No connection - exception thrown: 500 Server Error: Internal Server Error 2020-06-20 15:09:58 pkispawn : DEBUG ........... No connection - server may still be down ... repeats every second 2020-06-20 15:10:47 pkispawn : DEBUG ........... No connection - exception thrown: 500 Server Error: Internal Server Error 2020-06-20 15:10:48 pkispawn : DEBUG ........... No connection - server may still be down 2020-06-20 15:10:48 pkispawn : DEBUG ........... No connection - exception thrown: 500 Server Error: Internal Server Error 2020-06-20 15:10:49 pkispawn : ERROR ... server failed to restart 2020-06-20 15:10:49 pkispawn : DEBUG ....... Error Type: RuntimeError 2020-06-20 15:10:49 pkispawn : DEBUG ....... Error Message: server failed to restart 2020-06-20 15:10:49 pkispawn : DEBUG ....... File "/usr/sbin/pkispawn", line 534, in main scriptlet.spawn(deployer) File "/usr/lib/python2.7/site-packages/pki/server/deployment/scriptlets/configuration.py", line 1304, in spawn raise RuntimeError("server failed to restart") ###### And here is the failure in /var/log/ipareplica-ca-install.log: ###### ... --------------- Import complete --------------- Imported certificates into /etc/pki/pki-tomcat/alias: Certificate Nickname Trust Attributes SSL,S/MIME,JAR/XPI Third-party RSA CA C,, caSigningCert cert-pki-ca CTu,Cu,Cu subsystemCert cert-pki-ca u,u,u auditSigningCert cert-pki-ca u,u,Pu Third-party Root CA C,, ocspSigningCert cert-pki-ca u,u,u Installation failed: server failed to restart 2020-06-20T15:10:50Z DEBUG stderr=pkispawn : ERROR ... server failed to restart 2020-06-20T15:10:50Z CRITICAL Failed to configure CA instance: Command '/usr/sbin/pkispawn -s CA -f /tmp/tmpcQ1jxM' returned non-zero exit status 1 2020-06-20T15:10:50Z CRITICAL See the installation logs and the following files/directories for more information: 2020-06-20T15:10:50Z CRITICAL /var/log/pki/pki-tomcat 2020-06-20T15:10:50Z DEBUG Traceback (most recent call last): File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 567, in start_creation run_step(full_msg, method) File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 557, in run_step method() File "/usr/lib/python2.7/site-packages/ipaserver/install/cainstance.py", line 675, in __spawn_instance pki_pin) File "/usr/lib/python2.7/site-packages/ipaserver/install/dogtaginstance.py", line 167, in spawn_instance self.handle_setup_error(e) File "/usr/lib/python2.7/site-packages/ipaserver/install/dogtaginstance.py", line 408, in handle_setup_error raise RuntimeError("%s configuration failed." % self.subsystem) RuntimeError: CA configuration failed. 2020-06-20T15:10:50Z DEBUG [error] RuntimeError: CA configuration failed. ... ###### Has anyone run into this? Is this a known bug/issue? Current environment of all replicas: - CentOS 7.8 - FreeIPA 4.6.6 Any help/guidance on fixing this would be really appreciated. Thanks so much, Guillermo

4 6

Plans for integrating DHCP
by Ronald Wimmer 07 Jul '20

07 Jul '20

Hi there, are there any plans to integrate a DHCP server into FreeIPA. We have several environments where a lack of DHCP is a showstopper at the moment. Cheers, Ronald

10 9

Adding Windows 10 client to freeIPA - Error : Failed to parse result: All enctypes provided are unsupported
by lovepreetdeol 07 Jul '20

07 Jul '20

Hi, Running freeIPA server on centos 8.2. Trying to setup mixed OS environment with linux and windows clients. Another centos8.2 machine connects to freeIPA without any problem. I am trying to connect a windows 10 client to the freeIPA and getting the following error : [root@directory ~]# [root@directory ~]# ipa-getkeytab -s directory.compnet.local -p host/win10.compnet.local -e arcfour-hmac -k krb5.keytab.win10 -P New Principal Password: Verify Principal Password: Failed to parse result: All enctypes provided are unsupported Retrying with pre-4.0 keytab retrieval method... Failed to parse result: All enctypes provided are unsupported Failed to get keytab! Failed to get keytab [root@directory ~]# References followed : https://www.rootusers.com/how-to-login-to-windows-with-a-freeipa-account/ https://www.freeipa.org/page/Windows_authentication_against_FreeIPA https://www.server-world.info/en/note?os=CentOS_7&p=ipa&f=8

3 2

Kerberos realm trusting ipa realm
by Gerald Vogt 07 Jul '20

07 Jul '20

Hi! I am trying to get a kerberos realm to trust the ipa realm. I'm running ipa-server-4.6.6-11.el7 on a CentOS 7. It uses realm IPA.EXAMPLE.COM. I have another KDC on another CentOS 7 which has another realm KRB.EXAMPLE.COM with a legacy service connected. Now I would like all users of my IPA realm to use that legacy service. Thus I need the KRB realm to trust the IPA realm. I don't need the IPA realm to trust the KRB realm. For the KRB KDC I have no problem adding the necessary krbtgt/KRB.EXAMPLE.COM(a)IPA.EXAMPLE.COM principal with a password. However, everything I find about adding it to the IPA Kerberos involves kadmin.local which seems not to be supported anymore: kadmin.local: Cannot open DB2 database '/var/kerberos/krb5kdc/principal': No such file or directory while initializing kadmin.local interface How do I add this principal correctly to my IPA kerberos? Is it possible? Thx.

2 3

Providing service level access without granting sudo access
by Saurabh Garg 07 Jul '20

07 Jul '20

Hi All, We have a requirement where we need to give a user access to stop and start a service like tomcat8 without giving sudo access on that machine. I tried adding tomcat8 service (running on an ubuntu host) on the Idm server using "ipa service-add" command. Later, when I tried creating a hbac policy to provide access to a user on that service, it doesn't show up. Is there any other way of providing service level access to a user on Redhat IdM? Please advice. Thanks, Saurabh Garg

2 1

idm user access write issue
by Kannappan M 06 Jul '20

06 Jul '20

Hi All, i have granted a bunch of users to a list of servers but except one server all the user are able to touch the files once they login to 3out of 4 servers , in one server alone am able to switch to user but not able to touch any files getting message as permission denied Regards Kanna

2 3

Re: Last FreeIPA master is failing
by Ricardo Mendes 06 Jul '20

06 Jul '20

Hi all, Came around to post the definite fix for my problem, don't know if it will help anyone since it was all a mess. As mentioned previously: > There's the expected "slapd-DOMAIN-IO" but I also have a "try_ca_renew-slapd-DOMAIN-IO" dir dated from 8 of June that resembles a copy of "slapd-DOMAIN-IO" so I was wondering if between one and other maybe copying some files would work? So I did this, then the error that I got on pki-tomcat/ca/debug was the old message of peer certificate expired. So since I had already reverted to self signed certificates I issued ipa-cert-fix command, failed. [root@main ~]# ipa-cert-fix Failed to get Server-Cert The ipa-cert-fix command failed. Then I tried the 'ipa-cacert-manage renew' command which completed successfully. [root@main ~]# ipa-cacert-manage renew Renewing CA certificate, please wait CA certificate successfully renewed The ipa-cacert-manage command was successful And then all ipa services were able to start correctly (finally able to leave out both the --skip-version-check and --ignore-service-failure): [root@main ~]# ipactl restart IPA version error: data needs to be upgraded (expected version '4.6.6-11.el7.centos', current version '4.6.5-11.el7.centos.4') Automatically running upgrade, for details see /var/log/ipaupgrade.log Be patient, this may take a few minutes. Restarting Directory Service Restarting krb5kdc Service Restarting kadmin Service Restarting named Service Restarting httpd Service Restarting ipa-custodia Service Restarting ntpd Service Restarting pki-tomcatd Service Restarting ipa-otpd Service Restarting ipa-ods-exporter Service Restarting ipa-dnskeysyncd Service ipa: INFO: The ipactl command was successful

1 0

write permission to all users in idm server
by Kannappan M 06 Jul '20

06 Jul '20

Hi All i have problem with Write permission of all the users in a particular server alone server list 10.1.2.3 10.1.2.4 10.1.2.5 10.1.2.6 users list sam kim alias moore In the above users and servers list all the users are able to access all the 2.3,2.4 and 2.5 but non of the users are able to touch any files or folders in 10.1.2.6 but after login to 10.1.2.6 when i give the id sam or id kim or id alias or id moore all the ids are reflecting but non of the users not able to touch the files or folders please guide me to fix the issue. Regards Kanna

1 0

RADIUS proxy in FreeIPA
by Max Muller 04 Jul '20

04 Jul '20

Hi all! I keep trying to tune my FreeIPA server with FreeRADIUS. I deployed the FreeRADIUS for control authentication on VPN-server and I want use FreeIPA as RADIUS proxy (I want control from FreeIPA which users can use VPN). FreeRADIUS and FreeIPA run on one server. I add RADIUS-proxy in FreeIPA, but my RADIUS-server do not get requests from remote client. But test-util "radtest" from this server work fine. What am I doing wrong? Thanks for reply. [root@ipa ~]# ipa radiusproxy-find ----------------------------- 1 RADIUS proxy server matched ----------------------------- RADIUS proxy server name: radius Server: localhost.localdomain ---------------------------- Number of entries returned 1 ----------------------------

2 3

Is it normal to ID overrides not show on IPA Replica with its names?
by Vinícius Ferrão 03 Jul '20

03 Jul '20

Hello, I have two FreeIPA servers with AD trust enabled. Usually I do everything on the IPA #1 server, but I just observed that SIDs aren’t resolved on the replica, is it normal? I’m attaching a picture of the issue to illustrate it. [cid:E1C493F7-5F5F-437D-BF6F-4A33BDAB61FC] If this is not right, someone can help with debugging steps? I observed that I can’t do getent passwd ferrao on the replica either. Only on master: [root@ipa1 ~]# getent passwd ferrao ferrao(a)ad.example.com<mailto:ferrao@ad.example.com>:*:1499401105:1499401105:Vinícius Ferrão:/home/ferrao: [root@ipa2 ~]# getent passwd ferrao Thanks,

