June 2021 - FreeIPA-users - Fedora mailing-lists

Removal & clean up certificates from o=ipaca
by David Goudet 30 Sep '24

30 Sep '24

Hello all, I have to clean up lot of useless certificate in dirsrv database. Because of resubmit loop on Certmonger client, i have 99,9% of certificate in dirsrv database that are useless and not obsolete (expiration in 2020) (it represent ~85 000 certificates). These useless certificates produce some issues on FreeIPA: - decrease FreeIPA performances on CLI and GUI - increase the LDAP size - increase size and time of FreeIPA backup ... Is it possible to purge these certificates in dirsrv database and how? I found two branches in LDAP directory about these certificates: dn: cn=xxx,ou=ca,ou=requests,o=ipaca dn: cn=yyy,ou=certificateRepository,ou=ca,o=ipaca I can remove all requests and certificates entry from dirsrv database but how it is supported by PKI manager Dogtag (CRL, certificate generation, OCSP)? (This topic has already been discuss on https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost…) Thank you for you help -- David GOUDET LYRA NETWORK IT Operations service Tel : +33 (0)5 32 09 09 74 | Poste : 574

4 7

How to prevent non-admin users of FreeIPA from reading the list of users in the web interface?
by cdknight 16 Apr '24

16 Apr '24

When a user signs in to FreeIPA, I do not want them to be able to view the list of users in my LDAP server under the "Active users" link. I still want them to be able to administer self-service, so they can reset their password, add OTP tokens, etc. How would I go about doing this? The users will only be able to access the web interface, so it doesn't matter whether they can access it from other sources.

5 10

missing attribute "sambaGroupType" when attempting to create a new group - creating groups worked previously
by Tom Spettigue 19 Mar '24

19 Mar '24

Hey all - I seem to be getting the following error message whenever I try to create a group via the web interface: ``` IPA Error 4205: ObjectclassViolation missing attribute "sambaGroupType" required by object class "sambaGroupMapping" ``` I'm not sure exactly what's happening, except that I know I've created groups numerous times before, and never gotten this error message. Does anyone have any ideas?

1 2

certmonger error on ubuntu
by Robson Francisco de Souza 07 Feb '24

07 Feb '24

Hello! I've been running FreeIPA 4.3.1 on Ubuntu 16.04 for almost two years and most certificates should expire within three weeks. As this deadline approaches, I noticed certmonger has been unable to renew certificates due to the error below. After googling for two days, I found this issue has been observed by many people before, mostly after expiration of the certificates, as in https://tinyurl.com/vajmocw Still, I couldn't find a solution to this problem. If it is impossible to fix this issue while using FreeIPA 4.3.1, I would like to: 1) Find a way to renew all certificates even if certmonger can't be fixed. This would allow me to postpone the solution to after the next OS and/or FreeIPA upgrade 2) Find out what version of FreeIPA I should upgrade to while the operating system remains Ubuntu 16.04 Any help would be appreciated! Thanks! Robson ======> Command: systemctl status certmonger Nov 17 20:53:08 ipa.cefapnet.icb.usp.br certmonger[3873125]: 2019-11-17 20:53:08 [3873125] Error 77 connecting to https://ipa.cefapnet.icb.usp.br:8443/ca/agent/ca/profileReview: Problem with the SSL CA cert (path? access rights?). Nov 17 21:10:13 ipa.cefapnet.icb.usp.br dogtag-ipa-ca-renew-agent-submit[3875188]: Forwarding request to dogtag-ipa-renew-agent Nov 17 21:10:13 ipa.cefapnet.icb.usp.br dogtag-ipa-ca-renew-agent-submit[3875188]: dogtag-ipa-renew-agent returned 3 Nov 17 21:10:13 ipa.cefapnet.icb.usp.br certmonger[3873125]: 2019-11-17 21:10:13 [3873125] Error 77 connecting to https://ipa.cefapnet.icb.usp.br:8443/ca/agent/ca/profileReview: Problem with the SSL CA cert (path? access rights?). Nov 17 21:25:20 ipa.cefapnet.icb.usp.br dogtag-ipa-ca-renew-agent-submit[3875738]: Forwarding request to dogtag-ipa-renew-agent Nov 17 21:25:20 ipa.cefapnet.icb.usp.br dogtag-ipa-ca-renew-agent-submit[3875738]: dogtag-ipa-renew-agent returned 3 Nov 17 21:25:21 ipa.cefapnet.icb.usp.br certmonger[3873125]: 2019-11-17 21:25:21 [3873125] Error 77 connecting to https://ipa.cefapnet.icb.usp.br:8443/ca/agent/ca/profileReview: Problem with the SSL CA cert (path? access rights?). Nov 17 21:25:31 ipa.cefapnet.icb.usp.br dogtag-ipa-ca-renew-agent-submit[3875766]: Forwarding request to dogtag-ipa-renew-agent Nov 17 21:25:31 ipa.cefapnet.icb.usp.br dogtag-ipa-ca-renew-agent-submit[3875766]: dogtag-ipa-renew-agent returned 3 Nov 17 21:25:31 ipa.cefapnet.icb.usp.br certmonger[3873125]: 2019-11-17 21:25:31 [3873125] Error 77 connecting to https://ipa.cefapnet.icb.usp.br:8443/ca/agent/ca/profileReview: Problem with the SSL CA cert (path? access rights?). -- Robson Francisco de Souza, PhD Laboratório de Estrutura e Evolução de Proteínas (LEEP/PSEL) Departamento de Microbiologia Instituto de Ciências Biomédicas Universidade de São Paulo Av. Prof. Lineu Prestes, 1374 - Ed. Biomédicas II - Sala 250 - 2o. andar Tel: 3091-0891 Cidade Universitária - CEP 05508-900 - São Paulo - SP - Brasil ---- Robson Francisco de Souza, PhD Protein Structure and Evolution Laboratory (LEEP/PSEL) Microbiology Departament Biomedical Sciences Institute University of Sao Paulo Av. Prof. Lineu Prestes, 1374 - Biomédicas II - Sala 250 Phone: 55-11-3091-0891 Cidade Universitária - ZIP 05508-900 - São Paulo - SP - Brazil

6 10

Greenfield FreeIPA deployment - is it OK to put FreeIPA at the domain apex, or a "best practice" to put it in a subdomain?
by Braden McGrath 11 Jan '24

11 Jan '24

Hello FreeIPA-users. The Subject line is the core of my question here; I'll provide a bit more detail below. I work for what is (effectively) a startup, non-profit internet provider. I have an extensive Windows background, and "know enough to be dangerous" with Linux & BSD (have been tinkering with GNU/Linux on and off since Slackware 3.0 or 3.1). I'm very familiar with Windows Active Directory, but the org does not have any AD infrastructure right now (and being nonprofit, are trying to avoid spending money for MS, especially when all of the other VMs will be Linux or BSD anyway). Given the nonprofit nature, I discovered FreeIPA when looking for a free centralized directory system. The goal is to consolidate all credentials for *other* Linux VMs (customer-facing DNS, CRM web server, SNMP/network graphing servers, etc) as well as provide a back-end for RADIUS for management of network equipment (switches, routers, P2P wireless, etc). Simplifying DNS management and replication is also appealing, I'd rather administrate one system than two or three. In case it changes your opinion of the plan at all - all of the network equipment and VMs will be on *private* (10.x) IPv4 space and behind one or more firewalls, at least initially. We do want to add public IPv6, but do not have that yet. We only have a small allocation (/26) of public v4 from our upstream that will be NATed through a firewall and not directly on any devices. The traffic to FreeIPA is going to be internal-only, I do not plan on exposing FreeIPA's DNS "to the world" at all. Even customer-facing internal DNS will likely be through separate caching forwarders pointing back to FreeIPA. I have a completely unused, publicly registered domain (let's just call it "example.net" for this thread) available to dedicate to this system. We also own "example.org" and are using that for our public web presence, and I intend to keep that entirely standalone. Given that I have no current "interoperability" concerns, is there anything "wrong" with putting FreeIPA directly at the root of example.net? Or would it be more wise, from an interop, security, or manageability standpoint (i.e. a "best practice"), to root FreeIPA at something like auth.example.net or ipa.example.net and then have a separate set of nameservers handling the base domain? If I put FreeIPA's root (and Kerberos realm) in a subdomain, is it possible to *also* have it manage the parent domain's DNS entries? I've read through the Quick Start Guide and Deployment Recommendations (https://www.freeipa.org/page/Deployment_Recommendations) which is part of how I've come to the decisions I've made thus far. I couldn't really find guidance one way or the other on whether FreeIPA "should" be in a subdomain or not, hence this posting. I would appreciate any insight the community can provide!

3 4

FreeIPA web session timeout
by Yuri Krysko 10 Jan '24

10 Jan '24

Hello, Could you please advise how to configure FreeIPA web UI user session timeout? Thanks, Yuri ________________________________ LEGAL DISCLAIMER: M.C. Dean, Inc. and its subsidiaries considers this e-mail and any files transmitted with it to be protected, proprietary or privileged information intended solely for the use of the named recipient(s). Any disclosure of this material or the information contained herein, in whole or in part, to anyone outside of the intended recipient or affiliates is strictly prohibited. M. C. Dean, Inc. accepts no liability for the content of this e-mail or for the consequences of any actions taken on the basis of the information contained in it, unless that information is subsequently confirmed in writing. Employees of M.C. Dean, Inc. are instructed not to infringe on any rights of the recipient; any such communication violates company policy. If you are not the intended recipient, any disclosure, copying, distribution, or action taken or omitted in reliance on this information is strictly prohibited by M.C. Dean, Inc.; please notify the sender immediately by return e-mail, delete this communication and destroy all copies.

4 4

Auto cleanup old enrolled hosts
by Russ Long 01 Dec '23

01 Dec '23

We're adding FreeIPA to an immutable, often rotated environment (AWS ECS Hosts). These hosts are spun up and down at least daily. Is there a way to check FreeIPA to see when a host has last communicated with the FreeIPA Cluster? I'd like to use this information to auto-delete hosts that have not reported in from the FreeIPA host list.

5 4

Allow sysaccount to view its own entry
by Adam Bishop 09 Nov '23

09 Nov '23

I have a piece of software that tries to look up its own uid to check that LDAP is correctly configured. This check fails because the sysaccount cannot view anything under cn=etc,cn=sysaccounts. Is there an existing permission/privilege that I can use to allow it to read the sysaccounts tree (or better, just its own entry)? Many Thanks, Adam Bishop

4 3

kinit: KDC can't fulfill requested option while renewing credentials - which approach?
by Pieter Baele 19 Sep '23

19 Sep '23

I tried various approached to get Renewable tickets : modifying the kdc modifying krb5.conf using kadmin.local on every replica to modify the principal; which is not working - as designed (?)- in IPA What should I do to get a ticket with the correct R flag from IPA ? I don't think this is SSSD related (the service needing the renewable ticket this way is Apache Storm) Thanks a lot!

3 4

Do keytabs expire?
by Ronald Wimmer 07 Jun '23

07 Jun '23

Hi, today I found out that some entries in a keytab file seemed to have expired: Request ticket server HTTP/mwc.linux.mydomain.at(a)LINUX.MYDOMAIN.AT kvno 4 not found in keytab; keytab is likely out of date Fetching the keytab again with ipa-getkeytab fixed the problem. But why is this happening? Do keytab entries expire? I have not set any custom password or ticket policies. Regards, Ronald

4 13

ipa-replica-install -- cannot get past [26/41]: creating DS keytab
by Jonathon Jenkins 28 Mar '23

28 Mar '23

Greetings, I cannot get the ipa-replica-install to proceed past step 26/41 - creating DS keytab. I see the command that is to be run, and I can run that just fine before and after the ipa-replica-install command, and it creates the keytab. I am not sure how to proceed from here - the bug reports I see all pertain to earlier versions, and my files reflect those changes. I have also tried running this with all manner of password flags, which are correct, but still getting insufficient access rights. particulars: centos 7 3.10.0-957.1.3.el7.x86_64 ipa-server-4.6.4-10.el7.centos.x86_64 ipa-common-4.6.4-10.el7.centos.noarch ipa-server-common-4.6.4-10.el7.centos.noarch ipa-client-4.6.4-10.el7.centos.x86_64 ipa-server-dns-4.6.4-10.el7.centos.noarch ipa-client-common-4.6.4-10.el7.centos.noarch * Note: anonymized output below ipapython.ipautil: DEBUG stderr= ipalib.backend: DEBUG Created connection context.ldap2_139891568509776 ipaserver.install.service: DEBUG duration: 7 seconds ipaserver.install.service: DEBUG [26/41]: creating DS keytab [26/41]: creating DS keytab ipalib.frontend: DEBUG raw: service_add(u'ldap/<ipa-replica-host>@<domain>.NET', force=True, version=u'2.229') ipalib.frontend: DEBUG service_add(ipapython.kerberos.Principal('ldap/<ipa-replica-host>@<domain>.NET'), force=True, all=False, raw=False, version=u'2.229', no_members=False) ipalib.frontend: DEBUG raw: host_show(u'<ipa-replica-host>', version=u'2.229') ipalib.frontend: DEBUG host_show(u'<ipa-replica-host>', rights=False, all=False, raw=False, version=u'2.229', no_members=False) ipalib.install.sysrestore: DEBUG Backing up system configuration file '/etc/dirsrv/ds.keytab' ipalib.install.sysrestore: DEBUG -> Not backing up - '/etc/dirsrv/ds.keytab' doesn't exist ipapython.ipautil: DEBUG Starting external process ipapython.ipautil: DEBUG args=/usr/sbin/ipa-getkeytab -k /etc/dirsrv/ds.keytab -p ldap/<ipa-replica-host>@<domain>.NET -H ldaps://<ipa-replica-master> ipapython.ipautil: DEBUG Process finished, return code=9 ipapython.ipautil: DEBUG stdout= ipapython.ipautil: DEBUG stderr=Failed to parse result: Insufficient access rights Retrying with pre-4.0 keytab retrieval method... Failed to parse result: Insufficient access rights Failed to get keytab! Failed to get keytab ipaserver.install.service: DEBUG Traceback (most recent call last): File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 570, in start_creation run_step(full_msg, method) File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 560, in run_step method() File "/usr/lib/python2.7/site-packages/ipaserver/install/dsinstance.py", line 1308, in request_service_keytab super(DsInstance, self).request_service_keytab() File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 742, in request_service_keytab self.run_getkeytab(self.api.env.ldap_uri, self.keytab, self.principal) File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 732, in run_getkeytab ipautil.run(args, nolog=nolog) File "/usr/lib/python2.7/site-packages/ipapython/ipautil.py", line 562, in run raise CalledProcessError(p.returncode, arg_string, str(output)) CalledProcessError: Command '/usr/sbin/ipa-getkeytab -k /etc/dirsrv/ds.keytab -p ldap/<ipa-replica-host>@<domain>.NET -H ldaps://<ipa-replica-master>' returned non-zero exit status 9 ipaserver.install.service: DEBUG [error] CalledProcessError: Command '/usr/sbin/ipa-getkeytab -k /etc/dirsrv/ds.keytab -p ldap/<ipa-replica-host>@<domain>.NET -H ldaps://<ipa-replica-master>' returned non-zero exit status 9 [error] CalledProcessError: Command '/usr/sbin/ipa-getkeytab -k /etc/dirsrv/ds.keytab -p ldap/<ipa-replica-host>@<domain>.NET -H ldaps://<ipa-replica-master>' returned non-zero exit status 9 ipalib.backend: DEBUG Destroyed connection context.ldap2_139891548583120 ipalib.install.sysrestore: DEBUG Backing up system configuration file '/etc/ipa/default.conf' ipalib.install.sysrestore: DEBUG Saving Index File to '/var/lib/ipa/sysrestore/sysrestore.index' Your system may be partly configured. Run /usr/sbin/ipa-server-install --uninstall to clean up. ipapython.admintool: DEBUG File "/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 178, in execute return_value = self.run() File "/usr/lib/python2.7/site-packages/ipapython/install/cli.py", line 319, in run return cfgr.run() File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 364, in run return self.execute() File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 389, in execute for rval in self._executor(): File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 434, in __runner exc_handler(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 463, in _handle_execute_exception self._handle_exception(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 453, in _handle_exception six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 424, in __runner step() File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 421, in <lambda> step = lambda: next(self.__gen) File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from value = gen.send(prev_value) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 658, in _configure next(executor) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 434, in __runner exc_handler(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 463, in _handle_execute_exception self._handle_exception(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 521, in _handle_exception self.__parent._handle_exception(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 453, in _handle_exception six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 518, in _handle_exception super(ComponentBase, self)._handle_exception(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 453, in _handle_exception six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 424, in __runner step() File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 421, in <lambda> step = lambda: next(self.__gen) File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from value = gen.send(prev_value) File "/usr/lib/python2.7/site-packages/ipapython/install/common.py", line 65, in _install for unused in self._installer(self.parent): File "/usr/lib/python2.7/site-packages/ipaserver/install/server/__init__.py", line 622, in main replica_install(self) File "/usr/lib/python2.7/site-packages/ipaserver/install/server/replicainstall.py", line 406, in decorated func(installer) File "/usr/lib/python2.7/site-packages/ipaserver/install/server/replicainstall.py", line 1431, in install fstore=fstore) File "/usr/lib/python2.7/site-packages/ipaserver/install/server/replicainstall.py", line 113, in install_replica_ds setup_pkinit=not options.no_pkinit, File "/usr/lib/python2.7/site-packages/ipaserver/install/dsinstance.py", line 419, in create_replica self.start_creation(runtime=30) File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 570, in start_creation run_step(full_msg, method) File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 560, in run_step method() File "/usr/lib/python2.7/site-packages/ipaserver/install/dsinstance.py", line 1308, in request_service_keytab super(DsInstance, self).request_service_keytab() File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 742, in request_service_keytab self.run_getkeytab(self.api.env.ldap_uri, self.keytab, self.principal) File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 732, in run_getkeytab ipautil.run(args, nolog=nolog) File "/usr/lib/python2.7/site-packages/ipapython/ipautil.py", line 562, in run raise CalledProcessError(p.returncode, arg_string, str(output)) ipapython.admintool: DEBUG The ipa-replica-install command failed, exception: CalledProcessError: Command '/usr/sbin/ipa-getkeytab -k /etc/dirsrv/ds.keytab -p ldap/<ipa-replica-host>@<domain>.NET -H ldaps://<ipa-replica-master>' returned non-zero exit status 9 ipapython.admintool: ERROR Command '/usr/sbin/ipa-getkeytab -k /etc/dirsrv/ds.keytab -p ldap/<ipa-replica-host>@<domain>.NET -H ldaps://<ipa-replica-master>' returned non-zero exit status 9 ipapython.admintool: ERROR The ipa-replica-install command failed. See /var/log/ipareplica-install.log for more information

2 2

FreeIPA-Kubernetes Setup
by Ronald Wimmer 20 Mar '23

20 Mar '23

Hi, are there any plans (or maybe ongoing work already) to let FreeIPA run in a K8s environment? Cheers, Ronald

6 8

ipa-replica-install fails when I use custom certificates
by Peter Tselios 08 Feb '23

08 Feb '23

I have installed the ipa server by using the following command: --------- ipa-server-install --realm "EXAMPLE.COM" -p 'password' -a 'password' --hostname="server.example.com" -n example.com --ip-address="10.1.4.2" --dirsrv-cert-file=/etc/pki/tls/private/example.com.pem --dirsrv-cert-file=/etc/pki/tls/certs/example.com.crt --dirsrv-pin='' --http-cert-file=/etc/pki/tls/certs/example.com.crt --http-cert-file=/etc/pki/tls/private/example.com.pem --http-pin='' --ca-cert-file=/etc/pki/ca-trust/source/anchors/myca.pem --ca-cert-file=/etc/pki/ca-trust/source/anchors/mysubca.pem --mkhomedir -N --no-host-dns --unattended --------- Which works perfectly fine. However, I cannot make it work with ipa-replica-install since there is no option for --ca-cert-file. So, how can I install a replica with custom certificates?

6 12

FreeIPA CA failing to login with new admin user
by Stasiek Michalski 19 Dec '22

19 Dec '22

Hello, I installed FreeIPA replica on 4.8.4 on CentOS 8 from 4.4.4 from Fedora 25 with `ipa-replica-install --setup-dns --auto-forwarders`, without `--setup-ca` due to errors, which went fine. I do want to install CA though, which failed when I did `--setup-ca` and then later `ipa-ca-install` with the following error: ``` [4/29]: creating installation admin user Unable to log in as uid=admin-freeipa2.infra.opensuse.org,ou=people,o=ipaca on ldap://freeipa.infra.opensuse.org:389 [hint] tune with replication_wait_timeout [error] NotFound: uid=admin-freeipa2.infra.opensuse.org,ou=people,o=ipaca did not replicate to ldap://freeipa.infra.opensuse.org:389 Your system may be partly configured. Run /usr/sbin/ipa-server-install --uninstall to clean up. ``` Obviously I did try try extending the timeout based on that, but I don't think that was helpful in the end, considering the logs produced by the old server: httpd access_log ``` 192.168.47.90 - - [23/Jul/2020:00:25:36 +0000] "GET /ca/rest/account/login HTTP/1.1" 401 994 ``` server process in journal ``` SSLAuthenticatorWithFallback: Authenticating with BASIC authentication Invalid Credential. at com.netscape.cmscore.authentication.PasswdUserDBAuthentication.authenticate(PasswdUserDBAuthentication.java:167) at com.netscape.cms.realm.PKIRealm.authenticate(PKIRealm.java:63) at com.netscape.cms.tomcat.ProxyRealm.authenticate(ProxyRealm.java:78) at org.apache.catalina.authenticator.BasicAuthenticator.authenticate(BasicAuthenticator.java:94) at com.netscape.cms.tomcat.SSLAuthenticatorWithFallback.doSubAuthenticate(SSLAuthenticatorWithFallback.java:37) at com.netscape.cms.tomcat.AbstractPKIAuthenticator.doAuthenticate(AbstractPKIAuthenticator.java:98) at com.netscape.cms.tomcat.SSLAuthenticatorWithFallback.authenticate(SSLAuthenticatorWithFallback.java:47) at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:579) at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:141) at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:79) at org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:620) at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:88) at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:502) at org.apache.coyote.ajp.AbstractAjpProcessor.process(AbstractAjpProcessor.java:877) at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:684) at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1539) at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.run(NioEndpoint.java:1495) at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) at java.lang.Thread.run(Thread.java:748) SSLAuthenticatorWithFallback: Fallback auth header: WWW-Authenticate=Basic realm="Certificate Authority" SSLAuthenticatorWithFallback: Fallback auth return code: 401 SSLAuthenticatorWithFallback: Result: false ``` and from pki logs ``` Failed to authenticate as admin UID=admin-freeipa2.infra.opensuse.org. Error: netscape.ldap.LDAPException: error result (49) ``` I don't particularly know how to proceed from here, since those errors don't mean much to me. I see however it's not just me having issues with `ipa-ca-install` at least similar to this one (although by the looks of it, the reason is already different ;) Thanks in advance for trying, LCP [Stasiek] https://lcp.world/

4 6

IPA-Error 903: InternalError on Certificate page
by Nico Maas 10 Nov '22

10 Nov '22

Dear all, I am using FreeIPA, Version: 4.8.4 on CentOS 8 ipa-client.x86_64 4.8.4-7.module_el8.2.0+374+0d2d74a1 @AppStream ipa-client-common.noarch 4.8.4-7.module_el8.2.0+374+0d2d74a1 @AppStream ipa-common.noarch 4.8.4-7.module_el8.2.0+374+0d2d74a1 @AppStream ipa-healthcheck-core.noarch 0.4-4.module_el8.2.0+374+0d2d74a1 @AppStream ipa-server.x86_64 4.8.4-7.module_el8.2.0+374+0d2d74a1 @AppStream ipa-server-common.noarch 4.8.4-7.module_el8.2.0+374+0d2d74a1 @AppStream ipa-server-dns.noarch 4.8.4-7.module_el8.2.0+374+0d2d74a1 @AppStream Whenever I open the "Authentication" tab in the freeIPA webserver, I get the error "IPA-Error 903: InternalError. An internal error has happend". Retry does not help, within Authentication I can use all tabs, except from the Authentication -> Certificate -> Certificate one. This one gives the error. I can also not search for a certificate. The other areas of Authentication -> Certificate (Certificate Profiles, CA ACLS, Certificate Authorities) work without problems. As a test I cloned the machine and updated it to the latest CentOS 8 version with a newer freeIPA version on it, but that did not solve the problem and I scrapped this vm and idea again. Any idea on how to resolve the issue / what could be broken? Which logs and things would be useful to look into? Thanks a lot for your help and have a nice day Nico

4 8

Problem running IPA client on IPv6 only connection
by William Muriithi 26 Jul '22

26 Jul '22

Hello, I have an IPA clients that has both IPv4 and IPv6 addresses. One of the IPA client is in the office and hence can reach the IPA server on both IPv4 and IPv6. However, the client outside the LAN can only reach the IPA server over IPv6. I was able to enroll the external client fine over IPv6 and from the logs, all clean. However, when I attempted to ssh, its not able to retreave the user from IPA. The client in the office works fine. I can also make for example LDAP queries and they work over IPv6 fine. It looks like kerberos is somehow however using IPv4. I reached this conclusion after taking a tcpdump when attempting to ssh to the server and the kerberos traffic from the client to IPA is on IPv4. What would I need to do on the IPA client for it to prefer IPv6? I am aware I could remove IPv4 address from DNS, but that would break any communication from IPv4 only systems. Any assistance would be appreaciated. [william@ansible ~]$ ssh root(a)mars.external.example.com Last login: Mon Jan 7 17:19:49 2019 from 65.98.193.94 [root@mars ~]# kinit admin kinit: Cannot contact any KDC for realm 'EXTERNAL.EXAMPLE.COM <http://external.example.com/>' while getting initial credentials [root@mars ~]# ldapsearch -x -b cn=ftp,cn=groups,cn=compat,dc=external,dc=example,dc=com | tail -n 4 result: 0 Success # numResponses: 2 # numEntries: 1 [root@mars ~]# cat /etc/resolv.conf search external.example.com nameserver 2607:4860:6000:a::5 [root@mars ~]# Regards, William

5 10

ssh key issues
by Andrew Meyer 21 Jul '22

21 Jul '22

I recently cleaned up a few server in my home lab. Deleted servers that I no longer needed. However It seems I have a server with an IP address that used previously. FreeIPA is reporting that it is in /var/lib/sss/pubconf/known_hosts but I can't reverse engineer the hostname by doing sshkey -R 1.2.3.4. I have run into this issue previously but it has bee quite some time. When I go to delete the line from /var/lib/sss/pubconf/known_hosts it is gone. If someone could help me that would be great. I didn't see anything on my FreeIPA master that indicated I did anything there.

5 12

Could not login with AD user
by Ronald Wimmer 20 Jul '22

20 Jul '22

Today I was not able to log in with an AD user to an IPA client within a test setup. IPA users worked fine. DNS is managed externally. I figured out that the DNS-Record of that particular IPA client has not been created correctly. After having corrected the DNS entry and having dropped the SSSD cache on that client I could login with my AD user. Do you have an explanation for that or was it just a coincidence? Cheers, Ronald

