FreeIPA-users April 2022

freeipa-users@lists.fedorahosted.org

42 participants
73 discussions

HBAC rules - deny access to a subset of hosts
by iulian roman 19 Apr '22

19 Apr '22

Hello Everybody, I would like to ask if it is possible to deny access to a specific server group for a group of users who have access to all servers by default. Example: operators group have access to all servers , but I would like to deny access for them for a specific subset of servers which are highly secure. Is that possible and if yes , how can it be configured ? Thank You, i roman

2 1

Different global forwarder for replica - is it possible?
by Francis Augusto Medeiros-Logeay 19 Apr '22

19 Apr '22

Hi, I configured a replica on another location, and would rather use another DNS server as a global forwarder for that location. But when I change it, it changes on all replicas. Is there a way to apply a global forwarder unique to a replica? Best, Francis -- Francis Augusto Medeiros-Logeay Oslo, Norway

2 3

NIS domain and freeipa realm
by Ranbir 15 Apr '22

15 Apr '22

Hello Everyone, I'm a long time freeipa admin, but I've never used its NIS compatibility features. I'm also not well versed with NIS in general. Anyway, I'm testing out migrating NIS users, netgroup, etc. to freeipa and pointing a test NIS client at the freeipa server to get the NIS users, groups, etc. from. It occurred to me afterwards that the old NIS domain name doesn't match the test freeipa realm I've stood up. Do they both have to match on the freeipa server for NIS to work or can the freeipa realm be "A" and the NIS domain be "B"? If they can be different, how do I change the NIS domain name in freeipa? I tried the following (see below). [root@freeipatest01 ~]# ipa-compat-manage --realm swamp enable [root@freeipatest01 ~]# ipa-nis-manage --realm swamp enable I have no idea what the --realm switch is for. The man page is no help. I took a wild guess that I could specify a different NIS domain name with it. After doing the above, I created a freeipa user. I then tried to lookup the user from another server, which didn't work: [user@another-host ~]$ ypcat -h freeipatest01 -d swamp passwd No such map passwd.byname. Reason: No such map in server's domain NIS look ups do work if I don't specify a different NIS domain: [root@freeipatest01 ~]# ypcat passwd rsandhu:*:22205:100:Ranbir Sandhu:/home/rsandhu:/bin/bash admin:*:494800000:494800000:Administrator:/home/admin:/bin/bash My initial thought was the freeipa realm and the NIS domain name have to match. But, I decided to play around to see what would happen. I'd appreciate it if anyone can clear this up for me. -- Ranbir

2 1

[SSSD] Announcing SSSD 2.7.0
by Pavel Březina 14 Apr '22

14 Apr '22

# SSSD 2.7.0 The SSSD team is proud to announce the release of version 2.7.0 of the System Security Services Daemon. The tarball can be downloaded from: https://github.com/SSSD/sssd/releases/tag/2.7.0 See the full release notes at: https://sssd.io/release-notes/sssd-2.7.0.html RPM packages will be made available for Fedora shortly. ## New pgp key So far we have been signing each release with our personal keys. Starting from this release (including) we have switched to the new project key that is used to sign our release tarball. - Key ID: C13CD07FFB2DB1408E457A3CD3D21B2910CF6759 - URL: https://github.com/SSSD/sssd/blob/2.7.0/contrib/pubkey.asc - Keyserver: keys.openpgp.org ## Changes release process We have switched to a more aggressive release process since the release of 2.0, where we were trying to publish new features even on every .z release. From now on, we want to switch the process again to prioritize stabilization of each released version. Therefore .z releases will rather focus more on publishing bug fixes and will receive none or only very few carefully selected new features. ## Feedback Please provide comments, bugs and other feedback via the sssd-devel or sssd-users mailing lists: https://lists.fedorahosted.org/mailman/listinfo/sssd-devel https://lists.fedorahosted.org/mailman/listinfo/sssd-users ## Highlights ### New features * Added a new krb5 plugin `idp` and a new binary `oidc_child` which performs **OAuth2** authentication against FreeIPA. This, however, can not be tested yet because this feature is still under development on the FreeIPA server side. Nevertheless, we have decided to include this in the release in order to enable the functionality on the clients immediately when the FreeIPA project delivers this feature without the need to update the clients. ### General information * Better default for IPA/AD re_expression. Tunning for group names containing '@' is no longer needed. * A warning is added in the logs if an LDAP operation needs more than 80% of the configured timeout. * A new debug level is added to show statistical and performance data. Currently the duration of a backend request and of single LDAP operations are recorded if debug_level is set to 9 or the bit 0x20000 is set. * Added support for anonymous PKINIT to get FAST credentials * We have many warnings and errors from static analyzers ### Important fixes * SSSD now correctly falls back to UPN search if the user was not found even with `cache_first = true`. ### Packaging changes * Added new configure option `--with-oidc-child` and `--without-oidc-child` to control build of `oidc_child` (enabled by default). * Added new package `sssd-idp` that contains the `oidc_child` and krb5 `idp` plugin, this package is required by `sssd-ipa`.

