June 2021 - FreeIPA-users - Fedora mailing-lists

sssd version 2.2.3 issues with AD Trust View
by iulian roman 18 Jun '21

18 Jun '21

Hello everybody, I have an IPA setup with AD trust configured and Trust View defined on the IPA server. Everything works properly on Ubuntu 18 clients with sssd 1.16.1 but it doesn't on Ubuntu 20 with sssd version 2.2.3. I can list /query the AD accounts which are not part of the default Trust View, but not those accounts which have the id overriden in the Trust View. Is that a known issue, or any idea what do I need to change /where to look ?

2 4

Consumer failed to replay change Operations error (1)
by Alfred Victor 17 Jun '21

17 Jun '21

Hi FreeIPA, We have some replication messages in our slapd errors log which look very like the ones discussed here: https://bugzilla.redhat.com/show_bug.cgi?id=1574602 I took a look and we do have the MemberOf plugin, but our version of 389-ds newer: *389-ds-base-1.3.10.2-10.el7_9.x86_64* Hoping someone might have a suggestion for what we might do to get rid of these log messages, or what the root cause may be/impact? They've been going since at least a couple of weeks ago: [15/Jun/2021:18:57:26.362094959 -0500] - WARN - NSMMReplicationPlugin - repl5_inc_update_from_op_result - agmt="cn=redactedauth0001.redacted.com-to-redactedauth0003.redacted.com" (redactedauth0003:389): Consumer failed to replay change (uniqueid d5896001-39a111eb-8868efc8-91dc0b98, CSN 60c93bc2000400250000): Operations error (1). Will retry later. I looked for this same uniqueid (they are ALL the same uniqueID) and found this which is interesting and references a specific cn and "optype": > > [03/Jun/2021:15:45:43.332068775 -0500] - ERR - NSMMReplicationPlugin - write_changelog_and_ruv - Can't add a change for cn=admin,cn=groups,cn=accounts,dc=redacted,dc=com (uniqid: d5896001-39a111eb-8868efc8-91dc0b98, optype: 8) to changelog csn 60b93f93005200230000 Alfred

3 2

IPA RA expired, other certificates renewed
by Jan Bundesmann 16 Jun '21

16 Jun '21

Hi there, I need some suggestions for a certificate related problem. The setup has 2 servers, let's call them ldap1 and ldap2 with ldap1 being the primary system with the CA. The certificates were to expire on june 15. I checked on june 1st and on ldap1 certmonger had renewed all certificates, on ldap2 certmonger was not running. So, I restarted the certmonger service and it began its work. `getcert list` shows three certificates (it's ipa 4.4, so that's probably correct) Quite soon, the first certificate was renewed (HTTP/ldap2, ...) I assume that's the one for the web UI. A second one (ldap/ldap2...) is still valid until december. I assume that's why all the ldap related stuff and replication is still working. But the cn=IPA RA expired one week ago (may 24th). I have no ipa-certs-fix, would setting back the system clock still work? The HTTP/ldap2 certificate was not yet valid when the IPA RA certificate expired. Or put the the other round: what happens if i don't renew this certificate - that's not quite clear to me. Currently, the system ist working fine, replication works and in 2022 the hardware will be replaced, so we will setup new replicas anyways. But, that's after the expiration date of the ldap/ldap2 certificate. I hope this is understandable and thanks in advance for any hint.

2 7

Doc suggestion: explicitly advise 'non-desktop' spins for freeipa-server*
by Harry G. Coin 15 Jun '21

15 Jun '21

Might the 'edition' (server, desktop, iot, whatnot) of the distribution used in testing freeipa-server* be explicitly stated in the 'getting started' docs as being 'approved' for freeipa-server use? The better to avoid interactions with un-interaction-tested packages / security libraries generally seen only in user/special-purpose distros. (re: dnssec / bind9 / smart-card interaction) HC

1 0

AD Trust Types
by Ronald Wimmer 15 Jun '21

15 Jun '21

Quite some time ago I added a trust to another AD domain. IIRC I added an "external trust" for a reason I do not remember. What is the "Non-transitive external trust to a domain in another Active Directory forest" trust type for? Could I not just have added another "Active Directory domain" trust? Any clarification on this matter would be highly appreciated! Cheers, Ronald

3 9

FreeIPA 4.9.4 and 4.9.5 released
by Alexander Bokovoy 14 Jun '21

14 Jun '21

The FreeIPA team would like to announce FreeIPA 4.9.4 and 4.9.5 releases! Yes, this is not a mistake. First we created FreeIPA 4.9.4 on June 4th but then found a late time regression that took us more than ten days to sort out, thus going with the FreeIPA 4.9.5 release. This regression concerns an edge case of an unauthenticated or almost expired user credential's run of 'ipa' command line tool returning a non-processed Python exception instead of a human-readable error message. This, in turn uncovered a bit of a misconfiguration on the IPA server side which could trigger this behavior. In a process of investigating it we also found a bug in GSS-Proxy tool. FreeIPA 4.9.4 release notes are large and can be found at https://www.freeipa.org/page/Releases/4.9.4 FreeIPA 4.9.5 is released and can be downloaded from http://www.freeipa.org/page/Downloads. Builds for Fedora distributions will be available from the official repository soon. FreeIPA installation is currently broken in Fedora Rawhide due to an ongoing migration to Python 3.10 in Fedora where mod_wsgi does not yet support Python 3.10. == Highlights in 4.9.5 === Bug fixes FreeIPA 4.9.5 is a stabilization release for the features delivered as a part of 4.9.0 version series. There are 7 bug-fixes since FreeIPA 4.9.4 release. Details of the bug-fixes can be seen in the list of resolved tickets below. == Upgrading Upgrade instructions are available on Upgrade page. == Feedback Please provide comments, bugs and other feedback via the freeipa-users mailing list (https://lists.fedoraproject.org/archives/list/freeipa-users@lists.fedorahos…) or #freeipa channel on Freenode. == Resolved tickets * https://pagure.io/freeipa/issue/8691[#8691] [Tracker] Nightly failure (fc33) in test_winsyncmigrate.py: ipa-replica-manage connect --winsync error * https://pagure.io/freeipa/issue/8702[#8702] (https://bugzilla.redhat.com/show_bug.cgi?id=1780317[rhbz#1780317]) ipa-cert-fix: False Positive Status for cert renewal. * https://pagure.io/freeipa/issue/8756[#8756] [Tracker] 389ds coredump in test_caless.py::TestReplicaInstall::test_wildcard_http * https://pagure.io/freeipa/issue/8868[#8868] Nightly test failure in test_integration/test_fips.py::TestInstallFIPS * https://pagure.io/freeipa/issue/8873[#8873] Missing credential cache can raise 500 when authenticating instead of 401 * https://pagure.io/freeipa/issue/8876[#8876] Nightly failure in test_installation.py::TestInstallWithCA1::test_install_with_bad_ldap_conf * https://pagure.io/freeipa/issue/8877[#8877] Nightly test failure in test_nfs.py: runner VM runs out of disk space due to huge sssd log file == Detailed changelog since 4.9.4 === Armando Neto (1) * ipatests: Bump PR-CI boxes https://pagure.io/freeipa/c/79e0919132adf0df764400f9c27268cbadd2578b[commit] === Alexander Bokovoy (3) * Become FreeIPA 4.9.5 https://pagure.io/freeipa/c/e045f118c87346bfab5b5634fd23f3054f082f7f[commit] * get_credentials: return ValueError for missing creds https://pagure.io/freeipa/c/5238651da06547bb004de2434ae7d357422ba735[commit] https://pagure.io/freeipa/issue/8873[#8873] * Back to git snapshots https://pagure.io/freeipa/c/b25f5bd9109b87916e097dd8353ea5f0dc49e398[commit] === Florence Blanc-Renaud (4) * ipa-cert-fix man page: add note about certmonger renewal https://pagure.io/freeipa/c/06a445aff10c1ab84e8784ab41b0a838e500e617[commit] https://pagure.io/freeipa/issue/8702[#8702] * freeipa.spec: bump 389-ds version https://pagure.io/freeipa/c/6eb535334d33f8f375b856e3a2d0b8853b318b4d[commit] https://pagure.io/freeipa/issue/8691[#8691], https://pagure.io/freeipa/issue/8756[#8756] * ipatests: delete the replica before uninstallation https://pagure.io/freeipa/c/2b22450dfdc1657b463683b09b9c69816f9152d9[commit] https://pagure.io/freeipa/issue/8876[#8876] * ipatests: set selinux context for fips mode https://pagure.io/freeipa/c/13b257d7a05fd255df472144712edb34604dbe06[commit] https://pagure.io/freeipa/issue/8868[#8868] === Stanislav Levin (2) * gssproxy: Don't refresh expired delegated credentials https://pagure.io/freeipa/c/0fd06f33b83aec19a88c594d3750bc476157ab83[commit] * krb_utils: Simplify get_credentials https://pagure.io/freeipa/c/700be74975cad998e7dbcc4fb437e6b0bbd77305[commit] https://pagure.io/freeipa/issue/8873[#8873] === Sergey Orlov (2) * ipatests: disable test_nfs.py::TestNFS in nightly runs on Fedora 33 https://pagure.io/freeipa/c/c9f5acc0d281f1a27471091648c36f94528c5a29[commit] https://pagure.io/freeipa/issue/8877[#8877] * ipatests: temporary disable execution of test_nfs.py::TestNFS in nightly runs https://pagure.io/freeipa/c/6ee14f513711ae9be799cfa2bd009f13c5248932[commit] https://pagure.io/freeipa/issue/8877[#8877] -- / Alexander Bokovoy Sr. Principal Software Engineer Security / Identity Management Engineering Red Hat Limited, Finland _______________________________________________ FreeIPA-devel mailing list -- freeipa-devel(a)lists.fedorahosted.org To unsubscribe send an email to freeipa-devel-leave(a)lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/freeipa-devel@lists.fedorahost… Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure

1 0

DNS Locations and external DNS
by Ronald Wimmer 14 Jun '21

14 Jun '21

Is it sufficient to create DNS locations in IPA and do a ipa dns-update-system-records --dry-run in order to populate new DNS Zone information to the external DNS system? Apart from adding IPA clients to their respective locations, there is nothing to do regarding DNS locations on IPA clients, right? Cheers, Ronald

2 2

Cant login via AD user
by Konstantin Ignatev 13 Jun '21

13 Jun '21

Good day. IPA - 4.9.4. OS - Fedora 34. I have established a trust relationship with the AD domain. The list of domains is easily obtained by the command ipa trust-fetch-domains "example.com" I can get a ticket using kinit username(a)example.com in CLI. I can not log into the server using the AD account from UI. With exactly the same installation but on the Centos 7 + IPA 4.6.8 there are no similar problemsю In /var/log/httpd/error_log [Sun Jun 13 15:51:14.045718 2021] [wsgi:error] [pid 2312:tid 2815] [remote 172.17.51.252:8946] ipa: INFO: 401 Unauthorized: Major (851968): Unspecified GSS failure. Minor code may provide more information, Minor (2598844988): KDC returned error string: PROCESS_TGS In /var/log/krb5kdc.log Jun 13 15:51:13 freeipa-master.ipa.example.com krb5kdc[2256](info): AS_REQ (3 etypes {aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17), DEPRECATED:arcfour-hmac(23)}) 172.17.252.121: REFERRAL: aduser\@example.com@IPA.EXAMPLE.COM for krbtgt/IPA.EXAMPLE.COM(a)IPA.EXAMPLE.COM, Realm not local to KDC /etc/krb.conf includedir /etc/krb5.conf.d/ includedir /var/lib/sss/pubconf/krb5.include.d/ [logging] default = FILE:/var/log/krb5libs.log kdc = FILE:/var/log/krb5kdc.log admin_server = FILE:/var/log/kadmind.log [libdefaults] default_realm = IPA.EXAMPLE.COM dns_lookup_realm = false dns_lookup_kdc = true rdns = false ticket_lifetime = 24h forwardable = true udp_preference_limit = 0 default_ccache_name = KEYRING:persistent:%{uid} default_tkt_enctypes = aes256-cts aes128-cts rc4-hmac arcfour-hmac-md5 des-cbc-md5 des-cbc-crc [realms] IPA.EXAMPLE.COM = { kdc = freeipa-master.ipa.example.com:88 master_kdc = freeipa-master.ipa.example.com:88 admin_server = freeipa-master.ipa.example.com:749 default_domain = ipa.example.com pkinit_anchors = FILE:/var/lib/ipa-client/pki/kdc-ca-bundle.pem pkinit_pool = FILE:/var/lib/ipa-client/pki/ca-bundle.pem auth_to_local = RULE:[1:$1@$0](^.*@EXAMPLE.COM$)s/@EXAMPLE.COM/@example.com/ auth_to_local = DEFAULT } [domain_realm] .ipa.example.com = IPA.EXAMPLE.COM ipa.example.com = IPA.EXAMPLE.COM freeipa-master.ipa.example.com = IPA.EXAMPLE.COM [dbmodules] IPA.EXAMPLE.COM = { db_library = ipadb.so } [plugins] certauth = { module = ipakdb:kdb/ipadb.so enable_only = ipakdb } /etc/sssd/sssd.conf [domain/ipa.example.com] krb5_use_kdcinfo = False krb5_use_fast = never id_provider = ipa ipa_server_mode = True ipa_server = freeipa-master.ipa.example.com ipa_domain = ipa.example.com ipa_hostname = freeipa-master.ipa.example.com auth_provider = ipa chpass_provider = ipa access_provider = ipa cache_credentials = True ldap_tls_cacert = /etc/ipa/ca.crt krb5_store_password_if_offline = True [sssd] services = nss, pam, ifp, ssh, sudo domains = ipa.example.com [nss] homedir_substring = /home memcache_timeout = 600 [pam] [sudo] [autofs] [ssh] [pac] [ifp] allowed_uids = ipaapi, root [secrets] [session_recording] I would be grateful for any help

2 2

Cant login via AD from UI Freeipa
by Константин 13 Jun '21

13 Jun '21

Good day. IPA - 4.9.4. OS - Fedora 34. I have established a trust relationship with the AD domain. The list of domains is easily obtained by the command ipa trust-fetch-domains "example.com" I can get a ticket using kinit username(a)example.com in CLI. I can not log into the server using the AD account from UI. With exactly the same installation but on the Centos 7 + IPA 4.6.8 there are no similar problemsю In /var/log/httpd/error_log [Sun Jun 13 15:51:14.045718 2021] [wsgi:error] [pid 2312:tid 2815] [remote 172.17.51.252:8946] ipa: INFO: 401 Unauthorized: Major (851968): Unspecified GSS failure. Minor code may provide more information, Minor (2598844988): KDC returned error string: PROCESS_TGS In /var/log/krb5kdc.log Jun 13 15:51:13 freeipa-master.ipa.example.com krb5kdc[2256](info): AS_REQ (3 etypes {aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17), DEPRECATED:arcfour-hmac(23)}) 172.17.252.121: REFERRAL: aduser\@ example.com(a)IPA.EXAMPLE.COM for krbtgt/IPA.EXAMPLE.COM(a)IPA.EXAMPLE.COM, Realm not local to KDC /etc/krb.conf includedir /etc/krb5.conf.d/ includedir /var/lib/sss/pubconf/krb5.include.d/ [logging] default = FILE:/var/log/krb5libs.log kdc = FILE:/var/log/krb5kdc.log admin_server = FILE:/var/log/kadmind.log [libdefaults] default_realm = IPA.EXAMPLE.COM dns_lookup_realm = false dns_lookup_kdc = true rdns = false ticket_lifetime = 24h forwardable = true udp_preference_limit = 0 default_ccache_name = KEYRING:persistent:%{uid} default_tkt_enctypes = aes256-cts aes128-cts rc4-hmac arcfour-hmac-md5 des-cbc-md5 des-cbc-crc [realms] IPA.EXAMPLE.COM = { kdc = freeipa-master.ipa.example.com:88 master_kdc = freeipa-master.ipa.example.com:88 admin_server = freeipa-master.ipa.example.com:749 default_domain = ipa.example.com pkinit_anchors = FILE:/var/lib/ipa-client/pki/kdc-ca-bundle.pem pkinit_pool = FILE:/var/lib/ipa-client/pki/ca-bundle.pem auth_to_local = RULE:[1:$1@$0](^.*@EXAMPLE.COM$)s/@ EXAMPLE.COM/@example.com/ auth_to_local = DEFAULT } [domain_realm] .ipa.example.com = IPA.EXAMPLE.COM ipa.example.com = IPA.EXAMPLE.COM freeipa-master.ipa.example.com = IPA.EXAMPLE.COM [dbmodules] IPA.EXAMPLE.COM = { db_library = ipadb.so } [plugins] certauth = { module = ipakdb:kdb/ipadb.so enable_only = ipakdb } /etc/sssd/sssd.conf [domain/ipa.example.com] krb5_use_kdcinfo = False krb5_use_fast = never id_provider = ipa ipa_server_mode = True ipa_server = freeipa-master.ipa.example.com ipa_domain = ipa.example.com ipa_hostname = freeipa-master.ipa.example.com auth_provider = ipa chpass_provider = ipa access_provider = ipa cache_credentials = True ldap_tls_cacert = /etc/ipa/ca.crt krb5_store_password_if_offline = True [sssd] services = nss, pam, ifp, ssh, sudo domains = ipa.example.com [nss] homedir_substring = /home memcache_timeout = 600 [pam] [sudo] [autofs] [ssh] [pac] [ifp] allowed_uids = ipaapi, root [secrets] [session_recording] I would be grateful for any help

