FreeIPA-users May 2021

freeipa-users@lists.fedorahosted.org

46 participants
88 discussions

Changing directory manager password
by Ian Pilcher 29 Jul '21

29 Jul '21

Maybe it's just me, but I still find the documentation on this subject confusing. (This is probably because the docs seem to be telling me that I don't need to do anything beyond the actual password change, and I don't trust answers that seem too easy.) I running a single-node IPA 4.6.8 on RHEL 7. The actual password change with ldapmodify[1] is simple enough. Am I reading the FreeIPA documentation[2] correctly, that I don't need to perform any other steps? Thanks! [1] https://directory.fedoraproject.org/docs/389ds/howto/howto-resetdirmgrpassw… [2] https://www.freeipa.org/page/Howto/Change_Directory_Manager_Password -- ======================================================================== Ian Pilcher Sr. Principal Product Manager +1 469 892-8704 Red Hat Cloud Platforms ========================================================================

5 7

FreeIPA server packages upgrade best practice
by Suchismita Panda 16 Jul '21

16 Jul '21

Hi, I would like to know the best practice for patching FreeIPA-Server packages. We generally have daily patching enabled in our servers. Will it be a good idea to do automatic patching of FreeIPA-Server packages? If we want to restrict the FreeIPA-Server packages from automatomatic upgrade and rather keep it for manual upgrade, what are the packages we should hold back with a version restriction? And how frequently should we do the manual upgrade? If the FreeIPA-client packages are upgraded regularly by daily patching(yum-cron or unattended upgrade) will there be any problem with authentication, if the FreeIPA-Servers are behind version upgrade? We have two FreeIPA environments, one with CentOS7 and another with CentOS8. And we have FreeIPA clients mostly with Ubuntu(18 and 20) and CentOS (7 and 8). Any help and guidance is appreciated. Thanks Suchi

4 7

healthcheck complains about a removed replica
by Kees Bakker 13 Jul '21

13 Jul '21

Hi, After installing a new replica and running /usr/bin/ipa-healthcheck --source pki.server.healthcheck.clones.connectivity_and_data I'm getting this error keyctl_search: Required key not available Enter password for Internal Key Storage Token: Internal server error HTTPSConnectionPool(host='iparep3.ghs.nl', port=443): Max retries exceeded with url: /ca/rest/certs/search?size=3 (Caused by NewConnectionError('<urllib3.connection.VerifiedHTTPSConnection object at 0x7fc473262a90>: Failed to establish a new connection: [Errno 113] No route to host',)) [ { "source": "pki.server.healthcheck.clones.connectivity_and_data", "check": "ClonesConnectivyAndDataCheck", "result": "ERROR", "uuid": "c2f3ec1d-494b-4f6a-b6e3-0e38108f2005", "when": "20210528150818Z", "duration": "30.348789", "kw": { "status": "ERROR: pki-tomcat : Internal error testing CA clone. Host: iparep3.ghs.nl Port: 443" } } ] First, it is asking for a password, and I have no clue for what. I've tried the admin password and the Directory Manager password. It makes no difference. Second, it tries to connect to a replica that was removed several months ago. Both ipa-replica-manage list and ipa-csreplica-manage show the correct list of masters that we currently have. Where does ipa-healthcheck get the information from to query the removed replica? BTW. Two replica run CentOS 8 Stream, and one runs CentOS 7. The first two give this healthcheck error, the centos7 master does not. -- Kees

5 19

FreeIPA Upgrade F31 -> F32: usr/lib/api/apiutil.c Could not open /run/lock/opencryptoki/LCK..APIlock
by Anthony Joseph Messina 01 Jul '21

01 Jul '21

After upgrading FreeIPA from F31 to F32, on startup I now see a lot of these errors from certmonger, ns-slapd, java, etc. May 08 17:57:28 certmonger[38]: usr/lib/api/apiutil.c Could not open /run/lock/opencryptoki/LCK..APIlock May 08 17:57:30 ns-slapd[67]: usr/lib/api/apiutil.c Could not open /run/lock/opencryptoki/LCK..APIlock May 08 17:57:33 dogtag-ipa-renew-agent-submit[143]: usr/lib/api/apiutil.c Could not open /run/lock/opencryptoki/LCK..APIlock May 08 17:57:42 java[640]: usr/lib/api/apiutil.c Could not open /run/lock/opencryptoki/LCK..APIlock The server seems to come up without issue, but can you point me in the right direction to resolve these errors? freeipa-server-4.8.6-1.fc32.x86_64 opendnssec-2.1.6-5.fc32.x86_64 opencryptoki-3.13.0-1.fc32.x86_64 I've installed a fresh F32 freeipa-server (on a test domain) and I don't see these errors. Thanks. -A -- Anthony - https://messinet.com F9B6 560E 68EA 037D 8C3D D1C9 FF31 3BDB D9D8 99B6

