November 2022 - FreeIPA-users - Fedora mailing-lists

Removal & clean up certificates from o=ipaca
by David Goudet 30 Sep '24

30 Sep '24

Hello all, I have to clean up lot of useless certificate in dirsrv database. Because of resubmit loop on Certmonger client, i have 99,9% of certificate in dirsrv database that are useless and not obsolete (expiration in 2020) (it represent ~85 000 certificates). These useless certificates produce some issues on FreeIPA: - decrease FreeIPA performances on CLI and GUI - increase the LDAP size - increase size and time of FreeIPA backup ... Is it possible to purge these certificates in dirsrv database and how? I found two branches in LDAP directory about these certificates: dn: cn=xxx,ou=ca,ou=requests,o=ipaca dn: cn=yyy,ou=certificateRepository,ou=ca,o=ipaca I can remove all requests and certificates entry from dirsrv database but how it is supported by PKI manager Dogtag (CRL, certificate generation, OCSP)? (This topic has already been discuss on https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost…) Thank you for you help -- David GOUDET LYRA NETWORK IT Operations service Tel : +33 (0)5 32 09 09 74 | Poste : 574

4 7

KDC Self Signed Certificate Creation
by Mark Selby 22 May '24

22 May '24

My company has 6 FreeIPA servers across 3 different locations. Five of the six servers are ok, but one we could not login to. The error messages pointed to the expired certificate located at `/var/kerberos/krb5kdc/kdc.crt` My question is how do I "properly" renew or recreate this certificate. I have been able to renew it with the command listed below - but the renewed cert does not have the same characteristics as the other certs. The existing ones all see to be self signed with the specified profile while my new one does not have these features. It seems to be working Ok but it would great to understand how to generate this cert correctly. All is any help is greatly appreciated. The servers that work all display the following with using getcert list -f /var/kerberos/krb5kdc/kdc.crt Request ID '20191003181545': status: MONITORING stuck: no key pair storage: type=FILE,location='/var/kerberos/krb5kdc/kdc.key' certificate: type=FILE,location='/var/kerberos/krb5kdc/kdc.crt' CA: SelfSign issuer: CN=ipa01.sub1.acme.org,O=ACME.ORG subject: CN=ipa01.sub1.acme.org,O=ACME.ORG expires: 2022-08-09 22:06:33 UTC principal name: krbtgt/ACME.ORG(a)ACME.ORG certificate template/profile: KDCs_PKINIT_Certs pre-save command: post-save command: /usr/libexec/ipa/certmonger/renew_kdc_cert track: yes auto-renew: yes Using the local-getcert start-tracking command below gets me an updated cert but it is not self signed and does not have the specified profile. local-getcert start-tracking \ -k /var/kerberos/krb5kdc/kdc.key \ -f /var/kerberos/krb5kdc/kdc.crt \ -T KDCs_PKINIT_Certs \ -C /usr/libexec/ipa/certmonger/renew_kdc_cert Request ID '20220117193849': status: MONITORING stuck: no key pair storage: type=FILE,location='/var/kerberos/krb5kdc/kdc.key' certificate: type=FILE,location='/var/kerberos/krb5kdc/kdc.crt' CA: local issuer: CN=Certificate Authority,O=ACME.ORG subject: CN=vipa06.sub3.acme.org,O=ACME.ORG expires: 2024-01-18 17:32:20 UTC principal name: krbtgt/ACME.ORG(a)ACME.ORG key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment eku: id-kp-serverAuth,id-pkinit-KPKdc pre-save command: post-save command: /usr/libexec/ipa/certmonger/renew_kdc_cert track: yes auto-renew: yes

2 2

How to prevent non-admin users of FreeIPA from reading the list of users in the web interface?
by cdknight 16 Apr '24

16 Apr '24

When a user signs in to FreeIPA, I do not want them to be able to view the list of users in my LDAP server under the "Active users" link. I still want them to be able to administer self-service, so they can reset their password, add OTP tokens, etc. How would I go about doing this? The users will only be able to access the web interface, so it doesn't matter whether they can access it from other sources.

5 10

missing attribute "sambaGroupType" when attempting to create a new group - creating groups worked previously
by Tom Spettigue 19 Mar '24

19 Mar '24

Hey all - I seem to be getting the following error message whenever I try to create a group via the web interface: ``` IPA Error 4205: ObjectclassViolation missing attribute "sambaGroupType" required by object class "sambaGroupMapping" ``` I'm not sure exactly what's happening, except that I know I've created groups numerous times before, and never gotten this error message. Does anyone have any ideas?

1 2

Login failed due to an unknown reason
by Dan West 06 Mar '24

06 Mar '24

I am running into a strange issue with a few user accounts where logging into the web interface gives them the error message "Login failed due to an unknown reason”. It also prevents them from SSH’ing into IPA bound systems using passwords. Pubkeys work fine (as long as it is manually added to the local accounts) and any services I have bound to it (Gitlab, Mattermost, Owncloud, etc) seem to work fine. I ’think’ this is kerberos related since the only services that are using it is SSH and probably the IPA web interface. Here is the apache error log for it: [Thu Jan 13 09:15:38.688228 2022] [wsgi:error] [pid 579266:tid 139812542121728] [remote xx.xxx.xx.xxx:52162] ipa: INFO: 401 Unauthorized: Major (851968): Unspecified GSS failure. Minor code may provide more information, Minor (2598844948): TGT has been revoked I ’think’ the message "TGT has been revoked” is due to the 401 error, since the user is not showing as being authorized to login. However, this user is enabled and I have tried a number of things to try to fix it: 1. Disable/Re-enable account 2. Reset passwords 3. Kinit username (seems to get a ticket, but logins still do not work) 4. Run the account migration task (using the web gui) 5. Restart the IPA server and services 6. Re-initialize the IPA server from another master Also, I can confirm that the passwords are correct since a failed password error message shows up differently and other services are using it correctly. Going down the Kerberos path, here is the krb5kdc log file: Jan 13 09:15:38 ipa.example.com krb5kdc[579226](info): AS_REQ (7 etypes {aes256-cts-hmac-sha1-96(18), aes256-cts-hmac-sha384-192(20), camellia256-cts-cmac(26), aes128-cts-hmac-sha1-96(17), aes128-cts-hmac-sha256-128(19), camellia128-cts-cmac(25), DEPRECATED:arcfour-hmac(23)}) yy.yy.yy.yy: NEEDED_PREAUTH: WELLKNOWN/ANONYMOUS(a)EXAMPLE.COM for krbtgt/EXAMPLE.COM(a)EXAMPLE.COM, Additional pre-authentication required Jan 13 09:15:38 ipa.example.com krb5kdc[579226](info): closing down fd 12 Jan 13 09:15:38 ipa.example.com krb5kdc[579226](info): AS_REQ (7 etypes {aes256-cts-hmac-sha1-96(18), aes256-cts-hmac-sha384-192(20), camellia256-cts-cmac(26), aes128-cts-hmac-sha1-96(17), aes128-cts-hmac-sha256-128(19), camellia128-cts-cmac(25), DEPRECATED:arcfour-hmac(23)}) yy.yy.yy.yy: ISSUE: authtime 1642094138, etypes {rep=aes256-cts-hmac-sha1-96(18), tkt=aes256-cts-hmac-sha1-96(18), ses=aes256-cts-hmac-sha1-96(18)}, WELLKNOWN/ANONYMOUS(a)EXAMPLE.COM for krbtgt/EXAMPLE.COM(a)EXAMPLE.COM Jan 13 09:15:38 ipa.example.com krb5kdc[579226](info): closing down fd 12 Jan 13 09:15:38 ipa.example.com krb5kdc[579225](info): AS_REQ (7 etypes {aes256-cts-hmac-sha1-96(18), aes256-cts-hmac-sha384-192(20), camellia256-cts-cmac(26), aes128-cts-hmac-sha1-96(17), aes128-cts-hmac-sha256-128(19), camellia128-cts-cmac(25), DEPRECATED:arcfour-hmac(23)}) yy.yy.yy.yy: NEEDED_PREAUTH: testuser(a)EXAMPLE.COM for krbtgt/EXAMPLE.COM(a)EXAMPLE.COM, Additional pre-authentication required Jan 13 09:15:38 ipa.example.com krb5kdc[579225](info): closing down fd 12 Jan 13 09:15:38 ipa.example.com krb5kdc[579225](info): AS_REQ (7 etypes {aes256-cts-hmac-sha1-96(18), aes256-cts-hmac-sha384-192(20), camellia256-cts-cmac(26), aes128-cts-hmac-sha1-96(17), aes128-cts-hmac-sha256-128(19), camellia128-cts-cmac(25), DEPRECATED:arcfour-hmac(23)}) yy.yy.yy.yy: ISSUE: authtime 1642094138, etypes {rep=aes256-cts-hmac-sha1-96(18), tkt=aes256-cts-hmac-sha1-96(18), ses=aes256-cts-hmac-sha1-96(18)}, testuser(a)EXAMPLE.COM for krbtgt/EXAMPLE.COM(a)EXAMPLE.COM Jan 13 09:15:38 ipa.example.com krb5kdc[579225](info): closing down fd 12 Jan 13 09:15:38 ipa.example.com krb5kdc[579226](Error): PAC issue: PAC record claims domain SID different to local domain SID or any trusted domain SID: local [S-1-5-21-997841278-3584560916-1456654135], PAC [S-1-5-21-2108153867-2082035330-3701898995] Jan 13 09:15:38 ipa.example.com krb5kdc[579226](info): TGS_REQ : handle_authdata (-1765328364) Jan 13 09:15:38 ipa.example.com krb5kdc[579226](info): TGS_REQ (7 etypes {aes256-cts-hmac-sha1-96(18), aes256-cts-hmac-sha384-192(20), camellia256-cts-cmac(26), aes128-cts-hmac-sha1-96(17), aes128-cts-hmac-sha256-128(19), camellia128-cts-cmac(25), DEPRECATED:arcfour-hmac(23)}) yy.yy.yy.yy: HANDLE_AUTHDATA: authtime 1642094138, etypes {rep=UNSUPPORTED:(0)} testuser(a)EXAMPLE.COM for HTTP/ipa.example.com(a)EXAMPLE.COM, TGT has been revoked Jan 13 09:15:38 ipa.example.com krb5kdc[579226](info): closing down fd 12 Jan 13 09:15:38 ipa.example.com krb5kdc[579226](Error): PAC issue: PAC record claims domain SID different to local domain SID or any trusted domain SID: local [S-1-5-21-997841278-3584560916-1456654135], PAC [S-1-5-21-2108153867-2082035330-3701898995] Jan 13 09:15:38 ipa.example.com krb5kdc[579226](info): TGS_REQ : handle_authdata (-1765328364) Jan 13 09:15:38 ipa.example.com krb5kdc[579226](info): TGS_REQ (7 etypes {aes256-cts-hmac-sha1-96(18), aes256-cts-hmac-sha384-192(20), camellia256-cts-cmac(26), aes128-cts-hmac-sha1-96(17), aes128-cts-hmac-sha256-128(19), camellia128-cts-cmac(25), DEPRECATED:arcfour-hmac(23)}) yy.yy.yy.yy: HANDLE_AUTHDATA: authtime 1642094138, etypes {rep=UNSUPPORTED:(0)} testuser(a)EXAMPLE.COM for HTTP/ipa.example.com(a)EXAMPLE.COM, TGT has been revoked I only see two errors that might be related: "PAC record claims domain SID different to local domain SID or any trusted domain SID” "DEPRECATED:arcfour-hmac(23)” However, those might just be red herrings or something else that is unrelated. So far, there are only a small number of accounts that have this problem, but more seem to be popping up on a daily basis. The only fix I have found is the nuclear option, where I completely remove the account and then add it back in with the same UID/GID, group memberships and policies. After that it seems to work fine. However, I would rather not want to do this to all accounts since that would be a logistical nightmare. Are there any suggestions for either troubleshooting or fixing this problem with a lighter approach? Is it possible to reset or regenerate the users kerberos authentication? Thanks, Dan West Systems Administrator Galois Inc. http://galois.com

4 8

certmonger error on ubuntu
by Robson Francisco de Souza 07 Feb '24

07 Feb '24

Hello! I've been running FreeIPA 4.3.1 on Ubuntu 16.04 for almost two years and most certificates should expire within three weeks. As this deadline approaches, I noticed certmonger has been unable to renew certificates due to the error below. After googling for two days, I found this issue has been observed by many people before, mostly after expiration of the certificates, as in https://tinyurl.com/vajmocw Still, I couldn't find a solution to this problem. If it is impossible to fix this issue while using FreeIPA 4.3.1, I would like to: 1) Find a way to renew all certificates even if certmonger can't be fixed. This would allow me to postpone the solution to after the next OS and/or FreeIPA upgrade 2) Find out what version of FreeIPA I should upgrade to while the operating system remains Ubuntu 16.04 Any help would be appreciated! Thanks! Robson ======> Command: systemctl status certmonger Nov 17 20:53:08 ipa.cefapnet.icb.usp.br certmonger[3873125]: 2019-11-17 20:53:08 [3873125] Error 77 connecting to https://ipa.cefapnet.icb.usp.br:8443/ca/agent/ca/profileReview: Problem with the SSL CA cert (path? access rights?). Nov 17 21:10:13 ipa.cefapnet.icb.usp.br dogtag-ipa-ca-renew-agent-submit[3875188]: Forwarding request to dogtag-ipa-renew-agent Nov 17 21:10:13 ipa.cefapnet.icb.usp.br dogtag-ipa-ca-renew-agent-submit[3875188]: dogtag-ipa-renew-agent returned 3 Nov 17 21:10:13 ipa.cefapnet.icb.usp.br certmonger[3873125]: 2019-11-17 21:10:13 [3873125] Error 77 connecting to https://ipa.cefapnet.icb.usp.br:8443/ca/agent/ca/profileReview: Problem with the SSL CA cert (path? access rights?). Nov 17 21:25:20 ipa.cefapnet.icb.usp.br dogtag-ipa-ca-renew-agent-submit[3875738]: Forwarding request to dogtag-ipa-renew-agent Nov 17 21:25:20 ipa.cefapnet.icb.usp.br dogtag-ipa-ca-renew-agent-submit[3875738]: dogtag-ipa-renew-agent returned 3 Nov 17 21:25:21 ipa.cefapnet.icb.usp.br certmonger[3873125]: 2019-11-17 21:25:21 [3873125] Error 77 connecting to https://ipa.cefapnet.icb.usp.br:8443/ca/agent/ca/profileReview: Problem with the SSL CA cert (path? access rights?). Nov 17 21:25:31 ipa.cefapnet.icb.usp.br dogtag-ipa-ca-renew-agent-submit[3875766]: Forwarding request to dogtag-ipa-renew-agent Nov 17 21:25:31 ipa.cefapnet.icb.usp.br dogtag-ipa-ca-renew-agent-submit[3875766]: dogtag-ipa-renew-agent returned 3 Nov 17 21:25:31 ipa.cefapnet.icb.usp.br certmonger[3873125]: 2019-11-17 21:25:31 [3873125] Error 77 connecting to https://ipa.cefapnet.icb.usp.br:8443/ca/agent/ca/profileReview: Problem with the SSL CA cert (path? access rights?). -- Robson Francisco de Souza, PhD Laboratório de Estrutura e Evolução de Proteínas (LEEP/PSEL) Departamento de Microbiologia Instituto de Ciências Biomédicas Universidade de São Paulo Av. Prof. Lineu Prestes, 1374 - Ed. Biomédicas II - Sala 250 - 2o. andar Tel: 3091-0891 Cidade Universitária - CEP 05508-900 - São Paulo - SP - Brasil ---- Robson Francisco de Souza, PhD Protein Structure and Evolution Laboratory (LEEP/PSEL) Microbiology Departament Biomedical Sciences Institute University of Sao Paulo Av. Prof. Lineu Prestes, 1374 - Biomédicas II - Sala 250 Phone: 55-11-3091-0891 Cidade Universitária - ZIP 05508-900 - São Paulo - SP - Brazil

6 10

Greenfield FreeIPA deployment - is it OK to put FreeIPA at the domain apex, or a "best practice" to put it in a subdomain?
by Braden McGrath 11 Jan '24

11 Jan '24

Hello FreeIPA-users. The Subject line is the core of my question here; I'll provide a bit more detail below. I work for what is (effectively) a startup, non-profit internet provider. I have an extensive Windows background, and "know enough to be dangerous" with Linux & BSD (have been tinkering with GNU/Linux on and off since Slackware 3.0 or 3.1). I'm very familiar with Windows Active Directory, but the org does not have any AD infrastructure right now (and being nonprofit, are trying to avoid spending money for MS, especially when all of the other VMs will be Linux or BSD anyway). Given the nonprofit nature, I discovered FreeIPA when looking for a free centralized directory system. The goal is to consolidate all credentials for *other* Linux VMs (customer-facing DNS, CRM web server, SNMP/network graphing servers, etc) as well as provide a back-end for RADIUS for management of network equipment (switches, routers, P2P wireless, etc). Simplifying DNS management and replication is also appealing, I'd rather administrate one system than two or three. In case it changes your opinion of the plan at all - all of the network equipment and VMs will be on *private* (10.x) IPv4 space and behind one or more firewalls, at least initially. We do want to add public IPv6, but do not have that yet. We only have a small allocation (/26) of public v4 from our upstream that will be NATed through a firewall and not directly on any devices. The traffic to FreeIPA is going to be internal-only, I do not plan on exposing FreeIPA's DNS "to the world" at all. Even customer-facing internal DNS will likely be through separate caching forwarders pointing back to FreeIPA. I have a completely unused, publicly registered domain (let's just call it "example.net" for this thread) available to dedicate to this system. We also own "example.org" and are using that for our public web presence, and I intend to keep that entirely standalone. Given that I have no current "interoperability" concerns, is there anything "wrong" with putting FreeIPA directly at the root of example.net? Or would it be more wise, from an interop, security, or manageability standpoint (i.e. a "best practice"), to root FreeIPA at something like auth.example.net or ipa.example.net and then have a separate set of nameservers handling the base domain? If I put FreeIPA's root (and Kerberos realm) in a subdomain, is it possible to *also* have it manage the parent domain's DNS entries? I've read through the Quick Start Guide and Deployment Recommendations (https://www.freeipa.org/page/Deployment_Recommendations) which is part of how I've come to the decisions I've made thus far. I couldn't really find guidance one way or the other on whether FreeIPA "should" be in a subdomain or not, hence this posting. I would appreciate any insight the community can provide!