2 9

Adding new replica with CA fails.
by Guillermo Fuentes 02 Jul '20

02 Jul '20

Hi all, I'm having an issue creating a new replica with CA. The Directory Service installation works fine but adding the CA clone fails with a java.lang.NumberFormatException when getting the serial number range. This is the error logged in /var/log/pki/pki-tomcat/ca/debug: ###### ... [20/Jun/2020:15:09:55][localhost-startStop-1]: DBSubsystem: retrieving ou=ca, ou=requests,o=ipaca [20/Jun/2020:15:09:55][localhost-startStop-1]: DBSubsystem: updating nextRange from 80000001 to 90000001 [20/Jun/2020:15:09:55][localhost-startStop-1]: DBSubsystem: adding new range object: cn=80000001,ou=requests, ou=ranges,o=ipaca [20/Jun/2020:15:09:55][localhost-startStop-1]: DBSubsystem: getNextRange Next range has been added: 80000001 - 90000000 [20/Jun/2020:15:09:55][localhost-startStop-1]: Releasing ldap connection [20/Jun/2020:15:09:55][localhost-startStop-1]: returnConn: mNumConns now 3 [20/Jun/2020:15:09:55][localhost-startStop-1]: Repository: next range: 80000001 [20/Jun/2020:15:09:55][localhost-startStop-1]: Repository: Next min serial number: 80000001 [20/Jun/2020:15:09:55][localhost-startStop-1]: DBSubsystem: Setting next min requests number: 80000001 [20/Jun/2020:15:09:55][localhost-startStop-1]: DBSubsystem: Setting next max requests number: 90000000 [20/Jun/2020:15:09:55][localhost-startStop-1]: Checking for a range conflict [20/Jun/2020:15:09:55][localhost-startStop-1]: In LdapBoundConnFactory::getConn() [20/Jun/2020:15:09:55][localhost-startStop-1]: masterConn is connected: true [20/Jun/2020:15:09:55][localhost-startStop-1]: getConn: conn is connected true [20/Jun/2020:15:09:55][localhost-startStop-1]: getConn: mNumConns now 2 [20/Jun/2020:15:09:55][localhost-startStop-1]: Releasing ldap connection [20/Jun/2020:15:09:55][localhost-startStop-1]: returnConn: mNumConns now 3 [20/Jun/2020:15:09:55][localhost-startStop-1]: CMSEngine: checking certificate serial number ranges [20/Jun/2020:15:09:55][localhost-startStop-1]: Repository: Serial numbers left in range: 65536 [20/Jun/2020:15:09:55][localhost-startStop-1]: Repository: Last serial number: 2415656960 [20/Jun/2020:15:09:55][localhost-startStop-1]: Repository: Serial numbers available: 65536 [20/Jun/2020:15:09:55][localhost-startStop-1]: Repository: Low water mark: 33554432 [20/Jun/2020:15:09:55][localhost-startStop-1]: Repository: Requesting next range [20/Jun/2020:15:09:55][localhost-startStop-1]: In LdapBoundConnFactory::getConn() [20/Jun/2020:15:09:55][localhost-startStop-1]: masterConn is connected: true [20/Jun/2020:15:09:55][localhost-startStop-1]: getConn: conn is connected true [20/Jun/2020:15:09:55][localhost-startStop-1]: getConn: mNumConns now 2 [20/Jun/2020:15:09:55][localhost-startStop-1]: DBSubsystem: retrieving ou=certificateRepository, ou=ca,o=ipaca java.lang.NumberFormatException: For input string: "e0000001" at java.lang.NumberFormatException.forInputString(NumberFormatException.java:65) at java.lang.Integer.parseInt(Integer.java:580) at java.math.BigInteger.<init>(BigInteger.java:470) at java.math.BigInteger.<init>(BigInteger.java:606) at com.netscape.cmscore.dbs.DBSubsystem.getNextRange(DBSubsystem.java:417) at com.netscape.cmscore.dbs.Repository.checkRanges(Repository.java:546) at com.netscape.cmscore.apps.CMSEngine.startup(CMSEngine.java:1268) at com.netscape.certsrv.apps.CMS.startup(CMS.java:204) at com.netscape.certsrv.apps.CMS.start(CMS.java:1459) at com.netscape.cms.servlet.base.CMSStartServlet.init(CMSStartServlet.java:117) at javax.servlet.GenericServlet.init(GenericServlet.java:158) at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.lang.reflect.Method.invoke(Method.java:498) at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:288) at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:285) at java.security.AccessController.doPrivileged(Native Method) at javax.security.auth.Subject.doAsPrivileged(Subject.java:549) at org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:320) ... ###### This is logged in /var/log/pki/pki-ca-spawn.20200620150752.log: ###### ... 2020-06-20 15:09:47 pkispawn : INFO ....... executing 'systemctl stop pki-tomcatd(a)pki-tomcat.service' 2020-06-20 15:09:48 pkispawn : INFO ....... removing temp SSL server cert from internal token: Server-Cert cert-pki-ca 2020-06-20 15:09:48 pki.nssdb : DEBUG Command: certutil -D -d /var/lib/pki/pki-tomcat/alias -f /tmp/tmptjRzW6/password.txt -n Server-Cert cert-pki-ca 2020-06-20 15:09:48 pkispawn : INFO ....... importing permanent SSL server cert into internal token: Server-Cert cert-pki-ca 2020-06-20 15:09:48 pki.nssdb : DEBUG Command: certutil -A -d /var/lib/pki/pki-tomcat/alias -f /tmp/tmplJLOg8/internal_password.txt -n Server-Cert cert-pki-ca -a -i /tmp/tmpeCzA_b/sslserver.crt -t ,, 2020-06-20 15:09:48 pkispawn : INFO ....... executing 'systemctl daemon-reload' 2020-06-20 15:09:48 pkispawn : INFO ....... executing 'systemctl start pki-tomcatd(a)pki-tomcat.service' 2020-06-20 15:09:48 pkispawn : INFO ........... FIPS mode is NOT enabled on this operating system. 2020-06-20 15:09:48 pkispawn : DEBUG ........... No connection - server may still be down 2020-06-20 15:09:48 pkispawn : DEBUG ........... No connection - exception thrown: ('Connection aborted.', error(111, 'Connection refused')) 2020-06-20 15:09:49 pkispawn : DEBUG ........... No connection - server may still be down 2020-06-20 15:09:49 pkispawn : DEBUG ........... No connection - exception thrown: ('Connection aborted.', error(111, 'Connection refused')) 2020-06-20 15:09:56 pkispawn : DEBUG ........... No connection - server may still be down 2020-06-20 15:09:56 pkispawn : DEBUG ........... No connection - exception thrown: 500 Server Error: Internal Server Error 2020-06-20 15:09:57 pkispawn : DEBUG ........... No connection - server may still be down 2020-06-20 15:09:57 pkispawn : DEBUG ........... No connection - exception thrown: 500 Server Error: Internal Server Error 2020-06-20 15:09:58 pkispawn : DEBUG ........... No connection - server may still be down ... repeats every second 2020-06-20 15:10:47 pkispawn : DEBUG ........... No connection - exception thrown: 500 Server Error: Internal Server Error 2020-06-20 15:10:48 pkispawn : DEBUG ........... No connection - server may still be down 2020-06-20 15:10:48 pkispawn : DEBUG ........... No connection - exception thrown: 500 Server Error: Internal Server Error 2020-06-20 15:10:49 pkispawn : ERROR ... server failed to restart 2020-06-20 15:10:49 pkispawn : DEBUG ....... Error Type: RuntimeError 2020-06-20 15:10:49 pkispawn : DEBUG ....... Error Message: server failed to restart 2020-06-20 15:10:49 pkispawn : DEBUG ....... File "/usr/sbin/pkispawn", line 534, in main scriptlet.spawn(deployer) File "/usr/lib/python2.7/site-packages/pki/server/deployment/scriptlets/configuration.py", line 1304, in spawn raise RuntimeError("server failed to restart") ###### And here is the failure in /var/log/ipareplica-ca-install.log: ###### ... --------------- Import complete --------------- Imported certificates into /etc/pki/pki-tomcat/alias: Certificate Nickname Trust Attributes SSL,S/MIME,JAR/XPI Third-party RSA CA C,, caSigningCert cert-pki-ca CTu,Cu,Cu subsystemCert cert-pki-ca u,u,u auditSigningCert cert-pki-ca u,u,Pu Third-party Root CA C,, ocspSigningCert cert-pki-ca u,u,u Installation failed: server failed to restart 2020-06-20T15:10:50Z DEBUG stderr=pkispawn : ERROR ... server failed to restart 2020-06-20T15:10:50Z CRITICAL Failed to configure CA instance: Command '/usr/sbin/pkispawn -s CA -f /tmp/tmpcQ1jxM' returned non-zero exit status 1 2020-06-20T15:10:50Z CRITICAL See the installation logs and the following files/directories for more information: 2020-06-20T15:10:50Z CRITICAL /var/log/pki/pki-tomcat 2020-06-20T15:10:50Z DEBUG Traceback (most recent call last): File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 567, in start_creation run_step(full_msg, method) File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 557, in run_step method() File "/usr/lib/python2.7/site-packages/ipaserver/install/cainstance.py", line 675, in __spawn_instance pki_pin) File "/usr/lib/python2.7/site-packages/ipaserver/install/dogtaginstance.py", line 167, in spawn_instance self.handle_setup_error(e) File "/usr/lib/python2.7/site-packages/ipaserver/install/dogtaginstance.py", line 408, in handle_setup_error raise RuntimeError("%s configuration failed." % self.subsystem) RuntimeError: CA configuration failed. 2020-06-20T15:10:50Z DEBUG [error] RuntimeError: CA configuration failed. ... ###### Has anyone run into this? Is this a known bug/issue? Current environment of all replicas: - CentOS 7.8 - FreeIPA 4.6.6 Any help/guidance on fixing this would be really appreciated. Thanks so much, Guillermo -- *CONFIDENTIALITY NOTICE:* This e-mail message may contain material protected by the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations and other state and federal laws and legal privileges. This message is only for the personal and confidential use of the individuals or organization to whom the message is addressed. If you are an unintended recipient, you have received this message in error, and any reading, distributing, copying or disclosure is unauthorized and strictly prohibited. All recipients are hereby notified that any unauthorized receipt does not waive any confidentiality obligations or privileges. If you have received this message in error, please notify the sender immediately at the above email address and confirm that you have deleted or destroyed the message.

1 0

User based access control to services?
by Dominik Vogt 02 Jul '20

02 Jul '20

In our setup, a service is running on some server machine, say, "sample/servername.domain" and a client for that service is running on a workstation (using the sample gssapi client and server code from the kerberos sources). Now, what is the proper way to do this in freeipa? 1. Allow users foo and bar to log in to the workstation but to no other machine of the kerberos real. 2. Deny access to sample/servername.domain from any host except from the workstation. 3. Allow user foo access the service. 4. Deny user bar access the service. 5. Deny both users access to anything else on the server. I don't quite understand how that fits into chapter 10/19 or 31 of the "Linux Domain Identity, Authentication, and Policy Guide" for RHEL 7". Chapter 10 deals with access to freeipa internal objects, and chapter 31 describes host based access control. But how is access control done for someuser@clientmachine -> service@servermachine? Ciao Dominik ^_^ ^_^ -- Dominik Vogt

2 2

Re: ipa-server-upgrade failed after yum update on CentOS7
by Florence Blanc-Renaud 01 Jul '20

