FreeIPA-users March 2021

freeipa-users@lists.fedorahosted.org

59 participants
93 discussions

dirsrv hangs soon after reboot
by Kees Bakker 17 May '21

17 May '21

Hey, I'm looking for advice how to analyse/debug this. On one of the masters the dirsrv is unresponsive. It runs, but every attempt to connect it hangs. The command "systemctl status" does not show anything alarming ● dirsrv(a)EXAMPLE-COM.service - 389 Directory Server EXAMPLE-COM. Loaded: loaded (/usr/lib/systemd/system/dirsrv@.service; enabled; vendor preset: disabled) Active: active (running) since vr 2020-04-17 13:46:25 CEST; 1h 33min ago Process: 3123 ExecStartPre=/usr/sbin/ds_systemd_ask_password_acl /etc/dirsrv/slapd-%i/dse.ldif (code=exited, status=0/SUCCESS) Main PID: 3134 (ns-slapd) Status: "slapd started: Ready to process requests" CGroup: /system.slice/system-dirsrv.slice/dirsrv(a)EXAMPLE-COM.service └─3134 /usr/sbin/ns-slapd -D /etc/dirsrv/slapd-EXAMPLE-COM -i /var/run/dirsrv/slapd-EXAMPLE-COM.pid apr 17 15:13:54 linge.example.com ns-slapd[3134]: GSSAPI client step 1 apr 17 15:13:54 linge.example.com ns-slapd[3134]: GSSAPI client step 1 apr 17 15:13:54 linge.example.com ns-slapd[3134]: GSSAPI client step 1 apr 17 15:13:54 linge.example.com ns-slapd[3134]: GSSAPI client step 1 apr 17 15:13:54 linge.example.com ns-slapd[3134]: GSSAPI client step 2 apr 17 15:18:54 linge.example.com ns-slapd[3134]: GSSAPI client step 1 apr 17 15:18:54 linge.example.com ns-slapd[3134]: GSSAPI client step 1 apr 17 15:18:55 linge.example.com ns-slapd[3134]: GSSAPI client step 1 apr 17 15:18:55 linge.example.com ns-slapd[3134]: GSSAPI client step 1 apr 17 15:18:55 linge.example.com ns-slapd[3134]: GSSAPI client step 2 However, an ldapsearch command hangs forever [root@rotte ~]# ldapsearch -H ldaps://linge.example.com -D uid=keesbtest,cn=users,cn=accounts,dc=example,dc=com -W -LLL -o ldif-wrap=no -b cn=users,cn=accounts,dc=example,dc=com '(&(objectClass=person)(memberOf=cn=admins,cn=groups,cn=accounts,dc=example,dc=com))' uid Enter LDAP Password: Even if I use the socket (ldapi://%2fvar%2frun%2fslapd-EXAMPLE-COM.socket) the ldapsearch command hangs. "ipactl status" hangs "kinit" hangs -- Kees Bakker

5 16

DNS - trusted-keys via IPA's tools - ?
by lejeczek 03 May '21

03 May '21

hi everybody I want to ask if we have a way of adding trusted-keys? Official/recommended VS by fiddling/non-recommended ? many thanks, L.

1 1

Server Installation Error - [error] RuntimeError: failed to create DS instance Command '/usr/sbin/setup-ds.pl
by Scott Reed 19 Apr '21

