December 2021 - FreeIPA-users - Fedora Mailing-Lists

by Ned Wilson

I was wondering if anyone out there has successfully implemented a Samba cluster, where the individual nodes in the cluster are IPA clients, and then the cluster is joined to an IPA domain as a unit? RedHat has some great documentation on exactly this solution, available here: https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/... Unfortunately, this example that RedHat uses uses local authentication of users by way of a TDB file and Samba’s smbpasswd utility. RedHat’s KB article about this gives instructions on how to join a cluster to an Active Directory domain: https://access.redhat.com/articles/3304481 I can not, for the life of me, find any documentation available on how to join a Samba cluster to an IPA domain. This FreeIPA documentation is a great guide for manually adding an individual server to an IPA domain: https://freeipa.readthedocs.io/en/latest/designs/adtrust/samba-domain-mem... Once you cluster Samba, it no longer uses /var/lib/samba/private/secrets.tdb to store the machine account password ( and other information ). Rather, it uses /var/lib/ctdb/persistent/secrets.tdb.0. It would appear that once you create a Samba cluster, you are required to join the cluster to a domain with “net ads join”. Unfortunately, this does not work with an IPA domain; only Active Directory. Or, at least, I couldn’t figure it out! Here is what I learned: 1. After the cluster is created, the “net setdomainsid” command works as expected. 2. The steps in the FreeIPA “Samba Domain Member” documentation require that tdbtool is used to set two keys with value = ‘2\00’ in secrets.tdb. 3. Any attempts to modify the clustered version of secrets.tdb.N manually, using tdbtool or otherwise, result in a failed cluster. 4. The "net changesecretpw -f" command will fail unless the secrets.tdb file is modified by setting the appropriate keys with value = ‘2\00’ as described in the documentation. 5. The clustered secrets.tdb.N file is not identical to the standard secrets.tdb file.

2 years, 4 months

1
0
0 / 0

FreeIPA Bind DN account

by Kobus Bensch

Hi all My first time here. I created a Bind DN account with the following: ldapmodify -x -D 'cn=Directory Manager' -W dn: uid=ldapsystembind,cn=sysaccounts,cn=etc,dc=dev,dc=company,dc=com changetype: add objectclass: account objectclass: simplesecurityobject uid: system userPassword: !secret! passwordExpirationTime: 20380119031407Z nsIdleTimeout: 0 <blank line> ^D How can I create another user of the same type but with read/write permissions so I can use that use for intergration with keycloak? Thank you Kobus

2 years, 4 months

1
0
0 / 0

Malfunctioning DNSSSEC

by lejeczek

Hi guys. I think after, but am not 100% certain, I signed my zones I get these(quite regularly): ... ipapython.ipautil: DEBUG stderr= ipaserver.dnssec.bindmgr: DEBUG Key metadata in LDAP: {<DNS name private.pawel.>: {'1d24e517-5612-11ec-9843-95791e1d967b': <ldap.cidict.cidict object at 0x7f12c2cc96a0>, '1d24e519-5612-11ec-9843-95791e1d967b': <ldap.cidict.cidict object at 0x7f12c2cc9670>}, <DNS name 1.3.10.in-addr.arpa.>: {'1d24e51d-5612-11ec-9843-95791e1d967b': <ldap.cidict.cidict object at 0x7f12c2cc9af0>, '1d24e51f-5612-11ec-9843-95791e1d967b': <ldap.cidict.cidict object at 0x7f12c2cc9cd0>}, <DNS name mine.private.>: {'64ab7109-5612-11ec-9843-95791e1d967b': <ldap.cidict.cidict object at 0x7f12c2cd67f0>, '64ab710b-5612-11ec-9843-95791e1d967b': <ldap.cidict.cidict object at 0x7f12c2cd67c0>}, <DNS name private.road.>: {'64ab7111-5612-11ec-9843-95791e1d967b': <ldap.cidict.cidict object at 0x7f12c2cd6df0>, '64ab7113-5612-11ec-9843-95791e1d967b': <ldap.cidict.cidict object at 0x7f12c2cdf040>}} ipaserver.dnssec.bindmgr: DEBUG Zones modified but skipped during bindmgr.sync: set() ipaserver.dnssec.bindmgr: INFO Synchronizing zone 1.3.10.in-addr.arpa. ipaserver.dnssec.bindmgr: DEBUG Fixing directory permissions: /var/lib/ipa/dnssec/tokens/7af30d9a-17e4-be64-d067-36773049ff7a ... ipapython.ipautil: DEBUG args=['/usr/sbin/dnssec-keyfromlabel-pkcs11', '-K', '/var/named/dyndb-ldap/ipa/master/1.3.10.in-addr.arpa/tmpsqtcpdk7', '-a', b'RSASHA256', '-l', b'pkcs11:object=510d521b9dcec97000294dbcfa2af36a;pin-source=/var/lib/ipa/dnssec/softhsm_pin', '-P', b'20211205212748', '-A', b'20211205212748', '-I', 'none', '-D', 'none', '-f', 'KSK', '-E', 'pkcs11', '1.3.10.in-addr.arpa.'] ipapython.ipautil: DEBUG Process execution failed Traceback (most recent call last): File "/usr/libexec/ipa/ipa-dnskeysyncd", line 113, in <module> while ldap_connection.syncrepl_poll(all=1, msgid=ldap_search): File "/usr/lib64/python3.9/site-packages/ldap/syncrepl.py", line 465, in syncrepl_poll self.syncrepl_refreshdone() File "/usr/lib/python3.9/site-packages/ipaserver/dnssec/keysyncer.py", line 128, in syncrepl_refreshdone self.bindmgr.sync(self.dnssec_zones) File "/usr/lib/python3.9/site-packages/ipaserver/dnssec/bindmgr.py", line 231, in sync self.sync_zone(zone) File "/usr/lib/python3.9/site-packages/ipaserver/dnssec/bindmgr.py", line 204, in sync_zone self.install_key(zone, uuid, attrs, tempdir) File "/usr/lib/python3.9/site-packages/ipaserver/dnssec/bindmgr.py", line 145, in install_key result = ipautil.run(cmd, capture_output=True) File "/usr/lib/python3.9/site-packages/ipapython/ipautil.py", line 534, in run p = subprocess.Popen(args, stdin=p_in, stdout=p_out, stderr=p_err, File "/usr/lib64/python3.9/subprocess.py", line 951, in __init__ self._execute_child(args, executable, preexec_fn, close_fds, File "/usr/lib64/python3.9/subprocess.py", line 1821, in _execute_child raise child_exception_type(errno_num, err_msg, err_filename) FileNotFoundError: [Errno 2] No such file or directory: '/usr/sbin/dnssec-keyfromlabel-pkcs11' .. Before making it a BZ I thought I'd consult here - all thoughts much appreciated. I'm on CentOS 9 Stream with ipa-server-common-4.9.6-9.el9.noarch many thanks, L.