1 0

Redhat Idm/IPA cross domain trust problems
by thing.thing＠gmail.com 10 Jun '21

10 Jun '21

Hi, I have RH's version of freeipa (ipa-server-4.9.2-3.module+el8.4.0+10412+5ecb5b37.x86_64) working fine. RHEL8, RHEL7, Debian10.9, Ubuntu20LTS and Centos7 clients work perfectly OK to IPA OK for users in IPA.. For the cross domain trust however only RHEL8 and RHEL7 work. Debian10.9, Ubuntu20LTS and Centos7 fail for the AD user who cannot ssh in. Is there any config I need to do to get 3rd party Linux to work with a trust? Just wondering if I have missed a package? config? steps? or does it just not work? rhel7 secure log showing success, 8><---- Jun 9 16:40:55 rhel7a sshd[9339]: pam_sss(sshd:auth): authentication success; logname= uid=0 euid=0 tty=ssh ruser= rhost=v1.ods.vuw.ac.nz user=linuxuser2(a)vuwtest.ac.nz Jun 9 16:41:04 rhel7a sshd[9336]: Accepted keyboard-interactive/pam for linuxuser2(a)vuwtest.ac.nz from 10.100.32.67 port 48 Jun 9 16:41:04 rhel7a sshd[9336]: pam_unix(sshd:session): session opened for user linuxuser2(a)vuwtest.ac.nz by (uid=0) [root@rhel7a ~]# 8><--- centos7 secure log, 8><--- [root@centos7a ~]# tail -50f /var/log/secure Jun 9 17:15:24 centos7a sshd[1812]: Invalid user linuxuser2(a)vuwtest.ac.nz from 10.100.32.67 port 53880 Jun 9 17:15:24 centos7a sshd[1812]: input_userauth_request: invalid user linuxuser2(a)vuwtest.ac.nz [preauth] Jun 9 17:15:24 centos7a sshd[1812]: Postponed keyboard-interactive for invalid user linuxuser2(a)vuwtest.ac.nz from 10.100.32.67 port 53880 ssh2 [preauth] Jun 9 17:15:35 centos7a sshd[1814]: pam_unix(sshd:auth): check pass; user unknown Jun 9 17:15:35 centos7a sshd[1814]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=10.100.32.67 Jun 9 17:15:37 centos7a sshd[1812]: error: PAM: User not known to the underlying authentication module for illegal user linuxuser2(a)vuwtest.ac.nz from 10.100.32.67 Jun 9 17:15:37 centos7a sshd[1812]: Failed keyboard-interactive/pam for invalid user linuxuser2(a)vuwtest.ac.nz from 10.100.32.67 port 53880 ssh2 Jun 9 17:15:37 centos7a sshd[1812]: Postponed keyboard-interactive for invalid user linuxuser2(a)vuwtest.ac.nz from 10.100.32.67 port 53880 ssh2 [preauth] 8><---

