January 2022 - FreeIPA-users - Fedora mailing-lists

Question about autoregistration
by Boris Behrens 27 Jan '22

27 Jan '22

Hi, this might be a dump question: Is there a way to let hosts register themself and force them into a hostgroup? Currently we have one enrollment user that allows systems to join our IPA installation. This user is in a lot of our automation scripts. Now I want to have some customer facing systems enrolled with IPA but I want to force these hosts into a specific host group. Because of the nature of the systems it's hard to determine the hosts via hostname or IP address. Cheers Boris -- Die Selbsthilfegruppe "UTF-8-Probleme" trifft sich diesmal abweichend im groÃƒ¼en Saal.

1 0

first replica master - Internal error testing KRA clone
by lejeczek 26 Jan '22

26 Jan '22

Hi guys. I believe that is reproducible every time - clean deployment, first master's ipa-healthcheck no problems, replica added still no problems, then on that first replica 'ipa-kra-install' and immediately: -> $ ipa-healthcheck Internal error testing KRA clone. KRA clone problem detected Host: swir.mine.private Port: 443 Unhandler rdtype 256 Unhandler rdtype 256 Unhandler rdtype 256 Unhandler rdtype 256 Unhandler rdtype 256 Unhandler rdtype 256 Unhandler rdtype 256 Unhandler rdtype 256 [ { "source": "pki.server.healthcheck.clones.connectivity_and_data", "check": "ClonesConnectivyAndDataCheck", "result": "ERROR", "uuid": "eed4f41f-27fe-4f37-aa01-d47602f2c58f", "when": "20220126174106Z", "duration": "1.207738", "kw": { "status": "ERROR: pki-tomcat : Internal error testing KRA clone. Host: swir.mine.private Port: 443" } } ] How critical is that and what to do to fix it? many thanks, L.

2 1

crypto policies but for SAMBA only - ?
by lejeczek 26 Jan '22

26 Jan '22

Hi guys. If that can be a news for some - I'd like to share a finding: it's possible to have ipa-integrated Samba serving non-enrolled clients, both Linux & Windows, with passwords for authentication. (which has been long & will continue to be a must-have for me) Question for @devel - above I get with simply by switching to 'LEGACY' - is it possible to do that but only for IPA-Samba(+ whatever required bits) as oppose to system-widely? It would be great to have IPA capable of that - perhaps an "enhancement" to future releases. many thanks, L.

2 6

IPA removal/uninstall renders box unable to login, including console - ?
by lejeczek 25 Jan '22

25 Jan '22

Hi guys. Has anybody seen, experienced that/similar? - this is a second master from which I uninstalled IPA successfully, cleanly and immediately after reboot system does not login users(not even tty console) Something to do with SELinux/fcontext - I had to def-policy-relabeled whole '/etc' many thanks, L.

2 6

[SSSD] Announcing SSSD 2.6.3
by Pavel Březina 25 Jan '22

25 Jan '22

# SSSD 2.6.3 The SSSD team is proud to announce the release of version 2.6.3 of the System Security Services Daemon. The tarball can be downloaded from: https://github.com/SSSD/sssd/releases/tag/2.6.3 See the full release notes at: https://sssd.io/release-notes/sssd-2.6.3.html RPM packages will be made available for Fedora shortly. ## Feedback Please provide comments, bugs and other feedback via the sssd-devel or sssd-users mailing lists: https://lists.fedorahosted.org/mailman/listinfo/sssd-devel https://lists.fedorahosted.org/mailman/listinfo/sssd-users ## Highlights ### Important fixes * A regression introduced in sssd-2.6.2 in the IPA provider that prevented users from login was fixed. Access control always denied access because the selinux_child returned an unexpected reply. * A critical regression that prevented authentication of users via AD and IPA providers was fixed. LDAP port was reused for Kerberos communication and this provider would send incomprehensible information to this port. * When authenticating AD users, backtrace was triggered even though everything was working correctly. This was caused by a search in the global catalog. Servers from the global catalog are filtered out of the list before writing the KDC info file. With this fix, SSSD does not attempt to write to the KDC info file when performing a GC lookup.

