February 2023 - FreeIPA-users - Fedora mailing-lists

log permission issues with "ipa-replica-manage re-initialize" in almalinux 8
by Grant Janssen 13 Feb '23

13 Feb '23

users were reporting password change issues. ipa_check_consistency and cipa showed synchronization issues. grant@ef-idm04:~[20230211-7:01][#211]$ ipa-replica-manage re-initialize --from ef-idm01.production.efilm.com<http://ef-idm01.production.efilm.com> ipa: ERROR: Cannot open log file '/var/log/ipa/cli.log': [Errno 13] Permission denied: '/var/log/ipa/cli.log' Update in progress, 6 seconds elapsed Update succeeded grant@ef-idm04:~[20230211-7:02][#212]$ I am in the middle of a migration from 7 —> 8 (3 of 5 servers are still CentOS 7) The almalinux 8 systems showed an issue with log permissions when I executed the sync. The CentOS 7 systems did not output any error. ipa_check_consistency and cipa show these are all “in sync” now. what can I do to resolve these log issues, so next time I won’t see these again? thanx - grant

2 1

Show attributes of objectclass
by Francis Augusto Medeiros-Logeay 11 Feb '23

11 Feb '23

Hi, A very basic question, but can't find a proper answer: How do I show all attributes of an objectclass? I tried a few commands that are supposed to work on openldap, but can't have the same results in FreeIPA. Best, Francis -- Francis Augusto Medeiros-Logeay Oslo, Norway

1 1

Overriding sudo noexec Defaults
by Mathieu Baudier 11 Feb '23

11 Feb '23

Hello, with IPA v4.10.0 on RHEL 9.1, the IPA servers are configured with the security profile ANSSI-BP-028 (high) which mandates the sudo Defaults 'noexec' (commands cannot execute subprocesses). Along with other restrictive Defaults, it has been set automatically by OpenSCAP during OS installation, in the /etc/sudoers file. But there are quite a few situations where we need EXEC rights (typically some IPA utilities, such as ipa-healthcheck). During the initial configuration of the systems we had a local 'install' user, in the wheel group, and to which we gave blanket sudo EXEC rights. But now that IPA is up and running, I am struggling to configure working around the 'noexec' Defaults for real operators managed by IPA. I have tried three approaches, which all failed: 1) In an IPA sudo rule, configure Options to override the 'noexec' Defaults. I tried with both !noexec -=noexec but it had no effect and I did not see it listed in sudo -l, and noexec was still there. 2) In an IPA sudo command definition, add EXEC. That is, I created an IPA sudo command with the value: EXEC: ALL but this command appeared with the : escaped by \: (ALL : ALL) EXEC\: ALL 3) In an IPA sudo rule, use the 'ignore_local_sudoers' Option. The sudoers man page says "If set via LDAP, parsing of /etc/sudoers will be skipped. This is intended for Enterprises [...]". This could be an appropriate approach to reconstitute these Security Profiles constraints centrally in IPA instead of locally, but the 'ignore_local_sudoers' Option does not seem to be picked up: sudo -l keep showing the Defaults configured locally (including 'noexec') Am I doing something wrong? What would be the best approach to pursue? More generally, I noticed that changes in the IPA sudo rules are not effective immediately, even after a logout/login. Is there some caching? Or should I restart a service? If I reboot the system, the changes are taken, but this is a bit heavy. Thanks in advance! Mathieu