01 Jul '20

Hi, as you have installed 4.6.5-11, the command ipa-cert-fix is available and should ease fixing the expired certs. The topology looks simple enough (a single master), so no need to worry about which server to fix first. More info available in [1] and in ipa-cert-fix man page. HTH, flo [1] https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/ht… On 7/1/20 6:01 AM, Mariusz Stolarczyk via FreeIPA-users wrote: > The kinit command wouldn't work so it prevented the other commands. One > of my issues is that the IPA server tries to update itself: > > # ipactl start > IPA version error: data needs to be upgraded (expected version > '4.6.6-11.el7.centos', current version '4.6.5-11.el7.centos.4') > Automatically running upgrade, for details see /var/log/ipaupgrade.log > > > This seemed to get me past that: > > # ipactl start --skip-version-check --ignore-service-failure > Skipping version check > Existing service file detected! > Assuming stale, cleaning and proceeding > Starting Directory Service > Starting krb5kdc Service > Starting kadmin Service > Starting named Service > Starting httpd Service > Failed to start httpd Service > Forced start, ignoring httpd Service, continuing normal operation > Starting ipa-custodia Service > Starting ntpd Service > Starting pki-tomcatd Service > Failed to start pki-tomcatd Service > Forced start, ignoring pki-tomcatd Service, continuing normal operation > Starting smb Service > Starting winbind Service > Starting ipa-otpd Service > Starting ipa-dnskeysyncd Service > ipa: INFO: The ipactl command was successful > > > However I found some instructions to rollback the system clock to get > certmonger to renewal the expired certs. Now the httpd.service starts > but not the pki-tomcatd. > > > # ipactl start --skip-version-check --ignore-service-failure > Skipping version check > Existing service file detected! > Assuming stale, cleaning and proceeding > Starting Directory Service > Starting krb5kdc Service > Starting kadmin Service > Starting named Service > Starting httpd Service > Starting ipa-custodia Service > Starting ntpd Service > Starting pki-tomcatd Service > Failed to start pki-tomcatd Service > Forced start, ignoring pki-tomcatd Service, continuing normal operation > Starting smb Service > Starting winbind Service > Starting ipa-otpd Service > Starting ipa-dnskeysyncd Service > ipa: INFO: The ipactl command was successful > > > Now I was able to get the outputs: > > # ipa config-show | grep "CA renewal" > IPA CA renewal master: FAKE-HOST.FAKE-IPA-DOMAIN.lan > > > # ipa server-role-find > ---------------------- > 6 server roles matched > ---------------------- > Server name: FAKE-HOST.FAKE-IPA-DOMAIN.lan > Role name: CA server > Role status: enabled > > Server name: FAKE-HOST.FAKE-IPA-DOMAIN.lan > Role name: DNS server > Role status: enabled > > Server name: FAKE-HOST.FAKE-IPA-DOMAIN.lan > Role name: NTP server > Role status: enabled > > Server name: FAKE-HOST.FAKE-IPA-DOMAIN.lan > Role name: AD trust agent > Role status: enabled > > Server name: FAKE-HOST.FAKE-IPA-DOMAIN.lan > Role name: KRA server > Role status: absent > > Server name: FAKE-HOST.FAKE-IPA-DOMAIN.lan > Role name: AD trust controller > Role status: enabled > ---------------------------- > Number of entries returned 6 > ---------------------------- > > > # getcert list > Number of certificates and requests being tracked: 9. > Request ID '20171108154417': > status: MONITORING > stuck: no > key pair storage: type=FILE,location='/var/kerberos/krb5kdc/kdc.key' > certificate: type=FILE,location='/var/kerberos/krb5kdc/kdc.crt' > CA: SelfSign > issuer: CN=FAKE-HOST.FAKE-IPA-DOMAIN.lan,O=FAKE-IPA-DOMAIN.LAN > subject: CN=FAKE-HOST.FAKE-IPA-DOMAIN.lan,O=FAKE-IPA-DOMAIN.LAN > expires: 2020-09-13 20:50:34 UTC > principal name: krbtgt/FAKE-IPA-DOMAIN.LAN(a)FAKE-IPA-DOMAIN.LAN > certificate template/profile: KDCs_PKINIT_Certs > pre-save command: > post-save command: /usr/libexec/ipa/certmonger/renew_kdc_cert > track: yes > auto-renew: yes > Request ID '20181122014941': > status: MONITORING > stuck: no > key pair storage: > type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert > cert-pki-ca',token='NSS Certificate DB',pin set > certificate: > type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert > cert-pki-ca',token='NSS Certificate DB' > CA: dogtag-ipa-ca-renew-agent > issuer: CN=Certificate Authority,O=FAKE-IPA-DOMAIN.LAN > subject: CN=CA Audit,O=FAKE-IPA-DOMAIN.LAN > expires: 2022-05-18 03:13:17 UTC > key usage: digitalSignature,nonRepudiation > pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad > post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert > "auditSigningCert cert-pki-ca" > track: yes > auto-renew: yes > Request ID '20181122014942': > status: MONITORING > stuck: no > key pair storage: > type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert cert-pki-ca',token='NSS > Certificate DB',pin set > certificate: > type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert cert-pki-ca',token='NSS > Certificate DB' > CA: dogtag-ipa-ca-renew-agent > issuer: CN=Certificate Authority,O=FAKE-IPA-DOMAIN.LAN > subject: CN=OCSP Subsystem,O=FAKE-IPA-DOMAIN.LAN > expires: 2020-06-24 23:56:43 UTC > eku: id-kp-OCSPSigning > pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad > post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert > "ocspSigningCert cert-pki-ca" > track: yes > auto-renew: yes > Request ID '20181122014943': > status: MONITORING > stuck: no > key pair storage: > type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert > cert-pki-ca',token='NSS Certificate DB',pin set > certificate: > type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert > cert-pki-ca',token='NSS Certificate DB' > CA: dogtag-ipa-ca-renew-agent > issuer: CN=Certificate Authority,O=FAKE-IPA-DOMAIN.LAN > subject: CN=CA Subsystem,O=FAKE-IPA-DOMAIN.LAN > expires: 2022-05-18 03:11:57 UTC > key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment > eku: id-kp-serverAuth,id-kp-clientAuth > pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad > post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert > "subsystemCert cert-pki-ca" > track: yes > auto-renew: yes > Request ID '20181122014944': > status: MONITORING > stuck: no > key pair storage: > type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert > cert-pki-ca',token='NSS Certificate DB',pin set > certificate: > type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert > cert-pki-ca',token='NSS Certificate DB' > CA: dogtag-ipa-ca-renew-agent > issuer: CN=Certificate Authority,O=FAKE-IPA-DOMAIN.LAN > subject: CN=Certificate Authority,O=FAKE-IPA-DOMAIN.LAN > expires: 2036-08-12 21:35:52 UTC > key usage: digitalSignature,nonRepudiation,keyCertSign,cRLSign > pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad > post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert > "caSigningCert cert-pki-ca" > track: yes > auto-renew: yes > Request ID '20181122014945': > status: CA_UNREACHABLE > ca-error: Error 60 connecting to > https://FAKE-HOST.FAKE-IPA-DOMAIN.lan:8443/ca/agent/ca/profileReview: > Peer certificate cannot be authenticated with given CA certificates. > stuck: no > key pair storage: type=FILE,location='/var/lib/ipa/ra-agent.key' > certificate: type=FILE,location='/var/lib/ipa/ra-agent.pem' > CA: dogtag-ipa-ca-renew-agent > issuer: CN=Certificate Authority,O=FAKE-IPA-DOMAIN.LAN > subject: CN=IPA RA,O=FAKE-IPA-DOMAIN.LAN > expires: 2020-06-24 23:56:33 UTC > key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment > eku: id-kp-serverAuth,id-kp-clientAuth > pre-save command: /usr/libexec/ipa/certmonger/renew_ra_cert_pre > post-save command: /usr/libexec/ipa/certmonger/renew_ra_cert > track: yes > auto-renew: yes > Request ID '20181122014946': > status: CA_UNREACHABLE > ca-error: Error 60 connecting to > https://FAKE-HOST.FAKE-IPA-DOMAIN.lan:8443/ca/agent/ca/profileReview: > Peer certificate cannot be authenticated with given CA certificates. > stuck: no > key pair storage: > type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert > cert-pki-ca',token='NSS Certificate DB',pin set > certificate: > type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert > cert-pki-ca',token='NSS Certificate DB' > CA: dogtag-ipa-ca-renew-agent > issuer: CN=Certificate Authority,O=FAKE-IPA-DOMAIN.LAN > subject: CN=FAKE-HOST.FAKE-IPA-DOMAIN.lan,O=FAKE-IPA-DOMAIN.LAN > expires: 2020-06-24 23:55:43 UTC > key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment > eku: id-kp-serverAuth,id-kp-clientAuth > pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad > post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert > "Server-Cert cert-pki-ca" > track: yes > auto-renew: yes > Request ID '20181122014947': > status: CA_UNREACHABLE > ca-error: Server at https://FAKE-HOST.FAKE-IPA-DOMAIN.lan/ipa/xml failed > request, will retry: -504 (libcurl failed to execute the HTTP POST > transaction, explaining: Failed connect to > FAKE-HOST.FAKE-IPA-DOMAIN.lan:443; Connection refused). > stuck: no > key pair storage: > type=NSSDB,location='/etc/dirsrv/slapd-FAKE-IPA-DOMAIN-LAN',nickname='Server-Cert',token='NSS > Certificate DB',pinfile='/etc/dirsrv/slapd-FAKE-IPA-DOMAIN-LAN/pwdfile.txt' > certificate: > type=NSSDB,location='/etc/dirsrv/slapd-FAKE-IPA-DOMAIN-LAN',nickname='Server-Cert',token='NSS > Certificate DB' > CA: IPA > issuer: CN=Certificate Authority,O=FAKE-IPA-DOMAIN.LAN > subject: CN=FAKE-HOST.FAKE-IPA-DOMAIN.lan,O=FAKE-IPA-DOMAIN.LAN > expires: 2020-07-17 16:47:45 UTC > principal name: ldap/FAKE-HOST.FAKE-IPA-DOMAIN.lan(a)FAKE-IPA-DOMAIN.LAN > key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment > eku: id-kp-serverAuth,id-kp-clientAuth > pre-save command: > post-save command: /usr/libexec/ipa/certmonger/restart_dirsrv > FAKE-IPA-DOMAIN-LAN > track: yes > auto-renew: yes > Request ID '20181122014948': > status: MONITORING > stuck: no > key pair storage: > type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS > Certificate DB',pinfile='/etc/httpd/alias/pwdfile.txt' > certificate: > type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS > Certificate DB' > CA: IPA > issuer: CN=Certificate Authority,O=FAKE-IPA-DOMAIN.LAN > subject: CN=FAKE-HOST.FAKE-IPA-DOMAIN.lan,O=FAKE-IPA-DOMAIN.LAN > expires: 2022-03-16 22:14:54 UTC > dns: FAKE-HOST.FAKE-IPA-DOMAIN.lan > principal name: HTTP/FAKE-HOST.FAKE-IPA-DOMAIN.lan(a)FAKE-IPA-DOMAIN.LAN > key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment > eku: id-kp-serverAuth,id-kp-clientAuth > pre-save command: > post-save command: /usr/libexec/ipa/certmonger/restart_httpd > track: yes > auto-renew: yes > > > I am also able to restart pki-tomcatd service after two restart attempts: > > > # systemctl restart pki-tomcatd(a)pki-tomcat.service > # ipactl status > Directory Service: RUNNING > krb5kdc Service: RUNNING > kadmin Service: RUNNING > named Service: RUNNING > httpd Service: RUNNING > ipa-custodia Service: RUNNING > ntpd Service: RUNNING > pki-tomcatd Service: STOPPED > smb Service: RUNNING > winbind Service: RUNNING > ipa-otpd Service: RUNNING > ipa-dnskeysyncd Service: RUNNING > ipa: INFO: The ipactl command was successful > > # systemctl restart pki-tomcatd(a)pki-tomcat.service > # ipactl status > Directory Service: RUNNING > krb5kdc Service: RUNNING > kadmin Service: RUNNING > named Service: RUNNING > httpd Service: RUNNING > ipa-custodia Service: RUNNING > ntpd Service: RUNNING > pki-tomcatd Service: RUNNING > smb Service: RUNNING > winbind Service: RUNNING > ipa-otpd Service: RUNNING > ipa-dnskeysyncd Service: RUNNING > ipa: INFO: The ipactl command was