3 4

FreeIPA web session timeout
by Yuri Krysko 10 Jan '24

10 Jan '24

Hello, Could you please advise how to configure FreeIPA web UI user session timeout? Thanks, Yuri ________________________________ LEGAL DISCLAIMER: M.C. Dean, Inc. and its subsidiaries considers this e-mail and any files transmitted with it to be protected, proprietary or privileged information intended solely for the use of the named recipient(s). Any disclosure of this material or the information contained herein, in whole or in part, to anyone outside of the intended recipient or affiliates is strictly prohibited. M. C. Dean, Inc. accepts no liability for the content of this e-mail or for the consequences of any actions taken on the basis of the information contained in it, unless that information is subsequently confirmed in writing. Employees of M.C. Dean, Inc. are instructed not to infringe on any rights of the recipient; any such communication violates company policy. If you are not the intended recipient, any disclosure, copying, distribution, or action taken or omitted in reliance on this information is strictly prohibited by M.C. Dean, Inc.; please notify the sender immediately by return e-mail, delete this communication and destroy all copies.

4 4

Auto cleanup old enrolled hosts
by Russ Long 01 Dec '23

01 Dec '23

We're adding FreeIPA to an immutable, often rotated environment (AWS ECS Hosts). These hosts are spun up and down at least daily. Is there a way to check FreeIPA to see when a host has last communicated with the FreeIPA Cluster? I'd like to use this information to auto-delete hosts that have not reported in from the FreeIPA host list.

5 4

Allow sysaccount to view its own entry
by Adam Bishop 09 Nov '23

09 Nov '23

I have a piece of software that tries to look up its own uid to check that LDAP is correctly configured. This check fails because the sysaccount cannot view anything under cn=etc,cn=sysaccounts. Is there an existing permission/privilege that I can use to allow it to read the sysaccounts tree (or better, just its own entry)? Many Thanks, Adam Bishop

4 3

kinit: KDC can't fulfill requested option while renewing credentials - which approach?
by Pieter Baele 19 Sep '23

19 Sep '23

I tried various approached to get Renewable tickets : modifying the kdc modifying krb5.conf using kadmin.local on every replica to modify the principal; which is not working - as designed (?)- in IPA What should I do to get a ticket with the correct R flag from IPA ? I don't think this is SSSD related (the service needing the renewable ticket this way is Apache Storm) Thanks a lot!

3 4

Cannot get rid of a replica/agreement
by lejeczek 21 Jul '23

21 Jul '23

Hi guys. Two masters from which third got disconnected in a "dirty" manner. -> $ ipa-replica-manage del midway.ccn.priv.dom Server removal aborted: Replication topology in suffix 'domain' is disconnected: Topology does not allow server love.ccn.priv.dom to replicate with servers: midway.ccn.priv.dom Topology does not allow server midway.ccn.priv.dom to replicate with servers: love.ccn.priv.dom punch.ccn.priv.dom Topology does not allow server punch.ccn.priv.dom to replicate with servers: midway.ccn.priv.dom. -> $ ipa topologysegment-find domain ----------------- 1 segment matched ----------------- Segment name: punch.ccn.priv.dom-to-love.ccn.priv.dom Left node: punch.ccn.priv.dom Right node: love.ccn.priv.dom Connectivity: both ---------------------------- Number of entries returned 1 -> $ ipa-replica-manage del midway.ccn.priv.dom --force ipa: WARNING: /usr/lib/python3.6/site-packages/ipaserver/plugins/dogtag.py:1973: The subsystem in PKIConnection.__init__() has been deprecated (https://www.dogtagpki.org/wiki/PKI_10.8_Python_Changes) Updating DNS system records Not allowed on non-leaf entry I've tried to 'reinitialize' but without success. Anybody care to share suggestions & thoughts? many thanks, L.

4 6

Limiting access to GUI
by Entrepreneur AJ 10 Jul '23

10 Jul '23

Hey all, I have a wan facing install due to many of my team operating with mobile phone hotspots whilst visiting customers. An Issue I'm having is I want to restrict the GUI to only our admin team's IP address but editing the Apache Config with; # webUI is now completely static, and served out of that directory Alias /ipa/ui "/usr/share/ipa/ui" <Directory "/usr/share/ipa/ui"> SetHandler None AllowOverride None Satisfy Any Require all granted ExpiresActive On ExpiresDefault "access plus 1 year" <FilesMatch "(index.html|loader.js|login.html|reset_password.html)"> ExpiresDefault "access plus 0 seconds" </FilesMatch> Order allow,deny Allow from <ADMIN IP RANGE> </Directory> Is still allowing anyone with a browser to reach the IPA gui. We have Keycloak in place for staff and users to update their passwords. Any pointers? I would personally prefer to firewall it off but that effects other IPA features.

2 5

Do keytabs expire?
by Ronald Wimmer 07 Jun '23

07 Jun '23

Hi, today I found out that some entries in a keytab file seemed to have expired: Request ticket server HTTP/mwc.linux.mydomain.at(a)LINUX.MYDOMAIN.AT kvno 4 not found in keytab; keytab is likely out of date Fetching the keytab again with ipa-getkeytab fixed the problem. But why is this happening? Do keytab entries expire? I have not set any custom password or ticket policies. Regards, Ronald

4 13

ipa-replica-install -- cannot get past [26/41]: creating DS keytab
by Jonathon Jenkins 28 Mar '23

28 Mar '23

Greetings, I cannot get the ipa-replica-install to proceed past step 26/41 - creating DS keytab. I see the command that is to be run, and I can run that just fine before and after the ipa-replica-install command, and it creates the keytab. I am not sure how to proceed from here - the bug reports I see all pertain to earlier versions, and my files reflect those changes. I have also tried running this with all manner of password flags, which are correct, but still getting insufficient access rights. particulars: centos 7 3.10.0-957.1.3.el7.x86_64 ipa-server-4.6.4-10.el7.centos.x86_64 ipa-common-4.6.4-10.el7.centos.noarch ipa-server-common-4.6.4-10.el7.centos.noarch ipa-client-4.6.4-10.el7.centos.x86_64 ipa-server-dns-4.6.4-10.el7.centos.noarch ipa-client-common-4.6.4-10.el7.centos.noarch * Note: anonymized output below ipapython.ipautil: DEBUG stderr= ipalib.backend: DEBUG Created connection context.ldap2_139891568509776 ipaserver.install.service: DEBUG duration: 7 seconds ipaserver.install.service: DEBUG [26/41]: creating DS keytab [26/41]: creating DS keytab ipalib.frontend: DEBUG raw: service_add(u'ldap/<ipa-replica-host>@<domain>.NET', force=True, version=u'2.229') ipalib.frontend: DEBUG service_add(ipapython.kerberos.Principal('ldap/<ipa-replica-host>@<domain>.NET'), force=True, all=False, raw=False, version=u'2.229', no_members=False) ipalib.frontend: DEBUG raw: host_show(u'<ipa-replica-host>', version=u'2.229') ipalib.frontend: DEBUG host_show(u'<ipa-replica-host>', rights=False, all=False, raw=False, version=u'2.229', no_members=False) ipalib.install.sysrestore: DEBUG Backing up system configuration file '/etc/dirsrv/ds.keytab' ipalib.install.sysrestore: DEBUG -> Not backing up - '/etc/dirsrv/ds.keytab' doesn't exist ipapython.ipautil: DEBUG Starting external process ipapython.ipautil: DEBUG args=/usr/sbin/ipa-getkeytab -k /etc/dirsrv/ds.keytab -p ldap/<ipa-replica-host>@<domain>.NET -H ldaps://<ipa-replica-master> ipapython.ipautil: DEBUG Process finished, return code=9 ipapython.ipautil: DEBUG stdout= ipapython.ipautil: DEBUG stderr=Failed to parse result: Insufficient access rights Retrying with pre-4.0 keytab retrieval method... Failed to parse result: Insufficient access rights Failed to get keytab! Failed to get keytab ipaserver.install.service: DEBUG Traceback (most recent call last): File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 570, in start_creation run_step(full_msg, method) File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 560, in run_step method() File "/usr/lib/python2.7/site-packages/ipaserver/install/dsinstance.py", line 1308, in request_service_keytab super(DsInstance, self).request_service_keytab() File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 742, in request_service_keytab self.run_getkeytab(self.api.env.ldap_uri, self.keytab, self.principal) File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 732, in run_getkeytab ipautil.run(args, nolog=nolog) File "/usr/lib/python2.7/site-packages/ipapython/ipautil.py", line 562, in run raise CalledProcessError(p.returncode, arg_string, str(output)) CalledProcessError: Command '/usr/sbin/ipa-getkeytab -k /etc/dirsrv/ds.keytab -p ldap/<ipa-replica-host>@<domain>.NET -H ldaps://<ipa-replica-master>' returned non-zero exit status 9 ipaserver.install.service: DEBUG [error] CalledProcessError: Command '/usr/sbin/ipa-getkeytab -k /etc/dirsrv/ds.keytab -p ldap/<ipa-replica-host>@<domain>.NET -H ldaps://<ipa-replica-master>' returned non-zero exit status 9 [error] CalledProcessError: Command '/usr/sbin/ipa-getkeytab -k /etc/dirsrv/ds.keytab -p ldap/<ipa-replica-host>@<domain>.NET -H ldaps://<ipa-replica-master>' returned non-zero exit status 9 ipalib.backend: DEBUG Destroyed connection context.ldap2_139891548583120 ipalib.install.sysrestore: DEBUG Backing up system configuration file '/etc/ipa/default.conf' ipalib.install.sysrestore: DEBUG Saving Index File to '/var/lib/ipa/sysrestore/sysrestore.index' Your system may be partly configured. Run /usr/sbin/ipa-server-install --uninstall to clean up. ipapython.admintool: DEBUG File "/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 178, in execute return_value = self.run() File "/usr/lib/python2.7/site-packages/ipapython/install/cli.py", line 319, in run return cfgr.run() File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 364, in run return self.execute() File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 389, in execute for rval in self._executor(): File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 434, in __runner exc_handler(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 463, in _handle_execute_exception self._handle_exception(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 453, in _handle_exception six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 424, in __runner step() File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 421, in <lambda> step = lambda: next(self.__gen) File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from value = gen.send(prev_value) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 658, in _configure next(executor) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 434, in __runner exc_handler(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 463, in _handle_execute_exception self._handle_exception(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 521, in _handle_exception self.__parent._handle_exception(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 453, in _handle_exception six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 518, in _handle_exception super(ComponentBase, self)._handle_exception(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 453, in _handle_exception six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 424, in __runner step() File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 421, in <lambda> step = lambda: next(self.__gen) File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from value = gen.send(prev_value) File "/usr/lib/python2.7/site-packages/ipapython/install/common.py", line 65, in _install for unused in self._installer(self.parent): File "/usr/lib/python2.7/site-packages/ipaserver/install/server/__init__.py", line 622, in main replica_install(self) File "/usr/lib/python2.7/site-packages/ipaserver/install/server/replicainstall.py", line 406, in decorated func(installer) File "/usr/lib/python2.7/site-packages/ipaserver/install/server/replicainstall.py", line 1431, in install fstore=fstore) File "/usr/lib/python2.7/site-packages/ipaserver/install/server/replicainstall.py", line 113, in install_replica_ds setup_pkinit=not options.no_pkinit, File "/usr/lib/python2.7/site-packages/ipaserver/install/dsinstance.py", line 419, in create_replica self.start_creation(runtime=30) File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 570, in start_creation run_step(full_msg, method) File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 560, in run_step method() File "/usr/lib/python2.7/site-packages/ipaserver/install/dsinstance.py", line 1308, in request_service_keytab super(DsInstance, self).request_service_keytab() File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 742, in request_service_keytab self.run_getkeytab(self.api.env.ldap_uri, self.keytab, self.principal) File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 732, in run_getkeytab ipautil.run(args, nolog=nolog) File "/usr/lib/python2.7/site-packages/ipapython/ipautil.py", line 562, in run raise CalledProcessError(p.returncode, arg_string, str(output)) ipapython.admintool: DEBUG The ipa-replica-install command failed, exception: CalledProcessError: Command '/usr/sbin/ipa-getkeytab -k /etc/dirsrv/ds.keytab -p ldap/<ipa-replica-host>@<domain>.NET -H ldaps://<ipa-replica-master>' returned non-zero exit status 9 ipapython.admintool: ERROR Command '/usr/sbin/ipa-getkeytab -k /etc/dirsrv/ds.keytab -p ldap/<ipa-replica-host>@<domain>.NET -H ldaps://<ipa-replica-master>' returned non-zero exit status 9 ipapython.admintool: ERROR The ipa-replica-install command failed. See /var/log/ipareplica-install.log for more information

2 2

FreeIPA-Kubernetes Setup
by Ronald Wimmer 20 Mar '23

20 Mar '23

Hi, are there any plans (or maybe ongoing work already) to let FreeIPA run in a K8s environment? Cheers, Ronald

6 8

ipa-replica-install fails when I use custom certificates
by Peter Tselios 08 Feb '23

08 Feb '23

I have installed the ipa server by using the following command: --------- ipa-server-install --realm "EXAMPLE.COM" -p 'password' -a 'password' --hostname="server.example.com" -n example.com --ip-address="10.1.4.2" --dirsrv-cert-file=/etc/pki/tls/private/example.com.pem --dirsrv-cert-file=/etc/pki/tls/certs/example.com.crt --dirsrv-pin='' --http-cert-file=/etc/pki/tls/certs/example.com.crt --http-cert-file=/etc/pki/tls/private/example.com.pem --http-pin='' --ca-cert-file=/etc/pki/ca-trust/source/anchors/myca.pem --ca-cert-file=/etc/pki/ca-trust/source/anchors/mysubca.pem --mkhomedir -N --no-host-dns --unattended --------- Which works perfectly fine. However, I cannot make it work with ipa-replica-install since there is no option for --ca-cert-file. So, how can I install a replica with custom certificates?

6 12

Installing Third-Party Certificates-Help
by Polavarapu Manideep Sai 17 Jan '23

17 Jan '23

Hi Team, We need your help or support I have a master IPA server and 2 Replica IPA Servers, i want to install third party certificates in my setup a. master.ipa.example.com b. replica1.ipa.example.com c. replica2.ipa.example.com 1. Generated new CSR/wildcard certificate on master IPA server for the domain "*.ipa.example.com" and shared to third party vendor and they have shared two zip files one for apache and other for tomcat as shown below, i see crt and pem files in zip files as shown below after unzip a. _.ipa.onmobile.com_Apache.zip b. _.ipa.onmobile.com_TOMCAT.zip unzipped: [root@dir01 tmp]# tree Apache/ Apache/ ├── 1f1f7ab616938168.crt ├── 1f1f7ab616938168.pem ├── gd_bundle-g2-g1.crt └── _.ipa.onmobile.com_Apache.zip 0 directories, 4 files [root@dir01 tmp]# tree Tomcat/ Tomcat/ ├── 1f1f7ab616938168.crt ├── 1f1f7ab616938168.pem ├── gd_bundle-g2-g1.crt ├── gdig2.crt.pem └── _.ipa.onmobile.com_TOMCAT.zip 0 directories, 5 files 2. Followed the Redhat documentation but not understood which of the following one is applicable in my case for the received certificates Installing Third-Party Certificates for HTTP or LDAP Installing a CA Certificate Manually https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/ht… Can you please let us know the step by step procedure that how to install the certificates can you please also comment on below query 3. If i install the certificate will it get replaced in "/etc/pki/pki-tomcat/alias/" database as well? along with httpd and dirsrv databases ? /etc/pki/pki-tomcat/alias/ /etc/httpd/alias/ /etc/dirsrv/slapd-IPA-EXAMPLE-COM Please let us know if any more details required Sai ________________________________ DISCLAIMER: The information in this message is confidential and may be legally privileged. It is intended solely for the addressee. Access to this message by anyone else is unauthorized. If you are not the intended recipient, any disclosure, copying, or distribution of the message, or any action or omission taken by you in reliance on it, is prohibited and may be unlawful. Please immediately contact the sender if you have received this message in error. Further, this e-mail may contain viruses and all reasonable precaution to minimize the risk arising there from is taken by OnMobile. OnMobile is not liable for any damage sustained by you as a result of any virus in this e-mail. All applicable virus checks should be carried out by you before opening this e-mail or any attachment thereto. Thank you - OnMobile Global Limited.

