FreeIPA-users May 2021

freeipa-users@lists.fedorahosted.org

46 participants
88 discussions

ACME admin replication conflict
by Stijn De Weirdt 01 Jun '21

01 Jun '21

hello all, in our setup ipa-healthcheck reports an issue with a replication conflict on "dn: cn=Enterprise ACME Administrators,ou=groups,o=ipaca" the conflict and valid entry are almost identical: > Valid Entry: > > dn: cn=Enterprise ACME Administrators,ou=groups,o=ipaca > cn: Enterprise ACME Administrators > description: ACME RA accounts > objectClass: top > objectClass: groupOfUniqueNames > uniqueMember: uid=acme-master2.domain,ou=people,o=ipaca > uniqueMember: uid=ipara,ou=people,o=ipaca with the conflicting entry the same, except for the line > uniqueMember: uid=acme-master1.domain,ou=people,o=ipaca i would like some guidance what this means and how to proceed: delete the conflicting entry, swap to the conflicting entry, merge it (somehow) many thanks, stijn

2 2

broken replication between multi-master nodes
by Amos 29 May '21

29 May '21

We have a mutli-master configuration between two servers, ca-master1, and rep1. It was discovered that there were some replication failures with some records. We were instructed to clear these failed replication events by doing the following. # ldapdelete -x -h localhost -D 'cn=Directory Manager' -W 'krbprincipalname=HTTP/ca-master1.ipa.xxx.org(a)IPA.XXX.ORG +nsuniqueid=024ed801-290c11eb-a80f9961-57f7bd5e,cn=services,cn=accounts,dc=ipa,dc=xxx,dc=org' # ldapdelete -x -h localhost -D 'cn=Directory Manager' -W 'cn= ca-master1.ipa.xxx.org +nsuniqueid=f400bc09-290b11eb-a80f9961-57f7bd5e,cn=masters,cn=ipa,cn=etc,dc=ipa,dc=xxx,dc=org' # ldapdelete -x -h localhost -D 'cn=Directory Manager' -W 'cn=KDC+nsuniqueid=f400bc0e-290b11eb-a80f9961-57f7bd5e,cn= ca-master1.ipa.xxx.org,cn=masters,cn=ipa,cn=etc,dc=ipa,dc=xxx,dc=org' # ldapdelete -x -h localhost -D 'cn=Directory Manager' -W 'cn=KPASSWD+nsuniqueid=f400bc0f-290b11eb-a80f9961-57f7bd5e,cn= ca-master1.ipa.xxx.org,cn=masters,cn=ipa,cn=etc,dc=ipa,dc=xxx,dc=org' # ldapdelete -x -h localhost -D 'cn=Directory Manager' -W 'cn=HTTP+nsuniqueid=024ed802-290c11eb-a80f9961-57f7bd5e,cn= ca-master1.ipa.xxx.org,cn=masters,cn=ipa,cn=etc,dc=ipa,dc=xxx,dc=org' # ldapdelete -x -h localhost -D 'cn=Directory Manager' -W 'cn=OTPD+nsuniqueid=024ed803-290c11eb-a80f9961-57f7bd5e,cn= ca-master1.ipa.xxx.org,cn=masters,cn=ipa,cn=etc,dc=ipa,dc=xxx,dc=org' # ldapdelete -x -h localhost -D 'cn=Directory Manager' -W 'cn=KEYS+nsuniqueid=024ed804-290c11eb-a80f9961-57f7bd5e,cn= ca-master1.ipa.xxx.org,cn=masters,cn=ipa,cn=etc,dc=ipa,dc=xxx,dc=org' # ldapdelete -x -h localhost -D 'cn=Directory Manager' -W 'fqdn= oitidpnpdev02.xxx.org +nsuniqueid=10cf0001-a93e11eb-87aeb044-5694b0fb,cn=computers,cn=accounts,dc=ipa,dc=xxx,dc=org' Unfortunately, right after performing the above actions, we noticed: ca-master1: [19/May/2021:15:27:59.825229655 -0500] - WARN - str2entry_dupcheck - Duplicate value for attribute type nisNetgroupTriple detected in entry cn=ir-nfs,cn=ng,cn=compat,dc=ipa,dc=xxx,dc=org. Extra value