FreeIPA-users December 2022

freeipa-users@lists.fedorahosted.org

37 participants
62 discussions

Start a nNew thread

Max number of users
by phiroc＠free.fr 15 Dec '22

15 Dec '22

Hello, what is the maximum number of users you can add to freeipa? Many thanks. Best regards, Philippe

3 3

Re: Named failing the whole time
by Francis Augusto Medeiros-Logeay 14 Dec '22

14 Dec '22

1 0

Kerberos/GSSAPI dovecot auth wierdeness?
by Carlos Mogas da Silva 14 Dec '22

14 Dec '22

Hi list! I'm migrating my server into a new REALM (INT.R3PEK.ORG) from an old one (R3PEK.ORG) This is a completely new install and configuration, so no leftovers exits. The machine is correctly register into the REALM and users are able to login without a problem. Now, when I try to login using a Kerberos ticket, for some reason that I can't understand, dovecot is looking for a ticket on the old REALM. Maybe because of the email domain (which stayed the same)? This is the error message I see on the clients: "Failed to authenticate: Server krbtgt/R3PEK.ORG(a)INT.R3PEK.ORG" The one it should be looking for is krbtgt/INT.R3PEK.ORG(a)INT.R3PEK.ORG, but I can't seem to figure out where the problem is. I've posted the same email to the dovecot mailing list, but since I'm not sure this is a dovecot/configuration issue or something that I should have done on the FreeIPA side, I'm posting it here too just to have some feedback. Thanks!

