June 2021 - FreeIPA-users - Fedora mailing-lists

How to prevent non-admin users of FreeIPA from reading the list of users in the web interface?
by cdknight 16 Apr '24

16 Apr '24

When a user signs in to FreeIPA, I do not want them to be able to view the list of users in my LDAP server under the "Active users" link. I still want them to be able to administer self-service, so they can reset their password, add OTP tokens, etc. How would I go about doing this? The users will only be able to access the web interface, so it doesn't matter whether they can access it from other sources.

5 10

missing attribute "sambaGroupType" when attempting to create a new group - creating groups worked previously
by Tom Spettigue 19 Mar '24

19 Mar '24

Hey all - I seem to be getting the following error message whenever I try to create a group via the web interface: ``` IPA Error 4205: ObjectclassViolation missing attribute "sambaGroupType" required by object class "sambaGroupMapping" ``` I'm not sure exactly what's happening, except that I know I've created groups numerous times before, and never gotten this error message. Does anyone have any ideas?

1 2

certmonger error on ubuntu
by Robson Francisco de Souza 07 Feb '24

07 Feb '24

Hello! I've been running FreeIPA 4.3.1 on Ubuntu 16.04 for almost two years and most certificates should expire within three weeks. As this deadline approaches, I noticed certmonger has been unable to renew certificates due to the error below. After googling for two days, I found this issue has been observed by many people before, mostly after expiration of the certificates, as in https://tinyurl.com/vajmocw Still, I couldn't find a solution to this problem. If it is impossible to fix this issue while using FreeIPA 4.3.1, I would like to: 1) Find a way to renew all certificates even if certmonger can't be fixed. This would allow me to postpone the solution to after the next OS and/or FreeIPA upgrade 2) Find out what version of FreeIPA I should upgrade to while the operating system remains Ubuntu 16.04 Any help would be appreciated! Thanks! Robson ======> Command: systemctl status certmonger Nov 17 20:53:08 ipa.cefapnet.icb.usp.br certmonger[3873125]: 2019-11-17 20:53:08 [3873125] Error 77 connecting to https://ipa.cefapnet.icb.usp.br:8443/ca/agent/ca/profileReview: Problem with the SSL CA cert (path? access rights?). Nov 17 21:10:13 ipa.cefapnet.icb.usp.br dogtag-ipa-ca-renew-agent-submit[3875188]: Forwarding request to dogtag-ipa-renew-agent Nov 17 21:10:13 ipa.cefapnet.icb.usp.br dogtag-ipa-ca-renew-agent-submit[3875188]: dogtag-ipa-renew-agent returned 3 Nov 17 21:10:13 ipa.cefapnet.icb.usp.br certmonger[3873125]: 2019-11-17 21:10:13 [3873125] Error 77 connecting to https://ipa.cefapnet.icb.usp.br:8443/ca/agent/ca/profileReview: Problem with the SSL CA cert (path? access rights?). Nov 17 21:25:20 ipa.cefapnet.icb.usp.br dogtag-ipa-ca-renew-agent-submit[3875738]: Forwarding request to dogtag-ipa-renew-agent Nov 17 21:25:20 ipa.cefapnet.icb.usp.br dogtag-ipa-ca-renew-agent-submit[3875738]: dogtag-ipa-renew-agent returned 3 Nov 17 21:25:21 ipa.cefapnet.icb.usp.br certmonger[3873125]: 2019-11-17 21:25:21 [3873125] Error 77 connecting to https://ipa.cefapnet.icb.usp.br:8443/ca/agent/ca/profileReview: Problem with the SSL CA cert (path? access rights?). Nov 17 21:25:31 ipa.cefapnet.icb.usp.br dogtag-ipa-ca-renew-agent-submit[3875766]: Forwarding request to dogtag-ipa-renew-agent Nov 17 21:25:31 ipa.cefapnet.icb.usp.br dogtag-ipa-ca-renew-agent-submit[3875766]: dogtag-ipa-renew-agent returned 3 Nov 17 21:25:31 ipa.cefapnet.icb.usp.br certmonger[3873125]: 2019-11-17 21:25:31 [3873125] Error 77 connecting to https://ipa.cefapnet.icb.usp.br:8443/ca/agent/ca/profileReview: Problem with the SSL CA cert (path? access rights?). -- Robson Francisco de Souza, PhD Laboratório de Estrutura e Evolução de Proteínas (LEEP/PSEL) Departamento de Microbiologia Instituto de Ciências Biomédicas Universidade de São Paulo Av. Prof. Lineu Prestes, 1374 - Ed. Biomédicas II - Sala 250 - 2o. andar Tel: 3091-0891 Cidade Universitária - CEP 05508-900 - São Paulo - SP - Brasil ---- Robson Francisco de Souza, PhD Protein Structure and Evolution Laboratory (LEEP/PSEL) Microbiology Departament Biomedical Sciences Institute University of Sao Paulo Av. Prof. Lineu Prestes, 1374 - Biomédicas II - Sala 250 Phone: 55-11-3091-0891 Cidade Universitária - ZIP 05508-900 - São Paulo - SP - Brazil

6 10

Greenfield FreeIPA deployment - is it OK to put FreeIPA at the domain apex, or a "best practice" to put it in a subdomain?
by Braden McGrath 11 Jan '24

11 Jan '24

Hello FreeIPA-users. The Subject line is the core of my question here; I'll provide a bit more detail below. I work for what is (effectively) a startup, non-profit internet provider. I have an extensive Windows background, and "know enough to be dangerous" with Linux & BSD (have been tinkering with GNU/Linux on and off since Slackware 3.0 or 3.1). I'm very familiar with Windows Active Directory, but the org does not have any AD infrastructure right now (and being nonprofit, are trying to avoid spending money for MS, especially when all of the other VMs will be Linux or BSD anyway). Given the nonprofit nature, I discovered FreeIPA when looking for a free centralized directory system. The goal is to consolidate all credentials for *other* Linux VMs (customer-facing DNS, CRM web server, SNMP/network graphing servers, etc) as well as provide a back-end for RADIUS for management of network equipment (switches, routers, P2P wireless, etc). Simplifying DNS management and replication is also appealing, I'd rather administrate one system than two or three. In case it changes your opinion of the plan at all - all of the network equipment and VMs will be on *private* (10.x) IPv4 space and behind one or more firewalls, at least initially. We do want to add public IPv6, but do not have that yet. We only have a small allocation (/26) of public v4 from our upstream that will be NATed through a firewall and not directly on any devices. The traffic to FreeIPA is going to be internal-only, I do not plan on exposing FreeIPA's DNS "to the world" at all. Even customer-facing internal DNS will likely be through separate caching forwarders pointing back to FreeIPA. I have a completely unused, publicly registered domain (let's just call it "example.net" for this thread) available to dedicate to this system. We also own "example.org" and are using that for our public web presence, and I intend to keep that entirely standalone. Given that I have no current "interoperability" concerns, is there anything "wrong" with putting FreeIPA directly at the root of example.net? Or would it be more wise, from an interop, security, or manageability standpoint (i.e. a "best practice"), to root FreeIPA at something like auth.example.net or ipa.example.net and then have a separate set of nameservers handling the base domain? If I put FreeIPA's root (and Kerberos realm) in a subdomain, is it possible to *also* have it manage the parent domain's DNS entries? I've read through the Quick Start Guide and Deployment Recommendations (https://www.freeipa.org/page/Deployment_Recommendations) which is part of how I've come to the decisions I've made thus far. I couldn't really find guidance one way or the other on whether FreeIPA "should" be in a subdomain or not, hence this posting. I would appreciate any insight the community can provide!

3 4

FreeIPA web session timeout
by Yuri Krysko 10 Jan '24

10 Jan '24

Hello, Could you please advise how to configure FreeIPA web UI user session timeout? Thanks, Yuri ________________________________ LEGAL DISCLAIMER: M.C. Dean, Inc. and its subsidiaries considers this e-mail and any files transmitted with it to be protected, proprietary or privileged information intended solely for the use of the named recipient(s). Any disclosure of this material or the information contained herein, in whole or in part, to anyone outside of the intended recipient or affiliates is strictly prohibited. M. C. Dean, Inc. accepts no liability for the content of this e-mail or for the consequences of any actions taken on the basis of the information contained in it, unless that information is subsequently confirmed in writing. Employees of M.C. Dean, Inc. are instructed not to infringe on any rights of the recipient; any such communication violates company policy. If you are not the intended recipient, any disclosure, copying, distribution, or action taken or omitted in reliance on this information is strictly prohibited by M.C. Dean, Inc.; please notify the sender immediately by return e-mail, delete this communication and destroy all copies.

4 4

Auto cleanup old enrolled hosts
by Russ Long 01 Dec '23

01 Dec '23

We're adding FreeIPA to an immutable, often rotated environment (AWS ECS Hosts). These hosts are spun up and down at least daily. Is there a way to check FreeIPA to see when a host has last communicated with the FreeIPA Cluster? I'd like to use this information to auto-delete hosts that have not reported in from the FreeIPA host list.

5 4

Allow sysaccount to view its own entry
by Adam Bishop 09 Nov '23

09 Nov '23

I have a piece of software that tries to look up its own uid to check that LDAP is correctly configured. This check fails because the sysaccount cannot view anything under cn=etc,cn=sysaccounts. Is there an existing permission/privilege that I can use to allow it to read the sysaccounts tree (or better, just its own entry)? Many Thanks, Adam Bishop

4 3

kinit: KDC can't fulfill requested option while renewing credentials - which approach?
by Pieter Baele 19 Sep '23

19 Sep '23

I tried various approached to get Renewable tickets : modifying the kdc modifying krb5.conf using kadmin.local on every replica to modify the principal; which is not working - as designed (?)- in IPA What should I do to get a ticket with the correct R flag from IPA ? I don't think this is SSSD related (the service needing the renewable ticket this way is Apache Storm) Thanks a lot!

3 4

Do keytabs expire?
by Ronald Wimmer 07 Jun '23

07 Jun '23

Hi, today I found out that some entries in a keytab file seemed to have expired: Request ticket server HTTP/mwc.linux.mydomain.at(a)LINUX.MYDOMAIN.AT kvno 4 not found in keytab; keytab is likely out of date Fetching the keytab again with ipa-getkeytab fixed the problem. But why is this happening? Do keytab entries expire? I have not set any custom password or ticket policies. Regards, Ronald

4 13

ipa-replica-install -- cannot get past [26/41]: creating DS keytab
by Jonathon Jenkins 28 Mar '23

28 Mar '23

Greetings, I cannot get the ipa-replica-install to proceed past step 26/41 - creating DS keytab. I see the command that is to be run, and I can run that just fine before and after the ipa-replica-install command, and it creates the keytab. I am not sure how to proceed from here - the bug reports I see all pertain to earlier versions, and my files reflect those changes. I have also tried running this with all manner of password flags, which are correct, but still getting insufficient access rights. particulars: centos 7 3.10.0-957.1.3.el7.x86_64 ipa-server-4.6.4-10.el7.centos.x86_64 ipa-common-4.6.4-10.el7.centos.noarch ipa-server-common-4.6.4-10.el7.centos.noarch ipa-client-4.6.4-10.el7.centos.x86_64 ipa-server-dns-4.6.4-10.el7.centos.noarch ipa-client-common-4.6.4-10.el7.centos.noarch * Note: anonymized output below ipapython.ipautil: DEBUG stderr= ipalib.backend: DEBUG Created connection context.ldap2_139891568509776 ipaserver.install.service: DEBUG duration: 7 seconds ipaserver.install.service: DEBUG [26/41]: creating DS keytab [26/41]: creating DS keytab ipalib.frontend: DEBUG raw: service_add(u'ldap/<ipa-replica-host>@<domain>.NET', force=True, version=u'2.229') ipalib.frontend: DEBUG service_add(ipapython.kerberos.Principal('ldap/<ipa-replica-host>@<domain>.NET'), force=True, all=False, raw=False, version=u'2.229', no_members=False) ipalib.frontend: DEBUG raw: host_show(u'<ipa-replica-host>', version=u'2.229') ipalib.frontend: DEBUG host_show(u'<ipa-replica-host>', rights=False, all=False, raw=False, version=u'2.229', no_members=False) ipalib.install.sysrestore: DEBUG Backing up system configuration file '/etc/dirsrv/ds.keytab' ipalib.install.sysrestore: DEBUG -> Not backing up - '/etc/dirsrv/ds.keytab' doesn't exist ipapython.ipautil: DEBUG Starting external process ipapython.ipautil: DEBUG args=/usr/sbin/ipa-getkeytab -k /etc/dirsrv/ds.keytab -p ldap/<ipa-replica-host>@<domain>.NET -H ldaps://<ipa-replica-master> ipapython.ipautil: DEBUG Process finished, return code=9 ipapython.ipautil: DEBUG stdout= ipapython.ipautil: DEBUG stderr=Failed to parse result: Insufficient access rights Retrying with pre-4.0 keytab retrieval method... Failed to parse result: Insufficient access rights Failed to get keytab! Failed to get keytab ipaserver.install.service: DEBUG Traceback (most recent call last): File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 570, in start_creation run_step(full_msg, method) File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 560, in run_step method() File "/usr/lib/python2.7/site-packages/ipaserver/install/dsinstance.py", line 1308, in request_service_keytab super(DsInstance, self).request_service_keytab() File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 742, in request_service_keytab self.run_getkeytab(self.api.env.ldap_uri, self.keytab, self.principal) File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 732, in run_getkeytab ipautil.run(args, nolog=nolog) File "/usr/lib/python2.7/site-packages/ipapython/ipautil.py", line 562, in run raise CalledProcessError(p.returncode, arg_string, str(output)) CalledProcessError: Command '/usr/sbin/ipa-getkeytab -k /etc/dirsrv/ds.keytab -p ldap/<ipa-replica-host>@<domain>.NET -H ldaps://<ipa-replica-master>' returned non-zero exit status 9 ipaserver.install.service: DEBUG [error] CalledProcessError: Command '/usr/sbin/ipa-getkeytab -k /etc/dirsrv/ds.keytab -p ldap/<ipa-replica-host>@<domain>.NET -H ldaps://<ipa-replica-master>' returned non-zero exit status 9 [error] CalledProcessError: Command '/usr/sbin/ipa-getkeytab -k /etc/dirsrv/ds.keytab -p ldap/<ipa-replica-host>@<domain>.NET -H ldaps://<ipa-replica-master>' returned non-zero exit status 9 ipalib.backend: DEBUG Destroyed connection context.ldap2_139891548583120 ipalib.install.sysrestore: DEBUG Backing up system configuration file '/etc/ipa/default.conf' ipalib.install.sysrestore: DEBUG Saving Index File to '/var/lib/ipa/sysrestore/sysrestore.index' Your system may be partly configured. Run /usr/sbin/ipa-server-install --uninstall to clean up. ipapython.admintool: DEBUG File "/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 178, in execute return_value = self.run() File "/usr/lib/python2.7/site-packages/ipapython/install/cli.py", line 319, in run return cfgr.run() File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 364, in run return self.execute() File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 389, in execute for rval in self._executor(): File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 434, in __runner exc_handler(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 463, in _handle_execute_exception self._handle_exception(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 453, in _handle_exception six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 424, in __runner step() File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 421, in <lambda> step = lambda: next(self.__gen) File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from value = gen.send(prev_value) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 658, in _configure next(executor) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 434, in __runner exc_handler(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 463, in _handle_execute_exception self._handle_exception(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 521, in _handle_exception self.__parent._handle_exception(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 453, in _handle_exception six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 518, in _handle_exception super(ComponentBase, self)._handle_exception(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 453, in _handle_exception six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 424, in __runner step() File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 421, in <lambda> step = lambda: next(self.__gen) File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from value = gen.send(prev_value) File "/usr/lib/python2.7/site-packages/ipapython/install/common.py", line 65, in _install for unused in self._installer(self.parent): File "/usr/lib/python2.7/site-packages/ipaserver/install/server/__init__.py", line 622, in main replica_install(self) File "/usr/lib/python2.7/site-packages/ipaserver/install/server/replicainstall.py", line 406, in decorated func(installer) File "/usr/lib/python2.7/site-packages/ipaserver/install/server/replicainstall.py", line 1431, in install fstore=fstore) File "/usr/lib/python2.7/site-packages/ipaserver/install/server/replicainstall.py", line 113, in install_replica_ds setup_pkinit=not options.no_pkinit, File "/usr/lib/python2.7/site-packages/ipaserver/install/dsinstance.py", line 419, in create_replica self.start_creation(runtime=30) File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 570, in start_creation run_step(full_msg, method) File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 560, in run_step method() File "/usr/lib/python2.7/site-packages/ipaserver/install/dsinstance.py", line 1308, in request_service_keytab super(DsInstance, self).request_service_keytab() File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 742, in request_service_keytab self.run_getkeytab(self.api.env.ldap_uri, self.keytab, self.principal) File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 732, in run_getkeytab ipautil.run(args, nolog=nolog) File "/usr/lib/python2.7/site-packages/ipapython/ipautil.py", line 562, in run raise CalledProcessError(p.returncode, arg_string, str(output)) ipapython.admintool: DEBUG The ipa-replica-install command failed, exception: CalledProcessError: Command '/usr/sbin/ipa-getkeytab -k /etc/dirsrv/ds.keytab -p ldap/<ipa-replica-host>@<domain>.NET -H ldaps://<ipa-replica-master>' returned non-zero exit status 9 ipapython.admintool: ERROR Command '/usr/sbin/ipa-getkeytab -k /etc/dirsrv/ds.keytab -p ldap/<ipa-replica-host>@<domain>.NET -H ldaps://<ipa-replica-master>' returned non-zero exit status 9 ipapython.admintool: ERROR The ipa-replica-install command failed. See /var/log/ipareplica-install.log for more information