successful > > # systemctl status pki-tomcatd(a)pki-tomcat.service > ● pki-tomcatd(a)pki-tomcat.service - PKI Tomcat Server pki-tomcat > Loaded: loaded (/lib/systemd/system/pki-tomcatd@.service; enabled; > vendor preset: disabled) > Active: active (running) since Tue 2020-06-30 20:55:41 PDT; 20s ago > Process: 9567 ExecStop=/usr/libexec/tomcat/server stop (code=exited, > status=0/SUCCESS) > Process: 9612 ExecStartPre=/usr/bin/pkidaemon start %i (code=exited, > status=0/SUCCESS) > Main PID: 9749 (java) > CGroup: > /system.slice/system-pki\x2dtomcatd.slice/pki-tomcatd(a)pki-tomcat.service > └─9749 /usr/lib/jvm/jre-1.8.0-openjdk/bin/java > -DRESTEASY_LIB=/usr/share/java/resteasy-base > -Djava.library.path=/usr/lib64/nuxwdog-jni -classpath > /usr/share/tomcat/bin/bo... > > Jun 30 20:55:56 FAKE-IPA-HOST.FAKE-IPA-DOMAIN.lan server[9749]: Jun 30, > 2020 8:55:56 PM org.apache.catalina.loader.WebappClassLoaderBase > clearReferencesThreads > Jun 30 20:55:56 FAKE-IPA-HOST.FAKE-IPA-DOMAIN.lan server[9749]: SEVERE: > The web application [/ca] appears to have started a thread named > [LDAPConnThread-0 ldaps://FAKE-IPA-HOST.FAKE-IPA-DOMAIN.lan:636] > ...emory leak. > Jun 30 20:55:56 FAKE-IPA-HOST.FAKE-IPA-DOMAIN.lan server[9749]: Jun 30, > 2020 8:55:56 PM org.apache.catalina.loader.WebappClassLoaderBase > clearReferencesThreads > Jun 30 20:55:56 FAKE-IPA-HOST.FAKE-IPA-DOMAIN.lan server[9749]: SEVERE: > The web application [/ca] appears to have started a thread named > [LDAPConnThread-2 ldaps://FAKE-IPA-HOST.FAKE-IPA-DOMAIN.lan:636] > ...emory leak. > Jun 30 20:55:56 FAKE-IPA-HOST.FAKE-IPA-DOMAIN.lan server[9749]: Jun 30, > 2020 8:55:56 PM org.apache.catalina.loader.WebappClassLoaderBase > clearReferencesThreads > Jun 30 20:55:56 FAKE-IPA-HOST.FAKE-IPA-DOMAIN.lan server[9749]: SEVERE: > The web application [/ca] appears to have started a thread named > [authorityMonitor] but has failed to stop it. Thi...emory leak. > Jun 30 20:55:56 FAKE-IPA-HOST.FAKE-IPA-DOMAIN.lan server[9749]: Jun 30, > 2020 8:55:56 PM org.apache.catalina.loader.WebappClassLoaderBase > clearReferencesThreads > Jun 30 20:55:56 FAKE-IPA-HOST.FAKE-IPA-DOMAIN.lan server[9749]: SEVERE: > The web application [/ca] appears to have started a thread named > [LDAPConnThread-3 ldaps://FAKE-IPA-HOST.FAKE-IPA-DOMAIN.lan:636] > ...emory leak. > Jun 30 20:55:56 FAKE-IPA-HOST.FAKE-IPA-DOMAIN.lan server[9749]: Jun 30, > 2020 8:55:56 PM org.apache.catalina.loader.WebappClassLoaderBase > clearReferencesThreads > Jun 30 20:55:56 FAKE-IPA-HOST.FAKE-IPA-DOMAIN.lan server[9749]: SEVERE: > The web application [/ca] appears to have started a thread named > [profileChangeMonitor] but has failed to stop it....emory leak. > Hint: Some lines were ellipsized, use -l to show in full. > > > Not sure what to do next. > > Thanks, > -ms > > ------------------------------------------------------------------------ > *From:* Rob Crittenden <rcritten(a)redhat.com> > *Sent:* Tuesday, June 30, 2020 8:20 PM > *To:* FreeIPA users list <freeipa-users(a)lists.fedorahosted.org>; > Florence Blanc-Renaud <flo(a)redhat.com> > *Cc:* Mariusz Stolarczyk <zeusuofm(a)hotmail.com> > *Subject:* Re: [Freeipa-users] Re: ipa-server-upgrade failed after yum > update on CentOS7 > Mariusz Stolarczyk via FreeIPA-users wrote: >> Thanks for the response. >> >> This is my main IPA server the rest of my small network are just linux >> clients. >> >> >> kinit: Cannot contact any KDC for realm 'FAKE-IPA-DOMAIN.LAN' while >> getting initial credentials > > The other information that Flo requested is needed as well. > > Three of your certificates expired on June 24 and to create a plan to > fix it we need the other info. > > rob > >> >> >> # getcert list >> Number of certificates and requests being tracked: 9. >> Request ID '20171108154417': >> status: MONITORING >> stuck: no >> key pair storage: type=FILE,location='/var/kerberos/krb5kdc/kdc.key' >> certificate: type=FILE,location='/var/kerberos/krb5kdc/kdc.crt' >> CA: SelfSign >> issuer: CN=sol.FAKE-IPA-DOMAIN.LAN,O=FAKE-IPA-DOMAIN.LAN >> subject: CN=sol.FAKE-IPA-DOMAIN.LAN,O=FAKE-IPA-DOMAIN.LAN >> expires: 2020-09-13 20:50:34 UTC >> principal name: krbtgt/FAKE-IPA-DOMAIN.LAN(a)FAKE-IPA-DOMAIN.LAN >> certificate template/profile: KDCs_PKINIT_Certs >> pre-save command: >> post-save command: /usr/libexec/ipa/certmonger/renew_kdc_cert >> track: yes >> auto-renew: yes >> Request ID '20181122014941': >> status: MONITORING >> stuck: no >> key pair storage: >> type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert >> cert-pki-ca',token='NSS Certificate DB',pin set >> certificate: >> type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert >> cert-pki-ca',token='NSS Certificate DB' >> CA: dogtag-ipa-ca-renew-agent >> issuer: CN=Certificate Authority,O=FAKE-IPA-DOMAIN.LAN >> subject: CN=CA Audit,O=FAKE-IPA-DOMAIN.LAN >> expires: 2022-05-18 03:13:17 UTC >> key usage: digitalSignature,nonRepudiation >> pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad >> post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert >> "auditSigningCert cert-pki-ca" >> track: yes >> auto-renew: yes >> Request ID '20181122014942': >> status: CA_UNREACHABLE >> ca-error: Internal error >> stuck: no >> key pair storage: >> type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert cert-pki-ca',token='NSS >> Certificate DB',pin set >> certificate: >> type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert cert-pki-ca',token='NSS >> Certificate DB' >> CA: dogtag-ipa-ca-renew-agent >> issuer: CN=Certificate Authority,O=FAKE-IPA-DOMAIN.LAN >> subject: CN=OCSP Subsystem,O=FAKE-IPA-DOMAIN.LAN >> expires: 2020-06-24 23:56:43 UTC >> eku: id-kp-OCSPSigning >> pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad >> post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert >> "ocspSigningCert cert-pki-ca" >> track: yes >> auto-renew: yes >> Request ID '20181122014943': >> status: MONITORING >> stuck: no >> key pair storage: >> type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert >> cert-pki-ca',token='NSS Certificate DB',pin set >> certificate: >> type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert >> cert-pki-ca',token='NSS Certificate DB' >> CA: dogtag-ipa-ca-renew-agent >> issuer: CN=Certificate Authority,O=FAKE-IPA-DOMAIN.LAN >> subject: CN=CA Subsystem,O=FAKE-IPA-DOMAIN.LAN >> expires: 2022-05-18 03:11:57 UTC >> key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment >> eku: id-kp-serverAuth,id-kp-clientAuth >> pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad >> post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert >> "subsystemCert cert-pki-ca" >> track: yes >> auto-renew: yes >> Request ID '20181122014944': >> status: MONITORING >> stuck: no >> key pair storage: >> type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert >> cert-pki-ca',token='NSS Certificate DB',pin set >> certificate: >> type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert >> cert-pki-ca',token='NSS Certificate DB' >> CA: dogtag-ipa-ca-renew-agent >> issuer: CN=Certificate Authority,O=FAKE-IPA-DOMAIN.LAN >> subject: CN=Certificate Authority,O=FAKE-IPA-DOMAIN.LAN >> expires: 2036-08-12 21:35:52 UTC >> key usage: digitalSignature,nonRepudiation,keyCertSign,cRLSign >> pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad >> post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert >> "caSigningCert cert-pki-ca" >> track: yes >> auto-renew: yes >> Request ID '20181122014945': >> status: CA_UNREACHABLE >> ca-error: Internal error >> stuck: no >> key pair storage: type=FILE,location='/var/lib/ipa/ra-agent.key' >> certificate: type=FILE,location='/var/lib/ipa/ra-agent.pem' >> CA: dogtag-ipa-ca-renew-agent >> issuer: CN=Certificate Authority,O=FAKE-IPA-DOMAIN.LAN >> subject: CN=IPA RA,O=FAKE-IPA-DOMAIN.LAN >> expires: 2020-06-24 23:56:33 UTC >> key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment >> eku: id-kp-serverAuth,id-kp-clientAuth >> pre-save command: /usr/libexec/ipa/certmonger/renew_ra_cert_pre >> post-save command: /usr/libexec/ipa/certmonger/renew_ra_cert >> track: yes >> auto-renew: yes >> Request ID '20181122014946': >> status: CA_UNREACHABLE >> ca-error: Internal error >> stuck: no >> key pair storage: >> type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert >> cert-pki-ca',token='NSS Certificate DB',pin set >> certificate: >> type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert >> cert-pki-ca',token='NSS Certificate DB' >> CA: dogtag-ipa-ca-renew-agent >> issuer: CN=Certificate Authority,O=FAKE-IPA-DOMAIN.LAN >> subject: CN=sol.FAKE-IPA-DOMAIN.LAN,O=FAKE-IPA-DOMAIN.LAN >> expires: 2020-06-24 23:55:43 UTC >> key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment >> eku: id-kp-serverAuth,id-kp-clientAuth >> pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad >> post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert >> "Server-Cert cert-pki-ca" >> track: yes >> auto-renew: yes >> Request ID '20181122014947': >> status: CA_UNREACHABLE >> ca-error: Error setting up ccache for "host" service on client using >> default keytab: Cannot contact any KDC for realm 'FAKE-IPA-DOMAIN.LAN'. >> stuck: no >> key pair storage: >> type=NSSDB,location='/etc/dirsrv/slapd-FAKE-IPA-DOMAIN-LAN',nickname='Server-Cert',token='NSS >> Certificate DB',pinfile='/etc/dirsrv/slapd-FAKE-IPA-DOMAIN-LAN/pwdfile.txt' >> certificate: >> type=NSSDB,location='/etc/dirsrv/slapd-FAKE-IPA-DOMAIN-LAN',nickname='Server-Cert',token='NSS >> Certificate DB' >> CA: IPA >> issuer: CN=Certificate Authority,O=FAKE-IPA-DOMAIN.LAN >> subject: CN=sol.FAKE-IPA-DOMAIN.LAN,O=FAKE-IPA-DOMAIN.LAN >> expires: 2020-07-17 16:47:45 UTC >> principal name: ldap/sol.FAKE-IPA-DOMAIN.LAN(a)FAKE-IPA-DOMAIN.LAN >> key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment >> eku: id-kp-serverAuth,id-kp-clientAuth >> pre-save command: >> post-save command: /usr/libexec/ipa/certmonger/restart_dirsrv >> FAKE-IPA-DOMAIN-LAN >> track: yes >> auto-renew: yes >> Request ID '20181122014948': >> status: MONITORING >> stuck: no >> key pair storage: >> type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS >> Certificate DB',pinfile='/etc/httpd/alias/pwdfile.txt' >> certificate: >> type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS >> Certificate DB' >> CA: IPA >> issuer: CN=Certificate Authority,O=FAKE-IPA-DOMAIN.LAN >> subject: CN=sol.FAKE-IPA-DOMAIN.LAN,O=FAKE-IPA-DOMAIN.LAN >> expires: 2022-03-16 22:14:54 UTC >> dns: sol.FAKE-IPA-DOMAIN.LAN >> principal name: HTTP/sol.FAKE-IPA-DOMAIN.LAN(a)FAKE-IPA-DOMAIN.LAN >> key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment >> eku: id-kp-serverAuth,id-kp-clientAuth >> pre-save command: >> post-save command: /usr/libexec/ipa/certmonger/restart_httpd >> track: yes >> auto-renew: yes >> >> >> What can I do next? >> >> Thanks, >> -ms >> >> >> >> ------------------------------------------------------------------------ >> *From:* Florence Blanc-Renaud <flo(a)redhat.com> >> *Sent:* Tuesday, June 30, 2020 1:45 AM >> *To:* FreeIPA users list <freeipa-users(a)lists.fedorahosted.org> >> *Cc:* Mariusz Stolarczyk <zeusuofm(a)hotmail.com> >> *Subject:* Re: [Freeipa-users] ipa-server-upgrade failed after yum >> update on CentOS7 >> >> On 6/30/20 10:24 AM, Mariusz Stolarczyk via FreeIPA-users wrote: >>> All, >>> >>> I did a routine server updates last night on my IPA server. After the >>> reboot I first noticed the DNS was not resolving and the ipa.service >>> failed. The ipa.service failed to start so I ran the following: >>> >>> >>> # ipactl start >>> IPA version error: data needs to be upgraded (expected version >>> '4.6.6-11.el7.centos', current