March 2023 - FreeIPA-users - Fedora mailing-lists

FreeIPA-Kubernetes Setup
by Ronald Wimmer 20 Mar '23

20 Mar '23

Hi, are there any plans (or maybe ongoing work already) to let FreeIPA run in a K8s environment? Cheers, Ronald

6 8

backup & restore - 4.9.11 -> 4.10.1
by lejeczek 17 Mar '23

17 Mar '23

Hi guys. I'm trying to migrate IPA from Centos 8 over to Centos 9 but I fail. If the path I try is supported & should work then, first, 'restore' failed with: ... Restoring umask to 18 CalledProcessError(Command ['/usr/sbin/ipactl', 'start'] returned non-zero exit status 1: 'IPA version error: data needs to be upgraded (expected version \'4.10.1-6.el9\', current version \'4.9.8-7.module_el8.6.0+1103+a004f6a8\')\nAutomatically running upgrade, for details see /var/log/ipaupgrade.log\nBe patient, this may take a few minutes.\nAutomatic upgrade failed: Error caught updating nsDS5ReplicatedAttributeList: Server is unwilling to perform: Entry and attributes are managed by topology plugin.No direct modifications allowed.\nError caught updating nsDS5ReplicatedAttributeListTotal: Server is unwilling to perform: Entry and attributes are managed by topology plugin.No direct modifications allowed.\nUpdate complete\nUpgrading the configuration of the IPA services\n[Verifying that root certificate is published]\n[Migrate CRL publish directory]\nPublish directory already set to new location\nForcing update of template /usr/share/ipa/ipa-pki-proxy.conf.template\nUpgraded /etc/httpd/conf.d/ipa-pki-proxy.conf to version 17\n[Ensuring ephemeralRequest is enabled in KRA]\nephemeralRequest is already enabled\n[Verifying that KDC configuration is using ipa-kdb backend]\n[Fix DS schema file syntax]\n[Removing RA cert from DS NSS database]\n[Enable sidgen and extdom plugins by default]\n[Updating HTTPD service IPA configuration]\n[Updating HTTPD service IPA WSGI configuration]\nNothing to do for configure_httpd_wsgi_conf\n[Migrating from mod_nss to mod_ssl]\nAlready migrated to mod_ssl\n[Moving HTTPD service keytab to gssproxy]\n[Removing self-signed CA]\n[Removing Dogtag 9 CA]\n[Set OpenSSL engine for BIND]\n[Checking for deprecated KDC configuration files]\n[Checking for deprecated backups of Samba configuration files]\ndnssec-validation yes\n[Add missing CA DNS records]\nunable to resolve host name c8kubermaster1.private.lot. to IP address, ipa-ca DNS record will be incomplete\nIPA server upgrade failed: Inspect /var/log/ipaupgrade.log and run command ipa-server-upgrade manually.\nUnexpected error - see /var/log/ipaupgrade.log for details:\nCalledProcessError: CalledProcessError(Command [\'/bin/systemctl\', \'start\', \'named.service\'] returned non-zero exit status 1: \'Job for named.service failed because the control process exited with error code.\\nSee "systemctl status named.service" and "journalctl -xeu named.service" for details.\\n\')\nThe ipa-server-upgrade command failed. See /var/log/ipaupgrade.log for more information\n\nSee the upgrade log for more details and/or run /usr/sbin/ipa-server-upgrade again\nAborting ipactl\n') so I try: -> $ ipa-server-upgrade Upgrading IPA:. Estimated time: 1 minute 30 seconds [1/9]: saving configuration [2/9]: disabling listeners [3/9]: enabling DS global lock [4/9]: disabling Schema Compat [5/9]: starting directory server [error] CalledProcessError: CalledProcessError(Command ['/bin/systemctl', 'start', 'dirsrv(a)PRIVATE-LOT.service'] returned non-zero exit status 1: 'Job for dirsrv(a)PRIVATE-LOT.service failed because a fatal signal was delivered causing the control process to dump core.\nSee "systemctl status dirsrv(a)PRIVATE-LOT.service" and "journalctl -xeu dirsrv(a)PRIVATE-LOT.service" for details.\n') [cleanup]: stopping directory server [cleanup]: restoring configuration IPA server upgrade failed: Inspect /var/log/ipaupgrade.log and run command ipa-server-upgrade manually. Unexpected error - see /var/log/ipaupgrade.log for details: CalledProcessError: CalledProcessError(Command ['/bin/systemctl', 'start', 'dirsrv(a)PRIVATE-LOT.service'] returned non-zero exit status 1: 'Job for dirsrv(a)PRIVATE-LOT.service failed because a fatal signal was delivered causing the control process to dump core.