2 2

FreeIPA-Kubernetes Setup
by Ronald Wimmer 20 Mar '23

20 Mar '23

Hi, are there any plans (or maybe ongoing work already) to let FreeIPA run in a K8s environment? Cheers, Ronald

6 8

Removal & clean up certificates from o=ipaca
by David Goudet 13 Feb '23

13 Feb '23

Hello all, I have to clean up lot of useless certificate in dirsrv database. Because of resubmit loop on Certmonger client, i have 99,9% of certificate in dirsrv database that are useless and not obsolete (expiration in 2020) (it represent ~85 000 certificates). These useless certificates produce some issues on FreeIPA: - decrease FreeIPA performances on CLI and GUI - increase the LDAP size - increase size and time of FreeIPA backup ... Is it possible to purge these certificates in dirsrv database and how? I found two branches in LDAP directory about these certificates: dn: cn=xxx,ou=ca,ou=requests,o=ipaca dn: cn=yyy,ou=certificateRepository,ou=ca,o=ipaca I can remove all requests and certificates entry from dirsrv database but how it is supported by PKI manager Dogtag (CRL, certificate generation, OCSP)? (This topic has already been discuss on https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost…) Thank you for you help -- David GOUDET LYRA NETWORK IT Operations service Tel : +33 (0)5 32 09 09 74 | Poste : 574

4 5

ipa-replica-install fails when I use custom certificates
by Peter Tselios 08 Feb '23

08 Feb '23

I have installed the ipa server by using the following command: --------- ipa-server-install --realm "EXAMPLE.COM" -p 'password' -a 'password' --hostname="server.example.com" -n example.com --ip-address="10.1.4.2" --dirsrv-cert-file=/etc/pki/tls/private/example.com.pem --dirsrv-cert-file=/etc/pki/tls/certs/example.com.crt --dirsrv-pin='' --http-cert-file=/etc/pki/tls/certs/example.com.crt --http-cert-file=/etc/pki/tls/private/example.com.pem --http-pin='' --ca-cert-file=/etc/pki/ca-trust/source/anchors/myca.pem --ca-cert-file=/etc/pki/ca-trust/source/anchors/mysubca.pem --mkhomedir -N --no-host-dns --unattended --------- Which works perfectly fine. However, I cannot make it work with ipa-replica-install since there is no option for --ca-cert-file. So, how can I install a replica with custom certificates?

6 12

FreeIPA CA failing to login with new admin user
by Stasiek Michalski 19 Dec '22

19 Dec '22

Hello, I installed FreeIPA replica on 4.8.4 on CentOS 8 from 4.4.4 from Fedora 25 with `ipa-replica-install --setup-dns --auto-forwarders`, without `--setup-ca` due to errors, which went fine. I do want to install CA though, which failed when I did `--setup-ca` and then later `ipa-ca-install` with the following error: ``` [4/29]: creating installation admin user Unable to log in as uid=admin-freeipa2.infra.opensuse.org,ou=people,o=ipaca on ldap://freeipa.infra.opensuse.org:389 [hint] tune with replication_wait_timeout [error] NotFound: uid=admin-freeipa2.infra.opensuse.org,ou=people,o=ipaca did not replicate to ldap://freeipa.infra.opensuse.org:389 Your system may be partly configured. Run /usr/sbin/ipa-server-install --uninstall to clean up. ``` Obviously I did try try extending the timeout based on that, but I don't think that was helpful in the end, considering the logs produced by the old server: httpd access_log ``` 192.168.47.90 - - [23/Jul/2020:00:25:36 +0000] "GET /ca/rest/account/login HTTP/1.1" 401 994 ``` server process in journal ``` SSLAuthenticatorWithFallback: Authenticating with BASIC authentication Invalid Credential. at com.netscape.cmscore.authentication.PasswdUserDBAuthentication.authenticate(PasswdUserDBAuthentication.java:167) at com.netscape.cms.realm.PKIRealm.authenticate(PKIRealm.java:63) at com.netscape.cms.tomcat.ProxyRealm.authenticate(ProxyRealm.java:78) at org.apache.catalina.authenticator.BasicAuthenticator.authenticate(BasicAuthenticator.java:94) at com.netscape.cms.tomcat.SSLAuthenticatorWithFallback.doSubAuthenticate(SSLAuthenticatorWithFallback.java:37) at com.netscape.cms.tomcat.AbstractPKIAuthenticator.doAuthenticate(AbstractPKIAuthenticator.java:98) at com.netscape.cms.tomcat.SSLAuthenticatorWithFallback.authenticate(SSLAuthenticatorWithFallback.java:47) at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:579) at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:141) at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:79) at org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:620) at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:88) at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:502) at org.apache.coyote.ajp.AbstractAjpProcessor.process(AbstractAjpProcessor.java:877) at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:684) at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1539) at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.run(NioEndpoint.java:1495) at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) at java.lang.Thread.run(Thread.java:748) SSLAuthenticatorWithFallback: Fallback auth header: WWW-Authenticate=Basic realm="Certificate Authority" SSLAuthenticatorWithFallback: Fallback auth return code: 401 SSLAuthenticatorWithFallback: Result: false ``` and from pki logs ``` Failed to authenticate as admin UID=admin-freeipa2.infra.opensuse.org. Error: netscape.ldap.LDAPException: error result (49) ``` I don't particularly know how to proceed from here, since those errors don't mean much to me. I see however it's not just me having issues with `ipa-ca-install` at least similar to this one (although by the looks of it, the reason is already different ;) Thanks in advance for trying, LCP [Stasiek] https://lcp.world/

4 6

IPA-Error 903: InternalError on Certificate page
by Nico Maas 10 Nov '22

10 Nov '22

Dear all, I am using FreeIPA, Version: 4.8.4 on CentOS 8 ipa-client.x86_64 4.8.4-7.module_el8.2.0+374+0d2d74a1 @AppStream ipa-client-common.noarch 4.8.4-7.module_el8.2.0+374+0d2d74a1 @AppStream ipa-common.noarch 4.8.4-7.module_el8.2.0+374+0d2d74a1 @AppStream ipa-healthcheck-core.noarch 0.4-4.module_el8.2.0+374+0d2d74a1 @AppStream ipa-server.x86_64 4.8.4-7.module_el8.2.0+374+0d2d74a1 @AppStream ipa-server-common.noarch 4.8.4-7.module_el8.2.0+374+0d2d74a1 @AppStream ipa-server-dns.noarch 4.8.4-7.module_el8.2.0+374+0d2d74a1 @AppStream Whenever I open the "Authentication" tab in the freeIPA webserver, I get the error "IPA-Error 903: InternalError. An internal error has happend". Retry does not help, within Authentication I can use all tabs, except from the Authentication -> Certificate -> Certificate one. This one gives the error. I can also not search for a certificate. The other areas of Authentication -> Certificate (Certificate Profiles, CA ACLS, Certificate Authorities) work without problems. As a test I cloned the machine and updated it to the latest CentOS 8 version with a newer freeIPA version on it, but that did not solve the problem and I scrapped this vm and idea again. Any idea on how to resolve the issue / what could be broken? Which logs and things would be useful to look into? Thanks a lot for your help and have a nice day Nico

4 8

Problem running IPA client on IPv6 only connection
by William Muriithi 26 Jul '22

26 Jul '22

Hello, I have an IPA clients that has both IPv4 and IPv6 addresses. One of the IPA client is in the office and hence can reach the IPA server on both IPv4 and IPv6. However, the client outside the LAN can only reach the IPA server over IPv6. I was able to enroll the external client fine over IPv6 and from the logs, all clean. However, when I attempted to ssh, its not able to retreave the user from IPA. The client in the office works fine. I can also make for example LDAP queries and they work over IPv6 fine. It looks like kerberos is somehow however using IPv4. I reached this conclusion after taking a tcpdump when attempting to ssh to the server and the kerberos traffic from the client to IPA is on IPv4. What would I need to do on the IPA client for it to prefer IPv6? I am aware I could remove IPv4 address from DNS, but that would break any communication from IPv4 only systems. Any assistance would be appreaciated. [william@ansible ~]$ ssh root(a)mars.external.example.com Last login: Mon Jan 7 17:19:49 2019 from 65.98.193.94 [root@mars ~]# kinit admin kinit: Cannot contact any KDC for realm 'EXTERNAL.EXAMPLE.COM <http://external.example.com/>' while getting initial credentials [root@mars ~]# ldapsearch -x -b cn=ftp,cn=groups,cn=compat,dc=external,dc=example,dc=com | tail -n 4 result: 0 Success # numResponses: 2 # numEntries: 1 [root@mars ~]# cat /etc/resolv.conf search external.example.com nameserver 2607:4860:6000:a::5 [root@mars ~]# Regards, William

5 10

ssh key issues
by Andrew Meyer 21 Jul '22

21 Jul '22

I recently cleaned up a few server in my home lab. Deleted servers that I no longer needed. However It seems I have a server with an IP address that used previously. FreeIPA is reporting that it is in /var/lib/sss/pubconf/known_hosts but I can't reverse engineer the hostname by doing sshkey -R 1.2.3.4. I have run into this issue previously but it has bee quite some time. When I go to delete the line from /var/lib/sss/pubconf/known_hosts it is gone. If someone could help me that would be great. I didn't see anything on my FreeIPA master that indicated I did anything there.

5 12

Could not login with AD user
by Ronald Wimmer 20 Jul '22

20 Jul '22

Today I was not able to log in with an AD user to an IPA client within a test setup. IPA users worked fine. DNS is managed externally. I figured out that the DNS-Record of that particular IPA client has not been created correctly. After having corrected the DNS entry and having dropped the SSSD cache on that client I could login with my AD user. Do you have an explanation for that or was it just a coincidence? Cheers, Ronald