ignored. [19/May/2021:15:27:59.861813312 -0500] - WARN - str2entry_dupcheck - Duplicate value for attribute type nisNetgroupTriple detected in entry cn=acc-hosts,cn=ng,cn=compat,dc=ipa,dc=xxx,dc=org. Extra value ignored. [19/May/2021:15:27:59.899343450 -0500] - WARN - str2entry_dupcheck - Duplicate value for attribute type nisNetgroupTriple detected in entry cn=irunix,cn=ng,cn=compat,dc=ipa,dc=xxx,dc=org. Extra value ignored. [19/May/2021:15:27:59.936539800 -0500] - WARN - str2entry_dupcheck - Duplicate value for attribute type nisNetgroupTriple detected in entry cn=nfs-hosts,cn=ng,cn=compat,dc=ipa,dc=xxx,dc=org. Extra value ignored. [19/May/2021:15:27:59.983973594 -0500] - WARN - str2entry_dupcheck - Duplicate value for attribute type nisNetgroupTriple detected in entry cn=ir-nfs,cn=ng,cn=compat,dc=ipa,dc=xxx,dc=org. Extra value ignored. [19/May/2021:15:28:00.020404656 -0500] - WARN - str2entry_dupcheck - Duplicate value for attribute type nisNetgroupTriple detected in entry cn=acc-hosts,cn=ng,cn=compat,dc=ipa,dc=xxx,dc=org. Extra value ignored. [19/May/2021:18:32:35.566302057 -0500] - ERR - cos-plugin - cos_cache_entry_is_cos_related - Modified entry is NULL--updating cache just in case [19/May/2021:18:32:35.570114071 -0500] - ERR - cos-plugin - cos_dn_defs_cb - Skipping CoS Definition cn=Password Policy,cn=accounts,dc=ipa,dc=xxx,dc=org--no CoS Templates found, which should be added before the CoS Definition. [19/May/2021:18:34:32.674161356 -0500] - ERR - NSMMReplicationPlugin - acquire_replica - agmt="cn=ca-master1.ipa.xxx.org-to-rep1.ipa.xxx.org" (rep1:389): Unable to acquire replica: permission denied. The bind dn "" does not have permission to supply replication updates to the replica. Will retry later. [19/May/2021:18:34:35.681799169 -0500] - ERR - NSMMReplicationPlugin - acquire_replica - agmt="cn=ca-master1.ipa.xxx.org-to-rep1.ipa.xxx.org" (rep1:389): Unable to acquire replica: permission denied. The bind dn "" does not have permission to supply replication updates to the replica. Will retry later. [19/May/2021:18:34:41.689490330 -0500] - ERR - NSMMReplicationPlugin - acquire_replica - agmt="cn=ca-master1.ipa.xxx.org-to-rep1.ipa.xxx.org" (rep1:389): Unable to acquire replica: permission denied. The bind dn "" does not have permission to supply replication updates to the replica. Will retry later. [19/May/2021:18:34:53.711905379 -0500] - ERR - NSMMReplicationPlugin - acquire_replica - agmt="cn=ca-master1.ipa.xxx.org-to-rep1.ipa.xxx.org" (rep1:389): Unable to acquire replica: permission denied. The bind dn "" does not have permission to supply replication updates to the replica. Will retry later. [19/May/2021:18:35:17.719796394 -0500] - ERR - NSMMReplicationPlugin - acquire_replica - agmt="cn=ca-master1.ipa.xxx.org-to-rep1.ipa.xxx.org" (rep1:389): Unable to acquire replica: permission denied. The bind dn "" does not have permission to supply replication updates to the replica. Will retry later. rep1: [19/May/2021:15:28:39.324345375 -0500] - WARN - str2entry_dupcheck - Duplicate value for attribute type