About creating User home directory via autofs on nfs server.
by Alper AYKUT
After creating nfs automount user I need to run the following command
continuously on my nfs server.
mkhomedir_helper user 077
Why is it not enough to create the home directory on my nfs server when I
create the user from the web interface. Is there any way not to use this
command after creating a user ?
thankyou.
8 months
Free ipa takes a lot of time to add a user to a group from the web interface.
by Alper AYKUT
Hello, when I add a user to a group via free ipa, when I add a user to a
group, the user's addition to the group appears to be added in the web
interface. but it does not appear when I look through the server with *id
username.* It comes after a while but it takes a lot of time. What could be
the reason for this. Is there a way to speed this up? Or should I create a
user from the command prompt with ipa tools?
thankyou.
8 months
I get this warning when installing Rhel 7.9 ipa client. How can I fix it?
by Alper AYKUT
WARNING: ntpd time&date synchronization service will not be configured as
conflicting service (chronyd) is enabled
Use --force-ntpd option to disable it and force configuration of ntpd
I connect to the ntp server with chronyd on all my servers. If I install it
despite the warning, will the ipa client work with chronyd again? Or do I
need to set it with ntp?
thankyou.
8 months
Deleted user problem on my free ipa server?
by Alper AYKUT
On my free ipa server, I can still see the ldapuser02 user that I deleted
from the free ipa web interface with the following command, what could be
the reason for this?
[root@idm /]# id ldapuser02
uid=168200020(ldapuser02) gid=168200020(ldapuser02)
groups=168200020(ldapuser02)
id aykut
uid=168200021(aykut) gid=168200021(aykut) groups=168200021(aykut)
ipa user-del aykut
ipa: ERROR: aykut: user not found
ipa user-del ldapuser02
ipa: ERROR: ldapuser02: user not found
With the user del command, although there are no users, the ids of the
users appear. how can I update this? where should I check?
thankyou.
8 months
Cannot receive LDAP attributes 'memberof' and 'ipaSshPubKey' on new IPA nodes.
by Finn Fysj
I've setup two new IPA nodes which I migrated users & groups from an old IPA server.
When I do a ldapsearch -x uid=test-user on my client I'm not able to receive LDAP attributes such as memberof and ipaSshPubKey. However, this is possible if I log onto the IPA nodes and do the ldapsearch.
I can confirm that by running ldapsearch -H ldaps://old.ipa.example.com uid=test-user I can receive wanted attributes.
On new IPA node:
dn: uid=test-user,cn=users,cn=accounts,dc=example,dc=com
ipaNTSecurityIdentifier: S-1-5-21-xxxxxxxxxxxx
givenName: Test
sn: User
uid: test-user
cn: Test User
displayName: Test User
initials: TU
gecos: Test User
objectClass: top
objectClass: person
objectClass: organizationalperson
objectClass: inetorgperson
objectClass: inetuser
objectClass: posixaccount
objectClass: krbprincipalaux
objectClass: krbticketpolicyaux
objectClass: ipaobject
objectClass: ipasshuser
objectClass: ipaSshGroupOfPubKeys
objectClass: mepOriginEntry
objectClass: ipantuserattrs
loginShell: /bin/sh
homeDirectory: /home/test-user
uidNumber: 5015
gidNumber: 5015
Old IPA:
dn: uid=test-user,cn=users,cn=accounts,dc=example,dc=com
ipaNTSecurityIdentifier: S-1-5-21-xxxxxxxxxxxx
givenName: Test
sn: User
uid: test-user
cn: Test User
displayName: Test User
initials: TU
gecos: Test User
objectClass: top
objectClass: person
objectClass: organizationalperson
objectClass: inetorgperson
objectClass: inetuser
objectClass: posixaccount
objectClass: krbprincipalaux
objectClass: krbticketpolicyaux
objectClass: ipaobject
objectClass: ipasshuser
objectClass: ipaSshGroupOfPubKeys
objectClass: mepOriginEntry
objectClass: ipantuserattrs
loginShell: /bin/sh
homeDirectory: /home/test-user
uidNumber: 5015
gidNumber: 5015
memberOf: cn=admins,cn=groups,cn=accounts,dc=example,dc=com
ipaSshPubKey: ssh-rsa ..........