19 Apr '21

I am not new to installing FreeIPA. This one has been a struggle. I came in to help some people on there server installation. Long story short. I found the ipa-dnskeysyncd.service constantly restarting. I went and uninstalled the server, and found that the slapd-<Domain> service broken and I uninstalled it completely manually. Then when I went to install the server again. It is hanging on the creation of the domain server. Here are the results of the installation. Installation Output: The log file for this installation can be found in /var/log/ipaserver-install.log ============================================================================== This program will set up the IPA Server. This includes: * Configure a stand-alone CA (dogtag) for certificate management * Configure the Network Time Daemon (ntpd) * Create and configure an instance of Directory Server * Create and configure a Kerberos Key Distribution Center (KDC) * Configure Apache (httpd) * Configure DNS (bind) * Configure the KDC to enable PKINIT Warning: skipping DNS resolution of host serv.example.domain Checking DNS domain example.domain., please wait ... The IPA Master Server will be configured with: Hostname: serv.example.domain IP address(es): 192.168.1.191 Domain name: example.domain Realm name: EXAMPLE.DOMAIN BIND DNS server will be configured to serve IPA domain with: Forwarders: No forwarders Forward policy: only Reverse zone(s): No reverse zone Configuring NTP daemon (ntpd) [1/4]: stopping ntpd [2/4]: writing configuration [3/4]: configuring ntpd to start on boot [4/4]: starting ntpd Done configuring NTP daemon (ntpd). Configuring directory server (dirsrv). Estimated time: 30 seconds [1/45]: creating directory server instance [error] RuntimeError: failed to create DS instance Command '/usr/sbin/setup-ds.pl --silent --logfile - -f /tmp/tmp_Z6Bop' returned no-zero exit status 1 ipapython.admintool: ERROR failed to create DS instance Command '/usr/sbin/setup-ds.pl --silent --logfile - -f /tmp/tmp_Z6Bop' retured non-zero exit status 1 ipapython.admintool: ERROR The ipa-server-install command failed. See /var/log/ipaserver-install.log for more information Install Log File: 2021-03-30T19:11:29Z DEBUG Logging to /var/log/ipaserver-install.log 2021-03-30T19:11:29Z INFO Checking DNS domain example.domain, please wait ... 2021-03-30T19:11:29Z DEBUG ipa-server-install was invoked with arguments [] and options: {'no_dns_sshfp': False, 'ignore_topology_disconnect': False, 'verbose': False, 'domain_level': None, 'ip_addresses': None, 'secondary_rid_base': None, 'netbios_name': None, 'mkhomedir': True, 'http_cert_files': None, 'zonemgr': None, 'no_pkinit': False, 'reverse_zones': None, 'no_forwarders': True, 'external_ca_profile': None, 'external_ca_type': None, 'no_ntp': False, 'no_msdcs': False, 'setup_kra': False, 'domain_name': 'example.domain', 'idmax': None, 'setup_adtrust': False, 'http_cert_name': None, 'dirsrv_cert_files': None, 'no_dnssec_validation': False, 'ca_signing_algorithm': None, 'no_reverse': False, 'ssh_trust_dns': False, 'pkinit_cert_files': None, 'ca_cert_files': None, 'subject_base': None, 'auto_reverse': True, 'auto_forwarders': False, 'no_host_dns': False, 'no_sshd': False, 'no_ui_redirect': False, 'ignore_last_of_role': False, 'realm_name': 'EXAMPLE.DOMAIN', 'forwarders': None, 'i dstart': None, 'external_ca': False, 'pkinit_cert_name': None, 'no_ssh': False, 'external_cert_files': None, 'enable_compat': False, 'no_hbac_allow': False, 'forward_policy': None, 'dirsrv_cert_name': None, 'unattended': True, 'rid_base': None, 'quiet': False, 'setup_dns': True, 'ca_subject': None, 'host_name': 'serv.example.domain', 'dirsrv_config_file': None, 'log_file': None, 'allow_zone_overlap': False, 'uninstall': False} 2021-03-30T19:11:29Z DEBUG IPA version 4.6.8-5.el7.centos 2021-03-30T19:11:29Z DEBUG Searching for an interface of IP address: ::1 2021-03-30T19:11:29Z DEBUG Testing local IP address: ::1/ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff (interface: lo) 2021-03-30T19:11:29Z DEBUG Starting external process 2021-03-30T19:11:29Z DEBUG args=/usr/sbin/selinuxenabled 2021-03-30T19:11:29Z DEBUG Process finished, return code=1 2021-03-30T19:11:29Z DEBUG stdout= 2021-03-30T19:11:29Z DEBUG stderr= 2021-03-30T19:11:29Z DEBUG Loading StateFile from '/var/lib/ipa/sysrestore/sysrestore.state' 2021-03-30T19:11:29Z DEBUG Loading Index file from '/var/lib/ipa/sysrestore/sysrestore.index' 2021-03-30T19:11:29Z DEBUG httpd is not configured 2021-03-30T19:11:29Z DEBUG kadmin is not configured 2021-03-30T19:11:29Z DEBUG dirsrv is not configured 2021-03-30T19:11:29Z DEBUG pki-tomcatd is not configured 2021-03-30T19:11:29Z DEBUG install is not configured 2021-03-30T19:11:29Z DEBUG krb5kdc is not configured 2021-03-30T19:11:29Z DEBUG ntpd is not configured 2021-03-30T19:11:29Z DEBUG named is not configured 2021-03-30T19:11:29Z DEBUG filestore is tracking no files 2021-03-30T19:11:29Z DEBUG Loading Index file from '/var/lib/ipa-client/sysrestore/sysrestore.index' 2021-03-30T19:11:29Z DEBUG Loading Index file from '/var/lib/ipa/sysrestore/sysrestore.index' 2021-03-30T19:11:29Z DEBUG Loading StateFile from '/var/lib/ipa/sysrestore/sysrestore.state' 2021-03-30T19:11:29Z DEBUG Starting external process 2021-03-30T19:11:29Z DEBUG args=/bin/systemctl is-enabled chronyd.service 2021-03-30T19:11:29Z DEBUG Process finished, return code=1 2021-03-30T19:11:29Z DEBUG stdout= 2021-03-30T19:11:29Z DEBUG stderr=Failed to get unit file state for chronyd.service: No such file or directory 2021-03-30T19:11:29Z DEBUG Starting external process 2021-03-30T19:11:29Z DEBUG args=/bin/systemctl is-active chronyd.service 2021-03-30T19:11:29Z DEBUG Process finished, return code=3 2021-03-30T19:11:29Z DEBUG stdout=unknown 2021-03-30T19:11:29Z DEBUG stderr= 2021-03-30T19:11:29Z DEBUG Starting external process 2021-03-30T19:11:29Z DEBUG args=/usr/sbin/httpd -t -D DUMP_VHOSTS 2021-03-30T19:11:29Z DEBUG Process finished, return code=0 2021-03-30T19:11:29Z DEBUG stdout=VirtualHost configuration: *:8443 serv.example.domain (/etc/httpd/conf.d/nss.conf:81) 2021-03-30T19:11:29Z DEBUG stderr= 2021-03-30T19:11:29Z DEBUG Check if serv.example.domain is a primary hostname for localhost 2021-03-30T19:11:29Z DEBUG Primary hostname for localhost: serv.example.domain 2021-03-30T19:11:29Z DEBUG will use host_name: serv.example.domain 2021-03-30T19:11:29Z DEBUG importing all plugin modules in ipaserver.plugins... 