September 2020 - FreeIPA-users - Fedora mailing-lists

Re: Renewing a failed to auto-renewal certificate
by Stuart McRobert 09 Sep '20

09 Sep '20

Dear flo, > there is only one certificate that failed to renew, and the repair > should (hopefully) be straightforward. > > First of all, please confirm that the server is the CA renewal master: > # ipa config-show | grep "CA renewal" Although I can kinit on other hosts this fails on what I consider to be our CA master. kinit sm kinit: Cannot contact any KDC for realm 'OUR_REALM' while getting initial credentials and would normally work up until the expiry. Now if I try from one of our clients kinit works ipa config-show | grep "CA renewal" ipa: ERROR: cannot connect to 'https://PRIMARY_SERVER/ipa/json': [Errno 111] Connection refused which has happened since the expiry and web services etc being unavailable which seems to make sense. Attempt on one of the other freeipa servers, kinit works, but ipa command fails with: ipa: ERROR: cannot connect to 'https://THIS_SERVER/ipa/json': (SEC_ERROR_EXPIRED_CERTIFICATE) Peer's Certificate has expired. > The output should display your hostname. If that's not the case, we need > more information (which host is CA renewal master, are all the certs > valid on this host?) What would you like me to gather next? I am being cautious as I don't want the user service to fail, but worry not everything is working as it should be. Thanks. Best wishes Stuart

2 1

Renewing a failed to auto-renewal certificate
by Stuart McRobert 08 Sep '20

08 Sep '20

Hi, Although I thought these certificates would all happily auto-renew, and auto-renew: yes is shown, one of them clearly hasn't with an obvious impact on services. I recognise this is now a fairly old version of freeipa. As I don't wish to break anything further, what is the correct way to safely and successfully renew this one certificate? Thanks Best wishes Stuart ------------------------------------------------------- ipa --version VERSION: 4.4.4, API_VERSION: 2.215 getcert list | grep -i expi expires: 2022-06-13 17:57:38 BST expires: 2022-06-13 17:57:48 BST expires: 2022-06-13 17:57:28 BST expires: 2036-09-08 17:57:09 BST expires: 2022-06-13 17:57:50 BST expires: 2022-06-13 17:57:22 BST expires: 2022-07-16 17:58:18 BST expires: 2020-09-04 17:46:56 BST <<<<<<<<<<<<<<<<<<<< I've changed strings to be OUR_DOMAIN and our_server below. getcert list Number of certificates and requests being tracked: 8. Request ID '20170405152505': status: MONITORING stuck: no key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert cert-pki-ca',token='NSS Certificate DB',pin set certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert cert-pki-ca',token='NSS Certificate DB' CA: dogtag-ipa-ca-renew-agent issuer: CN=Certificate Authority,O=OUR_DOMAIN subject: CN=CA Audit,O=OUR_DOMAIN expires: 2022-06-13 17:57:38 BST key usage: digitalSignature,nonRepudiation pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "auditSigningCert cert-pki-ca" track: yes auto-renew: yes Request ID '20170405152506': status: MONITORING stuck: no key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert cert-pki-ca',token='NSS Certificate DB',pin set certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert cert-pki-ca',token='NSS Certificate DB' CA: dogtag-ipa-ca-renew-agent issuer: CN=Certificate Authority,O=OUR_DOMAIN subject: CN=OCSP Subsystem,O=OUR_DOMAIN expires: 2022-06-13 17:57:48 BST eku: id-kp-OCSPSigning pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "ocspSigningCert cert-pki-ca" track: yes auto-renew: yes Request ID '20170405152507': status: MONITORING stuck: no key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert cert-pki-ca',token='NSS Certificate DB',pin set certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert cert-pki-ca',token='NSS Certificate DB' CA: dogtag-ipa-ca-renew-agent issuer: CN=Certificate Authority,O=OUR_DOMAIN subject: CN=CA Subsystem,O=OUR_DOMAIN expires: 2022-06-13 17:57:28 BST key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment eku: id-kp-serverAuth,id-kp-clientAuth pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "subsystemCert cert-pki-ca" track: yes auto-renew: yes Request ID '20170405152508': status: MONITORING stuck: no key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert cert-pki-ca',token='NSS Certificate DB',pin set certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert cert-pki-ca',token='NSS Certificate DB' CA: dogtag-ipa-ca-renew-agent issuer: CN=Certificate Authority,O=OUR_DOMAIN subject: CN=Certificate Authority,O=OUR_DOMAIN expires: 2036-09-08 17:57:09 BST key usage: digitalSignature,nonRepudiation,keyCertSign,cRLSign pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "caSigningCert cert-pki-ca" track: yes auto-renew: yes Request ID '20170405152509': status: MONITORING stuck: no key pair storage: type=NSSDB,location='/etc/httpd/alias',nickname='ipaCert',token='NSS Certificate DB',pinfile='/etc/httpd/alias/pwdfile.txt' certificate: type=NSSDB,location='/etc/httpd/alias',nickname='ipaCert',token='NSS Certificate DB' CA: dogtag-ipa-ca-renew-agent issuer: CN=Certificate Authority,O=OUR_DOMAIN subject: CN=IPA RA,O=OUR_DOMAIN expires: 2022-06-13 17:57:50 BST key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment eku: id-kp-serverAuth,id-kp-clientAuth pre-save command: /usr/libexec/ipa/certmonger/renew_ra_cert_pre post-save command: /usr/libexec/ipa/certmonger/renew_ra_cert track: yes auto-renew: yes Request ID '20170405152510': status: MONITORING stuck: no key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert cert-pki-ca',token='NSS Certificate DB',pin set certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert cert-pki-ca',token='NSS Certificate DB' CA: dogtag-ipa-renew-agent issuer: CN=Certificate Authority,O=OUR_DOMAIN subject: CN=our_server,O=OUR_DOMAIN expires: 2022-06-13 17:57:22 BST key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment eku: id-kp-serverAuth,id-kp-clientAuth pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "Server-Cert cert-pki-ca" track: yes auto-renew: yes Request ID '20170405152511': status: MONITORING stuck: no key pair storage: type=NSSDB,location='/etc/dirsrv/slapd-OUR_DOMAIN',nickname='Server-Cert',token='NSS Certificate DB',pinfile='/etc/dirsrv/slapd-OUR-DOMAIN/pwdfile.txt' certificate: type=NSSDB,location='/etc/dirsrv/slapd-OUR_DOMAIN',nickname='Server-Cert',token='NSS Certificate DB' CA: IPA issuer: CN=Certificate Authority,O=OUR_DOMAIN subject: CN=our_server,O=OUR_DOMAIN expires: 2022-07-16 17:58:18 BST principal name: ldap/our_server@OUR_DOMAIN key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment eku: id-kp-serverAuth,id-kp-clientAuth pre-save command: post-save command: /usr/libexec/ipa/certmonger/restart_dirsrv OUR_DOMAIN track: yes auto-renew: yes Request ID '20170405152512': status: CA_UNREACHABLE ca-error: Error setting up ccache for "host" service on client using default keytab: Cannot contact any KDC for requested realm. stuck: no key pair storage: type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS Certificate DB',pinfile='/etc/httpd/alias/pwdfile.txt' certificate: type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS Certificate DB' CA: IPA issuer: CN=Certificate Authority,O=OUR_DOMAIN subject: CN=our_server,O=OUR_DOMAIN expires: 2020-09-04 17:46:56 BST <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<< principal name: HTTP/our_server@OUR_DOMAIN key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment eku: id-kp-serverAuth,id-kp-clientAuth pre-save command: post-save command: /usr/libexec/ipa/certmonger/restart_httpd track: yes auto-renew: yes