version '4.6.5-11.el7.centos.4') >>> Automatically running upgrade, for details see /var/log/ipaupgrade.log >>> Be patient, this may take a few minutes. >>> Automatic upgrade failed: Update complete >>> Upgrading the configuration of the IPA services >>> [Verifying that root certificate is published] >>> [Migrate CRL publish directory] >>> CRL tree already moved >>> [Verifying that CA proxy configuration is correct] >>> [Verifying that KDC configuration is using ipa-kdb backend] >>> [Fix DS schema file syntax] >>> Syntax already fixed >>> [Removing RA cert from DS NSS database] >>> RA cert already removed >>> [Enable sidgen and extdom plugins by default] >>> [Updating HTTPD service IPA configuration] >>> [Updating HTTPD service IPA WSGI configuration] >>> Nothing to do for configure_httpd_wsgi_conf >>> [Updating mod_nss protocol versions] >>> Protocol versions already updated >>> [Updating mod_nss cipher suite] >>> [Updating mod_nss enabling OCSP] >>> [Fixing trust flags in /etc/httpd/alias] >>> Trust flags already processed >>> [Moving HTTPD service keytab to gssproxy] >>> [Removing self-signed CA] >>> [Removing Dogtag 9 CA] >>> [Checking for deprecated KDC configuration files] >>> [Checking for deprecated backups of Samba configuration files] >>> [Remove FILE: prefix from 'dedicated keytab file' in Samba configuration] >>> [Update 'max smbd processes' in Samba configuration to prevent unlimited >>> SMBLoris attack amplification] >>> [Add missing CA DNS records] >>> IPA CA DNS records already processed >>> [Removing deprecated DNS configuration options] >>> [Ensuring minimal number of connections] >>> [Updating GSSAPI configuration in DNS] >>> [Updating pid-file configuration in DNS] >>> [Checking global forwarding policy in named.conf to avoid conflicts with >>> automatic empty zones] >>> Changes to named.conf have been made, restart named >>> [Upgrading CA schema] >>> CA schema update complete (no changes) >>> [Verifying that CA audit signing cert has 2 year validity] >>> [Update certmonger certificate renewal configuration] >>> Certmonger certificate renewal configuration already up-to-date >>> [Enable PKIX certificate path discovery and validation] >>> PKIX already enabled >>> [Authorizing RA Agent to modify profiles] >>> [Authorizing RA Agent to manage lightweight CAs] >>> [Ensuring Lightweight CAs container exists in Dogtag database] >>> [Adding default OCSP URI configuration] >>> [Ensuring CA is using LDAPProfileSubsystem] >>> [Migrating certificate profiles to LDAP] >>> IPA server upgrade failed: Inspect /var/log/ipaupgrade.log and run >>> command ipa-server-upgrade manually. >>> Unexpected error - see /var/log/ipaupgrade.log for details: >>> NetworkError: cannot connect to >>> 'https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Ffake-ipa-…': >> >>> [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:618) >>> The ipa-server-upgrade command failed. See /var/log/ipaupgrade.log for >>> more information >>> >>> See the upgrade log for more details and/or run >>> /usr/sbin/ipa-server-upgrade again >>> Aborting ipactl >>> >>> >>> The end of the /var/log/ipaupgrade.log file: >>> >>> 2020-06-29T22:43:38Z DEBUG stderr= >>> 2020-06-29T22:43:38Z DEBUG Loading Index file from >>> '/var/lib/ipa/sysrestore/sysrestore.index' >>> 2020-06-29T22:43:38Z DEBUG Starting external process >>> 2020-06-29T22:43:38Z DEBUG args=/usr/bin/certutil -d >>> dbm:/etc/pki/pki-tomcat/alias -L -f /etc/pki/pki-tomcat/alias/pwdfile.txt >>> 2020-06-29T22:43:38Z DEBUG Process finished, return code=0 >>> 2020-06-29T22:43:38Z DEBUG stdout= >>> Certificate Nickname Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Trust >>> Attributes >>> >>> Â SSL,S/MIME,JAR/XPI >>> >>> caSigningCert cert-pki-ca Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â CTu,Cu,Cu >>> subsystemCert cert-pki-ca Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â u,u,u >>> Server-Cert cert-pki-ca Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â u,u,u >>> ocspSigningCert cert-pki-ca Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â u,u,u >>> auditSigningCert cert-pki-ca Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â u,u,Pu >>> >>> 2020-06-29T22:43:38Z DEBUG stderr= >>> 2020-06-29T22:43:38Z INFO Certmonger certificate renewal configuration >>> already up-to-date >>> 2020-06-29T22:43:38Z INFO [Enable PKIX certificate path discovery and >>> validation] >>> 2020-06-29T22:43:38Z DEBUG Loading StateFile from >>> '/var/lib/ipa/sysupgrade/sysupgrade.state' >>> 2020-06-29T22:43:38Z INFO PKIX already enabled >>> 2020-06-29T22:43:38Z INFO [Authorizing RA Agent to modify profiles] >>> 2020-06-29T22:43:38Z INFO [Authorizing RA Agent to manage lightweight CAs] >>> 2020-06-29T22:43:38Z INFO [Ensuring Lightweight CAs container exists in >>> Dogtag database] >>> 2020-06-29T22:43:38Z DEBUG Created connection context.ldap2_140346851657552 >>> 2020-06-29T22:43:38Z DEBUG flushing >>> ldapi://%2fvar%2frun%2fslapd-FAKE-IPA-DOMAIN-LAN.socket from SchemaCache >>> 2020-06-29T22:43:38Z DEBUG retrieving schema for SchemaCache >>> url=ldapi://%2fvar%2frun%2fslapd-FAKE-IPA-DOMAIN-LAN.socket >>> conn=<ldap.ldapobject.SimpleLDAPObject instance at 0x7fa50c3e8e60> >>> 2020-06-29T22:43:39Z DEBUG Destroyed connection >>> context.ldap2_140346851657552 >>> 2020-06-29T22:43:39Z INFO [Adding default OCSP URI configuration] >>> 2020-06-29T22:43:39Z INFO [Ensuring CA is using LDAPProfileSubsystem] >>> 2020-06-29T22:43:39Z INFO [Migrating certificate profiles to LDAP] >>> 2020-06-29T22:43:39Z DEBUG Created connection context.ldap2_140346825804304 >>> 2020-06-29T22:43:39Z DEBUG flushing >>> ldapi://%2fvar%2frun%2fslapd-FAKE-IPA-DOMAIN-LAN.socket from SchemaCache >>> 2020-06-29T22:43:39Z DEBUG retrieving schema for SchemaCache >>> url=ldapi://%2fvar%2frun%2fslapd-FAKE-IPA-DOMAIN-LAN.socket >>> conn=<ldap.ldapobject.SimpleLDAPObject instance at 0x7fa50ac19b90> >>> 2020-06-29T22:43:39Z DEBUG Destroyed connection >>> context.ldap2_140346825804304 >>> 2020-06-29T22:43:39Z DEBUG request GET >>> https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Ffake-ipa-… >>> 2020-06-29T22:43:39Z DEBUG request body '' >>> 2020-06-29T22:43:39Z DEBUG httplib request failed: >>> Traceback (most recent call last): >>> Â File "/usr/lib/python2.7/site-packages/ipapython/dogtag.py", line >>> 220, in _httplib_request >>> Â Â conn.request(method, path, body=request_body, headers=headers) >>> Â File "/usr/lib64/python2.7/httplib.py", line 1056, in request >>> Â Â self._send_request(method, url, body, headers) >>> Â File "/usr/lib64/python2.7/httplib.py", line 1090, in _send_request >>> Â Â self.endheaders(body) >>> Â File "/usr/lib64/python2.7/httplib.py", line 1052, in endheaders >>> Â Â self._send_output(message_body) >>> Â File "/usr/lib64/python2.7/httplib.py", line 890, in _send_output >>> Â Â self.send(msg) >>> Â File "/usr/lib64/python2.7/httplib.py", line 852, in send >>> Â Â self.connect() >>> Â File "/usr/lib64/python2.7/httplib.py", line 1275, in connect >>> Â Â server_hostname=sni_hostname) >>> Â File "/usr/lib64/python2.7/ssl.py", line 348, in wrap_socket >>> Â Â _context=self) >>> Â File "/usr/lib64/python2.7/ssl.py", line 609, in __init__ >>> Â Â self.do_handshake() >>> Â File "/usr/lib64/python2.7/ssl.py", line 831, in do_handshake >>> Â Â self._sslobj.do_handshake() >>> SSLError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed >>> (_ssl.c:618) >>> 2020-06-29T22:43:39Z ERROR IPA server upgrade failed: Inspect >>> /var/log/ipaupgrade.log and run command ipa-server-upgrade manually. >>> 2020-06-29T22:43:39Z DEBUG Â File >>> "/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 178, in >>> execute >>> Â Â return_value = self.run() >>> Â File >>> "/usr/lib/python2.7/site-packages/ipaserver/install/ipa_server_upgrade.py", >>> line 54, in run >>> Â Â server.upgrade() >>> Â File >>> "/usr/lib/python2.7/site-packages/ipaserver/install/server/upgrade.py", >>> line 2166, in upgrade >>> Â Â upgrade_configuration() >>> Â File >>> "/usr/lib/python2.7/site-packages/ipaserver/install/server/upgrade.py", >>> line 2038, in upgrade_configuration >>> Â Â ca_enable_ldap_profile_subsystem(ca) >>> Â File >>> "/usr/lib/python2.7/site-packages/ipaserver/install/server/upgrade.py", >>> line 425, in ca_enable_ldap_profile_subsystem >>> Â Â cainstance.migrate_profiles_to_ldap() >>> Â File >>> "/usr/lib/python2.7/site-packages/ipaserver/install/cainstance.py", line >>> 2027, in migrate_profiles_to_ldap >>> Â Â _create_dogtag_profile(profile_id, profile_data, overwrite=False) >>> Â File >>> "/usr/lib/python2.7/site-packages/ipaserver/install/cainstance.py", line >>> 2033, in _create_dogtag_profile >>> Â Â with api.Backend.ra_certprofile as profile_api: >>> Â File "/usr/lib/python2.7/site-packages/ipaserver/plugins/dogtag.py", >>> line 1311, in __enter__ >>> Â Â method='GET' >>> Â File "/usr/lib/python2.7/site-packages/ipapython/dogtag.py", line >>> 167, in https_request >>> Â Â method=method, headers=headers) >>> Â File "/usr/lib/python2.7/site-packages/ipapython/dogtag.py", line >>> 229, in _httplib_request >>> Â �� raise NetworkError(uri=uri, error=str(e)) >>> >>> 2020-06-29T22:43:39Z DEBUG The ipa-server-upgrade command failed, >>> exception: NetworkError: cannot connect to >>> 'https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Ffake-ipa-…': >> >>> [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:618) >>> 2020-06-29T22:43:39Z ERROR Unexpected error - see >>> /var/log/ipaupgrade.log for details: >>> NetworkError: cannot connect to >>> 'https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Ffake-ipa-…': >> >>> [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:618) >>> 2020-06-29T22:43:39Z ERROR The ipa-server-upgrade command failed. See >>> /var/log/ipaupgrade.log for more information >>> >>> >>> What should be my next debug steps? >>> >> Hi, >> >> I would check whether any certificate expired: >> $ getcert list >> >> Look specifically for the "status: " and "expires: " labels. If some >> certs have expired, you will need to find the CA renewal master and fix >> this host first. To find the CA renewal master: >> $ kinit admin >> $ ipa config-show | grep "CA renewal" >> >> If you need help, please mention: >> - the output of "ipa server-role-find" >> - the output of "getcert list" on all the server nodes >> - are the httpd and ldap server certificates issued by IPA CA or by an >> external Certificate Authority? >> >> HTH, >> flo >> >>> Thanks in advance, >>> -ms >>> >>> >>> _______________________________________________ >>> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org >>> To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org >>> Fedora Code of Conduct: https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdocs.fedo… >>> List Guidelines: https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Ffedorapro… >>> List Archives: https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.fed… >>> >> >> >> _______________________________________________ >> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org >> To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org >> Fedora Code of Conduct: https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdocs.fedo… >> List Guidelines: https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Ffedorapro… >> List Archives: https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.fed… >> > > > _______________________________________________ > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org > To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org > Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost… >