2 years, 4 months

2
3
0 / 0

Laptop meine Seriennummer

by Ronald Wimmer

Type: 20HG Seriennummer #: PC0PDLA2

2 years, 4 months

1
1
0 / 0

Change default email format

by Vassiliy Kechin

Hello I want to change default user email format. I tried this method on FreeIPA 4.9.6 and it's no longer works https://listman.redhat.com/archives/freeipa-users/2015-August/msg00078.html Can you recommend how to change default FreeIPA email format? I use Centos 8 Stream add FreeIPA 4.9.6 Thanks in advance, Vassiliy

2 years, 4 months

2
2
0 / 0

IPA global deployment

by Merle Dodd

Hi list I am after some pointers on the best way to deploy FreeIPA for an organization that spans many continents (Europe, Asia/Oceania, Africa). Our two largest locations have network latencies of anywhere up to 600ms, and so far trials with FreeIPA have proven that the replication becomes unreliable.. this is our current deployment: User objects: - ~2500 Groups: - ~300 Computers - ~2000 Locations (all replias deployed with CA, KRA, domain roles) Italy: 4 x Replicas Sydney: 4x Replicas Singapore: 3x Replicas Cape Town: 3x Replicas So far have found it difficult to keep all replication going reliably, some account changes will take a considerable amount of time to replicate and if there is a big event like deleting > 10 objects (users or computers) it can cause some of the replicas to become unresponsive for a period of time (restarting dirsrv sometimes helps us here and sometimes replicas never catch up and have to be re-initialized). The replication agreements seem fairly well balanced based on best practice documentation I could find. The deployment has all replicas in one single domain, we do not run DNS Services in FreeIPA due to some complexities in our domain, all replicas are visible to each other and computers via appropriate DNS SRV records with correct weighting for the location (we maintain a unique DNS view per location). We are running FreeIPA 4.6.8 on CentOS 7 currently but looking at moving to Red Hat 9 and possibly in the near future. Any advice on the best deployment or configuration for this to succeed would be greatly appreciated regards M