1 0

ipa-healthcheck - RA agent description does not match 2 and Invalid Credential
by Kathy Zhu 14 Apr '22

14 Apr '22

Hi team, ipa-healthcheck has been a great tool for us. I run it weekly on all IPA servers via cron. This week ipa-healthcheck reported errors on all IPA servers. Take IPA server ipa2 as an example for the investigation: [root@ipa2 ~]# ipa-healthcheck --failures-only --output-type=human ra.get_certificate(): EXCEPTION (Invalid Credential.) ra.get_certificate(): EXCEPTION (Invalid Credential.) ra.get_certificate(): EXCEPTION (Invalid Credential.) ra.get_certificate(): EXCEPTION (Invalid Credential.) ra.get_certificate(): EXCEPTION (Invalid Credential.) ra.get_certificate(): EXCEPTION (Invalid Credential.) ra.get_certificate(): EXCEPTION (Invalid Credential.) ra.get_certificate(): EXCEPTION (Invalid Credential.) ra.get_certificate(): EXCEPTION (Invalid Credential.) ra.get_certificate(): EXCEPTION (Invalid Credential.) WARNING: ipahealthcheck.ipa.certs.IPACertmongerExpirationCheck.20190425210040: Request id 20190425210040 expires in 27 days WARNING: ipahealthcheck.ipa.certs.IPACertmongerExpirationCheck.20190425210052: Request id 20190425210052 expires in 27 days WARNING: ipahealthcheck.ipa.certs.IPACertmongerExpirationCheck.20190425210053: Request id 20190425210053 expires in 27 days WARNING: ipahealthcheck.ipa.certs.IPACertmongerExpirationCheck.20190425210054: Request id 20190425210054 expires in 27 days WARNING: ipahealthcheck.ipa.certs.IPACertfileExpirationCheck.20190425210040: Request id 20190425210040 expires in 27 days WARNING: ipahealthcheck.ipa.certs.IPACertfileExpirationCheck.20190425210052: Request id 20190425210052 expires in 27 days WARNING: ipahealthcheck.ipa.certs.IPACertfileExpirationCheck.20190425210053: Request id 20190425210053 expires in 27 days WARNING: ipahealthcheck.ipa.certs.IPACertfileExpirationCheck.20190425210054: Request id 20190425210054 expires in 27 days ERROR: ipahealthcheck.ipa.certs.IPARAAgent: RA agent description does not match 2;186;CN=Certificate Authority,O=EXAMPLE.COM;CN=IPA RA,O=EXAMPLE.COM in LDAP and 2;66;CN=Certificate Authority,O=EXAMPLE.COM;CN=IPA RA,O= EXAMPLE.COM expected ERROR: ipahealthcheck.ipa.certs.IPACertRevocation.20190425210040: Request for certificate failed, Certificate operation cannot be completed: EXCEPTION (Invalid Credential.) ERROR: ipahealthcheck.ipa.certs.IPACertRevocation.20190425210052: Request for certificate failed, Certificate operation cannot be completed: EXCEPTION (Invalid Credential.) ERROR: ipahealthcheck.ipa.certs.IPACertRevocation.20190425210053: Request for certificate failed, Certificate operation cannot be completed: EXCEPTION (Invalid Credential.) ERROR: ipahealthcheck.ipa.certs.IPACertRevocation.20190425210054: Request for certificate failed, Certificate operation cannot be completed: EXCEPTION (Invalid Credential.) ERROR: ipahealthcheck.ipa.certs.IPACertRevocation.20190425210055: Request for certificate failed, Certificate