2 1

Solaris 10 client setup. Works for user not groups
by Lois Blood Bennett 08 Sep '20

08 Sep '20

Hi! I am probably missing something really obvious. I have an IPA server that is still in development. I have created two test clients that are clones of existing VMs. One is Centos 7.7 and the other is Solaris10. The Centos 7.7 one is working great. The Solaris one works now for getent passwd user and. for logging in but the groups command is returning the list from the old LDAP server and I can't figure out how it is getting that. The content of the /var/ldap/ldap_client_file is : root # cat ldap_client_file # # Do not edit this file manually; your changes will be lost.Please use ldapclient (1M) instead. # NS_LDAP_FILE_VERSION= 2.0 NS_LDAP_SERVERS= 172.27.104.187 NS_LDAP_SEARCH_BASEDN= dc=channing,dc=harvard,dc=edu NS_LDAP_AUTH= tls:simple NS_LDAP_SEARCH_SCOPE= sub NS_LDAP_SERVER_PREF= chanidm.bwh.harvard.edu NS_LDAP_CACHETTL= 0 NS_LDAP_CREDENTIAL_LEVEL= proxy NS_LDAP_SERVICE_SEARCH_DESC= passwd:cn=users,cn=accounts,dc=channing,dc=harvard,dc=edu NS_LDAP_SERVICE_SEARCH_DESC= group:cn=groups,cn=accounts,dc=channing,dc=harvard,dc=edu NS_LDAP_ATTRIBUTEMAP= passwd:uidnumber=uidNumber NS_LDAP_ATTRIBUTEMAP= group:memberuid=memberUid NS_LDAP_ATTRIBUTEMAP= group:gidnumber=gidNumber NS_LDAP_ATTRIBUTEMAP= passwd:gidnumber=gidNumber NS_LDAP_OBJECTCLASSMAP= group:posixGroup=posixgroup NS_LDAP_SERVICE_AUTH_METHOD= pam_ldap:tls:simple NS_LDAP_SERVICE_AUTH_METHOD= passwd-cmd:tls:simple Any suggestions? Thank you all. Lois Bennett, MSEE Senior System Administrator Channing Division of Network Medicine, Brigham & Women's Hospital A Teaching Affiliate of Harvard Medical School and Harvard School of Public Health