4 13

freeipa/certmonger for openvpn user certificates
by Patrick Spinler 27 Jun '22

27 Jun '22

Hi, I'm setting up an openvpn server and I'd like to use our already existing FreeIPA CA to issue user keys/certs for openvpn's use. Since our OpenVPN box is a freeipa client, I thought it'd be nice to use certmonger to issue and keep up to date these certs. Ergo, I've created a certificate profile: pat@apex-freeipa ~$ ipa certprofile-show --all OpenVPNUserCert dn: cn=OpenVPNUserCert,cn=certprofiles,cn=ca,dc=int,dc=apexmw,dc=com Profile ID: OpenVPNUserCert Profile description: OpenVPN User Certificates Store issued certificates: FALSE objectclass: ipacertprofile, top And also a CA acl. For experimentation (and working vs our test freeipa) I've left this as wide open as I can: [pat@apex-freeipa ~]$ ipa caacl-show --all OpenVPN_User_Certificate_ACL dn: ipaUniqueID=6dde33a6-7849-11e9-aa05-525400b52c7b,cn=caacls,cn=ca,dc=int,dc=apexmw,dc=com ACL name: OpenVPN_User_Certificate_ACL Enabled: TRUE CA category: all Profile category: all User category: all Host category: all Service category: all ipauniqueid: 6dde33a6-7849-11e9-aa05-525400b52c7b objectclass: ipaassociation, ipacaacl Then, on my openvpn server, I ask for a cert for use for one of my users (myself, in this case): root@apex-openvpn:~# ipa-getcert request -f /etc/openvpn/client/pat.crt -k /etc/openvpn/client/pat.key -r -N 'CN=pat,O=INT.APEXMW.COM' -K pat -g 4096 --profile OpenVPNUserCert New signing request "20190603014016" added. But, it fails due to an access err vs the 'userCertificate' attribute of my account: root@apex-openvpn:~# ipa-getcert list (...snippy snip excess...) Request ID '20190603014016': status: CA_REJECTED ca-error: Server at https://apex-freeipa.int.apexmw.com/ipa/xml denied our request, giving up: 2100 (RPC failed at server. Insufficient access: Insufficient 'write' privilege to the 'userCertificate' attribute of entry 'uid=pat,cn=users,cn=accounts,dc=int,dc=apexmw,dc=com'.). stuck: yes key pair storage: type=FILE,location='/etc/openvpn/client/pat.key' certificate: type=FILE,location='/etc/openvpn/client/pat.crt' CA: IPA issuer: subject: expires: unknown pre-save command: post-save command: track: yes auto-renew: yes If I look at the dirsrv log, here's the accesses I see for this request (trimmed off the date/time to make the lines a _little_ shorter): root@apex-freeipa slapd-INT-APEXMW-COM# grep conn=178 access | cut -d' ' -f3- conn=178 fd=114 slot=114 connection from 10.10.200.1 to 10.10.200.1 conn=178 op=0 BIND dn="" method=sasl version=3 mech=GSS-SPNEGO conn=178 op=0 RESULT err=0 tag=97 nentries=0 etime=0.0025554208 dn="fqdn=apex-openvpn.int.apexmw.com,cn=computers,cn=accounts,dc=int,dc=apexmw,dc=com" conn=178 op=1 SRCH base="cn=ipaconfig,cn=etc,dc=int,dc=apexmw,dc=com" scope=0 filter="(objectClass=*)" attrs=ALL conn=178 op=1 RESULT err=0 tag=101 nentries=1 etime=0.0001319554 conn=178 op=2 SRCH base="cn=masters,cn=ipa,cn=etc,dc=int,dc=apexmw,dc=com" scope=2 filter="(&(objectClass=ipaConfigObject)(cn=CA))" attrs=ALL conn=178 op=2 RESULT err=0 tag=101 nentries=1 etime=0.0000979573 conn=178 op=3 SRCH base="cn=masters,cn=ipa,cn=etc,dc=int,dc=apexmw,dc=com" scope=2 filter="(&(objectClass=ipaConfigObject)(cn=CA))" attrs=ALL conn=178 op=3 RESULT err=0 tag=101 nentries=1 etime=0.0000736730 conn=178 op=4 SRCH base="cn=cas,cn=ca,dc=int,dc=apexmw,dc=com" scope=2 filter="(&(objectClass=ipaca)(cn=ipa))" attrs="" conn=178 op=4 RESULT err=0 tag=101 nentries=1 etime=0.0000499142 conn=178 op=5 SRCH base="cn=ipa,cn=cas,cn=ca,dc=int,dc=apexmw,dc=com" scope=0 filter="(objectClass=*)" attrs="ipaCaId ipaCaSubjectDN cn ipaCaIssuerDN description" conn=178 op=5 RESULT err=0 tag=101 nentries=1 etime=0.0000482726 conn=178 op=6 SRCH base="cn=apex-freeipa.int.apexmw.com,cn=masters,cn=ipa,cn=etc,dc=int,dc=apexmw,dc=com" scope=2 filter="(&(objectClass=ipaConfigObject)(ipaConfigString=enabledService)(cn=CA))" attrs=ALL conn=178 op=6 RESULT err=0 tag=101 nentries=1 etime=0.0000950646 notes=U conn=178 op=7 SRCH base="cn=accounts,dc=int,dc=apexmw,dc=com" scope=2 filter="(&(objectClass=krbprincipalaux)(krbPrincipalName=pat(a)INT.APEXMW.COM))" attrs=ALL conn=178 op=7 RESULT err=0 tag=101 nentries=1 etime=0.0002747849 conn=178 op=8 EXT oid="1.3.6.1.4.1.4203.1.11.3" name="whoami-plugin" conn=178 op=8 RESULT err=0 tag=120 nentries=0 etime=0.0000135034 conn=178 op=9 SRCH base="cn=request certificate ignore caacl,cn=virtual operations,cn=etc,dc=int,dc=apexmw,dc=com" scope=0 filter="(objectClass=*)" attrs="objectClass" conn=178 op=9 RESULT err=0 tag=101 nentries=1 etime=0.0000932668 - entryLevelRights: none conn=178 op=10 SRCH base="uid=pat,cn=users,cn=accounts,dc=int,dc=apexmw,dc=com" scope=0 filter="(objectClass=*)" attrs="distinguishedName" conn=178 op=10 RESULT err=0 tag=101 nentries=1 etime=0.0000640289 conn=178 op=11 SRCH base="uid=pat,cn=users,cn=accounts,dc=int,dc=apexmw,dc=com" scope=0 filter="(objectClass=*)" attrs="telephoneNumber ipaSshPubKey uid krbCanonicalName ipatokenRadiusUserName ipaUserAuthType krbPrincipalExpiration homeDirectory nsAccountLock usercertificate;binary title loginShell uidNumber mail ipaCertMapData memberOf memberofindirect krbPrincipalName givenName gidNumber sn ou userClass ipatokenRadiusConfigLink" conn=178 op=11 RESULT err=0 tag=101 nentries=1 etime=0.0001401737 conn=178 op=12 SRCH base="dc=int,dc=apexmw,dc=com" scope=2 filter="(|(member=uid=pat,cn=users,cn=accounts,dc=int,dc=apexmw,dc=com)(memberUser=uid=pat,cn=users,cn=accounts,dc=int,dc=apexmw,dc=com)(memberHost=uid=pat,cn=users,cn=accounts,dc=int,dc=apexmw,dc=com))" attrs="" conn=178 op=12 RESULT err=0 tag=101 nentries=7 etime=0.0001492344 notes=P pr_idx=0 pr_cookie=-1 conn=178 op=13 SRCH base="uid=pat,cn=users,cn=accounts,dc=int,dc=apexmw,dc=com" scope=0 filter="(userPassword=*)" attrs="userPassword" conn=178 op=13 RESULT err=0 tag=101 nentries=1 etime=0.0000524838 conn=178 op=14 SRCH base="uid=pat,cn=users,cn=accounts,dc=int,dc=apexmw,dc=com" scope=0 filter="(krbPrincipalKey=*)" attrs="krbPrincipalKey" conn=178 op=14 RESULT err=0 tag=101 nentries=1 etime=0.0000597589 conn=178 op=15 SRCH base="ipaUniqueID=80b23b30-6a0c-11e9-baa3-525400b52c7b,cn=sudorules,cn=sudo,dc=int,dc=apexmw,dc=com" scope=0 filter="(objectClass=*)" attrs="cn" conn=178 op=15 RESULT err=0 tag=101 nentries=1 etime=0.0000379744 conn=178 op=16 SRCH base="ipaUniqueID=5fb3a640-705a-11e9-aa05-525400b52c7b,cn=hbac,dc=int,dc=apexmw,dc=com" scope=0 filter="(objectClass=*)" attrs="cn" conn=178 op=16 RESULT err=0 tag=101 nentries=1 etime=0.0000337904 conn=178 op=17 SRCH base="cn=caacls,cn=ca,dc=int,dc=apexmw,dc=com" scope=1 filter="(&(objectClass=ipaassociation)(objectClass=ipacaacl))" attrs="serviceCategory cn ipaMemberCertProfile ipaMemberCa ipaCertProfileCategory memberUser userCategory hostCategory memberHost ipaEnabledFlag ipaCaCategory memberService description" conn=178 op=17 RESULT err=0 tag=101 nentries=2 etime=0.0001647058 conn=178 op=18 EXT oid="1.3.6.1.4.1.4203.1.11.3" name="whoami-plugin" conn=178 op=18 RESULT err=0 tag=120 nentries=0 etime=0.0000138321 conn=178 op=19 SRCH base="uid=pat,cn=users,cn=accounts,dc=int,dc=apexmw,dc=com" scope=0 filter="(objectClass=*)" attrs="userCertificate" conn=178 op=19 RESULT err=0 tag=101 nentries=1 etime=0.0001475052 - entryLevelRights: none conn=178 op=20 UNBIND conn=178 op=20 fd=114 closed - U1 To begin with, I note that this session does a BIND with 'dn=""', right at the beginning, it's essentially an anonymous bind, yah? That operation near the end, here: op=17 SRCH base="cn=caacls,cn=ca,dc=int,dc=apexmw,dc=com" scope=1 filter="(&(objectClass=ipaassociation)(objectClass=ipacaacl))" seems like it might be kinda key. and indeed, if I attempt to run this by hand as an anonymous bind, I get no results: root@apex-freeipa slapd-INT-APEXMW-COM# ldapsearch -x -h localhost -b dc=int,dc=apexmw,dc=com -s sub "(|(objectClass=ipaassociation)(objectClass=ipacaacl))" # extended LDIF # # LDAPv3 # base <dc=int,dc=apexmw,dc=com> with scope subtree # filter: (|(objectClass=ipaassociation)(objectClass=ipacaacl)) # requesting: ALL # # search result search: 2 result: 0 Success # numResponses: 1 It's only if I run this as an _authenticated_ bind, that I can find my ACL: root@apex-freeipa slapd-INT-APEXMW-COM# ldapsearch -x -D "cn=Directory Manager" -W -h localhost -b dc=int,dc=apexmw,dc=com -s sub "(&(objectClass=ipaassociation)(objectClass=ipacaacl))" cn Enter LDAP Password: # extended LDIF # # LDAPv3 # base <dc=int,dc=apexmw,dc=com> with scope subtree # filter: (&(objectClass=ipaassociation)(objectClass=ipacaacl)) # requesting: cn # # c98b740c-6903-11e9-ad1b-525400b52c7b, caacls, ca, int.apexmw.com dn: ipaUniqueID=c98b740c-6903-11e9-ad1b-525400b52c7b,cn=caacls,cn=ca,dc=int,dc =apexmw,dc=com cn: hosts_services_caIPAserviceCert # 6dde33a6-7849-11e9-aa05-525400b52c7b, caacls, ca, int.apexmw.com dn: ipaUniqueID=6dde33a6-7849-11e9-aa05-525400b52c7b,cn=caacls,cn=ca,dc=int,dc =apexmw,dc=com cn: OpenVPN_User_Certificate_ACL # search result search: 2 result: 0 Success # numResponses: 3 # numEntries: 2 Is this (using certmonger to auto-issue signed certs/keys for my openvpn users) going to be essentially impossible to do, here? Do I need to go a more traditional route of creating a seperate keystore/certdb, issuing a CSR, and feeding that to FreeIPA to sign? Any advice appreciated, and thanks in advance, -- Pat

4 6

Broken ipa replica
by Giulio Casella 08 May '22

08 May '22

Hi everyone, I'm stuck with a broken replica. I had a setup with two ipa server in replica (ipa-server-4.6.4 on CentOS 7.6), let's say "idc01" and "idc02". Due to heavy load idc01 crashed many times, and was not working anymore. So I tried to redo the replica again. At first I tried to "ipa-replica-manage re-initialize", with no success. Now I'm trying to redo from scratch the replica setup: on idc02 I removed the segments (ipa topologysegment-del, for both ca and domain suffix), on idc01 I removed everything (ipa-server-install --uninstall), then I joined domain (ipa-client-install), and everything is working so far. When doing "ipa-replica-install" on idc01 I get: [...] [28/41]: setting up initial replication Starting replication, please wait until this has completed. Update in progress, 22 seconds elapsed [ldap://idc02.my.dom.ain:389] reports: Update failed! Status: [Error (-11) connection error: Unknown connection error (-11) - Total update aborted] And on idc02 (the working server), in /var/log/dirsrv/slapd-MY-DOM-AIN/errors I find lines stating: [20/Mar/2019:09:28:06.545187923 +0100] - INFO - NSMMReplicationPlugin - repl5_tot_run - Beginning total update of replica "agmt="cn=meToidc01.my.dom.ain" (idc01:389)". [20/Mar/2019:09:28:26.528046160 +0100] - ERR - NSMMReplicationPlugin - perform_operation - agmt="cn=meToidc01.my.dom.ain" (idc01:389): Failed to send extended operation: LDAP error -1 (Can't contact LDAP server) [20/Mar/2019:09:28:26.530763939 +0100] - ERR - NSMMReplicationPlugin - repl5_tot_log_operation_failure - agmt="cn=meToidc01.my.dom.ain" (idc01:389): Received error -1 (Can't contact LDAP server): for total update operation [20/Mar/2019:09:28:26.532678072 +0100] - ERR - NSMMReplicationPlugin - release_replica - agmt="cn=meToidc01.my.dom.ain" (idc01:389): Unable to send endReplication extended operation (Can't contact LDAP server) [20/Mar/2019:09:28:26.534307539 +0100] - ERR - NSMMReplicationPlugin - repl5_tot_run - Total update failed for replica "agmt="cn=meToidc01.my.dom.ain" (idc01:389)", error (-11) [20/Mar/2019:09:28:26.561763168 +0100] - INFO - NSMMReplicationPlugin - bind_and_check_pwp - agmt="cn=meToidc01.my.dom.ain" (idc01:389): Replication bind with GSSAPI auth resumed [20/Mar/2019:09:28:26.582389258 +0100] - WARN - NSMMReplicationPlugin - repl5_inc_run - agmt="cn=meToidc01.my.dom.ain" (idc01:389): The remote replica has a different database generation ID than the local database. You may have to reinitialize the remote replica, or the local replica. It seems that idc02 remembers something about the old replica. Any hint? Thank you in advance, Giulio

5 10

IPA CA allow CSR SAN names in external domains
by Steve Dainard 14 Mar '22

14 Mar '22

Hello I have a RHEL7 IPA server installed as a subordinate CA. I'd like to be able to add SAN's for a different dns domain than exists in the IPA realm. The dns for 'otherdomain.com' is handled by active directory which my IPA server has a cross-forest trust with. ie: host: client1.ipadomain.com certificate: CN = client1.ipadomain.com, SAN = client1.ipadomain.com, servicename.otherdomain.com When I try to submit this CSR with 'ipa-getcert request' the IPA server denies with: "The service principal for subject alt name servicename.otherdomain.com in certificate request does not exist" It seems that the default CAACL enforces a profile named 'caIPAserviceCert', but I'm having some trouble determining what can be modified (or cloned and changed in a new profile) that would allow the CA to sign a CSR that contains *.ipadomain.com and *.otherdomain.com in the SAN. This is the only section in the profile that contains SAN: policyset.serverCertSet.12.constraint.class_id=noConstraintImpl policyset.serverCertSet.12.constraint.name=No Constraint policyset.serverCertSet.12.default.class_id=commonNameToSANDefaultImpl policyset.serverCertSet.12.default.name=Copy Common Name to Subject Alternative Name Thanks, Steve

3 3

freeipa with sudo and 2FA (OTP)
by John Ratliff 31 Jan '22

31 Jan '22

I'm trying to setup freeipa with OTP. I created a TOTP under my user in freeipa and updated my user to use 2FA (password + OTP). When I try to do sudo, it only asks for my password and it fails every time (presumably because it isn't getting the OTP first). I didn't see anything useful in the sss_sudo logs, even after adding debug_level = 6 in the config. What can I do to further troubleshoot this? Thanks.

4 6

IPA broken after dnf update on CentOS 8
by Vinícius Ferrão 15 Jan '22

15 Jan '22

Hello, I’ve a single IPA machine that provides authentication for itself. It does not even have any client or host. After def -y update and reboot, IPA fails to load an it’s in broken state. [root@headnode ~]# systemctl status ipa ● ipa.service - Identity, Policy, Audit Loaded: loaded (/usr/lib/systemd/system/ipa.service; enabled; vendor preset: disabled) Active: failed (Result: exit-code) since Wed 2021-01-06 16:14:48 -03; 45min ago Process: 1278 ExecStart=/usr/sbin/ipactl start (code=exited, status=1/FAILURE) Main PID: 1278 (code=exited, status=1/FAILURE) Jan 06 16:14:48 headnode.cluster.tmc.if.ufrj.br ipactl[1278]: CRL tree already moved Jan 06 16:14:48 headnode.cluster.tmc.if.ufrj.br ipactl[1278]: IPA server upgrade failed: Inspect /var/log/ipaupgrade.log and run command i> Jan 06 16:14:48 headnode.cluster.tmc.if.ufrj.br ipactl[1278]: Unexpected error - see /var/log/ipaupgrade.log for details: Jan 06 16:14:48 headnode.cluster.tmc.if.ufrj.br ipactl[1278]: CalledProcessError: CalledProcessError(Command ['/bin/systemctl', 'start', '> Jan 06 16:14:48 headnode.cluster.tmc.if.ufrj.br ipactl[1278]: The ipa-server-upgrade command failed. See /var/log/ipaupgrade.log for more > Jan 06 16:14:48 headnode.cluster.tmc.if.ufrj.br ipactl[1278]: See the upgrade log for more details and/or run /usr/sbin/ipa-server-upgrade> Jan 06 16:14:48 headnode.cluster.tmc.if.ufrj.br ipactl[1278]: Aborting ipactl Jan 06 16:14:48 headnode.cluster.tmc.if.ufrj.br systemd[1]: ipa.service: Main process exited, code=exited, status=1/FAILURE Jan 06 16:14:48 headnode.cluster.tmc.if.ufrj.br systemd[1]: ipa.service: Failed with result 'exit-code'. Jan 06 16:14:48 headnode.cluster.tmc.if.ufrj.br systemd[1]: Failed to start Identity, Policy, Audit. If asks for look on /var/log/ipaupgrade.log; but this log is just overwhelming. You must know what you should be looking for for actually find something. The relevant thing that I’ve found by myself is: 2021-01-06T19:09:51Z DEBUG The ipa-server-upgrade command failed, exception: CalledProcessError: CalledProcessError(Command ['/bin/systemctl', 'start', 'pki-tomcatd(a)pki-tomcat.service<mailto:pki-tomcatd@pki-tomcat.service>'] returned non-zero exit status 1: 'Job for pki-tomcatd(a)pki-tomcat.service<mailto:pki-tomcatd@pki-tomcat.service> failed because a timeout was exceeded.\nSee "systemctl status pki-tomcatd(a)pki-tomcat.service<mailto:pki-tomcatd@pki-tomcat.service>" and "journalctl -xe" for details.\n’) Is that Java regression again that happened a month or two ago? Thank you all.

5 7

Problems after replacing SSL certificates
by Andreas Bulling 21 Oct '21

21 Oct '21

Dear all, I have recently started using FreeIPA (4.8.1 on Ubuntu) and now wanted to replace the original SSL certificates for the web UI and the LDAP server with official ones issued by our university. I've followed the procedure described here (no errors): https://www.freeipa.org/page/Using_3rd_part_certificates_for_HTTP/LDAP I could confirm in the browser that the certificate for the web UI has been replaced and I therefore assume so has the LDAP certificate. Authentication from other hosts/services using LDAP still works but in the server log file I see errors like these for all hosts in the domain: Apr 20 19:57:11 auth krb5kdc[24895]: AS_REQ (8 etypes {18 17 20 19 16 23 25 26}) X: NEEDED_PREAUTH: host/X@X for krbtgt/X@X, Additional pre-authentication required Apr 20 19:57:11 auth krb5kdc[24895]: closing down fd 12 Apr 20 19:57:11 auth krb5kdc[24895]: AS_REQ (8 etypes {18 17 20 19 16 23 25 26}) X: ISSUE: authtime 1587405431, etypes {rep=18 tkt=18 ses=18}, host/X@X for krbtgt/X@X Apr 20 19:57:11 auth krb5kdc[24895]: closing down fd 12 Apr 20 19:57:11 auth krb5kdc[24895]: TGS_REQ (8 etypes {18 17 20 19 16 23 25 26}) X: ISSUE: authtime 1587405431, etypes {rep=18 tkt=18 ses=18}, host/X@X for ldap/X@X Apr 20 19:57:11 auth krb5kdc[24895]: closing down fd 12 Also, ipa-certupdate on the respective clients shows ipa-certupdate trying https://X/ipa/json [try 1]: Forwarding 'schema' to json server 'https://X/ipa/json' cannot connect to 'https://X/ipa/json': [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:727) The ipa-certupdate command failed. Also, I can't login to the web UI anymore. I tried ipa-getkeytab -s X -p HTTP/X@X -k /var/lib/ipa/gssproxy/http.keytab on the freeipa server (followed by ipactl restart) but this didn't help. Any idea/suggestions for how to get everything working again? Thanks a lot!