2 8

Issues upgrading FreeIPA 4.7 -> 4.8
by Johannes Falke 13 Dec '22

13 Dec '22

After postponing the my home network FreeIPA server upgrade (FreeIPA 4.7.x/Fedora 29 -> FreeIPA 4.8.x/Fedora 30) due previously running into this error already, I am running into the same error again but now want to fix it. On FreeIPA 4.7.x/Fedora 29 my set-up was judged healthy by ipa-healthcheck. However, `ipa-server-upgrade` fails with the message "Failed to authenticate to CA REST API". The pki-tomcatd(a)pki-tomcat.service log (during the upgrade) looks as follows: ``` Dec 11 21:17:16 ipa.my.domain systemd[1]: Starting PKI Tomcat Server pki-tomcat... Dec 11 21:17:16 ipa.my.domain pki-server[2405]: ---------------------------- Dec 11 21:17:16 ipa.my.domain pki-server[2405]: pki-tomcat instance migrated Dec 11 21:17:16 ipa.my.domain pki-server[2405]: ---------------------------- Dec 11 21:17:17 ipa.my.domain systemd[1]: Started PKI Tomcat Server pki-tomcat. Dec 11 21:17:17 ipa.my.domain server[2514]: Java virtual machine used: /usr/lib/jvm/jre-1.8.0-openjdk/bin/java Dec 11 21:17:17 ipa.my.domain server[2514]: classpath used: /usr/share/tomcat/bin/bootstrap.jar:/usr/share/tomcat/bin/tomcat-juli.jar:/usr/lib/java/commons-daemon.jar Dec 11 21:17:17 ipa.my.domain server[2514]: main class used: org.apache.catalina.startup.Bootstrap Dec 11 21:17:17 ipa.my.domain server[2514]: flags used: -Djava.library.path=/usr/lib64/nuxwdog-jni Dec 11 21:17:17 ipa.my.domain server[2514]: options used: -Dcatalina.base=/var/lib/pki/pki-tomcat -Dcatalina.home=/usr/share/tomcat -Djava.endorsed.dirs= -Djava.io.tmpdir=/var/lib/pki/pki-tomcat/temp -Djava.util.logging.config.file=/var/lib/pki/pki-tomcat/conf/logging.properties -Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager -Djava.security.manager -Djava.security.policy==/var/lib/pki/pki-tomcat/conf/catalina.policy Dec 11 21:17:17 ipa.my.domain server[2514]: arguments used: start Dec 11 21:17:22 ipa.my.domain server[2514]: main: Attempt to log message "/var/lib/pki/pki-tomcat/logs/ca/signedAudit/ca_audit" to closed log file 0.main - [11/Dec/2022:21:17:22 CET] [14] [6] [AuditEvent=AUDIT_LOG_SHUTDOWN][SubjectID=$System$][Outcome=Success] audit function shutdown Dec 11 21:17:22 ipa.my.domain server[2514]: main: Failed to write in file: "AUDIT_LOG_SHUTDOWN", entry: Attempt to log message "/var/lib/pki/pki-tomcat/logs/ca/signedAudit/ca_audit" to closed log file 0.main - [11/Dec/2022:21:17:22 CET] [14] [6] [AuditEvent=AUDIT_LOG_SHUTDOWN][SubjectID=$System$][Outcome=Success] audit function shutdown, error: Audit Event Failure! Dec 11 21:17:22 ipa.my.domain server[2514]: main: Attempt to log message "/var/lib/pki/pki-tomcat/logs/ca/signedAudit/ca_audit" to closed log file 0.main - [11/Dec/2022:21:17:22 CET] [14] [6] [AuditEvent=AUDIT_LOG_SHUTDOWN][SubjectID=$System$][Outcome=Success] audit function shutdown Dec 11 21:17:22 ipa.my.domain server[2514]: main: Failed to write in file: "AUDIT_LOG_SHUTDOWN", entry: Attempt to log message "/var/lib/pki/pki-tomcat/logs/ca/signedAudit/ca_audit" to closed log file 0.main - [11/Dec/2022:21:17:22 CET] [14] [6] [AuditEvent=AUDIT_LOG_SHUTDOWN][SubjectID=$System$][Outcome=Success] audit function shutdown, error: Audit Event Failure! Dec 11 21:17:28 ipa.my.domain server[2514]: SEVERE: CA subsystem unavailable. Check CA debug log. Dec 11 21:17:33 ipa.my.domain server[2514]: SEVERE: CA subsystem unavailable. Check CA debug log. ``` after which pki-tomcatd@pki-tomcat crashes. the pki-tomcat CA debug log has the following SEVERE exceptions: /var/log/pki/pki-tomcat/ca/debug.2022-12-11.log ``` [...] 