FreeIPA-users December 2022

freeipa-users@lists.fedorahosted.org

37 participants
62 discussions

Re: Indirect/nested group membership behaviour change in 4.6.8
by Rob Crittenden 08 Dec '22

08 Dec '22

Trond Strømme via FreeIPA-users wrote: > Hi, > > We experienced the same where we now only see direct memberships. > During the wee hours of Dec 7. We saw a crash in our IPA server, running > Centos 7 > > > > (were using nss-pam-ldapd on our hosts, which are running OEL7) > > Theyve gotten indirect/nested memberships without any problems previously. > > > > From our yum logs we can see that the last few days weve got the > following updated packages: > > Nov 22 05:24:29 Installed: kernel.x86_64 3.10.0-1160.80.1.el7 > > Nov 22 05:25:27 Updated: microcode_ctl.x86_64 2:2.1-73.15.el7_9 > > Dec 01 05:22:47 Updated: krb5-libs.x86_64 1.15.1-55.el7_9 > > Dec 01 05:22:47 Updated: libkadm5.x86_64 1.15.1-55.el7_9 > > Dec 01 05:22:47 Updated: krb5-workstation.x86_64 1.15.1-55.el7_9 > > Dec 01 05:22:47 Updated: krb5-devel.x86_64 1.15.1-55.el7_9 > > Dec 01 05:22:48 Updated: krb5-server.x86_64 1.15.1-55.el7_9 > > Dec 01 05:22:48 Updated: krb5-pkinit.x86_64 1.15.1-55.el7_9 > > Dec 01 05:22:50 Updated: tzdata.noarch 2022f-1.el7 > > Dec 01 05:22:50 Updated: hsqldb.noarch 1:1.8.1.3-15.el7_9 > > Dec 01 05:22:51 Updated: tzdata-java.noarch 2022f-1.el7 > > Dec 01 05:22:51 Updated: kpartx.x86_64 0.4.9-136.el7_9 > > > We did see the Derectory Service being in a STOPPED state, on `ipactl start` > > We get the following: > > [root@ipa slapd-REDACTED-REDACTEDSOMEMORE]# ipactl start > > IPA version error: data needs to be upgraded (expected version > '4.6.8-5.el7.centos.12', current version '4.6.8-5.el7.centos.11') > > Automatically running upgrade, fordetails see /var/log/ipaupgrade.log > > Be patient, thismay take a few minutes. > > [76068899.913648] ns-slapd[6185]: segfault at 10 ip 00007f997c761460 sp > 00007f99886cc760 error 4 in libcos-plugin.so[7f997c75e000+a000] A crash is bad though probably not related to nesting. I'd suggest opening a bug against your package provider, Oracle I presume, and/or against the 389-ds project. You'll want to install the debuginfo packages and reproduce the crash so you can get a stack trace which may show what is going on. rob > > Starting Directory Service > > Starting krb5kdc Service > > Starting kadmin Service > > Starting named Service > > Starting httpd Service > > Starting ipa-custodia Service > > Starting ntpd Service > > Starting pki-tomcatd Service > > Starting ipa-otpd Service > > Starting ipa-dnskeysyncd Service > > ipa: INFO: The ipactl command was successful > > from the ipaupgrade.log > > 2022-12-07T03:07:58Z ERROR Introspect error on > :1.25883111:/org/fedorahosted/certmonger: dbus.exceptions.DBusException: > org.freedesktop.DBus.Error.NoReply: Did not receive a reply. Possible > causes include: the remote application did not send a reply, the message > bus security policy blocked the reply, the reply timeout expired, or the > network connection was broken. > > 2022-12-07T03:07:58Z DEBUG Executing introspect queue due to error > > 2022-12-07T03:08:23Z ERROR IPA server upgrade failed: Inspect > /var/log/ipaupgrade.log and run command ipa-server-upgrade manually. > > 2022-12-07T03:08:23Z DEBUG File > "/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 178, in > execute > > return_value = self.run() > > File > "/usr/lib/python2.7/site-packages/ipaserver/install/ipa_server_upgrade.py", > line 54, in run > > server.upgrade() > > File > "/usr/lib/python2.7/site-packages/ipaserver/install/server/upgrade.py", > line 2190, in upgrade > > upgrade_configuration() > > File > "/usr/lib/python2.7/site-packages/ipaserver/install/server/upgrade.py", > line 1930, in upgrade_configuration > > http.configure_certmonger_renewal_guard() > > File > "/usr/lib/python2.7/site-packages/ipaserver/install/httpinstance.py", > line 335, in configure_certmonger_renewal_guard > > path = iface.find_ca_by_nickname('IPA') > > File "/usr/lib64/python2.7/site-packages/dbus/proxies.py", line 70, in > __call__ > > returnself._proxy_method(*args, **keywords) > > File "/usr/lib64/python2.7/site-packages/dbus/proxies.py", line 145, > in __call__ > > **keywords) > > File "/usr/lib64/python2.7/site-packages/dbus/connection.py", line > 651, in call_blocking > > message, timeout) > > > > 2022-12-07T03:08:23Z DEBUG The ipa-server-upgrade command failed, > exception: DBusException: org.freedesktop.DBus.Error.NoReply: Did not > receive a reply. Possible causes include: the remote application did not > send a reply, the message bus security policy blocked the reply, the > reply timeout expired, or the network connection was broken. > > 2022-12-07T03:08:23Z ERROR Unexpected error - see > /var/log/ipaupgrade.log fordetails: > > DBusException: org.freedesktop.DBus.Error.NoReply: Did not receive a > reply. Possible causes include: the remote application did not send a > reply, the message bus security policy blocked the reply, the reply > timeout expired, or the network connection was broken. > > And > > 2022-12-07T07:05:05Z DEBUG stderr=certutil: Could not find cert: ipaCert > > : PR_FILE_NOT_FOUND_ERROR: File not found > > The upgrade log can be provided if needed > > > > Best Regards > > Trond Strømme > > "This email with attachments is solely for the use of the individual or > entity to which it is addressed. It may contain confidential or > privileged information. If you are not the addressee, please notify the > sender and delete this message and all attachments from your files." > > _______________________________________________ > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org > To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org > Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost… > Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue >

1 0

Re: Indirect/nested group membership behaviour change in 4.6.8
by Trond Strømme 08 Dec '22

08 Dec '22

Hi, We experienced the same where we now only see direct memberships. During the wee hours of Dec 7. We saw a crash in our IPA server, running Centos 7 (we're using nss-pam-ldapd on our hosts, which are running OEL7) They've gotten indirect/nested memberships without any problems previously. From our yum logs we can see that the last few days we've got the following updated packages: Nov 22 05:24:29 Installed: kernel.x86_64 3.10.0-1160.80.1.el7 Nov 22 05:25:27 Updated: microcode_ctl.x86_64 2:2.1-73.15.el7_9 Dec 01 05:22:47 Updated: krb5-libs.x86_64 1.15.1-55.el7_9 Dec 01 05:22:47 Updated: libkadm5.x86_64 1.15.1-55.el7_9 Dec 01 05:22:47 Updated: krb5-workstation.x86_64 1.15.1-55.el7_9 Dec 01 05:22:47 Updated: krb5-devel.x86_64 1.15.1-55.el7_9 Dec 01 05:22:48 Updated: krb5-server.x86_64 1.15.1-55.el7_9 Dec 01 05:22:48 Updated: krb5-pkinit.x86_64 1.15.1-55.el7_9 Dec 01 05:22:50 Updated: tzdata.noarch 2022f-1.el7 Dec 01 05:22:50 Updated: hsqldb.noarch 1:1.8.1.3-15.el7_9 Dec 01 05:22:51 Updated: tzdata-java.noarch 2022f-1.el7 Dec 01 05:22:51 Updated: kpartx.x86_64 0.4.9-136.el7_9 We did see the Derectory Service being in a STOPPED state, on `ipactl start` We get the following: [root@ipa slapd-REDACTED-REDACTEDSOMEMORE]# ipactl start IPA version error: data needs to be upgraded (expected version '4.6.8-5.el7.centos.12', current version '4.6.8-5.el7.centos.11') Automatically running upgrade, for details see /var/log/ipaupgrade.log Be patient, this may take a few minutes. [76068899.913648] ns-slapd[6185]: segfault at 10 ip 00007f997c761460 sp 00007f99886cc760 error 4 in libcos-plugin.so[7f997c75e000+a000] Starting Directory Service Starting krb5kdc Service Starting kadmin Service Starting named Service Starting httpd Service Starting ipa-custodia Service Starting ntpd Service Starting pki-tomcatd Service Starting ipa-otpd Service Starting ipa-dnskeysyncd Service ipa: INFO: The ipactl command was successful from the ipaupgrade.log 2022-12-07T03:07:58Z ERROR Introspect error on :1.25883111:/org/fedorahosted/certmonger: dbus.exceptions.DBusException: org.freedesktop.DBus.Error.NoReply: Did not receive a reply. Possible causes include: the remote application did not send a reply, the message bus security policy blocked the reply, the reply timeout expired, or the network connection was broken. 2022-12-07T03:07:58Z DEBUG Executing introspect queue due to error 2022-12-07T03:08:23Z ERROR IPA server upgrade failed: Inspect /var/log/ipaupgrade.log and run command ipa-server-upgrade manually. 2022-12-07T03:08:23Z DEBUG File "/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 178, in execute return_value = self.run() File "/usr/lib/python2.7/site-packages/ipaserver/install/ipa_server_upgrade.py", line 54, in run server.upgrade() File "/usr/lib/python2.7/site-packages/ipaserver/install/server/upgrade.py", line 2190, in upgrade upgrade_configuration() File "/usr/lib/python2.7/site-packages/ipaserver/install/server/upgrade.py", line 1930, in upgrade_configuration http.configure_certmonger_renewal_guard() File "/usr/lib/python2.7/site-packages/ipaserver/install/httpinstance.py", line 335, in configure_certmonger_renewal_guard path = iface.find_ca_by_nickname('IPA') File "/usr/lib64/python2.7/site-packages/dbus/proxies.py", line 70, in __call__ return self._proxy_method(*args, **keywords) File "/usr/lib64/python2.7/site-packages/dbus/proxies.py", line 145, in __call__ **keywords) File "/usr/lib64/python2.7/site-packages/dbus/connection.py", line 651, in call_blocking message, timeout) 2022-12-07T03:08:23Z DEBUG The ipa-server-upgrade command failed, exception: DBusException: org.freedesktop.DBus.Error.NoReply: Did not receive a reply. Possible causes include: the remote application did not send a reply, the message bus security policy blocked the reply, the reply timeout expired, or the network connection was broken. 2022-12-07T03:08:23Z ERROR Unexpected error - see /var/log/ipaupgrade.log for details: DBusException: org.freedesktop.DBus.Error.NoReply: Did not receive a reply. Possible causes include: the remote application did not send a reply, the message bus security policy blocked the reply, the reply timeout expired, or the network connection was broken. And 2022-12-07T07:05:05Z DEBUG stderr=certutil: Could not find cert: ipaCert : PR_FILE_NOT_FOUND_ERROR: File not found The upgrade log can be provided if needed Best Regards Trond Strømme "This email with attachments is solely for the use of the individual or entity to which it is addressed. It may contain confidential or privileged information. If you are not the addressee, please notify the sender and delete this message and all attachments from your files."