6 15

User in AD not found by IPA
by Marc Boorshtein 14 Oct '21

14 Oct '21

We added a new account to AD that has a domain trust with FreeIPA. This one user is having an issue where IPA can't find him. The user is in the same OU as other users that work fine. The user is unlocked (userAccountControl is 512) and the userprincipalname is set. When I try to add the user to an id view or an external group IPA gives me the error "trusted domain object not found" . Not really sure where to look next to figure out what's wrong. We see the user when we make LDAP calls to AD. Thanks Marc

4 14

freeIPA Status Debian/Ubuntu
by Nico Maas 08 Sep '21

08 Sep '21

Hello there, with the decline of CentOS I need to migrate away from CentOS 8 to something different. I just wanted to ask how currently the status of the Debian or Ubuntu versions of freeIPA is - and if there is any possibility to migrate freeIPA installation / "backup and restore"? Best regards, Nico

10 14

Cannot add externally-signed IPA CA certificate
by Dmitry Perets 27 Aug '21

27 Aug '21

Hi, I am trying to configure FreeIPA as a SubCA, and the "RootCA" is self-made with openssl. So I've signed the FreeIPA's request with my self-signed "root ca" certificate, but it looks like FreeIPA doesn't like it: ipa-server-install --external-cert-file=/root/rootca/rootcacert.pem --external-cert-file=/root/rootca/certs/ipacert.pem <...skipped...> ipa.ipapython.install.cli.install_tool(CompatServerMasterInstall): ERROR CA certificate CN=RootCA,OU=PRJ,O=COMPANY,L=Bonn,C=DE in /root/rootca/rootcacert.pem, /root/rootca/certs/ipacert.pem is not valid: not a CA certificate ipa.ipapython.install.cli.install_tool(CompatServerMasterInstall): ERROR The ipa-server-install command failed. See /var/log/ipaserver-install.log for more information The subj above is my self-made root CA cert, so it looks like something is missing in it. But what...? Here is it below, it has the "Basic Constraint" set with CA:TRUE... What else is required, so that FreeIPA accepts it as a root CA? Should I add it somewhere first, before running the ipa-server-install? [root@ipa ~]# openssl x509 -text -noout -in /root/rootca/rootcacert.pem Certificate: Data: Version: 3 (0x2) Serial Number: 0 (0x0) Signature Algorithm: sha256WithRSAEncryption Issuer: C=DE, L=Bonn, O=COMPANY, OU=PRJ, CN=RootCA Validity Not Before: Oct 24 11:43:13 2018 GMT Not After : Oct 21 11:43:13 2028 GMT Subject: C=DE, L=Bonn, O=COMPANY, OU=PRJ, CN=RootCA Subject Public Key Info: Public Key Algorithm: rsaEncryption Public-Key: (4096 bit) Modulus: <...skipped...> Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Subject Key Identifier: B3:18:3B:CF:29:D2:A5:D4:AE:94:A5:42:65:A2:D8:12:7C:92:78:81 X509v3 Authority Key Identifier: keyid:B3:18:3B:CF:29:D2:A5:D4:AE:94:A5:42:65:A2:D8:12:7C:92:78:81 X509v3 Basic Constraints: CA:TRUE Signature Algorithm: sha256WithRSAEncryption <...skipped...> Thanks!!

2 2

Changing directory manager password
by Ian Pilcher 29 Jul '21

29 Jul '21

Maybe it's just me, but I still find the documentation on this subject confusing. (This is probably because the docs seem to be telling me that I don't need to do anything beyond the actual password change, and I don't trust answers that seem too easy.) I running a single-node IPA 4.6.8 on RHEL 7. The actual password change with ldapmodify[1] is simple enough. Am I reading the FreeIPA documentation[2] correctly, that I don't need to perform any other steps? Thanks! [1] https://directory.fedoraproject.org/docs/389ds/howto/howto-resetdirmgrpassw… [2] https://www.freeipa.org/page/Howto/Change_Directory_Manager_Password -- ======================================================================== Ian Pilcher Sr. Principal Product Manager +1 469 892-8704 Red Hat Cloud Platforms ========================================================================

5 7

Network I/O error when trying to resolve AD users
by Ronald Wimmer 28 Jul '21

28 Jul '21

Today I set up an IPA test web application in our IPA test environment. I figured out that my AD user was resolved but the user of my colleague was not. (getent passwd userA/userB) I stopped SSSD, cleared the cache with 'rm -rf /var/lib/sss/db/*' and started SSSD again. After that I could not resolve any AD user. The sssd logs showed an Network I/O error: ==> /var/log/sssd/sssd_ipatest.mydomain.at.log <== (2021-06-30 11:46:14): [be[ipatest.mydomain.at]] [ipa_s2n_exop_done] (0x0040): ldap_extended_operation result: Operations error(1), Failed to handle the request. . (2021-06-30 11:46:14): [be[ipatest.mydomain.at]] [ipa_s2n_exop_done] (0x0040): ldap_extended_operation failed, server logs might contain more details. (2021-06-30 11:46:14): [be[ipatest.mydomain.at]] [ipa_s2n_get_user_done] (0x0040): s2n exop request failed. (2021-06-30 11:46:14): [be[ipatest.mydomain.at]] [ipa_subdomain_account_done] (0x0040): ipa_get_*_acct request failed: [1432158230]: Network I/O Error. ==> /var/log/sssd/sssd_nss.log <== (2021-06-30 11:46:14): [nss] [cache_req_common_process_dp_reply] (0x0040): CR #197: Data Provider Error: 3, 1432158230, Network I/O Error (2021-06-30 11:46:14): [nss] [cache_req_common_process_dp_reply] (0x0400): CR #197: Due to an error we will return cached data (2021-06-30 11:46:14): [nss] [cache_req_search_cache] (0x0400): CR #197: Looking up [aduser271(a)ORG.MYDOMAIN.AT] in cache (2021-06-30 11:46:14): [nss] [cache_req_search_cache] (0x0400): CR #197: Object [aduser271(a)ORG.MYDOMAIN.AT] was not found in cache (2021-06-30 11:46:14): [nss] [cache_req_process_result] (0x0400): CR #197: Finished: Not found (2021-06-30 11:46:14): [nss] [client_recv] (0x0200): Client disconnected! What the hell is going on here? Any hints would be highly appreciated! Cheers, Ronald

2 5

Compatibility Plugin .update file for Active Directory
by Joseph Fry 23 Jul '21

23 Jul '21

My goal is to use the compatibility plugin to display IPA hosts in a format that an Active Directory centric tool can consume. Essentially my solution creates two containers under cn=compat called cn=adComputers and cn=adComputerGroups. An entry is added to adComputers for every ipaHost, and attributes populated that match active directory ldap attributes for a 'computer' object. We do the same for each IPA hostgroup. I have come pretty close to getting this working, but now I need to get the groups populated with the group members, but not the IPA hosts... instead I need the members to be the corresponding cn=adComputers entries that were created. So I need to manipulate the members attribute. For example the member attribute of one of the hostgroups in ipa is: fqdn=test.lab.local,cn=computers,cn=accounts,dc=lab,dc=local I need to change it to: cn=test.lab.local,cn=adcomputers,cn=compat,dc=lab,dc=local Below is my .update file. I want to add a line at the end like: add:schema-compat-entry-attribute: member=%{member} But want to rewrite the %{member} value as described above. I know I can do some logic here, as evidenced by https://pagure.io/freeipa/blob/master/f/install/updates/80-schema_compat.up… where they use %ifeq and %%%deref_f. But I cannot find any documentation explaining what options are available. Essentially I am hoping there is some sort of regex manipulation capability here? My .update file so far: dn: cn=adComputers, cn=Schema Compatibility, cn=plugins, cn=config add:objectClass: top add:objectClass: extensibleObject add:cn: adComputers add:schema-compat-container-group: cn=compat, $SUFFIX add:schema-compat-container-rdn: cn=adComputers add:schema-compat-search-base: cn=computers, cn=accounts, $SUFFIX add:schema-compat-search-filter: (&(fqdn=*)(objectClass=ipaHost)) add:schema-compat-entry-rdn: cn=%first("%{fqdn}") add:schema-compat-check-access: yes add:schema-compat-entry-attribute: objectclass=computer add:schema-compat-entry-attribute: cn=%{fqdn} add:schema-compat-entry-attribute: sAMAccountType=805306369 add:schema-compat-entry-attribute: dNSHostName=%{fqdn} add:schema-compat-entry-attribute: operatingSystem=%{nsHardwarePlatform} add:schema-compat-entry-attribute: operatingSystemVersion=%{nsOsVersion} add:schema-compat-entry-attribute: name=%{serverHostName} add:schema-compat-entry-attribute: sAMAccountName=$$%{serverHostName} add:schema-compat-entry-attribute: location=%{nsHostLocation} dn: cn=adComputerGroups, cn=Schema Compatibility, cn=plugins, cn=config add:objectClass: top add:objectClass: extensibleObject add:cn: adComputerGroups add:schema-compat-container-group: cn=compat, $SUFFIX add:schema-compat-container-rdn: cn=adComputerGroups add:schema-compat-search-base: cn=hostgroups, cn=accounts, $SUFFIX add:schema-compat-search-filter: (&(member=*)(objectClass=ipahostgroup)) add:schema-compat-entry-rdn: cn=%{cn} add:schema-compat-entry-check-access: yes add:schema-compat-entry-attribute: objectclass=group add:schema-compat-entry-attribute: cn=%{cn} add:schema-compat-entry-attribute: groupType=-2147483646 add:schema-compat-entry-attribute: sAMAccountType=268435456 add:schema-compat-entry-attribute: name=%{cn} add:schema-compat-entry-attribute: sAMAccountName=$$%{cn}

4 24

FreeIPA server packages upgrade best practice
by Suchismita Panda 16 Jul '21

16 Jul '21

Hi, I would like to know the best practice for patching FreeIPA-Server packages. We generally have daily patching enabled in our servers. Will it be a good idea to do automatic patching of FreeIPA-Server packages? If we want to restrict the FreeIPA-Server packages from automatomatic upgrade and rather keep it for manual upgrade, what are the packages we should hold back with a version restriction? And how frequently should we do the manual upgrade? If the FreeIPA-client packages are upgraded regularly by daily patching(yum-cron or unattended upgrade) will there be any problem with authentication, if the FreeIPA-Servers are behind version upgrade? We have two FreeIPA environments, one with CentOS7 and another with CentOS8. And we have FreeIPA clients mostly with Ubuntu(18 and 20) and CentOS (7 and 8). Any help and guidance is appreciated. Thanks Suchi

4 7

healthcheck complains about a removed replica
by Kees Bakker 13 Jul '21

13 Jul '21

Hi, After installing a new replica and running /usr/bin/ipa-healthcheck --source pki.server.healthcheck.clones.connectivity_and_data I'm getting this error keyctl_search: Required key not available Enter password for Internal Key Storage Token: Internal server error HTTPSConnectionPool(host='iparep3.ghs.nl', port=443): Max retries exceeded with url: /ca/rest/certs/search?size=3 (Caused by NewConnectionError('<urllib3.connection.VerifiedHTTPSConnection object at 0x7fc473262a90>: Failed to establish a new connection: [Errno 113] No route to host',)) [ { "source": "pki.server.healthcheck.clones.connectivity_and_data", "check": "ClonesConnectivyAndDataCheck", "result": "ERROR", "uuid": "c2f3ec1d-494b-4f6a-b6e3-0e38108f2005", "when": "20210528150818Z", "duration": "30.348789", "kw": { "status": "ERROR: pki-tomcat : Internal error testing CA clone. Host: iparep3.ghs.nl Port: 443" } } ] First, it is asking for a password, and I have no clue for what. I've tried the admin password and the Directory Manager password. It makes no difference. Second, it tries to connect to a replica that was removed several months ago. Both ipa-replica-manage list and ipa-csreplica-manage show the correct list of masters that we currently have. Where does ipa-healthcheck get the information from to query the removed replica? BTW. Two replica run CentOS 8 Stream, and one runs CentOS 7. The first two give this healthcheck error, the centos7 master does not. -- Kees

5 19

IPA client + AD Trust + ID Override inconsistent lookup results
by iulian roman 07 Jul '21

07 Jul '21

Hello everybody, I try to make the above combination to work in my environment , and already spent several weeks + open a few threads with different sort of issues. So far, I can say that it works only with workarounds , restarts, clear caches, etc , which is not the setup I can move in production with. I try to provide the latest update of the setup and the issues I am currently facing: RedHat Idm with AD trust configured (non-posix) Default Trust View configured which overrides the UID and GID of the AD users The UID and GID do exist in Active Directory (the user and group have the same name) , although the group name is in different OU - I do not know if this is an issue or not On the client, some of the users are resolved, some not. If I manually run getent group <username> before running the id command, it does resolve the group and user. Without running getent group command, sometimes it resolves, sometimes not. I checked the logs on the client and server and the errors I noticed when running id <username> are: on the client: [ipa_s2n_exop_done] (0x0040): ldap_extended_operation result: No such object(32), (null) on the server: [nss] [nss_protocol_fill_initgr] (0x0080): Unable to find primary gid [2]: No such file or directory It seems to be related to the magical primary GID which seems to be the source of all my issues, but I. have no idea how to fix it (the GID exist in AD and it is defined in the Default Trust View). I am considering even changing settings in AD, but I do not know what should I change. I tried to define as well all the AD groups (for which I do group override in Default Trust View) in IPA as posix groups with that specific GID . In that situation for some users the lookup failed first time but after the negative cache expired or sssd is restarted the lookup for the user and group works properly (situation was quite similar with the one in the thread https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost… ). For AD users which do not have attributes overwritten everything works properly.

2 5

FreeIPA Upgrade F31 -> F32: usr/lib/api/apiutil.c Could not open /run/lock/opencryptoki/LCK..APIlock
by Anthony Joseph Messina 01 Jul '21

01 Jul '21

After upgrading FreeIPA from F31 to F32, on startup I now see a lot of these errors from certmonger, ns-slapd, java, etc. May 08 17:57:28 certmonger[38]: usr/lib/api/apiutil.c Could not open /run/lock/opencryptoki/LCK..APIlock May 08 17:57:30 ns-slapd[67]: usr/lib/api/apiutil.c Could not open /run/lock/opencryptoki/LCK..APIlock May 08 17:57:33 dogtag-ipa-renew-agent-submit[143]: usr/lib/api/apiutil.c Could not open /run/lock/opencryptoki/LCK..APIlock May 08 17:57:42 java[640]: usr/lib/api/apiutil.c Could not open /run/lock/opencryptoki/LCK..APIlock The server seems to come up without issue, but can you point me in the right direction to resolve these errors? freeipa-server-4.8.6-1.fc32.x86_64 opendnssec-2.1.6-5.fc32.x86_64 opencryptoki-3.13.0-1.fc32.x86_64 I've installed a fresh F32 freeipa-server (on a test domain) and I don't see these errors. Thanks. -A -- Anthony - https://messinet.com F9B6 560E 68EA 037D 8C3D D1C9 FF31 3BDB D9D8 99B6

7 9

How does FreeIPA resolve AD group names
by iulian roman 30 Jun '21

30 Jun '21

Hello everybody, Can anyone explain which attribute is used to lookup/resolve group names in AD ? As far as I can see on my ipa clients, it seems to use sAMAccountName . Is that correct ?

