FreeIPA-users March 2021

freeipa-users@lists.fedorahosted.org

59 participants
93 discussions

SRV entries remain after removing replica
by Kees Bakker 15 Mar '21

15 Mar '21

Hi, After removing one of the replicas the SRV records in DNS remained. I'm talking about _kpasswd._udp _kerberos._udp _kerberos._tcp _kerberos-master._udp etc Two questions. 1. Is this a known problem? 2. Is there a (simple?) command to remove these SRV entries? I can remove them manually, so it's not a big deal. -- Kees

2 2

integrated Samba to respond under different FQDN - how?
by lejeczek 15 Mar '21

15 Mar '21

Hi guys. I'd like to ask whether Samba should be able to respond under/via a FQDN different from IPA's default. I use word "should" deliberately as I have Samba do that, with: - ipa-server-4.8.7-14.module_el8.3.0+698+d6d67052.x86_64 - samba-4.13.4-1.el8.x86_64 Eg. IPA is: "priv.my.dom.private" and its DNS manages "us.private" and Samba is completely fine serving Win10 non-enrolled clients under "us.private". I did not do any "extra" tweaking, certainly I do not recall, only usual DNS bits. Now I'm hoping to have the same with: - ipa-server-4.9.0-1.module_el8.4.0+639+a88aab78.x86_64 - samba-4.13.4-1.el8.x86_64 but having, I believe virtually the same setup, Samba is not happy. n Before I paste any logs, etc. - I guess the question for an expert, if one happens to read this is - should it work in as well or that functionality was "taken away" in 4.9. many thanks, L

1 0

different sssd.conf among masters
by lejeczek 15 Mar '21

15 Mar '21

Hi guys. What each option in sssd.conf mean & does I can try to learn from man pages, but I'd like to ask why would there be differences between masters? A) first master [domain/priv.my.dom.private] access_provider = ipa auth_provider = ipa cache_credentials = True chpass_provider = ipa id_provider = ipa ipa_domain = priv.my.dom.private ipa_hostname = drunk.priv.my.dom.private ipa_server = drunk.priv.my.dom.private ipa_server_mode = True krb5_store_password_if_offline = True ldap_tls_cacert = /etc/ipa/ca.crt B) next master [domain/priv.my.dom.private] access_provider = ipa auth_provider = ipa autofs_provider = ipa cache_credentials = True chpass_provider = ipa hostid_provider = ipa id_provider = ipa ipa_domain = priv.my.dom.private ipa_hostname = sucker.priv.my.dom.private ipa_server_mode = True ipa_server = sucker.priv.my.dom.private krb5_store_password_if_offline = True ldap_tls_cacert = /etc/ipa/ca.crt session_provider = ipa subdomains_provider = ipa sudo_provider = ipa Both config are result of 'ipa-server/replica' process, no manual interventions and both systems virtually identical in terms of soft/hardware. many thanks, L.

2 1

ipa-sidgen - when to run
by lejeczek 13 Mar '21

13 Mar '21

Hi guys. When integrating Samba with 'ipa-adtrust-install' the process asks: Do you want to run the ipa-sidgen task? I wonder why that is optional? Every subsequent run 'ipa-adtrust-install' or when repeated on other masters does not pause with that question. many thanks, L.

2 3

Joining Windows 7 system to a FreeIPA domain/realm
by dd4321 Dey 13 Mar '21

13 Mar '21

Hi I am trying to join a Windows 7 system to a FreeIPA domain/realm [mydomain.net] rather than being a member of workgroup. So i have added a SRV record to the dnszone [mydomain.net] DNS Resource Records: mydomain.net. Record name Record Type Data .... .... _ldap._tcp.dc._msdcs SRV 0 100 389 idm.mydomain.net. (https://imgur.com/a/7TouKjs) I get the desired SRV record by digging the LDAP domain # dig SRV _ldap._tcp.dc._msdcs.mydomain.net. (https://imgur.com/a/4TCDFuZ) However, when i try to join the domain, i encounter following error: ++++++++++++++++++++++++++++++++++++++++++++++++++ DNS was successfully queried for the service location (SRV) resource record used to locate a domain controller for domain "mydomain.net": The query was for the SRV record for _ldap._tcp.dc._msdcs.mydomain.net The following domain controllers were identified by the query: idm.mydomain.net However no domain controllers could be contacted. Common causes of this error include: - Host (A) or (AAAA) records that map the names of the domain controllers to their IP addresses are missing or contain incorrect addresses. - Domain controllers registered in DNS are not connected to the network or are not running. ++++++++++++++++++++++++++++++++++++++++++++++++++ The A record for the domain controller mydomain.net is resolved correctly as can be seen from the output of dig. I can confirm domain controller is running and is connected to the network. Although, it is an Windows 7 issue, i just like to know shall i have to add some more configuration in FreeIPA/LDAP side ? Regards

2 5

ssh login - Illegal empty authtok for user & 7 (Authentication failure)
by lejeczek 13 Mar '21