4 13

freeipa/certmonger for openvpn user certificates
by Patrick Spinler 27 Jun '22

27 Jun '22

Hi, I'm setting up an openvpn server and I'd like to use our already existing FreeIPA CA to issue user keys/certs for openvpn's use. Since our OpenVPN box is a freeipa client, I thought it'd be nice to use certmonger to issue and keep up to date these certs. Ergo, I've created a certificate profile: pat@apex-freeipa ~$ ipa certprofile-show --all OpenVPNUserCert dn: cn=OpenVPNUserCert,cn=certprofiles,cn=ca,dc=int,dc=apexmw,dc=com Profile ID: OpenVPNUserCert Profile description: OpenVPN User Certificates Store issued certificates: FALSE objectclass: ipacertprofile, top And also a CA acl. For experimentation (and working vs our test freeipa) I've left this as wide open as I can: [pat@apex-freeipa ~]$ ipa caacl-show --all OpenVPN_User_Certificate_ACL dn: ipaUniqueID=6dde33a6-7849-11e9-aa05-525400b52c7b,cn=caacls,cn=ca,dc=int,dc=apexmw,dc=com ACL name: OpenVPN_User_Certificate_ACL Enabled: TRUE CA category: all Profile category: all User category: all Host category: all Service category: all ipauniqueid: 6dde33a6-7849-11e9-aa05-525400b52c7b objectclass: ipaassociation, ipacaacl Then, on my openvpn server, I ask for a cert for use for one of my users (myself, in this case): root@apex-openvpn:~# ipa-getcert request -f /etc/openvpn/client/pat.crt -k /etc/openvpn/client/pat.key -r -N 'CN=pat,O=INT.APEXMW.COM' -K pat -g 4096 --profile OpenVPNUserCert New signing request "20190603014016" added. But, it fails due to an access err vs the 'userCertificate' attribute of my account: root@apex-openvpn:~# ipa-getcert list (...snippy snip excess...) Request ID '20190603014016': status: CA_REJECTED ca-error: Server at https://apex-freeipa.int.apexmw.com/ipa/xml denied our request, giving up: 2100 (RPC failed at server. Insufficient access: Insufficient 'write' privilege to the 'userCertificate' attribute of entry 'uid=pat,cn=users,cn=accounts,dc=int,dc=apexmw,dc=com'.). stuck: yes key pair storage: type=FILE,location='/etc/openvpn/client/pat.key' certificate: type=FILE,location='/etc/openvpn/client/pat.crt' CA: IPA issuer: subject: expires: unknown pre-save command: post-save command: track: yes auto-renew: yes If I look at the dirsrv log, here's the accesses I see for this request (trimmed off the date/time to make the lines a _little_ shorter): root@apex-freeipa slapd-INT-APEXMW-COM# grep conn=178 access | cut -d' ' -f3- conn=178 fd=114 slot=114 connection from 10.10.200.1 to 10.10.200.1 conn=178 op=0 BIND dn="" method=sasl version=3 mech=GSS-SPNEGO conn=178 op=0 RESULT err=0 tag=97 nentries=0 etime=0.0025554208 dn="fqdn=apex-openvpn.int.apexmw.com,cn=computers,cn=accounts,dc=int,dc=apexmw,dc=com" conn=178 op=1 SRCH base="cn=ipaconfig,cn=etc,dc=int,dc=apexmw,dc=com" scope=0 filter="(objectClass=*)" attrs=ALL conn=178 op=1 RESULT err=0 tag=101 nentries=1 etime=0.0001319554 conn=178 op=2 SRCH base="cn=masters,cn=ipa,cn=etc,dc=int,dc=apexmw,dc=com" scope=2 filter="(&(objectClass=ipaConfigObject)(cn=CA))" attrs=ALL conn=178 op=2 RESULT err=0 tag=101 nentries=1 etime=0.0000979573 conn=178 op=3 SRCH base="cn=masters,cn=ipa,cn=etc,dc=int,dc=apexmw,dc=com" scope=2 filter="(&(objectClass=ipaConfigObject)(cn=CA))" attrs=ALL conn=178 op=3 RESULT err=0 tag=101 nentries=1 etime=0.0000736730 conn=178 op=4 SRCH base="cn=cas,cn=ca,dc=int,dc=apexmw,dc=com" scope=2 filter="(&(objectClass=ipaca)(cn=ipa))" attrs="" conn=178 op=4 RESULT err=0 tag=101 nentries=1 etime=0.0000499142 conn=178 op=5 SRCH base="cn=ipa,cn=cas,cn=ca,dc=int,dc=apexmw,dc=com" scope=0 filter="(objectClass=*)" attrs="ipaCaId ipaCaSubjectDN cn ipaCaIssuerDN description" conn=178 op=5 RESULT err=0 tag=101 nentries=1 etime=0.0000482726 conn=178 op=6 SRCH base="cn=apex-freeipa.int.apexmw.com,cn=masters,cn=ipa,cn=etc,dc=int,dc=apexmw,dc=com" scope=2 filter="(&(objectClass=ipaConfigObject)(ipaConfigString=enabledService)(cn=CA))" attrs=ALL conn=178 op=6 RESULT err=0 tag=101 nentries=1 etime=0.0000950646 notes=U conn=178 op=7 SRCH base="cn=accounts,dc=int,dc=apexmw,dc=com" scope=2 filter="(&(objectClass=krbprincipalaux)(krbPrincipalName=pat(a)INT.APEXMW.COM))" attrs=ALL conn=178 op=7 RESULT err=0 tag=101 nentries=1 etime=0.0002747849 conn=178 op=8 EXT oid="1.3.6.1.4.1.4203.1.11.3" name="whoami-plugin" conn=178 op=8 RESULT err=0 tag=120 nentries=0 etime=0.0000135034 conn=178 op=9 SRCH base="cn=request certificate ignore caacl,cn=virtual operations,cn=etc,dc=int,dc=apexmw,dc=com" scope=0 filter="(objectClass=*)" attrs="objectClass" conn=178 op=9 RESULT err=0 tag=101 nentries=1 etime=0.0000932668 - entryLevelRights: none conn=178 op=10 SRCH base="uid=pat,cn=users,cn=accounts,dc=int,dc=apexmw,dc=com" scope=0 filter="(objectClass=*)" attrs="distinguishedName" conn=178 op=10 RESULT err=0 tag=101 nentries=1 etime=0.0000640289 conn=178 op=11 SRCH base="uid=pat,cn=users,cn=accounts,dc=int,dc=apexmw,dc=com" scope=0 filter="(objectClass=*)" attrs="telephoneNumber ipaSshPubKey uid krbCanonicalName ipatokenRadiusUserName ipaUserAuthType krbPrincipalExpiration homeDirectory nsAccountLock usercertificate;binary title loginShell uidNumber mail ipaCertMapData memberOf memberofindirect krbPrincipalName givenName gidNumber sn ou userClass ipatokenRadiusConfigLink" conn=178 op=11 RESULT err=0 tag=101 nentries=1 etime=0.0001401737 conn=178 op=12 SRCH base="dc=int,dc=apexmw,dc=com" scope=2 filter="(|(member=uid=pat,cn=users,cn=accounts,dc=int,dc=apexmw,dc=com)(memberUser=uid=pat,cn=users,cn=accounts,dc=int,dc=apexmw,dc=com)(memberHost=uid=pat,cn=users,cn=accounts,dc=int,dc=apexmw,dc=com))" attrs="" conn=178 op=12 RESULT err=0 tag=101 nentries=7 etime=0.0001492344 notes=P pr_idx=0 pr_cookie=-1 conn=178 op=13 SRCH base="uid=pat,cn=users,cn=accounts,dc=int,dc=apexmw,dc=com" scope=0 filter="(userPassword=*)" attrs="userPassword" conn=178 op=13 RESULT err=0 tag=101 nentries=1 etime=0.0000524838 conn=178 op=14 SRCH base="uid=pat,cn=users,cn=accounts,dc=int,dc=apexmw,dc=com" scope=0 filter="(krbPrincipalKey=*)" attrs="krbPrincipalKey" conn=178 op=14 RESULT err=0 tag=101 nentries=1 etime=0.0000597589 conn=178 op=15 SRCH base="ipaUniqueID=80b23b30-6a0c-11e9-baa3-525400b52c7b,cn=sudorules,cn=sudo,dc=int,dc=apexmw,dc=com" scope=0 filter="(objectClass=*)" attrs="cn" conn=178 op=15 RESULT err=0 tag=101 nentries=1 etime=0.0000379744 conn=178 op=16 SRCH base="ipaUniqueID=5fb3a640-705a-11e9-aa05-525400b52c7b,cn=hbac,dc=int,dc=apexmw,dc=com" scope=0 filter="(objectClass=*)" attrs="cn" conn=178 op=16 RESULT err=0 tag=101 nentries=1 etime=0.0000337904 conn=178 op=17 SRCH base="cn=caacls,cn=ca,dc=int,dc=apexmw,dc=com" scope=1 filter="(&(objectClass=ipaassociation)(objectClass=ipacaacl))" attrs="serviceCategory cn ipaMemberCertProfile ipaMemberCa ipaCertProfileCategory memberUser userCategory hostCategory memberHost ipaEnabledFlag ipaCaCategory memberService description" conn=178 op=17 RESULT err=0 tag=101 nentries=2 etime=0.0001647058 conn=178 op=18 EXT oid="1.3.6.1.4.1.4203.1.11.3" name="whoami-plugin" conn=178 op=18 RESULT err=0 tag=120 nentries=0 etime=0.0000138321 conn=178 op=19 SRCH base="uid=pat,cn=users,cn=accounts,dc=int,dc=apexmw,dc=com" scope=0 filter="(objectClass=*)" attrs="userCertificate" conn=178 op=19 RESULT err=0 tag=101 nentries=1 etime=0.0001475052 - entryLevelRights: none conn=178 op=20 UNBIND conn=178 op=20 fd=114 closed - U1 To begin with, I note that this session does a BIND with 'dn=""', right at the beginning, it's essentially an anonymous bind, yah? That operation near the end, here: op=17 SRCH base="cn=caacls,cn=ca,dc=int,dc=apexmw,dc=com" scope=1 filter="(&(objectClass=ipaassociation)(objectClass=ipacaacl))" seems like it might be kinda key. and indeed, if I attempt to run this by hand as an anonymous bind, I get no results: root@apex-freeipa slapd-INT-APEXMW-COM# ldapsearch -x -h localhost -b dc=int,dc=apexmw,dc=com -s sub "(|(objectClass=ipaassociation)(objectClass=ipacaacl))" # extended LDIF # # LDAPv3 # base <dc=int,dc=apexmw,dc=com> with scope subtree # filter: (|(objectClass=ipaassociation)(objectClass=ipacaacl)) # requesting: ALL # # search result search: 2 result: 0 Success # numResponses: 1 It's only if I run this as an _authenticated_ bind, that I can find my ACL: root@apex-freeipa slapd-INT-APEXMW-COM# ldapsearch -x -D "cn=Directory Manager" -W -h localhost -b dc=int,dc=apexmw,dc=com -s sub "(&(objectClass=ipaassociation)(objectClass=ipacaacl))" cn Enter LDAP Password: # extended LDIF # # LDAPv3 # base <dc=int,dc=apexmw,dc=com> with scope subtree # filter: (&(objectClass=ipaassociation)(objectClass=ipacaacl)) # requesting: cn # # c98b740c-6903-11e9-ad1b-525400b52c7b, caacls, ca, int.apexmw.com dn: ipaUniqueID=c98b740c-6903-11e9-ad1b-525400b52c7b,cn=caacls,cn=ca,dc=int,dc =apexmw,dc=com cn: hosts_services_caIPAserviceCert # 6dde33a6-7849-11e9-aa05-525400b52c7b, caacls, ca, int.apexmw.com dn: ipaUniqueID=6dde33a6-7849-11e9-aa05-525400b52c7b,cn=caacls,cn=ca,dc=int,dc =apexmw,dc=com cn: OpenVPN_User_Certificate_ACL # search result search: 2 result: 0 Success # numResponses: 3 # numEntries: 2 Is this (using certmonger to auto-issue signed certs/keys for my openvpn users) going to be essentially impossible to do, here? Do I need to go a more traditional route of creating a seperate keystore/certdb, issuing a CSR, and feeding that to FreeIPA to sign? Any advice appreciated, and thanks in advance, -- Pat

4 6

Broken ipa replica
by Giulio Casella 08 May '22

08 May '22

Hi everyone, I'm stuck with a broken replica. I had a setup with two ipa server in replica (ipa-server-4.6.4 on CentOS 7.6), let's say "idc01" and "idc02". Due to heavy load idc01 crashed many times, and was not working anymore. So I tried to redo the replica again. At first I tried to "ipa-replica-manage re-initialize", with no success. Now I'm trying to redo from scratch the replica setup: on idc02 I removed the segments (ipa topologysegment-del, for both ca and domain suffix), on idc01 I removed everything (ipa-server-install --uninstall), then I joined domain (ipa-client-install), and everything is working so far. When doing "ipa-replica-install" on idc01 I get: [...] [28/41]: setting up initial replication Starting replication, please wait until this has completed. Update in progress, 22 seconds elapsed [ldap://idc02.my.dom.ain:389] reports: Update failed! Status: [Error (-11) connection error: Unknown connection error (-11) - Total update aborted] And on idc02 (the working server), in /var/log/dirsrv/slapd-MY-DOM-AIN/errors I find lines stating: [20/Mar/2019:09:28:06.545187923 +0100] - INFO - NSMMReplicationPlugin - repl5_tot_run - Beginning total update of replica "agmt="cn=meToidc01.my.dom.ain" (idc01:389)". [20/Mar/2019:09:28:26.528046160 +0100] - ERR - NSMMReplicationPlugin - perform_operation - agmt="cn=meToidc01.my.dom.ain" (idc01:389): Failed to send extended operation: LDAP error -1 (Can't contact LDAP server) [20/Mar/2019:09:28:26.530763939 +0100] - ERR - NSMMReplicationPlugin - repl5_tot_log_operation_failure - agmt="cn=meToidc01.my.dom.ain" (idc01:389): Received error -1 (Can't contact LDAP server): for total update operation [20/Mar/2019:09:28:26.532678072 +0100] - ERR - NSMMReplicationPlugin - release_replica - agmt="cn=meToidc01.my.dom.ain" (idc01:389): Unable to send endReplication extended operation (Can't contact LDAP server) [20/Mar/2019:09:28:26.534307539 +0100] - ERR - NSMMReplicationPlugin - repl5_tot_run - Total update failed for replica "agmt="cn=meToidc01.my.dom.ain" (idc01:389)", error (-11) [20/Mar/2019:09:28:26.561763168 +0100] - INFO - NSMMReplicationPlugin - bind_and_check_pwp - agmt="cn=meToidc01.my.dom.ain" (idc01:389): Replication bind with GSSAPI auth resumed [20/Mar/2019:09:28:26.582389258 +0100] - WARN - NSMMReplicationPlugin - repl5_inc_run - agmt="cn=meToidc01.my.dom.ain" (idc01:389): The remote replica has a different database generation ID than the local database. You may have to reinitialize the remote replica, or the local replica. It seems that idc02 remembers something about the old replica. Any hint? Thank you in advance, Giulio

5 10

IPA CA allow CSR SAN names in external domains
by Steve Dainard 14 Mar '22

14 Mar '22

Hello I have a RHEL7 IPA server installed as a subordinate CA. I'd like to be able to add SAN's for a different dns domain than exists in the IPA realm. The dns for 'otherdomain.com' is handled by active directory which my IPA server has a cross-forest trust with. ie: host: client1.ipadomain.com certificate: CN = client1.ipadomain.com, SAN = client1.ipadomain.com, servicename.otherdomain.com When I try to submit this CSR with 'ipa-getcert request' the IPA server denies with: "The service principal for subject alt name servicename.otherdomain.com in certificate request does not exist" It seems that the default CAACL enforces a profile named 'caIPAserviceCert', but I'm having some trouble determining what can be modified (or cloned and changed in a new profile) that would allow the CA to sign a CSR that contains *.ipadomain.com and *.otherdomain.com in the SAN. This is the only section in the profile that contains SAN: policyset.serverCertSet.12.constraint.class_id=noConstraintImpl policyset.serverCertSet.12.constraint.name=No Constraint policyset.serverCertSet.12.default.class_id=commonNameToSANDefaultImpl policyset.serverCertSet.12.default.name=Copy Common Name to Subject Alternative Name Thanks, Steve

3 3

freeipa with sudo and 2FA (OTP)
by John Ratliff 31 Jan '22

31 Jan '22

I'm trying to setup freeipa with OTP. I created a TOTP under my user in freeipa and updated my user to use 2FA (password + OTP). When I try to do sudo, it only asks for my password and it fails every time (presumably because it isn't getting the OTP first). I didn't see anything useful in the sss_sudo logs, even after adding debug_level = 6 in the config. What can I do to further troubleshoot this? Thanks.

4 6

IPA broken after dnf update on CentOS 8
by Vinícius Ferrão 15 Jan '22

15 Jan '22

Hello, I’ve a single IPA machine that provides authentication for itself. It does not even have any client or host. After def -y update and reboot, IPA fails to load an it’s in broken state. [root@headnode ~]# systemctl status ipa ● ipa.service - Identity, Policy, Audit Loaded: loaded (/usr/lib/systemd/system/ipa.service; enabled; vendor preset: disabled) Active: failed (Result: exit-code) since Wed 2021-01-06 16:14:48 -03; 45min ago Process: 1278 ExecStart=/usr/sbin/ipactl start (code=exited, status=1/FAILURE) Main PID: 1278 (code=exited, status=1/FAILURE) Jan 06 16:14:48 headnode.cluster.tmc.if.ufrj.br ipactl[1278]: CRL tree already moved Jan 06 16:14:48 headnode.cluster.tmc.if.ufrj.br ipactl[1278]: IPA server upgrade failed: Inspect /var/log/ipaupgrade.log and run command i> Jan 06 16:14:48 headnode.cluster.tmc.if.ufrj.br ipactl[1278]: Unexpected error - see /var/log/ipaupgrade.log for details: Jan 06 16:14:48 headnode.cluster.tmc.if.ufrj.br ipactl[1278]: CalledProcessError: CalledProcessError(Command ['/bin/systemctl', 'start', '> Jan 06 16:14:48 headnode.cluster.tmc.if.ufrj.br ipactl[1278]: The ipa-server-upgrade command failed. See /var/log/ipaupgrade.log for more > Jan 06 16:14:48 headnode.cluster.tmc.if.ufrj.br ipactl[1278]: See the upgrade log for more details and/or run /usr/sbin/ipa-server-upgrade> Jan 06 16:14:48 headnode.cluster.tmc.if.ufrj.br ipactl[1278]: Aborting ipactl Jan 06 16:14:48 headnode.cluster.tmc.if.ufrj.br systemd[1]: ipa.service: Main process exited, code=exited, status=1/FAILURE Jan 06 16:14:48 headnode.cluster.tmc.if.ufrj.br systemd[1]: ipa.service: Failed with result 'exit-code'. Jan 06 16:14:48 headnode.cluster.tmc.if.ufrj.br systemd[1]: Failed to start Identity, Policy, Audit. If asks for look on /var/log/ipaupgrade.log; but this log is just overwhelming. You must know what you should be looking for for actually find something. The relevant thing that I’ve found by myself is: 2021-01-06T19:09:51Z DEBUG The ipa-server-upgrade command failed, exception: CalledProcessError: CalledProcessError(Command ['/bin/systemctl', 'start', 'pki-tomcatd(a)pki-tomcat.service<mailto:pki-tomcatd@pki-tomcat.service>'] returned non-zero exit status 1: 'Job for pki-tomcatd(a)pki-tomcat.service<mailto:pki-tomcatd@pki-tomcat.service> failed because a timeout was exceeded.\nSee "systemctl status pki-tomcatd(a)pki-tomcat.service<mailto:pki-tomcatd@pki-tomcat.service>" and "journalctl -xe" for details.\n’) Is that Java regression again that happened a month or two ago? Thank you all.

5 7

Problems after replacing SSL certificates
by Andreas Bulling 21 Oct '21

21 Oct '21

Dear all, I have recently started using FreeIPA (4.8.1 on Ubuntu) and now wanted to replace the original SSL certificates for the web UI and the LDAP server with official ones issued by our university. I've followed the procedure described here (no errors): https://www.freeipa.org/page/Using_3rd_part_certificates_for_HTTP/LDAP I could confirm in the browser that the certificate for the web UI has been replaced and I therefore assume so has the LDAP certificate. Authentication from other hosts/services using LDAP still works but in the server log file I see errors like these for all hosts in the domain: Apr 20 19:57:11 auth krb5kdc[24895]: AS_REQ (8 etypes {18 17 20 19 16 23 25 26}) X: NEEDED_PREAUTH: host/X@X for krbtgt/X@X, Additional pre-authentication required Apr 20 19:57:11 auth krb5kdc[24895]: closing down fd 12 Apr 20 19:57:11 auth krb5kdc[24895]: AS_REQ (8 etypes {18 17 20 19 16 23 25 26}) X: ISSUE: authtime 1587405431, etypes {rep=18 tkt=18 ses=18}, host/X@X for krbtgt/X@X Apr 20 19:57:11 auth krb5kdc[24895]: closing down fd 12 Apr 20 19:57:11 auth krb5kdc[24895]: TGS_REQ (8 etypes {18 17 20 19 16 23 25 26}) X: ISSUE: authtime 1587405431, etypes {rep=18 tkt=18 ses=18}, host/X@X for ldap/X@X Apr 20 19:57:11 auth krb5kdc[24895]: closing down fd 12 Also, ipa-certupdate on the respective clients shows ipa-certupdate trying https://X/ipa/json [try 1]: Forwarding 'schema' to json server 'https://X/ipa/json' cannot connect to 'https://X/ipa/json': [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:727) The ipa-certupdate command failed. Also, I can't login to the web UI anymore. I tried ipa-getkeytab -s X -p HTTP/X@X -k /var/lib/ipa/gssproxy/http.keytab on the freeipa server (followed by ipactl restart) but this didn't help. Any idea/suggestions for how to get everything working again? Thanks a lot!

6 15

User in AD not found by IPA
by Marc Boorshtein 14 Oct '21

14 Oct '21

We added a new account to AD that has a domain trust with FreeIPA. This one user is having an issue where IPA can't find him. The user is in the same OU as other users that work fine. The user is unlocked (userAccountControl is 512) and the userprincipalname is set. When I try to add the user to an id view or an external group IPA gives me the error "trusted domain object not found" . Not really sure where to look next to figure out what's wrong. We see the user when we make LDAP calls to AD. Thanks Marc

4 14

freeIPA Status Debian/Ubuntu
by Nico Maas 08 Sep '21

08 Sep '21

Hello there, with the decline of CentOS I need to migrate away from CentOS 8 to something different. I just wanted to ask how currently the status of the Debian or Ubuntu versions of freeIPA is - and if there is any possibility to migrate freeIPA installation / "backup and restore"? Best regards, Nico

10 14

Cannot add externally-signed IPA CA certificate
by Dmitry Perets 27 Aug '21

27 Aug '21

Hi, I am trying to configure FreeIPA as a SubCA, and the "RootCA" is self-made with openssl. So I've signed the FreeIPA's request with my self-signed "root ca" certificate, but it looks like FreeIPA doesn't like it: ipa-server-install --external-cert-file=/root/rootca/rootcacert.pem --external-cert-file=/root/rootca/certs/ipacert.pem <...skipped...> ipa.ipapython.install.cli.install_tool(CompatServerMasterInstall): ERROR CA certificate CN=RootCA,OU=PRJ,O=COMPANY,L=Bonn,C=DE in /root/rootca/rootcacert.pem, /root/rootca/certs/ipacert.pem is not valid: not a CA certificate ipa.ipapython.install.cli.install_tool(CompatServerMasterInstall): ERROR The ipa-server-install command failed. See /var/log/ipaserver-install.log for more information The subj above is my self-made root CA cert, so it looks like something is missing in it. But what...? Here is it below, it has the "Basic Constraint" set with CA:TRUE... What else is required, so that FreeIPA accepts it as a root CA? Should I add it somewhere first, before running the ipa-server-install? [root@ipa ~]# openssl x509 -text -noout -in /root/rootca/rootcacert.pem Certificate: Data: Version: 3 (0x2) Serial Number: 0 (0x0) Signature Algorithm: sha256WithRSAEncryption Issuer: C=DE, L=Bonn, O=COMPANY, OU=PRJ, CN=RootCA Validity Not Before: Oct 24 11:43:13 2018 GMT Not After : Oct 21 11:43:13 2028 GMT Subject: C=DE, L=Bonn, O=COMPANY, OU=PRJ, CN=RootCA Subject Public Key Info: Public Key Algorithm: rsaEncryption Public-Key: (4096 bit) Modulus: <...skipped...> Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Subject Key Identifier: B3:18:3B:CF:29:D2:A5:D4:AE:94:A5:42:65:A2:D8:12:7C:92:78:81 X509v3 Authority Key Identifier: keyid:B3:18:3B:CF:29:D2:A5:D4:AE:94:A5:42:65:A2:D8:12:7C:92:78:81 X509v3 Basic Constraints: CA:TRUE Signature Algorithm: sha256WithRSAEncryption <...skipped...> Thanks!!

2 2

Changing directory manager password
by Ian Pilcher 29 Jul '21

29 Jul '21

Maybe it's just me, but I still find the documentation on this subject confusing. (This is probably because the docs seem to be telling me that I don't need to do anything beyond the actual password change, and I don't trust answers that seem too easy.) I running a single-node IPA 4.6.8 on RHEL 7. The actual password change with ldapmodify[1] is simple enough. Am I reading the FreeIPA documentation[2] correctly, that I don't need to perform any other steps? Thanks! [1] https://directory.fedoraproject.org/docs/389ds/howto/howto-resetdirmgrpassw… [2] https://www.freeipa.org/page/Howto/Change_Directory_Manager_Password -- ======================================================================== Ian Pilcher Sr. Principal Product Manager +1 469 892-8704 Red Hat Cloud Platforms ========================================================================

5 7

Network I/O error when trying to resolve AD users
by Ronald Wimmer 28 Jul '21

28 Jul '21

Today I set up an IPA test web application in our IPA test environment. I figured out that my AD user was resolved but the user of my colleague was not. (getent passwd userA/userB) I stopped SSSD, cleared the cache with 'rm -rf /var/lib/sss/db/*' and started SSSD again. After that I could not resolve any AD user. The sssd logs showed an Network I/O error: ==> /var/log/sssd/sssd_ipatest.mydomain.at.log <== (2021-06-30 11:46:14): [be[ipatest.mydomain.at]] [ipa_s2n_exop_done] (0x0040): ldap_extended_operation result: Operations error(1), Failed to handle the request. . (2021-06-30 11:46:14): [be[ipatest.mydomain.at]] [ipa_s2n_exop_done] (0x0040): ldap_extended_operation failed, server logs might contain more details. (2021-06-30 11:46:14): [be[ipatest.mydomain.at]] [ipa_s2n_get_user_done] (0x0040): s2n exop request failed. (2021-06-30 11:46:14): [be[ipatest.mydomain.at]] [ipa_subdomain_account_done] (0x0040): ipa_get_*_acct request failed: [1432158230]: Network I/O Error. ==> /var/log/sssd/sssd_nss.log <== (2021-06-30 11:46:14): [nss] [cache_req_common_process_dp_reply] (0x0040): CR #197: Data Provider Error: 3, 1432158230, Network I/O Error (2021-06-30 11:46:14): [nss] [cache_req_common_process_dp_reply] (0x0400): CR #197: Due to an error we will return cached data (2021-06-30 11:46:14): [nss] [cache_req_search_cache] (0x0400): CR #197: Looking up [aduser271(a)ORG.MYDOMAIN.AT] in cache (2021-06-30 11:46:14): [nss] [cache_req_search_cache] (0x0400): CR #197: Object [aduser271(a)ORG.MYDOMAIN.AT] was not found in cache (2021-06-30 11:46:14): [nss] [cache_req_process_result] (0x0400): CR #197: Finished: Not found (2021-06-30 11:46:14): [nss] [client_recv] (0x0200): Client disconnected! What the hell is going on here? Any hints would be highly appreciated! Cheers, Ronald

2 5

Compatibility Plugin .update file for Active Directory
by Joseph Fry 23 Jul '21

23 Jul '21

My goal is to use the compatibility plugin to display IPA hosts in a format that an Active Directory centric tool can consume. Essentially my solution creates two containers under cn=compat called cn=adComputers and cn=adComputerGroups. An entry is added to adComputers for every ipaHost, and attributes populated that match active directory ldap attributes for a 'computer' object. We do the same for each IPA hostgroup. I have come pretty close to getting this working, but now I need to get the groups populated with the group members, but not the IPA hosts... instead I need the members to be the corresponding cn=adComputers entries that were created. So I need to manipulate the members attribute. For example the member attribute of one of the hostgroups in ipa is: fqdn=test.lab.local,cn=computers,cn=accounts,dc=lab,dc=local I need to change it to: cn=test.lab.local,cn=adcomputers,cn=compat,dc=lab,dc=local Below is my .update file. I want to add a line at the end like: add:schema-compat-entry-attribute: member=%{member} But want to rewrite the %{member} value as described above. I know I can do some logic here, as evidenced by https://pagure.io/freeipa/blob/master/f/install/updates/80-schema_compat.up… where they use %ifeq and %%%deref_f. But I cannot find any documentation explaining what options are available. Essentially I am hoping there is some sort of regex manipulation capability here? My .update file so far: dn: cn=adComputers, cn=Schema Compatibility, cn=plugins, cn=config add:objectClass: top add:objectClass: extensibleObject add:cn: adComputers add:schema-compat-container-group: cn=compat, $SUFFIX add:schema-compat-container-rdn: cn=adComputers add:schema-compat-search-base: cn=computers, cn=accounts, $SUFFIX add:schema-compat-search-filter: (&(fqdn=*)(objectClass=ipaHost)) add:schema-compat-entry-rdn: cn=%first("%{fqdn}") add:schema-compat-check-access: yes add:schema-compat-entry-attribute: objectclass=computer add:schema-compat-entry-attribute: cn=%{fqdn} add:schema-compat-entry-attribute: sAMAccountType=805306369 add:schema-compat-entry-attribute: dNSHostName=%{fqdn} add:schema-compat-entry-attribute: operatingSystem=%{nsHardwarePlatform} add:schema-compat-entry-attribute: operatingSystemVersion=%{nsOsVersion} add:schema-compat-entry-attribute: name=%{serverHostName} add:schema-compat-entry-attribute: sAMAccountName=$$%{serverHostName} add:schema-compat-entry-attribute: location=%{nsHostLocation} dn: cn=adComputerGroups, cn=Schema Compatibility, cn=plugins, cn=config add:objectClass: top add:objectClass: extensibleObject add:cn: adComputerGroups add:schema-compat-container-group: cn=compat, $SUFFIX add:schema-compat-container-rdn: cn=adComputerGroups add:schema-compat-search-base: cn=hostgroups, cn=accounts, $SUFFIX add:schema-compat-search-filter: (&(member=*)(objectClass=ipahostgroup)) add:schema-compat-entry-rdn: cn=%{cn} add:schema-compat-entry-check-access: yes add:schema-compat-entry-attribute: objectclass=group add:schema-compat-entry-attribute: cn=%{cn} add:schema-compat-entry-attribute: groupType=-2147483646 add:schema-compat-entry-attribute: sAMAccountType=268435456 add:schema-compat-entry-attribute: name=%{cn} add:schema-compat-entry-attribute: sAMAccountName=$$%{cn}

4 24

FreeIPA server packages upgrade best practice
by Suchismita Panda 16 Jul '21

16 Jul '21

Hi, I would like to know the best practice for patching FreeIPA-Server packages. We generally have daily patching enabled in our servers. Will it be a good idea to do automatic patching of FreeIPA-Server packages? If we want to restrict the FreeIPA-Server packages from automatomatic upgrade and rather keep it for manual upgrade, what are the packages we should hold back with a version restriction? And how frequently should we do the manual upgrade? If the FreeIPA-client packages are upgraded regularly by daily patching(yum-cron or unattended upgrade) will there be any problem with authentication, if the FreeIPA-Servers are behind version upgrade? We have two FreeIPA environments, one with CentOS7 and another with CentOS8. And we have FreeIPA clients mostly with Ubuntu(18 and 20) and CentOS (7 and 8). Any help and guidance is appreciated. Thanks Suchi

4 7

healthcheck complains about a removed replica
by Kees Bakker 13 Jul '21

13 Jul '21

Hi, After installing a new replica and running /usr/bin/ipa-healthcheck --source pki.server.healthcheck.clones.connectivity_and_data I'm getting this error keyctl_search: Required key not available Enter password for Internal Key Storage Token: Internal server error HTTPSConnectionPool(host='iparep3.ghs.nl', port=443): Max retries exceeded with url: /ca/rest/certs/search?size=3 (Caused by NewConnectionError('<urllib3.connection.VerifiedHTTPSConnection object at 0x7fc473262a90>: Failed to establish a new connection: [Errno 113] No route to host',)) [ { "source": "pki.server.healthcheck.clones.connectivity_and_data", "check": "ClonesConnectivyAndDataCheck", "result": "ERROR", "uuid": "c2f3ec1d-494b-4f6a-b6e3-0e38108f2005", "when": "20210528150818Z", "duration": "30.348789", "kw": { "status": "ERROR: pki-tomcat : Internal error testing CA clone. Host: iparep3.ghs.nl Port: 443" } } ] First, it is asking for a password, and I have no clue for what. I've tried the admin password and the Directory Manager password. It makes no difference. Second, it tries to connect to a replica that was removed several months ago. Both ipa-replica-manage list and ipa-csreplica-manage show the correct list of masters that we currently have. Where does ipa-healthcheck get the information from to query the removed replica? BTW. Two replica run CentOS 8 Stream, and one runs CentOS 7. The first two give this healthcheck error, the centos7 master does not. -- Kees

5 19

IPA client + AD Trust + ID Override inconsistent lookup results
by iulian roman 07 Jul '21

07 Jul '21

Hello everybody, I try to make the above combination to work in my environment , and already spent several weeks + open a few threads with different sort of issues. So far, I can say that it works only with workarounds , restarts, clear caches, etc , which is not the setup I can move in production with. I try to provide the latest update of the setup and the issues I am currently facing: RedHat Idm with AD trust configured (non-posix) Default Trust View configured which overrides the UID and GID of the AD users The UID and GID do exist in Active Directory (the user and group have the same name) , although the group name is in different OU - I do not know if this is an issue or not On the client, some of the users are resolved, some not. If I manually run getent group <username> before running the id command, it does resolve the group and user. Without running getent group command, sometimes it resolves, sometimes not. I checked the logs on the client and server and the errors I noticed when running id <username> are: on the client: [ipa_s2n_exop_done] (0x0040): ldap_extended_operation result: No such object(32), (null) on the server: [nss] [nss_protocol_fill_initgr] (0x0080): Unable to find primary gid [2]: No such file or directory It seems to be related to the magical primary GID which seems to be the source of all my issues, but I. have no idea how to fix it (the GID exist in AD and it is defined in the Default Trust View). I am considering even changing settings in AD, but I do not know what should I change. I tried to define as well all the AD groups (for which I do group override in Default Trust View) in IPA as posix groups with that specific GID . In that situation for some users the lookup failed first time but after the negative cache expired or sssd is restarted the lookup for the user and group works properly (situation was quite similar with the one in the thread https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost… ). For AD users which do not have attributes overwritten everything works properly.

2 5

FreeIPA Upgrade F31 -> F32: usr/lib/api/apiutil.c Could not open /run/lock/opencryptoki/LCK..APIlock
by Anthony Joseph Messina 01 Jul '21

01 Jul '21

After upgrading FreeIPA from F31 to F32, on startup I now see a lot of these errors from certmonger, ns-slapd, java, etc. May 08 17:57:28 certmonger[38]: usr/lib/api/apiutil.c Could not open /run/lock/opencryptoki/LCK..APIlock May 08 17:57:30 ns-slapd[67]: usr/lib/api/apiutil.c Could not open /run/lock/opencryptoki/LCK..APIlock May 08 17:57:33 dogtag-ipa-renew-agent-submit[143]: usr/lib/api/apiutil.c Could not open /run/lock/opencryptoki/LCK..APIlock May 08 17:57:42 java[640]: usr/lib/api/apiutil.c Could not open /run/lock/opencryptoki/LCK..APIlock The server seems to come up without issue, but can you point me in the right direction to resolve these errors? freeipa-server-4.8.6-1.fc32.x86_64 opendnssec-2.1.6-5.fc32.x86_64 opencryptoki-3.13.0-1.fc32.x86_64 I've installed a fresh F32 freeipa-server (on a test domain) and I don't see these errors. Thanks. -A -- Anthony - https://messinet.com F9B6 560E 68EA 037D 8C3D D1C9 FF31 3BDB D9D8 99B6

7 9

How does FreeIPA resolve AD group names
by iulian roman 30 Jun '21

30 Jun '21

Hello everybody, Can anyone explain which attribute is used to lookup/resolve group names in AD ? As far as I can see on my ipa clients, it seems to use sAMAccountName . Is that correct ?