2 2

FreeIPA 4.9.6 released
by Alexander Bokovoy 29 Jun '21

29 Jun '21

The FreeIPA team would like to announce FreeIPA 4.9.6 release! It can be downloaded from http://www.freeipa.org/page/Downloads. Builds for Fedora distributions will be available from the official repository soon. == Highlights in 4.9.6 * 8402: [RFE] ipa-client-install forces nsupdate to bind with gssapi Invoke nsupdate without authentication if the GSS-TSIG attempt fails at install time ; configure SSSD to use nsupdate without GSS-TSIG in this case. === Enhancements === Known Issues * FreeIPA 4.9.4 contains a new LDAP caching layer that might incorrectly return data in certain cases. This is known to affect ansible-freeipa operations with automember rules. FreeIPA 4.9.6 addresses this issue. === Bug fixes FreeIPA 4.9.6 is a stabilization release for the features delivered as a part of 4.9.0 version series. There are more than 10 bug-fixes since FreeIPA 4.9.5 release. Details of the bug-fixes can be seen in the list of resolved tickets below. == Upgrading Upgrade instructions are available on Upgrade page. == Feedback Please provide comments, bugs and other feedback via the freeipa-users mailing list (https://lists.fedoraproject.org/archives/list/freeipa-users@lists.fedorahos…) or #freeipa channel on Freenode. == Resolved tickets * https://pagure.io/freeipa/issue/7752[#7752] ipa client throws http.client.ResponseNotReady error * https://pagure.io/freeipa/issue/8402[#8402] (https://bugzilla.redhat.com/show_bug.cgi?id=1854557[rhbz#1854557]) [RFE] ipa-client-install forces nsupdate to bind with gssapi * https://pagure.io/freeipa/issue/8532[#8532] (https://bugzilla.redhat.com/show_bug.cgi?id=1886837[rhbz#1886837]) Revise PKINIT upgrade code * https://pagure.io/freeipa/issue/8726[#8726] Provide a better error message with updatedns and FQDN Is not provided * https://pagure.io/freeipa/issue/8754[#8754] (https://bugzilla.redhat.com/show_bug.cgi?id=1919384[rhbz#1919384]) Certificate Serial Number issue * https://pagure.io/freeipa/issue/8817[#8817] Running ipa-server-certinstall with v1 certificate fails with Attempted "__iter__" operation on ASN.1 schema object * https://pagure.io/freeipa/issue/8880[#8880] (https://bugzilla.redhat.com/show_bug.cgi?id=1973023[rhbz#1973023]) CA_less ipa-server-install fails if CA cert subject contains non ascii chars * https://pagure.io/freeipa/issue/8882[#8882] Directly integrate custodia * https://pagure.io/freeipa/issue/8884[#8884] (https://bugzilla.redhat.com/show_bug.cgi?id=1967325[rhbz#1967325]) API returns the misleading error "Insufficient Access" if run as non-admin * https://pagure.io/freeipa/issue/8885[#8885] (https://bugzilla.redhat.com/show_bug.cgi?id=1975139[rhbz#1975139]) Upgrade error: Add failure missing required attribute "objectclass" * https://pagure.io/freeipa/issue/8889[#8889] [tests] healthcheck 0.9 * https://pagure.io/freeipa/issue/8897[#8897] (https://bugzilla.redhat.com/show_bug.cgi?id=1976286[rhbz#1976286]) ansible-freeipa automember test fails with `automember_add_condition: testgroup: 'objectclass'` due to ldap cache * https://pagure.io/freeipa/issue/8898[#8898] plugin `plugins` doesn't work -- / Alexander Bokovoy Sr. Principal Software Engineer Security / Identity Management Engineering Red Hat Limited, Finland

2 1

cache invalidation dilema on the clients
by iulian roman 29 Jun '21

29 Jun '21

Hello, I tried for some time to understand how the cache invalidation works on the clients, and I have to admit that I am even more confused that when I started, therefore I would like to ask if there is someone who can either explain or point me to the relevant documentation. I'll describe bellow the situation I am currently facing: PHASE 1 - RedHat Idm with AD trust configured (non-posix) - override the UID of AD users in Idm - on the clients run the id <username> ; the correct (overwritten ) UID and an auto-generated GID is displayed PHASE 2 - overwrite the GID as well on Idm - on the clients still the old auto-generated GID is displayed (after sss_cache -E and restart of sssd) when I run id <username> - remove everything in /var/lib/sss/db , restart sssd and run id <username> - no user found - getent group <username> - new overwritten GID is displayed - id <username> displays the correct UID and GID For the users who are not in cache, restarting sssd seems to be enough (although I did not test if thoroughly). My question is : What do I have to do on the client in order to have the latest information from the Idm Override ? Apparently sss_cache -E and restart ssssd is not enough . Do we always need to remove everything in /var/lib/sss/db in order to have the latest information from the server ?

3 4

dns of two out of three masters not up to date
by Kees Bakker 29 Jun '21

29 Jun '21

Hey, Recently I discovered that the nameservers of two out the three IPA masters (replicas) are not responding with up-to-date information. Our setup has three masters. Each is configured as nameserver. Most of the time I use one as the main master when I modify DNS entries. We also have a DHCP server that sends updates to that "main" master. What I now discovered is that updates are not available when clients use the two other masters. On all three masters the DNS record is present when I use local ldapsearch [1]. But with dig the record is only present on one master. If I restart the nameserver it then has all records available. What would be the best method to find out what is wrong? BTW. There are two things that changed recently. I mention this in case it rings a bell. 1. one master was re-installed with CentOS 8 Stream. An other CentOS8 master was added a few weeks ago. 2. our nameservers don't have connection to the Internet any more. So, root servers cannot be found. [1] by local ldapsearch I mean doing a command like this: ldapsearch -H ldapi://%2fvar%2frun%2f... -- Kees

3 8

CentOS 8 master missing plugins?
by Kees Bakker 29 Jun '21

29 Jun '21

Hey, We have three masters. One is CentOS 7, the other two are CentOS 8 Stream. I'm seeing many plugins on the CentOS 7 in cn=plugins,cn=config (about 388 entries) But on the CentOS 8 systems there are very few plugins (about 30 entries). Is that normal? BTW. I struggling with nameservers not being updated (see thread: "dns of two out of three masters not up to date"). I'm not making any progress with that. -- Kees

2 2

Password avability before change
by Karim Bourenane 28 Jun '21

28 Jun '21

Hello Team I have a small question, about a new password reseted. I have into policy password: Min availability 1 days and max 90 days That means, if I reset a password, the temporary is available 24h ? Can you confirm? FreeIPA : 4.6.5 Bien à vous Mr Karim Bourenane +33686464439 +32 493 86 63 54

2 1

Hidden replica ipa-healthcheck error ADTRUST service is not enabled
by Duncan Mortimer 28 Jun '21

28 Jun '21

Hi, We have a three node Centos 8 IPA domain which we upgraded from Centos 8.3 to 8.4 (IPA version 4.9.2) yesterday. This appeared to succeed without issue, with clients continuing to operate as expected. To give us confidence that all was well we ran ipa-healthcheck on each node post upgrade and this found no issues on our two client facing servers ipa0 and ipa1 but on the third machine, ipa2, which is configured as a hidden replica (and is used to take disaster recovery backups) we received the following error: [ { "source": "ipahealthcheck.ipa.trust", "check": "IPATrustControllerServiceCheck", "result": "ERROR", "uuid": "f5d524a3-43c3-4320-92cb-c984727243d9", "when": "20210624085009Z", "duration": "0.000512", "kw": { "key": "ADTRUST", "msg": "{key} service is not enabled" } } ] We have Samba services setup for Centos based SMB file sharing - there is no Active Directory install on our network. Is this error a concern or is it a consequence of being a hidden replica. If it is a problem, how might we go about fixing the issue? As a first step I've tried re-running ipa-adtrust and this didn't seem to need to make any changes: The log file for this installation can be found in /var/log/ipaserver-adtrust-install.log ============================================================================== This program will setup components needed to establish trust to AD domains for the IPA Server. This includes: * Configure Samba * Add trust related objects to IPA LDAP server To accept the default shown in brackets, press the Enter key. Configuring cross-realm trusts for IPA server requires password for user 'admin'. This user is a regular system account used for IPA server administration. admin password: IPA generated smb.conf detected. Overwrite smb.conf? [no]: yes The following operations may take some minutes to complete. Please wait until the prompt is returned. Configuring CIFS [1/24]: validate server hostname [2/24]: stopping smbd [3/24]: creating samba domain object Samba domain object already exists [4/24]: retrieve local idmap range [5/24]: writing samba config file [6/24]: creating samba config registry [7/24]: adding cifs Kerberos principal [8/24]: adding cifs and host Kerberos principals to the adtrust agents group [9/24]: check for cifs services defined on other replicas [10/24]: adding cifs principal to S4U2Proxy targets cifs principal already targeted, nothing to do. [11/24]: adding admin(group) SIDs Admin SID already set, nothing to do Admin group SID already set, nothing to do [12/24]: adding RID bases RID bases already set, nothing to do [13/24]: updating Kerberos config 'dns_lookup_kdc' already set to 'true', nothing to do. [14/24]: activating CLDAP plugin CLDAP plugin already configured, nothing to do [15/24]: activating sidgen task Sidgen task plugin already configured, nothing to do [16/24]: map BUILTIN\Guests to nobody group [17/24]: configuring smbd to start on boot [18/24]: enabling trusted domains support for older clients via Schema Compatibility plugin [19/24]: restarting Directory Server to take MS PAC and LDAP plugins changes into account [20/24]: adding fallback group Fallback group already set, nothing to do [21/24]: adding Default Trust View Default Trust View already exists. [22/24]: setting SELinux booleans [23/24]: starting CIFS services [24/24]: restarting smbd Done configuring CIFS. ============================================================================= Setup complete You must make sure these network ports are open: TCP Ports: * 135: epmap * 138: netbios-dgm * 139: netbios-ssn * 445: microsoft-ds * 1024..1300: epmap listener range * 3268: msft-gc UDP Ports: * 138: netbios-dgm * 139: netbios-ssn * 389: (C)LDAP * 445: microsoft-ds See the ipa-adtrust-install(1) man page for more details ============================================================================= But there is no change in ipahealthcheck output. Regards, Duncan -- Duncan Mortimer

3 4

FreeIPA w. letsencrypt for HTTPS/LDAP failing to communicate with itself
by Chris Moody 28 Jun '21

28 Jun '21

Hello folks. Hopefully I'm just missing something face-palm level obvious, but I am running into some trouble when interfacing with my CA functionality on an IPA server cluster. My attempts at scouring all my saved prior-comms from the mailing-list as well as several search-engines are not enchanting me with much clue. It appears that my need for the LetsEncrypt certs for the user-facing Web-UI and LDAPs components are causing IPA to dis-trust itself. === 4-node cluster - Ubuntu19.10 (all nodes currently fully updated/patched via the official Ubuntu repos) === ipa --version VERSION: 4.8.1, API_VERSION: 2.233 === running letsencrypt certificates successfully for HTTPs & LDAPs connectivity === These 4-nodes are all happily running and replicating betwixt each other. LDAPs is functioning great and many linux systems are able to all join as freeipa-clients. Users and groups are replicating and being used elegantly for many LDAP-based authentication/authorization needs. Overall, for these nodes, life is good. Where I'm running into trouble is in finally wanting to leverage certificate issuance on a per-user basis. End goal is integrating things like yubikeys, user-cert auth, and so on. In the UI, when I enter a user's account and select Actions->New Certificate, I am able to successfully issue the couple prompted 'certutil' commands to generate the user's CSR. I then paste in the contents of the CSR and hit 'Issue' and run into the following error: ========== IPA Error 907: NetworkError cannot connect to 'https://REDACTED-1.ipa.REDACTED.com:443/ca/rest/account/login': [SSL: TLSV1_ALERT_UNKNOWN_CA] tlsv1 alert unknown ca (_ssl.c:2508) ========== As I then start digging into cli-mode to attempt to understand where things are unhappy, I run into similar troubles with the server attempting to talk to itself and not being very happy about it. ========== chris@REDACTED-1:~$ ipa ca-find ------------ 1 CA matched ------------ Name: ipa Description: IPA CA Authority ID: 8acca54b-64d7-44bf-b8f7-59316213cfb6 Subject DN: CN=Certificate Authority,O=IPA.REDACTED.COM Issuer DN: CN=Certificate Authority,O=IPA.REDACTED.COM ---------------------------- Number of entries returned 1 ---------------------------- chris@REDACTED-1:~$ ipa ca-show Name: ipa ipa: ERROR: cannot connect to 'https://REDACTED-1.ipa.REDACTED.com:443/ca/rest/account/login': [SSL: TLSV1_ALERT_UNKNOWN_CA] tlsv1 alert unknown ca (_ssl.c:2508) ========== Verifying with 'openssl s_client' returns the valid and non-expired LE cert-chain. ========== chris@REDACTED-1:~$ openssl s_client REDACTED-1.ipa.REDACTED.com:443 CONNECTED(00000003) depth=2 O = Digital Signature Trust Co., CN = DST Root CA X3 verify return:1 depth=1 C = US, O = Let's Encrypt, CN = R3 verify return:1 depth=0 CN = REDACTED-1.ipa.REDACTED.com verify return:1 --- Certificate chain 0 s:CN = REDACTED-1.ipa.REDACTED.com i:C = US, O = Let's Encrypt, CN = R3 1 s:C = US, O = Let's Encrypt, CN = R3 i:O = Digital Signature Trust Co., CN = DST Root CA X3 --- ...<output-truncated>... --- SSL handshake has read 3046 bytes and written 413 bytes Verification: OK --- New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384 Server public key is 2048 bit Secure Renegotiation IS NOT supported Compression: NONE Expansion: NONE No ALPN negotiated Early data was not sent Verify return code: 0 (ok) ...<output-truncated>... ========== Can anyone please hit me with some clue-bat as to where I can read to understand how to get IPA to love itself? I'm suspecting it's likely some certificate inclusion/exception that I need to add so that API calls and the ipa command itself will actually respect the LE cert-chain? Any hints would be greatly appreciated. Thanks, -Chris -- Node-Nine, Inc. chris(a)node-nine.com 619.354.6463

4 8

HP LaserJet Pro MFP M428fdw and scan to freeipa samba share
by Николай Савельев 28 Jun '21

28 Jun '21

2 2

compat branch not browseable
by Joseph Fry 25 Jun '21

25 Jun '21

I am just curious why the cn=compat,dc=mydomain,dc=org container cannot be reached when I bind to dc=mydomain,dc=org, but I can see it if I bind directly to it. Is there any way to expose it?

2 4

Get date user was deleted and preserved
by Tania Hagan 24 Jun '21

24 Jun '21

Hi, Is there a way to get the date and time a user was deleted and preserved (ipa user-del --preserve) and if possible by who? Many Thanks, Tania

1 0

Re: How to blend IPA server 4.1.4 on F21 with server 4.6.8 on C7?
by Bret Wortman 24 Jun '21

24 Jun '21

I cleaned up the contents of our ldap manually, re-created the replica file, and got a lot further than we have before but ipa-replica-install still failed as below: Configuring certificate server (pki-tomcatd). Estimated time: 3 minutes [1/30]: configuring certificate server instance ipaserver.install.dogtaginstance: CRITICAL Failed to configure CA instance: Command '/usr/sbin/pkispawn -s CA -f /tmp/tmphvJyRY' returned non-zero exit status 1 ipaserver.install.dogtaginstance: CRITICAL See the installation logs and the following files/directories for more information: ipaserver.install.dogtaginstance: CRITICAL /var/log/pki/pki-tomcat [error] RuntimeError: CA configuration failed. Your system may be partly configured. Run /usr/sbin/ipa-server-install --uninstall to clean up. ipapython.admintool: ERROR CA configuration failed. ipapython.admintool: ERROR The ipa-replica-install command failed. See /var/log/ipareplica-install.log for more information [root@ipa2c7 ~]# ipa-server-install --uninstall -U ipapython.admintool: ERROR Unable to read /etc/httpd/conf.d/ipa-pki-proxy.conf ipapython.admintool: ERROR The ipa-server-install command failed. See /var/log/ipaserver-uninstall.log for more information [root@ipa2c7 ~]# touch /etc/httpd/conf.d/ipa-pki-proxy.conf [root@ipa2c7 ~]# ipa-server-install --uninstall -U Deleting this server will leave your installation without a CRL generation master. ipapython.admintool: ERROR Aborting uninstall operation. ipapython.admintool: ERROR The ipa-server-install command failed. See /var/log/ipaserver-uninstall.log for more information It looks to have failed in such a way that it doesn't know how to back out again, which I haven't seen before. Thoughts? The error in ipa-uninstall.log looks like a generic admintool.py error: 2021-06-07T12:31:38Z DEBUG retrieving schema for SchemaCache url=ldapi://%2fvar%2frun%2fslapd-OUR-NET.socket conn=<ldap.ldapobject.SimpleLDAPObject instance at 0x7f05289fdf80> 2021-06-07T12:31:38Z DEBUG raw: config_show(version=u'2.237') 2021-06-07T12:31:38Z DEBUG config_show(rights=False, all=False, raw=False, version=u'2.237') 2021-06-07T12:31:38Z DEBUG File "/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 178, in execute return_value = self.run() File "/usr/lib/python2.7/site-packages/ipapython/install/cli.py", line 319, in run return cfgr.run() File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 358, in run self.validate() File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 368, in validate for _nothing in self._validator(): File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 431, in __runner exc_handler(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 455, in _handle_validate_exception self._handle_exception(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 450, in _handle_exception six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 421, in __runner step() File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 418, in <lambda> step = lambda: next(self.__gen) File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from value = gen.send(prev_value) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 633, in _configure next(validator) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 431, in __runner exc_handler(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 455, in _handle_validate_exception self._handle_exception(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 518, in _handle_exception self.__parent._handle_exception(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 450, in _handle_exception six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 515, in _handle_exception super(ComponentBase, self)._handle_exception(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 450, in _handle_exception six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 421, in __runner step() File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 418, in <lambda> step = lambda: next(self.__gen) File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from value = gen.send(prev_value) File "/usr/lib/python2.7/site-packages/ipapython/install/common.py", line 73, in _uninstall for unused in self._uninstaller(self.parent): File "/usr/lib/python2.7/site-packages/ipaserver/install/server/__init__.py", line 594, in main uninstall_check(self) File "/usr/lib/python2.7/site-packages/ipaserver/install/server/install.py", line 250, in decorated func(installer) File "/usr/lib/python2.7/site-packages/ipaserver/install/server/install.py", line 1030, in uninstall_check ca.uninstall_check(options) File "/usr/lib/python2.7/site-packages/ipaserver/install/ca.py", line 127, in uninstall_check raise ScriptError("Aborting uninstall operation.") 2021-06-07T12:31:38Z DEBUG The ipa-server-install command failed, exception: ScriptError: Aborting uninstall operation. 2021-06-07T12:31:38Z ERROR Aborting uninstall operation. 2021-06-07T12:31:38Z ERROR The ipa-server-install command failed. See /var/log/ipaserver-uninstall.log for more information -- Bret Wortman bret.wortman(a)damascusgrp.com On Fri, Jun 4, 2021, at 1:32 PM, Bret Wortman wrote: > Boom. Looking through the ldifs now. Thanks again, Rob. > > -- > Bret Wortman > bret.wortman(a)damascusgrp.com > > On Fri, Jun 4, 2021, at 1:22 PM, Rob Crittenden wrote: > > Bret Wortman wrote: > > > What's dsctl? I don't see that anywhere on any of my servers (including the more up-to-date ones). My 389 instance is v1.3.3, if that makes a difference... > > > > > > > > > > Right, really old release. > > > > Try: db2ldif -n userRoot -Z EXAMPLE-TEST -a /path/to/ldif/file > > > > To get the CA ldif replace userRoot with ipaca. > > > > rob > > > > >