13 Mar '21

Hi guys I have a fresh re/deployment and users cannot ssh with passwords. Snippets of some logs. ... (2021-03-12 23:16:00): [be[priv.my.dom.private]] [remove_tree_with_ctx] (0x0020): Cannot open /var/lib/sss/deskprofile/priv.my.dom.private/me: [2]: No such file or directory (2021-03-12 23:16:00): [be[priv.my.dom.private]] [remove_tree_with_ctx] (0x0020): Cannot open /var/lib/sss/deskprofile/priv.my.dom.private/me: [2]: No such file or directory (2021-03-12 23:18:33): [be[priv.my.dom.private]] [krb5_auth_send] (0x0020): Illegal empty authtok for user [me(a)priv.my.dom.private] (2021-03-12 23:27:56): [be[priv.my.dom.private]] [krb5_auth_send] (0x0020): Illegal empty authtok for user [me(a)priv.my.dom.private] (2021-03-13 3:10:50): [be[priv.my.dom.private]] [sysdb_range_create] (0x0040): Invalid range, skipping. Expected that either the secondary base RID or the SID of the trusted domain is set, but not both or none of them. (2021-03-13 7:10:50): [be[priv.my.dom.private]] [sysdb_range_create] (0x0040): Invalid range, skipping. Expected that either the secondary base RID or the SID of the trusted domain is set, but not both or none of them. (2021-03-13 9:08:25): [be[priv.my.dom.private]] [krb5_auth_send] (0x0020): Illegal empty authtok for user [me(a)priv.my.dom.private] (2021-03-13 9:28:16): [be[priv.my.dom.private]] [krb5_auth_send] (0x0020): Illegal empty authtok for user [me(a)priv.my.dom.private] .. of krb5_child.log .. ailed] (2021-03-13 9:27:42): [krb5_child[77868]] [map_krb5_error] (0x0020): 1849: [-1765328353][Decrypt integrity check failed] (2021-03-13 9:27:48): [krb5_child[77881]] [get_and_save_tgt] (0x0020): 1720: [-1765328353][Decrypt integrity check failed] (2021-03-13 9:27:48): [krb5_child[77881]] [map_krb5_error] (0x0020): 1849: [-1765328353][Decrypt integrity check failed] (2021-03-13 9:29:07): [krb5_child[78072]] [get_and_save_tgt] (0x0020): 1720: [-1765328353][Decrypt integrity check failed] (2021-03-13 9:29:07): [krb5_child[78072]] [map_krb5_error] (0x0020): 1849: [-1765328353][Decrypt integrity check failed] ... I'm on CentOS Stream with ipa-server-4.9.0. "Funny" thing is that very first domain deployment worked but I had 'idranges' created which I realized I needed different. So I quickly 'uninstalled' and started new with '--idstart'. But since then I 'uninstalled' again and again installed without '--idstart'. At this point I can re-install no matter how and the problem persists, ssh with password does not work. many thanks, L.

1 0

Adding OTP token without using IPA UI
by dd4321 Dey 12 Mar '21

12 Mar '21

Hi Is it possible to add/generate OTP token without using IPA user interface ? Due to security reasons, i don't want to give access to IPA web interface to users. Recently, i have configured password manager which integrates OpenLDAP/IPA server. So each user can change their password using password manager eliminating needs for accessing IPA web UI. In the same way, is it possible to do the same i.e generating OTP token using any third party application ? Regards

3 3

ipantsecurityidentifier missing if users created with --uid
by lejeczek 12 Mar '21

12 Mar '21

Hi guys My IPA does not inject ipantsecurityidentifier (maybe more?) when '--uid' is used. Why is that and how to have or make IPA do 'ipantsecurityidentifier' - would anybody know? many thanks, L.