operation cannot be completed: EXCEPTION (Invalid Credential.) ERROR: ipahealthcheck.ipa.certs.IPACertRevocation.20190425210056: Request for certificate failed, Certificate operation cannot be completed: EXCEPTION (Invalid Credential.) ERROR: ipahealthcheck.ipa.certs.IPACertRevocation.20190425205849: Request for certificate failed, Certificate operation cannot be completed: EXCEPTION (Invalid Credential.) ERROR: ipahealthcheck.ipa.certs.IPACertRevocation.20190425205831: Request for certificate failed, Certificate operation cannot be completed: EXCEPTION (Invalid Credential.) ERROR: ipahealthcheck.ipa.certs.IPACertRevocation.20190425210120: Request for certificate failed, Certificate operation cannot be completed: EXCEPTION (Invalid Credential.) ERROR: ipahealthcheck.dogtag.ca.DogtagCertsConnectivityCheck: Request for certificate failed, Certificate operation cannot be completed: EXCEPTION (Invalid Credential.) [root@ipa2 ~]# The list of certs: [root@ipa2 ~]# getcert list Number of certificates and requests being tracked: 9. Request ID '20190425205831': status: MONITORING stuck: no key pair storage: type=NSSDB,location='/etc/dirsrv/slapd-EXAMPLE-COM',nickname='Server-Cert',token='NSS Certificate DB',pinfile='/etc/dirsrv/slapd-EXAMPLE-COM/pwdfile.txt' certificate: type=NSSDB,location='/etc/dirsrv/slapd-EXAMPLE-COM',nickname='Server-Cert',token='NSS Certificate DB' CA: IPA issuer: CN=Certificate Authority,O=EXAMPLE.COM subject: CN=ipa2.example.com,O=EXAMPLE.COM expires: 2023-03-29 21:37:22 UTC dns: ipa2.example.com principal name: ldap/ipa2.example.com(a)EXAMPLE.COM key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment eku: id-kp-serverAuth,id-kp-clientAuth pre-save command: post-save command: /usr/libexec/ipa/certmonger/restart_dirsrv EXAMPLE-COM track: yes auto-renew: yes Request ID '20190425205849': status: MONITORING stuck: no key pair storage: type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS Certificate DB',pinfile='/etc/httpd/alias/pwdfile.txt' certificate: type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS Certificate DB' CA: IPA issuer: CN=Certificate Authority,O=EXAMPLE.COM subject: CN=ipa2.example.com,O=EXAMPLE.COM expires: 2023-03-29 21:37:46 UTC dns: ipa2.example.com principal name: HTTP/ipa2.example.com(a)EXAMPLE.COM key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment eku: id-kp-serverAuth,id-kp-clientAuth pre-save command: post-save command: /usr/libexec/ipa/certmonger/restart_httpd track: yes auto-renew: yes Request ID '20190425210040': status: MONITORING stuck: no key pair storage: type=FILE,location='/var/lib/ipa/ra-agent.key' certificate: type=FILE,location='/var/lib/ipa/ra-agent.pem' CA: dogtag-ipa-ca-renew-agent issuer: CN=Certificate Authority,O=EXAMPLE.COM subject: CN=IPA RA,O=EXAMPLE.COM expires: 2022-05-11 03:40:55 UTC key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment eku: id-kp-serverAuth,id-kp-clientAuth pre-save command: /usr/libexec/ipa/certmonger/renew_ra_cert_pre