2 1

CentOS 6 Client installation stuck and don't complete
by Rohan Talkar 10 Jun '21

10 Jun '21

HI Team, We are migrating from our current Directory Service 389DS to FreeIPA. Our all servers at present authenticated by 389DS server. Our infra hosted on AWS cloud. Please find below setup of FreeIPA & Client on which we are performing tests & getting issue. FreeIPA Servers Primary Master Server = Region 1 Secondary Master Server = Region 2 OS = CentOS Linux release 8.3.2011 IPA Version = 4.8.7, API_VERSION: 2.239 FreeIPA Client OS = CentOS release 6.9 (Final) Kernel Version = Linux drxlceco6app01 2.6.32-696.1.1.el6.x86_64 #1 SMP Tue Apr 11 17:13:24 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux IPA Client version = 3.0.0-51.el6.centos Our DNS getting managed from "/etc/hosts" file by manually adding DNS entries of server. On centos 6 client installation gets stuck after SSSD setup completes. Below output for details. NOTE = For security reason we have masked our Domain nme to "XYZ.com" & other details with Capital "X". ======================================== case "$env" in echo 'This is US DR' This is US DR ++ hostname ipa-client-install --mkhomedir --no-krb5-offline-passwords --hostname=drxlceco6app01.XYZ.com --force-join --fixed-primary --server=drxipaco8lds01.XYZ.com --server=prdipaco8ldm01.XYZ.com --domain XYZ.com --realm XYZ.COM Autodiscovery of servers for failover cannot work with this configuration. If you proceed with the installation, services will be configured to always access the discovered server for all operations and will not fail over to other servers in case of failure. Proceed with fixed values and no DNS discovery? [no]: yes Hostname: drxlceco6app01.XYZ.com Realm: XYZ.COM DNS Domain: XYZ.com IPA Server: prdipaco8ldm01.XYZ.com, drxipaco8lds01.XYZ.com BaseDN: dc=XYZ,dc=com Continue to configure the system with these values? [no]: yes User authorized to enroll computers: admin Synchronizing time with KDC... Unable to sync time with IPA NTP server, assuming the time is in sync. Please check that 123 UDP port is opened. Password for admin(a)XYZ.COM: Successfully retrieved CA cert Subject: CN=Certificate Authority,O=XYZ.COM Issuer: CN=Certificate Authority,O=XYZ.COM Valid From: Mon Apr 19 14:35:38 2021 UTC Valid Until: Fri Apr 19 14:35:38 2041 UTC Enrolled in IPA realm XYZ.COM Attempting to get host TGT... Created /etc/ipa/default.conf New SSSD config will be created Configured sudoers in /etc/nsswitch.conf Configured /etc/sssd/sssd.conf Configured /etc/krb5.conf for IPA realm XYZ.COM trying https://prdipaco8ldm01.XYZ.com/ipa/xml Forwarding 'env' to server u'https://prdipaco8ldm01.XYZ.com/ipa/xml' Hostname (drxlceco6app01.XYZ.com) not found in DNS Failed to update DNS records. Adding SSH public key from /etc/ssh/ssh_host_rsa_key.pub Forwarding 'host_mod' to server u'https://prdipaco8ldm01.XYZ.com/ipa/xml' Could not update DNS SSHFP records. SSSD enabled Configuring XYZ.com as NIS domain ======================================== Current /etc/nsswitch.conf entries as below. ======================================== passwd: files ldap shadow: files ldap group: files ldap hosts: files dns bootparams: nisplus [NOTFOUND=return] files ethers: files netmasks: files networks: files protocols: files rpc: files services: files netgroup: nisplus publickey: nisplus automount: files nisplus aliases: files nisplus ======================================== Complete client installation logs as below. ======================================== 2021-06-01T17:25:40Z DEBUG /usr/sbin/ipa-client-install was invoked with options: {'domain': 'XYZ.com', 'force': False, 'realm_name': 'XYZ.COM', 'krb5_offline_passwords': False, 'primary': True, 'mkhomedir': True, 'create_sshfp': True, 'conf_sshd': True, 'conf_ntp': True, 'on_master': False, 'ntp_server': None, 'nisdomain': None, 'no_nisdomain': False, 'principal': None, 'hostname': 'drxlceco6app01.XYZ.com', 'no_ac': False, 'unattended': None, 'sssd': True, 'trust_sshfp': False, 'kinit_attempts': 5, 'dns_updates': False, 'conf_sudo': True, 'conf_ssh': True, 'force_join': True, 'ca_cert_file': None, 'server': ['drxipaco8lds01.XYZ.com', 'prdipaco8ldm01.XYZ.com'], 'prompt_password': False, 'permit': False, 'debug': False, 'preserve_sssd': False, 'uninstall': False} 2021-06-01T17:25:40Z DEBUG missing options might be asked for interactively later 2021-06-01T17:25:40Z DEBUG Loading Index file from '/var/lib/ipa-client/sysrestore/sysrestore.index' 2021-06-01T17:25:40Z DEBUG Loading StateFile from '/var/lib/ipa-client/sysrestore/sysrestore.state' 2021-06-01T17:25:40Z DEBUG [IPA Discovery] 2021-06-01T17:25:40Z DEBUG Starting IPA discovery with domain=XYZ.com, servers=['drxipaco8lds01.XYZ.com', 'prdipaco8ldm01.XYZ.com'], hostname=drxlceco6app01.XYZ.com 2021-06-01T17:25:40Z DEBUG Server and domain forced 2021-06-01T17:25:40Z DEBUG [Kerberos realm search] 2021-06-01T17:25:40Z DEBUG Kerberos realm forced 2021-06-01T17:25:40Z DEBUG Search DNS for SRV record of _kerberos._udp.XYZ.com. 2021-06-01T17:25:40Z DEBUG No DNS record found 2021-06-01T17:25:40Z DEBUG SRV record for KDC not found! Domain: XYZ.com 2021-06-01T17:25:40Z DEBUG [LDAP server check] 2021-06-01T17:25:40Z DEBUG Verifying that drxipaco8lds01.XYZ.com (realm XYZ.COM) is an IPA server 2021-06-01T17:25:40Z DEBUG Init LDAP connection with: ldap://drxipaco8lds01.XYZ.com:389 2021-06-01T17:25:40Z DEBUG Search LDAP server for IPA base DN 2021-06-01T17:25:40Z DEBUG Check if naming context 'dc=XYZ,dc=com' is for IPA 2021-06-01T17:25:40Z DEBUG LDAP Error: Anonymous access not allowed 2021-06-01T17:25:40Z DEBUG Verifying that prdipaco8ldm01.XYZ.com (realm XYZ.COM) is an IPA server 2021-06-01T17:25:40Z DEBUG Init LDAP connection with: ldap://prdipaco8ldm01.XYZ.com:389 2021-06-01T17:25:40Z DEBUG Search LDAP server for IPA base DN 2021-06-01T17:25:40Z DEBUG Check if naming context 'dc=XYZ,dc=com' is for IPA 2021-06-01T17:25:40Z DEBUG LDAP Error: Anonymous access not allowed 2021-06-01T17:25:40Z DEBUG Generated basedn from realm: dc=XYZ,dc=com 2021-06-01T17:25:40Z DEBUG Discovery result: NO_ACCESS_TO_LDAP; server=None, domain=XYZ.com, kdc=None, basedn=dc=XYZ,dc=com 2021-06-01T17:25:40Z DEBUG Validated servers: prdipaco8ldm01.XYZ.com,drxipaco8lds01.XYZ.com 2021-06-01T17:25:40Z DEBUG will use discovered domain: XYZ.com 2021-06-01T17:25:40Z DEBUG Using servers from command line, disabling DNS discovery 2021-06-01T17:25:40Z DEBUG will use provided server: drxipaco8lds01.XYZ.com, prdipaco8ldm01.XYZ.com 2021-06-01T17:25:40Z INFO Autodiscovery of servers for failover cannot work with this configuration. 2021-06-01T17:25:40Z INFO If you proceed with the installation, services will be configured to always access the discovered server for all operations and will not fail over to other servers in case of failure. 2021-06-01T17:26:20Z DEBUG will use discovered realm: XYZ.COM 2021-06-01T17:26:20Z DEBUG will use discovered basedn: dc=XYZ,dc=com 2021-06-01T17:26:20Z INFO Hostname: drxlceco6app01.XYZ.com 2021-06-01T17:26:20Z DEBUG Hostname source: Provided as option 2021-06-01T17:26:20Z INFO Realm: XYZ.COM 2021-06-01T17:26:20Z DEBUG Realm source: Forced 2021-06-01T17:26:20Z INFO DNS Domain: XYZ.com 2021-06-01T17:26:20Z DEBUG DNS Domain source: Forced 2021-06-01T17:26:20Z INFO IPA Server: prdipaco8ldm01.XYZ.com, drxipaco8lds01.XYZ.com 2021-06-01T17:26:20Z DEBUG IPA Server source: Provided as option 2021-06-01T17:26:20Z INFO BaseDN: dc=XYZ,dc=com 2021-06-01T17:26:20Z DEBUG BaseDN source: Generated from Kerberos realm 2021-06-01T17:26:45Z DEBUG args=/usr/sbin/ipa-rmkeytab -k /etc/krb5.keytab -r XYZ.COM 2021-06-01T17:26:45Z DEBUG stdout= 2021-06-01T17:26:45Z DEBUG stderr=Failed to open keytab '/etc/krb5.keytab': No such file or directory 2021-06-01T17:26:45Z DEBUG args=/bin/hostname drxlceco6app01.XYZ.com 2021-06-01T17:26:45Z DEBUG stdout= 2021-06-01T17:26:45Z DEBUG stderr= 2021-06-01T17:26:45Z DEBUG Backing up system configuration file '/etc/sysconfig/network' 2021-06-01T17:26:45Z DEBUG Saving Index File to '/var/lib/ipa-client/sysrestore/sysrestore.index' 2021-06-01T17:26:45Z DEBUG args=/usr/sbin/selinuxenabled 2021-06-01T17:26:45Z DEBUG stdout= 2021-06-01T17:26:45Z DEBUG stderr= 2021-06-01T17:26:45Z DEBUG Saving StateFile to '/var/lib/ipa-client/sysrestore/sysrestore.state' 2021-06-01T17:26:51Z DEBUG will use principal provided as option: admin 2021-06-01T17:26:51Z INFO Synchronizing time with KDC... 2021-06-01T17:26:51Z DEBUG Search DNS for SRV record of _ntp._udp.XYZ.com. 2021-06-01T17:26:51Z DEBUG No DNS record found 2021-06-01T17:26:55Z DEBUG args=/usr/sbin/ntpdate -U ntp -s -b -v prdipaco8ldm01.XYZ.com 2021-06-01T17:26:55Z DEBUG stdout= 2021-06-01T17:26:55Z DEBUG stderr= 2021-06-01T17:26:59Z DEBUG args=/usr/sbin/ntpdate -U ntp -s -b -v prdipaco8ldm01.XYZ.com 2021-06-01T17:26:59Z DEBUG stdout= 2021-06-01T17:26:59Z DEBUG stderr= 2021-06-01T17:27:03Z DEBUG args=/usr/sbin/ntpdate -U ntp -s -b -v prdipaco8ldm01.XYZ.com 2021-06-01T17:27:03Z DEBUG stdout= 2021-06-01T17:27:03Z DEBUG stderr= 2021-06-01T17:27:03Z WARNING Unable to sync time with IPA NTP server, assuming the time is in sync. Please check that 123 UDP port is opened. 2021-06-01T17:27:03Z DEBUG Writing Kerberos configuration to /tmp/tmpGWIbHp: 2021-06-01T17:27:03Z DEBUG #File modified by ipa-client-install includedir /var/lib/sss/pubconf/krb5.include.d/ [libdefaults] default_realm = XYZ.COM dns_lookup_realm = false dns_lookup_kdc = false rdns = false ticket_lifetime = 24h forwardable = yes udp_preference_limit = 0 [realms] XYZ.COM = { kdc = prdipaco8ldm01.XYZ.com:88 master_kdc = prdipaco8ldm01.XYZ.com:88 admin_server = prdipaco8ldm01.XYZ.com:749 kdc = drxipaco8lds01.XYZ.com:88 master_kdc = drxipaco8lds01.XYZ.com:88 admin_server = drxipaco8lds01.XYZ.com:749 default_domain = XYZ.com pkinit_anchors = FILE:/etc/ipa/ca.crt } [domain_realm] .XYZ.com = XYZ.COM XYZ.com = XYZ.COM 2021-06-01T17:27:07Z DEBUG args=kinit admin(a)XYZ.COM 2021-06-01T17:27:07Z DEBUG stdout=Password for admin(a)XYZ.COM: 2021-06-01T17:27:07Z DEBUG stderr= 2021-06-01T17:27:07Z DEBUG trying to retrieve CA cert via LDAP from ldap://prdipaco8ldm01.XYZ.com 2021-06-01T17:27:07Z INFO Successfully retrieved CA cert Subject: CN=Certificate Authority,O=XYZ.COM Issuer: CN=Certificate Authority,O=XYZ.COM Valid From: Mon Apr 19 14:35:38 2021 UTC Valid Until: Fri Apr 19 14:35:38 2041 UTC 2021-06-01T17:27:08Z DEBUG args=/usr/sbin/ipa-join -s prdipaco8ldm01.XYZ.com -b dc=XYZ,dc=com -h drxlceco6app01.XYZ.com -f 2021-06-01T17:27:08Z DEBUG stdout= 2021-06-01T17:27:08Z DEBUG stderr=Failed to retrieve encryption type Triple DES cbc mode with HMAC/sha1 (#16) Failed to retrieve encryption type ArcFour with HMAC/md5 (#23) Keytab successfully retrieved and stored in: /etc/krb5.keytab Certificate subject base is: O=XYZ.COM 2021-06-01T17:27:08Z INFO Enrolled in IPA realm XYZ.COM 2021-06-01T17:27:08Z DEBUG args=kdestroy 2021-06-01T17:27:08Z DEBUG stdout= 2021-06-01T17:27:08Z DEBUG stderr= 2021-06-01T17:27:08Z INFO Attempting to get host TGT... 2021-06-01T17:27:08Z DEBUG args=/usr/bin/kinit -k -t /etc/krb5.keytab host/drxlceco6app01.XYZ.com(a)XYZ.COM 2021-06-01T17:27:08Z DEBUG stdout= 2021-06-01T17:27:08Z DEBUG stderr= 2021-06-01T17:27:08Z DEBUG Attempt 1/5 succeeded. 2021-06-01T17:27:08Z DEBUG Backing up system configuration file '/etc/ipa/default.conf' 2021-06-01T17:27:08Z DEBUG -> Not backing up - '/etc/ipa/default.conf' doesn't exist 2021-06-01T17:27:08Z INFO Created /etc/ipa/default.conf 2021-06-01T17:27:08Z DEBUG importing all plugin modules in '/usr/lib/python2.6/site-packages/ipalib/plugins'... 2021-06-01T17:27:08Z DEBUG importing plugin module '/usr/lib/python2.6/site-packages/ipalib/plugins/aci.py' 2021-06-01T17:27:08Z DEBUG importing plugin module '/usr/lib/python2.6/site-packages/ipalib/plugins/automember.py' 2021-06-01T17:27:08Z DEBUG importing plugin module '/usr/lib/python2.6/site-packages/ipalib/plugins/automount.py' 2021-06-01T17:27:08Z DEBUG importing plugin module '/usr/lib/python2.6/site-packages/ipalib/plugins/baseldap.py' 2021-06-01T17:27:08Z DEBUG importing plugin module '/usr/lib/python2.6/site-packages/ipalib/plugins/batch.py' 2021-06-01T17:27:08Z DEBUG importing plugin module '/usr/lib/python2.6/site-packages/ipalib/plugins/cert.py' 2021-06-01T17:27:08Z DEBUG importing plugin module '/usr/lib/python2.6/site-packages/ipalib/plugins/config.py' 2021-06-01T17:27:08Z DEBUG importing plugin module '/usr/lib/python2.6/site-packages/ipalib/plugins/delegation.py' 2021-06-01T17:27:08Z DEBUG importing plugin module '/usr/lib/python2.6/site-packages/ipalib/plugins/dns.py' 2021-06-01T17:27:08Z DEBUG importing plugin module '/usr/lib/python2.6/site-packages/ipalib/plugins/group.py' 2021-06-01T17:27:08Z DEBUG importing plugin module '/usr/lib/python2.6/site-packages/ipalib/plugins/hbacrule.py' 2021-06-01T17:27:08Z DEBUG importing plugin module '/usr/lib/python2.6/site-packages/ipalib/plugins/hbacsvc.py' 2021-06-01T17:27:08Z DEBUG importing plugin module '/usr/lib/python2.6/site-packages/ipalib/plugins/hbacsvcgroup.py' 2021-06-01T17:27:08Z DEBUG importing plugin module '/usr/lib/python2.6/site-packages/ipalib/plugins/hbactest.py' 2021-06-01T17:27:08Z DEBUG importing plugin module '/usr/lib/python2.6/site-packages/ipalib/plugins/host.py' 2021-06-01T17:27:08Z DEBUG importing plugin module '/usr/lib/python2.6/site-packages/ipalib/plugins/hostgroup.py' 2021-06-01T17:27:08Z DEBUG importing plugin module '/usr/lib/python2.6/site-packages/ipalib/plugins/idrange.py' 2021-06-01T17:27:08Z DEBUG importing plugin module '/usr/lib/python2.6/site-packages/ipalib/plugins/internal.py' 2021-06-01T17:27:08Z DEBUG importing plugin module '/usr/lib/python2.6/site-packages/ipalib/plugins/kerberos.py' 2021-06-01T17:27:08Z DEBUG importing plugin module '/usr/lib/python2.6/site-packages/ipalib/plugins/krbtpolicy.py' 2021-06-01T17:27:08Z DEBUG importing plugin module '/usr/lib/python2.6/site-packages/ipalib/plugins/migration.py' 2021-06-01T17:27:08Z DEBUG importing plugin module '/usr/lib/python2.6/site-packages/ipalib/plugins/misc.py' 2021-06-01T17:27:08Z DEBUG importing plugin module '/usr/lib/python2.6/site-packages/ipalib/plugins/netgroup.py' 2021-06-01T17:27:08Z DEBUG importing plugin module '/usr/lib/python2.6/site-packages/ipalib/plugins/passwd.py' 2021-06-01T17:27:08Z DEBUG importing plugin module '/usr/lib/python2.6/site-packages/ipalib/plugins/permission.py' 2021-06-01T17:27:08Z DEBUG importing plugin module '/usr/lib/python2.6/site-packages/ipalib/plugins/ping.py' 2021-06-01T17:27:08Z DEBUG importing plugin module '/usr/lib/python2.6/site-packages/ipalib/plugins/privilege.py' 2021-06-01T17:27:08Z DEBUG importing plugin module '/usr/lib/python2.6/site-packages/ipalib/plugins/pwpolicy.py' 2021-06-01T17:27:08Z DEBUG args=klist -V 2021-06-01T17:27:08Z DEBUG stdout=Kerberos 5 version 1.10.3 2021-06-01T17:27:08Z DEBUG stderr= 2021-06-01T17:27:08Z DEBUG importing plugin module '/usr/lib/python2.6/site-packages/ipalib/plugins/role.py' 2021-06-01T17:27:08Z DEBUG importing plugin module '/usr/lib/python2.6/site-packages/ipalib/plugins/selfservice.py' 2021-06-01T17:27:08Z DEBUG importing plugin module '/usr/lib/python2.6/site-packages/ipalib/plugins/selinuxusermap.py' 2021-06-01T17:27:08Z DEBUG importing plugin module '/usr/lib/python2.6/site-packages/ipalib/plugins/service.py' 2021-06-01T17:27:08Z DEBUG importing plugin module '/usr/lib/python2.6/site-packages/ipalib/plugins/sudocmd.py' 2021-06-01T17:27:08Z DEBUG importing plugin module '/usr/lib/python2.6/site-packages/ipalib/plugins/sudocmdgroup.py' 2021-06-01T17:27:08Z DEBUG importing plugin module '/usr/lib/python2.6/site-packages/ipalib/plugins/sudorule.py' 2021-06-01T17:27:08Z DEBUG importing plugin module '/usr/lib/python2.6/site-packages/ipalib/plugins/trust.py' 2021-06-01T17:27:08Z DEBUG importing plugin module '/usr/lib/python2.6/site-packages/ipalib/plugins/user.py' 2021-06-01T17:27:08Z DEBUG importing plugin module '/usr/lib/python2.6/site-packages/ipalib/plugins/virtual.py' 2021-06-01T17:27:08Z DEBUG importing plugin module '/usr/lib/python2.6/site-packages/ipalib/plugins/xmlclient.py' 2021-06-01T17:27:09Z DEBUG Backing up system configuration file '/etc/sssd/sssd.conf' 2021-06-01T17:27:09Z DEBUG -> Not backing up - '/etc/sssd/sssd.conf' doesn't exist 2021-06-01T17:27:09Z INFO New SSSD config will be created 2021-06-01T17:27:09Z DEBUG Backing up system configuration file '/etc/nsswitch.conf' 2021-06-01T17:27:09Z DEBUG Saving Index File to '/var/lib/ipa-client/sysrestore/sysrestore.index' 2021-06-01T17:27:09Z INFO Configured sudoers in /etc/nsswitch.conf 2021-06-01T17:27:09Z INFO Configured /etc/sssd/sssd.conf 2021-06-01T17:27:09Z DEBUG args=/usr/bin/certutil -A -d /etc/pki/nssdb -n IPA CA -t CT,C,C -a -i /etc/ipa/ca.crt 2021-06-01T17:27:09Z DEBUG stdout= 2021-06-01T17:27:09Z DEBUG stderr= 2021-06-01T17:27:09Z DEBUG Backing up system configuration file '/etc/krb5.conf' 2021-06-01T17:27:09Z DEBUG Saving Index File to '/var/lib/ipa-client/sysrestore/sysrestore.index' 2021-06-01T17:27:09Z DEBUG Writing Kerberos configuration to /etc/krb5.conf: 2021-06-01T17:27:09Z DEBUG #File modified by ipa-client-install includedir /var/lib/sss/pubconf/krb5.include.d/ [libdefaults] default_realm = XYZ.COM dns_lookup_realm = false dns_lookup_kdc = false rdns = false ticket_lifetime = 24h forwardable = yes udp_preference_limit = 0 [realms] XYZ.COM = { kdc = prdipaco8ldm01.XYZ.com:88 master_kdc = prdipaco8ldm01.XYZ.com:88 admin_server = prdipaco8ldm01.XYZ.com:749 kdc = drxipaco8lds01.XYZ.com:88 master_kdc = drxipaco8lds01.XYZ.com:88 admin_server = drxipaco8lds01.XYZ.com:749 default_domain = XYZ.com pkinit_anchors = FILE:/etc/ipa/ca.crt } [domain_realm] .XYZ.com = XYZ.COM XYZ.com = XYZ.COM 2021-06-01T17:27:09Z INFO Configured /etc/krb5.conf for IPA realm XYZ.COM 2021-06-01T17:27:09Z DEBUG args=keyctl search @s user ipa_session_cookie:host/drxlceco6app01.XYZ.com@XYZ.COM 2021-06-01T17:27:09Z DEBUG stdout= 2021-06-01T17:27:09Z DEBUG stderr=keyctl_search: Required key not available 2021-06-01T17:27:09Z DEBUG args=keyctl search @s user ipa_session_cookie:host/drxlceco6app01.XYZ.com@XYZ.COM 2021-06-01T17:27:09Z DEBUG stdout= 2021-06-01T17:27:09Z DEBUG stderr=keyctl_search: Required key not available 2021-06-01T17:27:09Z DEBUG failed to find session_cookie in persistent storage for principal 'host/drxlceco6app01.XYZ.com(a)XYZ.COM' 2021-06-01T17:27:09Z INFO trying https://prdipaco8ldm01.XYZ.com/ipa/xml 2021-06-01T17:27:09Z DEBUG Created connection context.xmlclient 2021-06-01T17:27:09Z DEBUG raw: env(None, server=True) 2021-06-01T17:27:09Z DEBUG env(None, server=True, all=True) 2021-06-01T17:27:09Z INFO Forwarding 'env' to server u'https://prdipaco8ldm01.XYZ.com/ipa/xml' 2021-06-01T17:27:09Z DEBUG NSSConnection init prdipaco8ldm01.XYZ.com 2021-06-01T17:27:09Z DEBUG Connecting: 10.113.10.50:0 2021-06-01T17:27:09Z DEBUG auth_certificate_callback: check_sig=True is_server=False Data: Version: 3 (0x2) Serial Number: 9 (0x9) Signature Algorithm: Algorithm: PKCS #1 SHA-256 With RSA Encryption Issuer: CN=Certificate Authority,O=XYZ.COM Validity: Not Before: Mon Apr 19 14:37:53 2021 UTC Not After: Thu Apr 20 14:37:53 2023 UTC Subject: CN=prdipaco8ldm01.XYZ.com,O=XYZ.COM Subject Public Key Info: Public Key Algorithm: Algorithm: PKCS #1 RSA Encryption RSA Public Key: Modulus: XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX: XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX: XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX: XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX: XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX: XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX: XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX: XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX: XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX: XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX: XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX: XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX: XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX: XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX: XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX: XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX Exponent: 65537 (0x10001) Signed Extensions: (7 total) Name: Certificate Authority Key Identifier Critical: False Key ID: XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX: XX:XX:XX:XX Serial Number: None General Names: [0 total] Name: Authority Information Access Critical: False Authority Information Access: [1 total] Info [1]: Method: PKIX Online Certificate Status Protocol Location: URI: http://ipa-ca.XYZ.com/ca/ocsp Name: Certificate Key Usage Critical: True Usages: Digital Signature Non-Repudiation Key Encipherment Data Encipherment Name: Extended Key Usage Critical: False Usages: TLS Web Server Authentication Certificate TLS Web Client Authentication Certificate Name: CRL Distribution Points Critical: False CRL Distribution Points: [1 total] Point [1]: General Names: [1 total] http://ipa-ca.XYZ.com/ipa/crl/MasterCRL.bin Issuer: Directory Name: CN=Certificate Authority,O=ipaca Reasons: () Name: Certificate Subject Key ID Critical: False Data: XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX: XX:XX:XX:XX Name: Certificate Subject Alt Name Critical: False Names: prdipaco8ldm01.XYZ.com ipa-ca.XYZ.com HTTP/prdipaco8ldm01.XYZ.com(a)XYZ.COM ['[0]', '[1]'] Signature: Signature Algorithm: Algorithm: PKCS #1 SHA-256 With RSA Encryption Signature: XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX: XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX: XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX: XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX: XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX: XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX: XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX: XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX: XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX: XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX: XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX: XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX: XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX: XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX: XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX: XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX: XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX: XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX: XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX: XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX: XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX: XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX: XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX: XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX Fingerprint (MD5): XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX Fingerprint (SHA1): XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX: XX:XX:XX:XX 2021-06-01T17:27:09Z DEBUG approved_usage = SSL Server intended_usage = SSL Server 2021-06-01T17:27:09Z DEBUG cert valid True for "CN=prdipaco8ldm01.XYZ.com,O=XYZ.COM" 2021-06-01T17:27:09Z DEBUG handshake complete, peer = 10.113.10.50:443 2021-06-01T17:27:09Z DEBUG Protocol: TLS1.2 2021-06-01T17:27:09Z DEBUG Cipher: TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 2021-06-01T17:27:09Z DEBUG received Set-Cookie 'ipa_session=MagBearerToken=Aus0%2bwdoksGBb%2belr0QOIi6Yk7TDzrcvkEuJLRtZf1KNWdahbAPsUyeWqGHs2CM72OMQKtkhONEi6FBan0Km69ssXfx%2bgu6r96B9VC4paNAXVi%2fVr3dd450OSsT1%2fHevzaAFoqFI0Mz95R%2bWgeIkuR4eZ%2fjvCLSGBlM3TwoQUMLA9CKKqPAh6kyN%2fMy6YaG0oXET1ht51P4zJ3rfXdPP9Ael%2bvTNQrS%2fiyCE%2b4TzjZtoNLHei2s5BoGlyZ3GPUS7;path=/ipa;httponly;secure;' 2021-06-01T17:27:09Z DEBUG storing cookie 'ipa_session=MagBearerToken=Aus0%2bwdoksGBb%2belr0QOIi6Yk7TDzrcvkEuJLRtZf1KNWdahbAPsUyeWqGHs2CM72OMQKtkhONEi6FBan0Km69ssXfx%2bgu6r96B9VC4paNAXVi%2fVr3dd450OSsT1%2fHevzaAFoqFI0Mz95R%2bWgeIkuR4eZ%2fjvCLSGBlM3TwoQUMLA9CKKqPAh6kyN%2fMy6YaG0oXET1ht51P4zJ3rfXdPP9Ael%2bvTNQrS%2fiyCE%2b4TzjZtoNLHei2s5BoGlyZ3GPUS7; Domain=prdipaco8ldm01.XYZ.com; Path=/ipa; Secure; HttpOnly' for principal host/drxlceco6app01.XYZ.com(a)XYZ.COM 2021-06-01T17:27:09Z DEBUG args=keyctl search @s user ipa_session_cookie:host/drxlceco6app01.XYZ.com@XYZ.COM 2021-06-01T17:27:09Z DEBUG stdout= 2021-06-01T17:27:09Z DEBUG stderr=keyctl_search: Required key not available 2021-06-01T17:27:09Z DEBUG args=keyctl search @s user ipa_session_cookie:host/drxlceco6app01.XYZ.com@XYZ.COM 2021-06-01T17:27:09Z DEBUG stdout= 2021-06-01T17:27:09Z DEBUG stderr=keyctl_search: Required key not available 2021-06-01T17:27:09Z DEBUG args=keyctl padd user ipa_session_cookie:host/drxlceco6app01.XYZ.com@XYZ.COM @s 2021-06-01T17:27:09Z DEBUG stdout=915601519 2021-06-01T17:27:09Z DEBUG stderr= 2021-06-01T17:27:09Z WARNING Hostname (drxlceco6app01.XYZ.com) not found in DNS 2021-06-01T17:27:09Z DEBUG Writing nsupdate commands to /etc/ipa/.dns_update.txt: 2021-06-01T17:27:09Z DEBUG zone XYZ.com. update delete drxlceco6app01.XYZ.com. IN A send update add drxlceco6app01.XYZ.com. 1200 IN A 10.111.5.11 send 2021-06-01T17:27:10Z DEBUG args=/usr/bin/nsupdate -g /etc/ipa/.dns_update.txt 2021-06-01T17:27:10Z DEBUG stdout= 2021-06-01T17:27:10Z DEBUG stderr=tkey query failed: GSSAPI error: Major = Unspecified GSS failure. Minor code may provide more information, Minor = Server DNS/udns1.ultradns.net(a)XYZ.COM not found in Kerberos database. 2021-06-01T17:27:10Z DEBUG nsupdate failed: Command '/usr/bin/nsupdate -g /etc/ipa/.dns_update.txt' returned non-zero exit status 1 2021-06-01T17:27:10Z ERROR Failed to update DNS records. 2021-06-01T17:27:10Z DEBUG args=/sbin/service messagebus start 2021-06-01T17:27:10Z DEBUG stdout=Starting system message bus: 2021-06-01T17:27:10Z DEBUG stderr= 2021-06-01T17:27:10Z DEBUG args=/sbin/service messagebus status 2021-06-01T17:27:10Z DEBUG stdout=messagebus (pid 1186) is running... 2021-06-01T17:27:10Z DEBUG stderr= 2021-06-01T17:27:10Z DEBUG args=/sbin/service certmonger restart 2021-06-01T17:27:10Z DEBUG stdout=Stopping certmonger: ?[60G[?[0;31mFAILED?[0;39m] Starting certmonger: ?[60G[?[0;32m OK ?[0;39m] 2021-06-01T17:27:10Z DEBUG stderr= 2021-06-01T17:27:10Z DEBUG args=/sbin/service certmonger status 2021-06-01T17:27:10Z DEBUG stdout=certmonger (pid 1974) is running... 2021-06-01T17:27:10Z DEBUG stderr= 2021-06-01T17:27:10Z DEBUG args=/sbin/service certmonger stop 2021-06-01T17:27:10Z DEBUG stdout=Stopping certmonger: ?[60G[?[0;32m OK ?[0;39m] 2021-06-01T17:27:10Z DEBUG stderr= 2021-06-01T17:27:11Z DEBUG args=/sbin/service certmonger restart 2021-06-01T17:27:11Z DEBUG stdout=Stopping certmonger: ?[60G[?[0;31mFAILED?[0;39m] Starting certmonger: ?[60G[?[0;32m OK ?[0;39m] 2021-06-01T17:27:11Z DEBUG stderr= 2021-06-01T17:27:11Z DEBUG args=/sbin/service certmonger status 2021-06-01T17:27:11Z DEBUG stdout=certmonger (pid 2063) is running... 2021-06-01T17:27:11Z DEBUG stderr= 2021-06-01T17:27:11Z DEBUG args=/sbin/chkconfig certmonger on 2021-06-01T17:27:11Z DEBUG stdout= 2021-06-01T17:27:11Z DEBUG stderr= 2021-06-01T17:27:12Z DEBUG args=ipa-getcert request -d /etc/pki/nssdb -n IPA Machine Certificate - drxlceco6app01.XYZ.com -N CN=drxlceco6app01.XYZ.com,O=XYZ.COM -K host/drxlceco6app01.XYZ.com(a)XYZ.COM 2021-06-01T17:27:12Z DEBUG stdout=New signing request "20210601172712" added. 2021-06-01T17:27:12Z DEBUG stderr= 2021-06-01T17:27:12Z INFO Adding SSH public key from /etc/ssh/ssh_host_rsa_key.pub 2021-06-01T17:27:12Z DEBUG raw: host_mod(u'drxlceco6app01.XYZ.com', ipasshpubkey=[u'ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAobH2Rt+aBxrhxWJazVGUpMej9nnncp8DhPewnZkyZxoSAyDc6C5c3nBqW22/Cr7gk26d/D2Ietbi0E7mFrt5Wo4bGgN2KcnlG3ABSifvwh3oqzL+anT6+/lkwzgm3hwIQQRDfF3/GljmvX495HateMqc7syLyOe5ZnKI4Xu6khQ/JF1hhv+8GiUbl7+le+QxYuosmNNIekfMqVbtJ8IM7Zf5/CXINIkwy1UtV+gl0JsAn6AlcBfLcsssg6LQVdgCCjVsJFNB2t+tR0LozJ8L5mDerKqVxJZWI3EnfLIXMq0VWoVfn20fPe0pkcoiyv9bQt/YsDxZS54BFjlTK7DpjQ=='], updatedns=False) 2021-06-01T17:27:12Z DEBUG host_mod(u'drxlceco6app01.XYZ.com', random=False, ipasshpubkey=(u'ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAobH2Rt+aBxrhxWJazVGUpMej9nnncp8DhPewnZkyZxoSAyDc6C5c3nBqW22/Cr7gk26d/D2Ietbi0E7mFrt5Wo4bGgN2KcnlG3ABSifvwh3oqzL+anT6+/lkwzgm3hwIQQRDfF3/GljmvX495HateMqc7syLyOe5ZnKI4Xu6khQ/JF1hhv+8GiUbl7+le+QxYuosmNNIekfMqVbtJ8IM7Zf5/CXINIkwy1UtV+gl0JsAn6AlcBfLcsssg6LQVdgCCjVsJFNB2t+tR0LozJ8L5mDerKqVxJZWI3EnfLIXMq0VWoVfn20fPe0pkcoiyv9bQt/YsDxZS54BFjlTK7DpjQ==',), rights=False, updatedns=False, all=False, raw=False, no_members=False) 2021-06-01T17:27:12Z INFO Forwarding 'host_mod' to server u'https://prdipaco8ldm01.XYZ.com/ipa/xml' 2021-06-01T17:27:12Z DEBUG NSSConnection init prdipaco8ldm01.XYZ.com 2021-06-01T17:27:12Z DEBUG Connecting: 10.113.10.50:0 2021-06-01T17:27:12Z DEBUG handshake complete, peer = 10.113.10.50:443 2021-06-01T17:27:12Z DEBUG Protocol: TLS1.2 2021-06-01T17:27:12Z DEBUG Cipher: TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 2021-06-01T17:27:12Z DEBUG received Set-Cookie 'ipa_session=MagBearerToken=yKnSiJdb44vhq6AuqB%2boAE5Fatp7CXJ8A9xYVUqlqXI73Gk9ukPfIr9%2bD6KnSCiBXmtVx3flwJ1Rf17528nymjCE5vMtNTSeVU5l8rn36fEtAFq6QZt%2bAHs2LjPLWwyR9geT7Y5aKgLbEMDzZv0DTwM3N2ocM0b7Rc6inZUvAgU%2fYmqmkZafsbYy%2fCUm2Kgyx%2b%2fZ6kQg%2fK94CVAqMLxZDE1k1gAP3qq98k%2fllMQu9k0GAYcdKEbmN%2bwff4LzeQRs;path=/ipa;httponly;secure;' 2021-06-01T17:27:12Z DEBUG storing cookie 'ipa_session=MagBearerToken=yKnSiJdb44vhq6AuqB%2boAE5Fatp7CXJ8A9xYVUqlqXI73Gk9ukPfIr9%2bD6KnSCiBXmtVx3flwJ1Rf17528nymjCE5vMtNTSeVU5l8rn36fEtAFq6QZt%2bAHs2LjPLWwyR9geT7Y5aKgLbEMDzZv0DTwM3N2ocM0b7Rc6inZUvAgU%2fYmqmkZafsbYy%2fCUm2Kgyx%2b%2fZ6kQg%2fK94CVAqMLxZDE1k1gAP3qq98k%2fllMQu9k0GAYcdKEbmN%2bwff4LzeQRs; Domain=prdipaco8ldm01.XYZ.com; Path=/ipa; Secure; HttpOnly' for principal host/drxlceco6app01.XYZ.com(a)XYZ.COM 2021-06-01T17:27:12Z DEBUG args=keyctl search @s user ipa_session_cookie:host/drxlceco6app01.XYZ.com@XYZ.COM 2021-06-01T17:27:12Z DEBUG stdout=915601519 2021-06-01T17:27:12Z DEBUG stderr= 2021-06-01T17:27:12Z DEBUG args=keyctl search @s user ipa_session_cookie:host/drxlceco6app01.XYZ.com@XYZ.COM 2021-06-01T17:27:12Z DEBUG stdout=915601519 2021-06-01T17:27:12Z DEBUG stderr= 2021-06-01T17:27:12Z DEBUG args=keyctl pupdate 915601519 2021-06-01T17:27:12Z DEBUG stdout= 2021-06-01T17:27:12Z DEBUG stderr= 2021-06-01T17:27:12Z DEBUG Caught fault 4202 from server https://prdipaco8ldm01.XYZ.com/ipa/xml: no modifications to be performed 2021-06-01T17:27:12Z DEBUG Writing nsupdate commands to /etc/ipa/.dns_update.txt: 2021-06-01T17:27:12Z DEBUG zone XYZ.com. update delete drxlceco6app01.XYZ.com. IN SSHFP send update add drxlceco6app01.XYZ.com. 1200 IN SSHFP 1 1 F6ABCFF542C5E35268387C2A53EBF83C5C6B0517 send 2021-06-01T17:27:12Z DEBUG args=/usr/bin/nsupdate -g /etc/ipa/.dns_update.txt 2021-06-01T17:27:12Z DEBUG stdout= 2021-06-01T17:27:12Z DEBUG stderr=tkey query failed: GSSAPI error: Major = Unspecified GSS failure. Minor code may provide more information, Minor = Server DNS/udns1.ultradns.net(a)XYZ.COM not found in Kerberos database. 2021-06-01T17:27:12Z DEBUG nsupdate failed: Command '/usr/bin/nsupdate -g /etc/ipa/.dns_update.txt' returned non-zero exit status 1 2021-06-01T17:27:12Z WARNING Could not update DNS SSHFP records. 2021-06-01T17:27:12Z DEBUG args=/sbin/service nscd status 2021-06-01T17:27:12Z DEBUG stdout=nscd is stopped 2021-06-01T17:27:12Z DEBUG stderr= 2021-06-01T17:27:12Z DEBUG args=/sbin/service nscd stop 2021-06-01T17:27:12Z DEBUG stdout= 2021-06-01T17:27:12Z DEBUG stderr= 2021-06-01T17:27:12Z DEBUG args=/sbin/chkconfig nscd off 2021-06-01T17:27:12Z DEBUG stdout= 2021-06-01T17:27:12Z DEBUG stderr= 2021-06-01T17:27:12Z DEBUG Saving StateFile to '/var/lib/ipa-client/sysrestore/sysrestore.state' 2021-06-01T17:27:12Z DEBUG Saving StateFile to '/var/lib/ipa-client/sysrestore/sysrestore.state' 2021-06-01T17:27:12Z DEBUG Saving StateFile to '/var/lib/ipa-client/sysrestore/sysrestore.state' 2021-06-01T17:27:15Z DEBUG args=/usr/sbin/authconfig --enablesssdauth --enablemkhomedir --update --enablesssd 2021-06-01T17:27:15Z DEBUG stdout=Starting sssd: ?[60G[?[0;32m OK ?[0;39m] Starting oddjobd: ?[60G[?[0;32m OK ?[0;39m] 2021-06-01T17:27:15Z DEBUG stderr= 2021-06-01T17:27:15Z INFO SSSD enabled 2021-06-01T17:27:15Z INFO Configuring XYZ.com as NIS domain 2021-06-01T17:27:15Z DEBUG args=/bin/nisdomainname 2021-06-01T17:27:15Z DEBUG stdout=(none) 2021-06-01T17:27:15Z DEBUG stderr= 2021-06-01T17:27:15Z DEBUG Saving StateFile to '/var/lib/ipa-client/sysrestore/sysrestore.state' 2021-06-01T17:27:15Z DEBUG args=/usr/sbin/authconfig --update --nisdomain XYZ.com 2021-06-01T17:27:15Z DEBUG stdout=Starting sssd: ?[60G[?[0;32m OK ?[0;39m] 2021-06-01T17:27:15Z DEBUG stderr= 2021-06-01T17:27:15Z DEBUG args=/bin/nisdomainname XYZ.com 2021-06-01T17:27:15Z DEBUG stdout= 2021-06-01T17:27:15Z DEBUG stderr= ======================================== I am unable to understand what i am missing or changes required in current config. Any help / suggestions appreciated. Regards, Rohan