1 0

Issue with Login PIN Prompting with SSSD and krb5_child.
by r0 nam1 10 Feb '23

10 Feb '23

Apologies for my previous thread mess, I've learned to keep it neat. In following my previous thread (https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost…) I've discovered what I believe to be the issue when trying to login with Smartcards. When running kinit already logged in it can prompt for a pin and successfully use that data to verify the certificate. Then when trying to login from tty1 with pam_sss.so require_cert_auth present, the krb5 child attempts to kinit: ''' DEBUG(SSSDBG_TRACE_FUNC, "Attempting kinit for realm [%s]\n",realm_name); kerr = kr->krb5_get_init_creds_password(kr->ctx, kr->creds, kr->princ, password_or_responder(password), sss_krb5_prompter, kr, 0, NULL, kr->options); if (kr->pd->cmd == SSS_PAM_PREAUTH && kerr != KRB5KDC_ERR_KEY_EXP) { /* Any errors except KRB5KDC_ERR_KEY_EXP are ignored during pre-auth, * only data is collected to be send back to the client. * KRB5KDC_ERR_KEY_EXP must be handled separately to figure out the * possible authentication methods to update the password. */ DEBUG(SSSDBG_TRACE_FUNC, "krb5_get_init_creds_password returned [%d] during pre-auth.\n", kerr); return 0; } else { if (kerr != 0) { KRB5_CHILD_DEBUG(SSSDBG_CRIT_FAILURE, kerr); ''' https://github.com/SSSD/sssd/blob/master/src/providers/krb5/krb5_child.c Looking at the source code for the process I've come to the conslusion that for SOME REASON, the kinit pin prompt fails after entering my Username, Password, then prompting for a smartcard. It seems like p11_child sees the smartcard inserted, lets the krb5_child run, and somehow fails when prompting for a pin. Even though the child 'fails' the login is never denied with any smartcard, one just needs to be present, the side effect of this is that a Kerberos ticket is never granted, but the Login does succeed. Unfortunately that's everything I've been able to find, anyone able to help with the info I've provided?

2 7

Help-Query IPA-Client Re-Enrollment
by Polavarapu Manideep Sai 10 Feb '23

10 Feb '23

HI Team, I have a query I have two replica servers which are replicating with master server Replica1[Old]-hostname1.com --- 10 client nodes integrated at Replica1 Replica2[New]-hostname2.com --- No client nodes integrated at Replica2 Now I want to remove Replica1, which is having issues Now the query is can I re-enrol all 10 clients to Replica2[hostname2.com], without going for uninstallation of ipa-client Regards Sai ________________________________ DISCLAIMER: The information in this message is confidential and may be legally privileged. It is intended solely for the addressee. Access to this message by anyone else is unauthorized. If you are not the intended recipient, any disclosure, copying, or distribution of the message, or any action or omission taken by you in reliance on it, is prohibited and may be unlawful. Please immediately contact the sender if you have received this message in error. Further, this e-mail may contain viruses and all reasonable precaution to minimize the risk arising there from is taken by OnMobile. OnMobile is not liable for any damage sustained by you as a result of any virus in this e-mail. All applicable virus checks should be carried out by you before opening this e-mail or any attachment thereto. Thank you - OnMobile Global Limited.

1 0

Starting `ipa-server-install` fails while trying to run inside created Docker container
by Georgiy Odisharia 10 Feb '23

10 Feb '23

Hi there, I am trying to install FreeIPA via Docker container. I successfully built image with Rocky Linux 9 as base image. Then I created container with following options. docker create \ -it \ --name ipa.odisharia.ru \ -v "$(realpath data)":/data:Z \ -v /sys/fs/cgroup:/sys/fs/cgroup:ro \ -e IPA_SERVER_IP=<MY_PUBLIC_IP> \ --read-only \ --tmpfs /run \ --tmpfs /tmp \ -h <HOSTNAME> \ --dns 127.0.0.1 \ freeipa-server \ -p 53:53 \ -p 8080:80 \ -p 8443:443 \ -p 389:389 \ -p 636:636 \ -p 88:88 \ -p 464:464 \ -p 88:88/udp \ -p 464:464/udp \ -p 123:123/udp \ ipa-server-install Then I tried to run it but get following error. ``` ❯ docker start -ai ipa.odisharia.ru systemd 250-12.el9_1.1 running in system mode (+PAM +AUDIT +SELINUX -APPARMOR +IMA +SMACK +SECCOMP +GCRYPT +GNUTLS +OPENSSL +ACL +BLKID +CURL +ELFUTILS -FIDO2 +IDN2 -IDN -IPTC +KMOD +LIBCRYPTSETUP +LIBFDISK +PCRE2 -PWQUALITY +P11KIT -QRENCODE +BZIP2 +LZ4 +XZ +ZLIB +ZSTD -BPF_FRAMEWORK +XKBCOMMON +UTMP +SYSVINIT default-hierarchy=unified) Detected virtualization docker. Detected architecture x86-64. Queued start job for default target Minimal target for containerized FreeIPA server. -.slice: Failed to get cgroup ID on cgroup /sys/fs/cgroup, ignoring: Operation not permitted system.slice: Failed to get cgroup ID on cgroup /sys/fs/cgroup/system.slice, ignoring: Operation not permitted systemd-journald.service: Failed to get cgroup ID on cgroup /sys/fs/cgroup/system.slice/systemd-journald.service, ignoring: Operation not permitted system.slice: Failed to get cgroup ID on cgroup /sys/fs/cgroup/system.slice, ignoring: Operation not permitted -.slice: Failed to get cgroup ID on cgroup /sys/fs/cgroup, ignoring: Operation not permitted Fri Feb 10 14:12:04 UTC 2023 /usr/sbin/ipa-server-configure-first Usage: ipa-server-install [options] ipa-server-install: error: Too many arguments provided File "/usr/lib/python3.9/site-packages/ipapython/admintool.py", line 177, in execute self.validate_options() File "/usr/lib/python3.9/site-packages/ipapython/install/cli.py", line 282, in validate_options self.option_parser.error("Too many arguments provided") File "/usr/lib64/python3.9/optparse.py", line 1569, in error self.exit(2, "%s: error: %s\n" % (self.get_prog_name(), msg)) File "/usr/lib64/python3.9/optparse.py", line 1559, in exit sys.exit(status) The ipa-server-install command failed, exception: SystemExit: 2 The ipa-server-install command failed. Sending SIGTERM to remaining processes... Sending SIGKILL to remaining processes... All filesystems, swaps, loop devices, MD devices and DM devices detached. Exiting container. ``` How should I create and run container with FreeIPA?