2 2

FreeIPA 4.9.6 released
by Alexander Bokovoy 29 Jun '21

29 Jun '21

The FreeIPA team would like to announce FreeIPA 4.9.6 release! It can be downloaded from http://www.freeipa.org/page/Downloads. Builds for Fedora distributions will be available from the official repository soon. == Highlights in 4.9.6 * 8402: [RFE] ipa-client-install forces nsupdate to bind with gssapi Invoke nsupdate without authentication if the GSS-TSIG attempt fails at install time ; configure SSSD to use nsupdate without GSS-TSIG in this case. === Enhancements === Known Issues * FreeIPA 4.9.4 contains a new LDAP caching layer that might incorrectly return data in certain cases. This is known to affect ansible-freeipa operations with automember rules. FreeIPA 4.9.6 addresses this issue. === Bug fixes FreeIPA 4.9.6 is a stabilization release for the features delivered as a part of 4.9.0 version series. There are more than 10 bug-fixes since FreeIPA 4.9.5 release. Details of the bug-fixes can be seen in the list of resolved tickets below. == Upgrading Upgrade instructions are available on Upgrade page. == Feedback Please provide comments, bugs and other feedback via the freeipa-users mailing list (https://lists.fedoraproject.org/archives/list/freeipa-users@lists.fedorahos…) or #freeipa channel on Freenode. == Resolved tickets * https://pagure.io/freeipa/issue/7752[#7752] ipa client throws http.client.ResponseNotReady error * https://pagure.io/freeipa/issue/8402[#8402] (https://bugzilla.redhat.com/show_bug.cgi?id=1854557[rhbz#1854557]) [RFE] ipa-client-install forces nsupdate to bind with gssapi * https://pagure.io/freeipa/issue/8532[#8532] (https://bugzilla.redhat.com/show_bug.cgi?id=1886837[rhbz#1886837]) Revise PKINIT upgrade code * https://pagure.io/freeipa/issue/8726[#8726] Provide a better error message with updatedns and FQDN Is not provided * https://pagure.io/freeipa/issue/8754[#8754] (https://bugzilla.redhat.com/show_bug.cgi?id=1919384[rhbz#1919384]) Certificate Serial Number issue * https://pagure.io/freeipa/issue/8817[#8817] Running ipa-server-certinstall with v1 certificate fails with Attempted "__iter__" operation on ASN.1 schema object * https://pagure.io/freeipa/issue/8880[#8880] (https://bugzilla.redhat.com/show_bug.cgi?id=1973023[rhbz#1973023]) CA_less ipa-server-install fails if CA cert subject contains non ascii chars * https://pagure.io/freeipa/issue/8882[#8882] Directly integrate custodia * https://pagure.io/freeipa/issue/8884[#8884] (https://bugzilla.redhat.com/show_bug.cgi?id=1967325[rhbz#1967325]) API returns the misleading error "Insufficient Access" if run as non-admin * https://pagure.io/freeipa/issue/8885[#8885] (https://bugzilla.redhat.com/show_bug.cgi?id=1975139[rhbz#1975139]) Upgrade error: Add failure missing required attribute "objectclass" * https://pagure.io/freeipa/issue/8889[#8889] [tests] healthcheck 0.9 * https://pagure.io/freeipa/issue/8897[#8897] (https://bugzilla.redhat.com/show_bug.cgi?id=1976286[rhbz#1976286]) ansible-freeipa automember test fails with `automember_add_condition: testgroup: 'objectclass'` due to ldap cache * https://pagure.io/freeipa/issue/8898[#8898] plugin `plugins` doesn't work -- / Alexander Bokovoy Sr. Principal Software Engineer Security / Identity Management Engineering Red Hat Limited, Finland

2 1

cache invalidation dilema on the clients
by iulian roman 29 Jun '21

29 Jun '21

Hello, I tried for some time to understand how the cache invalidation works on the clients, and I have to admit that I am even more confused that when I started, therefore I would like to ask if there is someone who can either explain or point me to the relevant documentation. I'll describe bellow the situation I am currently facing: PHASE 1 - RedHat Idm with AD trust configured (non-posix) - override the UID of AD users in Idm - on the clients run the id <username> ; the correct (overwritten ) UID and an auto-generated GID is displayed PHASE 2 - overwrite the GID as well on Idm - on the clients still the old auto-generated GID is displayed (after sss_cache -E and restart of sssd) when I run id <username> - remove everything in /var/lib/sss/db , restart sssd and run id <username> - no user found - getent group <username> - new overwritten GID is displayed - id <username> displays the correct UID and GID For the users who are not in cache, restarting sssd seems to be enough (although I did not test if thoroughly). My question is : What do I have to do on the client in order to have the latest information from the Idm Override ? Apparently sss_cache -E and restart ssssd is not enough . Do we always need to remove everything in /var/lib/sss/db in order to have the latest information from the server ?

3 4

dns of two out of three masters not up to date
by Kees Bakker 29 Jun '21

29 Jun '21

Hey, Recently I discovered that the nameservers of two out the three IPA masters (replicas) are not responding with up-to-date information. Our setup has three masters. Each is configured as nameserver. Most of the time I use one as the main master when I modify DNS entries. We also have a DHCP server that sends updates to that "main" master. What I now discovered is that updates are not available when clients use the two other masters. On all three masters the DNS record is present when I use local ldapsearch [1]. But with dig the record is only present on one master. If I restart the nameserver it then has all records available. What would be the best method to find out what is wrong? BTW. There are two things that changed recently. I mention this in case it rings a bell. 1. one master was re-installed with CentOS 8 Stream. An other CentOS8 master was added a few weeks ago. 2. our nameservers don't have connection to the Internet any more. So, root servers cannot be found. [1] by local ldapsearch I mean doing a command like this: ldapsearch -H ldapi://%2fvar%2frun%2f... -- Kees

3 8

CentOS 8 master missing plugins?
by Kees Bakker 29 Jun '21

29 Jun '21

Hey, We have three masters. One is CentOS 7, the other two are CentOS 8 Stream. I'm seeing many plugins on the CentOS 7 in cn=plugins,cn=config (about 388 entries) But on the CentOS 8 systems there are very few plugins (about 30 entries). Is that normal? BTW. I struggling with nameservers not being updated (see thread: "dns of two out of three masters not up to date"). I'm not making any progress with that. -- Kees

2 2

Password avability before change
by Karim Bourenane 28 Jun '21

28 Jun '21

Hello Team I have a small question, about a new password reseted. I have into policy password: Min availability 1 days and max 90 days That means, if I reset a password, the temporary is available 24h ? Can you confirm? FreeIPA : 4.6.5 Bien à vous Mr Karim Bourenane +33686464439 +32 493 86 63 54

2 1

Hidden replica ipa-healthcheck error ADTRUST service is not enabled
by Duncan Mortimer 28 Jun '21

28 Jun '21

Hi, We have a three node Centos 8 IPA domain which we upgraded from Centos 8.3 to 8.4 (IPA version 4.9.2) yesterday. This appeared to succeed without issue, with clients continuing to operate as expected. To give us confidence that all was well we ran ipa-healthcheck on each node post upgrade and this found no issues on our two client facing servers ipa0 and ipa1 but on the third machine, ipa2, which is configured as a hidden replica (and is used to take disaster recovery backups) we received the following error: [ { "source": "ipahealthcheck.ipa.trust", "check": "IPATrustControllerServiceCheck", "result": "ERROR", "uuid": "f5d524a3-43c3-4320-92cb-c984727243d9", "when": "20210624085009Z", "duration": "0.000512", "kw": { "key": "ADTRUST", "msg": "{key} service is not enabled" } } ] We have Samba services setup for Centos based SMB file sharing - there is no Active Directory install on our network. Is this error a concern or is it a consequence of being a hidden replica. If it is a problem, how might we go about fixing the issue? As a first step I've tried re-running ipa-adtrust and this didn't seem to need to make any changes: The log file for this installation can be found in /var/log/ipaserver-adtrust-install.log ============================================================================== This program will setup components needed to establish trust to AD domains for the IPA Server. This includes: * Configure Samba * Add trust related objects to IPA LDAP server To accept the default shown in brackets, press the Enter key. Configuring cross-realm trusts for IPA server requires password for user 'admin'. This user is a regular system account used for IPA server administration. admin password: IPA generated smb.conf detected. Overwrite smb.conf? [no]: yes The following operations may take some minutes to complete. Please wait until the prompt is returned. Configuring CIFS [1/24]: validate server hostname [2/24]: stopping smbd [3/24]: creating samba domain object Samba domain object already exists [4/24]: retrieve local idmap range [5/24]: writing samba config file [6/24]: creating samba config registry [7/24]: adding cifs Kerberos principal [8/24]: adding cifs and host Kerberos principals to the adtrust agents group [9/24]: check for cifs services defined on other replicas [10/24]: adding cifs principal to S4U2Proxy targets cifs principal already targeted, nothing to do. [11/24]: adding admin(group) SIDs Admin SID already set, nothing to do Admin group SID already set, nothing to do [12/24]: adding RID bases RID bases already set, nothing to do [13/24]: updating Kerberos config 'dns_lookup_kdc' already set to 'true', nothing to do. [14/24]: activating CLDAP plugin CLDAP plugin already configured, nothing to do [15/24]: activating sidgen task Sidgen task plugin already configured, nothing to do [16/24]: map BUILTIN\Guests to nobody group [17/24]: configuring smbd to start on boot [18/24]: enabling trusted domains support for older clients via Schema Compatibility plugin [19/24]: restarting Directory Server to take MS PAC and LDAP plugins changes into account [20/24]: adding fallback group Fallback group already set, nothing to do [21/24]: adding Default Trust View Default Trust View already exists. [22/24]: setting SELinux booleans [23/24]: starting CIFS services [24/24]: restarting smbd Done configuring CIFS. ============================================================================= Setup complete You must make sure these network ports are open: TCP Ports: * 135: epmap * 138: netbios-dgm * 139: netbios-ssn * 445: microsoft-ds * 1024..1300: epmap listener range * 3268: msft-gc UDP Ports: * 138: netbios-dgm * 139: netbios-ssn * 389: (C)LDAP * 445: microsoft-ds See the ipa-adtrust-install(1) man page for more details ============================================================================= But there is no change in ipahealthcheck output. Regards, Duncan -- Duncan Mortimer

3 4

FreeIPA w. letsencrypt for HTTPS/LDAP failing to communicate with itself
by Chris Moody 28 Jun '21

28 Jun '21

Hello folks. Hopefully I'm just missing something face-palm level obvious, but I am running into some trouble when interfacing with my CA functionality on an IPA server cluster. My attempts at scouring all my saved prior-comms from the mailing-list as well as several search-engines are not enchanting me with much clue. It appears that my need for the LetsEncrypt certs for the user-facing Web-UI and LDAPs components are causing IPA to dis-trust itself. === 4-node cluster - Ubuntu19.10 (all nodes currently fully updated/patched via the official Ubuntu repos) === ipa --version VERSION: 4.8.1, API_VERSION: 2.233 === running letsencrypt certificates successfully for HTTPs & LDAPs connectivity === These 4-nodes are all happily running and replicating betwixt each other. LDAPs is functioning great and many linux systems are able to all join as freeipa-clients. Users and groups are replicating and being used elegantly for many LDAP-based authentication/authorization needs. Overall, for these nodes, life is good. Where I'm running into trouble is in finally wanting to leverage certificate issuance on a per-user basis. End goal is integrating things like yubikeys, user-cert auth, and so on. In the UI, when I enter a user's account and select Actions->New Certificate, I am able to successfully issue the couple prompted 'certutil' commands to generate the user's CSR. I then paste in the contents of the CSR and hit 'Issue' and run into the following error: ========== IPA Error 907: NetworkError cannot connect to 'https://REDACTED-1.ipa.REDACTED.com:443/ca/rest/account/login': [SSL: TLSV1_ALERT_UNKNOWN_CA] tlsv1 alert unknown ca (_ssl.c:2508) ========== As I then start digging into cli-mode to attempt to understand where things are unhappy, I run into similar troubles with the server attempting to talk to itself and not being very happy about it. ========== chris@REDACTED-1:~$ ipa ca-find ------------ 1 CA matched ------------ Name: ipa Description: IPA CA Authority ID: 8acca54b-64d7-44bf-b8f7-59316213cfb6 Subject DN: CN=Certificate Authority,O=IPA.REDACTED.COM Issuer DN: CN=Certificate Authority,O=IPA.REDACTED.COM ---------------------------- Number of entries returned 1 ---------------------------- chris@REDACTED-1:~$ ipa ca-show Name: ipa ipa: ERROR: cannot connect to 'https://REDACTED-1.ipa.REDACTED.com:443/ca/rest/account/login': [SSL: TLSV1_ALERT_UNKNOWN_CA] tlsv1 alert unknown ca (_ssl.c:2508) ========== Verifying with 'openssl s_client' returns the valid and non-expired LE cert-chain. ========== chris@REDACTED-1:~$ openssl s_client REDACTED-1.ipa.REDACTED.com:443 CONNECTED(00000003) depth=2 O = Digital Signature Trust Co., CN = DST Root CA X3 verify return:1 depth=1 C = US, O = Let's Encrypt, CN = R3 verify return:1 depth=0 CN = REDACTED-1.ipa.REDACTED.com verify return:1 --- Certificate chain 0 s:CN = REDACTED-1.ipa.REDACTED.com i:C = US, O = Let's Encrypt, CN = R3 1 s:C = US, O = Let's Encrypt, CN = R3 i:O = Digital Signature Trust Co., CN = DST Root CA X3 --- ...<output-truncated>... --- SSL handshake has read 3046 bytes and written 413 bytes Verification: OK --- New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384 Server public key is 2048 bit Secure Renegotiation IS NOT supported Compression: NONE Expansion: NONE No ALPN negotiated Early data was not sent Verify return code: 0 (ok) ...<output-truncated>... ========== Can anyone please hit me with some clue-bat as to where I can read to understand how to get IPA to love itself? I'm suspecting it's likely some certificate inclusion/exception that I need to add so that API calls and the ipa command itself will actually respect the LE cert-chain? Any hints would be greatly appreciated. Thanks, -Chris -- Node-Nine, Inc. chris(a)node-nine.com 619.354.6463

4 8

HP LaserJet Pro MFP M428fdw and scan to freeipa samba share
by Николай Савельев 28 Jun '21

28 Jun '21

2 2

compat branch not browseable
by Joseph Fry 25 Jun '21

25 Jun '21

I am just curious why the cn=compat,dc=mydomain,dc=org container cannot be reached when I bind to dc=mydomain,dc=org, but I can see it if I bind directly to it. Is there any way to expose it?

2 4

Get date user was deleted and preserved
by Tania Hagan 24 Jun '21

24 Jun '21

Hi, Is there a way to get the date and time a user was deleted and preserved (ipa user-del --preserve) and if possible by who? Many Thanks, Tania

1 0

Re: How to blend IPA server 4.1.4 on F21 with server 4.6.8 on C7?
by Bret Wortman 24 Jun '21

24 Jun '21

I cleaned up the contents of our ldap manually, re-created the replica file, and got a lot further than we have before but ipa-replica-install still failed as below: Configuring certificate server (pki-tomcatd). Estimated time: 3 minutes [1/30]: configuring certificate server instance ipaserver.install.dogtaginstance: CRITICAL Failed to configure CA instance: Command '/usr/sbin/pkispawn -s CA -f /tmp/tmphvJyRY' returned non-zero exit status 1 ipaserver.install.dogtaginstance: CRITICAL See the installation logs and the following files/directories for more information: ipaserver.install.dogtaginstance: CRITICAL /var/log/pki/pki-tomcat [error] RuntimeError: CA configuration failed. Your system may be partly configured. Run /usr/sbin/ipa-server-install --uninstall to clean up. ipapython.admintool: ERROR CA configuration failed. ipapython.admintool: ERROR The ipa-replica-install command failed. See /var/log/ipareplica-install.log for more information [root@ipa2c7 ~]# ipa-server-install --uninstall -U ipapython.admintool: ERROR Unable to read /etc/httpd/conf.d/ipa-pki-proxy.conf ipapython.admintool: ERROR The ipa-server-install command failed. See /var/log/ipaserver-uninstall.log for more information [root@ipa2c7 ~]# touch /etc/httpd/conf.d/ipa-pki-proxy.conf [root@ipa2c7 ~]# ipa-server-install --uninstall -U Deleting this server will leave your installation without a CRL generation master. ipapython.admintool: ERROR Aborting uninstall operation. ipapython.admintool: ERROR The ipa-server-install command failed. See /var/log/ipaserver-uninstall.log for more information It looks to have failed in such a way that it doesn't know how to back out again, which I haven't seen before. Thoughts? The error in ipa-uninstall.log looks like a generic admintool.py error: 2021-06-07T12:31:38Z DEBUG retrieving schema for SchemaCache url=ldapi://%2fvar%2frun%2fslapd-OUR-NET.socket conn=<ldap.ldapobject.SimpleLDAPObject instance at 0x7f05289fdf80> 2021-06-07T12:31:38Z DEBUG raw: config_show(version=u'2.237') 2021-06-07T12:31:38Z DEBUG config_show(rights=False, all=False, raw=False, version=u'2.237') 2021-06-07T12:31:38Z DEBUG File "/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 178, in execute return_value = self.run() File "/usr/lib/python2.7/site-packages/ipapython/install/cli.py", line 319, in run return cfgr.run() File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 358, in run self.validate() File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 368, in validate for _nothing in self._validator(): File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 431, in __runner exc_handler(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 455, in _handle_validate_exception self._handle_exception(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 450, in _handle_exception six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 421, in __runner step() File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 418, in <lambda> step = lambda: next(self.__gen) File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from value = gen.send(prev_value) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 633, in _configure next(validator) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 431, in __runner exc_handler(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 455, in _handle_validate_exception self._handle_exception(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 518, in _handle_exception self.__parent._handle_exception(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 450, in _handle_exception six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 515, in _handle_exception super(ComponentBase, self)._handle_exception(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 450, in _handle_exception six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 421, in __runner step() File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 418, in <lambda> step = lambda: next(self.__gen) File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from value = gen.send(prev_value) File "/usr/lib/python2.7/site-packages/ipapython/install/common.py", line 73, in _uninstall for unused in self._uninstaller(self.parent): File "/usr/lib/python2.7/site-packages/ipaserver/install/server/__init__.py", line 594, in main uninstall_check(self) File "/usr/lib/python2.7/site-packages/ipaserver/install/server/install.py", line 250, in decorated func(installer) File "/usr/lib/python2.7/site-packages/ipaserver/install/server/install.py", line 1030, in uninstall_check ca.uninstall_check(options) File "/usr/lib/python2.7/site-packages/ipaserver/install/ca.py", line 127, in uninstall_check raise ScriptError("Aborting uninstall operation.") 2021-06-07T12:31:38Z DEBUG The ipa-server-install command failed, exception: ScriptError: Aborting uninstall operation. 2021-06-07T12:31:38Z ERROR Aborting uninstall operation. 2021-06-07T12:31:38Z ERROR The ipa-server-install command failed. See /var/log/ipaserver-uninstall.log for more information -- Bret Wortman bret.wortman(a)damascusgrp.com On Fri, Jun 4, 2021, at 1:32 PM, Bret Wortman wrote: > Boom. Looking through the ldifs now. Thanks again, Rob. > > -- > Bret Wortman > bret.wortman(a)damascusgrp.com > > On Fri, Jun 4, 2021, at 1:22 PM, Rob Crittenden wrote: > > Bret Wortman wrote: > > > What's dsctl? I don't see that anywhere on any of my servers (including the more up-to-date ones). My 389 instance is v1.3.3, if that makes a difference... > > > > > > > > > > Right, really old release. > > > > Try: db2ldif -n userRoot -Z EXAMPLE-TEST -a /path/to/ldif/file > > > > To get the CA ldif replace userRoot with ipaca. > > > > rob > > > > >