2 1

Invalid CA chain after ca chain renewal
by Philipp Leusmann 10 Jun '21

10 Jun '21

Hi, I have just renewed freeipas externally signed CA certificate using 'ipa-cacert-manage renew --external-ca' Given the new CSR contains the same key elements as the previous one, I already had to ignore the duplicate while signing. Maybe that's the cause for the issues following? After renewing I now have the new and the old CA key in /etc/ipa/ca.crt and also in exported certificate chains which for example nginx cannot handle properly. 1) Did I do anything wrong during renewal? 2) how can I remove the previous CA cert? Thanks in advance, Philipp

2 2

Announcing SSSD 2.5.1
by Pavel Březina 08 Jun '21

08 Jun '21

# SSSD 2.5.01 The SSSD team is proud to announce the release of version 2.5.1 of the System Security Services Daemon. The tarball can be downloaded from: https://github.com/SSSD/sssd/releases/tag/2.5.1 See the full release notes at: https://sssd.io/release-notes/sssd-2.5.1.html RPM packages will be made available for Fedora shortly. ## Feedback Please provide comments, bugs and other feedback via the sssd-devel or sssd-users mailing lists: https://lists.fedorahosted.org/mailman/listinfo/sssd-devel https://lists.fedorahosted.org/mailman/listinfo/sssd-users ## Highlights ### New features * `auto_private_groups` option can be set centrally through ID range setting in IPA (see `ipa idrange` commands family). This feature requires SSSD update on both client and server. This feature also requires `freeipa 4.9.4` and newer. ### Important fixes * Fix `getsidbyname` issues with IPA users with a user-private-group ### Configuration changes * Default value of `ldap_sudo_random_offset` changed to `0` (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration.

