January 2022 - FreeIPA-users - Fedora mailing-lists

Global Password Policy Change
by sdfdfeew fdshjnbfdx 07 Jan '22

07 Jan '22

I want to change the global password policy, but don't want to require users change their passwords, even if they might not be compliant. Does anyone know what will happen if the global password policy is changed but passwords are not set to expire? I am hoping the policy will be in effect if a user changes their password, and for new users, but existing users who chose not to change their password will not impacted.

2 2

ipa-healthcheck false positives
by Ronald Wimmer 07 Jan '22

07 Jan '22

Is it true that these "Errors" appear on an IPA server without CA role present and can be ignored? CRITICAL: pki.server.healthcheck.certs.expiration.CASystemCertExpiryCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.certs.expiration.KRASystemCertExpiryCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.certs.expiration.OCSPSystemCertExpiryCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.certs.expiration.TKSSystemCertExpiryCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.certs.expiration.TPSSystemCertExpiryCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.certs.trustflags.CASystemCertTrustFlagCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.certs.trustflags.KRASystemCertTrustFlagCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.certs.trustflags.OCSPSystemCertTrustFlagCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.certs.trustflags.TKSSystemCertTrustFlagCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.certs.trustflags.TPSSystemCertTrustFlagCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.clones.connectivity_and_data.ClonesConnectivyAndDataCheck CRITICAL: pki.server.healthcheck.meta.csconfig.CADogtagCertsConfigCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.meta.csconfig.KRADogtagCertsConfigCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.meta.csconfig.OCSPDogtagCertsConfigCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.meta.csconfig.TKSDogtagCertsConfigCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.meta.csconfig.TPSDogtagCertsConfigCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.meta.connectivity.DogtagCACertsConnectivityCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.meta.connectivity.DogtagKRAConnectivityCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.meta.connectivity.DogtagOCSPConnectivityCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.meta.connectivity.DogtagTKSConnectivityCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.meta.connectivity.DogtagTPSConnectivityCheck: Invalid PKI instance: pki-tomcat CRITICAL: ipahealthcheck.ipa.roles.IPACRLManagerCheck: Unable to read /var/lib/pki/pki-tomcat/conf/ca/CS.cfg As well as these for a disabled trust domain? ERROR: ipahealthcheck.ipa.trust.IPATrustDomainsCheck.domain-list: /usr/sbin/sssctl domain-list reports mismatch: sssd domains mydomain.at, buero.mydomain.at, org.mydomain.at trust domains buero.mydomain.at, mydomain.at, org.mydomain.at, tk.mydomain.at ERROR: ipahealthcheck.ipa.trust.IPATrustCatalogCheck.domain-status: Execution of domain-status failed: CalledProcessError(Command ['/usr/sbin/sssctl', 'domain-status', 'tk.mydomain.at', '--active-server'] returned non-zero exit status 1: 'Unable to get online status\n') Cheers, Ronald

2 7

Modified ipa-rewrite.conf
by Ronald Wimmer 07 Jan '22

07 Jan '22

Is it okay to modify /etc/httpd/conf.d/ipa-rewrite.conf in order to put the WebGUI behind a Loadbalancer? Or will it break something I am not aware of? Modified version looks like this: > # VERSION 7 - DO NOT REMOVE THIS LINE > > RewriteEngine on > > RequestHeader edit Referer ^https://ipa\.linux\.mydomain\.at/ https://pipa08.linux.mydomain.at/ > > # By default forward all requests to /ipa. If you don't want IPA > # to be the default on your web server comment this line out. > #RewriteRule ^/$ https://pipa08.linux.mydomain.at/ipa/ui [L,NC,R=301] > > # Redirect to the fully-qualified hostname. Not redirecting to secure > # port so configuration files can be retrieved without requiring SSL. > #RewriteCond %{HTTP_HOST} !^pipa08.linux.mydomain.at$ [NC] > #RewriteCond %{HTTP_HOST} !^ipa-ca.linux.mydomain.at$ [NC] > #RewriteRule ^/ipa/(.*) http://pipa08.linux.mydomain.at/ipa/$1 [L,R=301] > > # Redirect to the secure port if not displaying an error or retrieving > # configuration. > #RewriteCond %{SERVER_PORT} !^443$ > #RewriteCond %{REQUEST_URI} !^/ipa/(errors|config|crl) > #RewriteCond %{REQUEST_URI} !^/ipa/[^\?]+(\.js|\.css|\.png|\.gif|\.ico|\.woff|\.svg|\.ttf|\.eot)$ > #RewriteRule ^/ipa/(.*) https://pipa08.linux.mydomain.at/ipa/$1 [L,R=301,NC] > > RewriteCond %{HTTP_HOST} ^ipa-ca.linux.mydomain.at$ [NC] > RewriteCond %{REQUEST_URI} !^/ipa/crl > RewriteCond %{REQUEST_URI} !^/(ca|kra|pki|acme) > RewriteRule ^/(.*) https://pipa08.linux.mydomain.at/$1 [L,R=301] > > # Rewrite for plugin index, make it like it's a static file > RewriteRule ^/ipa/ui/js/freeipa/plugins.js$ /ipa/wsgi/plugins.py [PT]