3 6

Install client fails in Ubuntu 22.04
by Gustavo Berman 29 Dec '22

29 Dec '22

Hello there! Ubuntu 18.04 (and previous ones) works just fine In Ubuntu 22.04 I'm trying to execute ipa-client install but it fails with: root@fisica75:~# ipa-client-install This program will set up IPA client. Version 4.9.8 WARNING: conflicting time&date synchronization service 'ntp' will be disabled in favor of chronyd Discovery was successful! Do you want to configure chrony with NTP server or pool address? [no]: Client hostname: fisica75.fisica.cabib Realm: FISICA.CABIB DNS Domain: fisica.cabib IPA Server: ipaserver.fisica.cabib BaseDN: dc=fisica,dc=cabib Continue to configure the system with these values? [no]: yes Synchronizing time No SRV records of NTP servers found and no NTP server or pool address was provided. Using default chrony configuration. Attempting to sync time with chronyc. Time synchronization was successful. User authorized to enroll computers: tavo Password for tavo(a)FISICA.CABIB: Successfully retrieved CA cert Subject: CN=Certificate Authority,O=FISICA.CABIB Issuer: CN=Certificate Authority,O=FISICA.CABIB Valid From: 2014-01-14 12:56:57 Valid Until: 2034-01-14 12:56:57 Enrolled in IPA realm FISICA.CABIB Created /etc/ipa/default.conf Configured /etc/sssd/sssd.conf Configured /etc/krb5.conf for IPA realm FISICA.CABIB cannot connect to 'https://ipaserver.fisica.cabib/ipa/json': [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: Hostname mismatch, certificate is not valid for 'ipaserver.fisica.cabib'. (_ssl.c:997) The ipa-client-install command failed. See /var/log/ipaclient-install.log for more information root@fisica75:~# There is no Hostname mismatch for the server certificate. It has been working just fine for years with multiple distros as clients. I can access the website with the same URL and cert is just fine. Any ideas? Thanks! -- Gustavo Berman

3 7

FreeIPA CA failing to login with new admin user
by Stasiek Michalski 19 Dec '22

19 Dec '22

Hello, I installed FreeIPA replica on 4.8.4 on CentOS 8 from 4.4.4 from Fedora 25 with `ipa-replica-install --setup-dns --auto-forwarders`, without `--setup-ca` due to errors, which went fine. I do want to install CA though, which failed when I did `--setup-ca` and then later `ipa-ca-install` with the following error: ``` [4/29]: creating installation admin user Unable to log in as uid=admin-freeipa2.infra.opensuse.org,ou=people,o=ipaca on ldap://freeipa.infra.opensuse.org:389 [hint] tune with replication_wait_timeout [error] NotFound: uid=admin-freeipa2.infra.opensuse.org,ou=people,o=ipaca did not replicate to ldap://freeipa.infra.opensuse.org:389 Your system may be partly configured. Run /usr/sbin/ipa-server-install --uninstall to clean up. ``` Obviously I did try try extending the timeout based on that, but I don't think that was helpful in the end, considering the logs produced by the old server: httpd access_log ``` 192.168.47.90 - - [23/Jul/2020:00:25:36 +0000] "GET /ca/rest/account/login HTTP/1.1" 401 994 ``` server process in journal ``` SSLAuthenticatorWithFallback: Authenticating with BASIC authentication Invalid Credential. at com.netscape.cmscore.authentication.PasswdUserDBAuthentication.authenticate(PasswdUserDBAuthentication.java:167) at com.netscape.cms.realm.PKIRealm.authenticate(PKIRealm.java:63) at com.netscape.cms.tomcat.ProxyRealm.authenticate(ProxyRealm.java:78) at org.apache.catalina.authenticator.BasicAuthenticator.authenticate(BasicAuthenticator.java:94) at com.netscape.cms.tomcat.SSLAuthenticatorWithFallback.doSubAuthenticate(SSLAuthenticatorWithFallback.java:37) at com.netscape.cms.tomcat.AbstractPKIAuthenticator.doAuthenticate(AbstractPKIAuthenticator.java:98) at com.netscape.cms.tomcat.SSLAuthenticatorWithFallback.authenticate(SSLAuthenticatorWithFallback.java:47) at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:579) at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:141) at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:79) at org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:620) at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:88) at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:502) at org.apache.coyote.ajp.AbstractAjpProcessor.process(AbstractAjpProcessor.java:877) at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:684) at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1539) at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.run(NioEndpoint.java:1495) at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) at java.lang.Thread.run(Thread.java:748) SSLAuthenticatorWithFallback: Fallback auth header: WWW-Authenticate=Basic realm="Certificate Authority" SSLAuthenticatorWithFallback: Fallback auth return code: 401 SSLAuthenticatorWithFallback: Result: false ``` and from pki logs ``` Failed to authenticate as admin UID=admin-freeipa2.infra.opensuse.org. Error: netscape.ldap.LDAPException: error result (49) ``` I don't particularly know how to proceed from here, since those errors don't mean much to me. I see however it's not just me having issues with `ipa-ca-install` at least similar to this one (although by the looks of it, the reason is already different ;) Thanks in advance for trying, LCP [Stasiek] https://lcp.world/

4 6

ipa-restore in docker container
by Simon Thorley 09 Dec '22

09 Dec '22

Hi all, I am currently migrating a server from a locally installed FreeIPA setup to a CoreOS container setup and cannot find any documentation for this. I am assuming i am doing something wrong or missing something as i cannot find anyone else having an issue or even attempting it either. This is a fresh installed OS from an ignition file so should have no weirdness coming in from anywhere else. podman launch line: bin/podman run --name ipa \ -h thenom-srv1.thenom.local --read-only \ -v /var/lib/ipa-data:/data:Z \ -e IPA_SERVER_IP=192.168.101.6 \ -p 80:80 -p 443:443 -p 389:389 -p 636:636 -p 88:88 -p 464:464 -p 88:88/udp -p 464:464/udp -p 123:123/udp \ quay.io/freeipa/freeipa-server:fedora-36 I have finally got a fresh install running in a container but i am now trying to restore a backup into it from my old server. I have copied a ipa-full directory from my old service into the containers data volume folder on the host. I bash exec into the running IPA container then run ipa-restore /data/ipa-full-2022-11-11-04-03-19, type in my directory manager password and accept the prompts then just get a mass stream of tar errors and then fail: ... tar: setfileconat: Cannot set SELinux context for file 'var/lib/ipa/pki-ca': Permission denied tar: var/lib/ipa: Directory renamed before its status could be extracted tar: setfileconat: Cannot set SELinux context for file 'var/lib/pki/pki-tomcat/lib': Permission denied tar: setfileconat: Cannot set SELinux context for file 'var/lib/pki/pki-tomcat/ca': Permission denied tar: setfileconat: Cannot set SELinux context for file 'var/lib/pki/pki-tomcat': Permission denied tar: var/lib/pki: Directory renamed before its status could be extracted tar: etc/httpd/alias: Directory renamed before its status could be extracted tar: setfileconat: Cannot set SELinux context for file 'etc/pki/pki-tomcat/ca': Permission denied tar: etc/pki/pki-tomcat: Directory renamed before its status could be extracted tar: Exiting with failure status due to previous errors Restoring umask to 18 NSS is built without support of the legacy database(DBM) directory '/etc/ipa/nssdb' The ipa-restore command failed. See /data/var/log/iparestore.log for more information I get similar in the iparestore.log: ... tar: setfileconat: Cannot set SELinux context for file './THENOM-LOCAL/DBVERSION': Operation not supported tar: setfileconat: Cannot set SELinux context for file './THENOM-LOCAL/dse_instance.ldif': Operation not supported tar: setfileconat: Cannot set SELinux context for file './THENOM-LOCAL/dse_index.ldif': Operation not supported tar: setfileconat: Cannot set SELinux context for file './THENOM-LOCAL': Operation not supported tar: setfileconat: Cannot set SELinux context for file './files.tar': Operation not supported tar: setfileconat: Cannot set SELinux context for file '.': Operation not supported 2022-11-13T11:55:38Z DEBUG Starting external process 2022-11-13T11:55:38Z DEBUG args=['tar', '--xattrs', '--selinux', '-xzf', '/tmp/tmp7pt67l7sipa/ipa/files.tar', 'etc/ipa/default.conf'] 2022-11-13T11:55:40Z DEBUG Process finished, return code=0 2022-11-13T11:55:40Z DEBUG stdout= 2022-11-13T11:55:40Z DEBUG stderr=tar: setfileconat: Cannot set SELinux context for file 'etc/ipa/default.conf': Operation not supported This seems to make sense because from what i have read the selinux context on these /data files should be system_u:object_r:container_file_t and i am guessing unchanged\unchangeable due to the environment its running in. Any advice appreciated, thanks in advance. Simon

2 4

HTTP certificate expired
by Juan Pablo Lorier 05 Dec '22

05 Dec '22

Hi, I have a production server that was not maintained and I see that the HTTP certificate has expired long ago. I tried to renew it but I'm not being agle to get it right. The initial status was: Request ID '20191219011208': status: NEWLY_ADDED_NEED_KEYINFO_READ_PIN stuck: yes key pair storage: type=FILE,location='/var/lib/ipa/private/httpd.key' certificate: type=FILE,location='/var/lib/ipa/certs/httpd.crt' Then following this thread https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost… I got it to this state: Request ID '20191219011208': status: MONITORING ca-error: Server at https://dc1.tnu.com.uy/ipa/xml failed request, will retry: -504 (HTTP POST to URL 'https://XXXX/ipa/xml' failed. libcurl failed even to execute the HTTP transaction, explaining: SSL certificate problem: certificate has expired). stuck: no key pair storage: type=FILE,location='/var/lib/ipa/private/httpd.key',pinfile='/var/lib/ipa/passwds/XXXXX-443-RSA' certificate: type=FILE,location='/var/lib/ipa/certs/httpd.crt' The post indicates that I have to put an old date in the server to get it renewed, but as the server is in production, it means that all clients will fail to log to the server. Evenmore, what time should I return to, before the certificate expiration or right after? Thanks in advance

3 25

ipa-healthcheck errors
by Rob Verduijn 03 Dec '22

03 Dec '22

Hello, After todays update I noticed I am now running rocky 8.7 freeipa was updated just fine and is working nicely. However after running ipa-healthcheck I was treated with a HUGE amount of errors. After some digging I found that certmonger stopped tracking of all my certs. Figuring out how to get all the certs tracked again took quite some time examples or hints on how to do this are sadly missing in ipa-healthcheck they would have been very usefull So now all untracked certs are tracked and no longer in ipa-healthcheck output. But there are still quite a few errors left which have no clue Does anybody know how to fix the errors from ipa-healthcheck ? (see txt below) Any help would be appreciated Rob ipa-healthcheck args=({'msgtype': 101, 'msgid': 3, 'result': 32, 'desc': 'No such object', 'ctrls': [], 'ldap_request': "search_ext_s(('cn=changelog5,cn=config', 0, '(objectClass=*)'),{'attrlist': ['nsslapd-changelogmaxentries'], 'serverctrls': None, ' clientctrls': None, 'escapehatch': 'i am sure'}) on instance TJAKO-THUIS"},) [ { "source": "ipahealthcheck.ipa.certs", "check": "IPACertTracking", "result": "CRITICAL", "uuid": "711d096f-c1a8-4528-873d-522498811fbf", "when": "20221118235210Z", "duration": "2.149582", "kw": { "exception": "bus, object_path and dbus_interface must not be None." } }, { "source": "ipahealthcheck.ipa.certs", "check": "IPACertDNSSAN", "result": "CRITICAL", "uuid": "06997e50-52cd-4240-9b90-41cd7bf9e9f6", "when": "20221118235212Z", "duration": "2.599630", "kw": { "exception": "bus, object_path and dbus_interface must not be None." } }, { "source": "ipahealthcheck.ipa.certs", "check": "IPACertRevocation", "result": "CRITICAL", "uuid": "5fe7388f-6ec6-433f-87df-4596eabee060", "when": "20221118235224Z", "duration": "2.801779", "kw": { "exception": "bus, object_path and dbus_interface must not be None." } }, { "source": "ipahealthcheck.ipa.certs", "check": "IPACertmongerCA", "result": "ERROR", "uuid": "7a588ee8-f3f0-4db4-91d0-b236a9dcbb81", "when": "20221118235224Z", "duration": "0.009275", "kw": { "key": "dogtag-ipa-ca-renew-agent-reuse", "msg": "Certmonger CA '{key}' missing" } }, { "source": "ipahealthcheck.ipa.files", "check": "IPAFileCheck", "result": "CRITICAL", "uuid": "2e82818e-7210-4cf2-bd99-7490841348c6", "when": "20221118235226Z", "duration": "0.199291", "kw": { "exception": "bus, object_path and dbus_interface must not be None." } } ]

4 14

'transportCert cert-pki-kra' mix up
by GH 02 Dec '22

02 Dec '22

I've got two ancient (3.1?) IPA servers that have been upgraded over time. Last January things got really goofy with certificates and I got it all sorted. However, now I've got an old issue creeping back in. The 'transportCert cert-pki-kra' is mismatched between the CS.cfg and the tracked certificate. This is a multi-master setup. The signing master seems to be the one that's off. It's tracking the updated original 'transportCert cert-pki-kra' certificate. However, the "secondary" master is tracking a newly generated 'transportCert cert-pki-kra', which is also what both CS.cfg's are referencing. Neither one of the certificates is expired. Everything else seems to be in working order. Here is ipa-healthcheck's only relevant error: "source": "ipahealthcheck.dogtag.ca", "kw": { "msg": "Certificate 'transportCert cert-pki-kra' does not match the value of ca.connector.KRA.transportCert in /var/lib/pki/pki-tomcat/conf/ca/CS.cfg", "configfile": "/var/lib/pki/pki-tomcat/conf/ca/CS.cfg", "directive": "ca.connector.KRA.transportCert", "key": "transportCert cert-pki-kra" }, So, what should I copy where to get this sorted? It seems like the updated original 'transportCert cert-pki-kra' should be copied into the CS.cfg and then manually scp the NSS files from "primary" to "secondary"? What commands would you use to do this? I've got a lot of commands noted and am beginning to get confused as to which ones should be used to get this sorted. Thanks.