2 1

Change password hash for LDAP
by Max Muller 01 Jul '20

01 Jul '20

Hi all! I want use FreeIPA with FreeRADIUS. As I can know, FreeIPA use PBKDF2_SHA256 hashes. But actual FreeRADIUS not support PBKDF2_SHA256 hashes. Is there way to change hash in FreeIPA? About FreeRADIUS and PBKDF2_SHA256 https://github.com/FreeRADIUS/freeradius-server/issues/2649

2 2

Groups and Permissions
by Mark Potter 01 Jul '20

01 Jul '20

I have noticed that group membership is functioning differently on CentOS 8 with FreeIPA 4.8.4-7 than I remember it functioning on CentOS 7. This is a clean install with no use of backups. I have a user user(2063) with a primary group of admingroup(2060). I set up a sudo rule for members of admingroup(2060) and still could not sudo. The user does not show up in admingroup(2060) as a member and could not use sudo until I added the user to the group. I do not remember this being the case when we were using CentOS 7 and the available packages. I have also seen this when creating a service use to set up crons to keep the new FreeIPA installation in sync with the OpenLDAP installation we are replacing. No users show as members of the group assigned as the user's GID. My memory could be incorrect but I do not remember having to add members to groups that had a primary GID of said group in order for sudo rules or ipa commands to work (after kinit of course). If this is by design then I will need to write something really quick to get members added to their primary groups or if it's a setting I haven't been able to find it. I would appreciate any help. -- *Mark Potter* Senior Linux Administrator DownUnder GeoSolutions

1 0

Re: ipa-server-upgrade failed after yum update on CentOS7
by Rob Crittenden 30 Jun '20