post-save command: /usr/libexec/ipa/certmonger/renew_ra_cert track: yes auto-renew: yes Request ID '20190425210052': status: MONITORING stuck: no key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert cert-pki-ca',token='NSS Certificate DB',pin set certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert cert-pki-ca',token='NSS Certificate DB' CA: dogtag-ipa-ca-renew-agent issuer: CN=Certificate Authority,O=EXAMPLE.COM subject: CN=CA Audit,O=EXAMPLE.COM expires: 2022-05-11 03:40:05 UTC key usage: digitalSignature,nonRepudiation pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "auditSigningCert cert-pki-ca" track: yes auto-renew: yes Request ID '20190425210053': status: MONITORING stuck: no key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert cert-pki-ca',token='NSS Certificate DB',pin set certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert cert-pki-ca',token='NSS Certificate DB' CA: dogtag-ipa-ca-renew-agent issuer: CN=Certificate Authority,O=EXAMPLE.COM subject: CN=OCSP Subsystem,O=EXAMPLE.COM expires: 2022-05-11 03:40:25 UTC eku: id-kp-OCSPSigning pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "ocspSigningCert cert-pki-ca" track: yes auto-renew: yes Request ID '20190425210054': status: MONITORING stuck: no key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert cert-pki-ca',token='NSS Certificate DB',pin set certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert cert-pki-ca',token='NSS Certificate DB' CA: dogtag-ipa-ca-renew-agent issuer: CN=Certificate Authority,O=EXAMPLE.COM subject: CN=CA Subsystem,O=EXAMPLE.COM expires: 2022-05-11 03:40:05 UTC key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment eku: id-kp-serverAuth,id-kp-clientAuth pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "subsystemCert cert-pki-ca" track: yes auto-renew: yes Request ID '20190425210055': status: MONITORING stuck: no key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert cert-pki-ca',token='NSS Certificate DB',pin set certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert cert-pki-ca',token='NSS Certificate DB' CA: dogtag-ipa-ca-renew-agent issuer: CN=Certificate Authority,O=EXAMPLE.COM subject: CN=Certificate Authority,O=EXAMPLE.COM expires: 2038-06-28 21:19:45 UTC key usage: digitalSignature,nonRepudiation,keyCertSign,cRLSign pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "caSigningCert cert-pki-ca" track: yes auto-renew: yes Request ID '20190425210056': status: MONITORING stuck: no key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert cert-pki-ca',token='NSS Certificate DB',pin set certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert cert-pki-ca',token='NSS Certificate DB' CA: dogtag-ipa-ca-renew-agent issuer: CN=Certificate Authority,O=EXAMPLE.COM subject: CN=ipa2.example.com,O=EXAMPLE.COM expires: 2023-03-07 22:37:22 UTC key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment eku: id-kp-serverAuth,id-kp-clientAuth,id-kp-emailProtection pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "Server-Cert cert-pki-ca" track: yes auto-renew: yes Request ID '20190425210120': status: MONITORING stuck: no key pair storage: type=FILE,location='/var/kerberos/krb5kdc/kdc.key' certificate: type=FILE,location='/var/kerberos/krb5kdc/kdc.crt' CA: IPA issuer: CN=Certificate Authority,O=EXAMPLE.COM subject: CN=ipa2.example.com,O=EXAMPLE.COM expires: 2023-03-29 21:37:52 UTC principal name: krbtgt/EXAMPLE.COM(a)EXAMPLE.COM key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment eku: id-kp-serverAuth,id-pkinit-KPKdc pre-save command: post-save command: /usr/libexec/ipa/certmonger/renew_kdc_cert track: yes auto-renew: yes [root@ipa2 ~]# There are 4 certs which expire on 2022-05-11 which match "expires in 27 days". Take 20190425210040 as an example, we have: WARNING: ipahealthcheck.ipa.certs.IPACertmongerExpirationCheck.20190425210040: Request id 20190425210040 expires in 27 days WARNING: ipahealthcheck.ipa.certs.IPACertfileExpirationCheck.20190425210040: Request id 20190425210040 expires in 27 days ERROR: ipahealthcheck.ipa.certs.IPACertRevocation.20190425210040: Request for certificate failed, Certificate operation cannot be completed: EXCEPTION (Invalid Credential.) Request ID '20190425210040': status: MONITORING stuck: no key pair storage: type=FILE,location='/var/lib/ipa/ra-agent.key' certificate: type=FILE,location='/var/lib/ipa/ra-agent.pem' CA: dogtag-ipa-ca-renew-agent issuer: CN=Certificate Authority,O=EXAMPLE.COM subject: CN=IPA RA,O=EXAMPLE.COM expires: 2022-05-11 03:40:55 UTC key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment eku: id-kp-serverAuth,id-kp-clientAuth pre-save command: /usr/libexec/ipa/certmonger/renew_ra_cert_pre post-save command: /usr/libexec/ipa/certmonger/renew_ra_cert track: yes auto-renew: yes I was able to manually renew it: [root@ipa2 ~]# ipa-getcert resubmit -i '20190425210040' Resubmitting "20190425210040" to "dogtag-ipa-ca-renew-agent". [root@ipa2 ~]# After renew, it "expires: 2024-04-02 06:09:32 UTC": Request ID '20190425210040': status: MONITORING stuck: no key pair storage: type=FILE,location='/var/lib/ipa/ra-agent.key' certificate: type=FILE,location='/var/lib/ipa/ra-agent.pem' CA: dogtag-ipa-ca-renew-agent issuer: CN=Certificate Authority,O=EXAMPLE.COM subject: CN=IPA RA,O=EXAMPLE.COM expires: 2024-04-02 06:09:32 UTC key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment eku: id-kp-serverAuth,id-kp-clientAuth pre-save command: /usr/libexec/ipa/certmonger/renew_ra_cert_pre post-save command: /usr/libexec/ipa/certmonger/renew_ra_cert track: yes auto-renew: yes How to fix the issue reported by ipa-healthcheck? And what is this issue about? All IPA servers are at same level: CentOS Linux release 7.9.2009 (Core) ipa-*server*.x86_64 4.6.8-5.el7.centos.7 *slapi-nis*.x86_64 0.56.5-3.el7_9 *389-ds-base*.x86_64 1.3.10.2-12.el7_9 *389-ds-base*-libs.x86_64 1.3.10.2-12.el7_9 Many thanks! Kathy.