2 1

FreeIPA and Certbot ?
by Günther J. Niederwimmer 05 Jan '22

05 Jan '22

Hello list, Why are there actually problems between FreeIPA and Certbot? What I have found out so far is it no longer possible to install FreeIPA as a client and replication server if Certbot is installed before ipa-client- install? The question now is, are there also problems when Certbot is installed after FreeIPA? Can I still use Lestencryt at all? Thanks for an answer, -- mit freundlichen Grüßen / best regards Günther J. Niederwimmer

3 3

2 conflict entries found under the replication suffix o=ipaca - ? - issue
by lejeczek 05 Jan '22

05 Jan '22

Hi guys. -> $ ipa-healthcheck .. { "source": "ipahealthcheck.ds.replication", "check": "ReplicationCheck", "result": "WARNING", "uuid": "7ff8f869-36c8-411c-9c44-7cb323deaf95", "when": "20220104193941Z", "duration": "0.574693", "kw": { "key": "DSREPLLE0002", "items": [ "Replication", "Conflict Entries" ], "msg": "There were 2 conflict entries found under the replication suffix \"o=ipaca\"." } I have found some old tips here from the list but I'm not sure what to do with it. -> $ ldapsearch -H ldaps://$(hostname) -W -D 'cn=Directory Manager' -b 'o=ipaca' '(&(objectClass=ldapSubEntry)(nsds5ReplConflict=*))' nsds5ReplConflict Enter LDAP Password: # extended LDIF # # LDAPv3 # base <o=ipaca> with scope subtree # filter: (&(objectClass=ldapSubEntry)(nsds5ReplConflict=*)) # requesting: nsds5ReplConflict # # 7c395f01-6d6211ec-a624dc4c-7402d017 + admin-dzien.mine.private, people, ipaca dn: nsuniqueid=7c395f01-6d6211ec-a624dc4c-7402d017+uid=admin-dzien.mine.privat e,ou=people,o=ipaca nsds5ReplConflict: namingConflict (ADD) uid=admin-dzien.mine.private,ou=people ,o=ipaca # e6ed9901-6d6811ec-affe8b51-4855b2e0 + admin-swir.mine.private, people, ipaca dn: nsuniqueid=e6ed9901-6d6811ec-affe8b51-4855b2e0+uid=admin-swir.mine.private ,ou=people,o=ipaca nsds5ReplConflict: namingConflict (ADD) uid=admin-swir.mine.private,ou=people, o=ipaca Remove either entries? many thanks, L.