30 Jun '20

Mariusz Stolarczyk via FreeIPA-users wrote: > Thanks for the response. > > This is my main IPA server the rest of my small network are just linux > clients. > > > kinit: Cannot contact any KDC for realm 'FAKE-IPA-DOMAIN.LAN' while > getting initial credentials The other information that Flo requested is needed as well. Three of your certificates expired on June 24 and to create a plan to fix it we need the other info. rob > > > # getcert list > Number of certificates and requests being tracked: 9. > Request ID '20171108154417': > status: MONITORING > stuck: no > key pair storage: type=FILE,location='/var/kerberos/krb5kdc/kdc.key' > certificate: type=FILE,location='/var/kerberos/krb5kdc/kdc.crt' > CA: SelfSign > issuer: CN=sol.FAKE-IPA-DOMAIN.LAN,O=FAKE-IPA-DOMAIN.LAN > subject: CN=sol.FAKE-IPA-DOMAIN.LAN,O=FAKE-IPA-DOMAIN.LAN > expires: 2020-09-13 20:50:34 UTC > principal name: krbtgt/FAKE-IPA-DOMAIN.LAN(a)FAKE-IPA-DOMAIN.LAN > certificate template/profile: KDCs_PKINIT_Certs > pre-save command: > post-save command: /usr/libexec/ipa/certmonger/renew_kdc_cert > track: yes > auto-renew: yes > Request ID '20181122014941': > status: MONITORING > stuck: no > key pair storage: > type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert > cert-pki-ca',token='NSS Certificate DB',pin set > certificate: > type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert > cert-pki-ca',token='NSS Certificate DB' > CA: dogtag-ipa-ca-renew-agent > issuer: CN=Certificate Authority,O=FAKE-IPA-DOMAIN.LAN > subject: CN=CA Audit,O=FAKE-IPA-DOMAIN.LAN > expires: 2022-05-18 03:13:17 UTC > key usage: digitalSignature,nonRepudiation > pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad > post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert > "auditSigningCert cert-pki-ca" > track: yes > auto-renew: yes > Request ID '20181122014942': > status: CA_UNREACHABLE > ca-error: Internal error > stuck: no > key pair storage: > type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert cert-pki-ca',token='NSS > Certificate DB',pin set > certificate: > type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert cert-pki-ca',token='NSS > Certificate DB' > CA: dogtag-ipa-ca-renew-agent > issuer: CN=Certificate Authority,O=FAKE-IPA-DOMAIN.LAN > subject: CN=OCSP Subsystem,O=FAKE-IPA-DOMAIN.LAN > expires: 2020-06-24 23:56:43 UTC > eku: id-kp-OCSPSigning > pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad > post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert > "ocspSigningCert cert-pki-ca" > track: yes > auto-renew: yes > Request ID '20181122014943': > status: MONITORING > stuck: no > key pair storage: > type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert > cert-pki-ca',token='NSS Certificate DB',pin set > certificate: > type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert > cert-pki-ca',token='NSS Certificate DB' > CA: dogtag-ipa-ca-renew-agent > issuer: CN=Certificate Authority,O=FAKE-IPA-DOMAIN.LAN > subject: CN=CA Subsystem,O=FAKE-IPA-DOMAIN.LAN > expires: 2022-05-18 03:11:57 UTC > key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment > eku: id-kp-serverAuth,id-kp-clientAuth > pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad > post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert > "subsystemCert cert-pki-ca" > track: yes > auto-renew: yes > Request ID '20181122014944': > status: MONITORING > stuck: no > key pair storage: > type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert > cert-pki-ca',token='NSS Certificate DB',pin set > certificate: > type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert > cert-pki-ca',token='NSS Certificate DB' > CA: dogtag-ipa-ca-renew-agent > issuer: CN=Certificate Authority,O=FAKE-IPA-DOMAIN.LAN > subject: CN=Certificate Authority,O=FAKE-IPA-DOMAIN.LAN > expires: 2036-08-12 21:35:52 UTC > key usage: digitalSignature,nonRepudiation,keyCertSign,cRLSign > pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad > post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert > "caSigningCert cert-pki-ca" > track: yes > auto-renew: yes > Request ID '20181122014945': > status: CA_UNREACHABLE > ca-error: Internal error > stuck: no > key pair storage: type=FILE,location='/var/lib/ipa/ra-agent.key' > certificate: type=FILE,location='/var/lib/ipa/ra-agent.pem' > CA: dogtag-ipa-ca-renew-agent > issuer: CN=Certificate Authority,O=FAKE-IPA-DOMAIN.LAN > subject: CN=IPA RA,O=FAKE-IPA-DOMAIN.LAN > expires: 2020-06-24 23:56:33 UTC > key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment > eku: id-kp-serverAuth,id-kp-clientAuth > pre-save command: /usr/libexec/ipa/certmonger/renew_ra_cert_pre > post-save command: /usr/libexec/ipa/certmonger/renew_ra_cert > track: yes > auto-renew: yes > Request ID '20181122014946': > status: CA_UNREACHABLE > ca-error: Internal error > stuck: no > key pair storage: > type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert > cert-pki-ca',token='NSS Certificate DB',pin set > certificate: > type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert > cert-pki-ca',token='NSS Certificate DB' > CA: dogtag-ipa-ca-renew-agent > issuer: CN=Certificate Authority,O=FAKE-IPA-DOMAIN.LAN > subject: CN=sol.FAKE-IPA-DOMAIN.LAN,O=FAKE-IPA-DOMAIN.LAN > expires: 2020-06-24 23:55:43 UTC > key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment > eku: id-kp-serverAuth,id-kp-clientAuth > pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad > post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert > "Server-Cert cert-pki-ca" > track: yes > auto-renew: yes > Request ID '20181122014947': > status: CA_UNREACHABLE > ca-error: Error setting up ccache for "host" service on client using > default keytab: Cannot contact any KDC for realm 'FAKE-IPA-DOMAIN.LAN'. > stuck: no > key pair storage: > type=NSSDB,location='/etc/dirsrv/slapd-FAKE-IPA-DOMAIN-LAN',nickname='Server-Cert',token='NSS > Certificate DB',pinfile='/etc/dirsrv/slapd-FAKE-IPA-DOMAIN-LAN/pwdfile.txt' > certificate: > type=NSSDB,location='/etc/dirsrv/slapd-FAKE-IPA-DOMAIN-LAN',nickname='Server-Cert',token='NSS > Certificate DB' > CA: IPA > issuer: CN=Certificate Authority,O=FAKE-IPA-DOMAIN.LAN > subject: CN=sol.FAKE-IPA-DOMAIN.LAN,O=FAKE-IPA-DOMAIN.LAN > expires: 2020-07-17 16:47:45 UTC > principal name: ldap/sol.FAKE-IPA-DOMAIN.LAN(a)FAKE-IPA-DOMAIN.LAN > key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment > eku: id-kp-serverAuth,id-kp-clientAuth > pre-save command: > post-save command: /usr/libexec/ipa/certmonger/restart_dirsrv > FAKE-IPA-DOMAIN-LAN > track: yes > auto-renew: yes > Request ID '20181122014948': > status: MONITORING > stuck: no > key pair storage: > type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS > Certificate DB',pinfile='/etc/httpd/alias/pwdfile.txt' > certificate: > type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS > Certificate DB' > CA: IPA > issuer: CN=Certificate Authority,O=FAKE-IPA-DOMAIN.LAN > subject: CN=sol.FAKE-IPA-DOMAIN.LAN,O=FAKE-IPA-DOMAIN.LAN > expires: 2022-03-16 22:14:54 UTC > dns: sol.FAKE-IPA-DOMAIN.LAN > principal name: HTTP/sol.FAKE-IPA-DOMAIN.LAN(a)FAKE-IPA-DOMAIN.LAN > key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment > eku: id-kp-serverAuth,id-kp-clientAuth > pre-save command: > post-save command: /usr/libexec/ipa/certmonger/restart_httpd > track: yes > auto-renew: yes > > > What can I do next? > > Thanks, > -ms > > > > ------------------------------------------------------------------------ > *From:* Florence Blanc-Renaud <flo(a)redhat.com> > *Sent:* Tuesday, June 30, 2020 1:45 AM > *To:* FreeIPA users list <freeipa-users(a)lists.fedorahosted.org> > *Cc:* Mariusz Stolarczyk <zeusuofm(a)hotmail.com> > *Subject:* Re: [Freeipa-users] ipa-server-upgrade failed after yum > update on CentOS7 > > On 6/30/20 10:24 AM, Mariusz Stolarczyk via FreeIPA-users wrote: >> All, >> >> I did a routine server updates last night on my IPA server. After the >> reboot I first noticed the DNS was not resolving and the ipa.service >> failed. The ipa.service failed to start so I ran the following: >> >> >> # ipactl start >> IPA version error: data needs to be upgraded (expected version >> '4.6.6-11.el7.centos', current version '4.6.5-11.el7.centos.4') >> Automatically running upgrade, for details see /var/log/ipaupgrade.log >> Be patient, this may take a few minutes. >> Automatic upgrade failed: Update complete >> Upgrading the configuration of the IPA services >> [Verifying that root certificate is published] >> [Migrate CRL publish directory] >> CRL tree already moved >> [Verifying that CA proxy configuration is correct] >> [Verifying that KDC configuration is using ipa-kdb backend] >> [Fix DS schema file syntax] >> Syntax already fixed >> [Removing RA cert from DS NSS database] >> RA cert already removed >> [Enable sidgen and extdom plugins by default] >> [Updating HTTPD service IPA configuration] >> [Updating HTTPD service IPA WSGI configuration] >> Nothing to do for configure_httpd_wsgi_conf >> [Updating mod_nss protocol versions] >> Protocol versions already updated >> [Updating mod_nss cipher suite] >> [Updating mod_nss enabling OCSP] >> [Fixing trust flags in /etc/httpd/alias] >> Trust flags already processed >> [Moving HTTPD service keytab to gssproxy] >> [Removing self-signed CA] >> [Removing Dogtag 9 CA] >> [Checking for deprecated KDC configuration files] >> [Checking for deprecated backups of Samba configuration files] >> [Remove FILE: prefix from 'dedicated keytab file' in Samba configuration] >> [Update 'max smbd processes' in Samba configuration to prevent unlimited >> SMBLoris attack amplification] >> [Add missing CA DNS records] >> IPA CA DNS records already processed >> [Removing deprecated DNS configuration options] >> [Ensuring minimal number of connections] >> [Updating GSSAPI configuration in DNS] >> [Updating pid-file configuration in DNS] >> [Checking global forwarding policy in named.conf to avoid conflicts with >> automatic empty zones] >> Changes to named.conf have been made, restart named >> [Upgrading CA schema] >> CA schema update complete (no changes) >> [Verifying that CA audit signing cert has 2 year validity] >> [Update certmonger certificate renewal configuration] >> Certmonger certificate renewal configuration already up-to-date >> [Enable PKIX certificate path discovery and validation] >> PKIX already enabled >> [Authorizing RA Agent to modify profiles] >> [Authorizing RA Agent to manage lightweight CAs] >> [Ensuring Lightweight CAs container exists in Dogtag database] >> [Adding default OCSP URI configuration] >> [Ensuring CA is using LDAPProfileSubsystem] >> [Migrating certificate profiles to LDAP] >> IPA server upgrade failed: Inspect /var/log/ipaupgrade.log and run >> command ipa-server-upgrade manually. >> Unexpected error - see /var/log/ipaupgrade.log for details: >> NetworkError: cannot connect to >> 'https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Ffake-ipa-…': > >> [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:618) >> The ipa-server-upgrade command failed. See /var/log/ipaupgrade.log for >> more information >> >> See the upgrade log for more details and/or run >> /usr/sbin/ipa-server-upgrade again >> Aborting ipactl >> >> >> The end of the /var/log/ipaupgrade.log file: >> >> 2020-06-29T22:43:38Z DEBUG stderr= >> 2020-06-29T22:43:38Z DEBUG Loading Index file from >> '/var/lib/ipa/sysrestore/sysrestore.index' >> 2020-06-29T22:43:38Z DEBUG Starting external process >> 2020-06-29T22:43:38Z DEBUG args=/usr/bin/certutil -d >> dbm:/etc/pki/pki-tomcat/alias -L -f /etc/pki/pki-tomcat/alias/pwdfile.txt >> 2020-06-29T22:43:38Z DEBUG Process finished, return code=0 >> 2020-06-29T22:43:38Z DEBUG stdout= >> Certificate Nickname Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Trust >> Attributes >> >> Â SSL,S/MIME,JAR/XPI >> >> caSigningCert cert-pki-ca Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â CTu,Cu,Cu >> subsystemCert cert-pki-ca Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â u,u,u >> Server-Cert cert-pki-ca Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â u,u,u >> ocspSigningCert cert-pki-ca Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â u,u,u >> auditSigningCert cert-pki-ca Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â u,u,Pu >> >> 2020-06-29T22:43:38Z DEBUG stderr= >> 2020-06-29T22:43:38Z INFO Certmonger certificate renewal configuration >> already up-to-date >> 2020-06-29T22:43:38Z INFO [Enable PKIX certificate path discovery and >> validation] >> 2020-06-29T22:43:38Z DEBUG Loading StateFile from >> '/var/lib/ipa/sysupgrade/sysupgrade.state' >> 2020-06-29T22:43:38Z INFO PKIX already enabled >> 2020-06-29T22:43:38Z INFO [Authorizing RA Agent to modify profiles] >> 2020-06-29T22:43:38Z INFO [Authorizing RA Agent to manage lightweight CAs] >> 2020-06-29T22:43:38Z INFO [Ensuring Lightweight CAs container exists in >> Dogtag database] >> 2020-06-29T22:43:38Z DEBUG Created connection context.ldap2_140346851657552 >> 2020-06-29T22:43:38Z DEBUG flushing >> ldapi://%2fvar%2frun%2fslapd-FAKE-IPA-DOMAIN-LAN.socket from SchemaCache >> 2020-06-29T22:43:38Z DEBUG retrieving schema for SchemaCache >> url=ldapi://%2fvar%2frun%2fslapd-FAKE-IPA-DOMAIN-LAN.socket >> conn=<ldap.ldapobject.SimpleLDAPObject instance at 0x7fa50c3e8e60> >> 2020-06-29T22:43:39Z DEBUG Destroyed connection >> context.ldap2_140346851657552 >> 2020-06-29T22:43:39Z INFO [Adding default OCSP URI configuration] >> 2020-06-29T22:43:39Z INFO [Ensuring CA is using LDAPProfileSubsystem] >> 2020-06-29T22:43:39Z INFO [Migrating certificate profiles to LDAP] >> 2020-06-29T22:43:39Z DEBUG Created connection context.ldap2_140346825804304 >> 2020-06-29T22:43:39Z DEBUG flushing >> ldapi://%2fvar%2frun%2fslapd-FAKE-IPA-DOMAIN-LAN.socket from SchemaCache >> 2020-06-29T22:43:39Z DEBUG retrieving schema for SchemaCache >> url=ldapi://%2fvar%2frun%2fslapd-FAKE-IPA-DOMAIN-LAN.socket >> conn=<ldap.ldapobject.SimpleLDAPObject instance at 0x7fa50ac19b90> >> 2020-06-29T22:43:39Z DEBUG Destroyed connection >> context.ldap2_140346825804304 >> 2020-06-29T22:43:39Z DEBUG request GET >> https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Ffake-ipa-… >> 2020-06-29T22:43:39Z DEBUG request body '' >> 2020-06-29T22:43:39Z DEBUG httplib request failed: >> Traceback (most recent call last): >> Â File "/usr/lib/python2.7/site-packages/ipapython/dogtag.py", line >> 220, in _httplib_request >> Â Â conn.request(method, path, body=request_body, headers=headers) >> Â File "/usr/lib64/python2.7/httplib.py", line 1056, in request >> Â Â self._send_request(method, url, body, headers) >> Â File "/usr/lib64/python2.7/httplib.py", line 1090, in _send_request >> Â Â self.endheaders(body) >> Â File "/usr/lib64/python2.7/httplib.py", line 1052, in endheaders >> Â Â self._send_output(message_body) >> Â File "/usr/lib64/python2.7/httplib.py", line 890, in _send_output >> Â Â self.send(msg) >> Â File "/usr/lib64/python2.7/httplib.py", line 852, in send >> Â Â self.connect() >> Â File "/usr/lib64/python2.7/httplib.py", line 1275, in connect >> Â Â server_hostname=sni_hostname) >> Â File "/usr/lib64/python2.7/ssl.py", line 348, in wrap_socket >> Â Â _context=self) >> Â File "/usr/lib64/python2.7/ssl.py", line 609, in __init__ >> Â Â self.do_handshake() >> Â File "/usr/lib64/python2.7/ssl.py", line 831, in do_handshake >> Â Â self._sslobj.do_handshake() >> SSLError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed >> (_ssl.c:618) >> 2020-06-29T22:43:39Z ERROR IPA server upgrade failed: Inspect >> /var/log/ipaupgrade.log and run command ipa-server-upgrade manually. >> 2020-06-29T22:43:39Z DEBUG Â File >> "/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 178, in >> execute >> Â Â return_value = self.run() >> Â File >> "/usr/lib/python2.7/site-packages/ipaserver/install/ipa_server_upgrade.py", >> line 54, in run >> Â Â server.upgrade() >> Â File >> "/usr/lib/python2.7/site-packages/ipaserver/install/server/upgrade.py", >> line 2166, in upgrade >> Â Â upgrade_configuration() >> Â File >> "/usr/lib/python2.7/site-packages/ipaserver/install/server/upgrade.py", >> line 2038, in upgrade_configuration >> Â Â ca_enable_ldap_profile_subsystem(ca) >> Â File >> "/usr/lib/python2.7/site-packages/ipaserver/install/server/upgrade.py", >> line 425, in ca_enable_ldap_profile_subsystem >> Â Â cainstance.migrate_profiles_to_ldap() >> Â File >> "/usr/lib/python2.7/site-packages/ipaserver/install/cainstance.py", line >> 2027, in migrate_profiles_to_ldap >> Â Â _create_dogtag_profile(profile_id, profile_data, overwrite=False) >> Â File >> "/usr/lib/python2.7/site-packages/ipaserver/install/cainstance.py", line >> 2033, in _create_dogtag_profile >> Â Â with api.Backend.ra_certprofile as profile_api: >> Â File "/usr/lib/python2.7/site-packages/ipaserver/plugins/dogtag.py", >> line 1311, in __enter__ >> Â Â method='GET' >> Â File "/usr/lib/python2.7/site-packages/ipapython/dogtag.py", line >> 167, in https_request >> Â Â method=method, headers=headers) >> Â File "/usr/lib/python2.7/site-packages/ipapython/dogtag.py", line >> 229, in _httplib_request >> Â �� raise NetworkError(uri=uri, error=str(e)) >> >> 2020-06-29T22:43:39Z DEBUG The ipa-server-upgrade command failed, >> exception: NetworkError: cannot connect to >> 'https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Ffake-ipa-…': > >> [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:618) >> 2020-06-29T22:43:39Z ERROR Unexpected error - see >> /var/log/ipaupgrade.log for details: >> NetworkError: cannot connect to >> 'https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Ffake-ipa-…': > >> [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:618) >> 2020-06-29T22:43:39Z ERROR The ipa-server-upgrade command failed. See >> /var/log/ipaupgrade.log for more information >> >> >> What should be my next debug steps? >> > Hi, > > I would check whether any certificate expired: > $ getcert list > > Look specifically for the "status: " and "expires: " labels. If some > certs have expired, you will need to find the CA renewal master and fix > this host first. To find the CA renewal master: > $ kinit admin > $ ipa config-show | grep "CA renewal" > > If you need help, please mention: > - the output of "ipa server-role-find" > - the output of "getcert list" on all the server nodes > - are the httpd and ldap server certificates issued by IPA CA or by an > external Certificate Authority? > > HTH, > flo > >> Thanks in advance, >> -ms >> >> >> _______________________________________________ >> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org >> To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org >> Fedora Code of Conduct: https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdocs.fedo… >> List Guidelines: https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Ffedorapro… >> List Archives: https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.fed… >> > > > _______________________________________________ > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org > To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org > Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost… >