1 0

various errors and warnings on F34: Can't contact LDAP server, Component identity is NULL; Failed to unwrap key for cipher
by Robert Kudyba 07 Jun '21

07 Jun '21

After upgrading to Fedora 34 and freeipa-server-4.9.3-2.fc34.x86_64, we're seeing the below errors. I found a previous post that mentions a user had these during a migration but we finished the migration a while ago: https://lists.fedoraproject.org/archives/list/freeipa-users@lists.fedorahos… ipactl status Directory Service: RUNNING krb5kdc Service: RUNNING kadmin Service: RUNNING named Service: RUNNING httpd Service: RUNNING ipa-custodia Service: RUNNING pki-tomcatd Service: RUNNING ipa-otpd Service: RUNNING ipa-dnskeysyncd Service: RUNNING ipa: INFO: The ipactl command was successful ipa cert-find shows 10 certs and all have a status of VALID. Apache logs do not have any errors. And the ipaupgrade.log ends with INFO The ipa-server-upgrade command was successful Jun 3 18:14:03 ourschoolipa-dnskeysyncd[5025]: ipa-dnskeysyncd: ERROR syncrepl_poll: LDAP error ({'result': -1, 'desc': "Can't contact LDAP server", 'ctrls': []}) Jun 3 18:14:06 ourschoolns-slapd[17715]: [03/Jun/2021:18:14:06.994125936 -0400] - ERR - allow_operation - Component identity is NULL Jun 3 18:14:10 ourschoolns-slapd[17715]: [03/Jun/2021:18:14:10.899216572 -0400] - ERR - attrcrypt_unwrap_key - Failed to unwrap key for cipher AES Jun 3 18:14:10 ourschoolns-slapd[17715]: [03/Jun/2021:18:14:10.955942900 -0400] - ERR - attrcrypt_cipher_init - Symmetric key failed to unwrap with the private key; Cert might have been renewed since the key is wrapped. To recover the encrypted contents, keep the wrapped symmetric key value. Jun 3 18:14:11 ourschoolns-slapd[17715]: [03/Jun/2021:18:14:11.022213263 -0400] - ERR - attrcrypt_init - All prepared ciphers are not available. Please disable attribute encryption. Jun 3 18:14:11 ourschoolns-slapd[17715]: [03/Jun/2021:18:14:11.090020323 -0400] - ERR - attrcrypt_unwrap_key - Failed to unwrap key for cipher 3DES Jun 3 18:14:11 ourschoolns-slapd[17715]: [03/Jun/2021:18:14:11.177952423 -0400] - ERR - schema-compat-plugin - scheduled schema-compat-plugin tree scan in about 5 seconds after the server startup! Jun 3 18:14:11 ourschoolns-slapd[17715]: [03/Jun/2021:18:14:11.875367301 -0400] - ERR - cos-plugin - cos_dn_defs_cb - Skipping CoS Definition cn=Password Policy,cn=accounts,dc=sub,dc=domain,dc=ourschool,dc=edu--no CoS Templates found, which should be added before the CoS Definition. Jun 3 18:14:11 ourschoolns-slapd[17715]: [03/Jun/2021:18:14:11.961081967 -0400] - ERR - schema-compat-plugin - schema-compat-plugin tree scan will start in about 5 seconds! Jun 3 18:14:17 ourschoolns-slapd[17715]: [03/Jun/2021:18:14:17.740194095 -0400] - ERR - schema-compat-plugin - warning: no entries set up under ou=sudoers,dc=sub,dc=domain,dc=ourschool,dc=edu Jun 3 18:14:17 ourschoolns-slapd[17715]: [03/Jun/2021:18:14:17.818774136 -0400] - ERR - schema-compat-plugin - warning: no entries set up under cn=ng, cn=compat,dc=sub,dc=domain,dc=ourschool,dc=edu Jun 3 18:14:18 ourschoolns-slapd[17715]: [03/Jun/2021:18:14:18.804889621 -0400] - ERR - schema-compat-plugin - warning: no entries set up under cn=computers, cn=compat,dc=sub,dc=domain,dc=ourschool,dc=edu Jun 3 18:14:18 ourschoolns-slapd[17715]: [03/Jun/2021:18:14:18.873391357 -0400] - ERR - schema-compat-plugin - Finished plugin initialization. Jun 3 18:14:11 ourschoolns-slapd[17715]: [03/Jun/2021:18:14:11.577526585 -0400] - WARN - NSACLPlugin - acl_parse - The ACL target cn=ad,cn=etc,dc=sub,dc=domain,dc=ourschool,dc=edu does not exist Jun 3 18:14:11 ourschoolns-slapd[17715]: [03/Jun/2021:18:14:11.599342179 -0400] - WARN - NSACLPlugin - acl_parse - The ACL target cn=casigningcert cert-pki-ca,cn=ca_renewal,cn=ipa,cn=etc,dc=sub,dc=domain,dc=ourschool,dc=edu does not exist

2 1

Improper format of Kerberos configuration - error from client setup
by lejeczek 07 Jun '21

07 Jun '21

Hi guys. I'm trying client install and I fail: ... Time synchronization was successful. Please make sure the following ports are opened in the firewall settings: TCP: 80, 88, 389 UDP: 88 (at least one of TCP/UDP ports 88 has to be open) Also note that following ports are necessary for ipa-client working properly after enrollment: TCP: 464 UDP: 464, 123 (if NTP enabled) Installation failed. Rolling back changes. Disabling client Kerberos and LDAP configurations nscd daemon is not installed, skip configuration nslcd daemon is not installed, skip configuration Client uninstall complete. Kerberos authentication failed: kinit: Improper format of Kerberos configuration file while initializing Kerberos 5 library This is the client's problem right? Reason I'm bit doubtful is such that all the usual places I made sure are plain-vanilla. What do I miss? many thanks, L.

2 1

How to blend IPA server 4.1.4 on F21 with server 4.6.8 on C7?
by Bret Wortman 04 Jun '21

04 Jun '21

I'm trying to update our IPA servers to newer OSes and IPA versions. What I've done so far: 1. run "ipa-replica-prepare" on the original main server, ipa1. 2. Copied the resulting file to ipa1c7. 3. Tried to import that file via "ipa-replica-install replica-info-ipa2c7.our.net.gpg --skip-conncheck --setup-dns --auto-forwarders". This typically fails: =========== [root@ipa2c7 ~]# ipa-replica-install replica-info-ipa2c7.our.net.gpg --skip-conncheck --setup-dns --auto-forwarders Directory Manager (existing master) password: ipaserver.install.server.replicainstall: ERROR Could not resolve hostname ipa1.our.net using DNS. Clients may not function properly. Please check your DNS setup. (Note that this check queries IPA DNS directly and ignores /etc/hosts.) Continue? [no]: yes Checking DNS forwarders, please wait ... Configuring NTP daemon (ntpd) [1/4]: stopping ntpd [2/4]: writing configuration [3/4]: configuring ntpd to start on boot [4/4]: starting ntpd Done configuring NTP daemon (ntpd). Configuring directory server (dirsrv). Estimated time: 30 seconds [1/42]: creating directory server instance [2/42]: enabling ldapi [3/42]: configure autobind for root [4/42]: stopping directory server [5/42]: updating configuration in dse.ldif [6/42]: starting directory server [7/42]: adding default schema [8/42]: enabling memberof plugin [9/42]: enabling winsync plugin [10/42]: configure password logging [11/42]: configuring replication version plugin [12/42]: enabling IPA enrollment plugin [13/42]: configuring uniqueness plugin [14/42]: configuring uuid plugin [15/42]: configuring modrdn plugin [16/42]: configuring DNS plugin [17/42]: enabling entryUSN plugin [18/42]: configuring lockout plugin [19/42]: configuring topology plugin [20/42]: creating indices [21/42]: enabling referential integrity plugin [22/42]: configuring certmap.conf [23/42]: configure new location for managed entries [24/42]: configure dirsrv ccache [25/42]: enabling SASL mapping fallback [26/42]: restarting directory server [27/42]: creating DS keytab [28/42]: ignore time skew for initial replication [29/42]: setting up initial replication Starting replication, please wait until this has completed. Update in progress, 3 seconds elapsed Update succeeded [30/42]: prevent time skew after initial replication [31/42]: adding sasl mappings to the directory [32/42]: updating schema [33/42]: setting Auto Member configuration [34/42]: enabling S4U2Proxy delegation [35/42]: initializing group membership [36/42]: adding master entry ipaserver.install.service: CRITICAL Failed to load master-entry.ldif: Command '/usr/bin/ldapmodify -v -f /tmp/tmp2nlWU3 -H ldapi://%2fvar%2frun%2fslapd-OUR-NET.socket -Y EXTERNAL' returned non-zero exit status 68 [error] CalledProcessError: Command '/usr/bin/ldapmodify -v -f /tmp/tmp2nlWU3 -H ldapi://%2fvar%2frun%2fslapd-OUR-NET.socket -Y EXTERNAL' returned non-zero exit status 68 Your system may be partly configured. Run /usr/sbin/ipa-server-install --uninstall to clean up. ipapython.admintool: ERROR Command '/usr/bin/ldapmodify -v -f /tmp/tmp2nlWU3 -H ldapi://%2fvar%2frun%2fslapd-OUR-NET.socket -Y EXTERNAL' returned non-zero exit status 68 ipapython.admintool: ERROR The ipa-replica-install command failed. See /var/log/ipareplica-install.log for more information [root@ipa2c7 ~]# host ipa1.our.net ipa1.our.net has address 192.168.2.61 =========== So I'm not sure why the DNS query is failing but it appears to be intermittent at best. Also, after near-misses when the ldap error occurs, I often get informed that we have an existing replication agreement that needs to be removed. When I follow the indicated steps: =========== [root@ipa1 ~]# ipa-replica-manage del ipa2c7.our.net --force Directory Manager password: Connection to 'ipa2c7.our.net' failed: Forcing removal of ipa2c7.our.net Skipping calculation to determine if one or more masters would be orphaned. Deleting replication agreements between ipa2c7.our.net and ipa1.our.net, ipa2.our.net, ipa3.our.net Failed to get list of agreements from 'ipa2c7.our.net': Forcing removal on 'ipa1.our.net' Any DNA range on 'ipa2c7.our.net' will be lost Deleted replication agreement from 'ipa1.our.net' to 'ipa2c7.our.net' 'ipa2.our.net' has no replication agreement for 'ipa2c7.our.net' Unable to remove replication agreement for ipa2c7.our.net from ipa2.our.net. Failed to determine agreement type for 'ipa3.our.net': Unable to remove replication agreement for ipa2c7.our.net from ipa3.our.net. Background task created to clean replication data. This may take a while. This may be safely interrupted with Ctrl+C ^C Wait for task interrupted. It will continue to run in the background Failed to cleanup ipa2c7.our.net entries: Not allowed on non-leaf entry You may need to manually remove them from the tree Failed to cleanup ipa2c7.our.net DNS entries: no matching entry found You may need to manually remove them from the tree [root@ipa1 ~]# =========== Is there something obvious that I've missed? -- Bret Wortman bret.wortman(a)damascusgrp.com

2 5

python3-ipaserver installutils.py missing IPA_MODULES list
by iulian roman 04 Jun '21

04 Jun '21

Hello everybody, I do not know if this is the right place to mentioned, but maybe there will be someone who can redirect me to the right list or support channel. On RHEL 8.3 , the latest python3-ipaserver package (python3-ipaserver-4.9.2-3.module+el8.4.0+10412+5ecb5b37) does not contain the IPA_MODULES list in the installutils.py package. Due to that, the ansible freeipa role will fail. Can you please suggest whom I should contact for that or where should it be reported ?

2 3

named won't start
by Bret Wortman 03 Jun '21

03 Jun '21

It's an ancient server, and one I'm trying to get us off of, but it's our current primary IPA server on this network and named didn't like its last reboot and is erroring on startup: [root@ipa1 ~]# systemctl status -l named-pkcs11.service ● named-pkcs11.service - Berkeley Internet Name Domain (DNS) with native PKCS#11 Loaded: loaded (/usr/lib/systemd/system/named-pkcs11.service; disabled) Active: failed (Result: exit-code) since Thu 2021-06-03 12:47:25 EDT; 13min ago Process: 1055 ExecStart=/usr/sbin/named-pkcs11 -u named $OPTIONS (code=exited, status=1/FAILURE) Process: 1053 ExecStartPre=/usr/sbin/named-checkconf -z /etc/named.conf (code=exited, status=0/SUCCESS) Jun 03 12:47:25 ipa1.our.net named-pkcs11[1057]: bind-dyndb-ldap version 6.1 compiled at 17:24:34 Dec 2 2014, compiler 4.9.2 20141101 (Red Hat 4.9.2-1) Jun 03 12:47:25 ipa1.our.net named-pkcs11[1057]: option 'serial_autoincrement' is not supported, ignoring Jun 03 12:47:25 ipa1.our.net named-pkcs11[1057]: GSSAPI client step 1 Jun 03 12:47:25 ipa1.our.net named-pkcs11[1057]: GSSAPI client step 1 Jun 03 12:47:25 ipa1.our.net named-pkcs11[1057]: LDAP error: Invalid credentials: SASL(-13): authentication failure: GSSAPI Failure: gss_accept_sec_context: bind to LDAP server failed Jun 03 12:47:25 ipa1.our.net named-pkcs11[1057]: couldn't establish connection in LDAP connection pool: permission denied Jun 03 12:47:25 ipa1.our.net systemd[1]: named-pkcs11.service: control process exited, code=exited status=1 Jun 03 12:47:25 ipa1.our.net systemd[1]: Failed to start Berkeley Internet Name Domain (DNS) with native PKCS#11. Jun 03 12:47:25 ipa1.our.net systemd[1]: Unit named-pkcs11.service entered failed state. Jun 03 12:47:25 ipa1.our.net systemd[1]: named-pkcs11.service failed. One of its replicas is still up and running so I'm not in emergency crisis mode yet. This server is running Fedora 21 and ipa-server 4.1.4-1. We got here as I was trying to take this server and replicate it to a C7 box running a more recent ipa-server (4.6.8-5) but couldn't get the replication to work. Along the way, I rebooted the F21 server and it came back in this state. What should I try next to get it back? -- Bret Wortman bret.wortman(a)damascusgrp.com

1 1

Automember Hostgroup Rule not applying to new hosts
by Russ Long 03 Jun '21

03 Jun '21

Hello, I have an automember rule for a hostgroup where it uses the nshostlocation of the host to then add the host to the group. When adding new hosts, which are installed via ipa-client-install, and then have the nshostlocation added via ipa host-mod, all in an automated process, the new hosts are not being added to the group. If I run an automembership rebuild, the hosts are then added. As these hosts spin up and down frequently, having to manually trigger this is less than ideal. Is there a better way to handle this? I'm not dead set on using the nshostlocation for the automember rule, but it seemed the easiest and most appropriate for my situation. Thanks, Russ

2 3

Solve freeipa 'fragility' via orchestrated containers & whole-container upgrade?
by Harry G. Coin 03 Jun '21

03 Jun '21

Long time freeipa users have faced a certain 'fragility' freeipa has inherited, mostly as a result of freeipa being the 'band director' over a number of distinct subsystems maintained by various groups across the world. This or that 'little upgrade' in a seemingly small sub-part of freeipa 'suddenly breaks' major things like not being able to install a replica & etc, there's a quite a list and it's been going on for a few years at least to my knowledge. Usually one expects newer features to have bugs but none that disrupt core prior functionality. I wonder whether it would be a solution to this if free-ipa took a look at how a 'similar feeling' multi-host, multi-subsystem architecture has appeared to have solved this puzzle: ceph's 'containers' and 'orchestrator' / cephadm / 'ceph orch' concept. For some time, as freeipa, ceph relied on packages and 'dependency hell management' to operate as native packages across hosts connected on an internal network. Then in a very effective shift: they treated 'the contents of a container' much as 'one thing owned entirely by and released by ceph' and tested that -- each container housing known-good versions of dependent and third party modules as well as their own code -- 'as one thing', to the point of providing their own tool to 'download and manage upgrade installs in the proper sequence' across hosts providing this-or-that functionality. You might imagine a freeipa orchestrator upgrading masters and replicas in the correct order, freeipa devs knowing for certain-sure that no 'dnf upgrade' on the host will disrupt the setup that passed qa in the container... Will not 'corrupt a database' owing to a 'sync' with content one version understood but another did not, etc. Over these many months, while freeipa has struggled to provide consistent service and value, ceph has been working nearly flawlessly across many upgrade cycles and I think it's because ceph controls the versions of the subsystems in the containers-- and that improves QA and dramatically limits surprise breakages' that lead to the feeling of 'always catching up' under conditions of time pressure owing to down services, this or that distro's 100 package mantainers deciding when/if to include this/that patch and when to publish which new version, which are 'security updates', which are 'bug fix updates', etc. If freeipa server came in a container that was tested and QA'd as a container, deployed as a container, perhaps the 'fragility factor' would improve by 10x. My $0.02

3 4

ipa-replica-install failing - operations error: the changelog directory already exists and is not empty
by Sinh Lam 03 Jun '21

03 Jun '21

Hi Everyone - I’m running into this odd issue I can’t seem to find a resolution to. Long story short, my IPA master was on a system that had a power failure. Upon bring up, the dirsrv failed to start up due to a zero byte dse.ldif file. Used a “backup” of the file and my master seemed to have came back up ok however replication seems to have stopped working. When I noticed that replication wasn’t working from the replicas to the master I went digging and found this (which led me to try to recover by removing the old replicas and trying to do a reinstall) : replica.domain.net: replica last update status: Error (6) Replication error acquiring replica: Unable to acquire replica: there is no replicated area on the consumer server. Replication is aborting. (no such replica) last update ended: 2021-05-20 15:29:28+00:00 The above “last update” corresponds with the power outage that took down the IPA master. I’m trying to re-initialize the replication by doing a reinstall of the replica server but I’m failing with the following error : Disabled p11-kit-proxy Configuring directory server (dirsrv). Estimated time: 30 seconds [1/42]: creating directory server instance [2/42]: configure autobind for root [3/42]: tune ldbm plugin [4/42]: stopping directory server [5/42]: updating configuration in dse.ldif [6/42]: starting directory server [7/42]: adding default schema [8/42]: enabling memberof plugin [9/42]: enabling winsync plugin [10/42]: configure password logging [11/42]: configuring replication version plugin [12/42]: enabling IPA enrollment plugin [13/42]: configuring uniqueness plugin [14/42]: configuring uuid plugin [15/42]: configuring modrdn plugin [16/42]: configuring DNS plugin [17/42]: enabling entryUSN plugin [18/42]: configuring lockout plugin [19/42]: configuring topology plugin [20/42]: creating indices [21/42]: enabling referential integrity plugin [22/42]: configuring certmap.conf [23/42]: configure new location for managed entries [24/42]: configure dirsrv ccache and keytab [25/42]: enabling SASL mapping fallback [26/42]: restarting directory server [27/42]: creating DS keytab [28/42]: ignore time skew for initial replication [29/42]: setting up initial replication [error] DatabaseError: Operations error: The changelog directory [/var/lib/dirsrv/slapd-REPLICA-DOMAIN-NET/cldb] already exists and is not empty. Please choose a directory that does not exist or is empty. Your system may be partly configured. Run /usr/sbin/ipa-server-install --uninstall to clean up. Operations error: The changelog directory [/var/lib/dirsrv/slapd-REPLICA-DOMAIN-NET/cldb] already exists and is not empty. Please choose a directory that does not exist or is empty. The ipa-replica-install command failed. See /var/log/ipareplica-install.log for more information I’ve since done several uninstalls and verified at each uninstall the /var/lib/dirsrv directory is empty. Any pointers on how to get past this issue would be great since I have about 10 more replicas to get back up. Thanks. Sinh

3 5

groups imported incorrectly (made compat tree look out of sync memberUid)
by Scott Serr 03 Jun '21

03 Jun '21

A few months ago, using IPA 4.8.7, I imported users and groups from OpenLDAP: ipa -v migrate-ds --with-compat \ --bind-dn="cn=Manager,dc=example,dc=com" \ --user-container="ou=People,dc=example,dc=com" \ --user-objectclass="posixAccount" \ --group-container="ou=Group,dc=example,dc=com" \ --group-objectclass="posixGroup" \ --group-overwrite-gid \ --schema=RFC2307 \ ldap://openldap-server:389 Now, I've found a problem... In addition to the expected "member" attribute list on the group dn, I also have a memberUid attribute list. These memberUid attributes are not created when using IPA to assign users to groups, just during my import. An imported user: dn: cn=wahoo,cn=groups,cn=accounts,dc=example,dc=com member: uid=fred,cn=users,cn=accounts,dc=example,dc=com memberUid: fred dn: cn=wahoo,cn=groups,cn=compat,dc=example,dc=com memberUid: fred So, no harm done yet. Then I remove fred from the group wahoo. And I end up with this: dn: cn=wahoo,cn=groups,cn=accounts,dc=example,dc=com memberUid: fred dn: cn=wahoo,cn=groups,cn=compat,dc=example,dc=com memberUid: fred Now, anything pointing to my compat tree, still thinks fred is in the wahoo group. The solution is removing the memberUids from the cn=groups,cn=accounts,dc=example,dc=com tree, and the compat tree automatically reflects that change. Question: Is this a bug or did I do something wrong on the import? Thanks, Scott PS- If someone else runs into this, I hope I saved you time.