2 5

Re: SSL error after upgrade
by Per Qvindesland 05 Jan '22

05 Jan '22

Hi ScottMany thanks for the information and apologies for the delay in responding.I folllowed the information and it's all working now.RegardsPerOn 25 Dec 2021, at 17:06, "Dungan, Scott A. via FreeIPA-users" <freeipa-users(a)lists.fedorahosted.org> wrote:Hi, Per. I ran into the same problem and Alexander referred me to this link: https://www.mail-archive.com/freeipa-users@lists.fedorahosted.org/msg12583.… fix for us was is pretty easy: Make a backup of /etc/pki/pki-tomcat/server.xmlOn lines 129 and 171 of server.xml, you’ll see a value for “secret=” and “sharedSecret=.” Those values will be different and that is the cause of the problem. Both values should match what is found in the ProxyPassMatch statements located in the file /etc/httpd/conf.d/ipa-pki-proxy.conf. In my case, the value for secret= was correct and I just had to change the sharedSecert= to match.Restart services with ipactl restart -Scott From: Per Qvindesland via FreeIPA-users <freeipa-users(a)lists.fedorahosted.org> Sent: Wednesday, December 22, 2021 7:22 AM To: FreeIPA users list <freeipa-users(a)lists.fedorahosted.org> Cc: Per Qvindesland <perq(a)icloud.com> Subject: [Freeipa-users] SSL error after upgrade Hi All After an update to 4.9.6-10, I am unable to view any of the certificates that the IPA server has signed, I get error: An error has occurred (IPA Error 4301: CertificateOperationError) when I click on Authnticaiton -> Certificates, if I click on "Certificate Autorities" then I get popup message with the error "Failed to authenticate to CA REST API" and "An error has occurred (IPA Error 4016: RemoteRetrieveError)" is showing on the screen. ipactl status is showing everything as running:ipactl statusDirectory Service: RUNNINGkrb5kdc Service: RUNNINGkadmin Service: RUNNINGnamed Service: RUNNINGhttpd Service: RUNNINGipa-custodia Service: RUNNINGpki-tomcatd Service: RUNNINGsmb Service: RUNNINGwinbind Service: RUNNINGipa-otpd Service: RUNNINGipa-dnskeysyncd Service: RUNNINGipa: INFO: The ipactl command was successful Does anyone know what's causing this error? I ran ipa-healthcheck and pasted the output below, it reports that it's missing SRV records but the IPA server is the DNS server and it has the SRV records. RegardsPer ipa-healthcheckra.get_certificate(): Request failed with status 403: Non-2xx response from CA REST API: 403. (403)ra.get_certificate(): Request failed with status 403: Non-2xx response from CA REST API: 403. (403)ra.get_certificate(): Request failed with status 403: Non-2xx response from CA REST API: 403. (403)ra.get_certificate(): Request failed with status 403: Non-2xx response from CA REST API: 403. (403)ra.get_certificate(): Request failed with status 403: Non-2xx response from CA REST API: 403. (403)ra.get_certificate(): Request failed with status 403: Non-2xx response from CA REST API: 403. (403)ra.get_certificate(): Request failed with status 403: Non-2xx response from CA REST API: 403. (403)ra.get_certificate(): Request failed with status 403: Non-2xx response from CA REST API: 403. (403)ra.get_certificate(): Request failed with status 403: Non-2xx response from CA REST API: 403. (403)ra.get_certificate(): Request failed with status 403: Non-2xx response from CA REST API: 403. (403)[ { "source": "ipahealthcheck.dogtag.ca", "check": "DogtagCertsConnectivityCheck", "result": "ERROR", "uuid": "ac0200eb-3ec8-405f-ba5e-523cbb40ad6b", "when": "20211222151125Z", "duration": "0.016156", "kw": { "msg": "Request for certificate failed, Certificate operation cannot be completed: Request failed with status 403: Non-2xx response from CA REST API: 403. (403)" } }, { "source": "ipahealthcheck.ipa.certs", "check": "IPACertRevocation", "result": "ERROR", "uuid": "2f010c35-7d7d-431f-89b0-c342516cf296", "when": "20211222151130Z", "duration": "0.412221", "kw": { "key": "20211104170633", "serial": 7, "error": "Certificate operation cannot be completed: Request failed with status 403: Non-2xx response from CA REST API: 403. (403)", "msg": "Request for certificate serial number {serial} in request {key} failed: {error}" } }, { "source": "ipahealthcheck.ipa.certs", "check": "IPACertRevocation", "result": "ERROR", "uuid": "10a946e2-e511-417a-b189-a66f1b555470", "when": "20211222151130Z", "duration": "0.519989", "kw": { "key": "20211104170628", "serial": 5, "error": "Certificate operation cannot be completed: Request failed with status 403: Non-2xx response from CA REST API: 403. (403)", "msg": "Request for certificate serial number {serial} in request {key} failed: {error}" } }, { "source": "ipahealthcheck.ipa.certs", "check": "IPACertRevocation", "result": "ERROR", "uuid": "7c85e383-8508-4b8e-a10b-838b0b70eb73", "when": "20211222151130Z", "duration": "0.618106", "kw": { "key": "20211104170629", "serial": 2, "error": "Certificate operation cannot be completed: Request failed with status 403: Non-2xx response from CA REST API: 403. (403)", "msg": "Request for certificate serial number {serial} in request {key} failed: {error}" } }, { "source": "ipahealthcheck.ipa.certs", "check": "IPACertRevocation", "result": "ERROR", "uuid": "1776678c-d997-435b-b809-52576128a2e9", "when": "20211222151130Z", "duration": "0.709013", "kw": { "key": "20211104170630", "serial": 4, "error": "Certificate operation cannot be completed: Request failed with status 403: Non-2xx response from CA REST API: 403. (403)", "msg": "Request for certificate serial number {serial} in request {key} failed: {error}" } }, { "source": "ipahealthcheck.ipa.certs", "check": "IPACertRevocation", "result": "ERROR", "uuid": "f02ff5d9-13cf-4582-9bd3-7567b32c415d", "when": "20211222151130Z", "duration": "0.789825", "kw": { "key": "20211104170631", "serial": 1, "error": "Certificate operation cannot be completed: Request failed with status 403: Non-2xx response from CA REST API: 403. (403)", "msg": "Request for certificate serial number {serial} in request {key} failed: {error}" } }, { "source": "ipahealthcheck.ipa.certs", "check": "IPACertRevocation", "result": "ERROR", "uuid": "d30b17b3-f45e-4317-bf8e-c1c13c3f77e3", "when": "20211222151131Z", "duration": "0.903311", "kw": { "key": "20211104170632", "serial": 3, "error": "Certificate operation cannot be completed: Request failed with status 403: Non-2xx response from CA REST API: 403. (403)", "msg": "Request for certificate serial number {serial} in request {key} failed: {error}" } }, { "source": "ipahealthcheck.ipa.certs", "check": "IPACertRevocation", "result": "ERROR", "uuid": "32ff9bb7-69b8-4af3-8c20-9f2ab4394a73", "when": "20211222151131Z", "duration": "0.969296", "kw": { "key": "20211104170635", "serial": 34, "error": "Certificate operation cannot be completed: Request failed with status 403: Non-2xx response from CA REST API: 403. (403)", "msg": "Request for certificate serial number {serial} in request {key} failed: {error}" } }, { "source": "ipahealthcheck.ipa.certs", "check": "IPACertRevocation", "result": "ERROR", "uuid": "18fb96f0-7a64-4c1c-b03b-bb21e3f90bf1", "when": "20211222151131Z", "duration": "1.065584", "kw": { "key": "20211104170634", "serial": 8, "error": "Certificate operation cannot be completed: Request failed with status 403: Non-2xx response from CA REST API: 403. (403)", "msg": "Request for certificate serial number {serial} in request {key} failed: {error}" } }, { "source": "ipahealthcheck.ipa.certs", "check": "IPACertRevocation", "result": "ERROR", "uuid": "d82cdf6d-4d4b-44e4-9aa8-33211aa55c96", "when": "20211222151131Z", "duration": "1.116597", "kw": { "key": "20210811074531", "serial": 10, "error": "Certificate operation cannot be completed: Request failed with status 403: Non-2xx response from CA REST API: 403. (403)", "msg": "Request for certificate serial number {serial} in request {key} failed: {error}" } }, { "source": "ipahealthcheck.ipa.idns", "check": "IPADNSSystemRecordsCheck", "result": "WARNING", "uuid": "cc0c7d5c-1132-4b18-ac8e-c7625d3963f0", "when": "20211222151131Z", "duration": "0.015692", "kw": { "msg": "Expected SRV record missing", "key": "_ldap._tcp.proxdynamics.com.:ldap2.inne.proxdynamics.com." } }, { "source": "ipahealthcheck.ipa.idns", "check": "IPADNSSystemRecordsCheck", "result": "WARNING", "uuid": "f0d6873f-b681-457d-8006-9e5bb051b9df", "when": "20211222151131Z", "duration": "0.017296", "kw": { "msg": "Expected SRV record