2 33

Re: Join command 500 errors, timeouts
by Alfred Victor 23 Jun '21

23 Jun '21

Hi FreeIPA list, I did verify UDP is making it but for some reason ntpd commands fail in the join anyway (seemingly by timeout), I'm not sure why yet but for now we use --no-ntp after setting time just after boot so this isn't an issue. Curious if anyone can spot anything helpful in those logs above please, or how we can debug further to find out why our joins fail? The 401 not authorized seems to be really pretty mysterious, and I'm not sure if that "Matching credential not found" log message is a clue. Likewise, the "No permission to join" and "Cannot contact any KDC" are troubling, and I'm not sure if this is a clue below. So far I haven't managed to identify a network problem and log messages seem few and far between for the nodes which fail joins. Shared previously: ./krb5kdc.log:389805:Jun 21 14:12:07 hipa0002.redac.com krb5kdc[4746](info): DISPATCH: repeated (*retransmit*ted?) request from 10.2.11.17, resending previous response Alfred On Tue, Jun 22, 2021 at 1:12 AM Angus Clarke <angus(a)charworth.com> wrote: > Hello > > I've not been following the whole topic but you can replace your UDP > listener with netcat and indeed use netcat to simulate a client initiation > too. This could help tell you whether your network is permitting that > traffic or not. > > Duckduckgo found me this which looks suitable > > https://fsferrara.github.io/2020/08/02/sending-and-receiving-packets-using-… > > Regards > Angus > > ------------------------------ > *From:* Alfred Victor via FreeIPA-users < > freeipa-users(a)lists.fedorahosted.org> > *Sent:* Tuesday, June 22, 2021 12:24:32 AM > *To:* Rob Crittenden <rcritten(a)redhat.com> > *Cc:* FreeIPA users list <freeipa-users(a)lists.fedorahosted.org>; Alfred > Victor <alvic266(a)gmail.com> > *Subject:* [Freeipa-users] Re: Join command 500 errors, timeouts > > Thanks again. I've enabled trace and will see what I find. I do know there > may be an issue with UDP because it would log ntp failures until I did > --no-ntp, but the port is open on firewall both sides so I believe the > network is failing to deliver UDP. > > Alfred > > On Mon, Jun 21, 2021 at 4:39 PM Rob Crittenden <rcritten(a)redhat.com> > wrote: > > Alfred Victor wrote: > > Hi Rob and FreeIPA list, > > > > I wish I was able to say we are seeing success but aside from no longer > > having the krb5kdc.log log spam, we still experience a lot of join > > failures. However rather than seeing a ton of timeouts (still a few but > > much less), we get a lot of errors like below, which totally puzzle us > > as the ipactl services all report up, and mach_join account should have > > sufficient privilege. I will note we have our own non-IPA DNS solution > > where we have added all the records IPA should need but I can't see why > > this change would cause our errors (and indeed all the output of "ipa > > *dns*-update-system-records --dry-run" looks ok, not that below errors > > appear DNS related but its the only change I can think of aside from > > having replaced our IPA hosts with re-replicated new builds.) > > > > This works fine on rerun of install, and I don't see any evidence of > > service failure on the system this happened against, but neither am I > > aware of any intermittent network problem (perhaps there is a network > > problem on the very first connection to IPA we have not identified? but > > I would expect different errors than the 401 under this for instance) > > > > 2021-06-21T19:12:05Z DEBUG Initializing principal > > mach_join(a)redac.COM using password > > 2021-06-21T19:12:05Z DEBUG Starting external process > > 2021-06-21T19:12:05Z DEBUG args=/usr/bin/kinit mach_join(a)redac.COM > > -c /tmp/krbcc_xp2E2/ccache > > 2021-06-21T19:12:24Z DEBUG Process finished, return code=1 > > 2021-06-21T19:12:24Z DEBUG stdout= > > 2021-06-21T19:12:24Z DEBUG stderr=kinit: Cannot contact any KDC for > > realm 'redac.COM' while getting initial credentials > > 2021-06-21T19:12:24Z INFO Please make sure the following ports are > > opened in the firewall settings: > > TCP: 80, 88, 389 > > UDP: 88 (at least one of TCP/UDP ports 88 has to be open) > > Also note that following ports are necessary for ipa-client working > > properly after enrollment: > > TCP: 464 > > UDP: 464, 123 (if NTP enabled) > > 2021-06-21T19:12:24Z ERROR Installation failed. Rolling back changes. > > > > > > > > But then we also see things like this predominantly, in fact this seems > > now to be the largest category of failure we observe at the highest rate > > and makes no sense to me, because the mach_join account privileges > > should not be changing: > > > > 2021-06-17T19:29:11Z DEBUG args=/usr/sbin/ipa-join -s > > hipa0003.redac.com > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fhipa0003.…> > <http://hipa0003.redac.com > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fhipa0003.…>> > -b dc=redac,dc=com -h > > hred2-4-18.redac.com > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fhred2-4-1…> > <http://hred2-4-18.redac.com > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fhred2-4-1…>> > -f > > 2021-06-17T19:29:31Z DEBUG Process finished, return code=17 > > 2021-06-17T19:29:31Z DEBUG stdout= > > 2021-06-17T19:29:31Z DEBUG stderr=HTTP response code is 401, not 200 > > 2021-06-17T19:29:31Z ERROR Joining realm failed: HTTP response code > > is 401, not 200 > > > > > > > > Some more like this, but not quite the same error: > > > > > > 2021-06-17T19:29:32Z DEBUG get_ca_certs_from_ldap() error: > > Insufficient access: SASL(-1): generic failure: GSSAPI Error: > > Unspecified GSS failure. Minor code may provide more information > > (Cannot contact any KDC for realm 'redac.COM') > > 2021-06-17T19:29:32Z DEBUG Insufficient access: SASL(-1): generic > > failure: GSSAPI Error: Unspecified GSS failure. Minor code may > > provide more information (Cannot contact any KDC for realm > 'redac.COM') > > > > > > And still another example: > > > > > > > > > > 2021-06-17T22:25:37Z DEBUG args=/usr/sbin/ipa-join -s > > hipa0001.redac.com > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fhipa0001.…> > <http://hipa0001.redac.com > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fhipa0001.…>> > -b dc=redac,dc=com -h > > hred2-4-18.redac.com > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fhred2-4-1…> > <http://hred2-4-18.redac.com > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fhred2-4-1…>> > -f > > 2021-06-17T22:25:41Z DEBUG Process finished, return code=17 > > 2021-06-17T22:25:41Z DEBUG stdout= > > 2021-06-17T22:25:41Z DEBUG stderr=No permission to join this host to > > the IPA domain. > > 2021-06-17T22:25:41Z ERROR Joining realm failed: No permission to > > join this host to the IPA domain. > > 2021-06-17T22:25:41Z ERROR Installation failed. Rolling back changes. > > > > Any thoughts or ideas please? > > Some of these could be network issues. I'd run ipa-client-install with > Kerberos tracing: > > KRB5_TRACE=/path/to/some/log ipa-client-install <options> > > So that on failure you can see what KDCs were available, whether one was > contacted, etc. > > rob > > > > > Alfred > > > > > > On Tue, Jun 15, 2021 at 3:19 PM Rob Crittenden <rcritten(a)redhat.com > > <mailto:rcritten@redhat.com>> wrote: > > > > Alfred Victor wrote: > > > I don't see a directive equivalent of SECURE_NFS to add to > > nfs.conf (all > > > documentation seems to still refer to the sysconfig path), or is > > it the > > > same? Can I just disable rpcgssd? We have no nfs mounts which are > > > kerberized yet, and disabling rpcgssd seems to solve our problem, > > and I > > > can kinit after disabling rpcgssd. It also does not seem that > > disabling > > > rpcgssd hurts running tasks or node, but would like to confirm it's > > > limited to nfs in function. I still have to wonder if there's a > > better way. > > > > I suspect that SECURE_NFS is a no-op these days. It was necessary in > > RHEL 5/6 for sure. > > > > Yes, I think you can safely disable the service. In some versions of > > RHEL/Fedora IIRC this is symlinked to nfs-secure-server so mask that > as > > well. > > > > rob > > > > > > > > Alfred > > > > > > On Tue, Jun 15, 2021 at 10:31 AM Alexander Bokovoy > > <abokovoy(a)redhat.com <mailto:abokovoy@redhat.com> > > > <mailto:abokovoy@redhat.com <mailto:abokovoy@redhat.com>>> wrote: > > > > > > On ti, 15 kesä 2021, Alfred Victor via FreeIPA-users wrote: > > > >Hi Rob, > > > > > > > >We attempted setting sec=sys on the mount, however to our > > surprise > > > found > > > >this didn't work. We then figured out that IPA install is > adding > > > this to > > > >/etc/sysconfig/nfs: > > > > > > > >SECURE_NFS=yes > > > > > > > > > > > >We tried removing this to no avail and restarting all the > related > > > sytstemd > > > >units (rpcgssd, nfs, etc). Any idea why sec=sys is being > ignored? > > > Should we > > > >need to set SECURE_NFS=no? On non-IPA nodes this directive > > does not > > > exist > > > >at all. For now, I have also totally disabled rpcgssd as I > think > > > this unit > > > >may be responsible ( it seems that it does the upcall in > > > >https://access.redhat.com/solutions/225783 > <https://emea01.safelinks.protection.outlook.com/?url=https%3A%2F%2Faccess.r…> > ) so I will hope > > that this > > > >solves it, I don't believe anything else depends on rpcgssd > but > > > will soon > > > >find out. Any suggestions please? :) > > > > > > Depends on nfs-utils version? I remember there had been a > > change in > > > configuration in upstream nfs-utils in 2019: > > > > > > commit c69875c8afdd877baf7139c0cd5241f70105cbd4 > > > Author: François Cami <fcami(a)redhat.com > > <mailto:fcami@redhat.com> <mailto:fcami@redhat.com > > <mailto:fcami@redhat.com>>> > > > Date: Tue Feb 26 13:59:06 2019 +0100 > > > > > > ipa-client-automount: handle NFS configuration file > changes > > > > > > nfs-utils in Fedora 30 and later switched its > configuration > > > file from /etc/sysconfig/nfs to /etc/nfs.conf, providing a > > > conversion service (nfs-convert.service) for upgrades. > > > However, for new installs the original configuration file > > > is missing. This change: > > > * adds a tuple-based osinfo.version_number method to > handle > > > more kinds of OS versioning schemes > > > * detects RHEL and Fedora versions with the the new > nfs-utils > > > behavior > > > * avoids backing up the new NFS configuration file as we > do > > > not have to modify it. > > > > > > See: https://bugzilla.redhat.com/show_bug.cgi?id=1676981 > <https://emea01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fbugzilla…> > > > > > > Fixes: https://pagure.io/freeipa/issue/7868 > <https://emea01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fpagure.i…> > > > > > > > > > > > > > >Alfred > > > > > > > >On Thu, Jun 10, 2021 at 2:17 PM Rob Crittenden > > <rcritten(a)redhat.com <mailto:rcritten@redhat.com> > > > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com>>> > wrote: > > > > > > > >> Alfred Victor wrote: > > > >> > Thanks very much Rob et al! I believe we have found our > root > > > cause and > > > >> > the fix. If you like I'll provide some more details after > > we're > > > done > > > >> > with everything. > > > >> > > > >> Yes, knowing the cause would be great and could be helpful > > to others! > > > >> > > > >> cheers > > > >> > > > >> rob > > > >> > > > >> > > > > >> > Alfred > > > >> > > > > >> > On Thu, Jun 10, 2021 at 11:02 AM Rob Crittenden > > > <rcritten(a)redhat.com <mailto:rcritten@redhat.com> > > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com>> > > > >> > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com> > > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com>>>> wrote: > > > >> > > > > >> > Alfred Victor wrote: > > > >> > > Hi all, > > > >> > > > > > >> > > Just curious if anyone has suggestions about that > > please > > > before I > > > >> get > > > >> > > going in a couple of hours with conversions to IPA > > again? > > > I did > > > >> > the math > > > >> > > and 1,097,471 log messages in 5 hours is about 60 > > times per > > > >> second, so > > > >> > > I'm gradually becoming more certain this is why we > can > > > only boot > > > >> 20-30 > > > >> > > nodes at a time when we used to boot hundreds. > However, > > > this is > > > >> still > > > >> > > just a guess as I don't know the mechanism behind > > why this > > > >> interferes > > > >> > > with IPA joins, some bottleneck with the KDC? > > > >> > > > > >> > It sure seems like this is a kerberized NFS request > for a > > > host that > > > >> > doesn't provide it, or doesn't have an nfs principal. > I > > > think you'd > > > >> need > > > >> > to monitor the offending client to see what it is > doing. > > > >> > > > > >> > If the KDC is being dramatically slowed down by this > then > > > yes, you > > > >> could > > > >> > see slower Apache performance because it needs to > obtain > > > tickets on > > > >> > behalf of the user doing the join. Whether that would > > represent > > > >> itself > > > >> > as a read timeout I don't know. > > > >> > > > > >> > rob > > > >> > > > > >> > > > > > >> > > Alfred > > > >> > > > > > >> > > On Wed, Jun 9, 2021 at 3:49 PM Alfred Victor > > > <alvic266(a)gmail.com <mailto:alvic266@gmail.com> > > <mailto:alvic266@gmail.com <mailto:alvic266@gmail.com>> > > > >> > <mailto:alvic266@gmail.com > > <mailto:alvic266@gmail.com> <mailto:alvic266@gmail.com > > <mailto:alvic266@gmail.com>>> > > > >> > > <mailto:alvic266@gmail.com > > <mailto:alvic266@gmail.com> <mailto:alvic266@gmail.com > > <mailto:alvic266@gmail.com>> > > > <mailto:alvic266@gmail.com <mailto:alvic266@gmail.com> > > <mailto:alvic266@gmail.com <mailto:alvic266@gmail.com>>>>> wrote: > > > >> > > > > > >> > > Hi Rob, > > > >> > > > > > >> > > I have reduced that timeout and will tune it > > further. > > > >> > Regarding ISE > > > >> > > errors, I think we can make the assumption that > > this is > > > >> > entirely an > > > >> > > issue of the web timeouts, I haven't seen any > > evidence > > > >> > otherwise and > > > >> > > will have another attempt at converting nodes > > > tomorrow, and > > > >> with a > > > >> > > keener eye of what to look for I can make a > better > > > >> determination > > > >> > > then. I am most concerned over what the > underlying > > > cause might > > > >> be > > > >> > > causing it to take too long and hit the > > timeout, and > > > don't > > > >> want to > > > >> > > engineer around this by changing Apache > timeouts if > > > we can > > > >> instead > > > >> > > address the root cause. I am suspicious of krb > log > > > messages > > > >> > flooding > > > >> > > our IPA systems about a service principal like > so, > > > but not > > > >> sure if > > > >> > > this is gumming up the works (or even why this > > > message has > > > >> started > > > >> > > appearing since the rebuild): > > > >> > > > > > >> > > ./krb5kdc.log:Jun 09 10:38:51 > > redacted.redacted.com > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fredacted.…> > <http://redacted.redacted.com > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fredacted.…> > > > > > <http://redacted.redacted.com > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fredacted.…> > > > > > >> > <http://redacted.redacted.com > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fredacted.…> > > > > <http://redacted.redacted.com > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fredacted.…> > > > > > >> > krb5kdc[31187](info): TGS_REQ (4 etypes {18 17 16 23}) > > > 10.1.1.27 > > > >> > <http://10.1.1.27 > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2F10.1.1.27…>>: > LOOKING_UP_SERVER: authtime 0, > > > >> > host/redacted.redacted.com(a)redacted.COM for > > > >> > nfs/nfsserver.redacted.com(a)redacted.COM, Server not > > found in > > > >> > Kerberos database > > > >> > > > > > >> > > > > > >> > > Just in the last 5 hours alone, this log > > message and > > > others > > > >> > like it (main difference is just the nodename it > > > references) has > > > >> > appeared 1,097,471 times. Conceivably there is also > some > > > log write > > > >> > locking or something going on that could be slowing > IPA > > > down and > > > >> > leading to our symptom here? > > > >> > > > > > >> > > Alfred > > > >> > > > > > >> > > > > > >> > > On Wed, Jun 9, 2021 at 9:19 AM Rob Crittenden > > > >> > <rcritten(a)redhat.com <mailto:rcritten@redhat.com> > > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com>> > > > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com> > > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com>>> > > > >> > > <mailto:rcritten@redhat.com > > <mailto:rcritten@redhat.com> > > > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com>> > > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com> > > > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com>>>>> > > > >> wrote: > > > >> > > > > > >> > > Alfred Victor wrote: > > > >> > > > Hi Rob, > > > >> > > > > > > >> > > > We did revert to 60s - I seem to remember > > some > > > ldapsearch > > > >> > > timing out > > > >> > > > previously but maybe we could still > greatly > > > reduce this > > > >> with > > > >> > > no ill > > > >> > > > effect. However, we saw no change in join > > > success either > > > >> way > > > >> > > and I have > > > >> > > > not changed anything in Apache as I would > > need > > > to find > > > >> the > > > >> > > exact values > > > >> > > > in question and I think these directive > > changes > > > may get > > > >> lost > > > >> > > with an > > > >> > > > update? The timeout/ISE issues are new - > we > > > previously > > > >> > booted > > > >> > > many nodes > > > >> > > > concurrently (400+) without problems but > > now it > > > happens > > > >> even > > > >> > > booting as > > > >> > > > few as 50 results in 10-20 timeouts or > ISE. > > > This has > > > >> > been the > > > >> > > case at > > > >> > > > least since we rebuilt and re-replicated > the > > > environment > > > >> by > > > >> > > swapping IPA > > > >> > > > members out of the old one, but maybe > this is > > > unrelated. > > > >> > Is it > > > >> > > possible > > > >> > > > we landed on a newer version with > > different timeout > > > >> > values? Is it > > > >> > > > possible that IPA is under slightly more > load > > > from the > > > >> > higher > > > >> > > number of > > > >> > > > nodes and has some bottleneck since we > > last did > > > >> conversions? > > > >> > > We have not > > > >> > > > been able to substantiate the latter by > > looking at > > > >> > > CPU/memory/io trends. > > > >> > > > What might we investigate next to see if > > we may > > > have > > > >> missed > > > >> > > some ongoing > > > >> > > > issue that could for instance cause > locking > > > problems or > > > >> > > something else > > > >> > > > internally in IPA to explain our symptoms? > > > Also, I have > > > >> > > observed some > > > >> > > > nodes which report a successful > > installation of IPA > > > >> client, > > > >> > > but have in > > > >> > > > fact a lot of failures, for instance with > > > mounts not > > > >> > working from > > > >> > > > automount setup. We will need to try to > > > reproduce this to > > > >> > > understand > > > >> > > > what happened I think as we have already > > sorted > > > those > > > >> nodes > > > >> > > elsewhere > > > >> > > > and they have got going outside of IPA. > > > >> > > > > > > >> > > > I am interested that you suggested "at > least > > > some of the > > > >> > > clients aren't > > > >> > > > connecting at all and increasing the > timeout > > > could make > > > >> this > > > >> > > worse" - > > > >> > > > this might indicate some sort of network > > problem at > > > >> > play, but > > > >> > > as far as > > > >> > > > I am aware, everything is working absent > > IPA so > > > I do not > > > >> > > suspect it > > > >> > > > presently. > > > >> > > > > > >> > > A 60 second LDAP timeout is still way too > big. > > > The default > > > >> > is 2. > > > >> > > Unless > > > >> > > you are seeing timeouts I'd suggest > > lowering it. > > > >> > > > > > >> > > I'm only seeing hints to what you're seeing > and > > > the scope > > > >> so > > > >> > > it's hard > > > >> > > to make further suggestions. Are all the > > internal > > > errors > > > >> the > > > >> > > same, for > > > >> > > example? Are some failing due to LDAP > > timeouts or > > > are they > > > >> all > > > >> > > wsgi read > > > >> > > timeouts? > > > >> > > > > > >> > > The Apache request timeout can be > configured in > > > httpd.conf > > > >> > which is > > > >> > > independent of the config files that IPA > > > currently writes > > > >> > so it > > > >> > > should > > > >> > > survive upgrades. > > > >> > > > > > >> > > rob > > > >> > > > > > > >> > > > Alfred > > > >> > > > > > > >> > > > On Mon, Jun 7, 2021 at 4:42 PM Rob > Crittenden > > > >> > > <rcritten(a)redhat.com > > <mailto:rcritten@redhat.com> <mailto:rcritten@redhat.com > > <mailto:rcritten@redhat.com>> > > > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com> > > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com>>> > > > >> > <mailto:rcritten@redhat.com > > <mailto:rcritten@redhat.com> <mailto:rcritten@redhat.com > > <mailto:rcritten@redhat.com>> > > > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com> > > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com>>>> > > > >> > > > <mailto:rcritten@redhat.com > > <mailto:rcritten@redhat.com> > > > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com>> > > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com> > > > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com>>> > > > >> > <mailto:rcritten@redhat.com > > <mailto:rcritten@redhat.com> <mailto:rcritten@redhat.com > > <mailto:rcritten@redhat.com>> > > > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com> > > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com>>>>>> wrote: > > > >> > > > > > > >> > > > Alfred Victor wrote: > > > >> > > > > Actually, no change happened from > > 300-> 600 > > > >> > timeout, the > > > >> > > web portal > > > >> > > > > itself gave me an ISE I hadn't > noticed > > > when I tried > > > >> > > clicking save! > > > >> > > > > > > >> > > > I wasn't clear which log to look in. > > You'll see > > > >> details > > > >> > > about where the > > > >> > > > error is caught in IPA in the Apache > > log. > > > To see > > > >> LDAP > > > >> > > timeouts you look > > > >> > > > for err=3 in the 389-ds access log. > > > >> > > > > > > >> > > > But since you posted a traceback this > > time it's > > > >> > clear that > > > >> > > this is just > > > >> > > > Apache waiting for client data to > read so > > > any tuning > > > >> you > > > >> > > do needs to be > > > >> > > > in Apache. You could try tuning > > Timeout which > > > >> > defaults to > > > >> > > 60 but this > > > >> > > > doesn't seem likely to help since at > > least > > > some of > > > >> the > > > >> > > clients aren't > > > >> > > > connecting at all and increasing the > > > timeout could > > > >> make > > > >> > > this worse. > > > >> > > > > > > >> > > > Please revert the searchtimeout. 300 > > seconds is > > > >> > orders of > > > >> > > magnitude > > > >> > > > too big. > > > >> > > > > > > >> > > > rob > > > >> > > > > > > >> > > > > > > > >> > > > > Alfred > > > >> > > > > > > > >> > > > > On Mon, Jun 7, 2021 at 3:57 PM > > Alfred Victor > > > >> > > <alvic266(a)gmail.com > > <mailto:alvic266@gmail.com> <mailto:alvic266@gmail.com > > <mailto:alvic266@gmail.com>> > > > <mailto:alvic266@gmail.com <mailto:alvic266@gmail.com> > > <mailto:alvic266@gmail.com <mailto:alvic266@gmail.com>>> > > > >> > <mailto:alvic266@gmail.com > > <mailto:alvic266@gmail.com> <mailto:alvic266@gmail.com > > <mailto:alvic266@gmail.com>> > > > <mailto:alvic266@gmail.com <mailto:alvic266@gmail.com> > > <mailto:alvic266@gmail.com <mailto:alvic266@gmail.com>>>> > > > >> > > > <mailto:alvic266@gmail.com > > <mailto:alvic266@gmail.com> > > > <mailto:alvic266@gmail.com <mailto:alvic266@gmail.com>> > > > >> > <mailto:alvic266@gmail.com > > <mailto:alvic266@gmail.com> <mailto:alvic266@gmail.com > > <mailto:alvic266@gmail.com>>> > > > <mailto:alvic266@gmail.com <mailto:alvic266@gmail.com> > > <mailto:alvic266@gmail.com <mailto:alvic266@gmail.com>> > > > >> > <mailto:alvic266@gmail.com > > <mailto:alvic266@gmail.com> <mailto:alvic266@gmail.com > > <mailto:alvic266@gmail.com>>>>> > > > >> > > > > <mailto:alvic266@gmail.com > > <mailto:alvic266@gmail.com> > > > <mailto:alvic266@gmail.com <mailto:alvic266@gmail.com>> > > > >> > <mailto:alvic266@gmail.com > > <mailto:alvic266@gmail.com> <mailto:alvic266@gmail.com > > <mailto:alvic266@gmail.com>>> > > > <mailto:alvic266@gmail.com <mailto:alvic266@gmail.com> > > <mailto:alvic266@gmail.com <mailto:alvic266@gmail.com>> > > > >> > <mailto:alvic266@gmail.com > > <mailto:alvic266@gmail.com> <mailto:alvic266@gmail.com > > <mailto:alvic266@gmail.com>>>> > > > >> > > <mailto:alvic266@gmail.com > > <mailto:alvic266@gmail.com> > > > <mailto:alvic266@gmail.com <mailto:alvic266@gmail.com>> > > <mailto:alvic266@gmail.com <mailto:alvic266@gmail.com> > > > <mailto:alvic266@gmail.com <mailto:alvic266@gmail.com>>> > > > >> > <mailto:alvic266@gmail.com > > <mailto:alvic266@gmail.com> <mailto:alvic266@gmail.com > > <mailto:alvic266@gmail.com>> > > > <mailto:alvic266@gmail.com <mailto:alvic266@gmail.com> > > <mailto:alvic266@gmail.com <mailto:alvic266@gmail.com>>>>>>> wrote: > > > >> > > > > > > > >> > > > > Hi FreeIPA list, > > > >> > > > > > > > >> > > > > I don't see any in error log > that > > > match `grep > > > >> > -i "err=3" > > > >> > > > > /var/log/httpd/error_log`. We > > have tried > > > >> raising > > > >> > > > searchtimelimit as > > > >> > > > > high as 120, then 300 (now are > > trying > > > 600) but > > > >> > > observed no > > > >> > > > > difference in the rate at which > > nodes > > > >> succeeded or > > > >> > > failed in IPA > > > >> > > > > joins. We are somewhat puzzled > by > > > this, as > > > >> none of > > > >> > > the other > > > >> > > > values > > > >> > > > > we are aware of might have > changed, > > > though it > > > >> is > > > >> > > possible that the > > > >> > > > > IPA systems are under a little > > higher > > > demand > > > >> > from client > > > >> > > > systems, we > > > >> > > > > have tried to mitigate this by > > > shutting down > > > >> some > > > >> > > workflows and > > > >> > > > > aren't sure whether we've seen > any > > > improvement. > > > >> > > Short of adjusting > > > >> > > > > apache/resource/process > > timeouts it is > > > >> > difficult to > > > >> > > say what might > > > >> > > > > be wrong. To give an example, > > out of > > > 250 nodes > > > >> > > rebooted, only 112 > > > >> > > > > joined IPA successfully. Here > > is some > > > output > > > >> from > > > >> > > the error log, > > > >> > > > > following what this looks like > > in the ipa > > > >> client > > > >> > > install log > > > >> > > > (error > > > >> > > > > log output will match the node > > attempt): > > > >> > > > > > > > >> > > > > > > > >> > > > > 2021-06-07T18:25:30Z DEBUG The > > > >> ipa-client-install > > > >> > > command > > > >> > > > failed, exception: NetworkError: > cannot > > > connect to > > > >> > > > 'https://redactednode.com/ipa/json > <https://emea01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fredacted…> > > > >> > > > > > <https://hauth0004.dug.com/ipa/json > <https://emea01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fhauth000…>>': > Internal > > > >> > Server Error > > > >> > > > > > > > >> > > > > [Mon Jun 07 13:25:06.198259 > 2021] > > > [core:error] > > > >> > [pid > > > >> > > 25020] > > > >> > > > [client 10.1.24.48:47808 > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2F10.1.24.4…> > > <http://10.1.24.48:47808 > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2F10.1.24.4…> > > > > > <http://10.1.24.48:47808 > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2F10.1.24.4…>> > <http://10.1.24.48:47808 > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2F10.1.24.4…> > > > > > >> > <http://10.1.24.48:47808 > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2F10.1.24.4…> > > > > > >> > > <http://10.1.24.48:47808 > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2F10.1.24.4…> > > > > > >> > > > <http://10.1.24.48:47808 > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2F10.1.24.4…>>] > Script > > timed out > > > before > > > >> > returning > > > >> > > > headers: wsgi.py, referer: > > > >> > > https://redacted.redacted.com/ipa/xml > <https://emea01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fredacted…> > > > >> > > > <https://hauth0004.dug.com/ipa/xml > <https://emea01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fhauth000…> > > > > > >> > > > > > > > >> > > > > Different node, same time > period: > > > >> > > > > > > > >> > > > > > > > >> > > > > [Mon Jun 07 13:24:02.178092 > 2021] > > > [:error] [pid > > > >> > > 25725] ipa: > > > >> > > > INFO: [xmlserver] > mach_join(a)redacted.COM: > > > >> > > join(u'redacted.node.com > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fredacted.…> > > <http://redacted.node.com > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fredacted.…> > > > > > <http://redacted.node.com > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fredacted.…>> > <http://redacted.node.com > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fredacted.…> > > > > > >> > <http://redacted.node.com > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fredacted.…> > > > > > >> > > > <http://redacted.node.com > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fredacted.…> > > > > > <http://redacted.node.com > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fredacted.…> > > > >> >', > > > >> > > > nshardwareplatform=u'x86_64', > > > >> > > > > > > >> nsosversion=u'3.10.0-1062.18.1.1.el7.redacted.x86_64', > > > >> > > > version=u'2.51'): TimeLimitExceeded > > > >> > > > > > > > >> > > > > I also saw this: > > > >> > > > > > > > >> > > > > [Mon Jun 07 13:25:07.103503 > 2021] > > > [:error] [pid > > > >> > > 25725] ipa: > > > >> > > > ERROR: non-public: IOError: request > data > > > read error > > > >> > > > > [Mon Jun 07 13:25:07.103529 > 2021] > > > [:error] > > > >> > [pid 25725] > > > >> > > > Traceback (most recent call last): > > > >> > > > > [Mon Jun 07 13:25:07.103536 > 2021] > > > [:error] [pid > > > >> > > 25725] File > > > >> > > > > > > >> > > > "/usr/lib/python2.7/site-packages/ipaserver/rpcserver.py", > > > >> > > line 360, > > > >> > > > in wsgi_execute > > > >> > > > > [Mon Jun 07 13:25:07.103542 > 2021] > > > [:error] [pid > > > >> > > 25725] > > > >> > > > data = read_input(environ) > > > >> > > > > [Mon Jun 07 13:25:07.103548 > 2021] > > > [:error] [pid > > > >> > > 25725] File > > > >> > > > > > > >> > > > "/usr/lib/python2.7/site-packages/ipaserver/rpcserver.py", > > > >> > > line 200, > > > >> > > > in read_input > > > >> > > > > [Mon Jun 07 13:25:07.103553 > 2021] > > > [:error] [pid > > > >> > > 25725] > > > >> > > > return > > > >> > environ['wsgi.input'].read(length).decode('utf-8') > > > >> > > > > [Mon Jun 07 13:25:07.103559 > 2021] > > > [:error] > > > >> > [pid 25725] > > > >> > > > IOError: request data read error > > > >> > > > > [Mon Jun 07 13:25:07.103826 > 2021] > > > [:error] [pid > > > >> > > 25725] ipa: > > > >> > > > INFO: [xmlserver] > > mach_join(a)redacted.COM: None: > > > >> > InternalError > > > >> > > > > [Mon Jun 07 13:25:07.149962 > 2021] > > > [:error] [pid > > > >> > > 25726] ipa: > > > >> > > > ERROR: non-public: IOError: request > data > > > read error > > > >> > > > > [Mon Jun 07 13:25:07.149984 > 2021] > > > [:error] > > > >> > [pid 25726] > > > >> > > > Traceback (most recent call last): > > > >> > > > > [Mon Jun 07 13:25:07.149991 > 2021] > > > [:error] [pid > > > >> > > 25726] File > > > >> > > > > > > >> > > > "/usr/lib/python2.7/site-packages/ipaserver/rpcserver.py", > > > >> > > line 360, > > > >> > > > in wsgi_execute > > > >> > > > > [Mon Jun 07 13:25:07.149997 > 2021] > > > [:error] [pid > > > >> > > 25726] > > > >> > > > data = read_input(environ) > > > >> > > > > [Mon Jun 07 13:25:07.150002 > 2021] > > > [:error] [pid > > > >> > > 25726] File > > > >> > > > > > > >> > > > "/usr/lib/python2.7/site-packages/ipaserver/rpcserver.py", > > > >> > > line 200, > > > >> > > > in read_input > > > >> > > > > [Mon Jun 07 13:25:07.150008 > 2021] > > > [:error] [pid > > > >> > > 25726] > > > >> > > > return > > > >> > environ['wsgi.input'].read(length).decode('utf-8') > > > >> > > > > [Mon Jun 07 13:25:07.150013 > 2021] > > > [:error] > > > >> > [pid 25726] > > > >> > > > IOError: request data read error > > > >> > > > > > > > >> > > > > > > > >> > > > > > > > >> > > > > After setting the timeout to > > 600 and > > > rebooting > > > >> the > > > >> > > remaining > > > >> > > > 139 nodes from the initial set of > 250, 83 > > > joined of > > > >> the > > > >> > > 139 and we > > > >> > > > still had ISE occurring. In some > > cases, it > > > would ISE > > > >> on > > > >> > > the first > > > >> > > > attempt, try another IPA system, and > > > succeed. I'm > > > >> > not sure > > > >> > > that even > > > >> > > > such a long timeout as 600 has helped. > > > >> > > > > > > > >> > > > > Alfred > > > >> > > > > > > > >> > > > > > > > >> > > > > > > > >> > > > > > > > >> > > > > On Thu, Jun 3, 2021 at 7:51 PM > Rob > > > Crittenden > > > >> > > > <rcritten(a)redhat.com > > <mailto:rcritten@redhat.com> > > > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com>> > > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com> > > > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com>>> > > > >> > <mailto:rcritten@redhat.com > > <mailto:rcritten@redhat.com> <mailto:rcritten@redhat.com > > <mailto:rcritten@redhat.com>> > > > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com> > > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com>>>> > > > >> > > <mailto:rcritten@redhat.com > > <mailto:rcritten@redhat.com> > > > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com>> > > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com> > > > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com>>> > > > >> > <mailto:rcritten@redhat.com > > <mailto:rcritten@redhat.com> <mailto:rcritten@redhat.com > > <mailto:rcritten@redhat.com>> > > > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com> > > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com>>>>> > > > >> > > > > <mailto:rcritten@redhat.com > > <mailto:rcritten@redhat.com> > > > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com>> > > > >> > <mailto:rcritten@redhat.com > > <mailto:rcritten@redhat.com> <mailto:rcritten@redhat.com > > <mailto:rcritten@redhat.com>>> > > > >> > > <mailto:rcritten@redhat.com > > <mailto:rcritten@redhat.com> > > > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com>> > > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com> > > > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com>>>> > > > >> > <mailto:rcritten@redhat.com > > <mailto:rcritten@redhat.com> <mailto:rcritten@redhat.com > > <mailto:rcritten@redhat.com>> > > > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com> > > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com>>> > > > >> > > <mailto:rcritten@redhat.com > > <mailto:rcritten@redhat.com> > > > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com>> > > > >> > <mailto:rcritten@redhat.com <mailto: > rcritten(a)redhat.com> > > > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com>>>>>>> > > wrote: > > > >> > > > > > > > >> > > > > Alfred Victor via > FreeIPA-users > > > wrote: > > > >> > > > > > Hi FreeIPA list, > > > >> > > > > > > > > >> > > > > > We are having an issue > > with our IPA > > > >> > > environment of 4 > > > >> > > > > replicated FreeIPA > > > >> > > > > > systems serving linux > compute > > > clients > > > >> > > which join from a > > > >> > > > command in > > > >> > > > > > rc.local after boot. This > > > worked in the > > > >> > past, > > > >> > > but the system > > > >> > > > > has been > > > >> > > > > > rebuilt since and the > > join command > > > >> changed > > > >> > > > slightly. Unfortunately > > > >> > > > > > booting a few dozen nodes > > at a > > > time, > > > >> though > > > >> > > they each > > > >> > > > talk to a > > > >> > > > > > different IPA system by > > design, > > > leads to > > > >> > > problems such as > > > >> > > > > these - though > > > >> > > > > > 40-100 nodes can boot ok > at a > > > time there > > > >> are > > > >> > > always many > > > >> > > > > stragglers, and > > > >> > > > > > the more we attempt to > > boot at > > > once the > > > >> more > > > >> > > fail to > > > >> > > > join IPA > > > >> > > > > (if we try > > > >> > > > > > to boot 500 nodes, we are > > lucky > > > if we > > > >> get a > > > >> > > fifth of that > > > >> > > > > joining IPA). > > > >> > > > > > Can you please advise on > this > > > output? > > > >> > Here is > > > >> > > our join > > > >> > > > command in > > > >> > > > > > compute node rc.local: > > > >> > > > > > > > > >> > > > > > > > > >> > > > > > > > > >> > > > > > ipa-client-install -U > > -q -p > > > >> mach_join \ > > > >> > > > > > -w <redacted> \ > > > >> > > > > > --force-join \ > > > >> > > > > > --no-dns-sshfp \ > > > >> > > > > > > > > --automount-location=redacted-node > > > >> > > > > > > > > >> > > > > > > > > >> > > > > > > > > >> > > > > > > > > >> > > > > > And here is some log > > output of > > > the 500 > > > >> > error: > > > >> > > > > > > > > >> > > > > > ProtocolError: > > > <ProtocolError for > > > >> > > > > > > redacted.redacted.com/ipa/json > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fredacted.…> > <http://redacted.redacted.com/ipa/json > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fredacted.…> > > > > > <http://redacted.redacted.com/ipa/json > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fredacted.…> > > > > > >> > <http://redacted.redacted.com/ipa/json > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fredacted.…> > > > > > >> > > <http://redacted.redacted.com/ipa/json > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fredacted.…> > > > > > >> > > > < > http://redacted.redacted.com/ipa/json > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fredacted.…> > > > > > >> > > > > > > > <http://redacted.redacted.com/ipa/json > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fredacted.…> > > > > > >> > > > > > > > <http://redacted.redacted.com/ipa/json > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fredacted.…> > >: > > > >> 500 > > > >> > > Internal > > > >> > > > Server Error> > > > >> > > > > > Cannot connect to the > > > server due to > > > >> > > generic error: > > > >> > > > cannot > > > >> > > > > connect to > > > >> > 'https://redacted.redacted.com/ipa/json > <https://emea01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fredacted…> > > > >> > > > > > > > <https://hauth0003.dug.com/ipa/json > <https://emea01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fhauth000…> > >': > > > >> > Internal > > > >> > > Server Error > > > >> > > > > > > > > >> > > > > > > > > >> > > > > > As well as: > > > >> > > > > > > > > >> > > > > > 2021-06-02T21:39:11Z > > DEBUG > > > Starting > > > >> > > external process > > > >> > > > > > 2021-06-02T21:39:11Z > > DEBUG > > > >> > > args=/usr/sbin/ipa-join -s > > > >> > > > > > redacted.redacted.com > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fredacted.…> > > <http://redacted.redacted.com > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fredacted.…> > > > > > <http://redacted.redacted.com > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fredacted.…> > > > > > >> > <http://redacted.redacted.com > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fredacted.…> > > > > > >> > > <http://redacted.redacted.com > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fredacted.…>> > < > > > >> http://redacted.redacted.com > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fredacted.…> > > > > > >> > > > <http://redacted.redacted.com > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fredacted.…> > > > > > >> > > > > > > <http://redacted.redacted.com > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fredacted.…>> > -b > > > >> > > > > > dc=redacted,dc=com -h > > > >> > > redactednode.redacted.com > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fredactedn…> > > <http://redactednode.redacted.com > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fredactedn…> > > > > > <http://redactednode.redacted.com > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fredactedn…> > > > > > >> > <http://redactednode.redacted.com > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fredactedn…> > > > > > <http://redactednode.redacted.com > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fredactedn…> > > > >> > > > > >> > > > <http://redactednode.redacted.com > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fredactedn…> > > > > > >> > > > > > > <http://redactednode.redacted.com > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fredactedn…> > > > > > >> > > > > > > > > <http://redactednode.redacted.com > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fredactedn…> > > > > > >> -f > > > >> > > > > > 2021-06-02T21:40:13Z > > DEBUG > > > Process > > > >> > > finished, return > > > >> > > > code=17 > > > >> > > > > > 2021-06-02T21:40:13Z > > DEBUG > > > stdout= > > > >> > > > > > 2021-06-02T21:40:13Z > > DEBUG > > > >> stderr=HTTP > > > >> > > response code is > > > >> > > > > 500, not 200 > > > >> > > > > > 2021-06-02T21:40:13Z > > ERROR > > > Joining > > > >> realm > > > >> > > failed: HTTP > > > >> > > > > response code > > > >> > > > > > is 500, not 200 > > > >> > > > > > > > > >> > > > > > And we also see timeouts > > happen: > > > >> > > > > > > > > >> > > > > > > > > >> > > > > > 2021-06-02T22:08:50Z > > DEBUG > > > >> > > args=/usr/sbin/ipa-join -s > > > >> > > > > > redacted.redacted.com > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fredacted.…> > > <http://redacted.redacted.com > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fredacted.…> > > > > > <http://redacted.redacted.com > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fredacted.…> > > > > > >> > <http://redacted.redacted.com > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fredacted.…> > > > > > >> > > <http://redacted.redacted.com > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fredacted.…>> > < > > > >> http://redacted.redacted.com > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fredacted.…> > > > > > >> > > > <http://redacted.redacted.com > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fredacted.…> > > > > > >> > > > > > > <http://redacted.redacted.com > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fredacted.…>> > -b > > > >> > > > > > dc=redacted,dc=com -h > > > >> > > redactednode.redacted.com > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fredactedn…> > > <http://redactednode.redacted.com > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fredactedn…> > > > > > <http://redactednode.redacted.com > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fredactedn…> > > > > > >> > <http://redactednode.redacted.com > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fredactedn…> > > > > > <http://redactednode.redacted.com > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fredactedn…> > > > >> > > > > >> > > > <http://redactednode.redacted.com > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fredactedn…> > > > > > >> > > > > > > <http://redactednode.redacted.com > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fredactedn…> > > > > > >> > > > > > > > > <http://redactednode.redacted.com > <https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fredactedn…> > > > > > >> -f > > > >> > > > > > 2021-06-02T22:09:01Z > > DEBUG > > > Process > > > >> > > finished, return > > > >> > > > code=17 > > > >> > > > > > 2021-06-02T22:09:01Z > > DEBUG > > > stdout= > > > >> > > > > > 2021-06-02T22:09:01Z > > DEBUG > > > stderr=RPC > > > >> > > failed at server. > > > >> > > > > Configured > > > >> > > > > > time limit exceeded > > > >> > > > > > 2021-06-02T22:09:01Z > > ERROR > > > Joining > > > >> realm > > > >> > > failed: RPC > > > >> > > > failed at > > > >> > > > > > server. Configured > > time limit > > > >> exceeded > > > >> > > > > > > > > >> > > > > > > > > >> > > > > > And we also see later > > timeouts > > > near the > > > >> > end of > > > >> > > the log > > > >> > > > in some > > > >> > > > �� > cases though are able to > > > authenticate and > > > >> it > > > >> > > didn't back > > > >> > > > out the > > > >> > > > > install, but never got > > going healthy > > > >> either: > > > >> > > > > > > > > >> > > > > > > > > >> > > > > > > > > >> > > > > > 2021-06-03T19:20:13Z > > DEBUG The > > > >> > > ipa-client-install > > > >> > > > command > > > >> > > > > failed, > > > >> > > > > > exception: > > TimeLimitExceeded: > > > >> Configured > > > >> > > time limit > > > >> > > > exceeded > > > >> > > > > > > > >> > > > > When you see Internal Error > > look > > > to the > > > >> Apache > > > >> > > error log > > > >> > > > on the > > > >> > > > > server > > > >> > > > > for more information. > > > >> > > > > > > > >> > > > > In this case an LDAP search > is > > > failing > > > >> because > > > >> > > the server > > > >> > > > is too > > > >> > > > > busy. > > > >> > > > > Look for queries failing > with > > > err=3 to get > > > >> an > > > >> > > idea of how long > > > >> > > > > it is taking. > > > >> > > > > > > > >> > > > > To increase the timeout > > use: ipa > > > config-mod > > > >> > > > --searchtimelimit=INT > > > >> > > > > > > > >> > > > > The default is 2 seconds. > > > >> > > > > > > > >> > > > > You can pick a time at > > random but > > > could see > > > >> > > failures again. > > > >> > > > > > > > >> > > > > rob > > > >> > > > > > > > >> > > > > > > >> > > > > > >> > > > > >> > > > >> > > > > > > > > > > > > > > > -- > > > / Alexander Bokovoy > > > Sr. Principal Software Engineer > > > Security / Identity Management Engineering > > > Red Hat Limited, Finland > > > > > > >

1 0

Simulate the AD 'Computer' Object
by Joseph Fry 22 Jun '21

22 Jun '21

I support a product that natively supports ingesting computers from Active Directory via an LDAP query. We are able to ingest users from FreeIPA (actually Redhat IDM) without a problem, but hosts cannot be ingested because the objectClass and attributes are different than what is used by ActiveDirectory. Is there a simple solution in FreeIPA to have the host objects simulate an AD 'computer' object?

2 1

Join command 500 errors, timeouts
by Alfred Victor 22 Jun '21

22 Jun '21

Hi FreeIPA list, We are having an issue with our IPA environment of 4 replicated FreeIPA systems serving linux compute clients which join from a command in rc.local after boot. This worked in the past, but the system has been rebuilt since and the join command changed slightly. Unfortunately booting a few dozen nodes at a time, though they each talk to a different IPA system by design, leads to problems such as these - though 40-100 nodes can boot ok at a time there are always many stragglers, and the more we attempt to boot at once the more fail to join IPA (if we try to boot 500 nodes, we are lucky if we get a fifth of that joining IPA). Can you please advise on this output? Here is our join command in compute node rc.local: ipa-client-install -U -q -p mach_join \ > -w <redacted> \ > --force-join \ > --no-dns-sshfp \ > --automount-location=redacted-node And here is some log output of the 500 error: ProtocolError: <ProtocolError for redacted.redacted.com/ipa/json: 500 Internal Server Error> > Cannot connect to the server due to generic error: cannot connect to 'https://redacted.redacted.com/ipa/json <https://hauth0003.dug.com/ipa/json>': Internal Server Error > > As well as: 2021-06-02T21:39:11Z DEBUG Starting external process > 2021-06-02T21:39:11Z DEBUG args=/usr/sbin/ipa-join -s > redacted.redacted.com -b dc=redacted,dc=com -h redactednode.redacted.com > -f > 2021-06-02T21:40:13Z DEBUG Process finished, return code=17 > 2021-06-02T21:40:13Z DEBUG stdout= > 2021-06-02T21:40:13Z DEBUG stderr=HTTP response code is 500, not 200 > 2021-06-02T21:40:13Z ERROR Joining realm failed: HTTP response code is > 500, not 200 And we also see timeouts happen: > > 2021-06-02T22:08:50Z DEBUG args=/usr/sbin/ipa-join -s redacted.redacted.com -b dc=redacted,dc=com -h redactednode.redacted.com -f > 2021-06-02T22:09:01Z DEBUG Process finished, return code=17 > 2021-06-02T22:09:01Z DEBUG stdout= > 2021-06-02T22:09:01Z DEBUG stderr=RPC failed at server. Configured time limit exceeded > 2021-06-02T22:09:01Z ERROR Joining realm failed: RPC failed at server. Configured time limit exceeded And we also see later timeouts near the end of the log in some cases though are able to authenticate and it didn't back out the install, but never got going healthy either: > > 2021-06-03T19:20:13Z DEBUG The ipa-client-install command failed, > exception: TimeLimitExceeded: Configured time limit exceeded Donald

4 21

ipactl status hangs
by Ronald Wimmer 21 Jun '21

21 Jun '21

On some servers I can see that ipactl status hangs from time to time. I can see SSSD reporting the backend to be offline and dirsrv not running for some reason. ipactl -d status reveals that it hangs when issuing systemctl is-active dirsrv. Instead of hanging I would expect ipcactl status to report a problem (= dirsrv not running). Cheers, Ronald

2 2

sssd version 2.2.3 issues with AD Trust View
by iulian roman 18 Jun '21

18 Jun '21

Hello everybody, I have an IPA setup with AD trust configured and Trust View defined on the IPA server. Everything works properly on Ubuntu 18 clients with sssd 1.16.1 but it doesn't on Ubuntu 20 with sssd version 2.2.3. I can list /query the AD accounts which are not part of the default Trust View, but not those accounts which have the id overriden in the Trust View. Is that a known issue, or any idea what do I need to change /where to look ?