6 26

Re: failed to add IPA Replica(Centos 8) on existing IPA cluster (Centos 7) with CA role enabled.
by Florence Blanc-Renaud 29 Nov '22

29 Nov '22

Hi, please keep the list in copy as the resolution steps can often help other users. On Fri, Nov 25, 2022 at 4:55 PM Dushyant Khobragade <dushyantk.sun(a)gmail.com> wrote: > Hi Flo, > Thank you for response. > I could see below logs in /var/log/ipareplica-install.log > <<Truncated>>> > 2022-11-25T15:43:46Z DEBUG certmonger request is in state > 'GENERATING_KEY_PAIR' > 2022-11-25T15:43:46Z DEBUG certmonger request is in state 'SUBMITTING' > 2022-11-25T15:44:11Z DEBUG certmonger request is in state 'CA_UNREACHABLE' > 2022-11-25T15:44:11Z DEBUG Cert request 20221125154346 failed: > CA_UNREACHABLE (Server at https://innsv01p1.mylab.domain/ipa/json failed > request, will retry: 4001 (The service principal for subject alt name > ipa-ca. mylab.domain in certificate request does not exist).) > Is IPA configured as DNS server? You can check with # ipa config-show | grep DNS IPA DNS servers: fedora36.ipa.test If there is at least one server in the IPA DNS servers list, then IPA is configured as DNS server. It should contain a DNS record for ipa-ca.mylab.domain with the IP addresses of all the CA servers: # ipa dnsrecord-show mylab.domain ipa-ca Record name: ipa-ca A record: xxx.xxx.xxx.xxx If you are using an external DNS server, make sure that there is an A record for ipa-ca. You can generate an update file using # ipa dns-update-system-records --dry-run 2022-11-25T15:44:11Z DEBUG Giving up on cert request 20221125154346 > 2022-11-25T15:44:11Z DEBUG certmonger request is in state 'GENERATING_CSR' > 2022-11-25T15:44:12Z DEBUG certmonger request is in state 'SUBMITTING' > 2022-11-25T15:44:13Z DEBUG certmonger request is in state 'POST_SAVED_CERT' > 2022-11-25T15:44:14Z DEBUG certmonger request is in state 'MONITORING' > 2022-11-25T15:44:14Z DEBUG Cert request 20221125154411 was successful > <<Truncated>>> > ldap.SERVER_DOWN: {'result': -1, 'desc': "Can't contact LDAP server", > 'ctrls': [], 'info': 'error:1416F086:SSL > routines:tls_process_server_certificate:certificate verify failed > (certificate is not yet valid)'} > 2022-11-25T15:45:40Z CRITICAL Failed to configure CA instance > It's not clear if this error or the previous one is the root cause, but the content of /var/log/pki/pki-ca-spawn.<date>.log on the replica may give some hints. *Certificate not yet valid* would strongly suggest that the dates are not in sync on the master and the replica. flo > 2022-11-25T15:45:40Z CRITICAL See the installation logs and the following > files/directories for more information: > 2022-11-25T15:45:40Z CRITICAL /var/log/pki/pki-tomcat > 2022-11-25T15:45:40Z DEBUG Traceback (most recent call last): > File "/usr/lib/python3.6/site-packages/ipaserver/install/service.py", > line 635, in start_creation > run_step(full_msg, method) > File "/usr/lib/python3.6/site-packages/ipaserver/install/service.py", > line 621, in run_step > method() > File "/usr/lib/python3.6/site-packages/ipaserver/install/cainstance.py", > line 627, in __spawn_instance > nolog_list=nolog_list > File > "/usr/lib/python3.6/site-packages/ipaserver/install/dogtaginstance.py", > line 227, in spawn_instance > self.handle_setup_error(e) > File > "/usr/lib/python3.6/site-packages/ipaserver/install/dogtaginstance.py", > line 606, in handle_setup_error > ) from None > RuntimeError: CA configuration failed. > 2022-11-25T15:45:40Z DEBUG [error] RuntimeError: CA configuration failed. > 2022-11-25T15:45:40Z DEBUG Removing /root/.dogtag/pki-tomcat/ca > >>Truncted>> > > > Thanks & Regards, > Dushyant > > > > > > > On Fri, Nov 25, 2022 at 7:18 AM Florence Blanc-Renaud <flo(a)redhat.com> > wrote: > >> Hi, >> >> On Fri, Nov 25, 2022 at 3:59 PM dushyant k via FreeIPA-users < >> freeipa-users(a)lists.fedorahosted.org> wrote: >> >>> I am trying to add new replica Centos 8 IPA v.4.7 to my existing centos >>> 7 IPA cluster which has IPA version 4.6 >>> >>> I am able to add centos 8 replica as ipa client however while adding as >>> replica with setup-ca. it failing. >>> >>> Please provide the logs from the failing replica >> (/var/log/ipareplica-install.log). >> >> >>> Also it would be great if anyone can provide documents on migrating IPA >>> to centos 8 from centos 7 >>> >> The doc is available here: >> https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/ht… >> >> HTH, >> flo >> >> >>> _______________________________________________ >>> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org >>> To unsubscribe send an email to >>> freeipa-users-leave(a)lists.fedorahosted.org >>> Fedora Code of Conduct: >>> https://docs.fedoraproject.org/en-US/project/code-of-conduct/ >>> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines >>> List Archives: >>> https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost… >>> Do not reply to spam, report it: >>> https://pagure.io/fedora-infrastructure/new_issue >>> >>

3 3

Local account override IPA account
by Kevin Vasko 29 Nov '22

29 Nov '22

I know this is probably stupid but we have a server with a local account (let’s call this local user “user1”). This server and its install predated our IPA install. This local user also has sudoers exception for this account for a “NOPASSWD” locally on this machine and this machine alone. After some period of time (it’s been like this for years), we added this “user1” account to FreeIPA so we could use it on other select machine. We kept using the local account as if nothing changed. This server with the local “user1” account was on Ubuntu 18.04 and with this set up was working fine. We upgraded it to Ubuntu 20.04 and it broke the sudoers “NOPASSWD”. This local account can no longer execute commands without a password as it seems sssd is overriding the “local account” and going back to IPA and asking for its authentication (user1 on this box is local and has a uid of 1000, the freeipa user1 had the random freeIPA generated 123456789 UID). In my nsswitch.conf For passwd, group, sudoers all of them have “files” listed first which should instruct sssd to prioritize local account information first, correct? If I remove “sss” from the nsswitch sudoers line it works as expected. Is this a regression in sssd or something else Im missing? -Kevin

2 1

IPA servers stopped replicating and cannot get them to replicate again.
by kelly＠fergason.com 29 Nov '22

29 Nov '22

Hello all, I have inherited an IPA setup that has some issues. I was unfamiliar with the IPA software, but am learning a lot really fast. They had 4 servers, ipa01-04. Replication went from 01 to 02 to 03, and I don't recall how 04 was updated. Replication stopped working from ipa01 to ipa02, and I have not been able to get it going again. At this time, we have one working ipa server, with no redundancy. Ipa02 and 03 are shutdown at the moment, ipa04 was rebuilt and I used it to try to create a new replica. I have tried to reinitialize the replication to ipa02, and I have tried to create new replicas. These are set as domainlevel 1, so the process is to create a replica by promoting a client. The general process used here was to clear up any replication agreements between servers and attempt to reinitialize or install the new replica. It pretty much always fails the same way. We had a consultant work with us, and they were unable to determine what the problem was. Some basics about the setup. We are running Oracle Linux 7.9, ipa-server 4.6.8-5.0.1. I have also tried Oracle Linux 8, and ipa-server 4.9.10, but there is no difference. DNS is not managed by the ipa server. Replication seems to be the basis for DR and upgrading, so it would be really nice to get this working again. I am attaching the console output of the ipa-replica-install command, and the install log file. Any insights as to how to get this going again would be greatly appreciated. If anyone needs more information, please let me know. Thanks, Kelly kelly(a)fergason.com

2 1

freeipa dns resolving for non local domains fails
by Rob Verduijn 25 Nov '22

25 Nov '22

Hello, I've found an issue with my ipa dns setup. all local dns queries work fine. However queries outside my ipa domain fail most of the time. I found this error in the logs: managed-keys-zone: Unable to fetch DNSKEY set '.': timed out I think that this causes my problems with external dns. Anybody who knows how to deal with this ? Rob

2 4

FreeIPA 4.9.11
by Antonio Torres 25 Nov '22

25 Nov '22

1 0

failed to add IPA Replica(Centos 8) on existing IPA cluster (Centos 7) with CA role enabled.
by dushyant k 25 Nov '22

25 Nov '22

I am trying to add new replica Centos 8 IPA v.4.7 to my existing centos 7 IPA cluster which has IPA version 4.6 I am able to add centos 8 replica as ipa client however while adding as replica with setup-ca. it failing. Also it would be great if anyone can provide documents on migrating IPA to centos 8 from centos 7

3 2

FreeIPA 4.10.1
by Antonio Torres 24 Nov '22

24 Nov '22

1 0

FYI: Centos 8 Stream issues during Thanksgiving weekend
by Alexander Bokovoy 24 Nov '22

24 Nov '22

Hi, this is just to inform to not attempt upgrading CentOS 8 Stream installations, if you have any, for this Thanksgiving weekend. The compose as of today contains conflicting packages which will cause errors when trying to upgrade IPA deployment. https://bugzilla.redhat.com/show_bug.cgi?id=2148138 contains more details. In short, we are rebasing samba+sssd+freeipa and all related packages in RHEL 8.8, this required a side-tag build. CentOS 8 Stream update was synchronized once testing was completed by RHEL quality engineering team. However, the order of rebuilds on CentOS 8 Stream side was not preserved and at least sssd was rebuilt against old samba version. Since one of internal Samba libraries did change its soname, this causes installation conflicts. CentOS Stream team in US is now out for Thanksgiving, so we probably need to wait until next week before this problem will be fixed. -- / Alexander Bokovoy Sr. Principal Software Engineer Security / Identity Management Engineering Red Hat Limited, Finland

1 0

/var/log volume filling up due to growing logs of signedaudit
by Natxo Asenjo 24 Nov '22

24 Nov '22

hi, our ca master role got its /var/log disk full and after a quick analysis the directory /var/log/pki/pki-tomcat/ca/signedAudit was the problem. First time I come across this problem after 10 years ;-) This directory has a lot of files called ca_audit.yyyymmddhhmmss, each 2M large. It ended up costing 30G in total before we noticed. So the quick fix was fast, deleting files, but what can I tweak to not have this happen again in the future? And is this auditing crucial for some process? Or can it be turned off somewhere? Thanks in advance for your input. -- regards, natxo

3 4

"ipa-cacert-manage renew" is failing
by Sean McLennan 23 Nov '22

23 Nov '22

Went onto my IPA server today to discover the certificate had not been automatically renewed. It's a self-signed cert. I set the date back before the expiry and tried: ipa-cacert-manage renew which results in: 'NoneType' object has no attribute 'is_self_signed' The ipa-cacert-manage command failed. adding '--self-signed' just punts the same error to another attribute: Renewing CA certificate, please wait 'NoneType' object has no attribute 'issuer' The ipa-cacert-manage command failed. I assume the same thing caused the autorenewal to not happen. Any recommendations? IPA version is 4.6.90.pre1+git20180411, API_VERSION: 2.229 which I know is old. It's on an old Ubuntu distro that I can't upgrade without destroying and I've have tried many times to replicate the thing to a different VM but have yet to successfully do so.

4 10

Prometheus exporter ldap search monitoring FreeIPA servers
by Tania Hagan 23 Nov '22

23 Nov '22

Hi FreeIPA-Users, I have a prometheus server and I am trying to setup an alert to test if an ldap search succeeds. Searching there seems to be a few exporters (389ds exporter, openldap exporter ) but all rather old and I'm struggling to get any useful metrics out of them. Could anyone recommend a good way to achieve this (preferably not putting a password a text file), afraid I've had a good search, but struggling to find a good way to do this. Current version of IPA: 4.9.10 Many Thanks, Tania

3 4

NFSv4 id mapping through IPA ldap server
by Yanlish Hesap 23 Nov '22

23 Nov '22

Hi All. We have IPA setup in an AD trust to support our Linux fleet. User home directories are mounted from a Netapp filer (nfs4 with krb5). The filer performs uid <-> uidNumber mapping required by kerberized nfs4 via IPA ldap server. This setup was working well until we patched our RHEL8 IPA servers last week, specifically: 389-ds-base-1.4.3.23-14.module+el8.5.0+14377+c731dc97.x86_64 was updated to: 389-ds-base-1.4.3.28-7.module+el8.6.0+15293+4900ec12.x86_64 and, ipa-server-4.9.6-10.module+el8.5.0+13587+92118e57.x86_64 was updated to: ipa-server-4.9.8-7.module+el8.6.0+14337+19b76db2.x86_64 This seems to have broken something in IPA, the Netapp filer is no longer able to resolve uid,uidNumber mappings for AD trust users (it still works for IPA users. Ad trust is still working, and IPA clients are able to resolve AD users through sssd, and log them in (only the home directories are not working). Directory server logs an entry like the following when the filer attempt lo look up an AD trust user: [21/Nov/2022:16:46:22.551318734 +1100] conn=14684 op=1 BIND dn="uid=netapp-ldap-bind,cn=users,cn=accounts,dc=ipa,dc=localdomain" method=128 version=3 [21/Nov/2022:16:46:22.552177201 +1100] conn=14684 op=1 RESULT err=0 tag=97 nentries=0 wtime=0.000044925 optime=0.000864628 etime=0.000908138 dn="uid=netapp-ldap-bind,cn=users,cn=accounts,dc=ipa,dc=localdomain" [21/Nov/2022:16:46:22.554028669 +1100] conn=14684 op=2 SRCH base="dc=ipa,dc=localdomain" scope=2 filter= "(&(objectClass=posixAccount)(uid=username@localdomain))" <(&(objectClass=posixAccount)(uid=baybars(a)unimelb.edu.au))> attrs="uid uidNumber gidNumber userPassword gecos homeDirectory loginShell" [21/Nov/2022:16:46:22.554212462 +1100] conn=14684 op=2 RESULT err=0 tag=101 nentries=0 wtime=0.000072472 optime=0.000185686 etime=0.000256338 [21/Nov/2022:16:46:24.003556166 +1100] conn=14205 op=10 UNBIND Any pointers appreciated! Regards, Yanlish

2 3

SSSD unable to retrieve secondary groups after upgrade of ipa-server
by Krishna Pulluru 22 Nov '22

22 Nov '22

Hello Community, We recently updated ipa-server and a bunch of related packages from 4.6.8-5.el7.centos.11 to 4.6.8-5.el7.centos.12. This also updated the IPA data. After that, the clients are unable to retrieve group information. However, they can load SSH public keys and other user details fine. When I query the FreeIPA server using ipa and ldapsearch against a user, I see all group memberships. So, the data on the FreeIPA server seems fine, but only how SSSD talks to FreeIPA has changed. On the clients, there were no changes, and I tried all combinations of ldap_schema (rfc2307, rfc2307bis, ipa) and ldap_group_member (memberUid, uniqueMember) every time, removing the cache and restarting SSSD. However, I don't see any change when I run id <username> or getent group <group>. They return the user id and primary group; group and gid. I also tried to add initgroups sss files in /etc/nsswitch.conf, but that didn't make a difference. I tried to revert the packages on the server, but it failed to say data schema is incompatible. So, the current status is our users can SSH to the instances but can't sudo as group information is missing. Since it seems like an issue with SSSD, I raised an issue with SSSD last week: https://github.com/SSSD/sssd/issues/6443. I'm reaching out here hoping someone might have resolved this as an upgrade of the FreeIPA server that triggered this. Please let me know if you've any questions. Additional details: ============== On client: ======= id uid=1987401269(user_name) gid=1987401269(user_name) groups=1987401269(user_name) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 getent group sudo sudo:*:27: On FreeIPA server: ============== id uid=1987401269(user_name) gid=1987401269(user_name) groups=1987401269(user_name),27(sudo),1987400000(group1),1987400473(group2),1987401284(group3), context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 ipa user-show --all --raw user_name dn: uid=user_name,cn=users,cn=accounts,dc=REDACTED,dc=com REDACTED ipaSshPubKey: REDACTED .. memberof: cn=group1,cn=groups,cn=accounts,dc=REDACTED,dc=com memberof: cn=greoup2,cn=groups,cn=accounts,dc=REDACTED,dc=com memberof: cn=sudo,cn=groups,cn=accounts,dc=REDACTED,dc=com memberof: cn=group3,cn=groups,cn=accounts,dc=REDACTED,dc=com .. ldapsearch -Y GSSAPI -b 'uid=<user_name>,cn=users,cn=accounts,dc=REDACTED,dc=com' Shows output similar to above. I enabled debug logs(debug_level=6) on the SSSD client for all nss, pam and be calls to see if there are any issues, but I didn't find anything obvious. I thought it is not very useful to share it here, but I'm sharing the relevant commands SSSD initiates to the FreeIPA server. (2022-11-18 10:00:29): [be[REDACTED.com]] [sdap_initgr_rfc2307_next_base] (0x0400): Searching for groups with base [dc=REDACTED,dc=com] (2022-11-18 10:00:29): [be[REDACTED.com]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(&(memberUid=<user_name>)(objectClass=posixGroup)(cn=*)(&(gidNumber=*)(!(gidNumber=0))))][dc=REDACTED,dc=com]. (2022-11-18 10:00:29): [be[REDACTED.com]] [sdap_get_generic_op_finished] (0x0400): Search result: Success(0), no errmsg set and (2022-11-18 10:00:29): [be[REDACTED.com]] [sdap_get_groups_next_base] (0x0400): Searching for groups with base [dc=REDACTED,dc=com] (2022-11-18 10:00:29): [be[REDACTED.com]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(&(gidNumber=<gid_name>)(objectClass=posixGroup)(cn=*)(&(gidNumber=*)(!(gidNumber=0))))][dc=REDACTED,dc=com]. (2022-11-18 10:00:29): [be[REDACTED.com]] [sdap_get_generic_op_finished] (0x0400): Search result: Success(0), no errmsg set (2022-11-18 10:00:29): [be[REDACTED.com]] [sdap_get_groups_process] (0x0400): Search for groups, returned 1 results. More details below FreeIPA server OS details ================== cat /etc/*release* CentOS Linux release 7.9.2009 (Core) Derived from Red Hat Enterprise Linux 7.9 (Source) NAME="CentOS Linux" VERSION="7 (Core)" ID="centos" ID_LIKE="rhel fedora" VERSION_ID="7" PRETTY_NAME="CentOS Linux 7 (Core)" ANSI_COLOR="0;31" CPE_NAME="cpe:/o:centos:centos:7" HOME_URL="https://www.centos.org/" BUG_REPORT_URL="https://bugs.centos.org/" CENTOS_MANTISBT_PROJECT="CentOS-7" CENTOS_MANTISBT_PROJECT_VERSION="7" REDHAT_SUPPORT_PRODUCT="centos" REDHAT_SUPPORT_PRODUCT_VERSION="7" CentOS Linux release 7.9.2009 (Core) CentOS Linux release 7.9.2009 (Core) cpe:/o:centos:centos:7 Relevant upgrade logs on the FreeIPA server ========================= ---> Package ipa-client.x86_64 0:4.6.8-5.el7.centos.11 will be updated ---> Package ipa-client.x86_64 0:4.6.8-5.el7.centos.12 will be an update ---> Package ipa-client-common.noarch 0:4.6.8-5.el7.centos.11 will be updated ---> Package ipa-client-common.noarch 0:4.6.8-5.el7.centos.12 will be an update ---> Package ipa-common.noarch 0:4.6.8-5.el7.centos.11 will be updated ---> Package ipa-common.noarch 0:4.6.8-5.el7.centos.12 will be an update ---> Package ipa-python-compat.noarch 0:4.6.8-5.el7.centos.11 will be updated ---> Package ipa-python-compat.noarch 0:4.6.8-5.el7.centos.12 will be an update ---> Package ipa-server.x86_64 0:4.6.8-5.el7.centos.11 will be updated ---> Package ipa-server.x86_64 0:4.6.8-5.el7.centos.12 will be an update ---> Package ipa-server-common.noarch 0:4.6.8-5.el7.centos.11 will be updated ---> Package ipa-server-common.noarch 0:4.6.8-5.el7.centos.12 will be an update ---> Package python2-ipaclient.noarch 0:4.6.8-5.el7.centos.11 will be updated ---> Package python2-ipaclient.noarch 0:4.6.8-5.el7.centos.12 will be an update ---> Package python2-ipalib.noarch 0:4.6.8-5.el7.centos.11 will be updated ---> Package python2-ipalib.noarch 0:4.6.8-5.el7.centos.12 will be an update ---> Package python2-ipaserver.noarch 0:4.6.8-5.el7.centos.11 will be updated ---> Package python2-ipaserver.noarch 0:4.6.8-5.el7.centos.12 will be an update Client OS and sssd versions ===================== NAME="Amazon Linux" VERSION="2" ID="amzn" ID_LIKE="centos rhel fedora" VERSION_ID="2" PRETTY_NAME="Amazon Linux 2" ANSI_COLOR="0;33" CPE_NAME="cpe:2.3⭕amazon:amazon_linux:2" HOME_URL="https://amazonlinux.com/" Amazon Linux release 2 (Karoo) cpe:2.3⭕amazon:amazon_linux:2 yum list installed|grep sssd python-sssdconfig.noarch 1.16.5-10.amzn2.10 @amzn2-core sssd.x86_64 1.16.5-10.amzn2.10 @amzn2-core sssd-ad.x86_64 1.16.5-10.amzn2.10 @amzn2-core sssd-client.x86_64 1.16.5-10.amzn2.10 @amzn2-core sssd-common.x86_64 1.16.5-10.amzn2.10 @amzn2-core sssd-common-pac.x86_64 1.16.5-10.amzn2.10 @amzn2-core sssd-ipa.x86_64 1.16.5-10.amzn2.10 @amzn2-core sssd-krb5.x86_64 1.16.5-10.amzn2.10 @amzn2-core sssd-krb5-common.x86_64 1.16.5-10.amzn2.10 @amzn2-core sssd-ldap.x86_64 1.16.5-10.amzn2.10 @amzn2-core sssd-proxy.x86_64 1.16.5-10.amzn2.10 @amzn2-core sssd.conf on Client ================ [domain/REDACTED] ldap_search_base = cn=users,cn=accounts,dc=REDACTED,dc=com cache_credentials = true id_provider = ldap auth_provider = ldap chpass_provider = ldap ldap_uri = ldaps://freeipa.REDACTED.com,ldaps://ipa-slave.REDACTED.com ldap_tls_cacert = /etc/openldap/cacerts/ca.crt ldap_schema = rfc2307 ldap_user_ssh_public_key = ipaSshPubKey ldap_group_search_base = dc=REDACTED,dc=com ldap_page_size = 1900 group_name_attribute = cn ldap_group_member = memberUid group_class = posixGroup [sssd] config_file_version = 2 reconnection_retries = 3 sbus_timeout = 30 services = nss, pam, ssh, sudo domains = REDACTED.com [nss] filter_groups = root filter_users = root reconnection_retries = 3 homedir_substring = /home [pam] reconnection_retries = 3 offline_credentials_expiration = 2 offline_failed_login_attempts = 3 offline_failed_login_delay = 5 [ssh] Thanks, Krishna.