2 4

server sshfp update - ?
by lejeczek 13 Apr '22

13 Apr '22

Hi guys. What is the correct way to update/modify server's sshfp records? I assumed those are in: /etc/ssh/ssh_host_*.pub and I should use 'host-mod --updatedns ..' but then such records do not look like what IPA had/created. many thanks, L

3 7

Replica and different location behind NAT - any concerns?
by Francis Augusto Medeiros-Logeay 13 Apr '22

13 Apr '22

Hi, I have a few cloud servers and would like to have FreeIPA as an IdM for them, reusing what I have on a different location. My current FreeIPA install sits on a LAN, so all IP's are private. That will be a similar design on the cloud. So, for the replicas to communicate with each other, I thought about creating some port-forwarding rules/openings on both firewalls, but the catch is that the replica creation command would point to the public address of the destination. Any problems I might encounter with a setup like this, or is this a common practice? Best, Francis -- Francis Augusto Medeiros-Logeay Oslo, Norway

2 2

"Invalid range" authentication errors after failed replica install / upgrade
by Noah Walden 12 Apr '22

12 Apr '22

Hi all, I recently attempted to add a replica running FreeIPA v4.9.6 to our domain, which consists of two servers running FreeIPA v4.9.2. I was prompted to set a NetBIOS domain name. The installation then failed with the error “Too many ID ranges.” In order to avoid needing to delete ID ranges to accommodate the new replica, I removed the replica from FreeIPA and reinstalled it with an earlier version (v4.9.2). Since then, users have been unable to perform password-based authentication (tested with ssh & sudo). "Preauthentication failed" errors have also been appearing in /var/log/sssd/krb5_child.log on the server I've been attempting to login to via ssh. Does anyone know the root cause of this issue and/or a possible solution? Repeated message in /var/log/sssd/sssd_example.org.log of the server I’ve been attempting to ssh to: (2022-04-12 8:29:34): [be[example.org]] [sysdb_range_create] (0x0040): Invalid range, skipping. Expected that either the secondary base RID or the SID of the trusted domain is set, but not both or none of them. Our ID ranges: [root@ipaserver ~]$ ipa idrange-find --all --raw ---------------- 2 ranges matched ---------------- dn: cn=example-freeipa-service-accounts,cn=ranges,cn=etc,dc=example,dc=org cn: example-freeipa-service-accounts ipabaseid: 900000 ipaidrangesize: 99999 iparangetype: ipa-local objectclass: ipaIDrange objectclass: ipadomainidrange dn: cn=EXAMPLE.ORG_id_range,cn=ranges,cn=etc,dc=example,dc=org cn: EXAMPLE.ORG_id_range ipabaseid: 1014000 ipaidrangesize: 200000 iparangetype: ipa-local objectclass: top objectclass: ipaIDrange objectclass: ipaDomainIDRange ---------------------------- Number of entries returned 2 ---------------------------- [root@ipaserver ~]$ Last ~100 lines from /var/log/ipareplica-install.log: 2022-04-01T16:55:16Z DEBUG Configuring SID generation 2022-04-01T16:55:16Z DEBUG [1/7]: creating samba domain object 2022-04-01T16:55:16Z DEBUG step duration: SID generation __create_samba_domain_object 0.02 sec 2022-04-01T16:55:16Z DEBUG [2/7]: adding admin(group) SIDs 2022-04-01T16:55:16Z DEBUG step duration: SID generation __add_admin_sids 0.01 sec 2022-04-01T16:55:16Z DEBUG [3/7]: adding RID bases 2022-04-01T16:55:16Z CRITICAL Found more than one local domain ID range with no RID base set. 2022-04-01T16:55:16Z DEBUG Traceback (most recent call last): File "/usr/lib/python3.6/site-packages/ipaserver/install/service.py", line 635, in start_creation run_step(full_msg, method) File "/usr/lib/python3.6/site-packages/ipaserver/install/service.py", line 621, in run_step method() File "/usr/lib/python3.6/site-packages/ipaserver/install/adtrustinstance.py", line 380, in __add_rid_bases raise RuntimeError("Too many ID ranges\n") RuntimeError: Too many ID ranges 2022-04-01T16:55:16Z DEBUG [error] RuntimeError: Too many ID ranges 2022-04-01T16:55:16Z DEBUG File "/usr/lib/python3.6/site-packages/ipapython/admintool.py", line 180, in execute