2021-03-30T19:11:29Z DEBUG importing plugin module ipaserver.plugins.aci 2021-03-30T19:11:29Z DEBUG importing plugin module ipaserver.plugins.automember 2021-03-30T19:11:29Z DEBUG importing plugin module ipaserver.plugins.automount 2021-03-30T19:11:29Z DEBUG importing plugin module ipaserver.plugins.baseldap 2021-03-30T19:11:29Z DEBUG ipaserver.plugins.baseldap is not a valid plugin module 2021-03-30T19:11:29Z DEBUG importing plugin module ipaserver.plugins.baseuser 2021-03-30T19:11:29Z DEBUG importing plugin module ipaserver.plugins.batch 2021-03-30T19:11:29Z DEBUG importing plugin module ipaserver.plugins.ca 2021-03-30T19:11:29Z DEBUG importing plugin module ipaserver.plugins.caacl 2021-03-30T19:11:29Z DEBUG importing plugin module ipaserver.plugins.cert 2021-03-30T19:11:29Z DEBUG importing plugin module ipaserver.plugins.certmap 2021-03-30T19:11:29Z DEBUG importing plugin module ipaserver.plugins.certprofile 2021-03-30T19:11:29Z DEBUG importing plugin module ipaserver.plugins.config 2021-03-30T19:11:29Z DEBUG importing plugin module ipaserver.plugins.delegation 2021-03-30T19:11:29Z DEBUG importing plugin module ipaserver.plugins.dns 2021-03-30T19:11:29Z DEBUG importing plugin module ipaserver.plugins.dnsserver 2021-03-30T19:11:29Z DEBUG importing plugin module ipaserver.plugins.dogtag 2021-03-30T19:11:29Z DEBUG importing plugin module ipaserver.plugins.domainlevel 2021-03-30T19:11:29Z DEBUG importing plugin module ipaserver.plugins.group 2021-03-30T19:11:29Z DEBUG importing plugin module ipaserver.plugins.hbac 2021-03-30T19:11:29Z DEBUG ipaserver.plugins.hbac is not a valid plugin module 2021-03-30T19:11:29Z DEBUG importing plugin module ipaserver.plugins.hbacrule 2021-03-30T19:11:29Z DEBUG importing plugin module ipaserver.plugins.hbacsvc 2021-03-30T19:11:29Z DEBUG importing plugin module ipaserver.plugins.hbacsvcgroup 2021-03-30T19:11:29Z DEBUG importing plugin module ipaserver.plugins.hbactest 2021-03-30T19:11:29Z DEBUG importing plugin module ipaserver.plugins.host 2021-03-30T19:11:29Z DEBUG importing plugin module ipaserver.plugins.hostgroup 2021-03-30T19:11:29Z DEBUG importing plugin module ipaserver.plugins.idrange 2021-03-30T19:11:29Z DEBUG importing plugin module ipaserver.plugins.idviews 2021-03-30T19:11:29Z DEBUG importing plugin module ipaserver.plugins.internal 2021-03-30T19:11:29Z DEBUG importing plugin module ipaserver.plugins.join 2021-03-30T19:11:29Z DEBUG importing plugin module ipaserver.plugins.krbtpolicy 2021-03-30T19:11:29Z DEBUG importing plugin module ipaserver.plugins.ldap2 2021-03-30T19:11:29Z DEBUG importing plugin module ipaserver.plugins.location 2021-03-30T19:11:29Z DEBUG importing plugin module ipaserver.plugins.migration 2021-03-30T19:11:29Z DEBUG importing plugin module ipaserver.plugins.misc 2021-03-30T19:11:29Z DEBUG importing plugin module ipaserver.plugins.netgroup 2021-03-30T19:11:29Z DEBUG importing plugin module ipaserver.plugins.otp 2021-03-30T19:11:29Z DEBUG ipaserver.plugins.otp is not a valid plugin module 2021-03-30T19:11:29Z DEBUG importing plugin module ipaserver.plugins.otpconfig 2021-03-30T19:11:29Z DEBUG importing plugin module ipaserver.plugins.otptoken 2021-03-30T19:11:29Z DEBUG importing plugin module ipaserver.plugins.passwd 2021-03-30T19:11:29Z DEBUG importing plugin module ipaserver.plugins.permission 2021-03-30T19:11:29Z DEBUG importing plugin module ipaserver.plugins.ping 2021-03-30T19:11:29Z DEBUG importing plugin module ipaserver.plugins.pkinit 2021-03-30T19:11:29Z DEBUG importing plugin module ipaserver.plugins.privilege 2021-03-30T19:11:29Z DEBUG importing plugin module ipaserver.plugins.pwpolicy 2021-03-30T19:11:29Z DEBUG importing plugin module ipaserver.plugins.rabase 2021-03-30T19:11:29Z DEBUG ipaserver.plugins.rabase is not a valid plugin module 2021-03-30T19:11:29Z DEBUG importing plugin module ipaserver.plugins.radiusproxy 2021-03-30T19:11:29Z DEBUG importing plugin module ipaserver.plugins.realmdomains 2021-03-30T19:11:29Z DEBUG importing plugin module ipaserver.plugins.role 2021-03-30T19:11:29Z DEBUG importing plugin module ipaserver.plugins.schema 2021-03-30T19:11:29Z DEBUG importing plugin module ipaserver.plugins.selfservice 2021-03-30T19:11:29Z DEBUG importing plugin module ipaserver.plugins.selinuxusermap 2021-03-30T19:11:29Z DEBUG importing plugin module ipaserver.plugins.server 2021-03-30T19:11:29Z DEBUG importing plugin module ipaserver.plugins.serverrole 2021-03-30T19:11:29Z DEBUG importing plugin module ipaserver.plugins.serverroles 2021-03-30T19:11:29Z DEBUG importing plugin module ipaserver.plugins.service 2021-03-30T19:11:29Z DEBUG importing plugin module ipaserver.plugins.servicedelegation 2021-03-30T19:11:29Z DEBUG importing plugin module ipaserver.plugins.session 2021-03-30T19:11:29Z DEBUG importing plugin module ipaserver.plugins.stageuser 2021-03-30T19:11:29Z DEBUG importing plugin module ipaserver.plugins.sudo 2021-03-30T19:11:29Z DEBUG ipaserver.plugins.sudo is not a valid plugin module 2021-03-30T19:11:29Z DEBUG importing plugin module ipaserver.plugins.sudocmd 2021-03-30T19:11:29Z DEBUG importing plugin module ipaserver.plugins.sudocmdgroup 2021-03-30T19:11:29Z DEBUG importing plugin module ipaserver.plugins.sudorule 2021-03-30T19:11:29Z DEBUG importing plugin module ipaserver.plugins.topology 2021-03-30T19:11:29Z DEBUG importing plugin module ipaserver.plugins.trust 2021-03-30T19:11:29Z DEBUG importing plugin module ipaserver.plugins.user 2021-03-30T19:11:29Z DEBUG importing plugin module ipaserver.plugins.vault 2021-03-30T19:11:30Z DEBUG importing plugin module ipaserver.plugins.virtual 2021-03-30T19:11:30Z DEBUG ipaserver.plugins.virtual is not a valid plugin module 2021-03-30T19:11:30Z DEBUG importing plugin module ipaserver.plugins.whoami 2021-03-30T19:11:30Z DEBUG importing plugin module ipaserver.plugins.xmlserver 2021-03-30T19:11:30Z DEBUG importing all plugin modules in ipaserver.install.plugins... 2021-03-30T19:11:30Z DEBUG importing plugin module ipaserver.install.plugins.adtrust 2021-03-30T19:11:30Z DEBUG importing plugin module ipaserver.install.plugins.ca_renewal_master 2021-03-30T19:11:30Z DEBUG importing plugin module ipaserver.install.plugins.dns 2021-03-30T19:11:30Z DEBUG importing plugin module ipaserver.install.plugins.fix_kra_people_entry 2021-03-30T19:11:30Z DEBUG importing plugin module ipaserver.install.plugins.fix_replica_agreements 2021-03-30T19:11:30Z DEBUG importing plugin module ipaserver.install.plugins.rename_managed 2021-03-30T19:11:30Z DEBUG importing plugin module ipaserver.install.plugins.update_ca_topology 2021-03-30T19:11:30Z DEBUG importing plugin module ipaserver.install.plugins.update_dna_shared_config 2021-03-30T19:11:30Z DEBUG importing plugin module ipaserver.install.plugins.update_fix_duplicate_cacrt_in_ldap 2021-03-30T19:11:30Z DEBUG importing plugin module ipaserver.install.plugins.update_idranges 2021-03-30T19:11:30Z DEBUG importing plugin module ipaserver.install.plugins.update_ldap_server_list 2021-03-30T19:11:30Z DEBUG importing plugin module ipaserver.install.plugins.update_managed_permissions 2021-03-30T19:11:30Z DEBUG importing plugin module ipaserver.install.plugins.update_nis 2021-03-30T19:11:30Z DEBUG importing plugin module ipaserver.install.plugins.update_pacs 2021-03-30T19:11:30Z DEBUG importing plugin module ipaserver.install.plugins.update_passsync 2021-03-30T19:11:30Z DEBUG importing plugin module ipaserver.install.plugins.update_ra_cert_store 2021-03-30T19:11:30Z DEBUG importing plugin module ipaserver.install.plugins.update_referint 2021-03-30T19:11:30Z DEBUG importing plugin module ipaserver.install.plugins.update_services 2021-03-30T19:11:30Z DEBUG importing plugin module ipaserver.install.plugins.update_unhashed_password 2021-03-30T19:11:30Z DEBUG importing plugin module ipaserver.install.plugins.update_uniqueness 2021-03-30T19:11:30Z DEBUG importing plugin module ipaserver.install.plugins.upload_cacrt 2021-03-30T19:11:30Z DEBUG Loading Index file from '/var/lib/ipa/sysrestore/sysrestore.index' 2021-03-30T19:11:30Z INFO Checking DNS domain example.domain., please wait ... 