1 0

IPA yubikey duo
by Per Qvindesland 24 Jan '22

24 Jan '22

Hi Is there any information on how to implement IPA with yubikey duo? I had a look and it seems straightforward enough to implement duo and ssh https://duo.com/docs/duounix but it would be nice to be able to manage it through ipa. Regards Per Sent from my Commodore 64

2 1

CA - does it make sense with globbing/wildcard
by lejeczek 24 Jan '22

24 Jan '22

Hi guys I'm for the first time contemplating CA service from a public CA to subordinate IPA to it - would it make sense with a *.sub.domain cert, if such one cert one already has from that public CA, to still want to sub IPA's CA? (not a CA expert so go easy on me) many thanks, L.

2 3

Some ipa user passwords did not work after update
by Ronald Wimmer 24 Jan '22

24 Jan '22

On December the 30th we have updated the following packages on our IPA servers: Package list: 0:ipa-client-4.9.6-10.0.1.module+el8.5.0+20451+6c55862e.x86_64 0:ipa-client-common-4.9.6-10.0.1.module+el8.5.0+20451+6c55862e.noarch 0:ipa-common-4.9.6-10.0.1.module+el8.5.0+20451+6c55862e.noarch 0:ipa-selinux-4.9.6-10.0.1.module+el8.5.0+20451+6c55862e.noarch 0:ipa-server-4.9.6-10.0.1.module+el8.5.0+20451+6c55862e.x86_64 0:ipa-server-common-4.9.6-10.0.1.module+el8.5.0+20451+6c55862e.noarch 0:ipa-server-trust-ad-4.9.6-10.0.1.module+el8.5.0+20451+6c55862e.x86_64 0:python3-ipaclient-4.9.6-10.0.1.module+el8.5.0+20451+6c55862e.noarch 0:python3-ipalib-4.9.6-10.0.1.module+el8.5.0+20451+6c55862e.noarch 0:python3-ipaserver-4.9.6-10.0.1.module+el8.5.0+20451+6c55862e.noarch 0:389-ds-base-1.4.3.23-12.module+el8.5.0+20461+fe0fe228.x86_64 0:389-ds-base-libs-1.4.3.23-12.module+el8.5.0+20461+fe0fe228.x86_64 0:python3-lib389-1.4.3.23-12.module+el8.5.0+20461+fe0fe228.noarch 0:systemd-239-51.0.1.el8_5.3.x86_64 0:systemd-libs-239-51.0.1.el8_5.3.x86_64 0:systemd-pam-239-51.0.1.el8_5.3.x86_64 0:systemd-udev-239-51.0.1.el8_5.3.x86_64 0:kernel-4.18.0-348.7.1.el8_5.x86_64 0:kernel-core-4.18.0-348.7.1.el8_5.x86_64 0:kernel-modules-4.18.0-348.7.1.el8_5.x86_64 0:kernel-tools-4.18.0-348.7.1.el8_5.x86_64 0:kernel-tools-libs-4.18.0-348.7.1.el8_5.x86_64 0:kexec-tools-2.0.20-57.0.3.el8_5.1.x86_64 0:libipa_hbac-2.5.2-2.0.1.el8_5.3.x86_64 0:libsss_autofs-2.5.2-2.0.1.el8_5.3.x86_64 0:libsss_certmap-2.5.2-2.0.1.el8_5.3.x86_64 0:libsss_idmap-2.5.2-2.0.1.el8_5.3.x86_64 0:libsss_nss_idmap-2.5.2-2.0.1.el8_5.3.x86_64 0:libsss_simpleifp-2.5.2-2.0.1.el8_5.3.x86_64 0:libsss_sudo-2.5.2-2.0.1.el8_5.3.x86_64 1:openssl-1.1.1k-5.el8_5.x86_64 1:openssl-libs-1.1.1k-5.el8_5.x86_64 1:openssl-perl-1.1.1k-5.el8_5.x86_64 0:oraclelinux-release-el8-1.0-21.el8.x86_64 0:python3-libipa_hbac-2.5.2-2.0.1.el8_5.3.x86_64 0:python3-libsss_nss_idmap-2.5.2-2.0.1.el8_5.3.x86_64 0:python3-perf-4.18.0-348.7.1.el8_5.x86_64 0:python3-sss-2.5.2-2.0.1.el8_5.3.x86_64 0:python3-sss-murmur-2.5.2-2.0.1.el8_5.3.x86_64 0:python3-sssdconfig-2.5.2-2.0.1.el8_5.3.noarch 0:selinux-policy-3.14.3-80.0.2.el8_5.2.noarch 0:selinux-policy-targeted-3.14.3-80.0.2.el8_5.2.noarch 0:sssd-client-2.5.2-2.0.1.el8_5.3.x86_64 0:sssd-common-2.5.2-2.0.1.el8_5.3.x86_64 0:sssd-common-pac-2.5.2-2.0.1.el8_5.3.x86_64 0:sssd-dbus-2.5.2-2.0.1.el8_5.3.x86_64 0:sssd-ipa-2.5.2-2.0.1.el8_5.3.x86_64 0:sssd-kcm-2.5.2-2.0.1.el8_5.3.x86_64 0:sssd-krb5-common-2.5.2-2.0.1.el8_5.3.x86_64 0:sssd-nfs-idmap-2.5.2-2.0.1.el8_5.3.x86_64 0:sssd-tools-2.5.2-2.0.1.el8_5.3.x86_64 0:sssd-winbind-idmap-2.5.2-2.0.1.el8_5.3.x86_64 0:systemd-239-51.0.1.el8_5.2.x86_64 0:systemd-libs-239-51.0.1.el8_5.2.x86_64 0:systemd-pam-239-51.0.1.el8_5.2.x86_64 0:systemd-udev-239-51.0.1.el8_5.2.x86_64 0:kernel-uek-5.4.17-2136.302.6.1.el8uek.x86_64 After having updated these packages some of our ipa users (including admin) were not able to log in anymore. Fortunately, some users still worked allowing us to reset the passwords of the respective users. Can this be update related or is it just a coincidence? We had to reset the passwords and no time to hunt the problem down. But what can possibly have caused this? Cheers, Ronald