return_value = self.run() File "/usr/lib/python3.6/site-packages/ipapython/install/cli.py", line 342, in run return cfgr.run() File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 360, in run return self.execute() File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 386, in execute for rval in self._executor(): File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 431, in __runner exc_handler(exc_info) File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 460, in _handle_execute_exception self._handle_exception(exc_info) File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 450, in _handle_exception six.reraise(*exc_info) File "/usr/lib/python3.6/site-packages/six.py", line 693, in reraise raise value File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 421, in __runner step() File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 418, in <lambda> step = lambda: next(self.__gen) File "/usr/lib/python3.6/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from six.reraise(*exc_info) File "/usr/lib/python3.6/site-packages/six.py", line 693, in reraise raise value File "/usr/lib/python3.6/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from value = gen.send(prev_value) File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 655, in _configure next(executor) File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 431, in __runner exc_handler(exc_info) File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 460, in _handle_execute_exception self._handle_exception(exc_info) File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 518, in _handle_exception self.__parent._handle_exception(exc_info) File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 450, in _handle_exception six.reraise(*exc_info) File "/usr/lib/python3.6/site-packages/six.py", line 693, in reraise raise value File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 515, in _handle_exception super(ComponentBase, self)._handle_exception(exc_info) File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 450, in _handle_exception six.reraise(*exc_info) File "/usr/lib/python3.6/site-packages/six.py", line 693, in reraise raise value File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 421, in __runner step() File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 418, in <lambda> step = lambda: next(self.__gen) File "/usr/lib/python3.6/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from six.reraise(*exc_info) File "/usr/lib/python3.6/site-packages/six.py", line 693, in reraise raise value File "/usr/lib/python3.6/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from value = gen.send(prev_value) File "/usr/lib/python3.6/site-packages/ipapython/install/common.py", line 65, in _install for unused in self._installer(self.parent): File "/usr/lib/python3.6/site-packages/ipaserver/install/server/__init__.py", line 603, in main replica_install(self) File "/usr/lib/python3.6/site-packages/ipaserver/install/server/replicainstall.py", line 401, in decorated func(installer) File "/usr/lib/python3.6/site-packages/ipaserver/install/server/replicainstall.py", line 1371, in install adtrust.install(False, options, fstore, api) File "/usr/lib/python3.6/site-packages/ipaserver/install/adtrust.py", line 483, in install smb.create_instance() File "/usr/lib/python3.6/site-packages/ipaserver/install/adtrustinstance.py", line 895, in create_instance self.start_creation(show_service_name=False) File "/usr/lib/python3.6/site-packages/ipaserver/install/service.py", line 635, in start_creation run_step(full_msg, method) File "/usr/lib/python3.6/site-packages/ipaserver/install/service.py", line 621, in run_step method() File "/usr/lib/python3.6/site-packages/ipaserver/install/adtrustinstance.py", line 380, in __add_rid_bases raise RuntimeError("Too many ID ranges\n") 2022-04-01T16:55:16Z DEBUG The ipa-replica-install command failed, exception: RuntimeError: Too many ID ranges 2022-04-01T16:55:16Z ERROR Too many ID ranges 2022-04-01T16:55:16Z ERROR The ipa-replica-install command failed. See /var/log/ipareplica-install.log for more information