2 1

Re: ipa-server-upgrade failed after yum update on CentOS7
by Florence Blanc-Renaud 30 Jun '20

30 Jun '20

On 6/30/20 10:24 AM, Mariusz Stolarczyk via FreeIPA-users wrote: > All, > > I did a routine server updates last night on my IPA server. After the > reboot I first noticed the DNS was not resolving and the ipa.service > failed. The ipa.service failed to start so I ran the following: > > > # ipactl start > IPA version error: data needs to be upgraded (expected version > '4.6.6-11.el7.centos', current version '4.6.5-11.el7.centos.4') > Automatically running upgrade, for details see /var/log/ipaupgrade.log > Be patient, this may take a few minutes. > Automatic upgrade failed: Update complete > Upgrading the configuration of the IPA services > [Verifying that root certificate is published] > [Migrate CRL publish directory] > CRL tree already moved > [Verifying that CA proxy configuration is correct] > [Verifying that KDC configuration is using ipa-kdb backend] > [Fix DS schema file syntax] > Syntax already fixed > [Removing RA cert from DS NSS database] > RA cert already removed > [Enable sidgen and extdom plugins by default] > [Updating HTTPD service IPA configuration] > [Updating HTTPD service IPA WSGI configuration] > Nothing to do for configure_httpd_wsgi_conf > [Updating mod_nss protocol versions] > Protocol versions already updated > [Updating mod_nss cipher suite] > [Updating mod_nss enabling OCSP] > [Fixing trust flags in /etc/httpd/alias] > Trust flags already processed > [Moving HTTPD service keytab to gssproxy] > [Removing self-signed CA] > [Removing Dogtag 9 CA] > [Checking for deprecated KDC configuration files] > [Checking for deprecated backups of Samba configuration files] > [Remove FILE: prefix from 'dedicated keytab file' in Samba configuration] > [Update 'max smbd processes' in Samba configuration to prevent unlimited > SMBLoris attack amplification] > [Add missing CA DNS records] > IPA CA DNS records already processed > [Removing deprecated DNS configuration options] > [Ensuring minimal number of connections] > [Updating GSSAPI configuration in DNS] > [Updating pid-file configuration in DNS] > [Checking global forwarding policy in named.conf to avoid conflicts with > automatic empty zones] > Changes to named.conf have been made, restart named > [Upgrading CA schema] > CA schema update complete (no changes) > [Verifying that CA audit signing cert has 2 year validity] > [Update certmonger certificate renewal configuration] > Certmonger certificate renewal configuration already up-to-date > [Enable PKIX certificate path discovery and validation] > PKIX already enabled > [Authorizing RA Agent to modify profiles] > [Authorizing RA Agent to manage lightweight CAs] > [Ensuring Lightweight CAs container exists in Dogtag database] > [Adding default OCSP URI configuration] > [Ensuring CA is using LDAPProfileSubsystem] > [Migrating certificate profiles to LDAP] > IPA server upgrade failed: Inspect /var/log/ipaupgrade.log and run > command ipa-server-upgrade manually. > Unexpected error - see /var/log/ipaupgrade.log for details: > NetworkError: cannot connect to > 'https://FAKE-IPA-HOST.FAKE-IPA-DOMAIN.LAN:8443/ca/rest/account/login': > [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:618) > The ipa-server-upgrade command failed. See /var/log/ipaupgrade.log for > more information > > See the upgrade log for more details and/or run > /usr/sbin/ipa-server-upgrade again > Aborting ipactl > > > The end of the /var/log/ipaupgrade.log file: > > 2020-06-29T22:43:38Z DEBUG stderr= > 2020-06-29T22:43:38Z DEBUG Loading Index file from > '/var/lib/ipa/sysrestore/sysrestore.index' > 2020-06-29T22:43:38Z DEBUG Starting external process > 2020-06-29T22:43:38Z DEBUG args=/usr/bin/certutil -d > dbm:/etc/pki/pki-tomcat/alias -L -f /etc/pki/pki-tomcat/alias/pwdfile.txt > 2020-06-29T22:43:38Z DEBUG Process finished, return code=0 > 2020-06-29T22:43:38Z DEBUG stdout= > Certificate Nickname Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Trust > Attributes > > Â SSL,S/MIME,JAR/XPI > > caSigningCert cert-pki-ca Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â CTu,Cu,Cu > subsystemCert cert-pki-ca Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â u,u,u > Server-Cert cert-pki-ca Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â u,u,u > ocspSigningCert cert-pki-ca Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â u,u,u > auditSigningCert cert-pki-ca Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â u,u,Pu > > 2020-06-29T22:43:38Z DEBUG stderr= > 2020-06-29T22:43:38Z INFO Certmonger certificate renewal configuration > already up-to-date > 2020-06-29T22:43:38Z INFO [Enable PKIX certificate path discovery and > validation] > 2020-06-29T22:43:38Z DEBUG Loading StateFile from > '/var/lib/ipa/sysupgrade/sysupgrade.state' > 2020-06-29T22:43:38Z INFO PKIX already enabled > 2020-06-29T22:43:38Z INFO [Authorizing RA Agent to modify profiles] > 2020-06-29T22:43:38Z INFO [Authorizing RA Agent to manage lightweight CAs] > 2020-06-29T22:43:38Z INFO [Ensuring Lightweight CAs container exists in > Dogtag database] > 2020-06-29T22:43:38Z DEBUG Created connection context.ldap2_140346851657552 > 2020-06-29T22:43:38Z DEBUG flushing > ldapi://%2fvar%2frun%2fslapd-SEQUOIARC-LAN.socket from SchemaCache > 2020-06-29T22:43:38Z DEBUG retrieving schema for SchemaCache > url=ldapi://%2fvar%2frun%2fslapd-SEQUOIARC-LAN.socket > conn=<ldap.ldapobject.SimpleLDAPObject instance at 0x7fa50c3e8e60> > 2020-06-29T22:43:39Z DEBUG Destroyed connection > context.ldap2_140346851657552 > 2020-06-29T22:43:39Z INFO [Adding default OCSP URI configuration] > 2020-06-29T22:43:39Z INFO [Ensuring CA is using LDAPProfileSubsystem] > 2020-06-29T22:43:39Z INFO [Migrating certificate profiles to LDAP] > 2020-06-29T22:43:39Z DEBUG Created connection context.ldap2_140346825804304 > 2020-06-29T22:43:39Z DEBUG flushing > ldapi://%2fvar%2frun%2fslapd-SEQUOIARC-LAN.socket from SchemaCache > 2020-06-29T22:43:39Z DEBUG retrieving schema for SchemaCache > url=ldapi://%2fvar%2frun%2fslapd-SEQUOIARC-LAN.socket > conn=<ldap.ldapobject.SimpleLDAPObject instance at 0x7fa50ac19b90> > 2020-06-29T22:43:39Z DEBUG Destroyed connection > context.ldap2_140346825804304 > 2020-06-29T22:43:39Z DEBUG request GET > https://FAKE-IPA-HOST.FAKE-IPA-DOMAIN.LAN:8443/ca/rest/account/login > 2020-06-29T22:43:39Z DEBUG request body '' > 2020-06-29T22:43:39Z DEBUG httplib request failed: > Traceback (most recent call last): > Â File "/usr/lib/python2.7/site-packages/ipapython/dogtag.py", line > 220, in _httplib_request > Â Â conn.request(method, path, body=request_body, headers=headers) > Â File "/usr/lib64/python2.7/httplib.py", line 1056, in request > Â Â self._send_request(method, url, body, headers) > Â File "/usr/lib64/python2.7/httplib.py", line 1090, in _send_request > Â Â self.endheaders(body) > Â File "/usr/lib64/python2.7/httplib.py", line 1052, in endheaders > Â Â self._send_output(message_body) > Â File "/usr/lib64/python2.7/httplib.py", line 890, in _send_output > Â Â self.send(msg) > Â File "/usr/lib64/python2.7/httplib.py", line 852, in send > Â Â self.connect() > Â File "/usr/lib64/python2.7/httplib.py", line 1275, in connect > Â Â server_hostname=sni_hostname) > Â File "/usr/lib64/python2.7/ssl.py", line 348, in wrap_socket > Â Â _context=self) > Â File "/usr/lib64/python2.7/ssl.py", line 609, in __init__ > Â Â self.do_handshake() > Â File "/usr/lib64/python2.7/ssl.py", line 831, in do_handshake > Â Â self._sslobj.do_handshake() > SSLError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed > (_ssl.c:618) > 2020-06-29T22:43:39Z ERROR IPA server upgrade failed: Inspect > /var/log/ipaupgrade.log and run command ipa-server-upgrade manually. > 2020-06-29T22:43:39Z DEBUG Â File > "/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 178, in > execute > Â Â return_value = self.run() > Â File > "/usr/lib/python2.7/site-packages/ipaserver/install/ipa_server_upgrade.py", > line 54, in run > Â Â server.upgrade() > Â File > "/usr/lib/python2.7/site-packages/ipaserver/install/server/upgrade.py", > line 2166, in upgrade > Â Â upgrade_configuration() > Â File > "/usr/lib/python2.7/site-packages/ipaserver/install/server/upgrade.py", > line 2038, in upgrade_configuration > Â Â ca_enable_ldap_profile_subsystem(ca) > Â File > "/usr/lib/python2.7/site-packages/ipaserver/install/server/upgrade.py", > line 425, in ca_enable_ldap_profile_subsystem > Â Â cainstance.migrate_profiles_to_ldap() > Â File > "/usr/lib/python2.7/site-packages/ipaserver/install/cainstance.py", line > 2027, in migrate_profiles_to_ldap > Â Â _create_dogtag_profile(profile_id, profile_data, overwrite=False) > Â File > "/usr/lib/python2.7/site-packages/ipaserver/install/cainstance.py", line > 2033, in _create_dogtag_profile > Â Â with api.Backend.ra_certprofile as profile_api: > Â File "/usr/lib/python2.7/site-packages/ipaserver/plugins/dogtag.py", > line 1311, in __enter__ > Â Â method='GET' > Â File "/usr/lib/python2.7/site-packages/ipapython/dogtag.py", line > 167, in https_request > Â Â method=method, headers=headers) > Â File "/usr/lib/python2.7/site-packages/ipapython/dogtag.py", line > 229, in _httplib_request > Â Â raise NetworkError(uri=uri, error=str(e)) > > 2020-06-29T22:43:39Z DEBUG The ipa-server-upgrade command failed, > exception: NetworkError: cannot connect to > 'https://FAKE-IPA-HOST.FAKE-IPA-DOMAIN.LAN:8443/ca/rest/account/login': > [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:618) > 2020-06-29T22:43:39Z ERROR Unexpected error - see > /var/log/ipaupgrade.log for details: > NetworkError: cannot connect to > 'https://FAKE-IPA-HOST.FAKE-IPA-DOMAIN.LAN:8443/ca/rest/account/login': > [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:618) > 2020-06-29T22:43:39Z ERROR The ipa-server-upgrade command failed. See > /var/log/ipaupgrade.log for more information > > > What should be my next debug steps? > Hi, I would check whether any certificate expired: $ getcert list Look specifically for the "status: " and "expires: " labels. If some certs have expired, you will need to find the CA renewal master and fix this host first. To find the CA renewal master: $ kinit admin $ ipa config-show | grep "CA renewal" If you need help, please mention: - the output of "ipa server-role-find" - the output of "getcert list" on all the server nodes - are the httpd and ldap server certificates issued by IPA CA or by an external Certificate Authority? HTH, flo > Thanks in advance, > -ms > > > _______________________________________________ > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org > To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org > Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost… >

2 1

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users July 2020