1 1

ipa-client-install randomly fails with slapi_access_allowed does not allow WRITE to ipaProtectedOperation; write_keys!
by Paulina Budzon 22 Nov '22

22 Nov '22

Hi there, We have IPA (VERSION: 4.9.10, API_VERSION: 2.248) running on Alma Linux on 8.7 with total of 4 replicas. We're running in a cloud, so have an automated process in place where new instances automatically enrol to IPA when launching (they all use the same IPA user and fetch the password from a secrets manager). For a while now we have been seeing instances fail to enrol to IPA on random occasions, which is more pronounced when multiple instances are starting at the same time. Each instance runs ipa-client-install, like below, when it starts: ipa-client-install --mkhomedir --ssh-trust-dns --domain=example.com -w${PASSW} -phost-enrollment --unattended --force-join --no-dns-sshfp This sometimes fails with the following: Starting external process args=['/usr/bin/certutil', '-d', 'sql:/tmp/tmpdqzuq_ts', '-A', '-n', 'CA certificate 1', '-t', 'C,,', '-a', '-f', '/tmp/tmpdqzuq_ts/pwdfile.txt'] Process finished, return code=0 stdout= stderr= failed to find session_cookie in persistent storage for principal 'host/ip-172-26-1-238.xxx(a)EXAMPLE.COM' trying https://ipa2.example.com/ipa/json New HTTP connection (ipa2.example.com) HTTP connection destroyed (ipa2.example.com) Traceback (most recent call last): File "/usr/lib/python3.6/site-packages/ipaclient/remote_plugins/__init__.py", line 120, in get_package plugins = api._remote_plugins AttributeError: 'API' object has no attribute '_remote_plugins' During handling of the above exception, another exception occurred: Traceback (most recent call last): File "/usr/lib/python3.6/site-packages/ipalib/rpc.py", line 644, in get_auth_info response = self._sec_context.step() File "<decorator-gen-15>", line 2, in step File "/usr/lib64/python3.6/site-packages/gssapi/_utils.py", line 167, in check_last_err return func(self, *args, **kwargs) File "<decorator-gen-5>", line 2, in step File "/usr/lib64/python3.6/site-packages/gssapi/_utils.py", line 127, in catch_and_return_token return func(self, *args, **kwargs) File "/usr/lib64/python3.6/site-packages/gssapi/sec_contexts.py", line 521, in step return self._initiator_step(token=token) File "/usr/lib64/python3.6/site-packages/gssapi/sec_contexts.py", line 542, in _initiator_step token) File "gssapi/raw/sec_contexts.pyx", line 244, in gssapi.raw.sec_contexts.init_sec_context gssapi.raw.misc.GSSError: Major (851968): Unspecified GSS failure. Minor code may provide more information, Minor (2529639068): Cannot contact any KDC for realm 'EXAMPLE.COM' During handling of the above exception, another exception occurred: Traceback (most recent call last): File "/usr/lib/python3.6/site-packages/ipalib/rpc.py", line 697, in single_request self.get_auth_info() File "/usr/lib/python3.6/site-packages/ipalib/rpc.py", line 646, in get_auth_info self._handle_exception(e, service=service) File "/usr/lib/python3.6/site-packages/ipalib/rpc.py", line 605, in _handle_exception raise errors.KerberosError(message=unicode(e)) ipalib.errors.KerberosError: Major (851968): Unspecified GSS failure. Minor code may provide more information, Minor (2529639068): Cannot contact any KDC for realm 'EXAMPLE.COM' File "/usr/lib/python3.6/site-packages/ipapython/admintool.py", line 180, in execute return_value = self.run() File "/usr/lib/python3.6/site-packages/ipapython/install/cli.py", line 344, in run return cfgr.run() File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 360, in run return self.execute() File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 386, in execute for rval in self._executor(): File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 431, in __runner exc_handler(exc_info) File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 460, in _handle_execute_exception self._handle_exception(exc_info) File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 450, in _handle_exception six.reraise(*exc_info) File "/usr/lib/python3.6/site-packages/six.py", line 693, in reraise raise value File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 421, in __runner step() File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 418, in <lambda> step = lambda: next(self.__gen) File "/usr/lib/python3.6/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from six.reraise(*exc_info) File "/usr/lib/python3.6/site-packages/six.py", line 693, in reraise raise value File "/usr/lib/python3.6/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from value = gen.send(prev_value) File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 655, in _configure next(executor) File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 431, in __runner exc_handler(exc_info) File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 460, in _handle_execute_exception self._handle_exception(exc_info) File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 518, in _handle_exception self.__parent._handle_exception(exc_info) File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 450, in _handle_exception six.reraise(*exc_info) File "/usr/lib/python3.6/site-packages/six.py", line 693, in reraise raise value File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 515, in _handle_exception super(ComponentBase, self)._handle_exception(exc_info) File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 450, in _handle_exception six.reraise(*exc_info) File "/usr/lib/python3.6/site-packages/six.py", line 693, in reraise raise value File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 421, in __runner step() File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 418, in <lambda> step = lambda: next(self.__gen) File "/usr/lib/python3.6/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from six.reraise(*exc_info) File "/usr/lib/python3.6/site-packages/six.py", line 693, in reraise raise value File "/usr/lib/python3.6/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from value = gen.send(prev_value) File "/usr/lib/python3.6/site-packages/ipapython/install/common.py", line 65, in _install for unused in self._installer(self.parent): File "/usr/lib/python3.6/site-packages/ipaclient/install/client.py", line 3961, in main install(self) File "/usr/lib/python3.6/site-packages/ipaclient/install/client.py", line 2655, in install _install(options) File "/usr/lib/python3.6/site-packages/ipaclient/install/client.py", line 2972, in _install api.finalize() File "/usr/lib/python3.6/site-packages/ipalib/plugable.py", line 753, in finalize self.__do_if_not_done('load_plugins') File "/usr/lib/python3.6/site-packages/ipalib/plugable.py", line 432, in __do_if_not_done getattr(self, name)() File "/usr/lib/python3.6/site-packages/ipalib/plugable.py", line 632, in load_plugins for package in self.packages: File "/usr/lib/python3.6/site-packages/ipalib/__init__.py", line 952, in packages ipaclient.remote_plugins.get_package(self), File "/usr/lib/python3.6/site-packages/ipaclient/remote_plugins/__init__.py", line 128, in get_package plugins = schema.get_package(server_info, client) File "/usr/lib/python3.6/site-packages/ipaclient/remote_plugins/schema.py", line 546, in get_package schema = Schema(client) File "/usr/lib/python3.6/site-packages/ipaclient/remote_plugins/schema.py", line 395, in __init__ fingerprint, ttl = self._fetch(client, ignore_cache=read_failed) File "/usr/lib/python3.6/site-packages/ipaclient/remote_plugins/schema.py", line 407, in _fetch client.connect(verbose=False) File "/usr/lib/python3.6/site-packages/ipalib/backend.py", line 69, in connect conn = self.create_connection(*args, **kw) File "/usr/lib/python3.6/site-packages/ipalib/rpc.py", line 1064, in create_connection command([], {} ) File "/usr/lib/python3.6/site-packages/ipalib/rpc.py", line 1276, in _call return self.__request(name, args) File "/usr/lib/python3.6/site-packages/ipalib/rpc.py", line 1243, in __request verbose=self.__verbose >= 3, File "/usr/lib64/python3.6/xmlrpc/client.py", line 1154, in request return self.single_request(host, handler, request_body, verbose) File "/usr/lib/python3.6/site-packages/ipalib/rpc.py", line 697, in single_request self.get_auth_info() File "/usr/lib/python3.6/site-packages/ipalib/rpc.py", line 646, in get_auth_info self._handle_exception(e, service=service) File "/usr/lib/python3.6/site-packages/ipalib/rpc.py", line 605, in _handle_exception raise errors.KerberosError(message=unicode(e)) The ipa-client-install command failed, exception: KerberosError: Major (851968): Unspecified GSS failure. Minor code may provide more information, Minor (2529639068): Cannot contact any KDC for realm 'EXAMPLE.COM' Major (851968): Unspecified GSS failure. Minor code may provide more information, Minor (2529639068): Cannot contact any KDC for realm 'EXAMPLE.COM' The ipa-client-install command failed. See /var/log/ipaclient-install.log for more information This program will set up IPA client. Version 4.9.10 On IPA server the following pops up in logs: ERR - is_allowed_to_access_attr - [file ipa_pwd_extop.c, line 825]: slapi_access_allowed does not allow WRITE to ipaProtectedOperation;write_keys! ERR - ipapwd_getkeytab - [file ipa_pwd_extop.c, line 1714]: Not allowed to set keytab on [host/ip-172-26-1-238.xxx(a)EXAMPLE.COM] This doesn't happen every time - even when multiple instances are launched from the same image, some will fail and some will enrol successfully. It's worse when instances are in different cloud region that IPA (even when they are very close, network-wise, so latency shouldn't be an issue), but can still happen within the same region. For some reason, this has also become worse when we switched from forcing a specific IPA server (--server to ipa-client-install) to DNS auto-discovery. We commonly have situations where 5 instances try to launch at mostly the same time and try to enrol using 2 replicas - and all 5 will fail, both IPAs showing the same errors (as above). We've run out of ideas of what to debug and how, so any clues would be appreciated.

4 6

broken installation -> how to migrate it?
by Florian Hilgenberg 22 Nov '22

22 Nov '22

hello people. -> this is already posted here, maybe check there for better formatting? https://www.reddit.com/r/FreeIPA/comments/yzcln7/broken_installation_how_to… i broke my ipa installation on a centos 7 somehow... can't root cause it anymore. but since i basically use only ldap i managed to have it running in a crutch manner... i run into two problems: - when i try to uninstall & install same ipa on that vm (but snapshot clone) then i get an error that it cant connect to ldapi:///var/run/slapd*sock -> i gave up at some point. - cant join new machines via ipa-client-install - problem with kerberos keys i guess, see below. anyway, i found exporting a backup, importing it on a rockylinux 9 does import the same problems... so i am kinda lost and guess am seeking some help here... at this point i start hating the fullfeatureset of ipa which brings lots of complexity... anyways here we're.... dont be surprised about the date+timestamps, i got my shells PS settings that way. old system centos7 mgmt01: root@mgmt01 14:29:28 ~$ kinit admin Password for admin@REALM: root@mgmt01 14:29:51 ~$ ipa user-find ERROR: No valid Negotiate header in server response new system rocky9 mgmt02 after completely fresh install. 14:32:46-root@mgmt02:RC0:~ ↳ kinit admin 19.11.2022 14:32:48 Password for admin@REALM: 14:32:52-root@mgmt02:RC0:~ ↳ ipa user-find 19.11.2022 14:32:55 --------------1 user matched-------------- User login: admin Last name: Administrator Home directory: /home/admin Login shell: /bin/bash Principal alias: admin@REALM, root@REALM UID: 1037800000 GID: 1037800000 Account disabled: False ----------------------------Number of entries returned 1---------------------------- i do export backup on mgmt01: ipa-backup --data --online on mgmt02: go login to webinterface of new server, find default/empty user list ↳ ipa-restore --data --online --backend userRoot /home/sshadmin/ipa-data-2022-11-18-19-40-45/ 19.11.2022 14:48:14 Directory Manager (existing master) password: Preparing restore from /home/sshadmin/ipa-data-2022-11-18-19-40-45/ on mgmt01 Performing DATA restore from DATA backup Restoring data from a different release of IPA. Data is version 4.6.8. Server is running 4.9.8. Continue to restore? [no]: yes Temporary setting umask to 022 Restoring data will overwrite existing live data. Continue to restore? [no]: yes Each master will individually need to be re-initialized or re-created from this one. The replication agreements on masters running IPA 3.1 or earlier will need to be manually re-enabled. See the man page for details. Disabling all replication. Starting Directory Server Restoring from userRoot in REALM Waiting for LDIF to finish Restoring umask to 18 The ipa-restore command was successful ↳ ipa user-find -> can find users ↳ refresh website -> i can see my ldap users. ↳ logout of website, relogin with admin user gives me: Login failed due to an unknown reason (same on old system) ↳ reboot and ipa user-find will give me this one: ipa: ERROR: No valid Negotiate header in server response At this point again i cant join new machines to the new server via ipa-client-install I am pretty lost. I also tried exporting ldap data with db2ldif -> and added to new server with ldapmodify -ac -f ldiffile and seeeeem to run into pretty similar issues. luckily i can read the ldif file and connect to old and new server with apache studio, that might help in more manual efforts to restore the service. I tried something else now... I've exported LDIFs from cn=groups,cn=accounts and cn=users,cn=accounts seperately. Tried to import groups first (did work). Tried to import users then -> only a feeeew users are imported in the end. must of them are declined with this error: #!ERROR [LDAP result code 53 - unwillingToPerform] Managed Entry Plugin rejected add operation (see errors log). i have no damn clue... Nov 19 16:59:37 mgmt.doma.in ns-slapd[1257]: [19/Nov/2022:16:59:37.145273724 +0100] - ERR - managed-entries-plugin - mep_add_managed_entry - Unable to add pointer to managed entry "cn=user,cn=groups,cn=accounts,dc=doma,dc=in" in origin entry "uid=user,cn=users,cn=accounts,dc=doma,dc=in" (Type or value exists).