2 1

Re: IPA Reinstall
by Robert.Mattson＠L3Harris.com 02 Jun '21

02 Jun '21

Hi Florence, Thank you for taking the time to respond. We have a number of replicas in various campus locations around our region, and our state and country is currently locked-down with COVID restrictions, and it would take days to get to the replicas even without restrictions. We have had wide-scale WAN outages over weeks for this system. To describe our problem in a simplified manner; We had the IPA replicas ‘Location1R1’ and ‘Location2R1’ talking happily when the WAN between them went away, while it was down we added ‘Location2R2’ to ‘Location2R1’, and manually added some user-ranges for accounts at Location2. We also added a number of ipa-clients at Location2. When the WAN came back, ‘Location1R1’ and ‘Location2R1’ stopped sharing data because the CSN updates were dropped weeks ago. We re-initialized ‘Location2R1’ from ‘Location1R1’, however that has resulted in isolation of ‘Location2R2’. Most logins at Location2 fail, depending on where the DNS round-robin points SSSD at the time of login. We have multiple locations, each with a flavor of this issue. No replica has a complete picture of all replication agreements, host accounts and user accounts. Though we have had some success with continually re-initializing replicas. It was my hope, once the WAN was stabilized to remove and re ipa-server-install at our first server, then remove and re-run ipa-client-install then ipa-replica-install at each secondary server. I believe this would re-constitute the system, effectively by re-installation of that specific service. And yes, this would all be done via SSH. However, we meet the obstacles described in my initial email when performing the install a second time. Sincerely, and with many thanks in advance, Rob From: Florence Renaud via FreeIPA-users <freeipa-users(a)lists.fedorahosted.org> Sent: Wednesday, 2 June 2021 2:16 AM To: FreeIPA users list <freeipa-users(a)lists.fedorahosted.org> Cc: Mattson, Robert (FP) <Robert.Mattson(a)L3Harris.com>; Florence Renaud <flo(a)redhat.com> Subject: [EXTERNAL] [Freeipa-users] Re: IPA Reinstall Hi, the recommended way to uninstall a replica and reinstall it is described in the doc: 1. Uninstall the replica (https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/ht…) with ipa server-del and ipa-server-install --uninstall 2. re-install the replica as if it was a new one: https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/ht… Was there any reason to backup files and restore them? The replica installation should re-create everything. flo On Wed, May 26, 2021 at 7:32 AM Robert.Mattson--- via FreeIPA-users <freeipa-users(a)lists.fedorahosted.org<mailto:freeipa-users@lists.fedorahosted.org>> wrote: Dear Community, I'd like to uninstall and reinstall IPA from a CentOS box because its easier than reinstalling the OS completely. We have a number of replicas, and this host is installed using ipa-client-install and then ipa-replica-install. To remove it, I backup some data like /var/kerberos/krb5kdc/{cacert.pem,kd*} and /etc/httpd/conf/password.conf and then run '/usr/sbin/ipa-server-install --uninstall -U --ignore-topology-disconnect'. I then sed '/Environment=K/d', '/ExecStartPre/d', '/ExecStopPost/d' /etc/systemd/system/httpd.service I recreate the host-account on another replica using ipa host-add, then ipa hostgroup-add-member. On the now-removed host, I do some housekeeping like restoring the backed up files and then I run; /usr/sbin/ipa-client-install \ --password=${otp} \ --mkhomedir \ --no-ntp \ --unattended \ --domain=realm.name<http://realm.name> \ --realm=REALM.NAME<http://REALM.NAME> \ --ca-cert-file=/etc/pki/ca-trust/source/ca.crt then /usr/sbin/ipa-replica-install \ --dirsrv-cert-file=/etc/pki/tls/private/ipa.pkcs12 \ --http-cert-file=/etc/pki/tls/private/ipa.pkcs12 \ --dirsrv-pin=pwd \ --http-pin=pwd \ --unattended \ --no-pkinit \ --no-ntp I seem to get the following keytab request problem followed by dirsrv failure. from ipa-replica-install (4.6.4-10.el7.centos.3.x86_64). If I upgrade to 4.6.8-5.el7.centos.4.noarch.rpm, I get the same problem.[1] On serverb, the host which receives the binding request for the reinstall, I get permission denied the bind dn “” does not have permission in dirsrv error log…? Does anyone have any thoughts, Cheers and many thanks in advance, Rob [1] 2021-05-26T02:50:56Z DEBUG Backing up system configuration file '/etc/httpd/conf.d/ipa.conf' 2021-05-26T02:50:56Z DEBUG -> Not backing up - '/etc/httpd/conf.d/ipa.conf' doesn't exist 2021-05-26T02:50:56Z DEBUG Backing up system configuration file '/etc/httpd/conf.d/ipa-rewrite.conf' 2021-05-26T02:50:56Z DEBUG -> Not backing up - '/etc/httpd/conf.d/ipa-rewrite.conf' doesn't exist 2021-05-26T02:50:56Z DEBUG duration: 0 seconds 2021-05-26T02:50:56Z DEBUG [10/21]: setting up httpd keytab 2021-05-26T02:50:56Z DEBUG raw: service_add(u'HTTP/servera.system(a)REALM.NAME<mailto:servera.system@REALM.NAME>', force=True, version=u'2.230') 2021-05-26T02:50:56Z DEBUG service_add(ipapython.kerberos.Principal('HTTP/servera.system(a)REALM.NAME<mailto:servera.system@REALM.NAME>'), force=True, all=False, raw=False, version=u'2.230', no_members=False) 2021-05-26T02:50:56Z DEBUG flushing ldapi://%2Fvar%2Frun%2Fslapd-REALM-NAME.socket from SchemaCache 2021-05-26T02:50:56Z DEBUG retrieving schema for SchemaCache url=ldapi://%2Fvar%2Frun%2Fslapd-REALM-NAME.socket conn=<ldap.ldapobject.SimpleLDAPObject instance at 0x7f0d29f50368> 2021-05-26T02:50:57Z DEBUG raw: host_show(u'servera.system', version=u'2.230') 2021-05-26T02:50:57Z DEBUG host_show(u'servera.system', rights=False, all=False, raw=False, version=u'2.230', no_members=False) 2021-05-26T02:50:57Z DEBUG Backing up system configuration file '/var/lib/ipa/gssproxy/http.keytab' 2021-05-26T02:50:57Z DEBUG -> Not backing up - '/var/lib/ipa/gssproxy/http.keytab' doesn't exist 2021-05-26T02:50:57Z DEBUG Starting external process 2021-05-26T02:50:57Z DEBUG args=/usr/sbin/ipa-getkeytab -k /var/lib/ipa/gssproxy/http.keytab -p HTTP/servera.system(a)REALM.NAME<mailto:HTTP/servera.system@REALM.NAME> -H ldapi://%2Fvar%2Frun%2Fslapd-REALM-NAME.socket -Y EXTERNAL 2021-05-26T02:50:57Z DEBUG Process finished, return code=9 2021-05-26T02:50:57Z DEBUG stdout= 2021-05-26T02:50:57Z DEBUG stderr=Failed to parse result: unsupported extended operation Retrying with pre-4.0 keytab retrieval method... Failed to parse result: unsupported extended operation Failed to get keytab! Failed to get keytab 2021-05-26T02:50:57Z DEBUG Traceback (most recent call last): File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 570, in start_creation run_step(full_msg, method) File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 560, in run_step method() File "/usr/lib/python2.7/site-packages/ipaserver/install/httpinstance.py", line 637, in request_service_keytab super(HTTPInstance, self).request_service_keytab() File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 742, in request_service_keytab self.run_getkeytab(self.api.env.ldap_uri, self.keytab, self.principal) File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 732, in run_getkeytab ipautil.run(args, nolog=nolog) File "/usr/lib/python2.7/site-packages/ipapython/ipautil.py", line 562, in run raise CalledProcessError(p.returncode, arg_string, str(output)) CalledProcessError: Command '/usr/sbin/ipa-getkeytab -k /var/lib/ipa/gssproxy/http.keytab -p HTTP/servera.system(a)REALM.NAME<mailto:HTTP/servera.system@REALM.NAME> -H ldapi://%2Fvar%2Frun%2Fslapd-REALM-NAME.socket -Y EXTERNAL' returned non-zero exit status 9 2021-05-26T02:50:57Z DEBUG [error] CalledProcessError: Command '/usr/sbin/ipa-getkeytab -k /var/lib/ipa/gssproxy/http.keytab -p HTTP/servera.system(a)REALM.NAME<mailto:HTTP/servera.system@REALM.NAME> -H ldapi://%2Fvar%2Frun%2Fslapd-REALM-NAME.socket -Y EXTERNAL' returned non-zero exit status 9 2021-05-26T02:50:57Z DEBUG File "/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 178, in execute return_value = self.run() File "/usr/lib/python2.7/site-packages/ipapython/install/cli.py", line 319, in run return cfgr.run() File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 364, in run return self.execute() exc_handler(exc_info) <snip /> File "/usr/lib/python2.7/site-packages/ipapython/install/common.py", line 65, in _install for unused in self._installer(self.parent): File "/usr/lib/python2.7/site-packages/ipaserver/install/server/__init__.py", line 622, in main replica_install(self) File "/usr/lib/python2.7/site-packages/ipaserver/install/server/replicainstall.py", line 406, in decorated func(installer) File "/usr/lib/python2.7/site-packages/ipaserver/install/server/replicainstall.py", line 1487, in install fstore=fstore) File "/usr/lib/python2.7/site-packages/ipaserver/install/server/replicainstall.py", line 173, in install_http subject_base=config.subject_base, master_fqdn=config.master_host_name) File "/usr/lib/python2.7/site-packages/ipaserver/install/httpinstance.py", line 188, in create_instance self.start_creation() File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 570, in start_creation run_step(full_msg, method) File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 560, in run_step method() File "/usr/lib/python2.7/site-packages/ipaserver/install/httpinstance.py", line 637, in request_service_keytab super(HTTPInstance, self).request_service_keytab() File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 742, in request_service_keytab self.run_getkeytab(self.api.env.ldap_uri, self.keytab, self.principal) File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 732, in run_getkeytab ipautil.run(args, nolog=nolog) File "/usr/lib/python2.7/site-packages/ipapython/ipautil.py", line 562, in run raise CalledProcessError(p.returncode, arg_string, str(output)) 2021-05-26T02:50:57Z DEBUG The ipa-replica-install command failed, exception: CalledProcessError: Command '/usr/sbin/ipa-getkeytab -k /var/lib/ipa/gssproxy/http.keytab -p HTTP/servera.system(a)REALM.NAME<mailto:HTTP/servera.system@REALM.NAME> -H ldapi://%2Fvar%2Frun%2Fslapd-REALM-NAME.socket -Y EXTERNAL' returned non-zero exit status 9 2021-05-26T02:50:57Z ERROR Command '/usr/sbin/ipa-getkeytab -k /var/lib/ipa/gssproxy/http.keytab -p HTTP/servera.system(a)REALM.NAME<mailto:HTTP/servera.system@REALM.NAME> -H ldapi://%2Fvar%2Frun%2Fslapd-REALM-NAME.socket -Y EXTERNAL' returned non-zero exit status 9 2021-05-26T02:50:57Z ERROR The ipa-replica-install command failed. See /var/log/ipareplica-install.log for more information [2] [26/May/2021:12:50:47.240285166 +1000] - WARN - NSMMReplicationPlugin - repl5_inc_run - agmt="cn=meToservera.system" (servera:389): The remote replica has a different database generation ID than the local database. You may have to reinitialize the remote replica, or the local replica. [26/May/2021:12:50:47.858057379 +1000] - INFO - NSMMReplicationPlugin - repl5_tot_run - Beginning total update of replica "agmt="cn=meToservera.system" (servera:389)". [26/May/2021:12:50:50.679652092 +1000] - INFO - NSMMReplicationPlugin - repl5_tot_run - Finished total update of replica "agmt="cn=meToservera.system" (servera:389)". Sent 582 entries. [26/May/2021:12:50:52.158394667 +1000] - ERR - NSMMReplicationPlugin - acquire_replica - agmt="cn=meToservera.system" (servera:389): Unable to acquire replica: permission denied. The bind dn "" does not have permission to supply replication updates to the replica. Will retry later. [26/May/2021:12:50:55.079367688 +1000] - ERR - NSMMReplicationPlugin - acquire_replica - agmt="cn=meToservera.system" (servera:389): Unable to acquire replica: permission denied. The bind dn "" does not have permission to supply replication updates to the replica. Will retry later. [26/May/2021:12:50:58.084381230 +1000] - ERR - NSMMReplicationPlugin - acquire_replica - agmt="cn=meToservera.system" (servera:389): Unable to acquire replica: permission denied. The bind dn "" does not have permission to supply replication updates to the replica. Will retry later. [26/May/2021:12:51:01.092727541 +1000] - ERR - NSMMReplicationPlugin - acquire_replica - agmt="cn=meToservera.system" (servera:389): Unable to acquire replica: permission denied. The bind dn "" does not have permission to supply replication updates to the replica. Will retry later. CONFIDENTIALITY NOTICE: This email and any attachments are for the sole use of the intended recipient and may contain material that is proprietary, confidential, privileged or otherwise legally protected or restricted under applicable government laws. Any review, disclosure, distributing or other use without expressed permission of the sender is strictly prohibited. If you are not the intended recipient, please contact the sender and delete all copies without reading, printing, or saving. _______________________________________________ FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org<mailto:freeipa-users@lists.fedorahosted.org> To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org<mailto:freeipa-users-leave@lists.fedorahosted.org> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost… Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure

1 0

custom tls certtificate for web UI
by iulian roman 02 Jun '21

02 Jun '21

Hello everybody, I tried to change the WEB UI certificate with a custom certificate signed by our internal CA. The custom certificate was provided as a bundle (certificate + intermediates). The root ca which signs the intermediate was added in the truststore with ipa-cacert-manage. Everything was successful but when I accessed the Web UI I noticed that IPA provides only the certificate, not the full chain, which makes the certificate not trusted by the browsers (they are configured to trust only our internal root ca). Is there any method to configure IPA/Idm to provide the full certificate chain (certificate + intermediate) to the http clients or is there anything I configured wrong ?