3 13

dependency blocks to install ipa-server on Centos 7
by Kathy Zhu 21 Jan '22

21 Jan '22

Hi List, When I tried to install ipa-server on Centos 7, I ran into the following: Error: Package: ipa-server-4.6.8-5.el7.centos.10.x86_64 (updates) Requires: mod_wsgi Available: mod_wsgi-3.4-18.el7.x86_64 (base) mod_wsgi = 3.4-18.el7 Available: python36-mod_wsgi-4.6.2-2.el7.ius.x86_64 (ius) mod_wsgi = 4.6.2 After upgrading to the latest, it's still the same. Does anyone know how to get by this? Many thanks! Kathy.

2 2

After OS/IPA updates Employee attributes in web app are blank
by Scott Serr 21 Jan '22

21 Jan '22

Attributes in the Employee Information section of the user web page are blank following a series of OS/IPA updates. The "ipa user-find --all" cli command shows these attributes fine. Specifically (in my case): Department Number Employee Number Employee Type I'm wondering if anyone else has seen this. Trying to find a small test case, I've found 1 of my development VMs that has some snapshots. It's Rocky 8. It has seen OS/IPA updates frequently in the last month. This VM also has a snapshot on December 8th. Now I have 3 clones of this VM (at different snapshot times): dev-current -- fails to show these attributes on user web page dev-dec8 -- shows these attributes dev-dec8-updated-to-current -- shows these attributes The system is mainly used to test updates, data remains the same. The only difference I can think of is "dev-current" has had *incremental* OS/IPA updates between Dec 8th and now. I'm combing through a filesystem diff, trying to figure out why they behave differently, /usr/share/ipa appears to be the same. Something else odd: "dev-current" has a new section "User attributes for SMB services" on the user web page. The dev-dec8 and dev-dec8-updated-to-current states/VMs don't have this section on the user web page. Interested in any troubleshooting ideas, or ideas of why this is happening. Thank you, Scott

3 6

2025

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users January 2022