3 5

Replication broken
by Antoine Gatineau 12 Mar '21

12 Mar '21

Hello, I'm on freeipa 4.9.0 on CentOS Stream. (1 master and 1 replica) I have noticed that my replication is broken. Unfortunatly, I don't know since when... First Question, can it b fixed? Second question, is it possible to peform a restore (on one node, both nodes) to fix the issue. I recently upgraded from CentOS 8 to CentOS Stream (ipa with it). So can I restore from a previous version? Here are some snipets of what I see. $ sudo ipa-healthcheck Internal server error HTTPSConnectionPool(host='ipa-master-tmp.empire.lan', port=443): Max retries exceeded with url: /ca/rest/certs/search?size=3 (Caused by NewConnectionError('<urllib3.connection.VerifiedHTTPSConnection object at 0x7fa49f3df320>: Failed to establish a new connection: [Errno -2] Name or service not known',)) [ { "source": "pki.server.healthcheck.clones.connectivity_and_data", "check": "ClonesConnectivyAndDataCheck", "result": "ERROR", "uuid": "66815b82-56d9-43a4-9035-78333c5cb5cd", "when": "20210308162643Z", "duration": "0.364202", "kw": { "status": "ERROR: pki-tomcat : Internal error testing CA clone. Host: ipa-master-tmp.empire.lan Port: 443" } }, { "source": "ipahealthcheck.ds.replication", "check": "ReplicationCheck", "result": "WARNING", "uuid": "55addd45-6440-4317-8d0b-8eb0d516bd4e", "when": "20210308162645Z", "duration": "0.353734", "kw": { "key": "DSREPLLE0002", "items": [ "Replication", "Conflict Entries" ], "msg": "There were 6 conflict entries found under the replication suffix \"dc=empire,dc=lan\"." } } ] pki-tomcatd seems ok : $ sudo journalctl -u pki-tomcatd@pki-tomcat -- Logs begin at Mon 2021-03-08 17:24:39 CET, end at Mon 2021-03-08 17:35:01 CET. -- Mar 08 17:25:01 ipa-master.empire.lan systemd[1]: Starting PKI Tomcat Server pki-tomcat... Mar 08 17:25:04 ipa-master.empire.lan java[1613]: usr/lib/api/apiutil.c Could not open /run/lock/opencryptoki/LCK..APIlock Mar 08 17:25:05 ipa-master.empire.lan server[1716]: Java virtual machine used: /usr/lib/jvm/java-1.8.0-openjdk/bin/java Mar 08 17:25:05 ipa-master.empire.lan server[1716]: classpath used: /usr/share/tomcat/bin/bootstrap.jar:/usr/share/tomcat/bin/tomcat- juli.jar:/usr/share/java/ant.jar:/usr/share/java/ant-la> Mar 08 17:25:05 ipa-master.empire.lan server[1716]: main class used: org.apache.catalina.startup.Bootstrap Mar 08 17:25:05 ipa-master.empire.lan server[1716]: flags used: -Dcom.redhat.fips=false Mar 08 17:25:05 ipa-master.empire.lan server[1716]: options used: -Dcatalina.base=/var/lib/pki/pki-tomcat -Dcatalina.home=/usr/share/tomcat -Djava.endorsed.dirs= -Djava.io.tmpdir=/var/lib/> Mar 08 17:25:05 ipa-master.empire.lan server[1716]: arguments used: start Mar 08 17:25:05 ipa-master.empire.lan ipa-pki-wait-running[1717]: pki.client: /usr/libexec/ipa/ipa-pki-wait-running:63: The subsystem in PKIConnection.__init__() has been deprecated (https> Mar 08 17:25:05 ipa-master.empire.lan ipa-pki-wait-running[1717]: ipa-pki-wait-running: Created connection http://ipa-master.empire.lan:8080/ca Mar 08 17:25:05 ipa-master.empire.lan ipa-pki-wait-running[1717]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='ipa- master.empire.lan', port=8080): Max retries exceeded> Mar 08 17:25:06 ipa-master.empire.lan java[1716]: usr/lib/api/apiutil.c Could not open /run/lock/opencryptoki/LCK..APIlock Mar 08 17:25:06 ipa-master.empire.lan server[1716]: WARNING: Some of the specified [protocols] are not supported by the SSL engine and have been skipped: [[TLSv1, TLSv1.1]] Mar 08 17:25:07 ipa-master.empire.lan ipa-pki-wait-running[1717]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='ipa- master.empire.lan', port=8080): Read timed out. (rea> Mar 08 17:25:09 ipa-master.empire.lan ipa-pki-wait-running[1717]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='ipa- master.empire.lan', port=8080): Read timed out. (rea> Mar 08 17:25:11 ipa-master.empire.lan ipa-pki-wait-running[1717]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='ipa- master.empire.lan', port=8080): Read timed out. (rea> Mar 08 17:25:12 ipa-master.empire.lan ipa-pki-wait-running[1717]: ipa-pki-wait-running: Success, subsystem ca is running! Mar 08 17:25:12 ipa-master.empire.lan systemd[1]: Started PKI Tomcat Server pki-tomcat. Best Antoine

2 3

How to automatically manage a service before host creation
by Nelson LAMEIRAS 11 Mar '21

11 Mar '21

Hi all, I'm looking for a way to automatize certificate creation for services hosted on servers inside a highly available cluster. exemple: we have the following setup : - http/serverha (an IPA service that will be highly available) - server01 (not kickstarted yet) - server02 (not kickstarted yet) Both server01 and server02 must be able to get http/serverha certificate when kickstarted, but I find this impossible because they are not part of "managed by" hosts configured in service http/serverha I'm forced to add manually each host to "managed by" section of the service, but only after it is kickstarted, which ruins my automatation goal I hope this explanation is clear. 1 - Is there an elegant (ie. official) way to automaticaly manage this situation ? 2 - My intuitive solution would be to use automember to put server01 and server02 inside the same hostgroup and to able to add hostsgroups to the "managed by" section on a service, but this is not possible on my current setup (IPA v4.6.8) - only adding hosts (not hostgroups!) are allowed. Could this be a legitimate RFE I should write? Please note that I'm not suppose to know beforehand the precise name of serverXY ? it could be server24... ;) Thanks for your answers, regards, Nelson

2 1

← Newer
1
2
3
4
5
6
7
8
9
10
Older →

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users March 2021