2 33

Re: Join command 500 errors, timeouts
by Alfred Victor 23 Jun '21

23 Jun '21

Hi FreeIPA list, I did verify UDP is making it but for some reason ntpd commands fail in the join anyway (seemingly by timeout), I'm not sure why yet but for now we use --no-ntp after setting time just after boot so this isn't an issue. Curious if anyone can spot anything helpful in those logs above please, or how we can debug further to find out why our joins fail? The 401 not authorized seems to be really pretty mysterious, and I'm not sure if that "Matching credential not found" log message is a clue. Likewise, the "No permission to join" and "Cannot contact any KDC" are troubling, and I'm not sure if this is a clue below. So far I haven't managed to identify a network problem and log messages seem few and far between for the nodes which fail joins. Shared previously: ./krb5kdc.log:389805:Jun 21 14:12:07 hipa0002.redac.com krb5kdc[4746](info): DISPATCH: repeated (*retransmit*ted?) request from 10.2.11.17, resending previous response Alfred On Tue, Jun 22, 2021 at 1:12 AM Angus Clarke <angus(a)charworth.com> wrote: > Hello > > I've not been following the whole topic but you can replace your UDP > listener with netcat and indeed use netcat to simulate a client initiation > too. This could help tell you whether your network is permitting that > traffic or not. > > Duckduckgo found me this which looks suitable > > https://fsferrara.github.io/2020/08/02/sending-and-receiving-packets-using-… > > Regards > Angus > > ------------------------------ > *From:* Alfred Victor via FreeIPA-users < > freeipa-users(a)lists.fedorahosted.org> > *Sent:* Tuesday, June 22, 2021 12:24:32 AM > *To:* Rob Crittenden <rcritten(a)redhat.com> > *Cc:* FreeIPA users list <freeipa-users(a)lists.fedorahosted.org>; Alfred > Victor <alvic266(a)gmail.com> > *Subject:* [Freeipa-users] Re: Join command 500 errors, timeouts > > Thanks again. I've enabled trace and will see what I find. I do know there > may be an issue with UDP because it would log ntp failures until I did > --no-ntp, but the port is open on firewall both sides so I believe the > network is failing to deliver UDP. > > Alfred > > On Mon, Jun 21, 2021 at 4:39 PM Rob Crittenden <rcritten(a)redhat.com> > wrote: > > Alfred Victor wrote: > > Hi Rob and FreeIPA list, > > > > I wish I was able to say we are seeing success but aside from no longer > > having the krb5kdc.log log spam, we still experience a lot of join > > failures. However rather than seeing a ton of timeouts (still a few but > > much less), we get a lot of errors like below, which totally puzzle us > > as the ipactl services all report up, and mach_join account should have > > sufficient privilege. I will note we have our own non-IPA DNS solution > > where we have added all the records IPA should need but I can't see why > > this change would cause our errors (and indeed all the output of "ipa > > *dns*-update-system-records --dry-run" looks ok, not that below errors > > appear DNS related but its the only change I can think of aside from > > having replaced our IPA hosts with re-replicated new builds.) > > > > This works fine on rerun of install, and I don't see any evidence of > > service failure on the system this happened against, but neither am I > > aware of any intermittent network problem (perhaps there is a network > > problem on the very first connection to IPA we have not identified? but > > I would expect different errors than the 401 under this for instance) > > > > 2021-06-21T19:12:05Z DEBUG Initializing principal > > mach_join(a)redac.COM using password > > 2021-06-21T19:12:05Z DEBUG Starting external process > > 2021-06-21T19:12:05Z DEBUG args=/usr/bin/kinit mach_join(a)redac.COM > > -c /tmp/krbcc_xp2E2/ccache > > 2021-06-21T19:12:24Z DEBUG Process finished, return code=1 > > 2021-06-21T19:12:24Z DEBUG stdout= > > 2021-06-21T19:12:24Z DEBUG stderr=kinit: Cannot contact any KDC for > > realm 'redac.COM' while getting initial credentials > > 2021-06-21T19:12:24Z INFO Please make sure the following ports are > > opened in the firewall settings: > > TCP: 80, 88, 389 > > UDP: 88 (at least one of TCP/UDP ports 88 has to be open) > > Also note that following ports are necessary for ipa-client working > > properly after enrollment: > > TCP: 464 > > UDP: 464, 123 (if NTP enabled) > > 2021-06-21T19:12:24Z ERROR Installation failed. Rolling back changes. > > > > > > > > But then we also see things like this predominantly, in fact this seems > > now to be the largest category of failure we observe at the highest rate > > and makes no sense to me, because the mach_join account privileges > > should not be changing: > > > > 2021-06-17T19:29:11Z DEBUG args=/usr/sbin/ipa-join -s > > hipa0003.redac.com > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fhipa0003.…> > <http://hipa0003.redac.com > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fhipa0003.…>> > -b dc=redac,dc=com -h > > hred2-4-18.redac.com > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fhred2-4-1…> > <http://hred2-4-18.redac.com > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fhred2-4-1…>> > -f > > 2021-06-17T19:29:31Z DEBUG Process finished, return code=17 > > 2021-06-17T19:29:31Z DEBUG stdout= > > 2021-06-17T19:29:31Z DEBUG stderr=HTTP response code is 401, not 200 > > 2021-06-17T19:29:31Z ERROR Joining realm failed: HTTP response code > > is 401, not 200 > > > > > > > > Some more like this, but not quite the same error: > > > > > > 2021-06-17T19:29:32Z DEBUG get_ca_certs_from_ldap() error: > > Insufficient access: SASL(-1): generic failure: GSSAPI Error: > > Unspecified GSS failure. Minor code may provide more information > > (Cannot contact any KDC for realm 'redac.COM') > > 2021-06-17T19:29:32Z DEBUG Insufficient access: SASL(-1): generic > > failure: GSSAPI Error: Unspecified GSS failure. Minor code may > > provide more information (Cannot contact any KDC for realm > 'redac.COM') > > > > > > And still another example: > > > > > > > > > > 2021-06-17T22:25:37Z DEBUG args=/usr/sbin/ipa-join -s > > hipa0001.redac.com > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fhipa0001.…> > <http://hipa0001.redac.com > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fhipa0001.…>> > -b dc=redac,dc=com -h > > hred2-4-18.redac.com > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fhred2-4-1…> > <http://hred2-4-18.redac.com > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fhred2-4-1…>> > -f > > 2021-06-17T22:25:41Z DEBUG Process finished, return code=17 > > 2021-06-17T22:25:41Z DEBUG stdout= > > 2021-06-17T22:25:41Z DEBUG stderr=No permission to join this host to > > the IPA domain. > > 2021-06-17T22:25:41Z ERROR Joining realm failed: No permission to > > join this host to the IPA domain. > > 2021-06-17T22:25:41Z ERROR Installation failed. Rolling back changes. > > > > Any thoughts or ideas please? > > Some of these could be network issues. I'd run ipa-client-install with > Kerberos tracing: > > KRB5_TRACE=/path/to/some/log ipa-client-install <options> > > So that on failure you can see what KDCs were available, whether one was > contacted, etc. > > rob > > > > > Alfred > > > > > > On Tue, Jun 15, 2021 at 3:19 PM Rob Crittenden <rcritten(a)redhat.com > > <mailto:rcritten@redhat.com>> wrote: > > > > Alfred Victor wrote: > > > I don't see a directive equivalent of SECURE_NFS to add to > > nfs.conf (all > > > documentation seems to still refer to the sysconfig path), or is > > it the > > > same? Can I just disable rpcgssd? We have no nfs mounts which are > > > kerberized yet, and disabling rpcgssd seems to solve our problem, > > and I > > > can kinit after disabling rpcgssd. It also does not seem that > > disabling > > > rpcgssd hurts running tasks or node, but would like to confirm it's > > > limited to nfs in function. I still have to wonder if there's a > > better way. > > > > I suspect that SECURE_NFS is a no-op these days. It was necessary in > > RHEL 5/6 for sure. > > > > Yes, I think you can safely disable the service. In some versions of > > RHEL/Fedora IIRC this is symlinked to nfs-secure-server so mask that > as > > well. > > > > rob > > > > > > > > Alfred > > > > > > On Tue, Jun 15, 2021 at 10:31 AM Alexander Bokovoy > > <abokovoy(a)redhat.com <mailto:abokovoy@redhat.com> > > > <mailto:abokovoy@redhat.com <mailto:abokovoy@redhat.com>>> wrote: > > > > > > On ti, 15 kesä 2021, Alfred Victor via FreeIPA-users wrote: > > > >Hi Rob, > > > > > > > >We attempted setting sec=sys on the mount, however to our > > surprise > > > found > > > >this didn't work. We then figured out that IPA install is > adding > > > this to > > > >/etc/sysconfig/nfs: > > > > > > > >SECURE_NFS=yes > > > > > > > > > > > >We tried removing this to no avail and restarting all the > related > > > sytstemd > > > >units (rpcgssd, nfs, etc). Any idea why sec=sys is being > ignored? > > > Should we > > > >need to set SECURE_NFS=no? On non-IPA nodes this directive > > does not > > > exist > > > >at all. For now, I have also totally disabled rpcgssd as I > think > > > this unit > > > >may be responsible ( it seems that it does the upcall in > > > >https://access.redhat.com/solutions/225783 > <https://emea01.safelinks.protection.outlook.com/?url=https%3A%2F%2Faccess.r…> > ) so I will hope > > that this > > > >solves it, I don't believe anything else depends on rpcgssd > but > > > will soon > > > >find out. Any suggestions please? :) > > > > > > Depends on nfs-utils version? I remember there had been a > > change in > > > configuration in upstream nfs-utils in 2019: > > > > > > commit c69875c8afdd877baf7139c0cd5241f70105cbd4 > > > Author: François Cami <fcami(a)redhat.com > > <mailto:fcami@redhat.com> <mailto:fcami@redhat.com > > <mailto:fcami@redhat.com>>> > > > Date: Tue Feb 26 13:59:06 2019 +0100 > > > > > > ipa-client-automount: handle NFS configuration file > changes > > > > > > nfs-utils in Fedora 30 and later switched its > configuration > > > file from /etc/sysconfig/nfs to /etc/nfs.conf, providing a > > > conversion service (nfs-convert.service) for upgrades. > > > However, for new installs the original configuration file > > > is missing. This change: > > > * adds a tuple-based osinfo.version_number method to > handle > > > more kinds of OS versioning schemes > > > * detects RHEL and Fedora versions with the the new > nfs-utils > > > behavior > > > * avoids backing up the new NFS configuration file as we > do > > > not have to modify it. > > > > > > See: https://bugzilla.redhat.com/show_bug.cgi?id=1676981 > <https://emea01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fbugzilla…> > > > > > > Fixes: https://pagure.io/freeipa/issue/7868 > <https://emea01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fpagure.i…> > > > > > > > > > > > > > >Alfred > > > > > > > >On Thu, Jun 10, 2021 at 2:17 PM Rob Crittenden > > <rcritten(a)redhat.com <mailto:rcritten@redhat.com> > > > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com>>> > wrote: > > > > > > > >> Alfred Victor wrote: > > > >> > Thanks very much Rob et al! I believe we have found our > root > > > cause and > > > >> > the fix. If you like I'll provide some more details after > > we're > > > done > > > >> > with everything. > > > >> > > > >> Yes, knowing the cause would be great and could be helpful > > to others! > > > >> > > > >> cheers > > > >> > > > >> rob > > > >> > > > >> > > > > >> > Alfred > > > >> > > > > >> > On Thu, Jun 10, 2021 at 11:02 AM Rob Crittenden > > > <rcritten(a)redhat.com <mailto:rcritten@redhat.com> > > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com>> > > > >> > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com> > > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com>>>> wrote: > > > >> > > > > >> > Alfred Victor wrote: > > > >> > > Hi all, > > > >> > > > > > >> > > Just curious if anyone has suggestions about that > > please > > > before I > > > >> get > > > >> > > going in a couple of hours with conversions to IPA > > again? > > > I did > > > >> > the math > > > >> > > and 1,097,471 log messages in 5 hours is about 60 > > times per > > > >> second, so > > > >> > > I'm gradually becoming more certain this is why we > can > > > only boot > > > >> 20-30 > > > >> > > nodes at a time when we used to boot hundreds. > However, > > > this is > > > >> still > > > >> > > just a guess as I don't know the mechanism behind > > why this > > > >> interferes > > > >> > > with IPA joins, some bottleneck with the KDC? > > > >> > > > > >> > It sure seems like this is a kerberized NFS request > for a > > > host that > > > >> > doesn't provide it, or doesn't have an nfs principal. > I > > > think you'd > > > >> need > > > >> > to monitor the offending client to see what it is > doing. > > > >> > > > > >> > If the KDC is being dramatically slowed down by this > then > > > yes, you > > > >> could > > > >> > see slower Apache performance because it needs to > obtain > > > tickets on > > > >> > behalf of the user doing the join. Whether that would > > represent > > > >> itself > > > >> > as a read timeout I don't know. > > > >> > > > > >> > rob > > > >> > > > > >> > > > > > >> > > Alfred > > > >> > > > > > >> > > On Wed, Jun 9, 2021 at 3:49 PM Alfred Victor > > > <alvic266(a)gmail.com <mailto:alvic266@gmail.com> > > <mailto:alvic266@gmail.com <mailto:alvic266@gmail.com>> > > > >> > <mailto:alvic266@gmail.com > > <mailto:alvic266@gmail.com> <mailto:alvic266@gmail.com > > <mailto:alvic266@gmail.com>>> > > > >> > > <mailto:alvic266@gmail.com > > <mailto:alvic266@gmail.com> <mailto:alvic266@gmail.com > > <mailto:alvic266@gmail.com>> > > > <mailto:alvic266@gmail.com <mailto:alvic266@gmail.com> > > <mailto:alvic266@gmail.com <mailto:alvic266@gmail.com>>>>> wrote: > > > >> > > > > > >> > > Hi Rob, > > > >> > > > > > >> > > I have reduced that timeout and will tune it > > further. > > > >> > Regarding ISE > > > >> > > errors, I think we can make the assumption that > > this is > > > >> > entirely an > > > >> > > issue of the web timeouts, I haven't seen any > > evidence > > > >> > otherwise and > > > >> > > will have another attempt at converting nodes > > > tomorrow, and > > > >> with a > > > >> > > keener eye of what to look for I can make a > better > > > >> determination > > > >> > > then. I am most concerned over what the > underlying > > > cause might > > > >> be > > > >> > > causing it to take too long and hit the > > timeout, and > > > don't > > > >> want to > > > >> > > engineer around this by changing Apache > timeouts if > > > we can > > > >> instead > > > >> > > address the root cause. I am suspicious of krb > log > > > messages > > > >> > flooding > > > >> > > our IPA systems about a service principal like > so, > > > but not > > > >> sure if > > > >> > > this is gumming up the works (or even why this > > > message has > > > >> started > > > >> > > appearing since the rebuild): > > > >> > > > > > >> > > ./krb5kdc.log:Jun 09 10:38:51 > > redacted.redacted.com > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fredacted.…> > <http://redacted.redacted.com > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fredacted.…> > > > > > <http://redacted.redacted.com > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fredacted.…> > > > > > >> > <http://redacted.redacted.com > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fredacted.…> > > > > <http://redacted.redacted.com > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fredacted.…> > > > > > >> > krb5kdc[31187](info): TGS_REQ (4 etypes {18 17 16 23}) > > > 10.1.1.27 > > > >> > <http://10.1.1.27 > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2F10.1.1.27…>>: > LOOKING_UP_SERVER: authtime 0, > > > >> > host/redacted.redacted.com(a)redacted.COM for > > > >> > nfs/nfsserver.redacted.com(a)redacted.COM, Server not > > found in > > > >> > Kerberos database > > > >> > > > > > >> > > > > > >> > > Just in the last 5 hours alone, this log > > message and > > > others > > > >> > like it (main difference is just the nodename it > > > references) has > > > >> > appeared 1,097,471 times. Conceivably there is also > some > > > log write > > > >> > locking or something going on that could be slowing > IPA > > > down and > > > >> > leading to our symptom here? > > > >> > > > > > >> > > Alfred > > > >> > > > > > >> > > > > > >> > > On Wed, Jun 9, 2021 at 9:19 AM Rob Crittenden > > > >> > <rcritten(a)redhat.com <mailto:rcritten@redhat.com> > > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com>> > > > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com> > > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com>>> > > > >> > > <mailto:rcritten@redhat.com > > <mailto:rcritten@redhat.com> > > > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com>> > > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com> > > > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com>>>>> > > > >> wrote: > > > >> > > > > > >> > > Alfred Victor wrote: > > > >> > > > Hi Rob, > > > >> > > > > > > >> > > > We did revert to 60s - I seem to remember > > some > > > ldapsearch > > > >> > > timing out > > > >> > > > previously but maybe we could still > greatly > > > reduce this > > > >> with > > > >> > > no ill > > > >> > > > effect. However, we saw no change in join > > > success either > > > >> way > > > >> > > and I have > > > >> > > > not changed anything in Apache as I would > > need > > > to find > > > >> the > > > >> > > exact values > > > >> > > > in question and I think these directive > > changes > > > may get > > > >> lost > > > >> > > with an > > > >> > > > update? The timeout/ISE issues are new - > we > > > previously > > > >> > booted > > > >> > > many nodes > > > >> > > > concurrently (400+) without problems but > > now it > > > happens > > > >> even > > > >> > > booting as > > > >> > > > few as 50 results in 10-20 timeouts or > ISE. > > > This has > > > >> > been the > > > >> > > case at > > > >> > > > least since we rebuilt and re-replicated > the > > > environment > > > >> by > > > >> > > swapping IPA > > > >> > > > members out of the old one, but maybe > this is > > > unrelated. > > > >> > Is it > > > >> > > possible > > > >> > > > we landed on a newer version with > > different timeout > > > >> > values? Is it > > > >> > > > possible that IPA is under slightly more > load > > > from the > > > >> > higher > > > >> > > number of > > > >> > > > nodes and has some bottleneck since we > > last did > > > >> conversions? > > > >> > > We have not > > > >> > > > been able to substantiate the latter by > > looking at > > > >> > > CPU/memory/io trends. > > > >> > > > What might we investigate next to see if > > we may > > > have > > > >> missed > > > >> > > some ongoing > > > >> > > > issue that could for instance cause > locking > > > problems or > > > >> > > something else > > > >> > > > internally in IPA to explain our symptoms? > > > Also, I have > > > >> > > observed some > > > >> > > > nodes which report a successful > > installation of IPA > > > >> client, > > > >> > > but have in > > > >> > > > fact a lot of failures, for instance with > > > mounts not > > > >> > working from > > > >> > > > automount setup. We will need to try to > > > reproduce this to > > > >> > > understand > > > >> > > > what happened I think as we have already > > sorted > > > those > > > >> nodes > > > >> > > elsewhere > > > >> > > > and they have got going outside of IPA. > > > >> > > > > > > >> > > > I am interested that you suggested "at > least > > > some of the > > > >> > > clients aren't > > > >> > > > connecting at all and increasing the > timeout > > > could make > > > >> this > > > >> > > worse" - > > > >> > > > this might indicate some sort of network > > problem at > > > >> > play, but > > > >> > > as far as > > > >> > > > I am aware, everything is working absent > > IPA so > > > I do not > > > >> > > suspect it > > > >> > > > presently. > > > >> > > > > > >> > > A 60 second LDAP timeout is still way too > big. > > > The default > > > >> > is 2. > > > >> > > Unless > > > >> > > you are seeing timeouts I'd suggest > > lowering it. > > > >> > > > > > >> > > I'm only seeing hints to what you're seeing > and > > > the scope > > > >> so > > > >> > > it's hard > > > >> > > to make further suggestions. Are all the > > internal > > > errors > > > >> the > > > >> > > same, for > > > >> > > example? Are some failing due to LDAP > > timeouts or > > > are they > > > >> all > > > >> > > wsgi read > > > >> > > timeouts? > > > >> > > > > > >> > > The Apache request timeout can be > configured in > > > httpd.conf > > > >> > which is > > > >> > > independent of the config files that IPA > > > currently writes > > > >> > so it > > > >> > > should > > > >> > > survive upgrades. > > > >> > > > > > >> > > rob > > > >> > > > > > > >> > > > Alfred > > > >> > > > > > > >> > > > On Mon, Jun 7, 2021 at 4:42 PM Rob > Crittenden > > > >> > > <rcritten(a)redhat.com > > <mailto:rcritten@redhat.com> <mailto:rcritten@redhat.com > > <mailto:rcritten@redhat.com>> > > > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com> > > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com>>> > > > >> > <mailto:rcritten@redhat.com > > <mailto:rcritten@redhat.com> <mailto:rcritten@redhat.com > > <mailto:rcritten@redhat.com>> > > > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com> > > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com>>>> > > > >> > > > <mailto:rcritten@redhat.com > > <mailto:rcritten@redhat.com> > > > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com>> > > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com> > > > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com>>> > > > >> > <mailto:rcritten@redhat.com > > <mailto:rcritten@redhat.com> <mailto:rcritten@redhat.com > > <mailto:rcritten@redhat.com>> > > > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com> > > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com>>>>>> wrote: > > > >> > > > > > > >> > > > Alfred Victor wrote: > > > >> > > > > Actually, no change happened from > > 300-> 600 > > > >> > timeout, the > > > >> > > web portal > > > >> > > > > itself gave me an ISE I hadn't > noticed > > > when I tried > > > >> > > clicking save! > > > >> > > > > > > >> > > > I wasn't clear which log to look in. > > You'll see > > > >> details > > > >> > > about where the > > > >> > > > error is caught in IPA in the Apache > > log. > > > To see > > > >> LDAP > > > >> > > timeouts you look > > > >> > > > for err=3 in the 389-ds access log. > > > >> > > > > > > >> > > > But since you posted a traceback this > > time it's > > > >> > clear that > > > >> > > this is just > > > >> > > > Apache waiting for client data to > read so > > > any tuning > > > >> you > > > >> > > do needs to be > > > >> > > > in Apache. You could try tuning > > Timeout which > > > >> > defaults to > > > >> > > 60 but this > > > >> > > > doesn't seem likely to help since at > > least > > > some of > > > >> the > > > >> > > clients aren't > > > >> > > > connecting at all and increasing the > > > timeout could > > > >> make > > > >> > > this worse. > > > >> > > > > > > >> > > > Please revert the searchtimeout. 