2021-03-30T19:11:30Z DEBUG Name serv.example.domain resolved to set([UnsafeIPAddress('192.168.1.191')]) 2021-03-30T19:11:30Z DEBUG Searching for an interface of IP address: 192.168.1.191 2021-03-30T19:11:30Z DEBUG Testing local IP address: 127.0.0.1/255.0.0.0 (interface: lo) 2021-03-30T19:11:30Z DEBUG Testing local IP address: 192.168.1.191/255.255.255.0 (interface: eth0) 2021-03-30T19:11:30Z DEBUG IP address 192.168.1.191 belongs to a private range, using forward policy only 2021-03-30T19:11:30Z DEBUG will use DNS forwarders: [] 2021-03-30T19:11:30Z INFO Reverse record for IP address 192.168.1.191 already exists 2021-03-30T19:11:30Z DEBUG Backing up system configuration file '/etc/hostname' 2021-03-30T19:11:30Z DEBUG Saving Index File to '/var/lib/ipa/sysrestore/sysrestore.index' 2021-03-30T19:11:30Z DEBUG Loading StateFile from '/var/lib/ipa/sysrestore/sysrestore.state' 2021-03-30T19:11:30Z DEBUG Saving StateFile to '/var/lib/ipa/sysrestore/sysrestore.state' 2021-03-30T19:11:30Z DEBUG Starting external process 2021-03-30T19:11:30Z DEBUG args=/bin/hostnamectl set-hostname serv.example.domain 2021-03-30T19:11:30Z DEBUG Process finished, return code=0 2021-03-30T19:11:30Z DEBUG stdout= 2021-03-30T19:11:30Z DEBUG stderr= 2021-03-30T19:11:30Z DEBUG Backing up system configuration file '/etc/hosts' 2021-03-30T19:11:30Z DEBUG Saving Index File to '/var/lib/ipa/sysrestore/sysrestore.index' 2021-03-30T19:11:30Z DEBUG Starting external process 2021-03-30T19:11:30Z DEBUG args=/bin/systemctl is-enabled chronyd.service 2021-03-30T19:11:30Z DEBUG Process finished, return code=1 2021-03-30T19:11:30Z DEBUG stdout= 2021-03-30T19:11:30Z DEBUG stderr=Failed to get unit file state for chronyd.service: No such file or directory 2021-03-30T19:11:30Z DEBUG Starting external process 2021-03-30T19:11:30Z DEBUG args=/bin/systemctl is-active chronyd.service 2021-03-30T19:11:30Z DEBUG Process finished, return code=3 2021-03-30T19:11:30Z DEBUG stdout=unknown 2021-03-30T19:11:30Z DEBUG stderr= 2021-03-30T19:11:30Z DEBUG Loading StateFile from '/var/lib/ipa/sysrestore/sysrestore.state' 2021-03-30T19:11:30Z DEBUG Loading Index file from '/var/lib/ipa/sysrestore/sysrestore.index' 2021-03-30T19:11:30Z DEBUG Configuring NTP daemon (ntpd) 2021-03-30T19:11:30Z DEBUG [1/4]: stopping ntpd 2021-03-30T19:11:30Z DEBUG Starting external process 2021-03-30T19:11:30Z DEBUG args=/bin/systemctl is-active ntpd.service 2021-03-30T19:11:30Z DEBUG Process finished, return code=3 2021-03-30T19:11:30Z DEBUG stdout=unknown 2021-03-30T19:11:30Z DEBUG stderr= 2021-03-30T19:11:30Z DEBUG Loading StateFile from '/var/lib/ipa/sysrestore/sysrestore.state' 2021-03-30T19:11:30Z DEBUG Saving StateFile to '/var/lib/ipa/sysrestore/sysrestore.state' 2021-03-30T19:11:30Z DEBUG Starting external process 2021-03-30T19:11:30Z DEBUG args=/bin/systemctl stop ntpd.service 2021-03-30T19:11:30Z DEBUG Process finished, return code=0 2021-03-30T19:11:30Z DEBUG stdout= 2021-03-30T19:11:30Z DEBUG stderr= 2021-03-30T19:11:30Z DEBUG Stop of ntpd.service complete 2021-03-30T19:11:30Z DEBUG duration: 0 seconds 2021-03-30T19:11:30Z DEBUG [2/4]: writing configuration 2021-03-30T19:11:30Z DEBUG Backing up system configuration file '/etc/ntp.conf' 2021-03-30T19:11:30Z DEBUG Saving Index File to '/var/lib/ipa/sysrestore/sysrestore.index' 2021-03-30T19:11:30Z DEBUG Backing up system configuration file '/etc/sysconfig/ntpd' 2021-03-30T19:11:30Z DEBUG Saving Index File to '/var/lib/ipa/sysrestore/sysrestore.index' 2021-03-30T19:11:30Z DEBUG duration: 0 seconds 2021-03-30T19:11:30Z DEBUG [3/4]: configuring ntpd to start on boot 2021-03-30T19:11:30Z DEBUG Starting external process 2021-03-30T19:11:30Z DEBUG args=/bin/systemctl is-enabled ntpd.service 2021-03-30T19:11:30Z DEBUG Process finished, return code=1 2021-03-30T19:11:30Z DEBUG stdout=disabled 2021-03-30T19:11:30Z DEBUG stderr= 2021-03-30T19:11:30Z DEBUG Loading StateFile from '/var/lib/ipa/sysrestore/sysrestore.state' 2021-03-30T19:11:30Z DEBUG Saving StateFile to '/var/lib/ipa/sysrestore/sysrestore.state' 2021-03-30T19:11:30Z DEBUG Starting external process 2021-03-30T19:11:30Z DEBUG args=/bin/systemctl enable ntpd.service 2021-03-30T19:11:31Z DEBUG Process finished, return code=0 2021-03-30T19:11:31Z DEBUG stdout= 2021-03-30T19:11:31Z DEBUG stderr=Created symlink from /etc/systemd/system/multi-user.target.wants/ntpd.service to /usr/lib/systemd/system/ntpd.service. 2021-03-30T19:11:31Z DEBUG duration: 0 seconds 2021-03-30T19:11:31Z DEBUG [4/4]: starting ntpd 2021-03-30T19:11:31Z DEBUG Starting external process 2021-03-30T19:11:31Z DEBUG args=/bin/systemctl start ntpd.service 2021-03-30T19:11:31Z DEBUG Process finished, return code=0 2021-03-30T19:11:31Z DEBUG stdout= 2021-03-30T19:11:31Z DEBUG stderr= 2021-03-30T19:11:31Z DEBUG Starting external process 2021-03-30T19:11:31Z DEBUG args=/bin/systemctl is-active ntpd.service 2021-03-30T19:11:31Z DEBUG Process finished, return code=0 2021-03-30T19:11:31Z DEBUG stdout=active 2021-03-30T19:11:31Z DEBUG stderr= 2021-03-30T19:11:31Z DEBUG Start of ntpd.service complete 2021-03-30T19:11:31Z DEBUG duration: 0 seconds 2021-03-30T19:11:31Z DEBUG Done configuring NTP daemon (ntpd). 2021-03-30T19:11:31Z DEBUG Loading StateFile from '/var/lib/ipa/sysrestore/sysrestore.state' 2021-03-30T19:11:31Z DEBUG Configuring directory server (dirsrv). Estimated time: 30 seconds 2021-03-30T19:11:31Z DEBUG [1/45]: creating directory server instance 2021-03-30T19:11:31Z DEBUG Loading StateFile from '/var/lib/ipa/sysrestore/sysrestore.state' 2021-03-30T19:11:31Z DEBUG Saving StateFile to '/var/lib/ipa/sysrestore/sysrestore.state' 2021-03-30T19:11:31Z DEBUG Backing up system configuration file '/etc/sysconfig/dirsrv' 2021-03-30T19:11:31Z DEBUG Saving Index File to '/var/lib/ipa/sysrestore/sysrestore.index' 2021-03-30T19:11:31Z DEBUG dn: dc=example,dc=domain objectClass: top objectClass: domain objectClass: pilotObject dc: example info: IPA V2.0 2021-03-30T19:11:31Z DEBUG writing inf template 2021-03-30T19:11:31Z DEBUG [General] FullMachineName= serv.example.domain SuiteSpotUserID= dirsrv SuiteSpotGroup= dirsrv ServerRoot= /usr/lib64/dirsrv [slapd] ServerPort= 389 ServerIdentifier= EXAMPLE-DOMAIN Suffix= dc=example,dc=domain RootDN= cn=Directory Manager InstallLdifFile= /var/lib/dirsrv/boot.ldif inst_dir= /var/lib/dirsrv/scripts-EXAMPLE-DOMAIN 2021-03-30T19:11:31Z DEBUG calling setup-ds.pl 2021-03-30T19:11:31Z DEBUG Starting external