It's important to note, we're not using Kerberos for authentication, nor is ipa-client being used.
/etc/sssd/sssd.conf
[domain/default]
id_provider = ldap
auth_provider = ldap
chpass_provider = ldap
sudo_provider = ldap
ldap_uri = ldaps://ipa.example.com
ldap_schema = rfc2307bis
ldap_search_base = dc=example,dc=com
ldap_user_search_base = cn=users,cn=accounts,dc=example,dc=com
ldap_group_search_base = cn=groups,cn=accounts,dc=example,dc=com
ldap_sudo_search_base = ou=sudoers,dc=example,dc=com
ldap_id_use_start_tls = true
ldap_tls_cacertdir = /etc/openldap/certs
ldap_tls_reqcert = allow
cache_credentials = true
[sssd]
services = nss, pam, sudo
domains = default
[nss]
homedir_substring = /home
[pam]
[sudo]
/etc/openldap/ldap.conf:
BASE dc=example,dc=com
URI ldap://ipa.example.com
SASL_NOCANON on
TLS_CACERT /etc/ssl/certs/ca-bundle.crt
TLS_CACERTDIR /etc/openldap/cacerts
sudoers_base ou=sudoers,dc=example,dc=com
/etc/sudo-ldap.conf:
BASE dc=example,dc=com
URI ldap://ipa.example.com
SASL_NOCANON on
TLS_CACERT /etc/ssl/certs/ca-bundle.crt
TLS_CACERTDIR /etc/openldap/cacerts
sudoers_base ou=sudoers,dc=example,dc=com
8 months, 1 week
Extract user's private key from IdM
by HUANG, TONY
Hi,
I am trying to achieve user authentication against IdM using user's
certificate. User certificate is requested to the built-in CA within IdM
and signed by it.
I am able to download the user's public cert via the web UI, but how can I
download the private key so I can define it in user's .ldaprc file?
Thanks for your help!
Tony
8 months, 1 week
Strange the KSK key state.
by Arkadiusz Zalejski
Hello fellows.
I have some questions, maybe naive, but anyway I decided to write on the
list.
I found in my log following line:
WARNING: New KSK has reached the ready state; please submit the DS for
> my_domain and use ods-ksmutil key ds-seen when the DS appears in the DNS.
Currently KSK is in some weird state:
my_domain KSK ready waiting for ds-seen (active) 3072 8
> ckaid1234567890 SoftHSM 99999
Which suggest that it is ready for rollover, however there is no new
corresponding DNSKEY published. Running:
sudo -u ods SOFTHSM2_CONF=/etc/ipa/dnssec/softhsm2.conf ods-ksmutil key
> export ckaid1234567890
Only exports the old KSK.
So there are some questions:
- Is the ODS database in sane state?
- How does one exactly perform KSK rollover in FreeIPA?
- Should I simply perform *ods-ksmutil key ds-seen*
Best regards,
Arek
8 months, 2 weeks
sudo Problem on AIX
by Ronald Wimmer
We do have two users with the same name. One exists locally. The other
one comes from IPA.
The problem is that the sudo rules also show up for the local user.
I know you do not officially support AIX... but would there probably be
a solution apart from naming these two users differently?