300 > > seconds is > > > >> > orders of > > > >> > > magnitude > > > >> > > > too big. > > > >> > > > > > > >> > > > rob > > > >> > > > > > > >> > > > > > > > >> > > > > Alfred > > > >> > > > > > > > >> > > > > On Mon, Jun 7, 2021 at 3:57 PM > > Alfred Victor > > > >> > > <alvic266(a)gmail.com > > <mailto:alvic266@gmail.com> <mailto:alvic266@gmail.com > > <mailto:alvic266@gmail.com>> > > > <mailto:alvic266@gmail.com <mailto:alvic266@gmail.com> > > <mailto:alvic266@gmail.com <mailto:alvic266@gmail.com>>> > > > >> > <mailto:alvic266@gmail.com > > <mailto:alvic266@gmail.com> <mailto:alvic266@gmail.com > > <mailto:alvic266@gmail.com>> > > > <mailto:alvic266@gmail.com <mailto:alvic266@gmail.com> > > <mailto:alvic266@gmail.com <mailto:alvic266@gmail.com>>>> > > > >> > > > <mailto:alvic266@gmail.com > > <mailto:alvic266@gmail.com> > > > <mailto:alvic266@gmail.com <mailto:alvic266@gmail.com>> > > > >> > <mailto:alvic266@gmail.com > > <mailto:alvic266@gmail.com> <mailto:alvic266@gmail.com > > <mailto:alvic266@gmail.com>>> > > > <mailto:alvic266@gmail.com <mailto:alvic266@gmail.com> > > <mailto:alvic266@gmail.com <mailto:alvic266@gmail.com>> > > > >> > <mailto:alvic266@gmail.com > > <mailto:alvic266@gmail.com> <mailto:alvic266@gmail.com > > <mailto:alvic266@gmail.com>>>>> > > > >> > > > > <mailto:alvic266@gmail.com > > <mailto:alvic266@gmail.com> > > > <mailto:alvic266@gmail.com <mailto:alvic266@gmail.com>> > > > >> > <mailto:alvic266@gmail.com > > <mailto:alvic266@gmail.com> <mailto:alvic266@gmail.com > > <mailto:alvic266@gmail.com>>> > > > <mailto:alvic266@gmail.com <mailto:alvic266@gmail.com> > > <mailto:alvic266@gmail.com <mailto:alvic266@gmail.com>> > > > >> > <mailto:alvic266@gmail.com > > <mailto:alvic266@gmail.com> <mailto:alvic266@gmail.com > > <mailto:alvic266@gmail.com>>>> > > > >> > > <mailto:alvic266@gmail.com > > <mailto:alvic266@gmail.com> > > > <mailto:alvic266@gmail.com <mailto:alvic266@gmail.com>> > > <mailto:alvic266@gmail.com <mailto:alvic266@gmail.com> > > > <mailto:alvic266@gmail.com <mailto:alvic266@gmail.com>>> > > > >> > <mailto:alvic266@gmail.com > > <mailto:alvic266@gmail.com> <mailto:alvic266@gmail.com > > <mailto:alvic266@gmail.com>> > > > <mailto:alvic266@gmail.com <mailto:alvic266@gmail.com> > > <mailto:alvic266@gmail.com <mailto:alvic266@gmail.com>>>>>>> wrote: > > > >> > > > > > > > >> > > > > Hi FreeIPA list, > > > >> > > > > > > > >> > > > > I don't see any in error log > that > > > match `grep > > > >> > -i "err=3" > > > >> > > > > /var/log/httpd/error_log`. We > > have tried > > > >> raising > > > >> > > > searchtimelimit as > > > >> > > > > high as 120, then 300 (now are > > trying > > > 600) but > > > >> > > observed no > > > >> > > > > difference in the rate at which > > nodes > > > >> succeeded or > > > >> > > failed in IPA > > > >> > > > > joins. We are somewhat puzzled > by > > > this, as > > > >> none of > > > >> > > the other > > > >> > > > values > > > >> > > > > we are aware of might have > changed, > > > though it > > > >> is > > > >> > > possible that the > > > >> > > > > IPA systems are under a little > > higher > > > demand > > > >> > from client > > > >> > > > systems, we > > > >> > > > > have tried to mitigate this by > > > shutting down > > > >> some > > > >> > > workflows and > > > >> > > > > aren't sure whether we've seen > any > > > improvement. > > > >> > > Short of adjusting > > > >> > > > > apache/resource/process > > timeouts it is > > > >> > difficult to > > > >> > > say what might > > > >> > > > > be wrong. To give an example, > > out of > > > 250 nodes > > > >> > > rebooted, only 112 > > > >> > > > > joined IPA successfully. Here > > is some > > > output > > > >> from > > > >> > > the error log, > > > >> > > > > following what this looks like > > in the ipa > > > >> client > > > >> > > install log > > > >> > > > (error > > > >> > > > > log output will match the node > > attempt): > > > >> > > > > > > > >> > > > > > > > >> > > > > 2021-06-07T18:25:30Z DEBUG The > > > >> ipa-client-install > > > >> > > command > > > >> > > > failed, exception: NetworkError: > cannot > > > connect to > > > >> > > > 'https://redactednode.com/ipa/json > <https://emea01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fredacted…> > > > >> > > > > > <https://hauth0004.dug.com/ipa/json > <https://emea01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fhauth000…>>': > Internal > > > >> > Server Error > > > >> > > > > > > > >> > > > > [Mon Jun 07 13:25:06.198259 > 2021] > > > [core:error] > > > >> > [pid > > > >> > > 25020] > > > >> > > > [client 10.1.24.48:47808 > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2F10.1.24.4…> > > <http://10.1.24.48:47808 > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2F10.1.24.4…> > > > > > <http://10.1.24.48:47808 > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2F10.1.24.4…>> > <http://10.1.24.48:47808 > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2F10.1.24.4…> > > > > > >> > <http://10.1.24.48:47808 > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2F10.1.24.4…> > > > > > >> > > <http://10.1.24.48:47808 > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2F10.1.24.4…> > > > > > >> > > > <http://10.1.24.48:47808 > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2F10.1.24.4…>>] > Script > > timed out > > > before > > > >> > returning > > > >> > > > headers: wsgi.py, referer: > > > >> > > https://redacted.redacted.com/ipa/xml > <https://emea01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fredacted…> > > > >> > > > <https://hauth0004.dug.com/ipa/xml > <https://emea01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fhauth000…> > > > > > >> > > > > > > > >> > > > > Different node, same time > period: > > > >> > > > > > > > >> > > > > > > > >> > > > > [Mon Jun 07 13:24:02.178092 > 2021] > > > [:error] [pid > > > >> > > 25725] ipa: > > > >> > > > INFO: [xmlserver] > mach_join(a)redacted.COM: > > > >> > > join(u'redacted.node.com > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fredacted.…> > > <http://redacted.node.com > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fredacted.…> > > > > > <http://redacted.node.com > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fredacted.…>> > <http://redacted.node.com > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fredacted.…> > > > > > >> > <http://redacted.node.com > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fredacted.…> > > > > > >> > > > <http://redacted.node.com > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fredacted.…> > > > > > <http://redacted.node.com > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fredacted.…> > > > >> >', > > > >> > > > nshardwareplatform=u'x86_64', > > > >> > > > > > > >> nsosversion=u'3.10.0-1062.18.1.1.el7.redacted.x86_64', > > > >> > > > version=u'2.51'): TimeLimitExceeded > > > >> > > > > > > > >> > > > > I also saw this: > > > >> > > > > > > > >> > > > > [Mon Jun 07 13:25:07.103503 > 2021] > > > [:error] [pid > > > >> > > 25725] ipa: > > > >> > > > ERROR: non-public: IOError: request > data > > > read error > > > >> > > > > [Mon Jun 07 13:25:07.103529 > 2021] > > > [:error] > > > >> > [pid 25725] > > > >> > > > Traceback (most recent call last): > > > >> > > > > [Mon Jun 07 13:25:07.103536 > 2021] > > > [:error] [pid > > > >> > > 25725] File > > > >> > > > > > > >> > > > "/usr/lib/python2.7/site-packages/ipaserver/rpcserver.py", > > > >> > > line 360, > > > >> > > > in wsgi_execute > > > >> > > > > [Mon Jun 07 13:25:07.103542 > 2021] > > > [:error] [pid > > > >> > > 25725] > > > >> > > > data = read_input(environ) > > > >> > > > > [Mon Jun 07 13:25:07.103548 > 2021] > > > [:error] [pid > > > >> > > 25725] File > > > >> > > > > > > >> > > > "/usr/lib/python2.7/site-packages/ipaserver/rpcserver.py", > > > >> > > line 200, > > > >> > > > in read_input > > > >> > > > > [Mon Jun 07 13:25:07.103553 > 2021] > > > [:error] [pid > > > >> > > 25725] > > > >> > > > return > > > >> > environ['wsgi.input'].read(length).decode('utf-8') > > > >> > > > > [Mon Jun 07 13:25:07.103559 > 2021] > > > [:error] > > > >> > [pid 25725] > > > >> > > > IOError: request data read error > > > >> > > > > [Mon Jun 07 13:25:07.103826 > 2021] > > > [:error] [pid > > > >> > > 25725] ipa: > > > >> > > > INFO: [xmlserver] > > mach_join(a)redacted.COM: None: > > > >> > InternalError > > > >> > > > > [Mon Jun 07 13:25:07.149962 > 2021] > > > [:error] [pid > > > >> > > 25726] ipa: > > > >> > > > ERROR: non-public: IOError: request > data > > > read error > > > >> > > > > [Mon Jun 07 13:25:07.149984 > 2021] > > > [:error] > > > >> > [pid 25726] > > > >> > > > Traceback (most recent call last): > > > >> > > > > [Mon Jun 07 13:25:07.149991 > 2021] > > > [:error] [pid > > > >> > > 25726] File > > > >> > > > > > > >> > > > "/usr/lib/python2.7/site-packages/ipaserver/rpcserver.py", > > > >> > > line 360, > > > >> > > > in wsgi_execute > > > >> > > > > [Mon Jun 07 13:25:07.149997 > 2021] > > > [:error] [pid > > > >> > > 25726] > > > >> > > > data = read_input(environ) > > > >> > > > > [Mon Jun 07 13:25:07.150002 > 2021] > > > [:error] [pid > > > >> > > 25726] File > > > >> > > > > > > >> > > > "/usr/lib/python2.7/site-packages/ipaserver/rpcserver.py", > > > >> > > line 200, > > > >> > > > in read_input > > > >> > > > > [Mon Jun 07 13:25:07.150008 > 2021] > > > [:error] [pid > > > >> > > 25726] > > > >> > > > return > > > >> > environ['wsgi.input'].read(length).decode('utf-8') > > > >> > > > > [Mon Jun 07 13:25:07.150013 > 2021] > > > [:error] > > > >> > [pid 25726] > > > >> > > > IOError: request data read error > > > >> > > > > > > > >> > > > > > > > >> > > > > > > > >> > > > > After setting the timeout to > > 600 and > > > rebooting > > > >> the > > > >> > > remaining > > > >> > > > 139 nodes from the initial set of > 250, 83 > > > joined of > > > >> the > > > >> > > 139 and we > > > >> > > > still had ISE occurring. In some > > cases, it > > > would ISE > > > >> on > > > >> > > the first > > > >> > > > attempt, try another IPA system, and > > > succeed. I'm > > > >> > not sure > > > >> > > that even > > > >> > > > such a long timeout as 600 has helped. > > > >> > > > > > > > >> > > > > Alfred > > > >> > > > > > > > >> > > > > > > > >> > > > > > > > >> > > > > > > > >> > > > > On Thu, Jun 3, 2021 at 7:51 PM > Rob > > > Crittenden > > > >> > > > <rcritten(a)redhat.com > > <mailto:rcritten@redhat.com> > > > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com>> > > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com> > > > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com>>> > > > >> > <mailto:rcritten@redhat.com > > <mailto:rcritten@redhat.com> <mailto:rcritten@redhat.com > > <mailto:rcritten@redhat.com>> > > > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com> > > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com>>>> > > > >> > > <mailto:rcritten@redhat.com > > <mailto:rcritten@redhat.com> > > > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com>> > > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com> > > > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com>>> > > > >> > <mailto:rcritten@redhat.com > > <mailto:rcritten@redhat.com> <mailto:rcritten@redhat.com > > <mailto:rcritten@redhat.com>> > > > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com> > > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com>>>>> > > > >> > > > > <mailto:rcritten@redhat.com > > <mailto:rcritten@redhat.com> > > > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com>> > > > >> > <mailto:rcritten@redhat.com > > <mailto:rcritten@redhat.com> <mailto:rcritten@redhat.com > > <mailto:rcritten@redhat.com>>> > > > >> > > <mailto:rcritten@redhat.com > > <mailto:rcritten@redhat.com> > > > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com>> > > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com> > > > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com>>>> > > > >> > <mailto:rcritten@redhat.com > > <mailto:rcritten@redhat.com> <mailto:rcritten@redhat.com > > <mailto:rcritten@redhat.com>> > > > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com> > > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com>>> > > > >> > > <mailto:rcritten@redhat.com > > <mailto:rcritten@redhat.com> > > > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com>> > > > >> > <mailto:rcritten@redhat.com <mailto: > rcritten(a)redhat.com> > > > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com>>>>>>> > > wrote: > > > >> > > > > > > > >> > > > > Alfred Victor via > FreeIPA-users > > > wrote: > > > >> > > > > > Hi FreeIPA list, > > > >> > > > > > > > > >> > > > > > We are having an issue > > with our IPA > > > >> > > environment of 4 > > > >> > > > > replicated FreeIPA > > > >> > > > > > systems serving linux > compute > > > clients > > > >> > > which join from a > > > >> > > > command in > > > >> > > > > > rc.local after boot. This > > > worked in the > > > >> > past, > > > >> > > but the system > > > >> > > > > has been > > > >> > > > > > rebuilt since and the > > join command > > > >> changed > > > >> > > > slightly. Unfortunately > > > >> > > > > > booting a few dozen nodes > > at a > > > time, > > > >> though > > > >> > > they each > > > >> > > > talk to a > > > >> > > > > > different IPA system by > > design, > > > leads to > > > >> > > problems such as > > > >> > > > > these - though > > > >> > > > > > 40-100 nodes can boot ok > at a > > > time there > > > >> are > > > >> > > always many > > > >> > > > > stragglers, and > > > >> > > > > > the more we attempt to > > boot at > > > once the > > > >> more > > > >> > > fail to > > > >> > > > join IPA > > > >> > > > > (if we try > > > >> > > > > > to boot 500 nodes, we are > > lucky > > > if we > > > >> get a > > > >> > > fifth of that > > > >> > > > > joining IPA). > > > >> > > > > > Can you please advise on > this > > > output? > > > >> > Here is > > > >> > > our join > > > >> > > > command in > > > >> > > > > > compute node rc.local: > > > >> > > > > > > > > >> > > > > > > > > >> > > > > > > > > >> > > > > > ipa-client-install -U > > -q -p > > > >> mach_join \ > > > >> > > > > > -w <redacted> \ > > > >> > > > > > --force-join \ > > > >> > > > > > --no-dns-sshfp \ > > > >> > > > > > > > > --automount-location=redacted-node > > > >> > > > > > > > > >> > > > > > > > > >> > > > > > > > > >> > > > > > > > > >> > > > > > And here is some log > > output of > > > the 500 > > > >> > error: > > > >> > > > > > > > > >> > > > > > ProtocolError: > > > <ProtocolError for > > > >> > > > > > > redacted.redacted.com/ipa/json > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fredacted.…> > <http://redacted.redacted.com/ipa/json > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fredacted.…> > > > > > <http://redacted.redacted.com/ipa/json > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fredacted.…> > > > > > >> > <http://redacted.redacted.com/ipa/json > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fredacted.…> > > > > > >> > > <http://redacted.redacted.com/ipa/json > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fredacted.…> > > > > > >> > > > < > http://redacted.redacted.com/ipa/json > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fredacted.…> > > > > > >> > > > > > > > <http://redacted.redacted.com/ipa/json > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fredacted.…> > > > > > >> > > > > > > > <http://redacted.redacted.com/ipa/json > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fredacted.…> > >: > > > >> 500 > > > >> > > Internal > > > >> > > > Server Error> > > > >> > > > > > Cannot connect to the > > > server due to > > > >> > > generic error: > > > >> > > > cannot > > > >> > > > > connect to > > > >> > 'https://redacted.redacted.com/ipa/json > <https://emea01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fredacted…> > > > >> > > > > > > > <https://hauth0003.dug.com/ipa/json > <https://emea01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fhauth000…> > >': > > > >> > Internal > > > >> > > Server Error > > > >> > > > > > > > > >> > > > > > > > > >> > > > > > As well as: > > > >> > > > > > > > > >> > > > > > 2021-06-02T21:39:11Z > > DEBUG > > > Starting > > > >> > > external process > > > >> > > > > > 2021-06-02T21:39:11Z > > DEBUG > > > >> > > args=/usr/sbin/ipa-join -s > > > >> > > > > > redacted.redacted.com > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fredacted.…> > > <http://redacted.redacted.com > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fredacted.…> > > > > > <http://redacted.redacted.com > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fredacted.…> > > > > > >> > <http://redacted.redacted.com > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fredacted.…> > > > > > >> > > <http://redacted.redacted.com > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fredacted.…>> > < > > > >> http://redacted.redacted.com > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fredacted.…> > > > > > >> > > > <http://redacted.redacted.com > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fredacted.…> > > > > > >> > > > > > > <http://redacted.redacted.com > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fredacted.…>> > -b > > > >> > > > > > dc=redacted,dc=com -h > > > >> > > redactednode.redacted.com > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fredactedn…> > > <http://redactednode.redacted.com > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fredactedn…> > > > > > <http://redactednode.redacted.com > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fredactedn…> > > > > > >> > <http://redactednode.redacted.com > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fredactedn…> > > > > > <http://redactednode.redacted.com > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fredactedn…> > > > >> > > > > >> > > > <http://redactednode.redacted.com > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fredactedn…> > > > > > >> > > > > > > <http://redactednode.redacted.com > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fredactedn…> > > > > > >> > > > > > > > > <http://redactednode.redacted.com > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fredactedn…> > > > > > >> -f > > > >> > > > > > 2021-06-02T21:40:13Z > > DEBUG > > > Process > > > >> > > finished, return > > > >> > > > code=17 > > > >> > > > > > 2021-06-02T21:40:13Z > > DEBUG > > > stdout= > > > >> > > > > > 2021-06-02T21:40:13Z > > DEBUG > > > >> stderr=HTTP > > > >> > > response code is > > > >> > > > > 500, not 200 > > > >> > > > > > 2021-06-02T21:40:13Z > > ERROR > > > Joining > > > >> realm > > > >> > > failed: HTTP > > > >> > > > > response code > > > >> > > > > > is 500, not 200 > > > >> > > > > > > > > >> > > > > > And we also see timeouts > > happen: > > > >> > > > > > > > > >> > > > > > > > > >> > > > > > 2021-06-02T22:08:50Z > > DEBUG > > > >> > > args=/usr/sbin/ipa-join -s > > > >> > > > > > redacted.redacted.com > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fredacted.…> > > <http://redacted.redacted.com > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fredacted.…> > > > > > <http://redacted.redacted.com > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fredacted.…> > > > > > >> > <http://redacted.redacted.com > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fredacted.…> > > > > > >> > > <http://redacted.redacted.com > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fredacted.…>> > < > > > >> http://redacted.redacted.com > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fredacted.…> > > > > > >> > > > <http://redacted.redacted.com > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fredacted.…> > > > > > >> > > > > > > <http://redacted.redacted.com > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fredacted.…>> > -b > > > >> > > > > > dc=redacted,dc=com -h > > > >> > > redactednode.redacted.com > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fredactedn…> > > <http://redactednode.redacted.com > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fredactedn…> > > > > > <http://redactednode.redacted.com > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fredactedn…> > > > > > >> > <http://redactednode.redacted.com > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fredactedn…> > > > > > <http://redactednode.redacted.com > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fredactedn…> > > > >> > > > > >> > > > <http://redactednode.redacted.com > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fredactedn…> > > > > > >> > > > > > > <http://redactednode.redacted.com > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fredactedn…> > > > > > >> > > > > > > > > <http://redactednode.redacted.com > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fredactedn…> > > > > > >> -f > > > >> > > > > > 2021-06-02T22:09:01Z > > DEBUG > > > Process > > > >> > > finished, return > > > >> > > > code=17 > > > >> > > > > > 2021-06-02T22:09:01Z > > DEBUG > > > stdout= > > > >> > > > > > 2021-06-02T22:09:01Z > > DEBUG > > > stderr=RPC > > > >> > > failed at server. > > > >> > > > > Configured > > > >> > > > > > time limit exceeded > > > >> > > > > > 2021-06-02T22:09:01Z > > ERROR > > > Joining > > > >> realm > > > >> > > failed: RPC > > > >> > > > failed at > > > >> > > > > > server. Configured > > time limit > > > >> exceeded > > > >> > > > > > > > > >> > > > > > > > > >> > > > > > And we also see later > > timeouts > > > near the > > > >> > end of > > > >> > > the log > > > >> > > > in some > > > >> > > > �� > cases though are able to > > > authenticate and > > > >> it > > > >> > > didn't back > > > >> > > > out the > > > >> > > > > install, but never got > > going healthy > > > >> either: > > > >> > > > > > > > > >> > > > > > > > > >> > > > > > > > > >> > > > > > 2021-06-03T19:20:13Z > > DEBUG The > > > >> > > ipa-client-install > > > >> > > > command > > > >> > > > > failed, > > > >> > > > > > exception: > > TimeLimitExceeded: > > > >> Configured > > > >> > > time limit > > > >> > > > exceeded > > > >> > > > > > > > >> > > > > When you see Internal Error > > look > > > to the > > > >> Apache > > > >> > > error log > > > >> > > > on the > > > >> > > > > server > > > >> > > > > for more information. > > > >> > > > > > > > >> > > > > In this case an LDAP search > is > > > failing > > > >> because > > > >> > > the server > > > >> > > > is too > > > >> > > > > busy. > > > >> > > > > Look for queries failing > with > > > err=3 to get > > > >> an > > > >> > > idea of how long > > > >> > > > > it is taking. > > > >> > > > > > > > >> > > > > To increase the timeout > > use: ipa > > > config-mod > > > >> > > > --searchtimelimit=INT > > > >> > > > > > > > >> > > > > The default is 2 seconds. > > > >> > > > > > > > >> > > > > You can pick a time at > > random but > > > could see > > > >> > > failures again. > > > >> > > > > > > > >> > > > > rob > > > >> > > > > > > > >> > > > > > > >> > > > > > >> > > > > >> > > > >> > > > > > > > > > > > > > > > -- > > > / Alexander Bokovoy > > > Sr. Principal Software Engineer > > > Security / Identity Management Engineering > > > Red Hat Limited, Finland > > > > > > >