process 2021-03-30T19:11:31Z DEBUG args=/usr/sbin/setup-ds.pl --silent --logfile - -f /tmp/tmp_Z6Bop 2021-03-30T19:21:33Z DEBUG Process finished, return code=1 2021-03-30T19:21:33Z DEBUG stdout=Process returned 1280 [21/03/30:19:21:33] - [Setup] Info Could not start the directory server using command '/bin/systemctl start dirsrv(a)EXAMPLE-DOMAIN.service'. The last line from the error log was '[30/Mar/2021:19:11:32.950196247 +0000] - INFO - import_main_offline - import userRoot: Import complete. Processed 1 entries in 1 seconds. (1.00 entries/sec) '. Error: Unknown error 1280 Could not start the directory server using command '/bin/systemctl start dirsrv(a)EXAMPLE-DOMAIN.service'. The last line from the error log was '[30/Mar/2021:19:11:32.950196247 +0000] - INFO - import_main_offline - import userRoot: Import complete. Processed 1 entries in 1 seconds. (1.00 entries/sec) '. Error: Unknown error 1280 [21/03/30:19:21:33] - [Setup] Fatal Error: Could not create directory server instance 'EXAMPLE-DOMAIN'. Error: Could not create directory server instance 'EXAMPLE-DOMAIN'. [21/03/30:19:21:33] - [Setup] Fatal Exiting . . . Log file is '-' Exiting . . . Log file is '-' 2021-03-30T19:21:33Z DEBUG stderr=Process returned 1280 2021-03-30T19:21:33Z DEBUG Traceback (most recent call last): File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 567, in start_creation run_step(full_msg, method) File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 557, in run_step method() File "/usr/lib/python2.7/site-packages/ipaserver/install/dsinstance.py", line 587, in __create_instance raise RuntimeError("failed to create DS instance %s" % e) RuntimeError: failed to create DS instance Command '/usr/sbin/setup-ds.pl --silent --logfile - -f /tmp/tmp_Z6Bop' returned non-zero exit status 1 2021-03-30T19:21:33Z DEBUG [error] RuntimeError: failed to create DS instance Command '/usr/sbin/setup-ds.pl --silent --logfile - -f /tmp/tmp_Z6Bop' returned non-zero exit status 1 2021-03-30T19:21:33Z DEBUG File "/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 178, in execute return_value = self.run() File "/usr/lib/python2.7/site-packages/ipapython/install/cli.py", line 319, in run return cfgr.run() File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 360, in run return self.execute() File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 386, in execute for rval in self._executor(): File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 431, in __runner exc_handler(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 460, in _handle_execute_exception self._handle_exception(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 450, in _handle_exception six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 421, in __runner step() File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 418, in <lambda> step = lambda: next(self.__gen) File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from value = gen.send(prev_value) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 655, in _configure next(executor) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 431, in __runner exc_handler(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 460, in _handle_execute_exception self._handle_exception(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 518, in _handle_exception self.__parent._handle_exception(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 450, in _handle_exception six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 515, in _handle_exception super(ComponentBase, self)._handle_exception(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 450, in _handle_exception six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 421, in __runner step() File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 418, in <lambda> step = lambda: next(self.__gen) File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from value = gen.send(prev_value) File "/usr/lib/python2.7/site-packages/ipapython/install/common.py", line 65, in _install for unused in self._installer(self.parent): File "/usr/lib/python2.7/site-packages/ipaserver/install/server/__init__.py", line 590, in main master_install(self) File "/usr/lib/python2.7/site-packages/ipaserver/install/server/install.py", line 250, in decorated func(installer) File "/usr/lib/python2.7/site-packages/ipaserver/install/server/install.py", line 783, in install setup_pkinit=not options.no_pkinit) File "/usr/lib/python2.7/site-packages/ipaserver/install/dsinstance.py", line 346, in create_instance self.start_creation(runtime=30) File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 567, in start_creation run_step(full_msg, method) File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 557, in run_step method() File "/usr/lib/python2.7/site-packages/ipaserver/install/dsinstance.py", line 587, in __create_instance raise RuntimeError("failed to create DS instance %s" % e) 2021-03-30T19:21:33Z DEBUG The ipa-server-install command failed, exception: RuntimeError: failed to create DS instance Command '/usr/sbin/setup-ds.pl --silent --logfile - -f /tmp/tmp_Z6Bop' returned non-zero exit status 1 2021-03-30T19:21:33Z ERROR failed to create DS instance Command '/usr/sbin/setup-ds.pl --silent --logfile - -f /tmp/tmp_Z6Bop' returned non-zero exit status 1 Uninstall log: [root@serv scripts-EXAMPLE-DOMAIN]# ipa-server-install --uninstall This is a NON REVERSIBLE operation and will delete all data and configuration! It is highly recommended to take a backup of existing data and configuration using ipa-backup utility before proceeding. Are you sure you want to continue with the uninstall procedure? [no]: yes WARNING: Failed to connect to Directory Server to find information about replication agreements. Uninstallation will continue despite the possible existing replication agreements. If this server is the last instance of CA, KRA, or DNSSEC master, uninstallation may result in data loss. Are you sure you want to continue with the uninstall procedure? [no]: yes Shutting down all IPA services Unconfiguring ntpd Configuring certmonger to stop tracking system certificates for KRA Configuring certmonger to stop tracking system certificates for CA Unconfiguring directory server ipaserver.install.dsinstance: ERROR Unable to find server cert nickname in /etc/dirsrv/slapd-EXAMPLE-DOMAIN/dse.ldif Removing IPA client configuration Unconfigured automount client failed: Command '/usr/sbin/ipa-client-automount --uninstall --debug' returned non-zero exit status 1 Removing Kerberos service principals from /etc/krb5.keytab Disabling client Kerberos and LDAP configurations IPA domain could not be found in /etc/sssd/sssd.conf and therefore not deleted Other domains than IPA domain found, IPA domain was removed from /etc/sssd/sssd.conf. nscd daemon is not installed, skip configuration nslcd daemon is not installed, skip configuration Client uninstall complete. The ipa-client-install command was successful Thanks in advance in looking at this.