1 0

New ipaclient releases for PyPI?
by Sam Morris 22 Nov '22

22 Nov '22

ipaclient on PyPI is a bit outdated (4.8.9). Are there any plans to start uploading it again? Cheers, -- Sam Morris <https://robots.org.uk/> PGP: rsa4096/CAAA AA1A CA69 A83A 892B 1855 D20B 4202 5CDA 27B9

2 2

DNS Caching w/ FreeIPA
by TomK 20 Nov '22

20 Nov '22

Hello, How do I manipulate the DNS caching settings in FreeIPA? For example, how do I adjust the cache size, ttl etc ? I'm looking to speed up external queries by caching them in FreeIPA to allow faster lookups on subsequent requests, thereby reducing response times. -- Thx, TK.

1 0

Re: ghost replica for radius server
by Grant Janssen 18 Nov '22

18 Nov '22

that was easy - THANX Florence. My ghost replica still doesn’t show in ipa_check_consistency. Any ideas on that? grant@radius01:~[20221118-3:56][#97]$ ipa server-state $HOSTNAME --state=enabled ipa: WARNING: Automatic update of DNS system records failed. Please re-run update of system records manually to get list of missing records. -------------------------------------------------------- Changed server state of "radius01.production.efilm.com<http://radius01.production.efilm.com>". -------------------------------------------------------- grant@radius01:~[20221118-3:57][#98]$ sudo ipa-pkinit-manage status PKINIT is disabled The ipa-pkinit-manage command was successful grant@radius01:~[20221118-3:58][#99]$ sudo ipa-pkinit-manage enable Configuring Kerberos KDC (krb5kdc) [1/1]: installing X509 Certificate for PKINIT Done configuring Kerberos KDC (krb5kdc). The ipa-pkinit-manage command was successful grant@radius01:~[20221118-3:58][#100]$ ipa server-state $HOSTNAME --state=hidden ipa: WARNING: Automatic update of DNS system records failed. Please re-run update of system records manually to get list of missing records. -------------------------------------------------------- Changed server state of "radius01.production.efilm.com<http://radius01.production.efilm.com>". -------------------------------------------------------- grant@radius01:~[20221118-3:59][#101]$ ipa_check_consistency -d PRODUCTION.EFILM.COM<http://PRODUCTION.EFILM.COM> -W ************** FreeIPA servers: ef-idm01 ef-idm02 ef-idm03 ef-idm04 STATE ========================================================================= Active Users 349 349 349 349 OK Stage Users 7 7 7 7 OK Preserved Users 5 5 5 5 OK User Groups 42 42 42 42 OK Hosts 423 423 423 423 OK Host Groups 23 23 23 23 OK HBAC Rules 9 9 9 9 OK SUDO Rules 35 35 35 35 OK DNS Zones ERROR ERROR ERROR ERROR OK LDAP Conflicts NO NO NO NO OK Ghost Replicas NO NO NO NO OK Anonymous BIND YES YES YES YES OK Replication Status ef-idm02 0 ef-idm03 0 ef-idm02 0 ef-idm01 0 ef-idm03 0 ef-idm01 0 ef-idm01 0 ef-idm04 0 radius01 0 ========================================================================= grant@radius01:~[20221118-4:05][#102]$ sudo ipa-pkinit-manage status [sudo] password for grant: PKINIT is enabled The ipa-pkinit-manage command was successful grant@radius01:~[20221118-4:06][#103]$ When I add the _ldap._tcp and _ldaps._tcp SRV records for the radius server, ipa_check_consistency shows the replication is good, but it still doesn’t appear as a Ghost. grant@radius01:~[20221118-4:47][#106]$ ipa_check_consistency -d PRODUCTION.EFILM.COM<http://PRODUCTION.EFILM.COM> -W ************** FreeIPA servers: ef-idm01 ef-idm02 ef-idm03 ef-idm04 radius01 STATE ===================================================================================== Active Users 349 349 349 349 349 OK Stage Users 7 7 7 7 7 OK Preserved Users 5 5 5 5 5 OK User Groups 42 42 42 42 42 OK Hosts 423 423 423 423 423 OK Host Groups 23 23 23 23 23 OK HBAC Rules 9 9 9 9 9 OK SUDO Rules 35 35 35 35 35 OK DNS Zones ERROR ERROR ERROR ERROR ERROR OK LDAP Conflicts NO NO NO NO NO OK Ghost Replicas NO NO NO NO NO OK Anonymous BIND YES YES YES YES YES OK Replication Status ef-idm02 0 ef-idm03 0 ef-idm02 0 ef-idm01 0 ef-idm01 0 ef-idm03 0 ef-idm01 0 ef-idm01 0 ef-idm04 0 radius01 0 ===================================================================================== grant@radius01:~[20221118-4:52][#107]$ thanx - grant

2 1

Re: Microsoft November 2022 updates breaks Active Directory integration
by Rob Crittenden 18 Nov '22

18 Nov '22

Rob Crittenden wrote: > Microsoft addressed a number of CVEs last week which introduced some > authentication issues. After installation of these patches, user > authentication on Linux systems integrated in Active Directory no longer > works and new systems are unable to join an AD domain that is managed by > domain controllers where these patches have been applied. > > For more details see https://access.redhat.com/solutions/6985061 (open > to the public). > > rob > More detailed information on the issue from Alexander, https://www.redhat.com/en/blog/red-hat-enterprise-linux-and-microsoft-secur… rob

3 2

ghost replica for radius server
by Grant Janssen 18 Nov '22

18 Nov '22

Building a radius server, and decided this was an ideal application for a hidden replica. I got some errors in the replica install, and the consistency check does not show a ghost replica (but does show my radius host in Replication Status.) I run external DNS, this radius host has only has A and PTR records. grant@radius01:~[20221117-13:45][#89]$ sudo ipa-replica-install --setup-ca --hidden-replica Password for admin(a)PRODUCTION.EFILM.COM<mailto:admin@PRODUCTION.EFILM.COM>: ************* WARNING: 376 existing users or groups do not have a SID identifier assigned. Installer can run a task to have ipa-sidgen Directory Server plugin generate the SID identifier for all these users. Please note, in case of a high number of users and groups, the operation might lead to high replication traffic and performance degradation. Refer to ipa-adtrust-install(1) man page for details. Do you want to run the ipa-sidgen task? [no]: no Run connection check to master Connection check OK -snip- [28/30]: importing IPA certificate profiles Lookup failed: Preferred host radius01.production.efilm.com<http://radius01.production.efilm.com> does not provide CA. Lookup failed: Preferred host radius01.production.efilm.com<http://radius01.production.efilm.com> does not provide CA. Failed to import profile 'acmeIPAServerCert': Request failed with status 500: Non-2xx response from CA REST API: 500. . Running ipa-server-upgrade when installation is completed may resolve this issue. [29/30]: configuring certmonger renewal for lightweight CAs [30/30]: deploying ACME service Done configuring certificate server (pki-tomcatd). Configuring Kerberos KDC (krb5kdc) [1/1]: installing X509 Certificate for PKINIT PKINIT certificate request failed: Certificate issuance failed (CA_REJECTED: Server at https://ef-idm01.production.efilm.com/ipa/json failed request, will retry: 903 (an internal error has occurred).) Failed to configure PKINIT Full PKINIT configuration did not succeed The setup will only install bits essential to the server functionality You can enable PKINIT after the setup completed using 'ipa-pkinit-manage' Done configuring Kerberos KDC (krb5kdc). Applying LDAP updates Upgrading IPA:. Estimated time: 1 minute 30 seconds [1/10]: stopping directory server [2/10]: saving configuration [3/10]: disabling listeners -snip- [7/7]: adding fallback group Fallback group already set, nothing to do Done. The ipa-replica-install command was successful grant@radius01:~[20221117-13:51][#90]$ check consistency grant@radius01:~[20221117-13:53][#92]$ ipa_check_consistency -d PRODUCTION.EFILM.COM<http://PRODUCTION.EFILM.COM> -W ************* FreeIPA servers: ef-idm01 ef-idm02 ef-idm03 ef-idm04 STATE ========================================================================= Active Users 349 349 349 349 OK Stage Users 7 7 7 7 OK Preserved Users 5 5 5 5 OK User Groups 42 42 42 42 OK Hosts 423 423 423 423 OK Host Groups 23 23 23 23 OK HBAC Rules 9 9 9 9 OK SUDO Rules 35 35 35 35 OK DNS Zones ERROR ERROR ERROR ERROR OK LDAP Conflicts NO NO NO NO OK Ghost Replicas NO NO NO NO OK Anonymous BIND YES YES YES YES OK Replication Status ef-idm02 0 ef-idm03 0 ef-idm02 0 ef-idm01 0 ef-idm03 0 ef-idm01 0 ef-idm01 0 ef-idm04 0 radius01 0 ========================================================================= grant@radius01:~[20221117-13:53][#93]$ I executed ipa-server-upgrade as suggested grant@radius01:~[20221117-16:09][#88]$ sudo ipa-server-upgrade [sudo] password for grant: Upgrading IPA:. Estimated time: 1 minute 30 seconds [1/11]: stopping directory server [2/11]: saving configuration [3/11]: disabling listeners [4/11]: enabling DS global lock [5/11]: disabling Schema Compat [6/11]: starting directory server [7/11]: updating schema [8/11]: upgrading server Add failure attribute "cn" not allowed [9/11]: stopping directory server [10/11]: restoring configuration [11/11]: starting directory server Done. Update complete Upgrading IPA services -snip- Migrating profile 'caAuditSigningCert' [Ensuring presence of included profiles] [Add default CA ACL] [Updating ACME configuration] [Migrating to authselect profile] [Create systemd-user hbac service and rule] hbac service systemd-user already exists [Add root(a)PRODUCTION.EFILM.COM<mailto:root@PRODUCTION.EFILM.COM> alias to admin account] Added 'root(a)PRODUCTION.EFILM.COM<mailto:root@PRODUCTION.EFILM.COM>' alias to admin account [Setup SPAKE] [Setup PKINIT] [Enable server krb5.conf snippet] [Setup kpasswd_server] [Adding ipa-ca alias to HTTP certificate] Resubmitting HTTP cert tracking request The IPA services were upgraded The ipa-server-upgrade command was successful grant@radius01:~[20221117-16:11][#89]$ ipa_check_consistency -d PRODUCTION.EFILM.COM<http://PRODUCTION.EFILM.COM> -W ************* FreeIPA servers: ef-idm01 ef-idm02 ef-idm03 ef-idm04 STATE ========================================================================= Active Users 349 349 349 349 OK Stage Users 7 7 7 7 OK Preserved Users 5 5 5 5 OK User Groups 42 42 42 42 OK Hosts 423 423 423 423 OK Host Groups 23 23 23 23 OK HBAC Rules 9 9 9 9 OK SUDO Rules 35 35 35 35 OK DNS Zones ERROR ERROR ERROR ERROR OK LDAP Conflicts NO NO NO NO OK Ghost Replicas NO NO NO NO OK Anonymous BIND YES YES YES YES OK Replication Status ef-idm02 0 ef-idm03 0 ef-idm02 0 ef-idm01 0 ef-idm03 0 ef-idm01 0 ef-idm01 0 ef-idm04 0 radius01 0 ========================================================================= grant@radius01:~[20221117-16:11][#90]$ My version of ipa_check_consistency grant@radius01:~[20221117-16:16][#93]$ grep APP_VER /usr/local/bin/ipa_check_consistency readonly APP_VER="17.2.21a" printf "%s version %s\n" "$APP_NAME" "$APP_VER" grant@radius01:~[20221117-16:16][#94]$ I reviewed the installation again, then executed ipa-pkinit-manage grant@radius01:~[20221117-16:29][#91]$ sudo ipa-pkinit-manage status PKINIT is disabled The ipa-pkinit-manage command was successful grant@radius01:~[20221117-16:29][#92]$ sudo ipa-pkinit-manage enable Configuring Kerberos KDC (krb5kdc) [1/1]: installing X509 Certificate for PKINIT PKINIT certificate request failed: Certificate issuance failed (CA_REJECTED: Server at https://ef-idm01.production.efilm.com/ipa/json denied our request, giving up: 2100 (Insufficient access: Host 'radius01.production.efilm.com<http://radius01.production.efilm.com>' is not an active KDC).) Failed to configure PKINIT Full PKINIT configuration did not succeed The setup will only install bits essential to the server functionality You can enable PKINIT after the setup completed using 'ipa-pkinit-manage' Done configuring Kerberos KDC (krb5kdc). The ipa-pkinit-manage command was successful grant@radius01:~[20221117-16:30][#93]$ Are SRV records REQUIRED for PKINIT to succeed? thanx - grant

2 1

SCEP
by Francis Augusto Medeiros-Logeay 17 Nov '22

17 Nov '22

Hi, I try to find good documentation on SCEP and FreeIPA, but I cannot find something that seems updated nor conclusive. Does FreeIPA support SCEP out of the box, or does it need some hacking to do so? And does it support other types of certificate enrolment besides its own api/client? Best, Francis -- Francis Augusto Medeiros-Logeay Oslo, Norway