2 1

pki-tomcatd service doesn't start on multiple servers in the domain
by Yajith Dayarathna 12 Apr '22

12 Apr '22

Hello everyone, I'm trying to fix an issue with our freeipa setup where multiple servers in the domain are failing to start the pki-tomcatd service. At present we have used "pactl start --ignore-service-failure" just to get the rest of the services up and running and now trying to figure out how to fix the overall problem. Below is a summary of the current state from what I've managed to find so far: - We have 6 servers in our freeipa domain running version 4.5.4 - Three servers including the "IPA CA renewal master" is having an issue when starting up the pki-tomcatd service, with slightly different observations. - Problem started at different times, other two servers starting the problem many weeks ago, which we haven't been able to fix On the IPA CA renewal master server (this server only started having the problem few days ago following a crash > reboot ) - - All the certificates listed in "getcert list" are valid (one closest to expiry has about 2 years left) - Cerfificate in /etc/pki/pki-tomcat/alias/ and LDAP match along with the "description" field that has the correct serial - Logs contain this error : Internal Database Error encountered: Could not connect to LDAP server host <FQDN> port 636 Error netscape.ldap.LDAPException: Authentication failed (49) On the other two servers (where the problem started weeks apart following a server reboot or a ipactl restart ) - - Most of the certificates listed "getcert list" are already expired - Logs contain this error : Internal Database Error encountered: Could not connect to LDAP server host <FQDN> port 636 Error netscape.ldap.LDAPException: Authentication failed (49) - Cerfificate in /etc/pki/pki-tomcat/alias/ and LDAP does NOT match Other than that there are many other errors on the logs on all the servers related to replication : ERR - NSMMReplicationPlugin - send_updates" and messages like : Certificate in file "/var/kerberos/krb5kdc/kdc.crt" is no longer valid. To try to come up with some method to fix the servers, I've taken a clone(disconnected from the network) of a non IPA CA renewal master. Below steps I've found on various articles were all done within the clone. Some things I've tried within the clone out so far along with the errors: https://floblanc.wordpress.com/2017/09/11/troubleshooting-freeipa-pki-tomca… $ sudo grep internal /var/lib/pki/pki-tomcat/conf/password.conf | cut -d= -f2 > /tmp/pwdfile.txt $ sudo certutil -K -d /etc/pki/pki-tomcat/alias -f /tmp/pwdfile.txt -n 'subsystemCert cert-pki-ca' certutil: Checking token "NSS Certificate DB" in slot "NSS User Private Key and Certificate Services" certutil: problem listing keys: SEC_ERROR_INVALID_ARGS: security library: invalid arguments. I did notice is that the message says "NSS Certificate DB" but on the "getcert list" this certificate shows with token='NSS FIPS 140-2 Certificate DB', not sure if there is an actual problem with the password or if I'm not using the command correctly. Tried resetting the time back to a point where the expired certs are still valid as mentioned in https://access.redhat.com/solutions/3357261 and to get the pki-tomcatd to come up, tried to update the cert. in LDAP to match what is in /etc/pki/pki-tomcat/alias/ using this method https://access.redhat.com/solutions/3614001 fails for me. It updates the certificate serial in "description" field but never changes the certificate blob. ldapmodify command and the contents of the .ldif file I used are below. # ldapmodify -x -h localhost -p 389 -D “cn=directory manager” -w -f updatecert.ldif -v ldap_initializer( ldap://localhost:389 ) replace usercertificate: NOT ASCII (894 bytes) replace description: 2;32;CN=Certificate Authority,O=;CN=CA Subsystem,O=<OUR.DOMAIN> modifying entry “uid=pkidbuser,ou=people,o=ipaca” modify complete # cat updatecert.ldif dn: uid=pkidbuser,ou=people,o=ipaca changetype: modify replace: usercertificate usercertificate::MII.. – replace: description description: 2;32;CN=Certificate Authority,O=;CN=CA Subsystem,O=<OUR.DOMAIN> I've used various combinations here even a delete of "userCertificate" field to add the correct one later but none of which worked for me. I'm hoping someone can point me in the right direction. Thanks in advance, yajith

3 3

DNS record with all IPA servers
by Boris Behrens 11 Apr '22

11 Apr '22

Hi, I am currently trying to cleanup our IPA installation and saw that all our clients only got a single server configured, which doesn't sound good. (we've currently got two IPA servers). Is there some sort of record that can be used? root@host1:/etc/ipa# cat /etc/ipa/default.conf #File modified by ipa-client-install [global] basedn = dc=domain,dc=ca realm = DOMAIN.CA domain = DOMAIN.CA server = ipa1.domain.ca xmlrpc_uri = https://ipa1.domain.ca/ipa/xml enable_ra = True Cheers Boris -- Die Selbsthilfegruppe "UTF-8-Probleme" trifft sich diesmal abweichend im groÃƒ¼en Saal.

4 8

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users April 2022