January 2022 - FreeIPA-users - Fedora Mailing-Lists

by Mark Selby

My company has 6 FreeIPA servers across 3 different locations. Five of the six servers are ok, but one we could not login to. The error messages pointed to the expired certificate located at `/var/kerberos/krb5kdc/kdc.crt` My question is how do I "properly" renew or recreate this certificate. I have been able to renew it with the command listed below - but the renewed cert does not have the same characteristics as the other certs. The existing ones all see to be self signed with the specified profile while my new one does not have these features. It seems to be working Ok but it would great to understand how to generate this cert correctly. All is any help is greatly appreciated. The servers that work all display the following with using getcert list -f /var/kerberos/krb5kdc/kdc.crt Request ID '20191003181545': status: MONITORING stuck: no key pair storage: type=FILE,location='/var/kerberos/krb5kdc/kdc.key' certificate: type=FILE,location='/var/kerberos/krb5kdc/kdc.crt' CA: SelfSign issuer: CN=ipa01.sub1.acme.org,O=ACME.ORG subject: CN=ipa01.sub1.acme.org,O=ACME.ORG expires: 2022-08-09 22:06:33 UTC principal name: krbtgt/ACME.ORG(a)ACME.ORG certificate template/profile: KDCs_PKINIT_Certs pre-save command: post-save command: /usr/libexec/ipa/certmonger/renew_kdc_cert track: yes auto-renew: yes Using the local-getcert start-tracking command below gets me an updated cert but it is not self signed and does not have the specified profile. local-getcert start-tracking \ -k /var/kerberos/krb5kdc/kdc.key \ -f /var/kerberos/krb5kdc/kdc.crt \ -T KDCs_PKINIT_Certs \ -C /usr/libexec/ipa/certmonger/renew_kdc_cert Request ID '20220117193849': status: MONITORING stuck: no key pair storage: type=FILE,location='/var/kerberos/krb5kdc/kdc.key' certificate: type=FILE,location='/var/kerberos/krb5kdc/kdc.crt' CA: local issuer: CN=Certificate Authority,O=ACME.ORG subject: CN=vipa06.sub3.acme.org,O=ACME.ORG expires: 2024-01-18 17:32:20 UTC principal name: krbtgt/ACME.ORG(a)ACME.ORG key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment eku: id-kp-serverAuth,id-pkinit-KPKdc pre-save command: post-save command: /usr/libexec/ipa/certmonger/renew_kdc_cert track: yes auto-renew: yes

2 years, 3 months

2
2
0 / 0

healthcheck - Invalid PKI instance: pki-tomcat

by lejeczek

Hi guys. adding second master failed a number of times so I did go without '--setup-ca', now on that master I get lots of: Invalid PKI instance: pki-tomcat: { "source": "pki.server.healthcheck.certs.expiration", "check": "CASystemCertExpiryCheck", "result": "CRITICAL", "uuid": "7b920e6a-4f47-4541-80fa-e9d87dadff20", "when": "20220118102040Z", "duration": "0.000175", "kw": { "msg": "Invalid PKI instance: pki-tomcat" } }, ... { "source": "ipahealthcheck.ipa.certs", "check": "IPACertfileExpirationCheck", "result": "ERROR", "uuid": "fb01a7bd-3457-4007-8c3d-66662e23b6df", "when": "20220118102040Z", "duration": "0.006617", "kw": { "key": "20210709164208", "dbdir": "/etc/pki/pki-tomcat/alias", "nickname": "auditSigningCert cert-pki-kra", "error": "NSSDB '/etc/pki/pki-tomcat/alias' not initialized.", "msg": "Request id {key}: Unable to retrieve cert '{nickname}' from '{dbdir}': {error}" } }, .. first master's healthcheck does not mention these problems. Is it that IPA - falsely - believe that this second master is CA/KRA? If so, then how to resolve this - this second master, according to '--uinstall' was removed successfully(each time '--setup-ca' failed) many thanks, L.

2 years, 3 months

3
3
0 / 0

Automatic direcotry deletion on user removal

by akshay p

Hi, I was wondering if there is a way to automatically delete home directory on user deletion. If not i would like to learn and possibly do something that would enable me to do such a task. I ask you for pointers and thoughts on this matter. Thank you.