2 4

Consumer failed to replay change Operations error (1)
by Alfred Victor 17 Jun '21

17 Jun '21

Hi FreeIPA, We have some replication messages in our slapd errors log which look very like the ones discussed here: https://bugzilla.redhat.com/show_bug.cgi?id=1574602 I took a look and we do have the MemberOf plugin, but our version of 389-ds newer: *389-ds-base-1.3.10.2-10.el7_9.x86_64* Hoping someone might have a suggestion for what we might do to get rid of these log messages, or what the root cause may be/impact? They've been going since at least a couple of weeks ago: [15/Jun/2021:18:57:26.362094959 -0500] - WARN - NSMMReplicationPlugin - repl5_inc_update_from_op_result - agmt="cn=redactedauth0001.redacted.com-to-redactedauth0003.redacted.com" (redactedauth0003:389): Consumer failed to replay change (uniqueid d5896001-39a111eb-8868efc8-91dc0b98, CSN 60c93bc2000400250000): Operations error (1). Will retry later. I looked for this same uniqueid (they are ALL the same uniqueID) and found this which is interesting and references a specific cn and "optype": > > [03/Jun/2021:15:45:43.332068775 -0500] - ERR - NSMMReplicationPlugin - write_changelog_and_ruv - Can't add a change for cn=admin,cn=groups,cn=accounts,dc=redacted,dc=com (uniqid: d5896001-39a111eb-8868efc8-91dc0b98, optype: 8) to changelog csn 60b93f93005200230000 Alfred

3 2

IPA RA expired, other certificates renewed
by Jan Bundesmann 16 Jun '21

16 Jun '21

Hi there, I need some suggestions for a certificate related problem. The setup has 2 servers, let's call them ldap1 and ldap2 with ldap1 being the primary system with the CA. The certificates were to expire on june 15. I checked on june 1st and on ldap1 certmonger had renewed all certificates, on ldap2 certmonger was not running. So, I restarted the certmonger service and it began its work. `getcert list` shows three certificates (it's ipa 4.4, so that's probably correct) Quite soon, the first certificate was renewed (HTTP/ldap2, ...) I assume that's the one for the web UI. A second one (ldap/ldap2...) is still valid until december. I assume that's why all the ldap related stuff and replication is still working. But the cn=IPA RA expired one week ago (may 24th). I have no ipa-certs-fix, would setting back the system clock still work? The HTTP/ldap2 certificate was not yet valid when the IPA RA certificate expired. Or put the the other round: what happens if i don't renew this certificate - that's not quite clear to me. Currently, the system ist working fine, replication works and in 2022 the hardware will be replaced, so we will setup new replicas anyways. But, that's after the expiration date of the ldap/ldap2 certificate. I hope this is understandable and thanks in advance for any hint.

2 7

Doc suggestion: explicitly advise 'non-desktop' spins for freeipa-server*
by Harry G. Coin 15 Jun '21

15 Jun '21

Might the 'edition' (server, desktop, iot, whatnot) of the distribution used in testing freeipa-server* be explicitly stated in the 'getting started' docs as being 'approved' for freeipa-server use? The better to avoid interactions with un-interaction-tested packages / security libraries generally seen only in user/special-purpose distros. (re: dnssec / bind9 / smart-card interaction) HC

1 0

AD Trust Types
by Ronald Wimmer 15 Jun '21

15 Jun '21

Quite some time ago I added a trust to another AD domain. IIRC I added an "external trust" for a reason I do not remember. What is the "Non-transitive external trust to a domain in another Active Directory forest" trust type for? Could I not just have added another "Active Directory domain" trust? Any clarification on this matter would be highly appreciated! Cheers, Ronald

3 9

FreeIPA 4.9.4 and 4.9.5 released
by Alexander Bokovoy 14 Jun '21

14 Jun '21

The FreeIPA team would like to announce FreeIPA 4.9.4 and 4.9.5 releases! Yes, this is not a mistake. First we created FreeIPA 4.9.4 on June 4th but then found a late time regression that took us more than ten days to sort out, thus going with the FreeIPA 4.9.5 release. This regression concerns an edge case of an unauthenticated or almost expired user credential's run of 'ipa' command line tool returning a non-processed Python exception instead of a human-readable error message. This, in turn uncovered a bit of a misconfiguration on the IPA server side which could trigger this behavior. In a process of investigating it we also found a bug in GSS-Proxy tool. FreeIPA 4.9.4 release notes are large and can be found at https://www.freeipa.org/page/Releases/4.9.4 FreeIPA 4.9.5 is released and can be downloaded from http://www.freeipa.org/page/Downloads. Builds for Fedora distributions will be available from the official repository soon. FreeIPA installation is currently broken in Fedora Rawhide due to an ongoing migration to Python 3.10 in Fedora where mod_wsgi does not yet support Python 3.10. == Highlights in 4.9.5 === Bug fixes FreeIPA 4.9.5 is a stabilization release for the features delivered as a part of 4.9.0 version series. There are 7 bug-fixes since FreeIPA 4.9.4 release. Details of the bug-fixes can be seen in the list of resolved tickets below. == Upgrading Upgrade instructions are available on Upgrade page. == Feedback Please provide comments, bugs and other feedback via the freeipa-users mailing list (https://lists.fedoraproject.org/archives/list/freeipa-users@lists.fedorahos…) or #freeipa channel on Freenode. == Resolved tickets * https://pagure.io/freeipa/issue/8691[#8691] [Tracker] Nightly failure (fc33) in test_winsyncmigrate.py: ipa-replica-manage connect --winsync error * https://pagure.io/freeipa/issue/8702[#8702] (https://bugzilla.redhat.com/show_bug.cgi?id=1780317[rhbz#1780317]) ipa-cert-fix: False Positive Status for cert renewal. * https://pagure.io/freeipa/issue/8756[#8756] [Tracker] 389ds coredump in test_caless.py::TestReplicaInstall::test_wildcard_http * https://pagure.io/freeipa/issue/8868[#8868] Nightly test failure in test_integration/test_fips.py::TestInstallFIPS * https://pagure.io/freeipa/issue/8873[#8873] Missing credential cache can raise 500 when authenticating instead of 401 * https://pagure.io/freeipa/issue/8876[#8876] Nightly failure in test_installation.py::TestInstallWithCA1::test_install_with_bad_ldap_conf * https://pagure.io/freeipa/issue/8877[#8877] Nightly test failure in test_nfs.py: runner VM runs out of disk space due to huge sssd log file == Detailed changelog since 4.9.4 === Armando Neto (1) * ipatests: Bump PR-CI boxes https://pagure.io/freeipa/c/79e0919132adf0df764400f9c27268cbadd2578b[commit] === Alexander Bokovoy (3) * Become FreeIPA 4.9.5 https://pagure.io/freeipa/c/e045f118c87346bfab5b5634fd23f3054f082f7f[commit] * get_credentials: return ValueError for missing creds https://pagure.io/freeipa/c/5238651da06547bb004de2434ae7d357422ba735[commit] https://pagure.io/freeipa/issue/8873[#8873] * Back to git snapshots https://pagure.io/freeipa/c/b25f5bd9109b87916e097dd8353ea5f0dc49e398[commit] === Florence Blanc-Renaud (4) * ipa-cert-fix man page: add note about certmonger renewal https://pagure.io/freeipa/c/06a445aff10c1ab84e8784ab41b0a838e500e617[commit] https://pagure.io/freeipa/issue/8702[#8702] * freeipa.spec: bump 389-ds version https://pagure.io/freeipa/c/6eb535334d33f8f375b856e3a2d0b8853b318b4d[commit] https://pagure.io/freeipa/issue/8691[#8691], https://pagure.io/freeipa/issue/8756[#8756] * ipatests: delete the replica before uninstallation https://pagure.io/freeipa/c/2b22450dfdc1657b463683b09b9c69816f9152d9[commit] https://pagure.io/freeipa/issue/8876[#8876] * ipatests: set selinux context for fips mode https://pagure.io/freeipa/c/13b257d7a05fd255df472144712edb34604dbe06[commit] https://pagure.io/freeipa/issue/8868[#8868] === Stanislav Levin (2) * gssproxy: Don't refresh expired delegated credentials https://pagure.io/freeipa/c/0fd06f33b83aec19a88c594d3750bc476157ab83[commit] * krb_utils: Simplify get_credentials https://pagure.io/freeipa/c/700be74975cad998e7dbcc4fb437e6b0bbd77305[commit] https://pagure.io/freeipa/issue/8873[#8873] === Sergey Orlov (2) * ipatests: disable test_nfs.py::TestNFS in nightly runs on Fedora 33 https://pagure.io/freeipa/c/c9f5acc0d281f1a27471091648c36f94528c5a29[commit] https://pagure.io/freeipa/issue/8877[#8877] * ipatests: temporary disable execution of test_nfs.py::TestNFS in nightly runs https://pagure.io/freeipa/c/6ee14f513711ae9be799cfa2bd009f13c5248932[commit] https://pagure.io/freeipa/issue/8877[#8877] -- / Alexander Bokovoy Sr. Principal Software Engineer Security / Identity Management Engineering Red Hat Limited, Finland _______________________________________________ FreeIPA-devel mailing list -- freeipa-devel(a)lists.fedorahosted.org To unsubscribe send an email to freeipa-devel-leave(a)lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/freeipa-devel@lists.fedorahost… Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure

1 0

DNS Locations and external DNS
by Ronald Wimmer 14 Jun '21

14 Jun '21

Is it sufficient to create DNS locations in IPA and do a ipa dns-update-system-records --dry-run in order to populate new DNS Zone information to the external DNS system? Apart from adding IPA clients to their respective locations, there is nothing to do regarding DNS locations on IPA clients, right? Cheers, Ronald

2 2

Cant login via AD user
by Konstantin Ignatev 13 Jun '21

13 Jun '21

Good day. IPA - 4.9.4. OS - Fedora 34. I have established a trust relationship with the AD domain. The list of domains is easily obtained by the command ipa trust-fetch-domains "example.com" I can get a ticket using kinit username(a)example.com in CLI. I can not log into the server using the AD account from UI. With exactly the same installation but on the Centos 7 + IPA 4.6.8 there are no similar problemsю In /var/log/httpd/error_log [Sun Jun 13 15:51:14.045718 2021] [wsgi:error] [pid 2312:tid 2815] [remote 172.17.51.252:8946] ipa: INFO: 401 Unauthorized: Major (851968): Unspecified GSS failure. Minor code may provide more information, Minor (2598844988): KDC returned error string: PROCESS_TGS In /var/log/krb5kdc.log Jun 13 15:51:13 freeipa-master.ipa.example.com krb5kdc[2256](info): AS_REQ (3 etypes {aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17), DEPRECATED:arcfour-hmac(23)}) 172.17.252.121: REFERRAL: aduser\@example.com@IPA.EXAMPLE.COM for krbtgt/IPA.EXAMPLE.COM(a)IPA.EXAMPLE.COM, Realm not local to KDC /etc/krb.conf includedir /etc/krb5.conf.d/ includedir /var/lib/sss/pubconf/krb5.include.d/ [logging] default = FILE:/var/log/krb5libs.log kdc = FILE:/var/log/krb5kdc.log admin_server = FILE:/var/log/kadmind.log [libdefaults] default_realm = IPA.EXAMPLE.COM dns_lookup_realm = false dns_lookup_kdc = true rdns = false ticket_lifetime = 24h forwardable = true udp_preference_limit = 0 default_ccache_name = KEYRING:persistent:%{uid} default_tkt_enctypes = aes256-cts aes128-cts rc4-hmac arcfour-hmac-md5 des-cbc-md5 des-cbc-crc [realms] IPA.EXAMPLE.COM = { kdc = freeipa-master.ipa.example.com:88 master_kdc = freeipa-master.ipa.example.com:88 admin_server = freeipa-master.ipa.example.com:749 default_domain = ipa.example.com pkinit_anchors = FILE:/var/lib/ipa-client/pki/kdc-ca-bundle.pem pkinit_pool = FILE:/var/lib/ipa-client/pki/ca-bundle.pem auth_to_local = RULE:[1:$1@$0](^.*@EXAMPLE.COM$)s/@EXAMPLE.COM/@example.com/ auth_to_local = DEFAULT } [domain_realm] .ipa.example.com = IPA.EXAMPLE.COM ipa.example.com = IPA.EXAMPLE.COM freeipa-master.ipa.example.com = IPA.EXAMPLE.COM [dbmodules] IPA.EXAMPLE.COM = { db_library = ipadb.so } [plugins] certauth = { module = ipakdb:kdb/ipadb.so enable_only = ipakdb } /etc/sssd/sssd.conf [domain/ipa.example.com] krb5_use_kdcinfo = False krb5_use_fast = never id_provider = ipa ipa_server_mode = True ipa_server = freeipa-master.ipa.example.com ipa_domain = ipa.example.com ipa_hostname = freeipa-master.ipa.example.com auth_provider = ipa chpass_provider = ipa access_provider = ipa cache_credentials = True ldap_tls_cacert = /etc/ipa/ca.crt krb5_store_password_if_offline = True [sssd] services = nss, pam, ifp, ssh, sudo domains = ipa.example.com [nss] homedir_substring = /home memcache_timeout = 600 [pam] [sudo] [autofs] [ssh] [pac] [ifp] allowed_uids = ipaapi, root [secrets] [session_recording] I would be grateful for any help

2 2

Cant login via AD from UI Freeipa
by Константин 13 Jun '21

13 Jun '21

Good day. IPA - 4.9.4. OS - Fedora 34. I have established a trust relationship with the AD domain. The list of domains is easily obtained by the command ipa trust-fetch-domains "example.com" I can get a ticket using kinit username(a)example.com in CLI. I can not log into the server using the AD account from UI. With exactly the same installation but on the Centos 7 + IPA 4.6.8 there are no similar problemsю In /var/log/httpd/error_log [Sun Jun 13 15:51:14.045718 2021] [wsgi:error] [pid 2312:tid 2815] [remote 172.17.51.252:8946] ipa: INFO: 401 Unauthorized: Major (851968): Unspecified GSS failure. Minor code may provide more information, Minor (2598844988): KDC returned error string: PROCESS_TGS In /var/log/krb5kdc.log Jun 13 15:51:13 freeipa-master.ipa.example.com krb5kdc[2256](info): AS_REQ (3 etypes {aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17), DEPRECATED:arcfour-hmac(23)}) 172.17.252.121: REFERRAL: aduser\@ example.com(a)IPA.EXAMPLE.COM for krbtgt/IPA.EXAMPLE.COM(a)IPA.EXAMPLE.COM, Realm not local to KDC /etc/krb.conf includedir /etc/krb5.conf.d/ includedir /var/lib/sss/pubconf/krb5.include.d/ [logging] default = FILE:/var/log/krb5libs.log kdc = FILE:/var/log/krb5kdc.log admin_server = FILE:/var/log/kadmind.log [libdefaults] default_realm = IPA.EXAMPLE.COM dns_lookup_realm = false dns_lookup_kdc = true rdns = false ticket_lifetime = 24h forwardable = true udp_preference_limit = 0 default_ccache_name = KEYRING:persistent:%{uid} default_tkt_enctypes = aes256-cts aes128-cts rc4-hmac arcfour-hmac-md5 des-cbc-md5 des-cbc-crc [realms] IPA.EXAMPLE.COM = { kdc = freeipa-master.ipa.example.com:88 master_kdc = freeipa-master.ipa.example.com:88 admin_server = freeipa-master.ipa.example.com:749 default_domain = ipa.example.com pkinit_anchors = FILE:/var/lib/ipa-client/pki/kdc-ca-bundle.pem pkinit_pool = FILE:/var/lib/ipa-client/pki/ca-bundle.pem auth_to_local = RULE:[1:$1@$0](^.*@EXAMPLE.COM$)s/@ EXAMPLE.COM/@example.com/ auth_to_local = DEFAULT } [domain_realm] .ipa.example.com = IPA.EXAMPLE.COM ipa.example.com = IPA.EXAMPLE.COM freeipa-master.ipa.example.com = IPA.EXAMPLE.COM [dbmodules] IPA.EXAMPLE.COM = { db_library = ipadb.so } [plugins] certauth = { module = ipakdb:kdb/ipadb.so enable_only = ipakdb } /etc/sssd/sssd.conf [domain/ipa.example.com] krb5_use_kdcinfo = False krb5_use_fast = never id_provider = ipa ipa_server_mode = True ipa_server = freeipa-master.ipa.example.com ipa_domain = ipa.example.com ipa_hostname = freeipa-master.ipa.example.com auth_provider = ipa chpass_provider = ipa access_provider = ipa cache_credentials = True ldap_tls_cacert = /etc/ipa/ca.crt krb5_store_password_if_offline = True [sssd] services = nss, pam, ifp, ssh, sudo domains = ipa.example.com [nss] homedir_substring = /home memcache_timeout = 600 [pam] [sudo] [autofs] [ssh] [pac] [ifp] allowed_uids = ipaapi, root [secrets] [session_recording] I would be grateful for any help

1 0

Redhat Idm/IPA cross domain trust problems
by thing.thing＠gmail.com 10 Jun '21

10 Jun '21

Hi, I have RH's version of freeipa (ipa-server-4.9.2-3.module+el8.4.0+10412+5ecb5b37.x86_64) working fine. RHEL8, RHEL7, Debian10.9, Ubuntu20LTS and Centos7 clients work perfectly OK to IPA OK for users in IPA.. For the cross domain trust however only RHEL8 and RHEL7 work. Debian10.9, Ubuntu20LTS and Centos7 fail for the AD user who cannot ssh in. Is there any config I need to do to get 3rd party Linux to work with a trust? Just wondering if I have missed a package? config? steps? or does it just not work? rhel7 secure log showing success, 8><---- Jun 9 16:40:55 rhel7a sshd[9339]: pam_sss(sshd:auth): authentication success; logname= uid=0 euid=0 tty=ssh ruser= rhost=v1.ods.vuw.ac.nz user=linuxuser2(a)vuwtest.ac.nz Jun 9 16:41:04 rhel7a sshd[9336]: Accepted keyboard-interactive/pam for linuxuser2(a)vuwtest.ac.nz from 10.100.32.67 port 48 Jun 9 16:41:04 rhel7a sshd[9336]: pam_unix(sshd:session): session opened for user linuxuser2(a)vuwtest.ac.nz by (uid=0) [root@rhel7a ~]# 8><--- centos7 secure log, 8><--- [root@centos7a ~]# tail -50f /var/log/secure Jun 9 17:15:24 centos7a sshd[1812]: Invalid user linuxuser2(a)vuwtest.ac.nz from 10.100.32.67 port 53880 Jun 9 17:15:24 centos7a sshd[1812]: input_userauth_request: invalid user linuxuser2(a)vuwtest.ac.nz [preauth] Jun 9 17:15:24 centos7a sshd[1812]: Postponed keyboard-interactive for invalid user linuxuser2(a)vuwtest.ac.nz from 10.100.32.67 port 53880 ssh2 [preauth] Jun 9 17:15:35 centos7a sshd[1814]: pam_unix(sshd:auth): check pass; user unknown Jun 9 17:15:35 centos7a sshd[1814]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=10.100.32.67 Jun 9 17:15:37 centos7a sshd[1812]: error: PAM: User not known to the underlying authentication module for illegal user linuxuser2(a)vuwtest.ac.nz from 10.100.32.67 Jun 9 17:15:37 centos7a sshd[1812]: Failed keyboard-interactive/pam for invalid user linuxuser2(a)vuwtest.ac.nz from 10.100.32.67 port 53880 ssh2 Jun 9 17:15:37 centos7a sshd[1812]: Postponed keyboard-interactive for invalid user linuxuser2(a)vuwtest.ac.nz from 10.100.32.67 port 53880 ssh2 [preauth] 8><---