7 9

Invalid CA chain after ca chain renewal
by Philipp Leusmann 09 Jun '21

09 Jun '21

Hi, I have just renewed freeipas externally signed CA certificate using 'ipa-cacert-manage renew --external-ca' Given the new CSR contains the same key elements as the previous one, I already had to ignore the duplicate while signing. Maybe that's the cause for the issues following? After renewing I now have the new and the old CA key in /etc/ipa/ca.crt and also in exported certificate chains which for example nginx cannot handle properly. 1) Did I do anything wrong during renewal? 2) how can I remove the previous CA cert? Thanks in advance, Philipp

2 2

python3-ipaserver installutils.py missing IPA_MODULES list
by iulian roman 04 Jun '21

04 Jun '21

Hello everybody, I do not know if this is the right place to mentioned, but maybe there will be someone who can redirect me to the right list or support channel. On RHEL 8.3 , the latest python3-ipaserver package (python3-ipaserver-4.9.2-3.module+el8.4.0+10412+5ecb5b37) does not contain the IPA_MODULES list in the installutils.py package. Due to that, the ansible freeipa role will fail. Can you please suggest whom I should contact for that or where should it be reported ?

2 3

ipa-replica-install failing - operations error: the changelog directory already exists and is not empty
by Sinh Lam 03 Jun '21

03 Jun '21

Hi Everyone - I’m running into this odd issue I can’t seem to find a resolution to. Long story short, my IPA master was on a system that had a power failure. Upon bring up, the dirsrv failed to start up due to a zero byte dse.ldif file. Used a “backup” of the file and my master seemed to have came back up ok however replication seems to have stopped working. When I noticed that replication wasn’t working from the replicas to the master I went digging and found this (which led me to try to recover by removing the old replicas and trying to do a reinstall) : replica.domain.net: replica last update status: Error (6) Replication error acquiring replica: Unable to acquire replica: there is no replicated area on the consumer server. Replication is aborting. (no such replica) last update ended: 2021-05-20 15:29:28+00:00 The above “last update” corresponds with the power outage that took down the IPA master. I’m trying to re-initialize the replication by doing a reinstall of the replica server but I’m failing with the following error : Disabled p11-kit-proxy Configuring directory server (dirsrv). Estimated time: 30 seconds [1/42]: creating directory server instance [2/42]: configure autobind for root [3/42]: tune ldbm plugin [4/42]: stopping directory server [5/42]: updating configuration in dse.ldif [6/42]: starting directory server [7/42]: adding default schema [8/42]: enabling memberof plugin [9/42]: enabling winsync plugin [10/42]: configure password logging [11/42]: configuring replication version plugin [12/42]: enabling IPA enrollment plugin [13/42]: configuring uniqueness plugin [14/42]: configuring uuid plugin [15/42]: configuring modrdn plugin [16/42]: configuring DNS plugin [17/42]: enabling entryUSN plugin [18/42]: configuring lockout plugin [19/42]: configuring topology plugin [20/42]: creating indices [21/42]: enabling referential integrity plugin [22/42]: configuring certmap.conf [23/42]: configure new location for managed entries [24/42]: configure dirsrv ccache and keytab [25/42]: enabling SASL mapping fallback [26/42]: restarting directory server [27/42]: creating DS keytab [28/42]: ignore time skew for initial replication [29/42]: setting up initial replication [error] DatabaseError: Operations error: The changelog directory [/var/lib/dirsrv/slapd-REPLICA-DOMAIN-NET/cldb] already exists and is not empty. Please choose a directory that does not exist or is empty. Your system may be partly configured. Run /usr/sbin/ipa-server-install --uninstall to clean up. Operations error: The changelog directory [/var/lib/dirsrv/slapd-REPLICA-DOMAIN-NET/cldb] already exists and is not empty. Please choose a directory that does not exist or is empty. The ipa-replica-install command failed. See /var/log/ipareplica-install.log for more information I’ve since done several uninstalls and verified at each uninstall the /var/lib/dirsrv directory is empty. Any pointers on how to get past this issue would be great since I have about 10 more replicas to get back up. Thanks. Sinh