4 5

IPA-Resetup
by Ronald Wimmer 12 Apr '21

12 Apr '21

Hi, is there a way to export all IPA configuration and import it on a new server? For instance to resetup everything from scratch or if purchasing forces us to switch to a completely different distro. Cheers, Ronald

2 3

using SSH with password authentication when NIS is still running with FreeIPA
by Robert Kudyba 07 Apr '21

07 Apr '21

We have freeipa-server-4.8.10-6.fc33 running on top of NIS and I'm trying to determine why ssh -k from any client is hanging and not even connecting. Does sssd need to be configured as in this 2013 training document? https://www.freeipa.org/images/1/10/Freeipa30_SSSD_OpenSSH_integration.pdf The goal is to eliminate NIS so perhaps the issue is running both concurrently? The good news is, thanks to tips here last week, all the NIS users migrated along with their passwords. And kinit on the Free IPA server even prompts to change their password. sssd is running: sssd_be[2329]: GSSAPI client step 1 sssd_be[2329]: GSSAPI client step 2 /etc/krb.conf includedir /etc/krb5.conf.d/ includedir /var/lib/sss/pubconf/krb5.include.d/ [logging] default = FILE:/var/log/krb5libs.log kdc = FILE:/var/log/krb5kdc.log admin_server = FILE:/var/log/kadmind.log [libdefaults] default_realm = ourserver.EDU dns_lookup_realm = true dns_lookup_kdc = true rdns = false ticket_lifetime = 24h forwardable = true udp_preference_limit = 0 default_ccache_name = KEYRING:persistent:%{uid} [realms] ourserver.EDU = { kdc = ourserver.edu:88 master_kdc = ourserver.edu:88 admin_server = ourserver.edu:749 default_domain = ourserver.edu pkinit_anchors = FILE:/var/lib/ipa-client/pki/kdc-ca-bundle.pem pkinit_pool = FILE:/var/lib/ipa-client/pki/ca-bundle.pem } [domain_realm] .ourserver.edu = ourserver.EDU ourserver.edu = ourserver.EDU ourserver.edu = ourserver.EDU [dbmodules] ourserver.EDU = { db_library = ipadb.so } [plugins] certauth = { module = ipakdb:kdb/ipadb.so enable_only = ipakdb } HBAC is wide open: ipa hbacrule-find -------------------- 2 HBAC rules matched -------------------- Rule name: allow_all User category: all Host category: all Service category: all Description: Allow all users to access any host from any host Enabled: TRUE Rule name: allow_systemd-user User category: all Host category: all Description: Allow pam_systemd to run user@.service to create a system user session Enabled: TRUE Here are some debug ssh server logs: Feb 8 16:23:27 ourserver sshd[381563]: debug1: Forked child 510395. Feb 8 16:23:27 ourserver sshd[510395]: debug1: Set /proc/self/oom_score_adj to 0 Feb 8 16:23:27 ourserver sshd[510395]: debug1: rexec start in 5 out 5 newsock 5 pipe 10 sock 11 Feb 8 16:23:27 ourserver sshd[510395]: debug1: inetd sockets after dupping: 4, 4 Feb 8 16:23:27 ourserver sshd[510395]: Connection from 150.108.68.26 port 45806 on 150.108.64.156 port 22 rdomain "" Feb 8 16:23:27 ourserver sshd[510395]: debug1: Local version string SSH-2.0-OpenSSH_8.4 Feb 8 16:23:27 ourserver sshd[510395]: debug1: Remote protocol version 2.0, remote software version OpenSSH_8.4 Feb 8 16:23:27 ourserver sshd[510395]: debug1: match: OpenSSH_8.4 pat OpenSSH* compat 0x04000000 Feb 8 16:23:27 ourserver sshd[510395]: debug1: SELinux support disabled [preauth] Feb 8 16:23:27 ourserver sshd[510395]: debug1: permanently_set_uid: 74/74 [preauth] Feb 8 16:23:27 ourserver sshd[510395]: debug1: list_hostkey_types: rsa-sha2-512,rsa-sha2-256,ssh-rsa,ecdsa-sha2-nistp256,ssh-ed25519 [preauth] Feb 8 16:23:27 ourserver sshd[510395]: debug1: SSH2_MSG_KEXINIT sent [preauth] Feb 8 16:23:27 ourserver sshd[510395]: debug1: SSH2_MSG_KEXINIT received [preauth] Feb 8 16:23:27 ourserver sshd[510395]: debug1: kex: algorithm: curve25519-sha256 [preauth] Feb 8 16:23:27 ourserver sshd[510395]: debug1: kex: host key algorithm: ecdsa-sha2-nistp256 [preauth] Feb 8 16:23:27 ourserver sshd[510395]: debug1: kex: client->server cipher: aes256-gcm(a)openssh.com MAC: <implicit> compression: none [preauth] Feb 8 16:23:27 ourserver sshd[510395]: debug1: kex: server->client cipher: aes256-gcm(a)openssh.com MAC: <implicit> compression: none [preauth] Feb 8 16:23:27 ourserver sshd[510395]: debug1: kex: curve25519-sha256 need=32 dh_need=32 [preauth] Feb 8 16:23:27 ourserver sshd[510395]: debug1: kex: curve25519-sha256 need=32 dh_need=32 [preauth] Feb 8 16:23:27 ourserver sshd[510395]: debug1: expecting SSH2_MSG_KEX_ECDH_INIT [preauth] Feb 8 16:23:27 ourserver sshd[510395]: debug1: rekey out after 4294967296 blocks [preauth] Feb 8 16:23:27 ourserver sshd[510395]: debug1: SSH2_MSG_NEWKEYS sent [preauth] Feb 8 16:23:27 ourserver sshd[510395]: debug1: Sending SSH2_MSG_EXT_INFO [preauth] Feb 8 16:23:27 ourserver sshd[510395]: debug1: expecting SSH2_MSG_NEWKEYS [preauth] Feb 8 16:23:27 ourserver sshd[510395]: debug1: SSH2_MSG_NEWKEYS received [preauth] Feb 8 16:23:27 ourserver sshd[510395]: debug1: rekey in after 4294967296 blocks [preauth] Feb 8 16:23:27 ourserver sshd[510395]: debug1: KEX done [preauth] Feb 8 16:23:27 ourserver sshd[510395]: debug1: userauth-request for user ouruser service ssh-connection method none [preauth] Feb 8 16:23:27 ourserver sshd[510395]: debug1: attempt 0 failures 0 [preauth] Feb 8 16:23:27 ourserver sshd[510395]: debug1: PAM: initializing for "ouruser" Feb 8 16:23:27 ourserver sshd[510395]: debug1: PAM: setting PAM_RHOST to "xx.xx.xx.xx" Feb 8 16:23:27 ourserver sshd[510395]: debug1: PAM: setting PAM_TTY to "ssh" Feb 8 16:23:27 ourserver sshd[510395]: debug1: userauth-request for user ouruser service ssh-connection method publickey [preauth] Feb 8 16:23:27 ourserver sshd[510395]: debug1: attempt 1 failures 0 [preauth] Feb 8 16:23:27 ourserver sshd[510395]: debug1: userauth_pubkey: test pkalg rsa-sha2-256 pkblob RSA SHA256:++6z7fhR603SUI0fWp7k7noRz1/41+9/hM/rWjNQlXk [preauth] Feb 8 16:23:27 ourserver sshd[510395]: debug1: temporarily_use_uid: 5879/200 (e=0/0) Feb 8 16:23:27 ourserver sshd[510395]: debug1: trying public key file /home/ouruser/.ssh/authorized_keys and ssh -k from a Fedora client, note the user I'm logged in as is NOT the same user I'm trying to log in to: ssh -vv -k ouruser@ourserver OpenSSH_8.4p1, OpenSSL 1.1.1i FIPS 8 Dec 2020 debug1: Reading configuration data /home/ouruser/.ssh/config debug1: /home/ouruser/.ssh/config line 1: Applying options for * debug1: Reading configuration data /etc/ssh/ssh_config debug1: Reading configuration data /etc/ssh/ssh_config.d/50-redhat.conf debug2: checking match for 'final all' host ourserver originally ourserver debug2: match not found debug1: Reading configuration data /etc/crypto-policies/back-ends/openssh.config debug1: configuration requests final Match pass debug1: re-parsing configuration debug1: Reading configuration data /home/ouruser/.ssh/config debug1: /home/ouruser/.ssh/config line 1: Applying options for * debug1: Reading configuration data /etc/ssh/ssh_config debug1: Reading configuration data /etc/ssh/ssh_config.d/50-redhat.conf debug2: checking match for 'final all' host ourserver originally ourserver debug2: match found debug1: Reading configuration data /etc/crypto-policies/back-ends/openssh.config debug1: auto-mux: Trying existing master debug1: Control socket "/home/ouruser/.ssh/sockets/ouruser@ourserver-22" does not exist debug2: resolving "ourserver" port 22 debug2: ssh_connect_direct debug1: Connecting to ourserver [150.108.64.156] port 22. debug1: Connection established. debug1: identity file /home/ouruser/.ssh/id_rsa type 0 debug1: identity file /home/ouruser/.ssh/id_rsa-cert type -1 debug1: identity file /home/ouruser/.ssh/id_dsa type -1 debug1: identity file /home/ouruser/.ssh/id_dsa-cert type -1 debug1: identity file /home/ouruser/.ssh/id_ecdsa type -1 debug1: identity file /home/ouruser/.ssh/id_ecdsa-cert type -1 debug1: identity file /home/ouruser/.ssh/id_ecdsa_sk type -1 debug1: identity file /home/ouruser/.ssh/id_ecdsa_sk-cert type -1 debug1: identity file /home/ouruser/.ssh/id_ed25519 type 3 debug1: identity file /home/ouruser/.ssh/id_ed25519-cert type -1 debug1: identity file /home/ouruser/.ssh/id_ed25519_sk type -1 debug1: identity file /home/ouruser/.ssh/id_ed25519_sk-cert type -1 debug1: identity file /home/ouruser/.ssh/id_xmss type -1 debug1: identity file /home/ouruser/.ssh/id_xmss-cert type -1 debug1: Local version string SSH-2.0-OpenSSH_8.4 debug1: Remote protocol version 2.0, remote software version OpenSSH_8.4 debug1: match: OpenSSH_8.4 pat OpenSSH* compat 0x04000000 debug2: fd 3 setting O_NONBLOCK debug1: Authenticating to ourserver:22 as 'ouruser' debug1: SSH2_MSG_KEXINIT sent debug1: SSH2_MSG_KEXINIT received debug2: local client KEXINIT proposal debug2: KEX algorithms: curve25519-sha256,curve25519-sha256(a)libssh.org ,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,ext-info-c debug2: host key algorithms: ecdsa-sha2-nistp256-cert-v01(a)openssh.com, ecdsa-sha2-nistp384-cert-v01(a)openssh.com, ecdsa-sha2-nistp521-cert-v01(a)openssh.com, sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com ,sk-ssh-ed25519-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com, rsa-sha2-256-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com ,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521, sk-ecdsa-sha2-nistp256@openssh.com,ssh-ed25519,sk-ssh-ed25519@openssh.com ,rsa-sha2-512,rsa-sha2-256,ssh-rsa debug2: ciphers ctos: aes256-gcm@openssh.com,chacha20-poly1305@openssh.com ,aes256-ctr,aes128-gcm(a)openssh.com,aes128-ctr debug2: ciphers stoc: aes256-gcm@openssh.com,chacha20-poly1305@openssh.com ,aes256-ctr,aes128-gcm(a)openssh.com,aes128-ctr debug2: MACs ctos: hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com, umac-128-etm@openssh.com,hmac-sha2-512-etm@openssh.com ,hmac-sha2-256,hmac-sha1,umac-128(a)openssh.com,hmac-sha2-512 debug2: MACs stoc: hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com, umac-128-etm@openssh.com,hmac-sha2-512-etm@openssh.com ,hmac-sha2-256,hmac-sha1,umac-128(a)openssh.com,hmac-sha2-512 debug2: compression ctos: none,zlib(a)openssh.com,zlib debug2: compression stoc: none,zlib(a)openssh.com,zlib debug2: languages ctos: debug2: languages stoc: debug2: first_kex_follows 0 debug2: reserved 0 debug2: peer server KEXINIT proposal debug2: KEX algorithms: curve25519-sha256,curve25519-sha256(a)libssh.org ,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256 debug2: host key algorithms: rsa-sha2-512,rsa-sha2-256,ssh-rsa,ecdsa-sha2-nistp256,ssh-ed25519 debug2: ciphers ctos: chacha20-poly1305(a)openssh.com ,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm(a)openssh.com, aes256-gcm(a)openssh.com debug2: ciphers stoc: chacha20-poly1305(a)openssh.com ,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm(a)openssh.com, aes256-gcm(a)openssh.com debug2: MACs ctos: umac-64-etm@openssh.com,umac-128-etm@openssh.com, hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com, hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com ,hmac-sha2-256,hmac-sha2-512,hmac-sha1 debug2: MACs stoc: umac-64-etm@openssh.com,umac-128-etm@openssh.com, hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com, hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com ,hmac-sha2-256,hmac-sha2-512,hmac-sha1 debug2: compression ctos: none,zlib(a)openssh.com debug2: compression stoc: none,zlib(a)openssh.com debug2: languages ctos: debug2: languages stoc: debug2: first_kex_follows 0 debug2: reserved 0 debug1: kex: algorithm: curve25519-sha256 debug1: kex: host key algorithm: ecdsa-sha2-nistp256 debug1: kex: server->client cipher: aes256-gcm(a)openssh.com MAC: <implicit> compression: none debug1: kex: client->server cipher: aes256-gcm(a)openssh.com MAC: <implicit> compression: none debug1: kex: curve25519-sha256 need=32 dh_need=32 debug1: kex: curve25519-sha256 need=32 dh_need=32 debug1: expecting SSH2_MSG_KEX_ECDH_REPLY debug1: Server host key: ecdsa-sha2-nistp256 SHA256:XUXhRKNYwxAGhwVIMa3fuo8uNMay6q4/qVeSWlQAOpM debug1: Host 'ourserver' is known and matches the ECDSA host key. debug1: Found key in /home/ouruser/.ssh/known_hosts:46 debug2: set_newkeys: mode 1 debug1: rekey out after 4294967296 blocks debug1: SSH2_MSG_NEWKEYS sent debug1: expecting SSH2_MSG_NEWKEYS debug1: SSH2_MSG_NEWKEYS received debug2: set_newkeys: mode 0 debug1: rekey in after 4294967296 blocks debug1: Will attempt key: /home/ouruser/.ssh/id_rsa RSA SHA256:++6z7fhR603SUI0fWp7k7noRz1/41+9/hM/rWjNQlXk debug1: Will attempt key: /home/ouruser/.ssh/id_dsa debug1: Will attempt key: /home/ouruser/.ssh/id_ecdsa debug1: Will attempt key: /home/ouruser/.ssh/id_ecdsa_sk debug1: Will attempt key: /home/ouruser/.ssh/id_ed25519 ED25519 SHA256:OoedE0VhmLFtl9nifW57Mca+GHDD0xKkJ2BCLGlV9xc debug1: Will attempt key: /home/ouruser/.ssh/id_ed25519_sk debug1: Will attempt key: /home/ouruser/.ssh/id_xmss debug2: pubkey_prepare: done debug1: SSH2_MSG_EXT_INFO received debug1: kex_input_ext_info: server-sig-algs=<ssh-ed25519, sk-ssh-ed25519(a)openssh.com ,ssh-rsa,rsa-sha2-256,rsa-sha2-512,ssh-dss,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521, sk-ecdsa-sha2-nistp256(a)openssh.com, webauthn-sk-ecdsa-sha2-nistp256(a)openssh.com> debug2: service_accept: ssh-userauth debug1: SSH2_MSG_SERVICE_ACCEPT received debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password,keyboard-interactive debug1: Next authentication method: gssapi-with-mic debug1: Unspecified GSS failure. Minor code may provide more information No Kerberos credentials available (default cache: KCM:) debug1: Unspecified GSS failure. Minor code may provide more information No Kerberos credentials available (default cache: KCM:) debug2: we did not send a packet, disable method debug1: Next authentication method: publickey debug1: Offering public key: /home/ouruser/.ssh/id_rsa RSA SHA256:++6z7fhR603SUI0fWp7k7noRz1/41+9/hM/rWjNQlXk debug2: we sent a publickey packet, wait for reply What am I missing? I appreciate the help last week! Rob