\nSee "systemctl status dirsrv(a)PRIVATE-LOT.service" and "journalctl -xeu dirsrv(a)PRIVATE-LOT.service" for details.\n') The ipa-server-upgrade command failed. See /var/log/ipaupgrade.log for more information -> $ journalctl -lf -u dirsrv(a)PRIVATE-LOT.service Mar 17 16:19:03 c8kubermaster2.private.lot ns-slapd[14967]: [17/Mar/2023:16:19:03.748676397 +0000] - ERR - cos-plugin - cos_dn_defs_cb - Skipping CoS Definition cn=Password Policy,cn=accounts,dc=private,dc=lot--no CoS Templates found, which should be added before the CoS Definition. Mar 17 16:19:03 c8kubermaster2.private.lot ns-slapd[14967]: [17/Mar/2023:16:19:03.764528091 +0000] - ERR - libdb - BDB2506 file userRoot/replication_changelog.db has LSN 12/7510992, past end of log at 12/2536210 Mar 17 16:19:03 c8kubermaster2.private.lot ns-slapTrd[14967]: [17/Mar/2023:16:19:03.768119982 +0000] - ERR - libdb - BDB2507 Commonly caused by moving a database from one database environment Mar 17 16:19:03 c8kubermaster2.private.lot ns-slapd[14967]: [17/Mar/2023:16:19:03.771501904 +0000] - ERR - libdb - BDB2508 to another without clearing the database LSNs, or by removing all of Mar 17 16:19:03 c8kubermaster2.private.lot ns-slapd[14967]: [17/Mar/2023:16:19:03.774956063 +0000] - ERR - libdb - BDB2509 the log files from a database environment Mar 17 16:19:03 c8kubermaster2.private.lot ns-slapd[14967]: ns-slapd: ldap/servers/plugins/replication/cl5_api.c:1268: cldb_SetReplicaDB: Assertion `cldb' failed. Mar 17 16:19:03 c8kubermaster2.private.lot systemd-coredump[14993]: [🡕] Process 14967 (ns-slapd) of user 389 dumped core. Mar 17 16:19:03 c8kubermaster2.private.lot systemd[1]: dirsrv(a)PRIVATE-LOT.service: Main process exited, code=dumped, status=6/ABRT Mar 17 16:19:03 c8kubermaster2.private.lot systemd[1]: dirsrv(a)PRIVATE-LOT.service: Failed with result 'core-dump'. Mar 17 16:19:03 c8kubermaster2.private.lot systemd[1]: Failed to start 389 Directory Server PRIVATE-LOT.. If such simple process should work then please share your thoughts on what is failing here which can be fixed. Alternatively, trying the most obvious method - adding new master to existing domain - fails if the new member/master I want to make CA, without CA new master installs/adds. fails: ... [3/30]: creating ACIs for admin [4/30]: creating installation admin user Unable to log in as uid=admin-c9kmaster1.private.lot,ou=people,o=ipaca on ldap://c8kubermaster2.private.lot:389 [hint] tune with replication_wait_timeout [error] NotFound: uid=admin-c9kmaster1.private.lot,ou=people,o=ipaca did not replicate to ldap://c8kubermaster2.private.lot:389 and from log file: ... 2023-03-17T17:32:51Z ERROR Unable to log in as uid=admin-c9kmaster1.private.lot,ou=people,o=ipaca on ldap://c8kubermaster2.private.lot:389 2023-03-17T17:32:51Z INFO [hint] tune with replication_wait_timeout 2023-03-17T17:32:51Z DEBUG Traceback (most recent call last): File "/usr/lib/python3.9/site-packages/ipaserver/install/service.py", line 686, in start_creation run_step(full_msg, method) File "/usr/lib/python3.9/site-packages/ipaserver/install/service.py", line 672, in run_step method() File "/usr/lib/python3.9/site-packages/ipaserver/install/dogtaginstance.py", line 789, in setup_admin raise errors.NotFound( ipalib.errors.NotFound: uid=admin-c9kmaster1.private.lot,ou=people,o=ipaca did not replicate to ldap://c8kubermaster2.private.lot:389 2023-03-17T17:32:51Z DEBUG [error] NotFound: uid=admin-c9kmaster1.private.lot,ou=people,o=ipaca did not replicate to ldap://c8kubermaster2.private.lot:389 2023-03-17T17:32:51Z DEBUG Removing /root/.dogtag/pki-tomcat/ca 2023-03-17T17:32:51Z DEBUG File "/usr/lib/python3.9/site-packages/ipapython/admintool.py", line 180, in execute ...