3 6

dirsrv times out at startup
by Roberto Cornacchia 17 Nov '22

17 Nov '22

Yesterday I installed a replica on a clean Rocky 9 system. No issues at all. Everything seemed to work fine. Today the machine was rebooted (no dnf updates, no system changes) and ipa could not start anymore. ipactl start -d says: Starting Directory Service ipa: DEBUG: Starting external process ipa: DEBUG: args=['/bin/systemctl', 'start', 'dirsrv(a)HQ-SPINQUE-COM.service '] ipa: DEBUG: Process finished, return code=0 ipa: DEBUG: Starting external process ipa: DEBUG: args=['/bin/systemctl', 'is-active', 'dirsrv(a)HQ-SPINQUE-COM.service'] ipa: DEBUG: Process finished, return code=0 ipa: DEBUG: stdout=active ipa: DEBUG: stderr= ipa: DEBUG: wait_for_open_ports: localhost [389] timeout 120 ipa: DEBUG: waiting for port: 389 ipa: DEBUG: Failed to connect to port 389 tcp on ::1 ipa: DEBUG: File "/usr/lib/python3.9/site-packages/ipaserver/install/installutils.py", line 781, in run_script return_value = main_function() File "/usr/lib/python3.9/site-packages/ipaserver/install/ipactl.py", line 739, in main ipa_restart(options) File "/usr/lib/python3.9/site-packages/ipaserver/install/ipactl.py", line 499, in ipa_restart raise IpactlError("Failed to start Directory Service: " + str(e)) ipa: DEBUG: The ipactl command failed, exception: IpactlError: Failed to start Directory Service: Timeout exceeded Failed to start Directory Service: Timeout exceeded /var/log/dirsrv/slapd-HQ-SPINQUE-COM/errors says: [17/Nov/2022:17:22:21.074990853 +0100] - INFO - slapd_extract_cert - CA CERT NAME: HQ.SPINQUE.COM IPA CA [17/Nov/2022:17:22:21.668775045 +0100] - WARN - Security Initialization - SSL alert: Sending pin request to SVRCore. You may need to run systemd-tty-ask-password-agent to provide the password if pin.txt does not exist. [17/Nov/2022:17:22:22.295325169 +0100] - INFO - slapd_extract_cert - SERVER CERT NAME: Server-Cert [17/Nov/2022:17:22:23.275812957 +0100] - INFO - Security Initialization - SSL info: Enabling default cipher set. [17/Nov/2022:17:22:26.090728693 +0100] - INFO - Security Initialization - SSL info: Configured NSS Ciphers [17/Nov/2022:17:22:26.771211814 +0100] - INFO - Security Initialization - SSL info: TLS_AES_128_GCM_SHA256: enabled [17/Nov/2022:17:22:28.438124063 +0100] - INFO - Security Initialization - SSL info: TLS_CHACHA20_POLY1305_SHA256: enabled [17/Nov/2022:17:22:28.928766931 +0100] - INFO - Security Initialization - SSL info: TLS_AES_256_GCM_SHA384: enabled [17/Nov/2022:17:22:29.544178747 +0100] - INFO - Security Initialization - SSL info: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256: enabled [17/Nov/2022:17:22:30.099717701 +0100] - INFO - Security Initialization - SSL info: TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256: enabled [17/Nov/2022:17:22:30.657974763 +0100] - INFO - Security Initialization - SSL info: TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256: enabled [17/Nov/2022:17:22:31.245996850 +0100] - INFO - Security Initialization - SSL info: TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256: enabled [17/Nov/2022:17:22:31.790186166 +0100] - INFO - Security Initialization - SSL info: TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384: enabled [17/Nov/2022:17:22:32.205374722 +0100] - INFO - Security Initialization - SSL info: TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384: enabled [17/Nov/2022:17:22:32.771492861 +0100] - INFO - Security Initialization - SSL info: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA: enabled [17/Nov/2022:17:22:33.139528386 +0100] - INFO - Security Initialization - SSL info: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA: enabled [17/Nov/2022:17:22:33.392948327 +0100] - INFO - Security Initialization - SSL info: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA: enabled [17/Nov/2022:17:22:33.420924018 +0100] - INFO - Security Initialization - SSL info: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256: enabled [17/Nov/2022:17:22:33.468560401 +0100] - INFO - Security Initialization - SSL info: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256: enabled [17/Nov/2022:17:22:33.524578902 +0100] - INFO - Security Initialization - SSL info: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA: enabled [17/Nov/2022:17:22:33.769874334 +0100] - INFO - Security Initialization - SSL info: TLS_DHE_RSA_WITH_AES_128_GCM_SHA256: enabled [17/Nov/2022:17:22:34.596047264 +0100] - INFO - Security Initialization - SSL info: TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256: enabled [17/Nov/2022:17:22:35.137255640 +0100] - INFO - Security Initialization - SSL info: TLS_DHE_RSA_WITH_AES_256_GCM_SHA384: enabled [17/Nov/2022:17:22:35.938316117 +0100] - INFO - Security Initialization - SSL info: TLS_DHE_RSA_WITH_AES_128_CBC_SHA: enabled [17/Nov/2022:17:22:36.492933614 +0100] - INFO - Security Initialization - SSL info: TLS_DHE_RSA_WITH_AES_128_CBC_SHA256: enabled [17/Nov/2022:17:22:37.059388478 +0100] - INFO - Security Initialization - SSL info: TLS_DHE_RSA_WITH_AES_256_CBC_SHA: enabled [17/Nov/2022:17:22:37.497954414 +0100] - INFO - Security Initialization - SSL info: TLS_DHE_RSA_WITH_AES_256_CBC_SHA256: enabled [17/Nov/2022:17:22:37.899521527 +0100] - INFO - Security Initialization - SSL info: TLS_RSA_WITH_AES_128_GCM_SHA256: enabled [17/Nov/2022:17:22:38.340476108 +0100] - INFO - Security Initialization - SSL info: TLS_RSA_WITH_AES_256_GCM_SHA384: enabled [17/Nov/2022:17:22:38.910037361 +0100] - INFO - Security Initialization - SSL info: TLS_RSA_WITH_AES_128_CBC_SHA: enabled [17/Nov/2022:17:22:39.572044273 +0100] - INFO - Security Initialization - SSL info: TLS_RSA_WITH_AES_128_CBC_SHA256: enabled [17/Nov/2022:17:22:40.025517184 +0100] - INFO - Security Initialization - SSL info: TLS_RSA_WITH_AES_256_CBC_SHA: enabled [17/Nov/2022:17:22:40.426814987 +0100] - INFO - Security Initialization - SSL info: TLS_RSA_WITH_AES_256_CBC_SHA256: enabled [17/Nov/2022:17:22:40.972957570 +0100] - INFO - Security Initialization - slapd_ssl_init2 - Configured SSL version range: min: TLS1.2, max: TLS1.3 [17/Nov/2022:17:22:41.780274052 +0100] - INFO - Security Initialization - slapd_ssl_init2 - NSS adjusted SSL version range: min: TLS1.2, max: TLS1.3 [17/Nov/2022:17:22:42.112229404 +0100] - INFO - main - 389-Directory/2.0.14 B2022.028.0000 starting up [17/Nov/2022:17:22:42.255025476 +0100] - INFO - main - Setting the maximum file descriptor limit to: 524288 [17/Nov/2022:17:22:42.302617003 +0100] - ERR - allow_operation - Component identity is NULL [17/Nov/2022:17:22:42.487999340 +0100] - ERR - allow_operation - Component identity is NULL [17/Nov/2022:17:22:43.468192243 +0100] - INFO - PBKDF2_SHA256 - Based on CPU performance, chose 2048 rounds [17/Nov/2022:17:22:44.183513462 +0100] - INFO - ldbm_instance_config_cachememsize_set - force a minimal value 512000 [17/Nov/2022:17:22:44.624731155 +0100] - INFO - ldbm_instance_config_cachememsize_set - force a minimal value 512000 [17/Nov/2022:17:22:45.253918872 +0100] - INFO - ldbm_instance_config_cachememsize_set - force a minimal value 512000 [17/Nov/2022:17:22:45.858243466 +0100] - NOTICE - bdb_start_autotune - found 4009000k physical memory [17/Nov/2022:17:22:46.481252068 +0100] - NOTICE - bdb_start_autotune - found 2327312k available [17/Nov/2022:17:22:47.020077517 +0100] - NOTICE - bdb_start_autotune - cache autosizing: db cache: 250562k [17/Nov/2022:17:22:47.566361446 +0100] - NOTICE - bdb_start_autotune - cache autosizing: userRoot entry cache (3 total): 262144k [17/Nov/2022:17:22:48.138811388 +0100] - NOTICE - bdb_start_autotune - cache autosizing: userRoot dn cache (3 total): 65536k [17/Nov/2022:17:22:48.755496155 +0100] - NOTICE - bdb_start_autotune - cache autosizing: ipaca entry cache (3 total): 262144k [17/Nov/2022:17:22:49.175857218 +0100] - NOTICE - bdb_start_autotune - cache autosizing: ipaca dn cache (3 total): 65536k [17/Nov/2022:17:22:49.566843365 +0100] - NOTICE - bdb_start_autotune - cache autosizing: changelog entry cache (3 total): 262144k [17/Nov/2022:17:22:49.909708217 +0100] - NOTICE - bdb_start_autotune - cache autosizing: changelog dn cache (3 total): 65536k [17/Nov/2022:17:22:50.263993498 +0100] - NOTICE - bdb_start_autotune - total cache size: 1211893760 B; [17/Nov/2022:17:22:50.333639865 +0100] - ERR - schema-compat-plugin - scheduled schema-compat-plugin tree scan in about 5 seconds after the server startup! [17/Nov/2022:17:22:50.389238294 +0100] - WARN - NSACLPlugin - acl_parse - The ACL target cn=groups,cn=compat,dc=hq,dc=spinque,dc=com does not exist [17/Nov/2022:17:22:51.043292508 +0100] - WARN - NSACLPlugin - acl_parse - The ACL target cn=computers,cn=compat,dc=hq,dc=spinque,dc=com does not exist [17/Nov/2022:17:22:51.289250298 +0100] - WARN - NSACLPlugin - acl_parse - The ACL target cn=ng,cn=compat,dc=hq,dc=spinque,dc=com does not exist [17/Nov/2022:17:22:51.707124934 +0100] - WARN - NSACLPlugin - acl_parse - The ACL target ou=sudoers,dc=hq,dc=spinque,dc=com does not exist [17/Nov/2022:17:22:52.141269102 +0100] - WARN - NSACLPlugin - acl_parse - The ACL target cn=users,cn=compat,dc=hq,dc=spinque,dc=com does not exist [17/Nov/2022:17:22:52.683089238 +0100] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=hq,dc=spinque,dc=com does not exist [17/Nov/2022:17:22:53.088962531 +0100] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=hq,dc=spinque,dc=com does not exist [17/Nov/2022:17:22:53.508436603 +0100] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=hq,dc=spinque,dc=com does not exist [17/Nov/2022:17:22:53.968874992 +0100] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=hq,dc=spinque,dc=com does not exist [17/Nov/2022:17:22:54.420310634 +0100] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=hq,dc=spinque,dc=com does not exist [17/Nov/2022:17:22:54.999192598 +0100] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=hq,dc=spinque,dc=com does not exist [17/Nov/2022:17:22:55.956089913 +0100] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=hq,dc=spinque,dc=com does not exist [17/Nov/2022:17:22:56.410138348 +0100] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=hq,dc=spinque,dc=com does not exist [17/Nov/2022:17:22:56.849184508 +0100] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=hq,dc=spinque,dc=com does not exist [17/Nov/2022:17:22:57.326422211 +0100] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=hq,dc=spinque,dc=com does not exist [17/Nov/2022:17:22:57.907640062 +0100] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=hq,dc=spinque,dc=com does not exist [17/Nov/2022:17:22:58.319864944 +0100] - WARN - NSACLPlugin - acl_parse - The ACL target cn=casigningcert cert-pki-ca,cn=ca_renewal,cn=ipa,cn=etc,dc=hq,dc=spinque,dc=com does not exist [17/Nov/2022:17:22:58.828744743 +0100] - WARN - NSACLPlugin - acl_parse - The ACL target cn=casigningcert cert-pki-ca,cn=ca_renewal,cn=ipa,cn=etc,dc=hq,dc=spinque,dc=com does not exist [17/Nov/2022:17:22:59.370165550 +0100] - WARN - NSACLPlugin - acl_parse - The ACL target cn=automember rebuild membership,cn=tasks,cn=config does not exist [17/Nov/2022:17:22:59.588838582 +0100] - INFO - slapi_vattrspi_regattr - Because krbPwdPolicyReference is a new registered virtual attribute , nsslapd-ignore-virtual-attrs was set to 'off' [17/Nov/2022:17:22:59.745115662 +0100] - ERR - NSMMReplicationPlugin - bind_and_check_pwp - agmt="cn=ipa02.hq.spinque.com-to-ipa03.hq.spinque.com" (ipa03:389) - Replication bind with GSSAPI auth failed: LDAP error -1 (Can't contact LDAP server) () [17/Nov/2022:17:22:59.767333919 +0100] - ERR - NSMMReplicationPlugin - bind_and_check_pwp - agmt="cn=ipa02.hq.spinque.com-to-ipa03.hq.spinque.com" (ipa03:389) - Replication bind with GSSAPI auth failed: LDAP error -1 (Can't contact LDAP server) () [17/Nov/2022:17:22:59.860445639 +0100] - ERR - schema-compat-plugin - schema-compat-plugin tree scan will start in about 5 seconds! [17/Nov/2022:17:23:00.264824712 +0100] - INFO - slapd_daemon - slapd started. Listening on All Interfaces port 389 for LDAP requests [17/Nov/2022:17:23:00.921258615 +0100] - INFO - slapd_daemon - Listening on All Interfaces port 636 for LDAPS requests [17/Nov/2022:17:23:01.412183755 +0100] - INFO - slapd_daemon - Listening on /run/slapd-HQ-SPINQUE-COM.socket for LDAPI requests [17/Nov/2022:17:23:04.807261352 +0100] - ERR - schema-compat-plugin - warning: no entries set up under cn=computers, cn=compat,dc=hq,dc=spinque,dc=com Two things to notice about this last output: - bind_and_check_pwp - agmt="cn=ipa02.hq.spinque.com-to-ipa03.hq.spinque.com" (ipa03:389) is not surprising, because ipa03 no longer exists for quite some time. I thought I had removed it cleanly, but apparently there are still some reminders. I don't know how serious of a problem this can be, nor how to remove these traces. - sometimes, but not always, this log also shows: ERR - bdb_version_write - Could not open file "/dev/shm/slapd-HQ-SPINQUE-COM/DBVERSION" for writing Netscape Portable Runtime -5950 (File not found.) Afterwards, the file is there. Perhaps just a timing issue? I don't know what else to look at to see what the problem is. Thanks for your help, Roberto

4 8

failing ipa-server-upgrade
by Roberto Cornacchia 17 Nov '22

17 Nov '22

Hi there, I appear to be stuck in a failing upgrade. On Rocky Linux 8.6. The server is one of 2 replicas, both CA and DNS servers. It all started with pki-tomcat being down on a running server ( ipa02.hq.spinque.com) ipactl status Directory Service: RUNNING krb5kdc Service: RUNNING kadmin Service: RUNNING named Service: RUNNING httpd Service: RUNNING ipa-custodia Service: RUNNING pki-tomcatd Service: STOPPED ipa-otpd Service: RUNNING ipa-dnskeysyncd Service: RUNNING 1 service(s) are not running and unable to go up again, with these errors: ipa-pki-wait-running: Request failed unexpectedly, 404 Client Error: for url: http://ipa02.hq.spinque.com:8080/ca/admin/ca/getStatus SEVERE: LdapBoundConnFactory: Unable to connect to LDAP server: Authentication failed netscape.ldap.LDAPException: Authentication failed (48) Having read something about a similar issue being caused by nss 3.67 (the one installed in the system), I ran a dnf update (4.9.8-8 installed). This actually complicated things, because now it still fails, but also it tries to upgrade every time it starts, failing the upgrade. As far as I can see in the upgrade log, The actual upgrade succeeds, but starting the services at the end fails, which makes the whole procedure fail. So running ipactl restart --ignore-service-failures does not help, because the automatic upgrade fails and that stops all the services as a last step. I'm not sure how I could continue, some pointer would be appreciated. Errors I see now: ERR - set_krb5_creds - Could not get initial credentials for principal [ldap/ipa02.hq.spinque.com(a)HQ.SPINQUE.COM] in keytab [FILE:/etc/dirsrv/ds.keytab]: -1765328228 (Cannot contact any KDC for requested realm) ldap_child[2130]: Failed to initialize credentials using keytab [MEMORY:/etc/krb5.keytab]: Cannot contact any KDC for realm 'HQ.SPINQUE.COM'. Unable to create GSSAPI-encrypted LDAP connection. Thanks for your help, Roberto

4 14

ipa-replica-install: "Trust is configured"
by Roberto Cornacchia 17 Nov '22

17 Nov '22

I'm adding a replica, with CA and DNS setup, to an existing server (also DNS and CA). First enrolled the server-to-be with ipa-client-install, then promoting it to replica with ipa-replica-install. With or without CA and DNs, I get: ======= # ipa-replica-install Lookup failed: Preferred host ipa02.hq.spinque.com does not provide DNS. Trust is configured but no NetBIOS domain name found, setting it now. Enter the NetBIOS name for the IPA domain. Only up to 15 uppercase ASCII letters, digits and dashes are allowed. Example: EXAMPLE. NetBIOS domain name [HQ]: ======= The system is a clean Rocky 9 install, we never had a single Windows machine, we never used AD-trust, on both ipa01 and ipa02 ipa trust-find returns 0 matches. Where is it getting this from, and how can I avoid it? VERSION: 4.9.8, API_VERSION: 2.246 Thanks, Roberto

2 2

Microsoft November 2022 updates breaks Active Directory integration
by Rob Crittenden 15 Nov '22

15 Nov '22

Microsoft addressed a number of CVEs last week which introduced some authentication issues. After installation of these patches, user authentication on Linux systems integrated in Active Directory no longer works and new systems are unable to join an AD domain that is managed by domain controllers where these patches have been applied. For more details see https://access.redhat.com/solutions/6985061 (open to the public). rob

4 3

Modify IP address for a FreeIPA Server
by Deepak Ramanath 14 Nov '22

14 Nov '22

I'm trying to see if an IP address for a FreeIPA server can be changed after its been installed?

3 5

Domain(realm) alias for exiting local domain
by moc art 14 Nov '22

14 Nov '22

Hi! I have freeipa domain(realm) `example.local`. User authenticates via `username(a)EXAMPLE.LOCAL`. Can i add new realm `example.com`, like alias for `example.local` to users can authenticates via `username(a)EXAMPLE.COM`? I tryed to add new realm in UI (IPA->realms), but it not works: ``` kinit admin(a)EXAMPLE.COM kinit: Cannot find KDC for realm "EXAMPLE.COM" while getting initial credentials ``` Thanks!