nisNetgroupTriple detected in entry cn=iamshibnonprod,cn=ng,cn=compat,dc=ipa,dc=xxx,dc=org. Extra value ignored. [19/May/2021:15:28:39.331127354 -0500] - WARN - str2entry_dupcheck - Duplicate value for attribute type nisNetgroupTriple detected in entry cn=iamshibnonprod,cn=ng,cn=compat,dc=ipa,dc=xxx,dc=org. Extra value ignored. [19/May/2021:18:32:35.294020328 -0500] - ERR - ipa-topology-plugin - ipa_topo_util_modify: failed to modify entry (cn=replica,cn=dc\3Dipa\2Cdc\3Dxxx\2Cdc\3Dorg,cn=mapping tree,cn=config): error 16 [19/May/2021:18:32:35.310416977 -0500] - ERR - ipa-topology-plugin - ipa_topo_agmt_del: cn=rep1.ipa.xxx.org-to-ca-master1.ipa.xxx.org [19/May/2021:18:32:36.592724176 -0500] - ERR - ipa-topology-plugin - ipa_topo_agmt_del: cn=rep1.ipa.xxx.org-to-ca-master1.ipa.xxx.org [19/May/2021:18:32:36.705929392 -0500] - INFO - NSMMReplicationPlugin - CleanAllRUV Task (rid 11): Initiating CleanAllRUV Task... [19/May/2021:18:32:36.706688135 -0500] - INFO - NSMMReplicationPlugin - CleanAllRUV Task (rid 11): Retrieving maxcsn... [19/May/2021:18:32:36.707404944 -0500] - INFO - NSMMReplicationPlugin - CleanAllRUV Task (rid 11): Found maxcsn (60a574f60003000b0000) [19/May/2021:18:32:36.717663920 -0500] - INFO - NSMMReplicationPlugin - CleanAllRUV Task (rid 12): Initiating CleanAllRUV Task... [19/May/2021:18:32:36.718617493 -0500] - INFO - NSMMReplicationPlugin - CleanAllRUV Task (rid 12): Retrieving maxcsn... [19/May/2021:18:32:36.721014950 -0500] - INFO - NSMMReplicationPlugin - CleanAllRUV Task (rid 12): Found maxcsn (60a59d050000000c0000) [19/May/2021:18:32:36.739433329 -0500] - INFO - NSMMReplicationPlugin - CleanAllRUV Task (rid 12): Cleaning rid (12)... [19/May/2021:18:32:36.742689695 -0500] - INFO - NSMMReplicationPlugin - CleanAllRUV Task (rid 12): Waiting to process all the updates from the deleted replica... [19/May/2021:18:32:36.744353200 -0500] - INFO - NSMMReplicationPlugin - CleanAllRUV Task (rid 12): Waiting for all the replicas to be online... [19/May/2021:18:32:36.746343965 -0500] - INFO - NSMMReplicationPlugin - CleanAllRUV Task (rid 12): Waiting for all the replicas to receive all the deleted replica updates... [19/May/2021:18:32:36.748234565 -0500] - INFO - NSMMReplicationPlugin - CleanAllRUV Task (rid 12): Sending cleanAllRUV task to all the replicas... [19/May/2021:18:32:36.750036702 -0500] - INFO - NSMMReplicationPlugin - CleanAllRUV Task (rid 12): Cleaning local ruv's... [19/May/2021:18:32:37.720908584 -0500] - INFO - NSMMReplicationPlugin - CleanAllRUV Task (rid 11): Cleaning rid (11)... [19/May/2021:18:32:37.723446365 -0500] - INFO - NSMMReplicationPlugin - CleanAllRUV Task (rid 11): Waiting to process all the updates from the deleted replica... [19/May/2021:18:32:37.725861245 -0500] - INFO - NSMMReplicationPlugin - CleanAllRUV Task (rid 11): Waiting for all the replicas to be online... [19/May/2021:18:32:37.728834914 -0500] - INFO - NSMMReplicationPlugin - CleanAllRUV Task (rid 11): Waiting for all the replicas to receive all the deleted replica updates... [19/May/2021:18:32:37.731854881 -0500] - INFO - NSMMReplicationPlugin - CleanAllRUV Task (rid 11): Sending cleanAllRUV task to all the replicas... [19/May/2021:18:32:37.733648087 -0500] - INFO - NSMMReplicationPlugin - CleanAllRUV Task (rid 11): Cleaning local ruv's... [19/May/2021:18:32:37.766056624 -0500] - INFO - NSMMReplicationPlugin - CleanAllRUV Task (rid 12): Waiting for all the replicas to be cleaned... [19/May/2021:18:32:37.776216157 -0500] - INFO - NSMMReplicationPlugin - CleanAllRUV Task (rid 12): Waiting for all the replicas to finish cleaning... [19/May/2021:18:32:37.778075680 -0500] - INFO - NSMMReplicationPlugin - CleanAllRUV Task (rid 12): Original task deletes Keep alive entry (12). [19/May/2021:18:32:37.830528541 -0500] - INFO - NSMMReplicationPlugin - CleanAllRUV Task (rid 12): No Keep-Alive entry to remove (cn=repl keep alive 12,o=ipaca) [19/May/2021:18:32:37.833448028 -0500] - INFO - NSMMReplicationPlugin - CleanAllRUV Task (rid 12): Successfully cleaned rid(12) [19/May/2021:18:32:38.746020775 -0500] - INFO - NSMMReplicationPlugin - CleanAllRUV Task (rid 11): Waiting for all the replicas to be cleaned... [19/May/2021:18:32:38.756663129 -0500] - INFO - NSMMReplicationPlugin - CleanAllRUV Task (rid 11): Waiting for all the replicas to finish cleaning... [19/May/2021:18:32:38.758723096 -0500] - INFO - NSMMReplicationPlugin - CleanAllRUV Task (rid 11): Original task deletes Keep alive entry (11). [19/May/2021:18:32:38.766944696 -0500] - INFO - NSMMReplicationPlugin - CleanAllRUV Task (rid 11): Removed Keep-Alive entry (cn=repl keep alive 11,dc=ipa,dc=xxx,dc=org) [19/May/2021:18:32:38.768635297 -0500] - INFO - NSMMReplicationPlugin - CleanAllRUV Task (rid 11): Successfully cleaned rid(11) [19/May/2021:18:34:32.668761455 -0500] - ERR - NSMMReplicationPlugin - multimaster_extop_StartNSDS50ReplicationRequest - conn=6307648 op=5 replica="o=ipaca": Unable to acquire replica: error: permission denied [19/May/2021:18:34:35.676187613 -0500] - ERR - NSMMReplicationPlugin - multimaster_extop_StartNSDS50ReplicationRequest - conn=6307648 op=6 replica="o=ipaca": Unable to acquire replica: error: permission denied [19/May/2021:18:34:41.684145521 -0500] - ERR - NSMMReplicationPlugin - multimaster_extop_StartNSDS50ReplicationRequest - conn=6307648 op=7 replica="o=ipaca": Unable to acquire replica: error: permission denied [19/May/2021:18:34:53.699403689 -0500] - ERR - NSMMReplicationPlugin - multimaster_extop_StartNSDS50ReplicationRequest - conn=6307648 op=8 replica="o=ipaca": Unable to acquire replica: error: permission denied Now these two servers cannot sync anything, and are becoming disjoint. Any tips on how to rectify this? I'm getting the sinking feeling that I'll need to do the following: - Take a full ldif dump of both servers and see what differences there might be. - Anything in rep1 not in ca-master1 add to ca-master1 via ldapadd. - Delete rep1 as a replica (which will cause some issue with any clients currently bound to rep1.) - Re-initialize rep1 as a multi-master replica. Is there perhaps a simpler trick to fix things? Amos