2022-12-11 21:17:22 [main] FINE: LdapBoundConnection: Connecting to ipa.my.domain:636 with client cert auth 2022-12-11 21:17:22 [main] FINE: ldapconn/PKISocketFactory.makeSSLSocket: begins 2022-12-11 21:17:22 [main] FINE: SignedAuditLogger: event CLIENT_ACCESS_SESSION_ESTABLISH 2022-12-11 21:17:22 [main] FINE: LogFile: event type not selected: CLIENT_ACCESS_SESSION_ESTABLISH 2022-12-11 21:17:22 [main] SEVERE: Unable to create socket: java.net.ConnectException: Connection refused (Connection refused) java.net.ConnectException: Connection refused (Connection refused) [...traceback...] 2022-12-11 21:17:22 [main] SEVERE: LdapBoundConnFactory: Unable to connect to LDAP server: Unable to create socket: java.net.ConnectException: Connection refused (Connection refused) [...traceback...] 2022-12-11 21:17:22 [main] SEVERE: DBSubsystem: initialization failed: Unable to connect to LDAP server: Unable to create socket: java.net.ConnectException: Connection refused (Connection refused) [...traceback...] 2022-12-11 21:17:22 [main] SEVERE: Unable to start CMS engine: Internal Database Error encountered: Unable to connect to LDAP serve r: Unable to create socket: java.net.ConnectException: Connection refused (Connection refused) [...traceback...] 2022-12-11 21:17:22 [main] SEVERE: Shutting down. 2022-12-11 21:17:22 [main] INFO: Shutting down CA subsystem [...] ``` Looking at the `journalctl` log, it seems the dirsrv(a)MY-DOMAIN.service receives a stop command during the ipa-server-upgrade script just before this error occurs. Dec 11 21:17:19 ipa.my.domain systemd[1]: Stopping 389 Directory Server MY-DOMAIN.... Dec 11 21:17:19 ipa.my.domain ns-slapd[2338]: [11/Dec/2022:21:17:19.575684141 +0100] - INFO - op_thread_cleanup - slapd shutting d> Dec 11 21:17:19 ipa.my.domain ns-slapd[2338]: [11/Dec/2022:21:17:19.581818694 +0100] - INFO - slapd_daemon - slapd shutting down -> Dec 11 21:17:19 ipa.my.domain ns-slapd[2338]: [11/Dec/2022:21:17:19.595175102 +0100] - INFO - slapd_daemon - slapd shutting down -> Dec 11 21:17:20 ipa.my.domain ns-slapd[2338]: [11/Dec/2022:21:17:20.597957402 +0100] - INFO - dblayer_pre_close - Waiting for 4 da> Dec 11 21:17:22 ipa.my.domain server[2514]: main: Attempt to log message "/var/lib/pki/pki-tomcat/logs/ca/signedAudit/ca_audit" to> Dec 11 21:17:22 ipa.my.domain server[2514]: main: Failed to write in file: "AUDIT_LOG_SHUTDOWN", entry: Attempt to log message "/v> Dec 11 21:17:22 ipa.my.domain server[2514]: main: Attempt to log message "/var/lib/pki/pki-tomcat/logs/ca/signedAudit/ca_audit" to> Dec 11 21:17:22 ipa.my.domain server[2514]: main: Failed to write in file: "AUDIT_LOG_SHUTDOWN", entry: Attempt to log message "/v> Dec 11 21:17:22 ipa.my.domain ns-slapd[2338]: [11/Dec/2022:21:17:22.815909751 +0100] - INFO - dblayer_pre_close - All database thr> Dec 11 21:17:22 ipa.my.domain ns-slapd[2338]: [11/Dec/2022:21:17:22.831586103 +0100] - INFO - ldbm_back_instance_set_destructor - > Dec 11 21:17:22 ipa.my.domain ns-slapd[2338]: [11/Dec/2022:21:17:22.851949498 +0100] - INFO - connection_post_shutdown_cleanup - s> Dec 11 21:17:22 ipa.my.domain ns-slapd[2338]: [11/Dec/2022:21:17:22.864268380 +0100] - INFO - main - slapd stopped. Dec 11 21:17:23 ipa.my.domain systemd[1]: dirsrv(a)MY-DOMAIN.service: Succeeded. Dec 11 21:17:23 ipa.my.domain systemd[1]: Stopped 389 Directory Server MY-DOMAIN.. Dec 11 21:17:23 ipa.my.domain audit[1]: SERVICE_STOP pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 m> Dec 11 21:17:23 ipa.my.domain systemd[1]: Starting 389 Directory Server MY-DOMAIN.... I'm not sure how the LDAP connection is supposed to work if the LDAP server gets shut down, but since this is all handled/managed by ipa-server-upgrade, I assume this is correct...? Or is this some bug in the ipa-server-upgrade script? Does anyone have a clue what the root cause of this error might be or how to figure it out?