3 2

Win replication
by Алексей Иванов 17 Mar '23

17 Mar '23

Greetings, I'm using ipa-replica-manage connect --winsync to create users from windows to IPA. But it copies all the users from OU. Can I add an LDAP filter somewhere so that I will replicate only a subset of users? Regards, Alex Ivanov.

2 1

Kerberized NFS and IPA
by Ronald Wimmer 16 Mar '23

16 Mar '23

We enrolled a RHEL9 server (ipa client) in order to replace an old one (Centos 7.9). Unfortunately, windows users could not access their kerberized NFS home share. Today I rechecked the server and saw that the "trusted for delegation" flag was not set. (it was set on the old Centos server) I enabled it and now it seems to work. Was this probably just a coincidence or can it be explained somehow? The documentation says: > OK_AS_DELEGATE > Use this flag to specify Kerberos tickets trusted for delegation. > Active directory (AD) clients check the OK_AS_DELEGATE flag on the Kerberos ticket to > determine whether the user credentials can be forwarded or delegated to the specific server. AD > forwards the ticket-granting ticket (TGT) only to services or hosts with OK_AS_DELEGATE set. > With this flag, system security services daemon (SSSD) can add the AD user TGT to the default > Kerberos credentials cache on the IdM client machine. Is it needed that the TGT ticket can be forwarded to the server in order to let the server fetch the NFS-Ticket needed? Cheers, Ronald

2 9

Problem with added host to freeipa with AD Trust setup
by cdth＠gmx.net 15 Mar '23

15 Mar '23

Hi! I am experiencing strange behaviour with a host which is added to an IPA instance. The IPA instance is working as it should and I can't see any problems there. There is a Trust established to an AD domain. The AD domain is in the form of example.com whereas the IPA domain is ipa.example.com domain. However the domain names of the hosts are host-ipa.example.com and client-ipa.example.com (and not host-ipa.ipa.example.com) As already said this works fine for the IPA server itself but for the client I am experiencing weird behaviour. I can add the client to the IPA domain by joining via ipaclient-install script and log on is working during the first minutes, but after some time a login via ssh public key is not possible anymore. When I look into the log files I can see that a connection to the directory server fails with the error message "Extended failure message: [SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Server krbtgt/EXAMPLE.COM(a)IPA.EXAMPLE.COM not found in Kerberos database)]" which seems to be the root cause for my problem as it should be krbtgt/IPA.EXAMPLE.COM(a)IPA.EXAMPLE.COM to my knowledge. I already tried a hint from this thread https://lists.fedoraproject.org/archives/list/freeipa-users@lists.fedorahos… which tells to check the domain_realm mapping in /etc/krb5.conf (due to includes the [domain_realm] resides in /var/lib/sss/pubconf/krb5.include.d/domain_realm_ipa_example_com and indeed the mapping looks wrong to me: [domain_realm] .example.com = EXAMPLE.COM example.com = EXAMPLE.COM [capaths] EXAMPLE.COM = { IPA.EXAMPLE.COM = EXAMPLE.COM } IPA.EXAMPLE.COM = { EXAMPLE.COM = EXAMPLE.COM } I believe this should look like: [domain_realm] .example.com = EXAMPLE.COM example.com = EXAMPLE.COM [capaths] EXAMPLE.COM = { IPA.EXAMPLE.COM = IPA.EXAMPLE.COM } IPA.EXAMPLE.COM = { EXAMPLE.COM = EXAMPLE.COM } But changing the file does not help as after restarting sssd the file is overwritten again with the former version. Any hints are greatly appreciated! (the domain names are redacted to protect the innocent ;-) ) Best regards, Thomas