2 2

cleanup of removed masters
by Stijn De Weirdt 01 Jun '21

01 Jun '21

hi all, our ipa-healthcheck gives some seemingly odd output: > Internal server error HTTPSConnectionPool(host='oldm2.domain', port=443): Max retries exceeded with url: /ca/rest/certs/search?size=3 (Caused by NewConnectionError('<urllib3.connection.VerifiedHTTPSConnection object at 0x7f32581cb748>: Failed to establish a new connection: [Errno -2] Name or service not known',)) > [ > { > "source": "pki.server.healthcheck.clones.connectivity_and_data", > "check": "ClonesConnectivyAndDataCheck", > "result": "ERROR", > "uuid": "c7694559-157f-42da-9722-29ab4308d8bc", > "when": "20210601115956Z", > "duration": "0.424097", > "kw": { > "status": "ERROR: pki-tomcat : Internal error testing CA clone. Host: oldm2.domain Port: 443" > } > }, googling the error itself, i find references to this being a false positive; but looking closer (and also the initial server error) give an actual error: they reference an old master (it's obviously not called oldm2, so i had to read it a few times to see it was actually this old host). a while ago we migrated our centos7 setup (oldm1 and oldm2) to rhel82 (newm3 and newm4), by following the migration guide https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/ht… i'm quite sure we followed all steps, including the final uninstall on oldm1 and oldm2. however, after starting to run ipa-healthcheck recently and seeing this error, we looked for other traces of the old servers and started to clean them up. the old hosts are no longer around, so no chance to rerun things or check logs. so far we removed a bunch of DNS entries where the oldm1 was still used, but we now also have some other ones that reference oldm2: e.g. the pki related error above, but also oldm2 is still referenced in some entries in our dirserv dse.ldif (2 nsslapd-referral, 3 nsds50ruv and 3 nsruvReplicaLastModified). the traces are only of oldm2, not sign of oldm1 there. i'd appreciate some tips/guidance for removing the pki reference to oldm2 and things we can do to cleanup the dse.ldif many many thanks, stijn

1 1

IPA Reinstall
by Robert.Mattson＠L3Harris.com 01 Jun '21

01 Jun '21

Dear Community, I'd like to uninstall and reinstall IPA from a CentOS box because its easier than reinstalling the OS completely. We have a number of replicas, and this host is installed using ipa-client-install and then ipa-replica-install. To remove it, I backup some data like /var/kerberos/krb5kdc/{cacert.pem,kd*} and /etc/httpd/conf/password.conf and then run '/usr/sbin/ipa-server-install --uninstall -U --ignore-topology-disconnect'. I then sed '/Environment=K/d', '/ExecStartPre/d', '/ExecStopPost/d' /etc/systemd/system/httpd.service I recreate the host-account on another replica using ipa host-add, then ipa hostgroup-add-member. On the now-removed host, I do some housekeeping like restoring the backed up files and then I run; /usr/sbin/ipa-client-install \ --password=${otp} \ --mkhomedir \ --no-ntp \ --unattended \ --domain=realm.name \ --realm=REALM.NAME \ --ca-cert-file=/etc/pki/ca-trust/source/ca.crt then /usr/sbin/ipa-replica-install \ --dirsrv-cert-file=/etc/pki/tls/private/ipa.pkcs12 \ --http-cert-file=/etc/pki/tls/private/ipa.pkcs12 \ --dirsrv-pin=pwd \ --http-pin=pwd \ --unattended \ --no-pkinit \ --no-ntp I seem to get the following keytab request problem followed by dirsrv failure. from ipa-replica-install (4.6.4-10.el7.centos.3.x86_64). If I upgrade to 4.6.8-5.el7.centos.4.noarch.rpm, I get the same problem.[1] On serverb, the host which receives the binding request for the reinstall, I get permission denied the bind dn "" does not have permission in dirsrv error log...? Does anyone have any thoughts, Cheers and many thanks in advance, Rob [1] 2021-05-26T02:50:56Z DEBUG Backing up system configuration file '/etc/httpd/conf.d/ipa.conf' 2021-05-26T02:50:56Z DEBUG -> Not backing up - '/etc/httpd/conf.d/ipa.conf' doesn't exist 2021-05-26T02:50:56Z DEBUG Backing up system configuration file '/etc/httpd/conf.d/ipa-rewrite.conf' 2021-05-26T02:50:56Z DEBUG -> Not backing up - '/etc/httpd/conf.d/ipa-rewrite.conf' doesn't exist 2021-05-26T02:50:56Z DEBUG duration: 0 seconds 2021-05-26T02:50:56Z DEBUG [10/21]: setting up httpd keytab 2021-05-26T02:50:56Z DEBUG raw: service_add(u'HTTP/servera.system(a)REALM.NAME', force=True, version=u'2.230') 2021-05-26T02:50:56Z DEBUG service_add(ipapython.kerberos.Principal('HTTP/servera.system(a)REALM.NAME'), force=True, all=False, raw=False, version=u'2.230', no_members=False) 2021-05-26T02:50:56Z DEBUG flushing ldapi://%2Fvar%2Frun%2Fslapd-REALM-NAME.socket from SchemaCache 2021-05-26T02:50:56Z DEBUG retrieving schema for SchemaCache url=ldapi://%2Fvar%2Frun%2Fslapd-REALM-NAME.socket conn=<ldap.ldapobject.SimpleLDAPObject instance at 0x7f0d29f50368> 2021-05-26T02:50:57Z DEBUG raw: host_show(u'servera.system', version=u'2.230') 2021-05-26T02:50:57Z DEBUG host_show(u'servera.system', rights=False, all=False, raw=False, version=u'2.230', no_members=False) 2021-05-26T02:50:57Z DEBUG Backing up system configuration file '/var/lib/ipa/gssproxy/http.keytab' 2021-05-26T02:50:57Z DEBUG -> Not backing up - '/var/lib/ipa/gssproxy/http.keytab' doesn't exist 2021-05-26T02:50:57Z DEBUG Starting external process 2021-05-26T02:50:57Z DEBUG args=/usr/sbin/ipa-getkeytab -k /var/lib/ipa/gssproxy/http.keytab -p HTTP/servera.system(a)REALM.NAME<mailto:HTTP/servera.system@REALM.NAME> -H ldapi://%2Fvar%2Frun%2Fslapd-REALM-NAME.socket -Y EXTERNAL 2021-05-26T02:50:57Z DEBUG Process finished, return code=9 2021-05-26T02:50:57Z DEBUG stdout= 2021-05-26T02:50:57Z DEBUG stderr=Failed to parse result: unsupported extended operation Retrying with pre-4.0 keytab retrieval method... Failed to parse result: unsupported extended operation Failed to get keytab! Failed to get keytab 2021-05-26T02:50:57Z DEBUG Traceback (most recent call last): File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 570, in start_creation run_step(full_msg, method) File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 560, in run_step method() File "/usr/lib/python2.7/site-packages/ipaserver/install/httpinstance.py", line 637, in request_service_keytab super(HTTPInstance, self).request_service_keytab() File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 742, in request_service_keytab self.run_getkeytab(self.api.env.ldap_uri, self.keytab, self.principal) File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 732, in run_getkeytab ipautil.run(args, nolog=nolog) File "/usr/lib/python2.7/site-packages/ipapython/ipautil.py", line 562, in run raise CalledProcessError(p.returncode, arg_string, str(output)) CalledProcessError: Command '/usr/sbin/ipa-getkeytab -k /var/lib/ipa/gssproxy/http.keytab -p HTTP/servera.system(a)REALM.NAME<mailto:HTTP/servera.system@REALM.NAME> -H ldapi://%2Fvar%2Frun%2Fslapd-REALM-NAME.socket -Y EXTERNAL' returned non-zero exit status 9 2021-05-26T02:50:57Z DEBUG [error] CalledProcessError: Command '/usr/sbin/ipa-getkeytab -k /var/lib/ipa/gssproxy/http.keytab -p HTTP/servera.system(a)REALM.NAME<mailto:HTTP/servera.system@REALM.NAME> -H ldapi://%2Fvar%2Frun%2Fslapd-REALM-NAME.socket -Y EXTERNAL' returned non-zero exit status 9 2021-05-26T02:50:57Z DEBUG File "/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 178, in execute return_value = self.run() File "/usr/lib/python2.7/site-packages/ipapython/install/cli.py", line 319, in run return cfgr.run() File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 364, in run return self.execute() exc_handler(exc_info) <snip /> File "/usr/lib/python2.7/site-packages/ipapython/install/common.py", line 65, in _install for unused in self._installer(self.parent): File "/usr/lib/python2.7/site-packages/ipaserver/install/server/__init__.py", line 622, in main replica_install(self) File "/usr/lib/python2.7/site-packages/ipaserver/install/server/replicainstall.py", line 406, in decorated func(installer) File "/usr/lib/python2.7/site-packages/ipaserver/install/server/replicainstall.py", line 1487, in install fstore=fstore) File "/usr/lib/python2.7/site-packages/ipaserver/install/server/replicainstall.py", line 173, in install_http subject_base=config.subject_base, master_fqdn=config.master_host_name) File "/usr/lib/python2.7/site-packages/ipaserver/install/httpinstance.py", line 188, in create_instance self.start_creation() File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 570, in start_creation run_step(full_msg, method) File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 560, in run_step method() File "/usr/lib/python2.7/site-packages/ipaserver/install/httpinstance.py", line 637, in request_service_keytab super(HTTPInstance, self).request_service_keytab() File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 742, in request_service_keytab self.run_getkeytab(self.api.env.ldap_uri, self.keytab, self.principal) File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 732, in run_getkeytab ipautil.run(args, nolog=nolog) File "/usr/lib/python2.7/site-packages/ipapython/ipautil.py", line 562, in run raise CalledProcessError(p.returncode, arg_string, str(output)) 2021-05-26T02:50:57Z DEBUG The ipa-replica-install command failed, exception: CalledProcessError: Command '/usr/sbin/ipa-getkeytab -k /var/lib/ipa/gssproxy/http.keytab -p HTTP/servera.system(a)REALM.NAME<mailto:HTTP/servera.system@REALM.NAME> -H ldapi://%2Fvar%2Frun%2Fslapd-REALM-NAME.socket -Y EXTERNAL' returned non-zero exit status 9 2021-05-26T02:50:57Z ERROR Command '/usr/sbin/ipa-getkeytab -k /var/lib/ipa/gssproxy/http.keytab -p HTTP/servera.system(a)REALM.NAME<mailto:HTTP/servera.system@REALM.NAME> -H ldapi://%2Fvar%2Frun%2Fslapd-REALM-NAME.socket -Y EXTERNAL' returned non-zero exit status 9 2021-05-26T02:50:57Z ERROR The ipa-replica-install command failed. See /var/log/ipareplica-install.log for more information [2] [26/May/2021:12:50:47.240285166 +1000] - WARN - NSMMReplicationPlugin - repl5_inc_run - agmt="cn=meToservera.system" (servera:389): The remote replica has a different database generation ID than the local database. You may have to reinitialize the remote replica, or the local replica. [26/May/2021:12:50:47.858057379 +1000] - INFO - NSMMReplicationPlugin - repl5_tot_run - Beginning total update of replica "agmt="cn=meToservera.system" (servera:389)". [26/May/2021:12:50:50.679652092 +1000] - INFO - NSMMReplicationPlugin - repl5_tot_run - Finished total update of replica "agmt="cn=meToservera.system" (servera:389)". Sent 582 entries. [26/May/2021:12:50:52.158394667 +1000] - ERR - NSMMReplicationPlugin - acquire_replica - agmt="cn=meToservera.system" (servera:389): Unable to acquire replica: permission denied. The bind dn "" does not have permission to supply replication updates to the replica. Will retry later. [26/May/2021:12:50:55.079367688 +1000] - ERR - NSMMReplicationPlugin - acquire_replica - agmt="cn=meToservera.system" (servera:389): Unable to acquire replica: permission denied. The bind dn "" does not have permission to supply replication updates to the replica. Will retry later. [26/May/2021:12:50:58.084381230 +1000] - ERR - NSMMReplicationPlugin - acquire_replica - agmt="cn=meToservera.system" (servera:389): Unable to acquire replica: permission denied. The bind dn "" does not have permission to supply replication updates to the replica. Will retry later. [26/May/2021:12:51:01.092727541 +1000] - ERR - NSMMReplicationPlugin - acquire_replica - agmt="cn=meToservera.system" (servera:389): Unable to acquire replica: permission denied. The bind dn "" does not have permission to supply replication updates to the replica. Will retry later. CONFIDENTIALITY NOTICE: This email and any attachments are for the sole use of the intended recipient and may contain material that is proprietary, confidential, privileged or otherwise legally protected or restricted under applicable government laws. Any review, disclosure, distributing or other use without expressed permission of the sender is strictly prohibited. If you are not the intended recipient, please contact the sender and delete all copies without reading, printing, or saving.

2 1

Kerberos Issues
by Mark Potter 01 Jun '21

01 Jun '21

Long story short, we had to redeploy part of our FreeIPA cluster. As far as I know I followed all of the proper procedures and everything seems to be working from the client side however we are getting a TON of these messages in krb5kdc.log ipa3.example.com krb5kdc[31232](info): TGS_REQ (8 etypes {18 17 20 19 16 23 25 26}) 10.6.21.19: LOOKING_UP_SERVER: authtime 0, host/ client100.example.com(a)EXAMPLE.COM for nfs/nfs1.example.com(a)EXAMPLE.COM, Server not found in Kerberos database client100.example.com has working forward and reverse DNS entries that resolve from all FreeIPA servers and from itself. nfs1.example.com has working forward and reverse entries that resolve from all FreeIPA servers and from itself, it is not part of the FreeIPA domain at all, it is still using the authentication we are replacing with FreeIPA. It is used for automount homedirs in FreeIPA but is not kerberized All of the clients reporting this error still properly automount homedirs and that is the only thing on nfs1.example.com. There is another mountpoint, also not kerberized, in the automount setup that is not throwing any errors and access extremely frequently. I am happy to provide any logs necessary to track this down. -- *Mark Potter*

2 2

ACME admin replication conflict
by Stijn De Weirdt 01 Jun '21

01 Jun '21

hello all, in our setup ipa-healthcheck reports an issue with a replication conflict on "dn: cn=Enterprise ACME Administrators,ou=groups,o=ipaca" the conflict and valid entry are almost identical: > Valid Entry: > > dn: cn=Enterprise ACME Administrators,ou=groups,o=ipaca > cn: Enterprise ACME Administrators > description: ACME RA accounts > objectClass: top > objectClass: groupOfUniqueNames > uniqueMember: uid=acme-master2.domain,ou=people,o=ipaca > uniqueMember: uid=ipara,ou=people,o=ipaca with the conflicting entry the same, except for the line > uniqueMember: uid=acme-master1.domain,ou=people,o=ipaca i would like some guidance what this means and how to proceed: delete the conflicting entry, swap to the conflicting entry, merge it (somehow) many thanks, stijn

2 2

Re: Can't Add Replica: The changelog directory CLDB already exists and is not empty
by Sinh Lam 01 Jun '21