2 1

CentOS 6 Client installation stuck and don't complete
by Rohan Talkar 09 Jun '21

09 Jun '21

HI Team, We are migrating from our current Directory Service 389DS to FreeIPA. Our all servers at present authenticated by 389DS server. Our infra hosted on AWS cloud. Please find below setup of FreeIPA & Client on which we are performing tests & getting issue. FreeIPA Servers Primary Master Server = Region 1 Secondary Master Server = Region 2 OS = CentOS Linux release 8.3.2011 IPA Version = 4.8.7, API_VERSION: 2.239 FreeIPA Client OS = CentOS release 6.9 (Final) Kernel Version = Linux drxlceco6app01 2.6.32-696.1.1.el6.x86_64 #1 SMP Tue Apr 11 17:13:24 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux IPA Client version = 3.0.0-51.el6.centos Our DNS getting managed from "/etc/hosts" file by manually adding DNS entries of server. On centos 6 client installation gets stuck after SSSD setup completes. Below output for details. NOTE = For security reason we have masked our Domain nme to "XYZ.com" & other details with Capital "X". ======================================== case "$env" in echo 'This is US DR' This is US DR ++ hostname ipa-client-install --mkhomedir --no-krb5-offline-passwords --hostname=drxlceco6app01.XYZ.com --force-join --fixed-primary --server=drxipaco8lds01.XYZ.com --server=prdipaco8ldm01.XYZ.com --domain XYZ.com --realm XYZ.COM Autodiscovery of servers for failover cannot work with this configuration. If you proceed with the installation, services will be configured to always access the discovered server for all operations and will not fail over to other servers in case of failure. Proceed with fixed values and no DNS discovery? [no]: yes Hostname: drxlceco6app01.XYZ.com Realm: XYZ.COM DNS Domain: XYZ.com IPA Server: prdipaco8ldm01.XYZ.com, drxipaco8lds01.XYZ.com BaseDN: dc=XYZ,dc=com Continue to configure the system with these values? [no]: yes User authorized to enroll computers: admin Synchronizing time with KDC... Unable to sync time with IPA NTP server, assuming the time is in sync. Please check that 123 UDP port is opened. Password for admin(a)XYZ.COM: Successfully retrieved CA cert Subject: CN=Certificate Authority,O=XYZ.COM Issuer: CN=Certificate Authority,O=XYZ.COM Valid From: Mon Apr 19 14:35:38 2021 UTC Valid Until: Fri Apr 19 14:35:38 2041 UTC Enrolled in IPA realm XYZ.COM Attempting to get host TGT... Created /etc/ipa/default.conf New SSSD config will be created Configured sudoers in /etc/nsswitch.conf Configured /etc/sssd/sssd.conf Configured /etc/krb5.conf for IPA realm XYZ.COM trying https://prdipaco8ldm01.XYZ.com/ipa/xml Forwarding 'env' to server u'https://prdipaco8ldm01.XYZ.com/ipa/xml' Hostname (drxlceco6app01.XYZ.com) not found in DNS Failed to update DNS records. Adding SSH public key from /etc/ssh/ssh_host_rsa_key.pub Forwarding 'host_mod' to server u'https://prdipaco8ldm01.XYZ.com/ipa/xml' Could not update DNS SSHFP records. SSSD enabled Configuring XYZ.com as NIS domain ======================================== Current /etc/nsswitch.conf entries as below. ======================================== passwd: files ldap shadow: files ldap group: files ldap hosts: files dns bootparams: nisplus [NOTFOUND=return] files ethers: files netmasks: files networks: files protocols: files rpc: files services: files netgroup: nisplus publickey: nisplus automount: files nisplus aliases: files nisplus ======================================== Complete client installation logs as below. ======================================== 2021-06-01T17:25:40Z DEBUG /usr/sbin/ipa-client-install was invoked with options: {'domain': 'XYZ.com', 'force': False, 'realm_name': 'XYZ.COM', 'krb5_offline_passwords': False, 'primary': True, 'mkhomedir': True, 'create_sshfp': True, 'conf_sshd': True, 'conf_ntp': True, 'on_master': False, 'ntp_server': None, 'nisdomain': None, 'no_nisdomain': False, 'principal': None, 'hostname': 'drxlceco6app01.XYZ.com', 'no_ac': False, 'unattended': None, 'sssd': True, 'trust_sshfp': False, 'kinit_attempts': 5, 'dns_updates': False, 'conf_sudo': True, 'conf_ssh': True, 'force_join': True, 'ca_cert_file': None, 'server': ['drxipaco8lds01.XYZ.com', 'prdipaco8ldm01.XYZ.com'], 'prompt_password': False, 'permit': False, 'debug': False, 'preserve_sssd': False, 'uninstall': False} 2021-06-01T17:25:40Z DEBUG missing options might be asked for interactively later 2021-06-01T17:25:40Z DEBUG Loading Index file from '/var/lib/ipa-client/sysrestore/sysrestore.index' 2021-06-01T17:25:40Z DEBUG Loading StateFile from '/var/lib/ipa-client/sysrestore/sysrestore.state' 2021-06-01T17:25:40Z DEBUG [IPA Discovery] 2021-06-01T17:25:40Z DEBUG Starting IPA discovery with domain=XYZ.com, servers=['drxipaco8lds01.XYZ.com', 'prdipaco8ldm01.XYZ.com'], hostname=drxlceco6app01.XYZ.com 2021-06-01T17:25:40Z DEBUG Server and domain forced 2021-06-01T17:25:40Z DEBUG [Kerberos realm search] 2021-06-01T17:25:40Z DEBUG Kerberos realm forced 2021-06-01T17:25:40Z DEBUG Search DNS for SRV record of _kerberos._udp.XYZ.com. 2021-06-01T17:25:40Z DEBUG No DNS record found 2021-06-01T17:25:40Z DEBUG SRV record for KDC not found! Domain: XYZ.com 2021-06-01T17:25:40Z DEBUG [LDAP server check] 2021-06-01T17:25:40Z DEBUG Verifying that drxipaco8lds01.XYZ.com (realm XYZ.COM) is an IPA server 2021-06-01T17:25:40Z DEBUG Init LDAP connection with: ldap://drxipaco8lds01.XYZ.com:389 2021-06-01T17:25:40Z DEBUG Search LDAP server for IPA base DN 2021-06-01T17:25:40Z DEBUG Check if naming context 'dc=XYZ,dc=com' is for IPA 2021-06-01T17:25:40Z DEBUG LDAP Error: Anonymous access not allowed 2021-06-01T17:25:40Z DEBUG Verifying that prdipaco8ldm01.XYZ.com (realm XYZ.COM) is an IPA server 2021-06-01T17:25:40Z DEBUG Init LDAP connection with: ldap://prdipaco8ldm01.XYZ.com:389 2021-06-01T17:25:40Z DEBUG Search LDAP server for IPA base DN 2021-06-01T17:25:40Z DEBUG Check if naming context 'dc=XYZ,dc=com' is for IPA 2021-06-01T17:25:40Z DEBUG LDAP Error: Anonymous access not allowed 2021-06-01T17:25:40Z DEBUG Generated basedn from realm: dc=XYZ,dc=com 2021-06-01T17:25:40Z DEBUG Discovery result: NO_ACCESS_TO_LDAP; server=None, domain=XYZ.com, kdc=None, basedn=dc=XYZ,dc=com 2021-06-01T17:25:40Z DEBUG Validated servers: prdipaco8ldm01.XYZ.com,drxipaco8lds01.XYZ.com 2021-06-01T17:25:40Z DEBUG will use discovered domain: XYZ.com 2021-06-01T17:25:40Z DEBUG Using servers from command line, disabling DNS discovery 2021-06-01T17:25:40Z DEBUG will use provided server: drxipaco8lds01.XYZ.com, prdipaco8ldm01.XYZ.com 2021-06-01T17:25:40Z INFO Autodiscovery of servers for failover cannot work with this configuration. 2021-06-01T17:25:40Z INFO If you proceed with the installation, services will be configured to always access the discovered server for all operations and will not fail over to other servers in case of failure. 2021-06-01T17:26:20Z DEBUG will use discovered realm: XYZ.COM 2021-06-01T17:26:20Z DEBUG will use discovered basedn: dc=XYZ,dc=com 2021-06-01T17:26:20Z INFO Hostname: drxlceco6app01.XYZ.com 2021-06-01T17:26:20Z DEBUG Hostname source: Provided as option 2021-06-01T17:26:20Z INFO Realm: XYZ.COM 2021-06-01T17:26:20Z DEBUG Realm source: Forced 2021-06-01T17:26:20Z INFO DNS Domain: XYZ.com 2021-06-01T17:26:20Z DEBUG DNS Domain source: Forced 2021-06-01T17:26:20Z INFO IPA Server: prdipaco8ldm01.XYZ.com, drxipaco8lds01.XYZ.com 2021-06-01T17:26:20Z DEBUG IPA Server source: Provided as option 2021-06-01T17:26:20Z INFO BaseDN: dc=XYZ,dc=com 2021-06-01T17:26:20Z DEBUG BaseDN source: Generated from Kerberos realm 2021-06-01T17:26:45Z DEBUG args=/usr/sbin/ipa-rmkeytab -k /etc/krb5.keytab -r XYZ.COM 2021-06-01T17:26:45Z DEBUG stdout= 2021-06-01T17:26:45Z DEBUG stderr=Failed to open keytab '/etc/krb5.keytab': No such file or directory 2021-06-01T17:26:45Z DEBUG args=/bin/hostname drxlceco6app01.XYZ.com 2021-06-01T17:26:45Z DEBUG stdout= 2021-06-01T17:26:45Z DEBUG stderr= 2021-06-01T17:26:45Z DEBUG Backing up system configuration file '/etc/sysconfig/network' 2021-06-01T17:26:45Z DEBUG Saving Index File to '/var/lib/ipa-client/sysrestore/sysrestore.index' 2021-06-01T17:26:45Z DEBUG args=/usr/sbin/selinuxenabled 2021-06-01T17:26:45Z DEBUG stdout= 2021-06-01T17:26:45Z DEBUG stderr= 2021-06-01T17:26:45Z DEBUG Saving StateFile to '/var/lib/ipa-client/sysrestore/sysrestore.state' 2021-06-01T17:26:51Z DEBUG will use principal provided as option: admin 2021-06-01T17:26:51Z INFO Synchronizing time with KDC... 2021-06-01T17:26:51Z DEBUG Search DNS for SRV record of _ntp._udp.XYZ.com. 2021-06-01T17:26:51Z DEBUG No DNS record found 2021-06-01T17:26:55Z DEBUG args=/usr/sbin/ntpdate -U ntp -s -b -v prdipaco8ldm01.XYZ.com 2021-06-01T17:26:55Z DEBUG stdout= 2021-06-01T17:26:55Z DEBUG stderr= 2021-06-01T17:26:59Z DEBUG args=/usr/sbin/ntpdate -U ntp -s -b -v prdipaco8ldm01.XYZ.com 2021-06-01T17:26:59Z DEBUG stdout= 2021-06-01T17:26:59Z DEBUG stderr= 2021-06-01T17:27:03Z DEBUG args=/usr/sbin/ntpdate -U ntp -s -b -v prdipaco8ldm01.XYZ.com 2021-06-01T17:27:03Z DEBUG stdout= 2021-06-01T17:27:03Z DEBUG stderr= 2021-06-01T17:27:03Z WARNING Unable to sync time with IPA NTP server, assuming the time is in sync. Please check that 123 UDP port is opened. 2021-06-01T17:27:03Z DEBUG Writing Kerberos configuration to /tmp/tmpGWIbHp: 2021-06-01T17:27:03Z DEBUG #File modified by ipa-client-install includedir /var/lib/sss/pubconf/krb5.include.d/ [libdefaults] default_realm = XYZ.COM dns_lookup_realm = false dns_lookup_kdc = false rdns = false ticket_lifetime = 24h forwardable = yes udp_preference_limit = 0 [realms] XYZ.COM = { kdc = prdipaco8ldm01.XYZ.com:88 master_kdc = prdipaco8ldm01.XYZ.com:88 admin_server = prdipaco8ldm01.XYZ.com:749 kdc = drxipaco8lds01.XYZ.com:88 master_kdc = drxipaco8lds01.XYZ.com:88 admin_server = drxipaco8lds01.XYZ.com:749 default_domain = XYZ.com pkinit_anchors = FILE:/etc/ipa/ca.crt } [domain_realm] .XYZ.com = XYZ.COM XYZ.com = XYZ.COM 2021-06-01T17:27:07Z DEBUG args=kinit admin(a)XYZ.COM 2021-06-01T17:27:07Z DEBUG stdout=Password for admin(a)XYZ.COM: 2021-06-01T17:27:07Z DEBUG stderr= 2021-06-01T17:27:07Z DEBUG trying to retrieve CA cert via LDAP from ldap://prdipaco8ldm01.XYZ.com 2021-06-01T17:27:07Z INFO Successfully retrieved CA cert Subject: CN=Certificate Authority,O=XYZ.COM Issuer: CN=Certificate Authority,O=XYZ.COM Valid From: Mon Apr 19 14:35:38 2021 UTC Valid Until: Fri Apr 19 14:35:38 2041 UTC 2021-06-01T17:27:08Z DEBUG args=/usr/sbin/ipa-join -s prdipaco8ldm01.XYZ.com -b dc=XYZ,dc=com -h drxlceco6app01.XYZ.com -f 2021-06-01T17:27:08Z DEBUG stdout= 2021-06-01T17:27:08Z DEBUG stderr=Failed to retrieve encryption type Triple DES cbc mode with HMAC/sha1 (#16) Failed to retrieve encryption type ArcFour with HMAC/md5 (#23) Keytab successfully retrieved and stored in: /etc/krb5.keytab Certificate subject base is: O=XYZ.COM 2021-06-01T17:27:08Z INFO Enrolled in IPA realm XYZ.COM 2021-06-01T17:27:08Z DEBUG args=kdestroy 2021-06-01T17:27:08Z DEBUG stdout= 2021-06-01T17:27:08Z DEBUG stderr= 2021-06-01T17:27:08Z INFO Attempting to get host TGT... 2021-06-01T17:27:08Z DEBUG args=/usr/bin/kinit -k -t /etc/krb5.keytab host/drxlceco6app01.XYZ.com(a)XYZ.COM 2021-06-01T17:27:08Z DEBUG stdout= 2021-06-01T17:27:08Z DEBUG stderr= 2021-06-01T17:27:08Z DEBUG Attempt 1/5 succeeded. 2021-06-01T17:27:08Z DEBUG Backing up system configuration file '/etc/ipa/default.conf' 2021-06-01T17:27:08Z DEBUG -> Not backing up - '/etc/ipa/default.conf' doesn't exist 2021-06-01T17:27:08Z INFO Created /etc/ipa/default.conf 2021-06-01T17:27:08Z DEBUG importing all plugin modules in '/usr/lib/python2.6/site-packages/ipalib/plugins'... 2021-06-01T17:27:08Z DEBUG importing plugin module '/usr/lib/python2.6/site-packages/ipalib/plugins/aci.py' 2021-06-01T17:27:08Z DEBUG importing plugin module '/usr/lib/python2.6/site-packages/ipalib/plugins/automember.py' 2021-06-01T17:27:08Z DEBUG importing plugin module '/usr/lib/python2.6/site-packages/ipalib/plugins/automount.py' 2021-06-01T17:27:08Z DEBUG importing plugin module '/usr/lib/python2.6/site-packages/ipalib/plugins/baseldap.py' 2021-06-01T17:27:08Z DEBUG importing plugin module '/usr/lib/python2.6/site-packages/ipalib/plugins/batch.py' 2021-06-01T17:27:08Z DEBUG importing plugin module '/usr/lib/python2.6/site-packages/ipalib/plugins/cert.py' 2021-06-01T17:27:08Z DEBUG importing plugin module '/usr/lib/python2.6/site-packages/ipalib/plugins/config.py' 2021-06-01T17:27:08Z DEBUG importing plugin module '/usr/lib/python2.6/site-packages/ipalib/plugins/delegation.py' 2021-06-01T17:27:08Z DEBUG importing plugin module '/usr/lib/python2.6/site-packages/ipalib/plugins/dns.py' 2021-06-01T17:27:08Z DEBUG importing plugin module '/usr/lib/python2.6/site-packages/ipalib/plugins/group.py' 2021-06-01T17:27:08Z DEBUG importing plugin module '/usr/lib/python2.6/site-packages/ipalib/plugins/hbacrule.py' 2021-06-01T17:27:08Z DEBUG importing plugin module '/usr/lib/python2.6/site-packages/ipalib/plugins/hbacsvc.py' 2021-06-01T17:27:08Z DEBUG importing plugin module '/usr/lib/python2.6/site-packages/ipalib/plugins/hbacsvcgroup.py' 2021-06-01T17:27:08Z DEBUG importing plugin module '/usr/lib/python2.6/site-packages/ipalib/plugins/hbactest.py' 2021-06-01T17:27:08Z DEBUG importing plugin module '/usr/lib/python2.6/site-packages/ipalib/plugins/host.py' 2021-06-01T17:27:08Z DEBUG importing plugin module '/usr/lib/python2.6/site-packages/ipalib/plugins/hostgroup.py' 2021-06-01T17:27:08Z DEBUG importing plugin module '/usr/lib/python2.6/site-packages/ipalib/plugins/idrange.py' 2021-06-01T17:27:08Z DEBUG importing plugin module '/usr/lib/python2.6/site-packages/ipalib/plugins/internal.py' 2021-06-01T17:27:08Z DEBUG importing plugin module '/usr/lib/python2.6/site-packages/ipalib/plugins/kerberos.py' 2021-06-01T17:27:08Z DEBUG importing plugin module '/usr/lib/python2.6/site-packages/ipalib/plugins/krbtpolicy.py' 2021-06-01T17:27:08Z DEBUG importing plugin module '/usr/lib/python2.6/site-packages/ipalib/plugins/migration.py' 2021-06-01T17:27:08Z DEBUG importing plugin module '/usr/lib/python2.6/site-packages/ipalib/plugins/misc.py' 2021-06-01T17:27:08Z DEBUG importing plugin module '/usr/lib/python2.6/site-packages/ipalib/plugins/netgroup.py' 2021-06-01T17:27:08Z DEBUG importing plugin module '/usr/lib/python2.6/site-packages/ipalib/plugins/passwd.py' 2021-06-01T17:27:08Z DEBUG importing plugin module '/usr/lib/python2.6/site-packages/ipalib/plugins/permission.py' 2021-06-01T17:27:08Z DEBUG importing plugin module '/usr/lib/python2.6/site-packages/ipalib/plugins/ping.py' 2021-06-01T17:27:08Z DEBUG importing plugin module '/usr/lib/python2.6/site-packages/ipalib/plugins/privilege.py' 2021-06-01T17:27:08Z DEBUG importing plugin module '/usr/lib/python2.6/site-packages/ipalib/plugins/pwpolicy.py' 2021-06-01T17:27:08Z DEBUG args=klist -V 2021-06-01T17:27:08Z DEBUG stdout=Kerberos 5 version 1.10.3 2021-06-01T17:27:08Z DEBUG stderr= 2021-06-01T17:27:08Z DEBUG importing plugin module '/usr/lib/python2.6/site-packages/ipalib/plugins/role.py' 2021-06-01T17:27:08Z DEBUG importing plugin module '/usr/lib/python2.6/site-packages/ipalib/plugins/selfservice.py' 2021-06-01T17:27:08Z DEBUG importing plugin module '/usr/lib/python2.6/site-packages/ipalib/plugins/selinuxusermap.py' 2021-06-01T17:27:08Z DEBUG importing plugin module '/usr/lib/python2.6/site-packages/ipalib/plugins/service.py' 2021-06-01T17:27:08Z DEBUG importing plugin module '/usr/lib/python2.6/site-packages/ipalib/plugins/sudocmd.py' 2021-06-01T17:27:08Z DEBUG importing plugin module '/usr/lib/python2.6/site-packages/ipalib/plugins/sudocmdgroup.py' 2021-06-01T17:27:08Z DEBUG importing plugin module '/usr/lib/python2.6/site-packages/ipalib/plugins/sudorule.py' 2021-06-01T17:27:08Z DEBUG importing plugin module '/usr/lib/python2.6/site-packages/ipalib/plugins/trust.py' 2021-06-01T17:27:08Z DEBUG importing plugin module '/usr/lib/python2.6/site-packages/ipalib/plugins/user.py' 2021-06-01T17:27:08Z DEBUG importing plugin module '/usr/lib/python2.6/site-packages/ipalib/plugins/virtual.py' 2021-06-01T17:27:08Z DEBUG importing plugin module '/usr/lib/python2.6/site-packages/ipalib/plugins/xmlclient.py' 2021-06-01T17:27:09Z DEBUG Backing up system configuration file '/etc/sssd/sssd.conf' 2021-06-01T17:27:09Z DEBUG -> Not backing up - '/etc/sssd/sssd.conf' doesn't exist 2021-06-01T17:27:09Z INFO New SSSD config will be created 2021-06-01T17:27:09Z DEBUG Backing up system configuration file '/etc/nsswitch.conf' 2021-06-01T17:27:09Z DEBUG Saving Index File to '/var/lib/ipa-client/sysrestore/sysrestore.index' 2021-06-01T17:27:09Z INFO Configured sudoers in /etc/nsswitch.conf 2021-06-01T17:27:09Z INFO Configured /etc/sssd/sssd.conf 2021-06-01T17:27:09Z DEBUG args=/usr/bin/certutil -A -d /etc/pki/nssdb -n IPA CA -t CT,C,C -a -i /etc/ipa/ca.crt 2021-06-01T17:27:09Z DEBUG stdout= 2021-06-01T17:27:09Z DEBUG stderr= 2021-06-01T17:27:09Z DEBUG Backing up system configuration file '/etc/krb5.conf' 2021-06-01T17:27:09Z DEBUG Saving Index File to '/var/lib/ipa-client/sysrestore/sysrestore.index' 2021-06-01T17:27:09Z DEBUG Writing Kerberos configuration to /etc/krb5.conf: 2021-06-01T17:27:09Z DEBUG #File modified by ipa-client-install includedir /var/lib/sss/pubconf/krb5.include.d/ [libdefaults] default_realm = XYZ.COM dns_lookup_realm = false dns_lookup_kdc = false rdns = false ticket_lifetime = 24h forwardable = yes udp_preference_limit = 0 [realms] XYZ.COM = { kdc = prdipaco8ldm01.XYZ.com:88 master_kdc = prdipaco8ldm01.XYZ.com:88 admin_server = prdipaco8ldm01.XYZ.com:749 kdc = drxipaco8lds01.XYZ.com:88 master_kdc = drxipaco8lds01.XYZ.com:88 admin_server = drxipaco8lds01.XYZ.com:749 default_domain = XYZ.com pkinit_anchors = FILE:/etc/ipa/ca.crt } [domain_realm] .XYZ.com = XYZ.COM XYZ.com = XYZ.COM 2021-06-01T17:27:09Z INFO Configured /etc/krb5.conf for IPA realm XYZ.COM 2021-06-01T17:27:09Z DEBUG args=keyctl search @s user ipa_session_cookie:host/drxlceco6app01.XYZ.com@XYZ.COM 2021-06-01T17:27:09Z DEBUG stdout= 2021-06-01T17:27:09Z DEBUG stderr=keyctl_search: Required key not available 2021-06-01T17:27:09Z DEBUG args=keyctl search @s user ipa_session_cookie:host/drxlceco6app01.XYZ.com@XYZ.COM 2021-06-01T17:27:09Z DEBUG stdout= 2021-06-01T17:27:09Z DEBUG stderr=keyctl_search: Required key not available 2021-06-01T17:27:09Z DEBUG failed to find session_cookie in persistent storage for principal 'host/drxlceco6app01.XYZ.com(a)XYZ.COM' 2021-06-01T17:27:09Z INFO trying https://prdipaco8ldm01.XYZ.com/ipa/xml 2021-06-01T17:27:09Z DEBUG Created connection context.xmlclient 2021-06-01T17:27:09Z DEBUG raw: env(None, server=True) 2021-06-01T17:27:09Z DEBUG env(None, server=True, all=True) 2021-06-01T17:27:09Z INFO Forwarding 'env' to server u'https://prdipaco8ldm01.XYZ.com/ipa/xml' 2021-06-01T17:27:09Z DEBUG NSSConnection init prdipaco8ldm01.XYZ.com 2021-06-01T17:27:09Z DEBUG Connecting: 10.113.10.50:0 2021-06-01T17:27:09Z DEBUG auth_certificate_callback: check_sig=True is_server=False Data: Version: 3 (0x2) Serial Number: 9 (0x9) Signature Algorithm: Algorithm: PKCS #1 SHA-256 With RSA Encryption Issuer: CN=Certificate Authority,O=XYZ.COM Validity: Not Before: Mon Apr 19 14:37:53 2021 UTC Not After: Thu Apr 20 14:37:53 2023 UTC Subject: CN=prdipaco8ldm01.XYZ.com,O=XYZ.COM Subject Public Key Info: Public Key Algorithm: Algorithm: PKCS #1 RSA Encryption RSA Public Key: Modulus: XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX: XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX: XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX: XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX: XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX: XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX: XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX: XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX: XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX: XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX: XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX: XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX: XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX: XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX: XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX: XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX Exponent: 65537 (0x10001) Signed Extensions: (7 total) Name: Certificate Authority Key Identifier Critical: False Key ID: XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX: XX:XX:XX:XX Serial Number: None General Names: [0 total] Name: Authority Information Access Critical: False Authority Information Access: [1 total] Info [1]: Method: PKIX Online Certificate Status Protocol Location: URI: http://ipa-ca.XYZ.com/ca/ocsp Name: Certificate Key Usage Critical: True Usages: Digital Signature Non-Repudiation Key Encipherment Data Encipherment Name: Extended Key Usage Critical: False Usages: TLS Web Server Authentication Certificate TLS Web Client Authentication Certificate Name: CRL Distribution Points Critical: False CRL Distribution Points: [1 total] Point [1]: General Names: [1 total] http://ipa-ca.XYZ.com/ipa/crl/MasterCRL.bin Issuer: Directory Name: CN=Certificate Authority,O=ipaca Reasons: () Name: Certificate Subject Key ID Critical: False Data: XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX: XX:XX:XX:XX Name: Certificate Subject Alt Name Critical: False Names: prdipaco8ldm01.XYZ.com ipa-ca.XYZ.com HTTP/prdipaco8ldm01.XYZ.com(a)XYZ.COM ['[0]', '[1]'] Signature: Signature Algorithm: Algorithm: PKCS #1 SHA-256 With RSA Encryption Signature: XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX: XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX: XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX: XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX: XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX: XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX: XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX: XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX: XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX: XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX: XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX: XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX: XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX: XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX: XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX: XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX: XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX: XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX: XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX: XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX: XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX: XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX: XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX: XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX Fingerprint (MD5): XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX Fingerprint (SHA1): XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX: XX:XX:XX:XX 2021-06-01T17:27:09Z DEBUG approved_usage = SSL Server intended_usage = SSL Server 2021-06-01T17:27:09Z DEBUG cert valid True for "CN=prdipaco8ldm01.XYZ.com,O=XYZ.COM" 2021-06-01T17:27:09Z DEBUG handshake complete, peer = 10.113.10.50:443 2021-06-01T17:27:09Z DEBUG Protocol: TLS1.2 2021-06-01T17:27:09Z DEBUG Cipher: TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 2021-06-01T17:27:09Z DEBUG received Set-Cookie 'ipa_session=MagBearerToken=Aus0%2bwdoksGBb%2belr0QOIi6Yk7TDzrcvkEuJLRtZf1KNWdahbAPsUyeWqGHs2CM72OMQKtkhONEi6FBan0Km69ssXfx%2bgu6r96B9VC4paNAXVi%2fVr3dd450OSsT1%2fHevzaAFoqFI0Mz95R%2bWgeIkuR4eZ%2fjvCLSGBlM3TwoQUMLA9CKKqPAh6kyN%2fMy6YaG0oXET1ht51P4zJ3rfXdPP9Ael%2bvTNQrS%2fiyCE%2b4TzjZtoNLHei2s5BoGlyZ3GPUS7;path=/ipa;httponly;secure;' 2021-06-01T17:27:09Z DEBUG storing cookie 'ipa_session=MagBearerToken=Aus0%2bwdoksGBb%2belr0QOIi6Yk7TDzrcvkEuJLRtZf1KNWdahbAPsUyeWqGHs2CM72OMQKtkhONEi6FBan0Km69ssXfx%2bgu6r96B9VC4paNAXVi%2fVr3dd450OSsT1%2fHevzaAFoqFI0Mz95R%2bWgeIkuR4eZ%2fjvCLSGBlM3TwoQUMLA9CKKqPAh6kyN%2fMy6YaG0oXET1ht51P4zJ3rfXdPP9Ael%2bvTNQrS%2fiyCE%2b4TzjZtoNLHei2s5BoGlyZ3GPUS7; Domain=prdipaco8ldm01.XYZ.com; Path=/ipa; Secure; HttpOnly' for principal host/drxlceco6app01.XYZ.com(a)XYZ.COM 2021-06-01T17:27:09Z DEBUG args=keyctl search @s user ipa_session_cookie:host/drxlceco6app01.XYZ.com@XYZ.COM 2021-06-01T17:27:09Z DEBUG stdout= 2021-06-01T17:27:09Z DEBUG stderr=keyctl_search: Required key not available 2021-06-01T17:27:09Z DEBUG args=keyctl search @s user ipa_session_cookie:host/drxlceco6app01.XYZ.com@XYZ.COM 2021-06-01T17:27:09Z DEBUG stdout= 2021-06-01T17:27:09Z DEBUG stderr=keyctl_search: Required key not available 2021-06-01T17:27:09Z DEBUG args=keyctl padd user ipa_session_cookie:host/drxlceco6app01.XYZ.com@XYZ.COM @s 2021-06-01T17:27:09Z DEBUG stdout=915601519 2021-06-01T17:27:09Z DEBUG stderr= 2021-06-01T17:27:09Z WARNING Hostname (drxlceco6app01.XYZ.com) not found in DNS 2021-06-01T17:27:09Z DEBUG Writing nsupdate commands to /etc/ipa/.dns_update.txt: 2021-06-01T17:27:09Z DEBUG zone XYZ.com. update delete drxlceco6app01.XYZ.com. IN A send update add drxlceco6app01.XYZ.com. 1200 IN A 10.111.5.11 send 2021-06-01T17:27:10Z DEBUG args=/usr/bin/nsupdate -g /etc/ipa/.dns_update.txt 2021-06-01T17:27:10Z DEBUG stdout= 2021-06-01T17:27:10Z DEBUG stderr=tkey query failed: GSSAPI error: Major = Unspecified GSS failure. Minor code may provide more information, Minor = Server DNS/udns1.ultradns.net(a)XYZ.COM not found in Kerberos database. 2021-06-01T17:27:10Z DEBUG nsupdate failed: Command '/usr/bin/nsupdate -g /etc/ipa/.dns_update.txt' returned non-zero exit status 1 2021-06-01T17:27:10Z ERROR Failed to update DNS records. 2021-06-01T17:27:10Z DEBUG args=/sbin/service messagebus start 2021-06-01T17:27:10Z DEBUG stdout=Starting system message bus: 2021-06-01T17:27:10Z DEBUG stderr= 2021-06-01T17:27:10Z DEBUG args=/sbin/service messagebus status 2021-06-01T17:27:10Z DEBUG stdout=messagebus (pid 1186) is running... 2021-06-01T17:27:10Z DEBUG stderr= 2021-06-01T17:27:10Z DEBUG args=/sbin/service certmonger restart 2021-06-01T17:27:10Z DEBUG stdout=Stopping certmonger: ?[60G[?[0;31mFAILED?[0;39m] Starting certmonger: ?[60G[?[0;32m OK ?[0;39m] 2021-06-01T17:27:10Z DEBUG stderr= 2021-06-01T17:27:10Z DEBUG args=/sbin/service certmonger status 2021-06-01T17:27:10Z DEBUG stdout=certmonger (pid 1974) is running... 2021-06-01T17:27:10Z DEBUG stderr= 2021-06-01T17:27:10Z DEBUG args=/sbin/service certmonger stop 2021-06-01T17:27:10Z DEBUG stdout=Stopping certmonger: ?[60G[?[0;32m OK ?[0;39m] 2021-06-01T17:27:10Z DEBUG stderr= 2021-06-01T17:27:11Z DEBUG args=/sbin/service certmonger restart 2021-06-01T17:27:11Z DEBUG stdout=Stopping certmonger: ?[60G[?[0;31mFAILED?[0;39m] Starting certmonger: ?[60G[?[0;32m OK ?[0;39m] 2021-06-01T17:27:11Z DEBUG stderr= 2021-06-01T17:27:11Z DEBUG args=/sbin/service certmonger status 2021-06-01T17:27:11Z DEBUG stdout=certmonger (pid 2063) is running... 2021-06-01T17:27:11Z DEBUG stderr= 2021-06-01T17:27:11Z DEBUG args=/sbin/chkconfig certmonger on 2021-06-01T17:27:11Z DEBUG stdout= 2021-06-01T17:27:11Z DEBUG stderr= 2021-06-01T17:27:12Z DEBUG args=ipa-getcert request -d /etc/pki/nssdb -n IPA Machine Certificate - drxlceco6app01.XYZ.com -N CN=drxlceco6app01.XYZ.com,O=XYZ.COM -K host/drxlceco6app01.XYZ.com(a)XYZ.COM 2021-06-01T17:27:12Z DEBUG stdout=New signing request "20210601172712" added. 2021-06-01T17:27:12Z DEBUG stderr= 2021-06-01T17:27:12Z INFO Adding SSH public key from /etc/ssh/ssh_host_rsa_key.pub 2021-06-01T17:27:12Z DEBUG raw: host_mod(u'drxlceco6app01.XYZ.com', ipasshpubkey=[u'ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAobH2Rt+aBxrhxWJazVGUpMej9nnncp8DhPewnZkyZxoSAyDc6C5c3nBqW22/Cr7gk26d/D2Ietbi0E7mFrt5Wo4bGgN2KcnlG3ABSifvwh3oqzL+anT6+/lkwzgm3hwIQQRDfF3/GljmvX495HateMqc7syLyOe5ZnKI4Xu6khQ/JF1hhv+8GiUbl7+le+QxYuosmNNIekfMqVbtJ8IM7Zf5/CXINIkwy1UtV+gl0JsAn6AlcBfLcsssg6LQVdgCCjVsJFNB2t+tR0LozJ8L5mDerKqVxJZWI3EnfLIXMq0VWoVfn20fPe0pkcoiyv9bQt/YsDxZS54BFjlTK7DpjQ=='], updatedns=False) 2021-06-01T17:27:12Z DEBUG host_mod(u'drxlceco6app01.XYZ.com', random=False, ipasshpubkey=(u'ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAobH2Rt+aBxrhxWJazVGUpMej9nnncp8DhPewnZkyZxoSAyDc6C5c3nBqW22/Cr7gk26d/D2Ietbi0E7mFrt5Wo4bGgN2KcnlG3ABSifvwh3oqzL+anT6+/lkwzgm3hwIQQRDfF3/GljmvX495HateMqc7syLyOe5ZnKI4Xu6khQ/JF1hhv+8GiUbl7+le+QxYuosmNNIekfMqVbtJ8IM7Zf5/CXINIkwy1UtV+gl0JsAn6AlcBfLcsssg6LQVdgCCjVsJFNB2t+tR0LozJ8L5mDerKqVxJZWI3EnfLIXMq0VWoVfn20fPe0pkcoiyv9bQt/YsDxZS54BFjlTK7DpjQ==',), rights=False, updatedns=False, all=False, raw=False, no_members=False) 2021-06-01T17:27:12Z INFO Forwarding 'host_mod' to server u'https://prdipaco8ldm01.XYZ.com/ipa/xml' 2021-06-01T17:27:12Z DEBUG NSSConnection init prdipaco8ldm01.XYZ.com 2021-06-01T17:27:12Z DEBUG Connecting: 10.113.10.50:0 2021-06-01T17:27:12Z DEBUG handshake complete, peer = 10.113.10.50:443 2021-06-01T17:27:12Z DEBUG Protocol: TLS1.2 2021-06-01T17:27:12Z DEBUG Cipher: TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 2021-06-01T17:27:12Z DEBUG received Set-Cookie 'ipa_session=MagBearerToken=yKnSiJdb44vhq6AuqB%2boAE5Fatp7CXJ8A9xYVUqlqXI73Gk9ukPfIr9%2bD6KnSCiBXmtVx3flwJ1Rf17528nymjCE5vMtNTSeVU5l8rn36fEtAFq6QZt%2bAHs2LjPLWwyR9geT7Y5aKgLbEMDzZv0DTwM3N2ocM0b7Rc6inZUvAgU%2fYmqmkZafsbYy%2fCUm2Kgyx%2b%2fZ6kQg%2fK94CVAqMLxZDE1k1gAP3qq98k%2fllMQu9k0GAYcdKEbmN%2bwff4LzeQRs;path=/ipa;httponly;secure;' 2021-06-01T17:27:12Z DEBUG storing cookie 'ipa_session=MagBearerToken=yKnSiJdb44vhq6AuqB%2boAE5Fatp7CXJ8A9xYVUqlqXI73Gk9ukPfIr9%2bD6KnSCiBXmtVx3flwJ1Rf17528nymjCE5vMtNTSeVU5l8rn36fEtAFq6QZt%2bAHs2LjPLWwyR9geT7Y5aKgLbEMDzZv0DTwM3N2ocM0b7Rc6inZUvAgU%2fYmqmkZafsbYy%2fCUm2Kgyx%2b%2fZ6kQg%2fK94CVAqMLxZDE1k1gAP3qq98k%2fllMQu9k0GAYcdKEbmN%2bwff4LzeQRs; Domain=prdipaco8ldm01.XYZ.com; Path=/ipa; Secure; HttpOnly' for principal host/drxlceco6app01.XYZ.com(a)XYZ.COM 2021-06-01T17:27:12Z DEBUG args=keyctl search @s user ipa_session_cookie:host/drxlceco6app01.XYZ.com@XYZ.COM 2021-06-01T17:27:12Z DEBUG stdout=915601519 2021-06-01T17:27:12Z DEBUG stderr= 2021-06-01T17:27:12Z DEBUG args=keyctl search @s user ipa_session_cookie:host/drxlceco6app01.XYZ.com@XYZ.COM 2021-06-01T17:27:12Z DEBUG stdout=915601519 2021-06-01T17:27:12Z DEBUG stderr= 2021-06-01T17:27:12Z DEBUG args=keyctl pupdate 915601519 2021-06-01T17:27:12Z DEBUG stdout= 2021-06-01T17:27:12Z DEBUG stderr= 2021-06-01T17:27:12Z DEBUG Caught fault 4202 from server https://prdipaco8ldm01.XYZ.com/ipa/xml: no modifications to be performed 2021-06-01T17:27:12Z DEBUG Writing nsupdate commands to /etc/ipa/.dns_update.txt: 2021-06-01T17:27:12Z DEBUG zone XYZ.com. update delete drxlceco6app01.XYZ.com. IN SSHFP send update add drxlceco6app01.XYZ.com. 1200 IN SSHFP 1 1 F6ABCFF542C5E35268387C2A53EBF83C5C6B0517 send 2021-06-01T17:27:12Z DEBUG args=/usr/bin/nsupdate -g /etc/ipa/.dns_update.txt 2021-06-01T17:27:12Z DEBUG stdout= 2021-06-01T17:27:12Z DEBUG stderr=tkey query failed: GSSAPI error: Major = Unspecified GSS failure. Minor code may provide more information, Minor = Server DNS/udns1.ultradns.net(a)XYZ.COM not found in Kerberos database. 2021-06-01T17:27:12Z DEBUG nsupdate failed: Command '/usr/bin/nsupdate -g /etc/ipa/.dns_update.txt' returned non-zero exit status 1 2021-06-01T17:27:12Z WARNING Could not update DNS SSHFP records. 2021-06-01T17:27:12Z DEBUG args=/sbin/service nscd status 2021-06-01T17:27:12Z DEBUG stdout=nscd is stopped 2021-06-01T17:27:12Z DEBUG stderr= 2021-06-01T17:27:12Z DEBUG args=/sbin/service nscd stop 2021-06-01T17:27:12Z DEBUG stdout= 2021-06-01T17:27:12Z DEBUG stderr= 2021-06-01T17:27:12Z DEBUG args=/sbin/chkconfig nscd off 2021-06-01T17:27:12Z DEBUG stdout= 2021-06-01T17:27:12Z DEBUG stderr= 2021-06-01T17:27:12Z DEBUG Saving StateFile to '/var/lib/ipa-client/sysrestore/sysrestore.state' 2021-06-01T17:27:12Z DEBUG Saving StateFile to '/var/lib/ipa-client/sysrestore/sysrestore.state' 2021-06-01T17:27:12Z DEBUG Saving StateFile to '/var/lib/ipa-client/sysrestore/sysrestore.state' 2021-06-01T17:27:15Z DEBUG args=/usr/sbin/authconfig --enablesssdauth --enablemkhomedir --update --enablesssd 2021-06-01T17:27:15Z DEBUG stdout=Starting sssd: ?[60G[?[0;32m OK ?[0;39m] Starting oddjobd: ?[60G[?[0;32m OK ?[0;39m] 2021-06-01T17:27:15Z DEBUG stderr= 2021-06-01T17:27:15Z INFO SSSD enabled 2021-06-01T17:27:15Z INFO Configuring XYZ.com as NIS domain 2021-06-01T17:27:15Z DEBUG args=/bin/nisdomainname 2021-06-01T17:27:15Z DEBUG stdout=(none) 2021-06-01T17:27:15Z DEBUG stderr= 2021-06-01T17:27:15Z DEBUG Saving StateFile to '/var/lib/ipa-client/sysrestore/sysrestore.state' 2021-06-01T17:27:15Z DEBUG args=/usr/sbin/authconfig --update --nisdomain XYZ.com 2021-06-01T17:27:15Z DEBUG stdout=Starting sssd: ?[60G[?[0;32m OK ?[0;39m] 2021-06-01T17:27:15Z DEBUG stderr= 2021-06-01T17:27:15Z DEBUG args=/bin/nisdomainname XYZ.com 2021-06-01T17:27:15Z DEBUG stdout= 2021-06-01T17:27:15Z DEBUG stderr= ======================================== I am unable to understand what i am missing or changes required in current config. Any help / suggestions appreciated. Regards, Rohan

2 1

Invalid CA chain after ca chain renewal
by Philipp Leusmann 09 Jun '21

09 Jun '21

Hi, I have just renewed freeipas externally signed CA certificate using 'ipa-cacert-manage renew --external-ca' Given the new CSR contains the same key elements as the previous one, I already had to ignore the duplicate while signing. Maybe that's the cause for the issues following? After renewing I now have the new and the old CA key in /etc/ipa/ca.crt and also in exported certificate chains which for example nginx cannot handle properly. 1) Did I do anything wrong during renewal? 2) how can I remove the previous CA cert? Thanks in advance, Philipp

2 2

Announcing SSSD 2.5.1
by Pavel Březina 08 Jun '21

08 Jun '21

# SSSD 2.5.01 The SSSD team is proud to announce the release of version 2.5.1 of the System Security Services Daemon. The tarball can be downloaded from: https://github.com/SSSD/sssd/releases/tag/2.5.1 See the full release notes at: https://sssd.io/release-notes/sssd-2.5.1.html RPM packages will be made available for Fedora shortly. ## Feedback Please provide comments, bugs and other feedback via the sssd-devel or sssd-users mailing lists: https://lists.fedorahosted.org/mailman/listinfo/sssd-devel https://lists.fedorahosted.org/mailman/listinfo/sssd-users ## Highlights ### New features * `auto_private_groups` option can be set centrally through ID range setting in IPA (see `ipa idrange` commands family). This feature requires SSSD update on both client and server. This feature also requires `freeipa 4.9.4` and newer. ### Important fixes * Fix `getsidbyname` issues with IPA users with a user-private-group ### Configuration changes * Default value of `ldap_sudo_random_offset` changed to `0` (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration.