2 years, 4 months

1
0
0 / 0

ipa trust-add Fails

by White, Daniel E. (GSFC-770.0)[NICS]

ipa-client.x86_64 4.9.6-6.module+el8.5.0+12660+88e16a2c @rhel-8-for-x86_64-appstream-rpms ipa-client-common.noarch 4.9.6-6.module+el8.5.0+12660+88e16a2c @rhel-8-for-x86_64-appstream-rpms ipa-common.noarch 4.9.6-6.module+el8.5.0+12660+88e16a2c @rhel-8-for-x86_64-appstream-rpms ipa-healthcheck.noarch 0.7-6.module+el8.5.0+11410+91a33fe4 @rhel-8-for-x86_64-appstream-rpms ipa-healthcheck-core.noarch 0.7-6.module+el8.5.0+11410+91a33fe4 @rhel-8-for-x86_64-appstream-rpms ipa-selinux.noarch 4.9.6-6.module+el8.5.0+12660+88e16a2c @rhel-8-for-x86_64-appstream-rpms ipa-server.x86_64 4.9.6-6.module+el8.5.0+12660+88e16a2c @rhel-8-for-x86_64-appstream-rpms ipa-server-common.noarch 4.9.6-6.module+el8.5.0+12660+88e16a2c @rhel-8-for-x86_64-appstream-rpms ipa-server-trust-ad.x86_64 4.9.6-6.module+el8.5.0+12660+88e16a2c @rhel-8-for-x86_64-appstream-rpms Server is running RHEL 8.5 I follow all the Red Hat instructions to set up for an AD trust. When I get to the final step, ipa trust-add --type=ad ad_domain_name --admin ad_admin_username –password I get CIFS server communication error: code "3221225997", message "The transport connection has been reset." (both may be "None") Red Hat tech support is clueless (so what else is new) Any clues from the IPA folks ?

2 years, 4 months

2
1
0 / 0

How to fix missing CA

by Stephen Berg, Code 7309

Is there a procedure to deal with a domain that has no CA operating? I've got some replica servers working but none of them are the CA and the system I believe was the CA is not recoverable. I've looked into promoting one of the replicas to be the CA but without one currently it doesn't seem to work unless I'm doing it wrong. What I've tried so far: # ipa-csreplica-manage -v -f set-renewal-master Directory Manager password: Failed to set renewal master to <replica_server>: no such entry # ipa-cacert-manage renew CA is not configured on this system The ipa-cacert-manage command failed. Near as I can tell everything I've tried fails since the original CA is no longer online and there's no way for me to get it online. I need to modify one of the replicas to be the CA in an existing domain. All the procedures I've found require an existing functional CA. I've got one replica on CentOS 8.5 and ipa-server-4.9.6-6.module_el8.5.0+948+b8187ba6.x86_64. And four on Rocky Linux 8.5 and ipa-server-4.9.6-6.module+el8.5.0+675+61f67439.x86_64 The CentOS box will likely get retired sometime in the near future so I'll be looking to promote one of the Rocky Linux systems to be the master. There's four of those to spread out servers across different subnets in our network layout. Replication between the five current systems does seem to be working just fine. -- Stephen Berg, IT Specialist, Ocean Sciences Division, Code 7309 Naval Research Laboratory W: (228) 688-5738 <- (Preferred contact) DSN: (312) 823-5738 C: (228) 365-0162 Flank Speed: stephen.p.berg.civ(a)us.navy.mil

2 years, 4 months

2
2
0 / 0

Order of sudo rule precedence when all rules have undefined order values?

by A Dam

Hi -- We have a number of sudo rules configured that conflict with each other with no defined "Sudo Order" value. Notably, there is a rule that gives some users sudo on all IPA hosts, a rule that gives a smaller subset of users sudo on host group A, and a rule that gives a smaller subset of users sudo on host group B. We are seeing inconsistent sudo behavior between host groups A and B when a user is a member of the "sudo on all hosts" rule but not the smaller subset of users for either of the two host groups -- the user in the "sudo on all hosts" rule is able to sudo on hosts in hostgroup A despite not being in the more narrowly defined sudo rule, but they are not able to sudo on hosts in hostgroup B. What is the expected order of precedence here? Is this a race condition or is there some deterministic logic that is consistently applied to break the tie between rules with undefined sudo order values? We do plan on assigning order values to all rules to make this more explicit, but it would help to understand what the expected behavior is here until we are able to implement those changes. A pointer to the code where this is handled would be helpful as well, I wasn't able to find it easily. Thanks!

2 years, 4 months

2
1
0 / 0

Performance Problem and IPA Server startup

by Georg Seyerl

Hello, the IPA Infrastructure at my company is quite big and the performance of the login varies from acceptable to unacceptable. We are aware of the performance tuning guide by jhrozek, but it did not improve the performance in our case. In order to analyze our setup, we pinned one random IPA client onto one IPA Server in sssd.conf and started with debug_level=6 in all config sections. After deleting the cache on both machines and restarting the sssd service, the login with our AD-User on the IPA server works right away. Whereas, the client takes up to ~10 minutes before the login with our AD Account works at all. How long does it take the IPA Server on average to start up and serve client requests ? After a successful login on the client, the performance is acceptable (~2s) for some time. On the next day the performace of the first login becomes quite slow again (up to 30s and more). As IPA beginner I am to some extent overwhelmed by the sheer mass of logs and I'd be glad if you point me towards the right direction. Thanks Georg

2 years, 4 months

1
0
0 / 0

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users December 2021