3 5

custom tls certtificate for web UI
by iulian roman 01 Jun '21

01 Jun '21

Hello everybody, I tried to change the WEB UI certificate with a custom certificate signed by our internal CA. The custom certificate was provided as a bundle (certificate + intermediates). The root ca which signs the intermediate was added in the truststore with ipa-cacert-manage. Everything was successful but when I accessed the Web UI I noticed that IPA provides only the certificate, not the full chain, which makes the certificate not trusted by the browsers (they are configured to trust only our internal root ca). Is there any method to configure IPA/Idm to provide the full certificate chain (certificate + intermediate) to the http clients or is there anything I configured wrong ?

2 2

IPA Reinstall
by Robert.Mattson＠L3Harris.com 01 Jun '21

01 Jun '21

Dear Community, I'd like to uninstall and reinstall IPA from a CentOS box because its easier than reinstalling the OS completely. We have a number of replicas, and this host is installed using ipa-client-install and then ipa-replica-install. To remove it, I backup some data like /var/kerberos/krb5kdc/{cacert.pem,kd*} and /etc/httpd/conf/password.conf and then run '/usr/sbin/ipa-server-install --uninstall -U --ignore-topology-disconnect'. I then sed '/Environment=K/d', '/ExecStartPre/d', '/ExecStopPost/d' /etc/systemd/system/httpd.service I recreate the host-account on another replica using ipa host-add, then ipa hostgroup-add-member. On the now-removed host, I do some housekeeping like restoring the backed up files and then I run; /usr/sbin/ipa-client-install \ --password=${otp} \ --mkhomedir \ --no-ntp \ --unattended \ --domain=realm.name \ --realm=REALM.NAME \ --ca-cert-file=/etc/pki/ca-trust/source/ca.crt then /usr/sbin/ipa-replica-install \ --dirsrv-cert-file=/etc/pki/tls/private/ipa.pkcs12 \ --http-cert-file=/etc/pki/tls/private/ipa.pkcs12 \ --dirsrv-pin=pwd \ --http-pin=pwd \ --unattended \ --no-pkinit \ --no-ntp I seem to get the following keytab request problem followed by dirsrv failure. from ipa-replica-install (4.6.4-10.el7.centos.3.x86_64). If I upgrade to 4.6.8-5.el7.centos.4.noarch.rpm, I get the same problem.[1] On serverb, the host which receives the binding request for the reinstall, I get permission denied the bind dn "" does not have permission in dirsrv error log...? Does anyone have any thoughts, Cheers and many thanks in advance, Rob [1] 2021-05-26T02:50:56Z DEBUG Backing up system configuration file '/etc/httpd/conf.d/ipa.conf' 2021-05-26T02:50:56Z DEBUG -> Not backing up - '/etc/httpd/conf.d/ipa.conf' doesn't exist 2021-05-26T02:50:56Z DEBUG Backing up system configuration file '/etc/httpd/conf.d/ipa-rewrite.conf' 2021-05-26T02:50:56Z DEBUG -> Not backing up - '/etc/httpd/conf.d/ipa-rewrite.conf' doesn't exist 2021-05-26T02:50:56Z DEBUG duration: 0 seconds 2021-05-26T02:50:56Z DEBUG [10/21]: setting up httpd keytab 2021-05-26T02:50:56Z DEBUG raw: service_add(u'HTTP/servera.system(a)REALM.NAME', force=True, version=u'2.230') 2021-05-26T02:50:56Z DEBUG service_add(ipapython.kerberos.Principal('HTTP/servera.system(a)REALM.NAME'), force=True, all=False, raw=False, version=u'2.230', no_members=False) 2021-05-26T02:50:56Z DEBUG flushing ldapi://%2Fvar%2Frun%2Fslapd-REALM-NAME.socket from SchemaCache 2021-05-26T02:50:56Z DEBUG retrieving schema for SchemaCache url=ldapi://%2Fvar%2Frun%2Fslapd-REALM-NAME.socket conn=<ldap.ldapobject.SimpleLDAPObject instance at 0x7f0d29f50368> 2021-05-26T02:50:57Z DEBUG raw: host_show(u'servera.system', version=u'2.230') 2021-05-26T02:50:57Z DEBUG host_show(u'servera.system', rights=False, all=False, raw=False, version=u'2.230', no_members=False) 2021-05-26T02:50:57Z DEBUG Backing up system configuration file '/var/lib/ipa/gssproxy/http.keytab' 2021-05-26T02:50:57Z DEBUG -> Not backing up - '/var/lib/ipa/gssproxy/http.keytab' doesn't exist 2021-05-26T02:50:57Z DEBUG Starting external process 2021-05-26T02:50:57Z DEBUG args=/usr/sbin/ipa-getkeytab -k /var/lib/ipa/gssproxy/http.keytab -p HTTP/servera.system(a)REALM.NAME<mailto:HTTP/servera.system@REALM.NAME> -H ldapi://%2Fvar%2Frun%2Fslapd-REALM-NAME.socket -Y EXTERNAL 2021-05-26T02:50:57Z DEBUG Process finished, return code=9 2021-05-26T02:50:57Z DEBUG stdout= 2021-05-26T02:50:57Z DEBUG stderr=Failed to parse result: unsupported extended operation Retrying with pre-4.0 keytab retrieval method... Failed to parse result: unsupported extended operation Failed to get keytab! Failed to get keytab 2021-05-26T02:50:57Z DEBUG Traceback (most recent call last): File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 570, in start_creation run_step(full_msg, method) File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 560, in run_step method() File "/usr/lib/python2.7/site-packages/ipaserver/install/httpinstance.py", line 637, in request_service_keytab super(HTTPInstance, self).request_service_keytab() File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 742, in request_service_keytab self.run_getkeytab(self.api.env.ldap_uri, self.keytab, self.principal) File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 732, in run_getkeytab ipautil.run(args, nolog=nolog) File "/usr/lib/python2.7/site-packages/ipapython/ipautil.py", line 562, in run raise CalledProcessError(p.returncode, arg_string, str(output)) CalledProcessError: Command '/usr/sbin/ipa-getkeytab -k /var/lib/ipa/gssproxy/http.keytab -p HTTP/servera.system(a)REALM.NAME<mailto:HTTP/servera.system@REALM.NAME> -H ldapi://%2Fvar%2Frun%2Fslapd-REALM-NAME.socket -Y EXTERNAL' returned non-zero exit status 9 2021-05-26T02:50:57Z DEBUG [error] CalledProcessError: Command '/usr/sbin/ipa-getkeytab -k /var/lib/ipa/gssproxy/http.keytab -p HTTP/servera.system(a)REALM.NAME<mailto:HTTP/servera.system@REALM.NAME> -H ldapi://%2Fvar%2Frun%2Fslapd-REALM-NAME.socket -Y EXTERNAL' returned non-zero exit status 9 2021-05-26T02:50:57Z DEBUG File "/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 178, in execute return_value = self.run() File "/usr/lib/python2.7/site-packages/ipapython/install/cli.py", line 319, in run return cfgr.run() File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 364, in run return self.execute() exc_handler(exc_info) <snip /> File "/usr/lib/python2.7/site-packages/ipapython/install/common.py", line 65, in _install for unused in self._installer(self.parent): File "/usr/lib/python2.7/site-packages/ipaserver/install/server/__init__.py", line 622, in main replica_install(self) File "/usr/lib/python2.7/site-packages/ipaserver/install/server/replicainstall.py", line 406, in decorated func(installer) File "/usr/lib/python2.7/site-packages/ipaserver/install/server/replicainstall.py", line 1487, in install fstore=fstore) File "/usr/lib/python2.7/site-packages/ipaserver/install/server/replicainstall.py", line 173, in install_http subject_base=config.subject_base, master_fqdn=config.master_host_name) File "/usr/lib/python2.7/site-packages/ipaserver/install/httpinstance.py", line 188, in create_instance self.start_creation() File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 570, in start_creation run_step(full_msg, method) File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 560, in run_step method() File "/usr/lib/python2.7/site-packages/ipaserver/install/httpinstance.py", line 637, in request_service_keytab super(HTTPInstance, self).request_service_keytab() File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 742, in request_service_keytab self.run_getkeytab(self.api.env.ldap_uri, self.keytab, self.principal) File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 732, in run_getkeytab ipautil.run(args, nolog=nolog) File "/usr/lib/python2.7/site-packages/ipapython/ipautil.py", line 562, in run raise CalledProcessError(p.returncode, arg_string, str(output)) 2021-05-26T02:50:57Z DEBUG The ipa-replica-install command failed, exception: CalledProcessError: Command '/usr/sbin/ipa-getkeytab -k /var/lib/ipa/gssproxy/http.keytab -p HTTP/servera.system(a)REALM.NAME<mailto:HTTP/servera.system@REALM.NAME> -H ldapi://%2Fvar%2Frun%2Fslapd-REALM-NAME.socket -Y EXTERNAL' returned non-zero exit status 9 2021-05-26T02:50:57Z ERROR Command '/usr/sbin/ipa-getkeytab -k /var/lib/ipa/gssproxy/http.keytab -p HTTP/servera.system(a)REALM.NAME<mailto:HTTP/servera.system@REALM.NAME> -H ldapi://%2Fvar%2Frun%2Fslapd-REALM-NAME.socket -Y EXTERNAL' returned non-zero exit status 9 2021-05-26T02:50:57Z ERROR The ipa-replica-install command failed. See /var/log/ipareplica-install.log for more information [2] [26/May/2021:12:50:47.240285166 +1000] - WARN - NSMMReplicationPlugin - repl5_inc_run - agmt="cn=meToservera.system" (servera:389): The remote replica has a different database generation ID than the local database. You may have to reinitialize the remote replica, or the local replica. [26/May/2021:12:50:47.858057379 +1000] - INFO - NSMMReplicationPlugin - repl5_tot_run - Beginning total update of replica "agmt="cn=meToservera.system" (servera:389)". [26/May/2021:12:50:50.679652092 +1000] - INFO - NSMMReplicationPlugin - repl5_tot_run - Finished total update of replica "agmt="cn=meToservera.system" (servera:389)". Sent 582 entries. [26/May/2021:12:50:52.158394667 +1000] - ERR - NSMMReplicationPlugin - acquire_replica - agmt="cn=meToservera.system" (servera:389): Unable to acquire replica: permission denied. The bind dn "" does not have permission to supply replication updates to the replica. Will retry later. [26/May/2021:12:50:55.079367688 +1000] - ERR - NSMMReplicationPlugin - acquire_replica - agmt="cn=meToservera.system" (servera:389): Unable to acquire replica: permission denied. The bind dn "" does not have permission to supply replication updates to the replica. Will retry later. [26/May/2021:12:50:58.084381230 +1000] - ERR - NSMMReplicationPlugin - acquire_replica - agmt="cn=meToservera.system" (servera:389): Unable to acquire replica: permission denied. The bind dn "" does not have permission to supply replication updates to the replica. Will retry later. [26/May/2021:12:51:01.092727541 +1000] - ERR - NSMMReplicationPlugin - acquire_replica - agmt="cn=meToservera.system" (servera:389): Unable to acquire replica: permission denied. The bind dn "" does not have permission to supply replication updates to the replica. Will retry later. CONFIDENTIALITY NOTICE: This email and any attachments are for the sole use of the intended recipient and may contain material that is proprietary, confidential, privileged or otherwise legally protected or restricted under applicable government laws. Any review, disclosure, distributing or other use without expressed permission of the sender is strictly prohibited. If you are not the intended recipient, please contact the sender and delete all copies without reading, printing, or saving.