1 0

various errors and warnings on F34: Can't contact LDAP server, Component identity is NULL; Failed to unwrap key for cipher
by Robert Kudyba 07 Jun '21

07 Jun '21

After upgrading to Fedora 34 and freeipa-server-4.9.3-2.fc34.x86_64, we're seeing the below errors. I found a previous post that mentions a user had these during a migration but we finished the migration a while ago: https://lists.fedoraproject.org/archives/list/freeipa-users@lists.fedorahos… ipactl status Directory Service: RUNNING krb5kdc Service: RUNNING kadmin Service: RUNNING named Service: RUNNING httpd Service: RUNNING ipa-custodia Service: RUNNING pki-tomcatd Service: RUNNING ipa-otpd Service: RUNNING ipa-dnskeysyncd Service: RUNNING ipa: INFO: The ipactl command was successful ipa cert-find shows 10 certs and all have a status of VALID. Apache logs do not have any errors. And the ipaupgrade.log ends with INFO The ipa-server-upgrade command was successful Jun 3 18:14:03 ourschoolipa-dnskeysyncd[5025]: ipa-dnskeysyncd: ERROR syncrepl_poll: LDAP error ({'result': -1, 'desc': "Can't contact LDAP server", 'ctrls': []}) Jun 3 18:14:06 ourschoolns-slapd[17715]: [03/Jun/2021:18:14:06.994125936 -0400] - ERR - allow_operation - Component identity is NULL Jun 3 18:14:10 ourschoolns-slapd[17715]: [03/Jun/2021:18:14:10.899216572 -0400] - ERR - attrcrypt_unwrap_key - Failed to unwrap key for cipher AES Jun 3 18:14:10 ourschoolns-slapd[17715]: [03/Jun/2021:18:14:10.955942900 -0400] - ERR - attrcrypt_cipher_init - Symmetric key failed to unwrap with the private key; Cert might have been renewed since the key is wrapped. To recover the encrypted contents, keep the wrapped symmetric key value. Jun 3 18:14:11 ourschoolns-slapd[17715]: [03/Jun/2021:18:14:11.022213263 -0400] - ERR - attrcrypt_init - All prepared ciphers are not available. Please disable attribute encryption. Jun 3 18:14:11 ourschoolns-slapd[17715]: [03/Jun/2021:18:14:11.090020323 -0400] - ERR - attrcrypt_unwrap_key - Failed to unwrap key for cipher 3DES Jun 3 18:14:11 ourschoolns-slapd[17715]: [03/Jun/2021:18:14:11.177952423 -0400] - ERR - schema-compat-plugin - scheduled schema-compat-plugin tree scan in about 5 seconds after the server startup! Jun 3 18:14:11 ourschoolns-slapd[17715]: [03/Jun/2021:18:14:11.875367301 -0400] - ERR - cos-plugin - cos_dn_defs_cb - Skipping CoS Definition cn=Password Policy,cn=accounts,dc=sub,dc=domain,dc=ourschool,dc=edu--no CoS Templates found, which should be added before the CoS Definition. Jun 3 18:14:11 ourschoolns-slapd[17715]: [03/Jun/2021:18:14:11.961081967 -0400] - ERR - schema-compat-plugin - schema-compat-plugin tree scan will start in about 5 seconds! Jun 3 18:14:17 ourschoolns-slapd[17715]: [03/Jun/2021:18:14:17.740194095 -0400] - ERR - schema-compat-plugin - warning: no entries set up under ou=sudoers,dc=sub,dc=domain,dc=ourschool,dc=edu Jun 3 18:14:17 ourschoolns-slapd[17715]: [03/Jun/2021:18:14:17.818774136 -0400] - ERR - schema-compat-plugin - warning: no entries set up under cn=ng, cn=compat,dc=sub,dc=domain,dc=ourschool,dc=edu Jun 3 18:14:18 ourschoolns-slapd[17715]: [03/Jun/2021:18:14:18.804889621 -0400] - ERR - schema-compat-plugin - warning: no entries set up under cn=computers, cn=compat,dc=sub,dc=domain,dc=ourschool,dc=edu Jun 3 18:14:18 ourschoolns-slapd[17715]: [03/Jun/2021:18:14:18.873391357 -0400] - ERR - schema-compat-plugin - Finished plugin initialization. Jun 3 18:14:11 ourschoolns-slapd[17715]: [03/Jun/2021:18:14:11.577526585 -0400] - WARN - NSACLPlugin - acl_parse - The ACL target cn=ad,cn=etc,dc=sub,dc=domain,dc=ourschool,dc=edu does not exist Jun 3 18:14:11 ourschoolns-slapd[17715]: [03/Jun/2021:18:14:11.599342179 -0400] - WARN - NSACLPlugin - acl_parse - The ACL target cn=casigningcert cert-pki-ca,cn=ca_renewal,cn=ipa,cn=etc,dc=sub,dc=domain,dc=ourschool,dc=edu does not exist

2 1

Improper format of Kerberos configuration - error from client setup
by lejeczek 07 Jun '21

07 Jun '21

Hi guys. I'm trying client install and I fail: ... Time synchronization was successful. Please make sure the following ports are opened in the firewall settings: TCP: 80, 88, 389 UDP: 88 (at least one of TCP/UDP ports 88 has to be open) Also note that following ports are necessary for ipa-client working properly after enrollment: TCP: 464 UDP: 464, 123 (if NTP enabled) Installation failed. Rolling back changes. Disabling client Kerberos and LDAP configurations nscd daemon is not installed, skip configuration nslcd daemon is not installed, skip configuration Client uninstall complete. Kerberos authentication failed: kinit: Improper format of Kerberos configuration file while initializing Kerberos 5 library This is the client's problem right? Reason I'm bit doubtful is such that all the usual places I made sure are plain-vanilla. What do I miss? many thanks, L.

2 1

How to blend IPA server 4.1.4 on F21 with server 4.6.8 on C7?
by Bret Wortman 04 Jun '21

04 Jun '21

I'm trying to update our IPA servers to newer OSes and IPA versions. What I've done so far: 1. run "ipa-replica-prepare" on the original main server, ipa1. 2. Copied the resulting file to ipa1c7. 3. Tried to import that file via "ipa-replica-install replica-info-ipa2c7.our.net.gpg --skip-conncheck --setup-dns --auto-forwarders". This typically fails: =========== [root@ipa2c7 ~]# ipa-replica-install replica-info-ipa2c7.our.net.gpg --skip-conncheck --setup-dns --auto-forwarders Directory Manager (existing master) password: ipaserver.install.server.replicainstall: ERROR Could not resolve hostname ipa1.our.net using DNS. Clients may not function properly. Please check your DNS setup. (Note that this check queries IPA DNS directly and ignores /etc/hosts.) Continue? [no]: yes Checking DNS forwarders, please wait ... Configuring NTP daemon (ntpd) [1/4]: stopping ntpd [2/4]: writing configuration [3/4]: configuring ntpd to start on boot [4/4]: starting ntpd Done configuring NTP daemon (ntpd). Configuring directory server (dirsrv). Estimated time: 30 seconds [1/42]: creating directory server instance [2/42]: enabling ldapi [3/42]: configure autobind for root [4/42]: stopping directory server [5/42]: updating configuration in dse.ldif [6/42]: starting directory server [7/42]: adding default schema [8/42]: enabling memberof plugin [9/42]: enabling winsync plugin [10/42]: configure password logging [11/42]: configuring replication version plugin [12/42]: enabling IPA enrollment plugin [13/42]: configuring uniqueness plugin [14/42]: configuring uuid plugin [15/42]: configuring modrdn plugin [16/42]: configuring DNS plugin [17/42]: enabling entryUSN plugin [18/42]: configuring lockout plugin [19/42]: configuring topology plugin [20/42]: creating indices [21/42]: enabling referential integrity plugin [22/42]: configuring certmap.conf [23/42]: configure new location for managed entries [24/42]: configure dirsrv ccache [25/42]: enabling SASL mapping fallback [26/42]: restarting directory server [27/42]: creating DS keytab [28/42]: ignore time skew for initial replication [29/42]: setting up initial replication Starting replication, please wait until this has completed. Update in progress, 3 seconds elapsed Update succeeded [30/42]: prevent time skew after initial replication [31/42]: adding sasl mappings to the directory [32/42]: updating schema [33/42]: setting Auto Member configuration [34/42]: enabling S4U2Proxy delegation [35/42]: initializing group membership [36/42]: adding master entry ipaserver.install.service: CRITICAL Failed to load master-entry.ldif: Command '/usr/bin/ldapmodify -v -f /tmp/tmp2nlWU3 -H ldapi://%2fvar%2frun%2fslapd-OUR-NET.socket -Y EXTERNAL' returned non-zero exit status 68 [error] CalledProcessError: Command '/usr/bin/ldapmodify -v -f /tmp/tmp2nlWU3 -H ldapi://%2fvar%2frun%2fslapd-OUR-NET.socket -Y EXTERNAL' returned non-zero exit status 68 Your system may be partly configured. Run /usr/sbin/ipa-server-install --uninstall to clean up. ipapython.admintool: ERROR Command '/usr/bin/ldapmodify -v -f /tmp/tmp2nlWU3 -H ldapi://%2fvar%2frun%2fslapd-OUR-NET.socket -Y EXTERNAL' returned non-zero exit status 68 ipapython.admintool: ERROR The ipa-replica-install command failed. See /var/log/ipareplica-install.log for more information [root@ipa2c7 ~]# host ipa1.our.net ipa1.our.net has address 192.168.2.61 =========== So I'm not sure why the DNS query is failing but it appears to be intermittent at best. Also, after near-misses when the ldap error occurs, I often get informed that we have an existing replication agreement that needs to be removed. When I follow the indicated steps: =========== [root@ipa1 ~]# ipa-replica-manage del ipa2c7.our.net --force Directory Manager password: Connection to 'ipa2c7.our.net' failed: Forcing removal of ipa2c7.our.net Skipping calculation to determine if one or more masters would be orphaned. Deleting replication agreements between ipa2c7.our.net and ipa1.our.net, ipa2.our.net, ipa3.our.net Failed to get list of agreements from 'ipa2c7.our.net': Forcing removal on 'ipa1.our.net' Any DNA range on 'ipa2c7.our.net' will be lost Deleted replication agreement from 'ipa1.our.net' to 'ipa2c7.our.net' 'ipa2.our.net' has no replication agreement for 'ipa2c7.our.net' Unable to remove replication agreement for ipa2c7.our.net from ipa2.our.net. Failed to determine agreement type for 'ipa3.our.net': Unable to remove replication agreement for ipa2c7.our.net from ipa3.our.net. Background task created to clean replication data. This may take a while. This may be safely interrupted with Ctrl+C ^C Wait for task interrupted. It will continue to run in the background Failed to cleanup ipa2c7.our.net entries: Not allowed on non-leaf entry You may need to manually remove them from the tree Failed to cleanup ipa2c7.our.net DNS entries: no matching entry found You may need to manually remove them from the tree [root@ipa1 ~]# =========== Is there something obvious that I've missed? -- Bret Wortman bret.wortman(a)damascusgrp.com

2 5

python3-ipaserver installutils.py missing IPA_MODULES list
by iulian roman 04 Jun '21

04 Jun '21

Hello everybody, I do not know if this is the right place to mentioned, but maybe there will be someone who can redirect me to the right list or support channel. On RHEL 8.3 , the latest python3-ipaserver package (python3-ipaserver-4.9.2-3.module+el8.4.0+10412+5ecb5b37) does not contain the IPA_MODULES list in the installutils.py package. Due to that, the ansible freeipa role will fail. Can you please suggest whom I should contact for that or where should it be reported ?

2 3

named won't start
by Bret Wortman 03 Jun '21

03 Jun '21

It's an ancient server, and one I'm trying to get us off of, but it's our current primary IPA server on this network and named didn't like its last reboot and is erroring on startup: [root@ipa1 ~]# systemctl status -l named-pkcs11.service ● named-pkcs11.service - Berkeley Internet Name Domain (DNS) with native PKCS#11 Loaded: loaded (/usr/lib/systemd/system/named-pkcs11.service; disabled) Active: failed (Result: exit-code) since Thu 2021-06-03 12:47:25 EDT; 13min ago Process: 1055 ExecStart=/usr/sbin/named-pkcs11 -u named $OPTIONS (code=exited, status=1/FAILURE) Process: 1053 ExecStartPre=/usr/sbin/named-checkconf -z /etc/named.conf (code=exited, status=0/SUCCESS) Jun 03 12:47:25 ipa1.our.net named-pkcs11[1057]: bind-dyndb-ldap version 6.1 compiled at 17:24:34 Dec 2 2014, compiler 4.9.2 20141101 (Red Hat 4.9.2-1) Jun 03 12:47:25 ipa1.our.net named-pkcs11[1057]: option 'serial_autoincrement' is not supported, ignoring Jun 03 12:47:25 ipa1.our.net named-pkcs11[1057]: GSSAPI client step 1 Jun 03 12:47:25 ipa1.our.net named-pkcs11[1057]: GSSAPI client step 1 Jun 03 12:47:25 ipa1.our.net named-pkcs11[1057]: LDAP error: Invalid credentials: SASL(-13): authentication failure: GSSAPI Failure: gss_accept_sec_context: bind to LDAP server failed Jun 03 12:47:25 ipa1.our.net named-pkcs11[1057]: couldn't establish connection in LDAP connection pool: permission denied Jun 03 12:47:25 ipa1.our.net systemd[1]: named-pkcs11.service: control process exited, code=exited status=1 Jun 03 12:47:25 ipa1.our.net systemd[1]: Failed to start Berkeley Internet Name Domain (DNS) with native PKCS#11. Jun 03 12:47:25 ipa1.our.net systemd[1]: Unit named-pkcs11.service entered failed state. Jun 03 12:47:25 ipa1.our.net systemd[1]: named-pkcs11.service failed. One of its replicas is still up and running so I'm not in emergency crisis mode yet. This server is running Fedora 21 and ipa-server 4.1.4-1. We got here as I was trying to take this server and replicate it to a C7 box running a more recent ipa-server (4.6.8-5) but couldn't get the replication to work. Along the way, I rebooted the F21 server and it came back in this state. What should I try next to get it back? -- Bret Wortman bret.wortman(a)damascusgrp.com

1 1

Automember Hostgroup Rule not applying to new hosts
by Russ Long 03 Jun '21

03 Jun '21

Hello, I have an automember rule for a hostgroup where it uses the nshostlocation of the host to then add the host to the group. When adding new hosts, which are installed via ipa-client-install, and then have the nshostlocation added via ipa host-mod, all in an automated process, the new hosts are not being added to the group. If I run an automembership rebuild, the hosts are then added. As these hosts spin up and down frequently, having to manually trigger this is less than ideal. Is there a better way to handle this? I'm not dead set on using the nshostlocation for the automember rule, but it seemed the easiest and most appropriate for my situation. Thanks, Russ

2 3

Solve freeipa 'fragility' via orchestrated containers & whole-container upgrade?
by Harry G. Coin 03 Jun '21

03 Jun '21

Long time freeipa users have faced a certain 'fragility' freeipa has inherited, mostly as a result of freeipa being the 'band director' over a number of distinct subsystems maintained by various groups across the world. This or that 'little upgrade' in a seemingly small sub-part of freeipa 'suddenly breaks' major things like not being able to install a replica & etc, there's a quite a list and it's been going on for a few years at least to my knowledge. Usually one expects newer features to have bugs but none that disrupt core prior functionality. I wonder whether it would be a solution to this if free-ipa took a look at how a 'similar feeling' multi-host, multi-subsystem architecture has appeared to have solved this puzzle: ceph's 'containers' and 'orchestrator' / cephadm / 'ceph orch' concept. For some time, as freeipa, ceph relied on packages and 'dependency hell management' to operate as native packages across hosts connected on an internal network. Then in a very effective shift: they treated 'the contents of a container' much as 'one thing owned entirely by and released by ceph' and tested that -- each container housing known-good versions of dependent and third party modules as well as their own code -- 'as one thing', to the point of providing their own tool to 'download and manage upgrade installs in the proper sequence' across hosts providing this-or-that functionality. You might imagine a freeipa orchestrator upgrading masters and replicas in the correct order, freeipa devs knowing for certain-sure that no 'dnf upgrade' on the host will disrupt the setup that passed qa in the container... Will not 'corrupt a database' owing to a 'sync' with content one version understood but another did not, etc. Over these many months, while freeipa has struggled to provide consistent service and value, ceph has been working nearly flawlessly across many upgrade cycles and I think it's because ceph controls the versions of the subsystems in the containers-- and that improves QA and dramatically limits surprise breakages' that lead to the feeling of 'always catching up' under conditions of time pressure owing to down services, this or that distro's 100 package mantainers deciding when/if to include this/that patch and when to publish which new version, which are 'security updates', which are 'bug fix updates', etc. If freeipa server came in a container that was tested and QA'd as a container, deployed as a container, perhaps the 'fragility factor' would improve by 10x. My $0.02

3 4

ipa-replica-install failing - operations error: the changelog directory already exists and is not empty
by Sinh Lam 03 Jun '21

03 Jun '21

Hi Everyone - I’m running into this odd issue I can’t seem to find a resolution to. Long story short, my IPA master was on a system that had a power failure. Upon bring up, the dirsrv failed to start up due to a zero byte dse.ldif file. Used a “backup” of the file and my master seemed to have came back up ok however replication seems to have stopped working. When I noticed that replication wasn’t working from the replicas to the master I went digging and found this (which led me to try to recover by removing the old replicas and trying to do a reinstall) : replica.domain.net: replica last update status: Error (6) Replication error acquiring replica: Unable to acquire replica: there is no replicated area on the consumer server. Replication is aborting. (no such replica) last update ended: 2021-05-20 15:29:28+00:00 The above “last update” corresponds with the power outage that took down the IPA master. I’m trying to re-initialize the replication by doing a reinstall of the replica server but I’m failing with the following error : Disabled p11-kit-proxy Configuring directory server (dirsrv). Estimated time: 30 seconds [1/42]: creating directory server instance [2/42]: configure autobind for root [3/42]: tune ldbm plugin [4/42]: stopping directory server [5/42]: updating configuration in dse.ldif [6/42]: starting directory server [7/42]: adding default schema [8/42]: enabling memberof plugin [9/42]: enabling winsync plugin [10/42]: configure password logging [11/42]: configuring replication version plugin [12/42]: enabling IPA enrollment plugin [13/42]: configuring uniqueness plugin [14/42]: configuring uuid plugin [15/42]: configuring modrdn plugin [16/42]: configuring DNS plugin [17/42]: enabling entryUSN plugin [18/42]: configuring lockout plugin [19/42]: configuring topology plugin [20/42]: creating indices [21/42]: enabling referential integrity plugin [22/42]: configuring certmap.conf [23/42]: configure new location for managed entries [24/42]: configure dirsrv ccache and keytab [25/42]: enabling SASL mapping fallback [26/42]: restarting directory server [27/42]: creating DS keytab [28/42]: ignore time skew for initial replication [29/42]: setting up initial replication [error] DatabaseError: Operations error: The changelog directory [/var/lib/dirsrv/slapd-REPLICA-DOMAIN-NET/cldb] already exists and is not empty. Please choose a directory that does not exist or is empty. Your system may be partly configured. Run /usr/sbin/ipa-server-install --uninstall to clean up. Operations error: The changelog directory [/var/lib/dirsrv/slapd-REPLICA-DOMAIN-NET/cldb] already exists and is not empty. Please choose a directory that does not exist or is empty. The ipa-replica-install command failed. See /var/log/ipareplica-install.log for more information I’ve since done several uninstalls and verified at each uninstall the /var/lib/dirsrv directory is empty. Any pointers on how to get past this issue would be great since I have about 10 more replicas to get back up. Thanks. Sinh

3 5

groups imported incorrectly (made compat tree look out of sync memberUid)
by Scott Serr 02 Jun '21

02 Jun '21

A few months ago, using IPA 4.8.7, I imported users and groups from OpenLDAP: ipa -v migrate-ds --with-compat \ --bind-dn="cn=Manager,dc=example,dc=com" \ --user-container="ou=People,dc=example,dc=com" \ --user-objectclass="posixAccount" \ --group-container="ou=Group,dc=example,dc=com" \ --group-objectclass="posixGroup" \ --group-overwrite-gid \ --schema=RFC2307 \ ldap://openldap-server:389 Now, I've found a problem... In addition to the expected "member" attribute list on the group dn, I also have a memberUid attribute list. These memberUid attributes are not created when using IPA to assign users to groups, just during my import. An imported user: dn: cn=wahoo,cn=groups,cn=accounts,dc=example,dc=com member: uid=fred,cn=users,cn=accounts,dc=example,dc=com memberUid: fred dn: cn=wahoo,cn=groups,cn=compat,dc=example,dc=com memberUid: fred So, no harm done yet. Then I remove fred from the group wahoo. And I end up with this: dn: cn=wahoo,cn=groups,cn=accounts,dc=example,dc=com memberUid: fred dn: cn=wahoo,cn=groups,cn=compat,dc=example,dc=com memberUid: fred Now, anything pointing to my compat tree, still thinks fred is in the wahoo group. The solution is removing the memberUids from the cn=groups,cn=accounts,dc=example,dc=com tree, and the compat tree automatically reflects that change. Question: Is this a bug or did I do something wrong on the import? Thanks, Scott PS- If someone else runs into this, I hope I saved you time.

2 1

Re: IPA Reinstall
by Robert.Mattson＠L3Harris.com 01 Jun '21

01 Jun '21

Hi Florence, Thank you for taking the time to respond. We have a number of replicas in various campus locations around our region, and our state and country is currently locked-down with COVID restrictions, and it would take days to get to the replicas even without restrictions. We have had wide-scale WAN outages over weeks for this system. To describe our problem in a simplified manner; We had the IPA replicas ‘Location1R1’ and ‘Location2R1’ talking happily when the WAN between them went away, while it was down we added ‘Location2R2’ to ‘Location2R1’, and manually added some user-ranges for accounts at Location2. We also added a number of ipa-clients at Location2. When the WAN came back, ‘Location1R1’ and ‘Location2R1’ stopped sharing data because the CSN updates were dropped weeks ago. We re-initialized ‘Location2R1’ from ‘Location1R1’, however that has resulted in isolation of ‘Location2R2’. Most logins at Location2 fail, depending on where the DNS round-robin points SSSD at the time of login. We have multiple locations, each with a flavor of this issue. No replica has a complete picture of all replication agreements, host accounts and user accounts. Though we have had some success with continually re-initializing replicas. It was my hope, once the WAN was stabilized to remove and re ipa-server-install at our first server, then remove and re-run ipa-client-install then ipa-replica-install at each secondary server. I believe this would re-constitute the system, effectively by re-installation of that specific service. And yes, this would all be done via SSH. However, we meet the obstacles described in my initial email when performing the install a second time. Sincerely, and with many thanks in advance, Rob From: Florence Renaud via FreeIPA-users <freeipa-users(a)lists.fedorahosted.org> Sent: Wednesday, 2 June 2021 2:16 AM To: FreeIPA users list <freeipa-users(a)lists.fedorahosted.org> Cc: Mattson, Robert (FP) <Robert.Mattson(a)L3Harris.com>; Florence Renaud <flo(a)redhat.com> Subject: [EXTERNAL] [Freeipa-users] Re: IPA Reinstall Hi, the recommended way to uninstall a replica and reinstall it is described in the doc: 1. Uninstall the replica (https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/ht…) with ipa server-del and ipa-server-install --uninstall 2. re-install the replica as if it was a new one: https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/ht… Was there any reason to backup files and restore them? The replica installation should re-create everything. flo On Wed, May 26, 2021 at 7:32 AM Robert.Mattson--- via FreeIPA-users <freeipa-users(a)lists.fedorahosted.org<mailto:freeipa-users@lists.fedorahosted.org>> wrote: Dear Community, I'd like to uninstall and reinstall IPA from a CentOS box because its easier than reinstalling the OS completely. We have a number of replicas, and this host is installed using ipa-client-install and then ipa-replica-install. To remove it, I backup some data like /var/kerberos/krb5kdc/{cacert.pem,kd*} and /etc/httpd/conf/password.conf and then run '/usr/sbin/ipa-server-install --uninstall -U --ignore-topology-disconnect'. I then sed '/Environment=K/d', '/ExecStartPre/d', '/ExecStopPost/d' /etc/systemd/system/httpd.service I recreate the host-account on another replica using ipa host-add, then ipa hostgroup-add-member. On the now-removed host, I do some housekeeping like restoring the backed up files and then I run; /usr/sbin/ipa-client-install \ --password=${otp} \ --mkhomedir \ --no-ntp \ --unattended \ --domain=realm.name<http://realm.name> \ --realm=REALM.NAME<http://REALM.NAME> \ --ca-cert-file=/etc/pki/ca-trust/source/ca.crt then /usr/sbin/ipa-replica-install \ --dirsrv-cert-file=/etc/pki/tls/private/ipa.pkcs12 \ --http-cert-file=/etc/pki/tls/private/ipa.pkcs12 \ --dirsrv-pin=pwd \ --http-pin=pwd \ --unattended \ --no-pkinit \ --no-ntp I seem to get the following keytab request problem followed by dirsrv failure. from ipa-replica-install (4.6.4-10.el7.centos.3.x86_64). If I upgrade to 4.6.8-5.el7.centos.4.noarch.rpm, I get the same problem.[1] On serverb, the host which receives the binding request for the reinstall, I get permission denied the bind dn “” does not have permission in dirsrv error log…? Does anyone have any thoughts, Cheers and many thanks in advance, Rob [1] 2021-05-26T02:50:56Z DEBUG Backing up system configuration file '/etc/httpd/conf.d/ipa.conf' 2021-05-26T02:50:56Z DEBUG -> Not backing up - '/etc/httpd/conf.d/ipa.conf' doesn't exist 2021-05-26T02:50:56Z DEBUG Backing up system configuration file '/etc/httpd/conf.d/ipa-rewrite.conf' 2021-05-26T02:50:56Z DEBUG -> Not backing up - '/etc/httpd/conf.d/ipa-rewrite.conf' doesn't exist 2021-05-26T02:50:56Z DEBUG duration: 0 seconds 2021-05-26T02:50:56Z DEBUG [10/21]: setting up httpd keytab 2021-05-26T02:50:56Z DEBUG raw: service_add(u'HTTP/servera.system(a)REALM.NAME<mailto:servera.system@REALM.NAME>', force=True, version=u'2.230') 2021-05-26T02:50:56Z DEBUG service_add(ipapython.kerberos.Principal('HTTP/servera.system(a)REALM.NAME<mailto:servera.system@REALM.NAME>'), force=True, all=False, raw=False, version=u'2.230', no_members=False) 2021-05-26T02:50:56Z DEBUG flushing ldapi://%2Fvar%2Frun%2Fslapd-REALM-NAME.socket from SchemaCache 2021-05-26T02:50:56Z DEBUG retrieving schema for SchemaCache url=ldapi://%2Fvar%2Frun%2Fslapd-REALM-NAME.socket conn=<ldap.ldapobject.SimpleLDAPObject instance at 0x7f0d29f50368> 2021-05-26T02:50:57Z DEBUG raw: host_show(u'servera.system', version=u'2.230') 2021-05-26T02:50:57Z DEBUG host_show(u'servera.system', rights=False, all=False, raw=False, version=u'2.230', no_members=False) 2021-05-26T02:50:57Z DEBUG Backing up system configuration file '/var/lib/ipa/gssproxy/http.keytab' 2021-05-26T02:50:57Z DEBUG -> Not backing up - '/var/lib/ipa/gssproxy/http.keytab' doesn't exist 2021-05-26T02:50:57Z DEBUG Starting external process 2021-05-26T02:50:57Z DEBUG args=/usr/sbin/ipa-getkeytab -k /var/lib/ipa/gssproxy/http.keytab -p HTTP/servera.system(a)REALM.NAME<mailto:HTTP/servera.system@REALM.NAME> -H ldapi://%2Fvar%2Frun%2Fslapd-REALM-NAME.socket -Y EXTERNAL 2021-05-26T02:50:57Z DEBUG Process finished, return code=9 2021-05-26T02:50:57Z DEBUG stdout= 2021-05-26T02:50:57Z DEBUG stderr=Failed to parse result: unsupported extended operation Retrying with pre-4.0 keytab retrieval method... Failed to parse result: unsupported extended operation Failed to get keytab! Failed to get keytab 2021-05-26T02:50:57Z DEBUG Traceback (most recent call last): File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 570, in start_creation run_step(full_msg, method) File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 560, in run_step method() File "/usr/lib/python2.7/site-packages/ipaserver/install/httpinstance.py", line 637, in request_service_keytab super(HTTPInstance, self).request_service_keytab() File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 742, in request_service_keytab self.run_getkeytab(self.api.env.ldap_uri, self.keytab, self.principal) File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 732, in run_getkeytab ipautil.run(args, nolog=nolog) File "/usr/lib/python2.7/site-packages/ipapython/ipautil.py", line 562, in run raise CalledProcessError(p.returncode, arg_string, str(output)) CalledProcessError: Command '/usr/sbin/ipa-getkeytab -k /var/lib/ipa/gssproxy/http.keytab -p HTTP/servera.system(a)REALM.NAME<mailto:HTTP/servera.system@REALM.NAME> -H ldapi://%2Fvar%2Frun%2Fslapd-REALM-NAME.socket -Y EXTERNAL' returned non-zero exit status 9 2021-05-26T02:50:57Z DEBUG [error] CalledProcessError: Command '/usr/sbin/ipa-getkeytab -k /var/lib/ipa/gssproxy/http.keytab -p HTTP/servera.system(a)REALM.NAME<mailto:HTTP/servera.system@REALM.NAME> -H ldapi://%2Fvar%2Frun%2Fslapd-REALM-NAME.socket -Y EXTERNAL' returned non-zero exit status 9 2021-05-26T02:50:57Z DEBUG File "/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 178, in execute return_value = self.run() File "/usr/lib/python2.7/site-packages/ipapython/install/cli.py", line 319, in run return cfgr.run() File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 364, in run return self.execute() exc_handler(exc_info) <snip /> File "/usr/lib/python2.7/site-packages/ipapython/install/common.py", line 65, in _install for unused in self._installer(self.parent): File "/usr/lib/python2.7/site-packages/ipaserver/install/server/__init__.py", line 622, in main replica_install(self) File "/usr/lib/python2.7/site-packages/ipaserver/install/server/replicainstall.py", line 406, in decorated func(installer) File "/usr/lib/python2.7/site-packages/ipaserver/install/server/replicainstall.py", line 1487, in install fstore=fstore) File "/usr/lib/python2.7/site-packages/ipaserver/install/server/replicainstall.py", line 173, in install_http subject_base=config.subject_base, master_fqdn=config.master_host_name) File "/usr/lib/python2.7/site-packages/ipaserver/install/httpinstance.py", line 188, in create_instance self.start_creation() File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 570, in start_creation run_step(full_msg, method) File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 560, in run_step method() File "/usr/lib/python2.7/site-packages/ipaserver/install/httpinstance.py", line 637, in request_service_keytab super(HTTPInstance, self).request_service_keytab() File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 742, in request_service_keytab self.run_getkeytab(self.api.env.ldap_uri, self.keytab, self.principal) File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 732, in run_getkeytab ipautil.run(args, nolog=nolog) File "/usr/lib/python2.7/site-packages/ipapython/ipautil.py", line 562, in run raise CalledProcessError(p.returncode, arg_string, str(output)) 2021-05-26T02:50:57Z DEBUG The ipa-replica-install command failed, exception: CalledProcessError: Command '/usr/sbin/ipa-getkeytab -k /var/lib/ipa/gssproxy/http.keytab -p HTTP/servera.system(a)REALM.NAME<mailto:HTTP/servera.system@REALM.NAME> -H ldapi://%2Fvar%2Frun%2Fslapd-REALM-NAME.socket -Y EXTERNAL' returned non-zero exit status 9 2021-05-26T02:50:57Z ERROR Command '/usr/sbin/ipa-getkeytab -k /var/lib/ipa/gssproxy/http.keytab -p HTTP/servera.system(a)REALM.NAME<mailto:HTTP/servera.system@REALM.NAME> -H ldapi://%2Fvar%2Frun%2Fslapd-REALM-NAME.socket -Y EXTERNAL' returned non-zero exit status 9 2021-05-26T02:50:57Z ERROR The ipa-replica-install command failed. See /var/log/ipareplica-install.log for more information [2] [26/May/2021:12:50:47.240285166 +1000] - WARN - NSMMReplicationPlugin - repl5_inc_run - agmt="cn=meToservera.system" (servera:389): The remote replica has a different database generation ID than the local database. You may have to reinitialize the remote replica, or the local replica. [26/May/2021:12:50:47.858057379 +1000] - INFO - NSMMReplicationPlugin - repl5_tot_run - Beginning total update of replica "agmt="cn=meToservera.system" (servera:389)". [26/May/2021:12:50:50.679652092 +1000] - INFO - NSMMReplicationPlugin - repl5_tot_run - Finished total update of replica "agmt="cn=meToservera.system" (servera:389)". Sent 582 entries. [26/May/2021:12:50:52.158394667 +1000] - ERR - NSMMReplicationPlugin - acquire_replica - agmt="cn=meToservera.system" (servera:389): Unable to acquire replica: permission denied. The bind dn "" does not have permission to supply replication updates to the replica. Will retry later. [26/May/2021:12:50:55.079367688 +1000] - ERR - NSMMReplicationPlugin - acquire_replica - agmt="cn=meToservera.system" (servera:389): Unable to acquire replica: permission denied. The bind dn "" does not have permission to supply replication updates to the replica. Will retry later. [26/May/2021:12:50:58.084381230 +1000] - ERR - NSMMReplicationPlugin - acquire_replica - agmt="cn=meToservera.system" (servera:389): Unable to acquire replica: permission denied. The bind dn "" does not have permission to supply replication updates to the replica. Will retry later. [26/May/2021:12:51:01.092727541 +1000] - ERR - NSMMReplicationPlugin - acquire_replica - agmt="cn=meToservera.system" (servera:389): Unable to acquire replica: permission denied. The bind dn "" does not have permission to supply replication updates to the replica. Will retry later. CONFIDENTIALITY NOTICE: This email and any attachments are for the sole use of the intended recipient and may contain material that is proprietary, confidential, privileged or otherwise legally protected or restricted under applicable government laws. Any review, disclosure, distributing or other use without expressed permission of the sender is strictly prohibited. If you are not the intended recipient, please contact the sender and delete all copies without reading, printing, or saving. _______________________________________________ FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org<mailto:freeipa-users@lists.fedorahosted.org> To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org<mailto:freeipa-users-leave@lists.fedorahosted.org> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost… Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure

1 0

custom tls certtificate for web UI
by iulian roman 01 Jun '21

01 Jun '21

Hello everybody, I tried to change the WEB UI certificate with a custom certificate signed by our internal CA. The custom certificate was provided as a bundle (certificate + intermediates). The root ca which signs the intermediate was added in the truststore with ipa-cacert-manage. Everything was successful but when I accessed the Web UI I noticed that IPA provides only the certificate, not the full chain, which makes the certificate not trusted by the browsers (they are configured to trust only our internal root ca). Is there any method to configure IPA/Idm to provide the full certificate chain (certificate + intermediate) to the http clients or is there anything I configured wrong ?