2 years, 3 months

2
1
0 / 0

DBusException: org.fedorahosted.certmonger.duplicate: Certificate at same location is already used by

by lejeczek

Hi guys, That's new, well, I've never seen it. I got on a replica candidate so I thought I'd make a first new master and yet: -> $ ipa-server-install --setup-dns --setup-kra --no-forwarders --idstart=57400000 --admin-password=diradm --ds-password=dirsrv --enable-compat --setup-adtrust ... [6/9]: configure certificate renewals [error] DBusException: org.fedorahosted.certmonger.duplicate: Certificate at same location is already used by request with nickname "20210709164208". org.fedorahosted.certmonger.duplicate: Certificate at same location is already used by request with nickname "20210709164208". The ipa-server-install command failed. See /var/log/ipaserver-install.log for more information in log file: ... 2022-01-18T13:30:02Z DEBUG [6/9]: configure certificate renewals 2022-01-18T13:30:02Z DEBUG Loading StateFile from '/var/lib/ipa/sysrestore/sysrestore.state' 2022-01-18T13:30:03Z DEBUG Traceback (most recent call last): File "/usr/lib/python3.6/site-packages/ipaserver/install/service.py", line 635, in start_creation run_step(full_msg, method) File "/usr/lib/python3.6/site-packages/ipaserver/install/service.py", line 621, in run_step method() File "/usr/lib/python3.6/site-packages/ipaserver/install/dogtaginstance.py", line 486, in configur e_renewal profile=self.tracking_reqs[nickname], File "/usr/lib/python3.6/site-packages/ipalib/install/certmonger.py", line 576, in start_tracking result = cm.obj_if.add_request(params) File "/usr/lib64/python3.6/site-packages/dbus/proxies.py", line 145, in __call__ **keywords) File "/usr/lib64/python3.6/site-packages/dbus/connection.py", line 651, in call_blocking message, timeout) dbus.exceptions.DBusException: org.fedorahosted.certmonger.duplicate: Certificate at same location i s already used by request with nickname "20210709164208". 2022-01-18T13:30:03Z DEBUG [error] DBusException: org.fedorahosted.certmonger.duplicate: Certifica te at same location is already used by request with nickname "20210709164208". 2022-01-18T13:30:03Z DEBUG Removing /var/lib/ipa/tmp-brry92se 2022-01-18T13:30:03Z DEBUG Removing /root/.dogtag/pki-tomcat/kra 2022-01-18T13:30:03Z DEBUG File "/usr/lib/python3.6/site-packages/ipapython/admintool.py", line 18 0, in execute return_value = self.run() File "/usr/lib/python3.6/site-packages/ipapython/install/cli.py", line 342, in run return cfgr.run() File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 360, in run return self.execute() File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 386, in execute for rval in self._executor(): File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 431, in __runner exc_handler(exc_info) File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 460, in _handle_execute_ex ception How could this be, with first master?? many thanks, L.

2 years, 3 months

2
2
0 / 0

Replica KRA install - Certificate at same location is already used

by lejeczek

Hi guys. Is this critical on its face and un/reinstall is necessary or some troubleshooting can still reveal it's all good? ... [4/10]: destroying installation admin user [5/10]: enabling ephemeral requests [6/10]: restarting KRA [7/10]: configure certmonger for renewals [8/10]: configure certificate renewals [error] DBusException: org.fedorahosted.certmonger.duplicate: Certificate at same location is already used by request with nickname "20210709164208". Your system may be partly configured. If you run into issues, you may have to re-install IPA on this server. org.fedorahosted.certmonger.duplicate: Certificate at same location is already used by request with nickname "20210709164208". many thanks, L.