2 1

/etc/ipa/nssdb label
by Sam Morris 11 Nov '22

11 Nov '22

Hi folks I've got a container image into which I bind mount /etc/ipa so that freeipa-client works. I noticed[0] that /etc/ipa/nssdb is not accessible inside the container, because it is labelled with cert_t. SELinux policy prevents container_t from reading files labelled with cert_t. As I understand it /etc/ipa/nssdb is there so that clients using NSS can find the IPA CA certificate. and /etc/ipa/ca.crt is there so that OpenSSL-using clients can find the certificate. If that is the case then I think both files/dirs should be labelled consistently, with etc_t. If so shall I file an issue (and where, FreeIPA or selinux-policy[1]?) # matchpathcon /etc/ipa/* /etc/ipa/ca.crt system_u:object_r:etc_t:s0 /etc/ipa/default.conf system_u:object_r:etc_t:s0 /etc/ipa/nssdb system_u:object_r:cert_t:s0 [0] <https://bugzilla.redhat.com/show_bug.cgi?id=2141311> [1] <https://github.com/fedora-selinux/selinux-policy/blob/a3b543d959064d8384e89…> Regards, -- Sam Morris <https://robots.org.uk/> PGP: rsa4096/CAAA AA1A CA69 A83A 892B 1855 D20B 4202 5CDA 27B9

3 2

External IDP Configuration with Okta
by Russ Long 10 Nov '22

10 Nov '22

Hello, I am working on a test environment to test the integration of Okta as an external IDP. According to the docs, this is supported, however there is no okta-specific documentation that I can find. I have okta configured as follows: [root@ipa-primary ~]# ipa idp-show okta Identity Provider server name: okta Authorization URI: https://ORGNAME.okta.com/oauth2/v1/authorize Device authorization URI: https://ORGNAME.okta.com/oauth2/v1/device/authorize Token URI: https://ORGNAME.okta.com/oauth2/v1/token User info URI: https://ORGNAME.okta.com/oauth2/v1/userinfo Client identifier: CLIENTID Scope: openid email External IdP user identifier attribute: email I also have the Secret configured, as the Okta side is configured to require the secret. When I attempt to perform a login operation using a user configured for this external IDP, I get the following errors (partially redacted for brevity and security): Nov 09 14:58:43 ipa-primary.ipa.DOMAIN.COM oidc_child[5749]: libcurl: > POST /oauth2/v1/device/authorize HTTP/2 Host: ORGNAME.okta.com user-agent: SSSD oidc_child/0.0 accept: application/json content-length: 49 content-type: application/x-www-form-urlencoded Nov 09 14:58:43 ipa-primary.ipa.DOMAIN.COM oidc_child[5749]: {"error":"invalid_client","error_description":"Client authentication failed. Either the client or the client credentials are invalid."} Is there any Okta-specific documentation I can reference, or does anyone know where my configuration issue may be? Thanks, Russ

2 2

IPA-Error 903: InternalError on Certificate page
by Nico Maas 10 Nov '22

10 Nov '22

Dear all, I am using FreeIPA, Version: 4.8.4 on CentOS 8 ipa-client.x86_64 4.8.4-7.module_el8.2.0+374+0d2d74a1 @AppStream ipa-client-common.noarch 4.8.4-7.module_el8.2.0+374+0d2d74a1 @AppStream ipa-common.noarch 4.8.4-7.module_el8.2.0+374+0d2d74a1 @AppStream ipa-healthcheck-core.noarch 0.4-4.module_el8.2.0+374+0d2d74a1 @AppStream ipa-server.x86_64 4.8.4-7.module_el8.2.0+374+0d2d74a1 @AppStream ipa-server-common.noarch 4.8.4-7.module_el8.2.0+374+0d2d74a1 @AppStream ipa-server-dns.noarch 4.8.4-7.module_el8.2.0+374+0d2d74a1 @AppStream Whenever I open the "Authentication" tab in the freeIPA webserver, I get the error "IPA-Error 903: InternalError. An internal error has happend". Retry does not help, within Authentication I can use all tabs, except from the Authentication -> Certificate -> Certificate one. This one gives the error. I can also not search for a certificate. The other areas of Authentication -> Certificate (Certificate Profiles, CA ACLS, Certificate Authorities) work without problems. As a test I cloned the machine and updated it to the latest CentOS 8 version with a newer freeIPA version on it, but that did not solve the problem and I scrapped this vm and idea again. Any idea on how to resolve the issue / what could be broken? Which logs and things would be useful to look into? Thanks a lot for your help and have a nice day Nico

4 8

IPA Client / access from another domain and realm possible ?
by Karim Bourenane 09 Nov '22

09 Nov '22

Hello Team Im on CentOS 7.9, with IPA server under 4.6.8. My IPA server manages a domain/realm AAA.com. I would like it to be accessible also via ssh from another domain/realm BBB.com and also to use Kerberos token from BBB.com to use sudo management. It possible ? How should I proceed? If you could help me please. Bien à vous Mr Karim Bourenane

2 3

ds-replcheck error after updating today
by Steve Huston 07 Nov '22

07 Nov '22

I'm running Springdale 7 (a RHEL derivative). I have three IPA servers in a multi-master configuration with schema-compat-plugin turned on (old NIS-based netgroup authorization for NFS mounts which has carried over to newer file servers as well). Last week I updated these packages when they became available in the repo: Nov 03 10:50:43 Updated: 389-ds-base-libs-1.3.10.2-17.el7_9.x86_64 Nov 03 10:50:59 Updated: 389-ds-base-1.3.10.2-17.el7_9.x86_64 Nov 03 10:50:59 Updated: 389-ds-base-snmp-1.3.10.2-17.el7_9.x86_64 This morning I updated these: Nov 07 09:51:26 Updated: ipa-common-4.6.8-5.el7_9.12.noarch Nov 07 09:51:27 Updated: ipa-client-common-4.6.8-5.el7_9.12.noarch Nov 07 09:51:27 Updated: ipa-server-common-4.6.8-5.el7_9.12.noarch Nov 07 09:51:27 Updated: python2-ipalib-4.6.8-5.el7_9.12.noarch Nov 07 09:51:28 Updated: python2-ipaclient-4.6.8-5.el7_9.12.noarch Nov 07 09:51:28 Updated: python2-ipaserver-4.6.8-5.el7_9.12.noarch Nov 07 09:51:30 Updated: ipa-client-4.6.8-5.el7_9.12.x86_64 Nov 07 09:51:30 Updated: slapi-nis-0.60.0-1.el7_9.x86_64 Nov 07 09:51:31 Updated: ipa-server-4.6.8-5.el7_9.12.x86_64 Others were updated as well, but I don't believe they were relevant. After updating the group of packages today, I ran a replication check from the machine I consider the "primary master", which was not the one that I'd updated. 'repl-monitor' completed successfully and showed everything was connected and working. However, ds-replcheck when involved with the newly-upgraded server reported differences in the replication. Specifically everything in the "cn=compat" subtree was missing from the upgraded host, and strangely so is "ou=sudoers" which is empty anyway but I don't recall it being missing in the replication check before. I eventually checked the directory itself, and found that while ds-replcheck reports those replicas as missing, they do exist on the updated server and are retrievable. I picked one of the entries from the output of ds-replcheck and used 'ldapsearch' to view it on both the master and the replica, and got the same answer from both. So it appears that the data does exist, but ds-replcheck isn't finding it. If I limit the base DN for the replication check to "cn=compat" from any of the hosts I get the error that it is not replicated. After a bit of digging around I see that the slapi-nis upgrade may include quite a bit of differences from 0.56.5 to 0.60.0 though I'm not sure how many of those were backported to the RPM before. I've halted updating machines until I figure out this discrepancy since I don't want to make things worse. At the moment I'm not sure how many (if any) hosts are querying this one server - I don't have nearly as many on the network as I used to so the three servers is more for redundancy than load balancing - but I'm not seeing errors from machines so I'm leaving it up. Can anyone shed some light on this? Is this a real problem or just an indicator of a change in slapi-nis that means ds-replcheck will error until I upgrade the other two hosts as well, and then they'll all agree? -- Steve Huston - W2SRH - Unix Sysadmin, PICSciE/CSES & Astrophysical Sci Princeton University | ICBM Address: 40.346344 -74.652242 345 Lewis Library |"On my ship, the Rocinante, wheeling through Princeton, NJ 08544 | the galaxies; headed for the heart of Cygnus, (267) 793-0852 | headlong into mystery." -Rush, 'Cygnus X-1'

2 2

using custom 389ds package
by dweller dweller 07 Nov '22

07 Nov '22

I need to use recompiled with "-fno-omit-frame-pointer" version of 389ds server for test purposes as a part of FreeIPA. How would I approach such installation. I navigated through freeipa code on github and didn't find exactly the point where FreeIPA handles installation of packages (bind, 389-ds, dogtag etc). Can someone give me a hint on how to approach this?

2 1

Cannot obtain CA certificate
by Ronald Wimmer 07 Nov '22

07 Nov '22

When trying to enroll some IPA clients (RHEL 7.9) I do get the following error: Cannot obtain CA certificate 'ldap://pipag01.linux.gleis.at' doesn't have a certificate. Installation failed. Rolling back changes. LDAP(S)/HTTP(S) ports are open. What's going on here? How can I debug further? Cheers, Ronald

2 1

LoadBalancer vs. DNS
by Ronald Wimmer 06 Nov '22

06 Nov '22

IPA heavily relies on DNS entries. In my opinion, this design makes it more difficult to quickly disable one or more IPA servers - especially when using IPA in combination with external DNS (managed by a different department). Would it be possible to put all relevant DNS entries on a Loadbalancer VIP and let the LB resolve to all IPA servers? e.g. instead of having 8 DNS entries for _kerberos-master._tcp.linux.oebb.at for every of our 8 IPA servers I would have just one _kerberos-master._tcp.linux.oebb.at entry. The LB would distribute requests in such a setup. Is it possible to do that or would it break some IPA functionality? Cheers, Ronald

3 9

IPA API - Fetch keytab
by Ronald Wimmer 06 Nov '22

06 Nov '22

In order to integrate our AIX clients we do have to take two steps manually: 1) Enrolling the host 2) Fetching the keytab file for this particular host A quick search in the WebGUIs API browser revealed a host_add method but I cannot find a method for fetching a keytab file. Did I miss something here? Cheers, Ronald

4 12

Migrating from RHEL 7 IDM to Fedora 36 FreeIPA: passwords and root CA
by Martin Gignac 06 Nov '22

06 Nov '22

Hello, I would like to take a RedHat IDM installation running on RHEL 7 and migrate it to a Fedora 36 installation running FreeIPA. Since the jump in version is too big to simply make the Fedora 36 server a replica of the RHEL 7 installation, and since I'd like to change the domain name from 'country.example.com' to 'example.com', I've decided to use the API to extract users and groups from the RHEL installation and populate them in the Fedora 36 server. The Python script I wrote to run this seems to work fine. However I am left with two remaining things I would like to migrate: passwords and the root CA certificate. 1. Is there a way to transfer over the hashed passwords from the RHEL 7 install to the Fedora 36 one? (I expect that the answer will be "no", but I gotta ask anyway!) 2. Is there away to extract the root CA from the RHEL 7 install and use it as the root CA for all generated certificates on the Fedora 36 one? I would like to keep the same root CA so that I don't have to go and change that certificate on all of my LDAPS clients. Thanks for any hints, tips or guidance you can provide! -Martin

2 2

Rocky Linux 9 missing groups or modules: idm:DL1
by Leo O 06 Nov '22

06 Nov '22

I would like to build my Freeipa Postfix-Book plugin for Rocky Linux 9. Therefore I'm following my readme instructions to setup a development environment: https://github.com/leonidas-o/freeipa-postfixbook-plugin#development-enviro… Unfortunately when executing "dnf module enable idm:DL1" on a Rocky Linux 9 VM, I get: " Error: Problems in request: missing groups or modules: idm:DL1 " How can I do that on Rocky9, Rhel9?

5 8

389ds perfomance and paging out operations
by vladislav zharkov 05 Nov '22

05 Nov '22

Hi, I need assistance in understanding what kind of processes happen behind the work of 389ds server in my case, to come with better approaches in troubleshooting further problems. In our environment we are running FreeIPA instances in Docker, but neither the case that it is FreeIPA nor the Docker part actually matter that much, cause ns-slapd service is the main actor of a "problem" I faced. Prerequisites ------------- Host has 4 CPU, 8gb RAM FreeIPA v.4.9.8 ns-slapd -v 389 Project 389-Directory/1.4.3.28 B2022.074.1358 ------------- Most of the time the host does not expirience any kind of load, though RAM usage (talking about used) can grow linery over time but it makes no odds. After some moment (now I can say with some certainty that's because if buff/cache grows) the host begin to expirience heavy disk write load, which I notice by CPU IOWait alerts. cpu iowait https://imgur.com/ifXPX5N disk IO and latency https://imgur.com/HyT0cNR The increase in load is not due to external causes (increase of ldap queries). Actually, "page out" operations were increasing. https://imgur.com/OxofSD9 and also process exporter showed increased major page faults which served as indicator of memory problems (memory shortage though? there was plenty of RAM) https://imgur.com/xt2p933 Memory status during the problem -------------------------------- Tasks: 175 total, 1 running, 174 sleeping, 0 stopped, 0 zombie %CPU(s): 0.7 us, 0.7 sy, 0.0 ni, 29.1 id, 69.4 wa, 0.0 hi, 0.0 si, 0.0 st MiB Mem : 7957.3 total, 414.3 free, 2332.7 used, 5210.3 buff/cache MiB Swap: 0.0 total, 0.0 free, 0.0 used. 5300.7 avail Mem I tried to use some other instruments that would indicate that something was wrong, but I didn't succeed, but I will still add them here for full picture Here output of https://github.com/iovisor/bcc/blob/master/tools/ext4slower_example.txt shows that fsync syscalls by ns-slapd taking to long TIME COMM PID T BYTES OFF_KB LAT(ms) FILENAME 07:00:02 ns-slapd 4017 S 0 0 1455.28 log.0000006661 07:00:10 ns-slapd 4017 S 0 0 1133.62 log.0000006661 07:00:11 ns-slapd 4017 S 0 0 1248.36 log.0000006661 07:01:02 ns-slapd 4017 S 0 0 736.46 log.0000006661 07:01:05 ns-slapd 4017 S 0 0 1541.29 access 07:01:07 ns-slapd 4017 S 0 0 1220.32 log.0000006661 07:01:08 ns-slapd 4017 S 0 0 832.87 log.0000006661 07:01:08 ns-slapd 4017 S 0 0 93.07 entryusn.db 07:01:09 ns-slapd 4017 S 0 0 418.88 description.db 07:01:10 ns-slapd 4017 S 0 0 822.64 nsuniqueid.db 07:01:10 ns-slapd 4017 S 0 0 417.25 displayname.db 07:01:10 ns-slapd 4017 S 0 0 1493.60 log.0000006661 07:01:11 ns-slapd 4017 S 0 0 617.68 memberHost.db 07:01:12 ns-slapd 4017 S 0 0 1684.12 log.0000006661 07:01:12 ns-slapd 4017 S 0 0 434.58 parentid.db 07:01:12 ns-slapd 4017 S 0 0 601.09 accessRuleType.db 07:01:13 ns-slapd 4017 S 0 0 1051.10 memberUser.db 07:01:14 ns-slapd 4017 S 0 0 1056.28 ipakrbprincipalalias.db 07:01:14 ns-slapd 4017 S 0 0 1803.00 log.0000006661 And another output of https://github.com/iovisor/bcc/blob/master/tools/cachetop_example.txt I honestly not sure how to interpret those results, maybe it would be helpful 07:15:30 Buffers MB: 97 / Cached MB: 4212 / Sort: HITS / Order: descending PID UID CMD HITS MISSES DIRTIES READ_HIT% WRITE_HIT% 4017 UNKNOWN( ns-slapd 7259 7177 7177 0.6% 0.0% So, in the attempts to figure out the solution I tried to restart FreeIPA container but it had no effect. In the end, I stopped container, dropped all memory caches (sync; echo 3 > /proc/sys/vm/drop_caches) and started container, and only after that excessive paging out (and disk IO) was gone. So my questions are: 1) What processes behind the scenes of 389ds server could cause such behavior? 2) Is it (kind of) normal? 3) What actions would you suggest to mitigate such behavior. Would ldap metrics in cn=monitor helped to determing something was wrong? (unfortunately they are not currently monitored, but will be). 4) Generally, what would you suggest to monitor additionally, maybe some metrics that would be of help, but not very obvious.

1 0

[SSSD] Announcing SSSD 2.8.1
by Pavel Březina 04 Nov '22

04 Nov '22

# SSSD 2.8.1 The SSSD team is announcing the release of version 2.8.1 of the System Security Services Daemon. The tarball can be downloaded from: https://github.com/SSSD/sssd/releases/tag/2.8.1 See the full release notes at: https://sssd.io/release-notes/sssd-2.8.1.html RPM packages will be made available for Fedora shortly. ## Feedback Please provide comments, bugs and other feedback via the sssd-devel or sssd-users mailing lists: https://lists.fedorahosted.org/mailman/listinfo/sssd-devel https://lists.fedorahosted.org/mailman/listinfo/sssd-users ## Highlights ### Important fixes * A regression when running sss_cache when no SSSD domain is enabled would produce a syslog critical message was fixed.

1 0

debian and derivates as ipa clients?
by Mathias Homann 02 Nov '22

02 Nov '22

Hi, I have a few debian hosts of various flavours (raspbian, OSMC, and actual debian) that I have to attach to my ipa server (which runs in docker using the last official image), and I'm having trouble finding some of the required packages, namely authselect... any suggestions? I have Ubuntu 22.04.1 LTS and Debian 11 Bullseye here... Cheers MH -- Mathias Homann Mathias.Homann(a)openSUSE.org Jabber (XMPP): lemmy(a)tuxonline.tech Matrix: @mathias:eregion.de IRC: [Lemmy] on freenode and ircnet (bouncer active) keybase: https://keybase.io/lemmy gpg key fingerprint: 8029 2240 F4DD 7776 E7D2 C042 6B8E 029E 13F2 C102

2 3

Cannot obtain CA certificate
by Ronald Wimmer 02 Nov '22

02 Nov '22

When trying to add some new ipa clients (RHEL 7.9) I do get the following error: Cannot obtain CA certificate 'ldap://pipag01.linux.gleis.at' doesn't have a certificate. Installation failed. Rolling back changes. LDAP(S)/HTTP(S) ports are open. What's going on here? How can I debug further? Cheers, Ronald

2 2

Cannot obtain CA certificate
by Ronald Wimmer 02 Nov '22

02 Nov '22

When trying to an ipa client (RHEL 7.9) I do get the following error: Cannot obtain CA certificate 'ldap://ipa1.linux.mydomain.at' doesn't have a certificate. Installation failed. Rolling back changes. LDAP(S) and HTTP(S) ports are open. I do not have a clue why install fails yet. Cheers, Ronald

1 0

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users November 2022