1 0

FeeIPA SSL chain
by Andrew Meyer 26 May '21

26 May '21

Hello, I am trying to find the correct way to get the FreeIPA SSL certificate in pem format. So far I have the following commands: kinit $USER_WITH_ADMIN_PRIVS ipa ca-show ipa ca-show --certificate-out=/etc/pki/tls/private/server.key I don't think this is right. I need this to get the private key for FreeIPA for setting up Duo 2FA. Thanks!

2 4

ipa-healtcheck complains about kra
by Rob Verduijn 26 May '21

26 May '21

Hello, I've updated my ipa server to the latest version today. But now the ipa healthcheck gives a warning about kra. ipa-healthcheck --failures-only Internal error testing KRA clone. 'NoneType' object has no attribute 'config' [ { "source": "pki.server.healthcheck.clones.connectivity_and_data", "check": "ClonesConnectivyAndDataCheck", "result": "ERROR", "uuid": "2adc9f06-05aa-4e6f-af7f-0cad33e0e179", "when": "20210526104303Z", "duration": "0.749857", "kw": { "status": "ERROR: pki-tomcat : Internal error testing KRA clone. Host: freeipa02.tjako.thuis Port: 443" } } ] Googling doesn't really help. Anybody know how to solve this ? Rob

3 2

26 May '21

Greetings, After automatic KDC certificate renewal, I'm no longer able to access the UI. [Sun Dec 27 23:33:20.563064 2020] [:error] [pid 6150] [remote 10.xx.xx.22:72] Traceback (most recent call last): [Sun Dec 27 23:33:20.563085 2020] [:error] [pid 6150] [remote 10.xx.xx.22:72] File "/usr/share/ipa/wsgi.py", line 59, in application [Sun Dec 27 23:33:20.563121 2020] [:error] [pid 6150] [remote 10.xx.xx.22:72] return api.Backend.wsgi_dispatch(environ, start_response) [Sun Dec 27 23:33:20.563129 2020] [:error] [pid 6150] [remote 10.xx.xx.22:72] File "/usr/lib/python2.7/site-packages/ipaserver/rpcserver.py", line 267, in __call__ [Sun Dec 27 23:33:20.563142 2020] [:error] [pid 6150] [remote 10.xx.xx.22:72] return self.route(environ, start_response) [Sun Dec 27 23:33:20.563160 2020] [:error] [pid 6150] [remote 10.xx.xx.22:72] File "/usr/lib/python2.7/site-packages/ipaserver/rpcserver.py", line 279, in route [Sun Dec 27 23:33:20.563170 2020] [:error] [pid 6150] [remote 10.xx.xx.22:72] return app(environ, start_response) [Sun Dec 27 23:33:20.563174 2020] [:error] [pid 6150] [remote 10.xx.xx.22:72] File "/usr/lib/python2.7/site-packages/ipaserver/rpcserver.py", line 937, in __call__ [Sun Dec 27 23:33:20.563182 2020] [:error] [pid 6150] [remote 10.xx.xx.22:72] self.kinit(user_principal, password, ipa_ccache_name) [Sun Dec 27 23:33:20.563194 2020] [:error] [pid 6150] [remote 10.xx.xx.22:72] File "/usr/lib/python2.7/site-packages/ipaserver/rpcserver.py", line 973, in kinit [Sun Dec 27 23:33:20.563201 2020] [:error] [pid 6150] [remote 10.xx.xx.22:72] pkinit_anchors=[paths.KDC_CERT, paths.KDC_CA_BUNDLE_PEM], [Sun Dec 27 23:33:20.563209 2020] [:error] [pid 6150] [remote 10.xx.xx.22:72] File "/usr/lib/python2.7/site-packages/ipalib/install/kinit.py", line 127, in kinit_armor [Sun Dec 27 23:33:20.563219 2020] [:error] [pid 6150] [remote 10.xx.xx.22:72] run(args, env=env, raiseonerr=True, capture_error=True) [Sun Dec 27 23:33:20.563225 2020] [:error] [pid 6150] [remote 10.xx.xx.22:72] File "/usr/lib/python2.7/site-packages/ipapython/ipautil.py", line 563, in run [Sun Dec 27 23:33:20.563234 2020] [:error] [pid 6150] [remote 10.xx.xx.22:72] raise CalledProcessError(p.returncode, arg_string, str(output)) [Sun Dec 27 23:33:20.563263 2020] [:error] [pid 6150] [remote 10.xx.xx.22:72] CalledProcessError: Command '/usr/bin/kinit -n -c /var/run/ipa/ccaches/armor_6150 -X X509_anchors=FILE:/var/kerberos/krb5kdc/kdc.crt -X X509_anchors=FILE:/var/lib/ipa-client/pki/kdc-ca-bundle.pem' returned non-zero exit status 1 --- KRB5_TRACE=/dev/stdout /usr/bin/kinit -n -c /var/run/ipa/ccaches/armor_19265 -X X509_anchors=FILE:/var/kerberos/krb5kdc/kdc.crt -X X509_anchors=FILE:/var/lib/ipa-client/pki/kdc-ca-bundle.pem [12904] 1609104974.342210: Getting initial credentials for WELLKNOWN/ ANONYMOUS(a)A-LABS.COM [12904] 1609104974.342212: Sending unauthenticated request [12904] 1609104974.342213: Sending request (184 bytes) to A-LABS.COM [12904] 1609104974.342214: Initiating TCP connection to stream 10.xx.xx.90:88 [12904] 1609104974.342215: Sending TCP request to stream 10.xx.xx.90:88 [12904] 1609104974.342216: Received answer (335 bytes) from stream 10.xx.xx.90:88 [12904] 1609104974.342217: Terminating TCP connection to stream 10.xx.xx.90:88 [12904] 1609104974.342218: Response was from master KDC [12904] 1609104974.342219: Received error from KDC: -1765328359/Additional pre-authentication required [12904] 1609104974.342222: Preauthenticating using KDC method data [12904] 1609104974.342223: Processing preauth types: PA-PK-AS-REQ (16), PA-PK-AS-REP_OLD (15), PA-PK-AS-REQ_OLD (14), PA-FX-FAST (136), PA-ETYPE-INFO2 (19), PA-PKINIT-KX (147), PA-ENC-TIMESTAMP (2), PA-FX-COOKIE (133) [12904] 1609104974.342224: Selected etype info: etype aes256-cts, salt "A-LABS.COMWELLKNOWNANONYMOUS", params "" [12904] 1609104974.342225: Received cookie: MIT [12904] 1609104974.342226: Preauth module pkinit (147) (info) returned: 0/Success [12904] 1609104974.342227: PKINIT loading CA certs and CRLs from FILE [12904] 1609104974.342228: PKINIT loading CA certs and CRLs from FILE [12904] 1609104974.342229: PKINIT loading CA certs and CRLs from FILE [12904] 1609104974.342230: PKINIT client computed kdc-req-body checksum 9/D4FAE675E4E8C9664DBE0FAD0EB8C416A639CAF3 [12904] 1609104974.342232: PKINIT client making DH request [12904] 1609104974.342233: Preauth module pkinit (16) (real) returned: 0/Success [12904] 1609104974.342234: Produced preauth for next request: PA-FX-COOKIE (133), PA-PK-AS-REQ (16) [12904] 1609104974.342235: Sending request (1497 bytes) to A-LABS.COM [12904] 1609104974.342236: Initiating TCP connection to stream 10.xx.xx.90:88 [12904] 1609104974.342237: Sending TCP request to stream 10.xx.xx.90:88 [12904] 1609104974.342238: Received answer (1603 bytes) from stream 10.xx.xx.90:88 [12904] 1609104974.342239: Terminating TCP connection to stream 10.xx.xx.90:88 [12904] 1609104974.342240: Response was from master KDC [12904] 1609104974.342241: Processing preauth types: PA-PK-AS-REP (17), PA-ETYPE-INFO2 (19), PA-PKINIT-KX (147) [12904] 1609104974.342242: Selected etype info: etype aes256-cts, salt "A-LABS.COMWELLKNOWNANONYMOUS", params "" [12904] 1609104974.342243: Preauth module pkinit (147) (info) returned: 0/Success [12904] 1609104974.342244: PKINIT client verified DH reply [12904] 1609104974.342245: Preauth module pkinit (17) (real) returned: -1765328308/KDC name mismatch [12904] 1609104974.342246: Produced preauth for next request: (empty) [12904] 1609104974.342247: Getting AS key, salt "A-LABS.COMWELLKNOWNANONYMOUS", params "" Password for WELLKNOWN/ANONYMOUS(a)A-LABS.COM: [12904] 1609104977.873071: AS key obtained from gak_fct: aes256-cts/B8BD kinit: Password incorrect while getting initial credentials -- openssl x509 -in /var/kerberos/krb5kdc/kdc.crt -text -noout Certificate: Data: Version: 3 (0x2) Serial Number: 10 (0xa) Signature Algorithm: sha256WithRSAEncryption Issuer: O=DOMAIN.COM, CN=ipa.domain.com Validity Not Before: Dec 27 07:38:54 2020 GMT Not After : Dec 27 07:38:54 2021 GMT Subject: O=DOMAIN.COM, CN=ipa.domain.com Subject Public Key Info: Public Key Algorithm: rsaEncryption Public-Key: (2048 bit) Modulus: 00:cc:6e:b1:b1:2d:05:ab:f1:df:ce:01:43:d5:80: 4a:f6:72:38:3c:50:aa:c7:40:bf:bd:6c:60:5e:8d: d0:f3:2b:6c:db:fc:8f:48:9f:91:d6:d3:d2:43:f2: 39:35:17:56:37:a8:6f:66:c3:ab:1f:13:8f:d9:48: c3:be:b9:2b:83:77:78:08:fe:3b:f8:93:83:1c:bb: d0:e8:eb:49:a5:c1:8c:7f:0c:b5:fa:e7:07:f1:0c: 97:9b:47:e9:a2:a3:ab:9b:c1:70:e3:1b:e9:f2:3d: 2f:96:53:6d:38:eb:57:19:7f:dd:ed:e8:3c:c8:f0: 7c:36:b1:72:03:f1:2f:86:8e:cd:67:fd:fd:85:73: 00:16:60:81:3c:ad:13:4d:19:c0:4d:e7:94:8d:34: 29:99:7a:45:70:db:81:5d:0e:2d:83:7a:9c:19:c7: ef:0a:79:8d:84:af:74:a3:b9:90:c8:b1:8c:65:d0: 2d:e0:89:98:42:e0:cb:c8:b0:e3:b5:7c:9b:44:01: a8:31:15:8d:19:79:c5:35:26:4d:3f:e6:83:64:7f: 15:da:50:c1:5e:9c:67:1b:27:e5:35:0c:a8:71:a9: 4e:ee:ef:92:b5:f9:10:f6:31:82:2c:94:04:05:c5: 89:c6:96:1d:48:11:e5:8d:05:92:56:93:99:55:66: b0:93 Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Basic Constraints: critical CA:FALSE Signature Algorithm: sha256WithRSAEncryption To my understanding, something is wrong with the kdc certificate, it lacks some attributes. I'm just not sure how to generate a proper cert.