2 2

Cannot authenticate using Kerberos after upgrade to 4.10.1
by Gianluca Amato 15 Mar '23

15 Mar '23

Hi all, I have a FreeIPA installation with three servers on CentOS Stream 9. Recently, I upgraded one server from FreeIPA 4.10.0 to 4.10.1. After the upgrade, kinit <user> fails in the new server for all users, with the only exception of the admin user. The following happens: 1) In the command shell, I type "kinit studente" (or any other user but admin) 2) I enter the correct password 3) The result is "kinit: Generic error (see e-text) while getting initial credentials" Kerberos authentication still works correctly on the servers which are still on 4.10.0. LDAP authentication works correctly everywhere. If I check the /var/log/krb5kdc.log, I notice the following: Mar 14 13:35:13 ipa1.labeconomia.unich.it krb5kdc2868: AS_REQ (4 etypes {aes256-cts-hmac-sha1-96(18), aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19), aes128-cts-hmac-sha1-96(17)}) 10.1.68.199: HANDLE_AUTHDATA: studente(a)LABECONOMIA.UNICH.IT for krbtgt/LABECONOMIA.UNICH.IT(a)LABECONOMIA.UNICH.IT, No such file or directory So the problem seems this "No such file or directory" during the HANDLE_AUTHDATA phase, but I have no idea what file it is looking for. This error only appears if I type the correct password. In case of wrong password, I get a standard "Preauthentication failed" error. Note also that "admin" is the only user with a SID (attribute "ipaNTSecurityIdentifier" in LDAP), which is required for generating Kerberos tickets with PACs. Is it possible the new FreeIPA insists in generating PACs? In case, is it possible to disable this behavior ? Thanks for any help, --gianluca

2 4

Help with importing Asterisk LDAP Schema into FreeIPA Server.
by r0 nam1 14 Mar '23

14 Mar '23

Hi, I'm currently attempting to run my asterisk instance and testing instance in realtime mode with the database being my FreeIPA instance. To do this I've looked at every thread and determined that the OpenLDAP structure Asterisk Provides and the 389 structure FreeIPA uses are different. I am not sure how different, so I have no clue how to translate it. I also have two ways of importing it, (I think), either with ldapadd, or by moving the ldif file to a certain directory and restarting the service, issue with that second approach is that I'm not sure what will happen if the ldif file isn't valid. I'll post what the asterisk source provides: https://wiki.asterisk.org/wiki/display/AST/LDAP+Realtime+Driver The ldif and schema file are both on that page, I'm not looking for somebody to translate if it's to much work, but I simply want to know how to. Seems like a valuable skill to have.

2 1

Publicly resolvable DNS
by Francis Augusto Medeiros-Logeay 12 Mar '23

12 Mar '23

Hi, I am considering using my current FreeIPA set-up - which has only .local domains, to be authoritative for a domain name. Therefore, I might open the port 53 to allow external queries. Is it a reasonable ok thing to do? And is there a way to use ACL's to block queries that are not for that publicly-resoveable domain name? Best, Francis -- Francis Augusto Medeiros-Logeay Oslo, Norway