2 1

FreeIPA DNS (named-pkcs11) failover
by Peter Larsen 06 Sep '20

06 Sep '20

I have two FreeIPA servers both are working as DNS servers for the network. Each IPA server is in the DNS server list, so they serve as "backup" for one another. I had one of the server's named-pkcs11 fail last night and somehow the second server failed resolving as it could not reach the first one. The zone they're hitting has forwarding disabled. I could get internal addresses resolved but when it came to external, the server that was running would not forward out of the network - only to the server that no longer was open. I'm struggling to see what would cause this dependency. Since the zone definition is the same on both systems, what causes this dependency? Is there a setting I need to look at that's not in the LDAP DB? Each IPA server has a resolve that lists localhost (them-self) and the IP address of the other IPA server. So I understand if there's attempt to reach the other, but if the first IPA server can do a global forward, why can't the other? I use "forwarding disabled" because it turned out when there was no external access the "forward first" would fail and hence I would have no DNS just because my ISP decided not to reply - even the internal DNS would fail this way. Forwarding disabled seems to work - and it's my expectation that it simply looks up the NS record directly when it doesn't have a zone that matches. So why does one of the IPA servers not seem to be able to do this? -- Regards Peter Larsen

2 1

Seeking ALL server datafile/database file/dir paths on Ubuntu 18.04
by Johnny Utahh 05 Sep '20

05 Sep '20

We are seeking ALL the FreeIPA file/database file paths created in the |ipa-server-install| command in the |freeipa-server| package on Ubuntu 18.04. We're looking for a /comprehensive/ list. Is this feasible? Details: https://www.reddit.com/r/FreeIPA/comments/im6zjs/where_are_all_the_freeipa_… Regards, ~Johnny -- //

2 4

migrate IPA server to new OS
by Boris Behrens 04 Sep '20

04 Sep '20

Hi, just a short question: Is it possible to migrate a freeIPA server to a new host? I'd like to move from fedora 26 to centos8, but I wouldn't like to "add a new master, then remove the older master, test everything, move ip addresses and fw rules" and all that stuff. Cheers Boris -- Die Selbsthilfegruppe "UTF-8-Probleme" trifft sich diesmal abweichend im groÃƒ¼en Saal.

3 4

CentOS 7 --> 8 migration for FreeIPA with external CA?
by Harald Dunkel 04 Sep '20

04 Sep '20

Hi folks, I have found several migration guidelines from Centos 7 to 8. AFAIU the procedure is to setup a new CentOS 8 FreeIPA server, and then to migrate the "master" from the old to the new host. See [1], for example. Having myself burned with the CA stuff in FreeIPA before, I wonder if there are any pitfalls wrt having an external root CA and external DNS? Thats the part not described in [1]. Every helpful comment is highly appreciated Harri [1] https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/ht…

2 1

FreeIPA Role Management
by John Burns 03 Sep '20

03 Sep '20

What exactly should be granted to enable a user to view /edit freeIPA roles? Specifically, what enables a user to view anything under "IPA Server" > "Role-Based Access Control?" Context: roles, privileges, permissions are all populated for one non-"admin" login but not for another.

2 1

Delegation (S4U2Proxy) with apache's mod_auth_gssapi
by Aurelien Bompard 02 Sep '20