missing", "key": "_kerberos._tcp.proxdynamics.com.:ldap2.inne.proxdynamics.com." } }, { "source": "ipahealthcheck.ipa.idns", "check": "IPADNSSystemRecordsCheck", "result": "WARNING", "uuid": "92a5517d-5f73-4f49-8874-bf6bbeb2ed9d", "when": "20211222151131Z", "duration": "0.018275", "kw": { "msg": "Expected SRV record missing", "key": "_kerberos._udp.proxdynamics.com.:ldap2.inne.proxdynamics.com." } }, { "source": "ipahealthcheck.ipa.idns", "check": "IPADNSSystemRecordsCheck", "result": "WARNING", "uuid": "7f1994fb-e1dc-4d8c-93c5-5ba2e6652427", "when": "20211222151131Z", "duration": "0.019243", "kw": { "msg": "Expected SRV record missing", "key": "_kerberos-master._tcp.proxdynamics.com.:ldap2.inne.proxdynamics.com." } }, { "source": "ipahealthcheck.ipa.idns", "check": "IPADNSSystemRecordsCheck", "result": "WARNING", "uuid": "e9bbd202-8f37-4a44-b9b0-377ae5a53d08", "when": "20211222151131Z", "duration": "0.020150", "kw": { "msg": "Expected SRV record missing", "key": "_kerberos-master._udp.proxdynamics.com.:ldap2.inne.proxdynamics.com." } }, { "source": "ipahealthcheck.ipa.idns", "check": "IPADNSSystemRecordsCheck", "result": "WARNING", "uuid": "2d4a438f-6271-470e-a6f5-68a30858d928", "when": "20211222151131Z", "duration": "0.021502", "kw": { "msg": "Expected SRV record missing", "key": "_kpasswd._tcp.proxdynamics.com.:ldap2.inne.proxdynamics.com." } }, { "source": "ipahealthcheck.ipa.idns", "check": "IPADNSSystemRecordsCheck", "result": "WARNING", "uuid": "828efbaf-2071-4693-94f4-0e4c2ec884c0", "when": "20211222151131Z", "duration": "0.022772", "kw": { "msg": "Expected SRV record missing", "key": "_kpasswd._udp.proxdynamics.com.:ldap2.inne.proxdynamics.com." } }, { "source": "ipahealthcheck.ipa.idns", "check": "IPADNSSystemRecordsCheck", "result": "WARNING", "uuid": "b0a73e45-da65-43a6-a540-8e092e3e4d76", "when": "20211222151131Z", "duration": "0.023895", "kw": { "msg": "Expected SRV record missing", "key": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.proxdynamics.com.:ldap2…." } }, { "source": "ipahealthcheck.ipa.idns", "check": "IPADNSSystemRecordsCheck", "result": "WARNING", "uuid": "3329eea5-c794-4201-a973-82f22b58f151", "when": "20211222151131Z", "duration": "0.025341", "kw": { "msg": "Expected SRV record missing", "key": "_ldap._tcp.dc._msdcs.proxdynamics.com.:ldap2.inne.proxdynamics.com." } }, { "source": "ipahealthcheck.ipa.idns", "check": "IPADNSSystemRecordsCheck", "result": "WARNING", "uuid": "dde9dd12-e044-4bde-a75f-2ea4d96910dc", "when": "20211222151131Z", "duration": "0.027364", "kw": { "msg": "Expected SRV record missing", "key": "_kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.proxdynamics.com.:l…." } }, { "source": "ipahealthcheck.ipa.idns", "check": "IPADNSSystemRecordsCheck", "result": "WARNING", "uuid": "9ebec84f-aa7d-4ba9-8c4e-ca8dd2aa98c8", "when": "20211222151131Z", "duration": "0.029421", "kw": { "msg": "Expected SRV record missing", "key": "_kerberos._udp.Default-First-Site-Name._sites.dc._msdcs.proxdynamics.com.:l…." } }, { "source": "ipahealthcheck.ipa.idns", "check": "IPADNSSystemRecordsCheck", "result": "WARNING", "uuid": "cd921441-98bf-4fc1-a043-ed35a056e818", "when": "20211222151131Z", "duration": "0.030800", "kw": { "msg": "Expected SRV record missing", "key": "_kerberos._tcp.dc._msdcs.proxdynamics.com.:ldap2.inne.proxdynamics.com." } }, { "source": "ipahealthcheck.ipa.idns", "check": "IPADNSSystemRecordsCheck", "result": "WARNING", "uuid": "93f21c35-a10d-418b-a549-c0c70d6330cd", "when": "20211222151131Z", "duration": "0.031808", "kw": { "msg": "Expected SRV record missing", "key": "_kerberos._udp.dc._msdcs.proxdynamics.com.:ldap2.inne.proxdynamics.com." } }, { "source": "ipahealthcheck.ipa.idns", "check": "IPADNSSystemRecordsCheck", "result": "WARNING", "uuid": "331ef74f-e5d6-47d8-a666-a352320772de", "when": "20211222151131Z", "duration": "0.034319", "kw": { "msg": "Got {count} ipa-ca A records, expected {expected}", "count": 0, "expected": 1 } }] _______________________________________________FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.orgTo unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.orgFedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelinesList Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost… not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure

1 0

allowing password only one place
by Charles Hedrick 04 Jan '22

04 Jan '22

We have users who have otp set. I want to require them to use it except in one specific situation, where I want to be able to use a keytable to generate credentials for them (which have to work for all services). Can anyone think of a way to do this? Auth indicators doesn't seem to do the job, since it looks like a constraint on using the ticket, where I'm concerned with how it's generated. The only thing I've come up with is setting the directory server to override ipaUserAuthType for that host. There's got to be a better way.

1 0

listing current KCM ccaches
by Charles Hedrick 04 Jan '22

04 Jan '22

I'm trying to find ways to get rid of as much of my custom C coding as possible, since I may be the only one that can maintain it. One major one is renewd, which renews tgt's automatically. sssd can now do this. However I also need to kill the tickets when the user is no longer active. This could be done in a fairly simple shell script, but only if I can find a list of current active credential caches. At the moment the only way I can see to do that is to use tdbdump on secrets.ldb. I'm probably going to try that, but I'd prefer a better approach.

1 0

Replica install fails due nonexisting RID ranges
by Andrius Jurkus 03 Jan '22

03 Jan '22

Hello, I didint enable adrust or installed related packages, I dont use samba shares either on existing installation. I wanted to create additional replica, during install it asked what is NETBIOS name and if I want to generate SID identifiers for users (answered no) then process failed with errors below. Should I update my ID ranges? or there is replica install option to skip this setup. (I dont use cross AD trusts, or similar features) Configuring SID generation [1/7]: creating samba domain object Samba domain object already exists [2/7]: adding admin(group) SIDs Admin SID already set, nothing to do Admin group SID already set, nothing to do [3/7]: adding RID bases Found more than one local domain ID range with no RID base set. [error] RuntimeError: Too many ID ranges Your system may be partly configured. Run /usr/sbin/ipa-server-install --uninstall to clean up. Too many ID ranges 2021-12-27T17:56:04Z DEBUG [2/7]: adding admin(group) SIDs 2021-12-27T17:56:04Z DEBUG Admin SID already set, nothing to do 2021-12-27T17:56:04Z DEBUG Admin group SID already set, nothing to do 2021-12-27T17:56:04Z DEBUG step duration: SID generation __add_admin_sids 0.00 sec 2021-12-27T17:56:04Z DEBUG [3/7]: adding RID bases 2021-12-27T17:56:04Z CRITICAL Found more than one local domain ID range with no RID base set. 2021-12-27T17:56:04Z DEBUG Traceback (most recent call last): File "/usr/lib/python3.6/site-packages/ipaserver/install/service.py", line 635, in start_creation run_step(full_msg, method) File "/usr/lib/python3.6/site-packages/ipaserver/install/service.py", line 621, in run_step method() File "/usr/lib/python3.6/site-packages/ipaserver/install/adtrustinstance.py", line 380, in __add_rid_bases raise RuntimeError("Too many ID ranges\n") RuntimeError: Too many ID ranges 2021-12-27T17:56:04Z DEBUG [error] RuntimeError: Too many ID ranges 2021-12-27T17:56:04Z DEBUG File "/usr/lib/python3.6/site-packages/ipapython/admintool.py", line 180, in execute return_value = self.run() File "/usr/lib/python3.6/site-packages/ipapython/install/cli.py", line 342, in run return cfgr.run() File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 360, in run return self.execute() File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 386, in execute for rval in self._executor(): File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 431, in __runner exc_handler(exc_info) File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 460, in _handle_execute_exception self._handle_exception(exc_info) File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 450, in _handle_exception six.reraise(*exc_info) File "/usr/lib/python3.6/site-packages/six.py", line 693, in reraise raise value File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 421, in __runner step() File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 418, in <lambda> step = lambda: next(self.