1 0

Simulate the AD 'Computer' Object
by Joseph Fry 22 Jun '21

22 Jun '21

I support a product that natively supports ingesting computers from Active Directory via an LDAP query. We are able to ingest users from FreeIPA (actually Redhat IDM) without a problem, but hosts cannot be ingested because the objectClass and attributes are different than what is used by ActiveDirectory. Is there a simple solution in FreeIPA to have the host objects simulate an AD 'computer' object?

2 1

Join command 500 errors, timeouts
by Alfred Victor 22 Jun '21

22 Jun '21

Hi FreeIPA list, We are having an issue with our IPA environment of 4 replicated FreeIPA systems serving linux compute clients which join from a command in rc.local after boot. This worked in the past, but the system has been rebuilt since and the join command changed slightly. Unfortunately booting a few dozen nodes at a time, though they each talk to a different IPA system by design, leads to problems such as these - though 40-100 nodes can boot ok at a time there are always many stragglers, and the more we attempt to boot at once the more fail to join IPA (if we try to boot 500 nodes, we are lucky if we get a fifth of that joining IPA). Can you please advise on this output? Here is our join command in compute node rc.local: ipa-client-install -U -q -p mach_join \ > -w <redacted> \ > --force-join \ > --no-dns-sshfp \ > --automount-location=redacted-node And here is some log output of the 500 error: ProtocolError: <ProtocolError for redacted.redacted.com/ipa/json: 500 Internal Server Error> > Cannot connect to the server due to generic error: cannot connect to 'https://redacted.redacted.com/ipa/json <https://hauth0003.dug.com/ipa/json>': Internal Server Error > > As well as: 2021-06-02T21:39:11Z DEBUG Starting external process > 2021-06-02T21:39:11Z DEBUG args=/usr/sbin/ipa-join -s > redacted.redacted.com -b dc=redacted,dc=com -h redactednode.redacted.com > -f > 2021-06-02T21:40:13Z DEBUG Process finished, return code=17 > 2021-06-02T21:40:13Z DEBUG stdout= > 2021-06-02T21:40:13Z DEBUG stderr=HTTP response code is 500, not 200 > 2021-06-02T21:40:13Z ERROR Joining realm failed: HTTP response code is > 500, not 200 And we also see timeouts happen: > > 2021-06-02T22:08:50Z DEBUG args=/usr/sbin/ipa-join -s redacted.redacted.com -b dc=redacted,dc=com -h redactednode.redacted.com -f > 2021-06-02T22:09:01Z DEBUG Process finished, return code=17 > 2021-06-02T22:09:01Z DEBUG stdout= > 2021-06-02T22:09:01Z DEBUG stderr=RPC failed at server. Configured time limit exceeded > 2021-06-02T22:09:01Z ERROR Joining realm failed: RPC failed at server. Configured time limit exceeded And we also see later timeouts near the end of the log in some cases though are able to authenticate and it didn't back out the install, but never got going healthy either: > > 2021-06-03T19:20:13Z DEBUG The ipa-client-install command failed, > exception: TimeLimitExceeded: Configured time limit exceeded Donald

4 21

ipactl status hangs
by Ronald Wimmer 21 Jun '21

21 Jun '21

On some servers I can see that ipactl status hangs from time to time. I can see SSSD reporting the backend to be offline and dirsrv not running for some reason. ipactl -d status reveals that it hangs when issuing systemctl is-active dirsrv. Instead of hanging I would expect ipcactl status to report a problem (= dirsrv not running). Cheers, Ronald

2 2

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users June 2021