1 0

idranges & NT_STATUS_NO_IMPERSONATION_TOKEN - ?
by lejeczek 06 Dec '22

06 Dec '22

Hi Gents. I have a user with UID of 57500500 and Samba's clients would fail with: NT_STATUS_NO_IMPERSONATION_TOKEN while trying to connect/authenticate. There was not idrange in the domain for that ID )so I created one: ... Range name: CCN.PRIVATE_id_range First Posix ID of the range: 57400000 Number of IDs in the range: 9999 First RID of the corresponding RID range: 57400000 First RID of the secondary RID range: 57409999 Range type: local domain range and -> $ ipa-replica-manage dnarange-show drunk.in.ccn: 57400000-57409999 sucker.in.ccn: 1600700501-160079999 but I still cannot samba-connect to the service/server, still fails with the same error. Would you know what is wrong and/or what I'm missing - all thoughts share are much appreciated. many thanks, L.

1 1

Update to Docker Freeipa rocky-9-4.10.0 still checkbox boolean bug
by Leo O 05 Dec '22

05 Dec '22

Hello guys, Talked with Alexander about this bug already in the past: https://pagure.io/freeipa/issue/9171 It should be fixed and in 4.9 according to: https://github.com/freeipa/freeipa/pull/6294 Today I updated freeipa to the latest docker tag "rocky-9-4.10.0" but the checkbox is still not working. I entered a user profile, the checkbox was unchecked, I double checked if the property is set to "TRUE" with ldapsearch and it was. So still the same behaviour. For which version is the fix planend?

2 2

New fields
by phiroc＠free.fr 05 Dec '22

05 Dec '22

Good morning, Is it possible to create new fields in Freeipa using the IPA CLI? Furthermore, how can you access LDAP fields (eg. the account creation date) from ipa ? Many thanks. Philippe

2 3

Dumping Freeipa
by Philippe de Rochambeau 05 Dec '22

05 Dec '22

Hello, In Freeipa 2.0, is there a way to dump the FI for backup purposes? Many thanks. Philippe