2 2

Force LDAPS and 636 port
by Alex Ivanov 09 Feb '23

09 Feb '23

Greetings, I'm struggling to find a comprehensive guide on how to block LDAP and 389 port on FreeIPA and force usage of LDAPS and 636 port for all clients and connections. I would really appreciate a link or a hint.

5 6

Upgrade outdated FreeIPA sanity check
by Kevin Vasko 08 Feb '23

08 Feb '23

We have a set of 3x freeIPA servers that have outdated (everything) in a development/test environment that need to be updated. It seems that 4.6.8-5.el7.centos.12 is the latest version available on CentOS 7? We are at on the 3 servers: 4.5.4-10.el7.centos.4.4 4.6.4-10-el7.centos.6 4.6.4-10-el7.centos.6 For the two 4.6.4 installs, that seems relatively simple upgrade as we would only be going to a different dot release and a simple "yum update ipa-server" should handle this? Is there any advisement for/against doing a full "yum update" on the entire system to get everything updated? For the 4.5.4 system, is there much of a concern going straight from 4.5.4 to 4.6.8 straight? I assume the concern would be jumping major versions and going from say 4.5 to 4.9? My current plan is to stop at CentOS 7.9 and latest FreeIPA 4.6 release on CentOS 7.9. But for my own knowledge if I was going to 4.10 wouldn't the recommendation path to upgrade to 4.10, to install CentOS Stream 9 on a new server, enroll it, make 4.10 the master and then remove the CentOS 7 instances? -Kevin

3 5

ipa-replica-install fails when I use custom certificates
by Peter Tselios 08 Feb '23

08 Feb '23

I have installed the ipa server by using the following command: --------- ipa-server-install --realm "EXAMPLE.COM" -p 'password' -a 'password' --hostname="server.example.com" -n example.com --ip-address="10.1.4.2" --dirsrv-cert-file=/etc/pki/tls/private/example.com.pem --dirsrv-cert-file=/etc/pki/tls/certs/example.com.crt --dirsrv-pin='' --http-cert-file=/etc/pki/tls/certs/example.com.crt --http-cert-file=/etc/pki/tls/private/example.com.pem --http-pin='' --ca-cert-file=/etc/pki/ca-trust/source/anchors/myca.pem --ca-cert-file=/etc/pki/ca-trust/source/anchors/mysubca.pem --mkhomedir -N --no-host-dns --unattended --------- Which works perfectly fine. However, I cannot make it work with ipa-replica-install since there is no option for --ca-cert-file. So, how can I install a replica with custom certificates?

6 12

Questions about /root/cacert.p12 file
by Kathy Zhu 08 Feb '23

08 Feb '23

Hi Team, I like to understand more about the /root/cacert.p12 file in a self signed CA environment. Here are the questions: 1, could this file be located somewhere other than under /root? 2, what operations use this file instead of nssdb? In other words, if the /root/cacert.p12 file were not in place, what operations would fail? 3, any good readings to learn more? Thank you in advance! Kathy.

2 2

2025

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users February 2023