02 Sep '20

Hey folks! I have a Kerberos issue when using s4u2proxy with mod_auth_gssapi and IPA, and I don't know where to look. Basically, I've setup delegation in IPA (with servicedelegationrules and targets) and in Apache's config for mod_auth_gssapi, but the directory where the CCaches are supposed to be created remains empty (GssapiDelegCcacheDir). In the apache log I only see: GSS ERROR gss_acquire_cred[_from]() failed to get server creds: [Unspecified GSS failure. Minor code may provide more information ( SPNEGO cannot find mechanisms to negotiate)] For context, the webapp running in Apache is delegating for IPA's ldap service, and if I contact it directly with ldapwhoami I get the right result, so it's really the delegation I think. Also, the webapp is running in openshift, but that should not be a big issue (besides for debugging) because I've already made it work elsewhere. I have keytabs for the host and the HTTP service: $ klist -k /etc/krb5.keytab Keytab name: FILE:/etc/krb5.keytab KVNO Principal ---- -------------------------------------------------------------------------- 1 host/fasjson.stg.fedoraproject.org(a)STG.FEDORAPROJECT.ORG 1 host/fasjson.stg.fedoraproject.org(a)STG.FEDORAPROJECT.ORG $ klist -k /etc/keytabs/http Keytab name: FILE:/etc/keytabs/http KVNO Principal ---- -------------------------------------------------------------------------- 1 HTTP/fasjson.stg.fedoraproject.org(a)STG.FEDORAPROJECT.ORG 1 HTTP/fasjson.stg.fedoraproject.org(a)STG.FEDORAPROJECT.ORG And the section in Apache's config file is: AuthType GSSAPI AuthName "Kerberos Login" GssapiUseSessions On Session On SessionCookieName ipa_session path=/;httponly;secure; SessionHeader IPASESSION GssapiSessionKey file:/httpdir/run/session.key GssapiCredStore keytab:/etc/keytabs/httpd GssapiImpersonate On GssapiDelegCcacheDir /httpdir/run/ccaches GssapiDelegCcachePerms mode:0660 GssapiUseS4U2Proxy on GssapiAllowedMech krb5 Here's what I'm seeing. When I'm authenticated with kerberos: $ klist Ticket cache: KEYRING:persistent:1000290000:1000290000 Default principal: abompard(a)STG.FEDORAPROJECT.ORG Valid starting Expires Service principal 09/02/20 12:55:59 09/03/20 12:55:47 krbtgt/STG.FEDORAPROJECT.ORG(a)STG.FEDORAPROJECT.ORG and I contact the web app with curl: curl --negotiate -u : https://fasjson.stg.fedoraproject.org/v1/ I get a 401 response with the log pasted above. The /httpdir/run/ccaches/ directory remains empty, but I do get the service's entry in klist: $ klist Ticket cache: KEYRING:persistent:1000290000:1000290000 Default principal: abompard(a)STG.FEDORAPROJECT.ORG Valid starting Expires Service principal 09/02/20 12:57:12 09/03/20 12:55:47 HTTP/fasjson.stg.fedoraproject.org(a)STG.FEDORAPROJECT.ORG 09/02/20 12:55:59 09/03/20 12:55:47 krbtgt/STG.FEDORAPROJECT.ORG(a)STG.FEDORAPROJECT.ORG I don't know what I'm doing wrong and where I could dig. Could you point me in the right direction? I'm also on IRC in the freeipa channel as abompard. Thanks! Aurélien

2 1

freeIPA : AD trust
by Christophe BERGER 01 Sep '20

01 Sep '20

I created a trust relationship between my IPA server, and an Active Directory. From any machine connected to freeIPA, I can : - sudo su - ADuser(a)ad.example.com - id ADuser(a)ad.example.com ( I get things like uid=167644279(ADuser(a)ad.example.com) gid=167644279(ADuser(a)ad.example.com) groups=167644279(ADuser@ad.example.com),167616854(groupXXX@ad.example.com), .................... - getent passwd ADuser(a)ad.example.com ADuser@ad.example.com:*:167644279:167644279:ADuser:/home/example.com/ADuser The connection between IPA and AD looks fine. Then I created : - An external group, with my ADuser(a)ad.example.com user (external) - An POSIX group, with my external group as a user group member - A HBAC rule to allow the POSIX group to connect to a server However, I can't ssh this server with my AD account, I get this : Sep 01 15:15:18 myServer.example.com systemd[1]: Starting SSSD Kerberos Cache Manager... Sep 01 15:15:18 myServer.example.com systemd[1]: Started SSSD Kerberos Cache Manager. Sep 01 15:15:18 myServer.example.com sssd[kcm][1730]: Starting up Sep 01 15:15:18 myServer.example.com [sssd[krb5_child[1727]]][1727]: Cannot find KDC for realm "EXAMPLE.COM" Sep 01 15:15:18 myServer.example.com [sssd[krb5_child[1727]]][1727]: Cannot find KDC for realm "EXAMPLE.COM" Sep 01 15:15:18 myServer.example.com [sssd[krb5_child[1731]]][1731]: Cannot find KDC for realm "EXAMPLE.COM" Sep 01 15:15:18 myServer.example.com [sssd[krb5_child[1731]]][1731]: Cannot find KDC for realm "EXAMPLE.COM" Sep 01 15:15:18 myServer.example.com sshd[1723]: pam_sss(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=X.X.X.X user=ADuser(a)EXAMPLE.COM Sep 01 15:15:18 myServer.example.com sshd[1723]: pam_sss(sshd:auth): received for user ADuser(a)EXAMPLE.COM: 6 (Permission denied) Sep 01 15:15:20 myServer.example.com sshd[1723]: Failed password for ADuser(a)EXAMPLE.COM from X.X.X.X port 57320 ssh2

2 1

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users September 2020