Cheers,
Ronald
8 months, 2 weeks
Re: backup / restore
by Florence Blanc-Renaud
Hi,
On Thu, Oct 12, 2023 at 3:44 PM Frederic Ayrault <fred(a)lix.polytechnique.fr>
wrote:
> Just in case here are the logs after going in the authentification menu in
> the GUI
> ( I get on Erreur IPA 903: InternalError ) when trying to get certificats
> informations
>
> in the server roles, CA server is now configured
>
>
> Frédéric AYRAULT
> Administrateur Systèmes et Réseaux
> Laboratoire d'Informatique de l'Ecole polytechnique
> <http://www.lix.polytechnique.fr>
> fred(a)lix.polytechnique.fr
>
> Le 12/10/2023 à 15:33, Frederic Ayrault a écrit :
>
> I restored the vm, clean all logs and run the ipa-ca-install without the
> --ca-subject
> then with the --ca-subject="CN=New Certificate Authority,O=
> LIX.POLYTECHNIQUE.FR"
>
> please find enclosed the requested logs
>
> The CA installation fails because it finds an existing entry in "cn=
LIX.POLYTECHNIQUE.FR IPA
CA,cn=certificates,cn=ipa,cn=etc,dc=lix,dc=polytechnique,dc=fr". It really
looks like your topology used to have a self-signed CA at one point.
If you look at this entry, does it correspond to a CA known to you?
You can extract the certificate using
ldapsearch -D "cn=directory\ manager" -W -b "cn=LIX.POLYTECHNIQUE.FR IPA
CA,cn=certificates,cn=ipa,cn=etc,dc=lix,dc=polytechnique,dc=fr" -LLL -o
ldif-wrap=no
which should show a value for cacertificate;binary:: <content>
Then create a pem file with the format
-----BEGIN CERTIFICATE-----
<here paste the content>
-----END CERTIFICATE-----
and execute: openssl x509 -noout -text -in <pemfile>
You mentioned in a previous email that the server was originally part of a
cluster but got "extracted" out of it to run the tests. Did this set of
servers have a self-signed IPA CA? In the logs we can see reference to 3
different CA certificates for "CN=Certificate Authority, O=
LIX.POLYTECHNIQUE.FR" (self signed, issued in june, june and july 2016).
It's really a confusing situation, as it's the subject that IPA CA would
use by default but it could also be a completely different origin.
flo
Thank you very much for your help
>
> Le 12/10/2023 à 14:19, Florence Blanc-Renaud a écrit :
>
> Hi,
>
> On Thu, Oct 12, 2023 at 11:41 AM Frederic Ayrault <
> fred(a)lix.polytechnique.fr> wrote:
>
>>
>> Le 12/10/2023 à 10:59, Florence Blanc-Renaud a écrit :
>> > Hi,
>> >
>> >
>> >
>> > If I recap everything so far:
>> > - there is a single server, ipa3.lix.polytechnique.fr
>>
>> It was part of a cluster but it is removed for the tests
>>
>> > - it was installed CA-less, with http and ldap certificates issued by an
>> > external CA (C=FR, O=CNRS, CN=CNRS2-Standard), which is an intermediate
>> CA,
>> > signed by the root CA (C=FR, O=CNRS, CN=CNRS2)
>>
>> exactly
>>
>> > Your goal is to "replace our external CA to an Internal one", do you
>> mean
>> > that you want IPA to act as a certificate authority, or use a different
>> CA
>> > authority instead of C=FR, O=CNRS, CN=CNRS2-Standard ?
>>
>> As I am not able to use CNRS2-Standard, I need to use a different CA
>> authority
>>
>> Ok, so you went through the right path by using ipa-ca-install. Now we
> need to understand why the command failed.
> Can you share /var/log/ipareplica-ca-install.log? We may also need
> /var/log/pki/pki-ca-spawn.$date and /var/log/dirsrv/slap-LIX-POLYTECHNIQUE
> -FR/errors and access.
>
> flo
>
> I thought using IPA as a certificate authority was logical (and should
>> also be easier)
>> but I can be wrong :-(
>>
>>
>> > flo
>> >
>>
>> Frederic
>>
>>
>
>
8 months, 2 weeks