2 1

Kerberos Issues
by Mark Potter 01 Jun '21

01 Jun '21

Long story short, we had to redeploy part of our FreeIPA cluster. As far as I know I followed all of the proper procedures and everything seems to be working from the client side however we are getting a TON of these messages in krb5kdc.log ipa3.example.com krb5kdc[31232](info): TGS_REQ (8 etypes {18 17 20 19 16 23 25 26}) 10.6.21.19: LOOKING_UP_SERVER: authtime 0, host/ client100.example.com(a)EXAMPLE.COM for nfs/nfs1.example.com(a)EXAMPLE.COM, Server not found in Kerberos database client100.example.com has working forward and reverse DNS entries that resolve from all FreeIPA servers and from itself. nfs1.example.com has working forward and reverse entries that resolve from all FreeIPA servers and from itself, it is not part of the FreeIPA domain at all, it is still using the authentication we are replacing with FreeIPA. It is used for automount homedirs in FreeIPA but is not kerberized All of the clients reporting this error still properly automount homedirs and that is the only thing on nfs1.example.com. There is another mountpoint, also not kerberized, in the automount setup that is not throwing any errors and access extremely frequently. I am happy to provide any logs necessary to track this down. -- *Mark Potter*

2 2

← Newer
1
2
3
4
5
6
7
8
9
Older →

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users May 2021