4 4

IRC server change
by Rob Crittenden 26 May '21

26 May '21

Due to the changes at freenode [1], the freeIPA IRC channel is transitioning to the libera.chat IRC server with the same channel name: irc://irc.libera.chat/freeipa There is currently no hard cut-off date but its likely to be sooner than later. rob [1] https://www.kline.sh/

2 1

FreeIPA Bastion
by G Col 24 May '21

24 May '21

Hello Team, I was wondering how I can configure FreeIPA as a bastion server when I ssh other hosts. Basically FreeIPA would be in the middle of the ssh approval to access to the specific server via ssh. Is a functionality that FreeIPA has at the moment? Thank you for your help, gcol

3 4

Disable SSH Key login
by Russ Long 21 May '21

21 May '21

In my environment, I need to force password + OTP for users. I have "Default user authentication types" set to "Two factor..." and "Disable per-user override". However, I'm seeing that SSH Keys that users add to the FreeIPA console are allowing them to login without a second factor. Any ideas how to resolve this?

2 2

Removal of host certificates
by Gerrard Geldenhuis 19 May '21

19 May '21

Hi I am trying to remove old host certificates. I generated a list using: ipa cert-find --sizelimit 0 One of the certs are: Issuing CA: ipa Subject: CN=server.example.com,O=COMPANY.COM Issuer: CN=Certificate Authority,O=COMPANY.COM Not Before: Fri May 20 15:56:37 2016 UTC Not After: Mon May 21 15:56:37 2018 UTC Serial number: 268238888 Serial number (hex): 0xFFD002D Status: REVOKED_EXPIRED Revoked: True I also did: ipa cert-show 268238888 I then tried to remove the cert by using: ipa host-remove-cert server.example.com which then prompts me for the certificate, I enter the certificate as I got it from ipa cert-show command, using the "Certificate: " part. But I get the error: ipa: ERROR: server.examle.com: host not found I also tried to remove the certificate from the UI, which shows quite a lot more expired certificates for the host, but does not give me any option to delete/remove the certificates Am I missing something obvious with regards to the steps required to remove old certificates? Am I not supposed to remove them? FreeIPA, version: 4.5.4 Regards

2 1

Removal of host certificates
by Gerrard Geldenhuis 19 May '21

19 May '21

1 0

← Newer
1
2
3
4
5
6
7
8
9
Older →

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users May 2021