2 2

cleanup of removed masters
by Stijn De Weirdt 01 Jun '21

01 Jun '21

hi all, our ipa-healthcheck gives some seemingly odd output: > Internal server error HTTPSConnectionPool(host='oldm2.domain', port=443): Max retries exceeded with url: /ca/rest/certs/search?size=3 (Caused by NewConnectionError('<urllib3.connection.VerifiedHTTPSConnection object at 0x7f32581cb748>: Failed to establish a new connection: [Errno -2] Name or service not known',)) > [ > { > "source": "pki.server.healthcheck.clones.connectivity_and_data", > "check": "ClonesConnectivyAndDataCheck", > "result": "ERROR", > "uuid": "c7694559-157f-42da-9722-29ab4308d8bc", > "when": "20210601115956Z", > "duration": "0.424097", > "kw": { > "status": "ERROR: pki-tomcat : Internal error testing CA clone. Host: oldm2.domain Port: 443" > } > }, googling the error itself, i find references to this being a false positive; but looking closer (and also the initial server error) give an actual error: they reference an old master (it's obviously not called oldm2, so i had to read it a few times to see it was actually this old host). a while ago we migrated our centos7 setup (oldm1 and oldm2) to rhel82 (newm3 and newm4), by following the migration guide https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/ht… i'm quite sure we followed all steps, including the final uninstall on oldm1 and oldm2. however, after starting to run ipa-healthcheck recently and seeing this error, we looked for other traces of the old servers and started to clean them up. the old hosts are no longer around, so no chance to rerun things or check logs. so far we removed a bunch of DNS entries where the oldm1 was still used, but we now also have some other ones that reference oldm2: e.g. the pki related error above, but also oldm2 is still referenced in some entries in our dirserv dse.ldif (2 nsslapd-referral, 3 nsds50ruv and 3 nsruvReplicaLastModified). the traces are only of oldm2, not sign of oldm1 there. i'd appreciate some tips/guidance for removing the pki reference to oldm2 and things we can do to cleanup the dse.ldif many many thanks, stijn

1 1

IPA Reinstall
by Robert.Mattson＠L3Harris.com 01 Jun '21

01 Jun '21

Dear Community, I'd like to uninstall and reinstall IPA from a CentOS box because its easier than reinstalling the OS completely. We have a number of replicas, and this host is installed using ipa-client-install and then ipa-replica-install. To remove it, I backup some data like /var/kerberos/krb5kdc/{cacert.pem,kd*} and /etc/httpd/conf/password.conf and then run '/usr/sbin/ipa-server-install --uninstall -U --ignore-topology-disconnect'. I then sed '/Environment=K/d', '/ExecStartPre/d', '/ExecStopPost/d' /etc/systemd/system/httpd.service I recreate the host-account on another replica using ipa host-add, then ipa hostgroup-add-member. On the now-removed host, I do some housekeeping like restoring the backed up files and then I run; /usr/sbin/ipa-client-install \ --password=${otp} \ --mkhomedir \ --no-ntp \ --unattended \ --domain=realm.name \ --realm=REALM.NAME \ --ca-cert-file=/etc/pki/ca-trust/source/ca.crt then /usr/sbin/ipa-replica-install \ --dirsrv-cert-file=/etc/pki/tls/private/ipa.pkcs12 \ --http-cert-file=/etc/pki/tls/private/ipa.pkcs12 \ --dirsrv-pin=pwd \ --http-pin=pwd \ --unattended \ --no-pkinit \ --no-ntp I seem to get the following keytab request problem followed by dirsrv failure. from ipa-replica-install (4.6.4-10.el7.centos.3.x86_64). If I upgrade to 4.6.8-5.el7.centos.4.noarch.rpm, I get the same problem.[1] On serverb, the host which receives the binding request for the reinstall, I get permission denied the bind dn "" does not have permission in dirsrv error log...? Does anyone have any thoughts, Cheers and many thanks in advance, Rob [1] 2021-05-26T02:50:56Z DEBUG Backing up system configuration file '/etc/httpd/conf.d/ipa.conf' 2021-05-26T02:50:56Z DEBUG -> Not backing up - '/etc/httpd/conf.d/ipa.conf' doesn't exist 2021-05-26T02:50:56Z DEBUG Backing up system configuration file '/etc/httpd/conf.d/ipa-rewrite.conf' 2021-05-26T02:50:56Z DEBUG -> Not backing up - '/etc/httpd/conf.d/ipa-rewrite.conf' doesn't exist 2021-05-26T02:50:56Z DEBUG duration: 0 seconds 2021-05-26T02:50:56Z DEBUG [10/21]: setting up httpd keytab 2021-05-26T02:50:56Z DEBUG raw: service_add(u'HTTP/servera.system(a)REALM.NAME', force=True, version=u'2.230') 2021-05-26T02:50:56Z DEBUG service_add(ipapython.kerberos.Principal('HTTP/servera.system(a)REALM.NAME'), force=True, all=False, raw=False, version=u'2.230', no_members=False) 2021-05-26T02:50:56Z DEBUG flushing ldapi://%2Fvar%2Frun%2Fslapd-REALM-NAME.socket from SchemaCache 2021-05-26T02:50:56Z DEBUG retrieving schema for SchemaCache url=ldapi://%2Fvar%2Frun%2Fslapd-REALM-NAME.socket conn=<ldap.ldapobject.SimpleLDAPObject instance at 0x7f0d29f50368> 2021-05-26T02:50:57Z DEBUG raw: host_show(u'servera.system', version=u'2.230') 2021-05-26T02:50:57Z DEBUG host_show(u'servera.system', rights=False, all=False, raw=False, version=u'2.230', no_members=False) 2021-05-26T02:50:57Z DEBUG Backing up system configuration file '/var/lib/ipa/gssproxy/http.keytab' 2021-05-26T02:50:57Z DEBUG -> Not backing up - '/var/lib/ipa/gssproxy/http.keytab' doesn't exist 2021-05-26T02:50:57Z DEBUG Starting external process 2021-05-26T02:50:57Z DEBUG args=/usr/sbin/ipa-getkeytab -k /var/lib/ipa/gssproxy/http.keytab -p HTTP/servera.system(a)REALM.NAME<mailto:HTTP/servera.system@REALM.NAME> -H ldapi://%2Fvar%2Frun%2Fslapd-REALM-NAME.socket -Y EXTERNAL 2021-05-26T02:50:57Z DEBUG Process finished, return code=9 2021-05-26T02:50:57Z DEBUG stdout= 2021-05-26T02:50:57Z DEBUG stderr=Failed to parse result: unsupported extended operation Retrying with pre-4.0 keytab retrieval method... Failed to parse result: unsupported extended operation Failed to get keytab! Failed to get keytab 2021-05-26T02:50:57Z DEBUG Traceback (most recent call last): File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 570, in start_creation run_step(full_msg, method) File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 560, in run_step method() File "/usr/lib/python2.7/site-packages/ipaserver/install/httpinstance.py", line 637, in request_service_keytab super(HTTPInstance, self).request_service_keytab() File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 742, in request_service_keytab self.run_getkeytab(self.api.env.ldap_uri, self.keytab, self.principal) File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 732, in run_getkeytab ipautil.run(args, nolog=nolog) File "/usr/lib/python2.7/site-packages/ipapython/ipautil.py", line 562, in run raise CalledProcessError(p.returncode, arg_string, str(output)) CalledProcessError: Command '/usr/sbin/ipa-getkeytab -k /var/lib/ipa/gssproxy/http.keytab -p HTTP/servera.system(a)REALM.NAME<mailto:HTTP/servera.system@REALM.NAME> -H ldapi://%2Fvar%2Frun%2Fslapd-REALM-NAME.socket -Y EXTERNAL' returned non-zero exit status 9 2021-05-26T02:50:57Z DEBUG [error] CalledProcessError: Command '/usr/sbin/ipa-getkeytab -k /var/lib/ipa/gssproxy/http.keytab -p HTTP/servera.system(a)REALM.NAME<mailto:HTTP/servera.system@REALM.NAME> -H ldapi://%2Fvar%2Frun%2Fslapd-REALM-NAME.socket -Y EXTERNAL' returned non-zero exit status 9 2021-05-26T02:50:57Z DEBUG File "/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 178, in execute return_value = self.run() File "/usr/lib/python2.7/site-packages/ipapython/install/cli.py", line 319, in run return cfgr.run() File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 364, in run return self.execute() exc_handler(exc_info) <snip /> File "/usr/lib/python2.7/site-packages/ipapython/install/common.py", line 65, in _install for unused in self._installer(self.parent): File "/usr/lib/python2.7/site-packages/ipaserver/install/server/__init__.py", line 622, in main replica_install(self) File "/usr/lib/python2.7/site-packages/ipaserver/install/server/replicainstall.py", line 406, in decorated func(installer) File "/usr/lib/python2.7/site-packages/ipaserver/install/server/replicainstall.py", line 1487, in install fstore=fstore) File "/usr/lib/python2.7/site-packages/ipaserver/install/server/replicainstall.py", line 173, in install_http subject_base=config.subject_base, master_fqdn=config.master_host_name) File "/usr/lib/python2.7/site-packages/ipaserver/install/httpinstance.py", line 188, in create_instance self.start_creation() File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 570, in start_creation run_step(full_msg, method) File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 560, in run_step method() File "/usr/lib/python2.7/site-packages/ipaserver/install/httpinstance.py", line 637, in request_service_keytab super(HTTPInstance, self).request_service_keytab() File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 742, in request_service_keytab self.run_getkeytab(self.api.env.ldap_uri, self.keytab, self.principal) File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 732, in run_getkeytab ipautil.run(args, nolog=nolog) File "/usr/lib/python2.7/site-packages/ipapython/ipautil.py", line 562, in run raise CalledProcessError(p.returncode, arg_string, str(output)) 2021-05-26T02:50:57Z DEBUG The ipa-replica-install command failed, exception: CalledProcessError: Command '/usr/sbin/ipa-getkeytab -k /var/lib/ipa/gssproxy/http.keytab -p HTTP/servera.system(a)REALM.NAME<mailto:HTTP/servera.system@REALM.NAME> -H ldapi://%2Fvar%2Frun%2Fslapd-REALM-NAME.socket -Y EXTERNAL' returned non-zero exit status 9 2021-05-26T02:50:57Z ERROR Command '/usr/sbin/ipa-getkeytab -k /var/lib/ipa/gssproxy/http.keytab -p HTTP/servera.system(a)REALM.NAME<mailto:HTTP/servera.system@REALM.NAME> -H ldapi://%2Fvar%2Frun%2Fslapd-REALM-NAME.socket -Y EXTERNAL' returned non-zero exit status 9 2021-05-26T02:50:57Z ERROR The ipa-replica-install command failed. See /var/log/ipareplica-install.log for more information [2] [26/May/2021:12:50:47.240285166 +1000] - WARN - NSMMReplicationPlugin - repl5_inc_run - agmt="cn=meToservera.system" (servera:389): The remote replica has a different database generation ID than the local database. You may have to reinitialize the remote replica, or the local replica. [26/May/2021:12:50:47.858057379 +1000] - INFO - NSMMReplicationPlugin - repl5_tot_run - Beginning total update of replica "agmt="cn=meToservera.system" (servera:389)". [26/May/2021:12:50:50.679652092 +1000] - INFO - NSMMReplicationPlugin - repl5_tot_run - Finished total update of replica "agmt="cn=meToservera.system" (servera:389)". Sent 582 entries. [26/May/2021:12:50:52.158394667 +1000] - ERR - NSMMReplicationPlugin - acquire_replica - agmt="cn=meToservera.system" (servera:389): Unable to acquire replica: permission denied. The bind dn "" does not have permission to supply replication updates to the replica. Will retry later. [26/May/2021:12:50:55.079367688 +1000] - ERR - NSMMReplicationPlugin - acquire_replica - agmt="cn=meToservera.system" (servera:389): Unable to acquire replica: permission denied. The bind dn "" does not have permission to supply replication updates to the replica. Will retry later. [26/May/2021:12:50:58.084381230 +1000] - ERR - NSMMReplicationPlugin - acquire_replica - agmt="cn=meToservera.system" (servera:389): Unable to acquire replica: permission denied. The bind dn "" does not have permission to supply replication updates to the replica. Will retry later. [26/May/2021:12:51:01.092727541 +1000] - ERR - NSMMReplicationPlugin - acquire_replica - agmt="cn=meToservera.system" (servera:389): Unable to acquire replica: permission denied. The bind dn "" does not have permission to supply replication updates to the replica. Will retry later. CONFIDENTIALITY NOTICE: This email and any attachments are for the sole use of the intended recipient and may contain material that is proprietary, confidential, privileged or otherwise legally protected or restricted under applicable government laws. Any review, disclosure, distributing or other use without expressed permission of the sender is strictly prohibited. If you are not the intended recipient, please contact the sender and delete all copies without reading, printing, or saving.

2 1

Kerberos Issues
by Mark Potter 01 Jun '21

01 Jun '21

Long story short, we had to redeploy part of our FreeIPA cluster. As far as I know I followed all of the proper procedures and everything seems to be working from the client side however we are getting a TON of these messages in krb5kdc.log ipa3.example.com krb5kdc[31232](info): TGS_REQ (8 etypes {18 17 20 19 16 23 25 26}) 10.6.21.19: LOOKING_UP_SERVER: authtime 0, host/ client100.example.com(a)EXAMPLE.COM for nfs/nfs1.example.com(a)EXAMPLE.COM, Server not found in Kerberos database client100.example.com has working forward and reverse DNS entries that resolve from all FreeIPA servers and from itself. nfs1.example.com has working forward and reverse entries that resolve from all FreeIPA servers and from itself, it is not part of the FreeIPA domain at all, it is still using the authentication we are replacing with FreeIPA. It is used for automount homedirs in FreeIPA but is not kerberized All of the clients reporting this error still properly automount homedirs and that is the only thing on nfs1.example.com. There is another mountpoint, also not kerberized, in the automount setup that is not throwing any errors and access extremely frequently. I am happy to provide any logs necessary to track this down. -- *Mark Potter*

2 2

ACME admin replication conflict
by Stijn De Weirdt 01 Jun '21

01 Jun '21

hello all, in our setup ipa-healthcheck reports an issue with a replication conflict on "dn: cn=Enterprise ACME Administrators,ou=groups,o=ipaca" the conflict and valid entry are almost identical: > Valid Entry: > > dn: cn=Enterprise ACME Administrators,ou=groups,o=ipaca > cn: Enterprise ACME Administrators > description: ACME RA accounts > objectClass: top > objectClass: groupOfUniqueNames > uniqueMember: uid=acme-master2.domain,ou=people,o=ipaca > uniqueMember: uid=ipara,ou=people,o=ipaca with the conflicting entry the same, except for the line > uniqueMember: uid=acme-master1.domain,ou=people,o=ipaca i would like some guidance what this means and how to proceed: delete the conflicting entry, swap to the conflicting entry, merge it (somehow) many thanks, stijn

2 2

Re: Can't Add Replica: The changelog directory CLDB already exists and is not empty
by Sinh Lam 01 Jun '21

01 Jun '21

This is an old thread but I’m running into this issue and was wondering if there was ever a resolution to this. Tldr - My master failed and was not able to start up due to the dse.ldif being a zero byte file and the .bak file was unusable as well. Ended up using the startOK file and that got my IPA master back up. I didn’t find out till a week or so later that my replication has stopped working and I’ve been trying to resolve this ever since. The error I’m getting when trying to set up a new replica is the error in the subject. These are the last couple entries in the journal logs for the dirsrv service : May 20 16:11:40 ns-slapd[5273]: [20/May/2021:16:11:40.900845676 +0000] - NOTICE - bdb_start - Detected Disorderly Shutdown last time Directory Server was running, recovering database. May 20 16:11:42 ns-slapd[5273]: [20/May/2021:16:11:42.103929069 +0000] - ERR - attrcrypt_unwrap_key - Failed to unwrap key for cipher AES May 20 16:11:42 ns-slapd[5273]: [20/May/2021:16:11:42.106523128 +0000] - ERR - attrcrypt_cipher_init - Symmetric key failed to unwrap with the private key; Cert might have been renewed since the key is wrapped. To recover the encrypted contents, keep the wrapped symmetric key value. May 20 16:11:42 ns-slapd[5273]: [20/May/2021:16:11:42.281157478 +0000] - ERR - attrcrypt_unwrap_key - Failed to unwrap key for cipher 3DES May 20 16:11:42 ns-slapd[5273]: [20/May/2021:16:11:42.284236656 +0000] - ERR - attrcrypt_cipher_init - Symmetric key failed to unwrap with the private key; Cert might have been renewed since the key is wrapped. To recover the encrypted contents, keep the wrapped symmetric key value. May 20 16:11:42 ns-slapd[5273]: [20/May/2021:16:11:42.287235192 +0000] - ERR - attrcrypt_init - All prepared ciphers are not available. Please disable attribute encryption. May 20 16:11:42 ns-slapd[5273]: [20/May/2021:16:11:42.464658571 +0000] - ERR - attrcrypt_unwrap_key - Failed to unwrap key for cipher AES May 20 16:11:42 ns-slapd[5273]: [20/May/2021:16:11:42.468260771 +0000] - ERR - attrcrypt_cipher_init - Symmetric key failed to unwrap with the private key; Cert might have been renewed since the key is wrapped. To recover the encrypted contents, keep the wrapped symmetric key value. May 20 16:11:42 ns-slapd[5273]: [20/May/2021:16:11:42.644832465 +0000] - ERR - attrcrypt_unwrap_key - Failed to unwrap key for cipher 3DES May 20 16:11:42 ns-slapd[5273]: [20/May/2021:16:11:42.647838123 +0000] - ERR - attrcrypt_cipher_init - Symmetric key failed to unwrap with the private key; Cert might have been renewed since the key is wrapped. To recover the encrypted contents, keep the wrapped symmetric key value. May 20 16:11:42 ns-slapd[5273]: [20/May/2021:16:11:42.650519798 +0000] - ERR - attrcrypt_init - All prepared ciphers are not available. Please disable attribute encryption. May 20 16:11:43 ns-slapd[5273]: [20/May/2021:16:11:43.015851937 +0000] - ERR - schema-compat-plugin - scheduled schema-compat-plugin tree scan in about 5 seconds after the server startup! May 20 16:11:43 ns-slapd[5273]: [20/May/2021:16:11:43.054457416 +0000] - WARN - NSACLPlugin - acl_parse - The ACL target cn=groups,cn=compat,dc=example,dc=net does not exist May 20 16:11:43 ns-slapd[5273]: [20/May/2021:16:11:43.056902182 +0000] - WARN - NSACLPlugin - acl_parse - The ACL target cn=computers,cn=compat,dc=example,dc=net does not exist May 20 16:11:43 ns-slapd[5273]: [20/May/2021:16:11:43.059621578 +0000] - WARN - NSACLPlugin - acl_parse - The ACL target cn=ng,cn=compat,dc=example,dc=net does not exist May 20 16:11:43 ns-slapd[5273]: [20/May/2021:16:11:43.061834684 +0000] - WARN - NSACLPlugin - acl_parse - The ACL target ou=sudoers,dc=example,dc=net does not exist May 20 16:11:43 ns-slapd[5273]: [20/May/2021:16:11:43.063891013 +0000] - WARN - NSACLPlugin - acl_parse - The ACL target cn=users,cn=compat,dc=example,dc=net does not exist May 20 16:11:43 ns-slapd[5273]: [20/May/2021:16:11:43.066217133 +0000] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=example,dc=net does not exist May 20 16:11:43 ns-slapd[5273]: [20/May/2021:16:11:43.068870945 +0000] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=example,dc=net does not exist May 20 16:11:43 ns-slapd[5273]: [20/May/2021:16:11:43.071006284 +0000] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=example,dc=net does not exist May 20 16:11:43 ns-slapd[5273]: [20/May/2021:16:11:43.073207989 +0000] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=example,dc=net does not exist May 20 16:11:43 ns-slapd[5273]: [20/May/2021:16:11:43.076186848 +0000] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=example,dc=net does not exist May 20 16:11:43 ns-slapd[5273]: [20/May/2021:16:11:43.078837082 +0000] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=example,dc=net does not exist May 20 16:11:43 ns-slapd[5273]: [20/May/2021:16:11:43.081064756 +0000] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=example,dc=net does not exist May 20 16:11:43 ns-slapd[5273]: [20/May/2021:16:11:43.083418248 +0000] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=example,dc=net does not exist May 20 16:11:43 ns-slapd[5273]: [20/May/2021:16:11:43.085693933 +0000] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=example,dc=net does not exist May 20 16:11:43 ns-slapd[5273]: [20/May/2021:16:11:43.088486548 +0000] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=example,dc=net does not exist May 20 16:11:43 ns-slapd[5273]: [20/May/2021:16:11:43.090954337 +0000] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=example,dc=net does not exist May 20 16:11:43 ns-slapd[5273]: [20/May/2021:16:11:43.105391221 +0000] - WARN - NSACLPlugin - acl_parse - The ACL target cn=ad,cn=etc,dc=example,dc=net does not exist May 20 16:11:43 ns-slapd[5273]: [20/May/2021:16:11:43.109923564 +0000] - WARN - NSACLPlugin - acl_parse - The ACL target cn=casigningcert cert-pki-ca,cn=ca_renewal,cn=ipa,cn=etc,dc=example,dc=net does not exist May 20 16:11:43 ns-slapd[5273]: [20/May/2021:16:11:43.111808229 +0000] - WARN - NSACLPlugin - acl_parse - The ACL target cn=casigningcert cert-pki-ca,cn=ca_renewal,cn=ipa,cn=etc,dc=example,dc=net does not exist May 20 16:11:43 ns-slapd[5273]: [20/May/2021:16:11:43.199628452 +0000] - WARN - NSACLPlugin - acl_parse - The ACL target cn=automember rebuild membership,cn=tasks,cn=config does not exist May 20 16:11:43 ns-slapd[5273]: [20/May/2021:16:11:43.207869328 +0000] - ERR - cos-plugin - cos_dn_defs_cb - Skipping CoS Definition cn=Password Policy,cn=accounts,dc=example,dc=net--no CoS Templates found, which should be added before the CoS Definition. May 20 16:11:43 ns-slapd[5273]: [20/May/2021:16:11:43.251700304 +0000] - INFO - slapd_daemon - slapd started. Listening on All Interfaces port 389 for LDAP requests May 20 16:11:43 ns-slapd[5273]: [20/May/2021:16:11:43.254651872 +0000] - INFO - slapd_daemon - Listening on All Interfaces port 636 for LDAPS requests May 20 16:11:43 ns-slapd[5273]: [20/May/2021:16:11:43.256778704 +0000] - INFO - slapd_daemon - Listening on /var/run/slapd-EXAMPLE-NET.socket for LDAPI requests May 20 16:11:43 systemd[1]: Started 389 Directory Server EXAMPLE-NET.. May 20 16:11:43 ns-slapd[5273]: [20/May/2021:16:11:43.310441141 +0000] - ERR - schema-compat-plugin - schema-compat-plugin tree scan will start in about 5 seconds! May 20 16:11:48 ns-slapd[5273]: [20/May/2021:16:11:48.503046676 +0000] - ERR - schema-compat-plugin - warning: no entries set up under cn=computers, cn=compat,dc=example,dc=net May 20 16:11:48 ns-slapd[5273]: [20/May/2021:16:11:48.514741500 +0000] - ERR - schema-compat-plugin - Finished plugin initialization. May 20 16:12:03 ns-slapd[5273]: [20/May/2021:16:12:03.319674451 +0000] - ERR - ipa-topology-plugin - ipa_topo_agreement_dn: no replica found May 20 16:12:03 ns-slapd[5273]: [20/May/2021:16:12:03.325071163 +0000] - ERR - ipa-topology-plugin - ipa_topo_agreement_dn: no replica found May 20 16:12:03 ns-slapd[5273]: [20/May/2021:16:12:03.329293579 +0000] - ERR - ipa-topology-plugin - ipa_topo_agreement_dn: no replica found May 20 16:12:03 ns-slapd[5273]: [20/May/2021:16:12:03.333178665 +0000] - ERR - ipa-topology-plugin - ipa_topo_agreement_dn: no replica found May 20 16:12:03 ns-slapd[5273]: [20/May/2021:16:12:03.336932011 +0000] - ERR - ipa-topology-plugin - ipa_topo_agreement_dn: no replica found May 20 16:12:03 ns-slapd[5273]: [20/May/2021:16:12:03.341244859 +0000] - ERR - ipa-topology-plugin - ipa_topo_agreement_dn: no replica found May 20 16:12:03 ns-slapd[5273]: [20/May/2021:16:12:03.345131920 +0000] - ERR - ipa-topology-plugin - ipa_topo_agreement_dn: no replica found May 20 16:12:03 ns-slapd[5273]: [20/May/2021:16:12:03.349357371 +0000] - ERR - ipa-topology-plugin - ipa_topo_agreement_dn: no replica found May 20 16:12:03 ns-slapd[5273]: [20/May/2021:16:12:03.353178446 +0000] - ERR - ipa-topology-plugin - ipa_topo_agreement_dn: no replica found May 20 16:12:51 ns-slapd[5273]: [20/May/2021:16:12:51.527767324 +0000] - ERR - NSMMReplicationPlugin - multimaster_extop_StartNSDS50ReplicationRequest - conn=77 op=5 replica="unknown": Unable to acquire replica: error: no such replica May 20 16:12:52 ns-slapd[5273]: [20/May/2021:16:12:52.283753249 +0000] - ERR - NSMMReplicationPlugin - multimaster_extop_StartNSDS50ReplicationRequest - conn=78 op=5 replica="unknown": Unable to acquire replica: error: no such replica May 20 16:12:52 ns-slapd[5273]: [20/May/2021:16:12:52.390379930 +0000] - ERR - NSMMReplicationPlugin - multimaster_extop_StartNSDS50ReplicationRequest - conn=79 op=5 replica="unknown": Unable to acquire replica: error: no such replica May 20 16:12:52 ns-slapd[5273]: [20/May/2021:16:12:52.957417497 +0000] - ERR - NSMMReplicationPlugin - multimaster_extop_StartNSDS50ReplicationRequest - conn=80 op=5 replica="unknown": Unable to acquire replica: error: no such replica May 20 16:12:53 ns-slapd[5273]: [20/May/2021:16:12:53.283781064 +0000] - ERR - NSMMReplicationPlugin - multimaster_extop_StartNSDS50ReplicationRequest - conn=81 op=5 replica="unknown": Unable to acquire replica: error: no such replica May 20 16:12:55 ns-slapd[5273]: [20/May/2021:16:12:55.479234600 +0000] - ERR - NSMMReplicationPlugin - multimaster_extop_StartNSDS50ReplicationRequest - conn=82 op=5 replica="unknown": Unable to acquire replica: error: no such replica May 20 16:15:51 ns-slapd[5273]: [20/May/2021:16:15:51.868329611 +0000] - ERR - NSMMReplicationPlugin - multimaster_extop_StartNSDS50ReplicationRequest - conn=212 op=5 replica="unknown": Unable to acquire replica: error: no such replica May 20 16:16:24 ns-slapd[5273]: [20/May/2021:16:16:24.216095880 +0000] - ERR - NSMMReplicationPlugin - multimaster_extop_StartNSDS50ReplicationRequest - conn=233 op=5 replica="unknown": Unable to acquire replica: error: no such replica May 20 16:16:27 ns-slapd[5273]: [20/May/2021:16:16:27.408505127 +0000] - ERR - NSMMReplicationPlugin - multimaster_extop_StartNSDS50ReplicationRequest - conn=240 op=5 replica="unknown": Unable to acquire replica: error: no such replica May 25 20:45:37 ns-slapd[5273]: [25/May/2021:20:45:37.356300061 +0000] - ERR - NSMMReplicationPlugin - multimaster_extop_StartNSDS50ReplicationRequest - conn=111801 op=5 replica="unknown": Unable to acquire replica: error: no such replica May 26 04:20:37 ns-slapd[5273]: [26/May/2021:04:20:37.246445897 +0000] - ERR - ipa-topology-plugin - ipa_topo_agreement_dn: no replica found May 26 04:20:37 ns-slapd[5273]: [26/May/2021:04:20:37.249257028 +0000] - ERR - ipa-topology-plugin - ipa_topo_agmt_del: cn=master.example.net-to-replica001.example.net May 26 04:20:39 ns-slapd[5273]: [26/May/2021:04:20:39.266434467 +0000] - WARN - modify_internal_entry - Can't modify task entry 'cn=clean 5,cn=cleanallruv,cn=tasks,cn=config'; No such object (32) May 26 04:20:41 ns-slapd[5273]: [26/May/2021:04:20:41.272692883 +0000] - WARN - modify_internal_entry - Can't modify task entry 'cn=clean 5,cn=cleanallruv,cn=tasks,cn=config'; No such object (32) May 26 04:20:43 ns-slapd[5273]: [26/May/2021:04:20:43.333985925 +0000] - WARN - modify_internal_entry - Can't modify task entry 'cn=clean 5,cn=cleanallruv,cn=tasks,cn=config'; No such object (32) May 26 04:20:43 ns-slapd[5273]: [26/May/2021:04:20:43.337030838 +0000] - ERR - NSMMReplicationPlugin - CleanAllRUV Task (rid 5): Could not find replica from dn(dc=example,dc=net) May 26 04:20:45 ns-slapd[5273]: [26/May/2021:04:20:45.342517080 +0000] - WARN - modify_internal_entry - Can't modify task entry 'cn=clean 5,cn=cleanallruv,cn=tasks,cn=config'; No such object (32) May 26 04:20:47 ns-slapd[5273]: [26/May/2021:04:20:47.348898719 +0000] - WARN - modify_internal_entry - Can't modify task entry 'cn=clean 5,cn=cleanallruv,cn=tasks,cn=config'; No such object (32) May 26 04:20:49 ns-slapd[5273]: [26/May/2021:04:20:49.355780507 +0000] - WARN - modify_internal_entry - Can't modify task entry 'cn=clean 5,cn=cleanallruv,cn=tasks,cn=config'; No such object (32) May 26 04:20:49 ns-slapd[5273]: [26/May/2021:04:20:49.358756218 +0000] - ERR - NSMMReplicationPlugin - CleanAllRUV Task (rid 5): Task failed...(-1) May 26 04:20:51 ns-slapd[5273]: [26/May/2021:04:20:51.364127080 +0000] - WARN - modify_internal_entry - Can't modify task entry 'cn=clean 5,cn=cleanallruv,cn=tasks,cn=config'; No such object (32) May 26 04:20:51 ns-slapd[5273]: [26/May/2021:04:20:51.406580664 +0000] - WARN - get_internal_entry - Can't find task entry 'cn=clean 5,cn=cleanallruv,cn=tasks,cn=config' May 26 04:20:51 ns-slapd[5273]: [26/May/2021:04:20:51.412684547 +0000] - ERR - ipa-topology-plugin - ipa_topo_util_cleanruv: failed to create cleanalltuv task May 28 00:08:17 ns-slapd[5273]: [28/May/2021:00:08:17.669467056 +0000] - ERR - log_ber_too_big_error - conn=173723 fd=156 Incoming BER Element may be misformed. This may indicate an attempt to use TLS on a plaintext port, IE ldaps://localhost:389. Check your client LDAP_URI settings. May 28 01:06:22 ns-slapd[5273]: [28/May/2021:01:06:22.406718855 +0000] - ERR - log_ber_too_big_error - conn=175016 fd=158 Incoming BER Element was 24019198018235050 bytes, max allowable is 209715200 bytes. Change the nsslapd-maxbersize attribute in cn=config to increase. May 28 15:50:43 ns-slapd[5273]: [28/May/2021:15:50:43.082273849 +0000] - ERR - log_ber_too_big_error - conn=195035 fd=289 Incoming BER Element may be misformed. This may indicate an attempt to use TLS on a plaintext port, IE ldaps://localhost:389. Check your client LDAP_URI settings. May 28 15:50:43 ns-slapd[5273]: [28/May/2021:15:50:43.097752625 +0000] - ERR - log_ber_too_big_error - conn=195036 fd=289 Incoming BER Element may be misformed. This may indicate an attempt to use TLS on a plaintext port, IE ldaps://localhost:389. Check your client LDAP_URI settings. May 29 12:43:13 ns-slapd[5273]: [29/May/2021:12:43:13.872403558 +0000] - ERR - log_ber_too_big_error - conn=222810 fd=357 Incoming BER Element may be misformed. This may indicate an attempt to use TLS on a plaintext port, IE ldaps://localhost:389. Check your client LDAP_URI settings. May 29 17:26:04 ns-slapd[5273]: [29/May/2021:17:26:04.858100977 +0000] - ERR - log_ber_too_big_error - conn=229005 fd=322 Incoming BER Element may be misformed. This may indicate an attempt to use TLS on a plaintext port, IE ldaps://localhost:389. Check your client LDAP_URI settings. May 31 11:05:27 ns-slapd[5273]: [31/May/2021:11:05:27.982685756 +0000] - ERR - connection_read_operation - conn=283764 received a non-LDAP message (tag 0x47, expected 0x30) May 31 11:05:31 ns-slapd[5273]: [31/May/2021:11:05:31.522716719 +0000] - ERR - connection_read_operation - conn=283766 received a non-LDAP message (tag 0x47, expected 0x30) May 31 11:31:27 ns-slapd[5273]: [31/May/2021:11:31:27.029834838 +0000] - ERR - connection_read_operation - conn=284343 received a non-LDAP message (tag 0x47, expected 0x30) May 31 11:31:27 ns-slapd[5273]: [31/May/2021:11:31:27.520938917 +0000] - ERR - connection_read_operation - conn=284344 received a non-LDAP message (tag 0x47, expected 0x30) I changed up the host info in the log output but otherwise log is still the same. Right now, as it is, the master works, the existing replicas are working but no new changes are getting pushed out. I would like to NOT rebuild the entire IPA infrastructure if I can avoid it to get replication back up and running so any help would be greatly appreciated. Thank you. Sinh Lam

1 0

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users June 2021