__gen) File "/usr/lib/python3.6/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from six.reraise(*exc_info) File "/usr/lib/python3.6/site-packages/six.py", line 693, in reraise raise value File "/usr/lib/python3.6/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from value = gen.send(prev_value) File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 655, in _configure next(executor) File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 431, in __runner exc_handler(exc_info) File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 460, in _handle_execute_exception self._handle_exception(exc_info) File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 518, in _handle_exception self.__parent._handle_exception(exc_info) File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 450, in _handle_exception six.reraise(*exc_info) File "/usr/lib/python3.6/site-packages/six.py", line 693, in reraise raise value File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 515, in _handle_exception super(ComponentBase, self)._handle_exception(exc_info) File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 450, in _handle_exception six.reraise(*exc_info) File "/usr/lib/python3.6/site-packages/six.py", line 693, in reraise raise value File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 421, in __runner step() File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 418, in <lambda> step = lambda: next(self.__gen) File "/usr/lib/python3.6/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from six.reraise(*exc_info) File "/usr/lib/python3.6/site-packages/six.py", line 693, in reraise raise value File "/usr/lib/python3.6/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from value = gen.send(prev_value) File "/usr/lib/python3.6/site-packages/ipapython/install/common.py", line 65, in _install for unused in self._installer(self.parent): File "/usr/lib/python3.6/site-packages/ipaserver/install/server/__init__.py", line 603, in main replica_install(self) File "/usr/lib/python3.6/site-packages/ipaserver/install/server/replicainstall.py", line 401, in decorated func(installer) File "/usr/lib/python3.6/site-packages/ipaserver/install/server/replicainstall.py", line 1371, in install adtrust.install(False, options, fstore, api) File "/usr/lib/python3.6/site-packages/ipaserver/install/adtrust.py", line 483, in install smb.create_instance() File "/usr/lib/python3.6/site-packages/ipaserver/install/adtrustinstance.py", line 895, in create_instance self.start_creation(show_service_name=False) File "/usr/lib/python3.6/site-packages/ipaserver/install/service.py", line 635, in start_creation run_step(full_msg, method) File "/usr/lib/python3.6/site-packages/ipaserver/install/service.py", line 621, in run_step method() File "/usr/lib/python3.6/site-packages/ipaserver/install/adtrustinstance.py", line 380, in __add_rid_bases raise RuntimeError("Too many ID ranges\n") 2021-12-27T17:56:04Z DEBUG The ipa-replica-install command failed, exception: RuntimeError: Too many ID ranges 2021-12-27T17:56:04Z ERROR Too many ID ranges

2 2

[pam] [sss_dp_on_reconnect] (0x0010): Could not reconnect to provider.
by Alexander Becker 03 Jan '22

03 Jan '22

Hello all, since some time we have some cases where a sssd login does not work anymore and a service restart is necessary. According to analysis, there is a high disk and CPU usage at that time. Affected are clients with Ubuntu 20.04 sssd 2.2.3 freeipa 4.8.6 We get the following error messages: sssd_pam.log [pam] [sss_dp_on_reconnect] (0x0010): Could not reconnect to ad.server provider. auth.log pam_sss(sshd:account): Access denied for user monitor: 4 (System error) sshd[3126935]: fatal: Access denied for user monitor by PAM account configuration [preauth]. Does anyone have any ideas?

2 1

2025

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users January 2022