2 years, 3 months

2
1
0 / 0

Re: IPA broken after dnf update on CentOS 8

by Abhinav Chittora

Attaching the output of journalctl -u pki-tomcatd@pki-tomcat *--With Regards, Abhinav Chittora*

2 years, 3 months

2
2
0 / 0

KDC Self Signed Certificate Creation

by Mark Selby

My company has 6 FreeIPA servers across 3 different locations. Five of the six servers are ok, but one we could not login to. The error messages pointed to the expired certificate located at `/var/kerberos/krb5kdc/kdc.crt` My question is how do I "properly" renew or recreate this certificate. I have been able to renew it with the command listed below - but the renewed cert does not have the same characteristics as the other certs. The existing ones all see to be self signed with the specified profile while my new one does not have these features. It seems to be working Ok but it would great to understand how to generate this cert correctly. All is any help is greatly appreciated. The servers that work all display the following with using getcert list -f /var/kerberos/krb5kdc/kdc.crt Request ID '20191003181545': status: MONITORING stuck: no key pair storage: type=FILE,location='/var/kerberos/krb5kdc/kdc.key' certificate: type=FILE,location='/var/kerberos/krb5kdc/kdc.crt' CA: SelfSign issuer: CN=ipa01.sub1.acme.org,O=ACME.ORG subject: CN=ipa01.sub1.acme.org,O=ACME.ORG expires: 2022-08-09 22:06:33 UTC principal name: krbtgt/ACME.ORG(a)ACME.ORG certificate template/profile: KDCs_PKINIT_Certs pre-save command: post-save command: /usr/libexec/ipa/certmonger/renew_kdc_cert track: yes auto-renew: yes Using the local-getcert start-tracking command below gets me an updated cert but it is not self signed and does not have the specified profile. local-getcert start-tracking \ -k /var/kerberos/krb5kdc/kdc.key \ -f /var/kerberos/krb5kdc/kdc.crt \ -T KDCs_PKINIT_Certs \ -C /usr/libexec/ipa/certmonger/renew_kdc_cert Request ID '20220117193849': status: MONITORING stuck: no key pair storage: type=FILE,location='/var/kerberos/krb5kdc/kdc.key' certificate: type=FILE,location='/var/kerberos/krb5kdc/kdc.crt' CA: local issuer: CN=Certificate Authority,O=ACME.ORG subject: CN=vipa06.sub3.acme.org,O=ACME.ORG expires: 2024-01-18 17:32:20 UTC principal name: krbtgt/ACME.ORG(a)ACME.ORG key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment eku: id-kp-serverAuth,id-pkinit-KPKdc pre-save command: post-save command: /usr/libexec/ipa/certmonger/renew_kdc_cert track: yes auto-renew: yes

2 years, 3 months

1
0
0 / 0

on stand-alone detached master - force-add KRA - ?

by lejeczek

Hi guys Is it possible on a detached master to setup KRA, as if it was first master? many thanks, L.

2 years, 3 months

2
3
0 / 0

HA / high availability service - ?

by lejeczek

Hi guys. I have an old - set up ~2 yrs ago - IPA domain which "survived" updates/upgrades till this day in such a way that integrated Samba serves up under different hostname/domain and serves non-enrolled clients(win 10) too. With new deployment, 4.9.6, just adding things to just DNS - which worked in that "old" domain - does _not_ do the trick. With only such "simple" DNS Samba does respond, clients connect and get password prompt but Samba says: NT_STATUS_WRONG_PASSWORD How - if it should be possible at all - to have a service, say Samba, which would serve a "virtual" FQDN? - which would make High-Available service for what I need. What I've tried so far - adding host/service seems not good/enough. many thanks, L.

2 years, 3 months

3
11
0 / 0

DoD Common Access Card for authentication

by Stephen Berg, Code 7309

Where can I find documentation for getting authentication using DoD CAC's working? The script I got using ipa-advise hasn't seemed to set this up correctly (or maybe just not completley) on the server where I tried it. Using a client that is bound to just that server and none of the other replicas did not yield a workable CAC authentication. I'm running ipa-4.9.6-10 on Rocky Linux 8.5. -- Stephen Berg, IT Specialist, Ocean Sciences Division, Code 7309 Naval Research Laboratory W: (228) 688-5738 <- (Preferred contact) DSN: (312) 823-5738 C: (228) 365-0162 Flank Speed: stephen.p.berg.civ(a)us.navy.mil

2 years, 3 months

2
1
0 / 0

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users January 2022