4 5

HTTP certificate expired
by Juan Pablo Lorier 05 Dec '22

05 Dec '22

Hi, I have a production server that was not maintained and I see that the HTTP certificate has expired long ago. I tried to renew it but I'm not being agle to get it right. The initial status was: Request ID '20191219011208': status: NEWLY_ADDED_NEED_KEYINFO_READ_PIN stuck: yes key pair storage: type=FILE,location='/var/lib/ipa/private/httpd.key' certificate: type=FILE,location='/var/lib/ipa/certs/httpd.crt' Then following this thread https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost… I got it to this state: Request ID '20191219011208': status: MONITORING ca-error: Server at https://dc1.tnu.com.uy/ipa/xml failed request, will retry: -504 (HTTP POST to URL 'https://XXXX/ipa/xml' failed. libcurl failed even to execute the HTTP transaction, explaining: SSL certificate problem: certificate has expired). stuck: no key pair storage: type=FILE,location='/var/lib/ipa/private/httpd.key',pinfile='/var/lib/ipa/passwds/XXXXX-443-RSA' certificate: type=FILE,location='/var/lib/ipa/certs/httpd.crt' The post indicates that I have to put an old date in the server to get it renewed, but as the server is in production, it means that all clients will fail to log to the server. Evenmore, what time should I return to, before the certificate expiration or right after? Thanks in advance

3 25

Using Python kernel
by Philippe de Rochambeau 05 Dec '22

05 Dec '22

Hello, while reading the manual (man ipa), I’ve noticed there’s a way to access the Python « kernel », for lack of a better word. What is that « kernel »’s exact purpose? Many thanks. Philippe

2 1

Adding roles
by Philippe de Rochambeau 04 Dec '22

04 Dec '22

Hello, is there an ipa command called role-add? I couldn’t find it in the man. Furthermore, let’s say you wish to 400 roles to FreeIPA using the CLI. Would you recommend backing-up FreeIPA before issuing 400 role-adds? Can role-adds fail or cause exceptions? Many thanks. Philippe

2 1

ipa-healthcheck errors
by Rob Verduijn 03 Dec '22

03 Dec '22

Hello, After todays update I noticed I am now running rocky 8.7 freeipa was updated just fine and is working nicely. However after running ipa-healthcheck I was treated with a HUGE amount of errors. After some digging I found that certmonger stopped tracking of all my certs. Figuring out how to get all the certs tracked again took quite some time examples or hints on how to do this are sadly missing in ipa-healthcheck they would have been very usefull So now all untracked certs are tracked and no longer in ipa-healthcheck output. But there are still quite a few errors left which have no clue Does anybody know how to fix the errors from ipa-healthcheck ? (see txt below) Any help would be appreciated Rob ipa-healthcheck args=({'msgtype': 101, 'msgid': 3, 'result': 32, 'desc': 'No such object', 'ctrls': [], 'ldap_request': "search_ext_s(('cn=changelog5,cn=config', 0, '(objectClass=*)'),{'attrlist': ['nsslapd-changelogmaxentries'], 'serverctrls': None, ' clientctrls': None, 'escapehatch': 'i am sure'}) on instance TJAKO-THUIS"},) [ { "source": "ipahealthcheck.ipa.certs", "check": "IPACertTracking", "result": "CRITICAL", "uuid": "711d096f-c1a8-4528-873d-522498811fbf", "when": "20221118235210Z", "duration": "2.149582", "kw": { "exception": "bus, object_path and dbus_interface must not be None." } }, { "source": "ipahealthcheck.ipa.certs", "check": "IPACertDNSSAN", "result": "CRITICAL", "uuid": "06997e50-52cd-4240-9b90-41cd7bf9e9f6", "when": "20221118235212Z", "duration": "2.599630", "kw": { "exception": "bus, object_path and dbus_interface must not be None." } }, { "source": "ipahealthcheck.ipa.certs", "check": "IPACertRevocation", "result": "CRITICAL", "uuid": "5fe7388f-6ec6-433f-87df-4596eabee060", "when": "20221118235224Z", "duration": "2.801779", "kw": { "exception": "bus, object_path and dbus_interface must not be None." } }, { "source": "ipahealthcheck.ipa.certs", "check": "IPACertmongerCA", "result": "ERROR", "uuid": "7a588ee8-f3f0-4db4-91d0-b236a9dcbb81", "when": "20221118235224Z", "duration": "0.009275", "kw": { "key": "dogtag-ipa-ca-renew-agent-reuse", "msg": "Certmonger CA '{key}' missing" } }, { "source": "ipahealthcheck.ipa.files", "check": "IPAFileCheck", "result": "CRITICAL", "uuid": "2e82818e-7210-4cf2-bd99-7490841348c6", "when": "20221118235226Z", "duration": "0.199291", "kw": { "exception": "bus, object_path and dbus_interface must not be None." } } ]

4 14

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users December 2022