3 28

Retrieve service keytab with host keytab authentication?
by Peter Tselios 05 Apr '21

05 Apr '21

Hello, When I retrieve a service keytab, what I do is more or less this: ipa-getkeytab -a admin -P password -s service/client.example.com -k /path/to/keytab However, the ipa-getkeytab man page mention this: =========== -Y, --mech SASL mechanism to use if -D and -w are not specified. Use either GSSAPI or EXTERNAL. =========== So, if I am not mistaken, that means I can use another keytab in order to download the service/client.example.com one. Is that true? And if so, which keytab should I use and how? Because I cannot find an option that goes along with the -Y GSSAPI. Thanks

3 5

custom ssl cert install error
by Ashwath Kumar 01 Apr '21

01 Apr '21

Hello Team, Can you please help us to troubleshoot custom ssl certificate for freeipa service. Getting below error while trying. [root@ldap1 certs]# ipa-server-certinstall --http robosoftincom.crt robosoftincom.key Directory Manager password: Enter private key unlock password: The full certificate chain is not present in robosoftincom.crt, robosoftincom.key The ipa-server-certinstall command failed. [root@ldap1 certs]# Regards Ashwath ---------------------------------------------------- Robosoft Technologies - Emotion Engineering & Design Disclaimer: This email may contain confidential material. If you were not an intended recipient, please notify the sender and delete all copies. Emails to and from our network may be logged and monitored. This email and its attachments are scanned for virus by our scanners and are believed to be safe. However, no warranty is given that this email is free of malicious content or virus.

2 3

how to get xrdp to work with ipa users
by Rob Verduijn 01 Apr '21

01 Apr '21

Hi, I'm trying to figure out how to get xrdp to work with ipa user accounts. So far I can only login to an xrdp centos8 desktop with local user accounts. But as soon as I try to log in to the same machine with a ipa user account it fails. Anybody who knows how to get xrdp to work with ipa users ? Rob

2 3

ModuleNotFoundError: No module named 'ipapython'
by Stephan Boldt 31 Mar '21

31 Mar '21

Hello, I want to install IdM / FreeIPA on a RHEL 8.3 VM using Ansible running on a CentOS 8 VM. I installed the ansible-freeipa package und set up inventory and playbook as shown in the docs. Running the playbook then fails with the following message: TASK [ipaserver : Install - Server installation test] ********************************************************************************************** task path: /usr/share/ansible/roles/ipaserver/tasks/install.yml:46 An exception occurred during task execution. To see the full traceback, use -vvv. The error was: ModuleNotFoundError: No module named 'ipapython' fatal: [th-ha-thidm-01t.tdeidmpoc.thalia.de]: FAILED! => {"changed": false, "module_stderr": "Shared connection to 172.28.210.44 closed.\r\n", "module_stdout": "Traceback (most recent call last):\r\n File \"/root/.ansible/tmp/ansible-tmp-1617185879.276394-306034-84664824025072/AnsiballZ_ipaserver_test.py\", line 102, in <module>\r\n _ansiballz_main()\r\n File \"/root/.ansible/tmp/ansible-tmp-1617185879.276394-306034-84664824025072/AnsiballZ_ipaserver_test.py\", line 94, in _ansiballz_main\r\n invoke_module(zipped_mod, temp_path, ANSIBALLZ_PARAMS)\r\n File \"/root/.ansible/tmp/ansible-tmp-1617185879.276394-306034-84664824025072/AnsiballZ_ipaserver_test.py\", line 40, in invoke_module\r\n runpy.run_module(mod_name='ansible.modules.ipaserver_test', init_globals=None, run_name='__main__', alter_sys=True)\r\n File \"/usr/lib64/python3.6/runpy.py\", line 205, in run_module\r\n return _run_module_code(code, init_globals, run_name, mod_spec)\r\n File \"/usr/lib64/python3.6/runpy.py\", line 96, in _run_module_code\r\n mod_name, mod_spec, pkg_name, script_name)\r\n File \"/usr/lib64/python3.6/runpy.py\", line 85, in _run_code\r\n exec(code, run_globals)\r\n File \"/tmp/ansible_ipaserver_test_payload_tlzfemmq/ansible_ipaserver_test_payload.zip/ansible/modules/ipaserver_test.py\", line 215, in <module>\r\n File \"/tmp/ansible_ipaserver_test_payload_tlzfemmq/ansible_ipaserver_test_payload.zip/ansible/module_utils/ansible_ipa_server.py\", line 48, in <module>\r\nModuleNotFoundError: No module named 'ipapython'\r\n", "msg": "MODULE FAILURE\nSee stdout/stderr for the exact error", "rc": 1} I've then installed the ipa-python-compat package as this was the only ipapython like package that I was able to find but it didn't fix the problem. When trying to import the module from the python CLI it shows no errors: # python3 Python 3.6.8 (default, Aug 24 2020, 17:57:11) [GCC 8.3.1 20191121 (Red Hat 8.3.1-5)] on linux Type "help", "copyright", "credits" or "license" for more information. >>> import ipapython >>> Does anyone have an Idea what might be the problem? Thanks in advance! regards Stephan

2 2

FreeIPA 4.9.3 released
by Alexander Bokovoy 31 Mar '21

31 Mar '21

1 0

← Newer
1
2
3
4
5
6
7
8
9
10
Older →

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users March 2021