01 Jun '21

This is an old thread but I’m running into this issue and was wondering if there was ever a resolution to this. Tldr - My master failed and was not able to start up due to the dse.ldif being a zero byte file and the .bak file was unusable as well. Ended up using the startOK file and that got my IPA master back up. I didn’t find out till a week or so later that my replication has stopped working and I’ve been trying to resolve this ever since. The error I’m getting when trying to set up a new replica is the error in the subject. These are the last couple entries in the journal logs for the dirsrv service : May 20 16:11:40 ns-slapd[5273]: [20/May/2021:16:11:40.900845676 +0000] - NOTICE - bdb_start - Detected Disorderly Shutdown last time Directory Server was running, recovering database. May 20 16:11:42 ns-slapd[5273]: [20/May/2021:16:11:42.103929069 +0000] - ERR - attrcrypt_unwrap_key - Failed to unwrap key for cipher AES May 20 16:11:42 ns-slapd[5273]: [20/May/2021:16:11:42.106523128 +0000] - ERR - attrcrypt_cipher_init - Symmetric key failed to unwrap with the private key; Cert might have been renewed since the key is wrapped. To recover the encrypted contents, keep the wrapped symmetric key value. May 20 16:11:42 ns-slapd[5273]: [20/May/2021:16:11:42.281157478 +0000] - ERR - attrcrypt_unwrap_key - Failed to unwrap key for cipher 3DES May 20 16:11:42 ns-slapd[5273]: [20/May/2021:16:11:42.284236656 +0000] - ERR - attrcrypt_cipher_init - Symmetric key failed to unwrap with the private key; Cert might have been renewed since the key is wrapped. To recover the encrypted contents, keep the wrapped symmetric key value. May 20 16:11:42 ns-slapd[5273]: [20/May/2021:16:11:42.287235192 +0000] - ERR - attrcrypt_init - All prepared ciphers are not available. Please disable attribute encryption. May 20 16:11:42 ns-slapd[5273]: [20/May/2021:16:11:42.464658571 +0000] - ERR - attrcrypt_unwrap_key - Failed to unwrap key for cipher AES May 20 16:11:42 ns-slapd[5273]: [20/May/2021:16:11:42.468260771 +0000] - ERR - attrcrypt_cipher_init - Symmetric key failed to unwrap with the private key; Cert might have been renewed since the key is wrapped. To recover the encrypted contents, keep the wrapped symmetric key value. May 20 16:11:42 ns-slapd[5273]: [20/May/2021:16:11:42.644832465 +0000] - ERR - attrcrypt_unwrap_key - Failed to unwrap key for cipher 3DES May 20 16:11:42 ns-slapd[5273]: [20/May/2021:16:11:42.647838123 +0000] - ERR - attrcrypt_cipher_init - Symmetric key failed to unwrap with the private key; Cert might have been renewed since the key is wrapped. To recover the encrypted contents, keep the wrapped symmetric key value. May 20 16:11:42 ns-slapd[5273]: [20/May/2021:16:11:42.650519798 +0000] - ERR - attrcrypt_init - All prepared ciphers are not available. Please disable attribute encryption. May 20 16:11:43 ns-slapd[5273]: [20/May/2021:16:11:43.015851937 +0000] - ERR - schema-compat-plugin - scheduled schema-compat-plugin tree scan in about 5 seconds after the server startup! May 20 16:11:43 ns-slapd[5273]: [20/May/2021:16:11:43.054457416 +0000] - WARN - NSACLPlugin - acl_parse - The ACL target cn=groups,cn=compat,dc=example,dc=net does not exist May 20 16:11:43 ns-slapd[5273]: [20/May/2021:16:11:43.056902182 +0000] - WARN - NSACLPlugin - acl_parse - The ACL target cn=computers,cn=compat,dc=example,dc=net does not exist May 20 16:11:43 ns-slapd[5273]: [20/May/2021:16:11:43.059621578 +0000] - WARN - NSACLPlugin - acl_parse - The ACL target cn=ng,cn=compat,dc=example,dc=net does not exist May 20 16:11:43 ns-slapd[5273]: [20/May/2021:16:11:43.061834684 +0000] - WARN - NSACLPlugin - acl_parse - The ACL target ou=sudoers,dc=example,dc=net does not exist May 20 16:11:43 ns-slapd[5273]: [20/May/2021:16:11:43.063891013 +0000] - WARN - NSACLPlugin - acl_parse - The ACL target cn=users,cn=compat,dc=example,dc=net does not exist May 20 16:11:43 ns-slapd[5273]: [20/May/2021:16:11:43.066217133 +0000] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=example,dc=net does not exist May 20 16:11:43 ns-slapd[5273]: [20/May/2021:16:11:43.068870945 +0000] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=example,dc=net does not exist May 20 16:11:43 ns-slapd[5273]: [20/May/2021:16:11:43.071006284 +0000] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=example,dc=net does not exist May 20 16:11:43 ns-slapd[5273]: [20/May/2021:16:11:43.073207989 +0000] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=example,dc=net does not exist May 20 16:11:43 ns-slapd[5273]: [20/May/2021:16:11:43.076186848 +0000] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=example,dc=net does not exist May 20 16:11:43 ns-slapd[5273]: [20/May/2021:16:11:43.078837082 +0000] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=example,dc=net does not exist May 20 16:11:43 ns-slapd[5273]: [20/May/2021:16:11:43.081064756 +0000] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=example,dc=net does not exist May 20 16:11:43 ns-slapd[5273]: [20/May/2021:16:11:43.083418248 +0000] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=example,dc=net does not exist May 20 16:11:43 ns-slapd[5273]: [20/May/2021:16:11:43.085693933 +0000] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=example,dc=net does not exist May 20 16:11:43 ns-slapd[5273]: [20/May/2021:16:11:43.088486548 +0000] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=example,dc=net does not exist May 20 16:11:43 ns-slapd[5273]: [20/May/2021:16:11:43.090954337 +0000] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=example,dc=net does not exist May 20 16:11:43 ns-slapd[5273]: [20/May/2021:16:11:43.105391221 +0000] - WARN - NSACLPlugin - acl_parse - The ACL target cn=ad,cn=etc,dc=example,dc=net does not exist May 20 16:11:43 ns-slapd[5273]: [20/May/2021:16:11:43.109923564 +0000] - WARN - NSACLPlugin - acl_parse - The ACL target cn=casigningcert cert-pki-ca,cn=ca_renewal,cn=ipa,cn=etc,dc=example,dc=net does not exist May 20 16:11:43 ns-slapd[5273]: [20/May/2021:16:11:43.111808229 +0000] - WARN - NSACLPlugin - acl_parse - The ACL target cn=casigningcert cert-pki-ca,cn=ca_renewal,cn=ipa,cn=etc,dc=example,dc=net does not exist May 20 16:11:43 ns-slapd[5273]: [20/May/2021:16:11:43.199628452 +0000] - WARN - NSACLPlugin - acl_parse - The ACL target cn=automember rebuild membership,cn=tasks,cn=config does not exist May 20 16:11:43 ns-slapd[5273]: [20/May/2021:16:11:43.207869328 +0000] - ERR - cos-plugin - cos_dn_defs_cb - Skipping CoS Definition cn=Password Policy,cn=accounts,dc=example,dc=net--no CoS Templates found, which should be added before the CoS Definition. May 20 16:11:43 ns-slapd[5273]: [20/May/2021:16:11:43.251700304 +0000] - INFO - slapd_daemon - slapd started. Listening on All Interfaces port 389 for LDAP requests May 20 16:11:43 ns-slapd[5273]: [20/May/2021:16:11:43.254651872 +0000] - INFO - slapd_daemon - Listening on All Interfaces port 636 for LDAPS requests May 20 16:11:43 ns-slapd[5273]: [20/May/2021:16:11:43.256778704 +0000] - INFO - slapd_daemon - Listening on /var/run/slapd-EXAMPLE-NET.socket for LDAPI requests May 20 16:11:43 systemd[1]: Started 389 Directory Server EXAMPLE-NET.. May 20 16:11:43 ns-slapd[5273]: [20/May/2021:16:11:43.310441141 +0000] - ERR - schema-compat-plugin - schema-compat-plugin tree scan will start in about 5 seconds! May 20 16:11:48 ns-slapd[5273]: [20/May/2021:16:11:48.503046676 +0000] - ERR - schema-compat-plugin - warning: no entries set up under cn=computers, cn=compat,dc=example,dc=net May 20 16:11:48 ns-slapd[5273]: [20/May/2021:16:11:48.514741500 +0000] - ERR - schema-compat-plugin - Finished plugin initialization. May 20 16:12:03 ns-slapd[5273]: [20/May/2021:16:12:03.319674451 +0000] - ERR - ipa-topology-plugin - ipa_topo_agreement_dn: no replica found May 20 16:12:03 ns-slapd[5273]: [20/May/2021:16:12:03.325071163 +0000] - ERR - ipa-topology-plugin - ipa_topo_agreement_dn: no replica found May 20 16:12:03 ns-slapd[5273]: [20/May/2021:16:12:03.329293579 +0000] - ERR - ipa-topology-plugin - ipa_topo_agreement_dn: no replica found May 20 16:12:03 ns-slapd[5273]: [20/May/2021:16:12:03.333178665 +0000] - ERR - ipa-topology-plugin - ipa_topo_agreement_dn: no replica found May 20 16:12:03 ns-slapd[5273]: [20/May/2021:16:12:03.336932011 +0000] - ERR - ipa-topology-plugin - ipa_topo_agreement_dn: no replica found May 20 16:12:03 ns-slapd[5273]: [20/May/2021:16:12:03.341244859 +0000] - ERR - ipa-topology-plugin - ipa_topo_agreement_dn: no replica found May 20 16:12:03 ns-slapd[5273]: [20/May/2021:16:12:03.345131920 +0000] - ERR - ipa-topology-plugin - ipa_topo_agreement_dn: no replica found May 20 16:12:03 ns-slapd[5273]: [20/May/2021:16:12:03.349357371 +0000] - ERR - ipa-topology-plugin - ipa_topo_agreement_dn: no replica found May 20 16:12:03 ns-slapd[5273]: [20/May/2021:16:12:03.353178446 +0000] - ERR - ipa-topology-plugin - ipa_topo_agreement_dn: no replica found May 20 16:12:51 ns-slapd[5273]: [20/May/2021:16:12:51.527767324 +0000] - ERR - NSMMReplicationPlugin - multimaster_extop_StartNSDS50ReplicationRequest - conn=77 op=5 replica="unknown": Unable to acquire replica: error: no such replica May 20 16:12:52 ns-slapd[5273]: [20/May/2021:16:12:52.283753249 +0000] - ERR - NSMMReplicationPlugin - multimaster_extop_StartNSDS50ReplicationRequest - conn=78 op=5 replica="unknown": Unable to acquire replica: error: no such replica May 20 16:12:52 ns-slapd[5273]: [20/May/2021:16:12:52.390379930 +0000] - ERR - NSMMReplicationPlugin - multimaster_extop_StartNSDS50ReplicationRequest - conn=79 op=5 replica="unknown": Unable to acquire replica: error: no such replica May 20 16:12:52 ns-slapd[5273]: [20/May/2021:16:12:52.957417497 +0000] - ERR - NSMMReplicationPlugin - multimaster_extop_StartNSDS50ReplicationRequest - conn=80 op=5 replica="unknown": Unable to acquire replica: error: no such replica May 20 16:12:53 ns-slapd[5273]: [20/May/2021:16:12:53.283781064 +0000] - ERR - NSMMReplicationPlugin - multimaster_extop_StartNSDS50ReplicationRequest - conn=81 op=5 replica="unknown": Unable to acquire replica: error: no such replica May 20 16:12:55 ns-slapd[5273]: [20/May/2021:16:12:55.479234600 +0000] - ERR - NSMMReplicationPlugin - multimaster_extop_StartNSDS50ReplicationRequest - conn=82 op=5 replica="unknown": Unable to acquire replica: error: no such replica May 20 16:15:51 ns-slapd[5273]: [20/May/2021:16:15:51.868329611 +0000] - ERR - NSMMReplicationPlugin - multimaster_extop_StartNSDS50ReplicationRequest - conn=212 op=5 replica="unknown": Unable to acquire replica: error: no such replica May 20 16:16:24 ns-slapd[5273]: [20/May/2021:16:16:24.216095880 +0000] - ERR - NSMMReplicationPlugin - multimaster_extop_StartNSDS50ReplicationRequest - conn=233 op=5 replica="unknown": Unable to acquire replica: error: no such replica May 20 16:16:27 ns-slapd[5273]: [20/May/2021:16:16:27.408505127 +0000] - ERR - NSMMReplicationPlugin - multimaster_extop_StartNSDS50ReplicationRequest - conn=240 op=5 replica="unknown": Unable to acquire replica: error: no such replica May 25 20:45:37 ns-slapd[5273]: [25/May/2021:20:45:37.356300061 +0000] - ERR - NSMMReplicationPlugin - multimaster_extop_StartNSDS50ReplicationRequest - conn=111801 op=5 replica="unknown": Unable to acquire replica: error: no such replica May 26 04:20:37 ns-slapd[5273]: [26/May/2021:04:20:37.246445897 +0000] - ERR - ipa-topology-plugin - ipa_topo_agreement_dn: no replica found May 26 04:20:37 ns-slapd[5273]: [26/May/2021:04:20:37.249257028 +0000] - ERR - ipa-topology-plugin - ipa_topo_agmt_del: cn=master.example.net-to-replica001.example.net May 26 04:20:39 ns-slapd[5273]: [26/May/2021:04:20:39.266434467 +0000] - WARN - modify_internal_entry - Can't modify task entry 'cn=clean 5,cn=cleanallruv,cn=tasks,cn=config'; No such object (32) May 26 04:20:41 ns-slapd[5273]: [26/May/2021:04:20:41.272692883 +0000] - WARN - modify_internal_entry - Can't modify task entry 'cn=clean 5,cn=cleanallruv,cn=tasks,cn=config'; No such object (32) May 26 04:20:43 ns-slapd[5273]: [26/May/2021:04:20:43.333985925 +0000] - WARN - modify_internal_entry - Can't modify task entry 'cn=clean 5,cn=cleanallruv,cn=tasks,cn=config'; No such object (32) May 26 04:20:43 ns-slapd[5273]: [26/May/2021:04:20:43.337030838 +0000] - ERR - NSMMReplicationPlugin - CleanAllRUV Task (rid 5): Could not find replica from dn(dc=example,dc=net) May 26 04:20:45 ns-slapd[5273]: [26/May/2021:04:20:45.342517080 +0000] - WARN - modify_internal_entry - Can't modify task entry 'cn=clean 5,cn=cleanallruv,cn=tasks,cn=config'; No such object (32) May 26 04:20:47 ns-slapd[5273]: [26/May/2021:04:20:47.348898719 +0000] - WARN - modify_internal_entry - Can't modify task entry 'cn=clean 5,cn=cleanallruv,cn=tasks,cn=config'; No such object (32) May 26 04:20:49 ns-slapd[5273]: [26/May/2021:04:20:49.355780507 +0000] - WARN - modify_internal_entry - Can't modify task entry 'cn=clean 5,cn=cleanallruv,cn=tasks,cn=config'; No such object (32) May 26 04:20:49 ns-slapd[5273]: [26/May/2021:04:20:49.358756218 +0000] - ERR - NSMMReplicationPlugin - CleanAllRUV Task (rid 5): Task failed...(-1) May 26 04:20:51 ns-slapd[5273]: [26/May/2021:04:20:51.364127080 +0000] - WARN - modify_internal_entry - Can't modify task entry 'cn=clean 5,cn=cleanallruv,cn=tasks,cn=config'; No such object (32) May 26 04:20:51 ns-slapd[5273]: [26/May/2021:04:20:51.406580664 +0000] - WARN - get_internal_entry - Can't find task entry 'cn=clean 5,cn=cleanallruv,cn=tasks,cn=config' May 26 04:20:51 ns-slapd[5273]: [26/May/2021:04:20:51.412684547 +0000] - ERR - ipa-topology-plugin - ipa_topo_util_cleanruv: failed to create cleanalltuv task May 28 00:08:17 ns-slapd[5273]: [28/May/2021:00:08:17.669467056 +0000] - ERR - log_ber_too_big_error - conn=173723 fd=156 Incoming BER Element may be misformed. This may indicate an attempt to use TLS on a plaintext port, IE ldaps://localhost:389. Check your client LDAP_URI settings. May 28 01:06:22 ns-slapd[5273]: [28/May/2021:01:06:22.406718855 +0000] - ERR - log_ber_too_big_error - conn=175016 fd=158 Incoming BER Element was 24019198018235050 bytes, max allowable is 209715200 bytes. Change the nsslapd-maxbersize attribute in cn=config to increase. May 28 15:50:43 ns-slapd[5273]: [28/May/2021:15:50:43.082273849 +0000] - ERR - log_ber_too_big_error - conn=195035 fd=289 Incoming BER Element may be misformed. This may indicate an attempt to use TLS on a plaintext port, IE ldaps://localhost:389. Check your client LDAP_URI settings. May 28 15:50:43 ns-slapd[5273]: [28/May/2021:15:50:43.097752625 +0000] - ERR - log_ber_too_big_error - conn=195036 fd=289 Incoming BER Element may be misformed. This may indicate an attempt to use TLS on a plaintext port, IE ldaps://localhost:389. Check your client LDAP_URI settings. May 29 12:43:13 ns-slapd[5273]: [29/May/2021:12:43:13.872403558 +0000] - ERR - log_ber_too_big_error - conn=222810 fd=357 Incoming BER Element may be misformed. This may indicate an attempt to use TLS on a plaintext port, IE ldaps://localhost:389. Check your client LDAP_URI settings. May 29 17:26:04 ns-slapd[5273]: [29/May/2021:17:26:04.858100977 +0000] - ERR - log_ber_too_big_error - conn=229005 fd=322 Incoming BER Element may be misformed. This may indicate an attempt to use TLS on a plaintext port, IE ldaps://localhost:389. Check your client LDAP_URI settings. May 31 11:05:27 ns-slapd[5273]: [31/May/2021:11:05:27.982685756 +0000] - ERR - connection_read_operation - conn=283764 received a non-LDAP message (tag 0x47, expected 0x30) May 31 11:05:31 ns-slapd[5273]: [31/May/2021:11:05:31.522716719 +0000] - ERR - connection_read_operation - conn=283766 received a non-LDAP message (tag 0x47, expected 0x30) May 31 11:31:27 ns-slapd[5273]: [31/May/2021:11:31:27.029834838 +0000] - ERR - connection_read_operation - conn=284343 received a non-LDAP message (tag 0x47, expected 0x30) May 31 11:31:27 ns-slapd[5273]: [31/May/2021:11:31:27.520938917 +0000] - ERR - connection_read_operation - conn=284344 received a non-LDAP message (tag 0x47, expected 0x30) I changed up the host info in the log output but otherwise log is still the same. Right now, as it is, the master works, the existing replicas are working but no new changes are getting pushed out. I would like to NOT rebuild the entire IPA infrastructure if I can avoid it to get replication back up and running so any help would be greatly appreciated. Thank you. Sinh Lam

1 0

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users June 2021