2 2

Free IPA sub CA and 8192 keys
by Алексей Иванов 07 Mar '23

07 Mar '23

Greetings, During installation process I used following pki_override.cfg file [DEFAULT] pki_admin_key_algorithm=SHA512withRSA pki_admin_key_size=8192 pki_audit_signing_key_algorithm=SHA512withRSA pki_audit_signing_key_size=8192 pki_audit_signing_key_type=rsa pki_audit_signing_signing_algorithm=SHA512withRSA pki_ssl_server_key_algorithm=SHA512withRSA pki_ssl_server_key_size=8192 pki_sslserver_signing_algorithm=SHA512withRSA pki_subsystem_key_algorithm=SHA512withRSA pki_subsystem_signing_algorithm=SHA512withRSA pki_subsystem_key_size=8192 [CA] pki_ca_signing_key_size=8192 pki_ca_signing_key_algorithm=SHA512withRSA pki_ca_signing_signing_algorithm=SHA512withRSA pki_ocsp_signing_key_algorithm=SHA512withRSA pki_ocsp_signing_key_size=8192 pki_ocsp_signing_signing_algorithm=SHA512withRSA [KRA] pki_storage_key_algorithm=SHA512withRSA pki_storage_key_size=8192 pki_storage_signing_algorithm=SHA512withRSA pki_transport_key_algorithm=SHA512withRSA pki_transport_key_size=8192 pki_transport_signing_algorithm=SHA512withRSA [OCSP] pki_ocsp_signing_key_algorithm=SHA512withRSA pki_ocsp_signing_key_size=8192 pki_ocsp_signing_signing_algorithm=SHA512hRSA This lead to the following error when I'm trying to add subCA Request failed with status 400: Non-2xx response from CA REST API: 400. Failed to issue CA certificate. Final status: rejected. Additional info: Key Parameters 1024,2048,3072,4096,nistp256,nistp384,nistp521 Not Matched By default we have three certificate profiles caIPAserviceCert, KDCs_PKINIT_Certs, IECUserRoles but changing them does not fix this error. Could you please tell me where I can find a subCA certificate template? Regards, Alex Ivanov.

3 4

Different results with search in replicas
by danila kuzovlev 05 Mar '23

05 Mar '23

Hi, I'm trynig to create centrlized authorization for my services with freeipa cluster in differnet locations. For some reasons I use base search in cn=compat tree for mapping users, but in different replcias result of same ldapsearch quiestions is different: ldapsearch -h X.X.X.X -p 389 -b "cn=some_group,cn=groups,cn=compat,dc=example,dc=com" -s base -D "uid=binddn,cn=users,cn=accounts,dc=example,dc=com" -W Enter LDAP Password: # extended LDIF # # LDAPv3 # base <cn=some_group,cn=groups,cn=compat,dc=example,dc=com> with scope baseObject # filter: (objectclass=*) # requesting: ALL # # search result search: 2 result: 0 Success ldapsearch -h Y.Y.Y.Y -p 389 -b "cn=some_group,cn=groups,cn=compat,dc=example,dc=com" -s base -D "uid=binddn,cn=users,cn=accounts,dc=example,dc=com" -W # extended LDIF # # LDAPv3 # base <cn=some_group,cn=groups,cn=compat,dc=example,dc=com> with scope baseObject # filter: (objectclass=*) # requesting: ALL # # some-group, groups, compat, example.com dn: some_group,cn=groups,cn=compat,dc=example,dc=com objectClass: posixGroup objectClass: ipaOverrideTarget objectClass: ipaexternalgroup objectClass: top gidNumber: 12345678 memberUid: user2 memberUid: user1 ipaAnchorUUID:: OklQQToyMS1zY2hvb2wucnU6YjI2ZTNkNjQtYWI5ZC0xMWVkLWE5NDUtMDA1MD U2YWIxMDNl cn: some_group But, if I make search with "Subtree" cope to the first one, I can see entries in answer: ldapsearch -h X.X.X.X -p 389 -b "cn=some_group,cn=groups,cn=compat,dc=example,dc=com" -s sub -D "uid=binddn,cn=users,cn=accounts,dc=example,dc=com" -W # extended LDIF # # LDAPv3 # base <cn=some_group,cn=groups,cn=compat,dc=example,dc=com> with scope subtree # filter: (objectclass=*) # requesting: ALL # # some-group, groups, compat, example.com dn: some_group,cn=groups,cn=compat,dc=example,dc=com objectClass: posixGroup objectClass: ipaOverrideTarget objectClass: ipaexternalgroup objectClass: top gidNumber: 12345678 memberUid: user2 memberUid: user1 ipaAnchorUUID:: OklQQToyMS1zY2hvb2wucnU6YjI2ZTNkNjQtYWI5ZC0xMWVkLWE5NDUtMDA1MD U2YWIxMDNl cn: some_group I have 4 ipa-servers with vesrions 4.9.6 and 4.9.10. This result I can see with a only one replica, with 4.9.6 vesrion. I try delete topology segment, reinstall ipa-replica - but it doesnt work. Thanks.

3 4

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users March 2023