2 3

Named failing the whole time
by Francis Augusto Medeiros-Logeay 13 Dec '22

13 Dec '22

Hi, I know this mail has very few info - will add them later - but are there common causes for named to crash randomly? My FreeIPA réplica has been so unstable. actually, named crashes. Any hints on where to look? Once I had the replica to blame, it lost contact with the other replicas and had to be rejoined. Thanks in advance for any clues. Best, __ Francis Augusto Medeiros-Logeay Oslo, Norway Sent from a mobile device / Enviado a partir de dispositivo móvel

5 6

Adding data
by Philippe de Rochambeau 12 Dec '22

12 Dec '22

2 1

createTimestamp
by phiroc＠free.fr 10 Dec '22

10 Dec '22

Hello, is there a way in FreeIPA to access LDAP fields which are not normally accessible, such as createTimeStamp? Many thanks.

3 3

ipa-restore in docker container
by Simon Thorley 09 Dec '22

09 Dec '22

Hi all, I am currently migrating a server from a locally installed FreeIPA setup to a CoreOS container setup and cannot find any documentation for this. I am assuming i am doing something wrong or missing something as i cannot find anyone else having an issue or even attempting it either. This is a fresh installed OS from an ignition file so should have no weirdness coming in from anywhere else. podman launch line: bin/podman run --name ipa \ -h thenom-srv1.thenom.local --read-only \ -v /var/lib/ipa-data:/data:Z \ -e IPA_SERVER_IP=192.168.101.6 \ -p 80:80 -p 443:443 -p 389:389 -p 636:636 -p 88:88 -p 464:464 -p 88:88/udp -p 464:464/udp -p 123:123/udp \ quay.io/freeipa/freeipa-server:fedora-36 I have finally got a fresh install running in a container but i am now trying to restore a backup into it from my old server. I have copied a ipa-full directory from my old service into the containers data volume folder on the host. I bash exec into the running IPA container then run ipa-restore /data/ipa-full-2022-11-11-04-03-19, type in my directory manager password and accept the prompts then just get a mass stream of tar errors and then fail: ... tar: setfileconat: Cannot set SELinux context for file 'var/lib/ipa/pki-ca': Permission denied tar: var/lib/ipa: Directory renamed before its status could be extracted tar: setfileconat: Cannot set SELinux context for file 'var/lib/pki/pki-tomcat/lib': Permission denied tar: setfileconat: Cannot set SELinux context for file 'var/lib/pki/pki-tomcat/ca': Permission denied tar: setfileconat: Cannot set SELinux context for file 'var/lib/pki/pki-tomcat': Permission denied tar: var/lib/pki: Directory renamed before its status could be extracted tar: etc/httpd/alias: Directory renamed before its status could be extracted tar: setfileconat: Cannot set SELinux context for file 'etc/pki/pki-tomcat/ca': Permission denied tar: etc/pki/pki-tomcat: Directory renamed before its status could be extracted tar: Exiting with failure status due to previous errors Restoring umask to 18 NSS is built without support of the legacy database(DBM) directory '/etc/ipa/nssdb' The ipa-restore command failed. See /data/var/log/iparestore.log for more information I get similar in the iparestore.log: ... tar: setfileconat: Cannot set SELinux context for file './THENOM-LOCAL/DBVERSION': Operation not supported tar: setfileconat: Cannot set SELinux context for file './THENOM-LOCAL/dse_instance.ldif': Operation not supported tar: setfileconat: Cannot set SELinux context for file './THENOM-LOCAL/dse_index.ldif': Operation not supported tar: setfileconat: Cannot set SELinux context for file './THENOM-LOCAL': Operation not supported tar: setfileconat: Cannot set SELinux context for file './files.tar': Operation not supported tar: setfileconat: Cannot set SELinux context for file '.': Operation not supported 2022-11-13T11:55:38Z DEBUG Starting external process 2022-11-13T11:55:38Z DEBUG args=['tar', '--xattrs', '--selinux', '-xzf', '/tmp/tmp7pt67l7sipa/ipa/files.tar', 'etc/ipa/default.conf'] 2022-11-13T11:55:40Z DEBUG Process finished, return code=0 2022-11-13T11:55:40Z DEBUG stdout= 2022-11-13T11:55:40Z DEBUG stderr=tar: setfileconat: Cannot set SELinux context for file 'etc/ipa/default.conf': Operation not supported This seems to make sense because from what i have read the selinux context on these /data files should be system_u:object_r:container_file_t and i am guessing unchanged\unchangeable due to the environment its running in. Any advice appreciated, thanks in advance. Simon

2 4

[SSSD] Announcing SSSD 2.8.2
by Pavel Březina 09 Dec '22

09 Dec '22

# SSSD 2.8.2 The SSSD team is announcing the release of version 2.8.2 of the System Security Services Daemon. The tarball can be downloaded from: https://github.com/SSSD/sssd/releases/tag/2.8.2 See the full release notes at: https://sssd.io/release-notes/sssd-2.8.2.html RPM packages will be made available for Fedora shortly. ## Feedback Please provide comments, bugs and other feedback via the sssd-devel or sssd-users mailing lists: https://lists.fedorahosted.org/mailman/listinfo/sssd-devel https://lists.fedorahosted.org/mailman/listinfo/sssd-users ## Highlights ### General information * SSSD can be configured not to perform a DNS search during DNS name resolution. This behavior is governed by the new dns_resolver_use_search_list. This parameter can be used in the domain section. Default value is true - that means that SSSD follows the system settings. * `--enable-files-domain` configure option is deprecated and will be removed in one of the next versions of SSSD. * `sssctl analyze` tool doesn't require anymore to be run under root. ### New features * New mapping template for serial number, subject key id, SID, certificate hashes and DN components are added to libsss_certmap.

1 0

Using the 'member managers' functionality in the FreeIPA web GUI: is it currently possible?
by Martin Gignac 08 Dec '22

08 Dec '22

Hi, I've recently gone from an old version of IDM on CentOS 7 to FreeIPA 4.10.1 on Fedora 37. One difference I noticed on FreeIPA is the additional of the 'member managers' attribute for groups. I initially thought that adding a user to the 'member managers' attribute of a given group would allow this user to manage membership for that group in the FreeIPA web GUI, but when an unprivileged accesses the GUI, all they see are the 'Users' and 'OTP Tokens' tabs. This section of the documentation (https://freeipa.readthedocs.io/en/latest/designs/membermanager.html) gives an example of how to do it with the ipa CLI, but I didn't see any reference to performing the same operation with the GUI. Is there a way for unprivileged users to use the 'member managers' functionality in the GUI, or is the feature currently limited to the CLI and API? Thanks, -Martin

2 2

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users December 2022