FreeIPA-users March 2023

freeipa-users@lists.fedorahosted.org

31 participants
53 discussions

v4.6.8->v4.10.1 Replica Install | CA Configuration Section | Admin Login Failing
by Paulson McIntyre 02 Mar '23

02 Mar '23

Hey, I'm trying to create a replica from an older FreeIPA server to a more modern one. The eventual plan being to remove the very old one and use the new one as the primary. Then new replicas would be created off it. Running into a problem though during the CA Configuration phase when it tries to create the admin user, or rather verify it. This thread <https://lists.fedoraproject.org/archives/list/freeipa-users@lists.fedorahos…> might be related as well as RedHat Bugzilla – Bug 2151071 <https://bugzilla.redhat.com/show_bug.cgi?id=2151071>. Details on the issue, environment, and troubleshooting performed so far are posted here <https://www.gpmidi.net/node/162> as well as copy/pasted below. -Paulson The ProblemOverview Can't create a new replica of an older FreeIPA server (v4.6.8 on c7) to a new FreeIPA server (v4.9 on f36 and v4.10 on f37). The error is during the `Configuring certificate server (pki-tomcatd)` phase. Example ipa-replica-install error # kinit <MY PERSONAL ADMIN USERNAME> # ipa-replica-install --setup-adtrust --setup-ca --setup-dns --no-forwarders --skip-conncheck --add-sids ... Configuring certificate server (pki-tomcatd). Estimated time: 3 minutes [1/30]: creating certificate server db [2/30]: setting up initial replication Starting replication, please wait until this has completed. Update in progress, 11 seconds elapsed Update succeeded [3/30]: creating ACIs for admin [4/30]: creating installation admin user Unable to log in as uid=admin-ipa0.i.gpmidi.net,ou=people,o=ipaca on ldap://ipam.i.gpmidi.net:389 [hint] tune with replication_wait_timeout [error] NotFound: uid=admin-ipa0.i.gpmidi.net,ou=people,o=ipaca did not replicate to ldap://ipam.i.gpmidi.net:389 Your system may be partly configured. Run /usr/sbin/ipa-server-install --uninstall to clean up. uid=admin-ipa0.i.gpmidi.net,ou=people,o=ipaca did not replicate to ldap://ipam.i.gpmidi.net:389 The ipa-replica-install command failed. See /var/log/ipareplica-install.log for more information From Installer Log 2023-03-01T18:01:02Z DEBUG [4/30]: creating installation admin user 2023-03-01T18:01:02Z DEBUG Waiting 30 seconds for uid=admin-ipa0.i.gpmidi.net,ou=people,o=ipaca to appear on ldap://ipam.i.gpmidi.net:389 2023-03-01T18:01:32Z ERROR Unable to log in as uid=admin-ipa0.i.gpmidi.net,ou=people,o=ipaca on ldap://ipam.i.gpmidi.net:389 2023-03-01T18:01:32Z INFO [hint] tune with replication_wait_timeout 2023-03-01T18:01:32Z DEBUG Traceback (most recent call last): File "/usr/lib/python3.11/site-packages/ipaserver/install/service.py", line 686, in start_creation run_step(full_msg, method) File "/usr/lib/python3.11/site-packages/ipaserver/install/service.py", line 672, in run_step method() File "/usr/lib/python3.11/site-packages/ipaserver/install/dogtaginstance.py", line 789, in setup_admin raise errors.NotFound( ipalib.errors.NotFound: uid=admin-ipa0.i.gpmidi.net,ou=people,o=ipaca did not replicate to ldap://ipam.i.gpmidi.net:389 2023-03-01T18:01:32Z DEBUG [error] NotFound: uid=admin-ipa0.i.gpmidi.net,ou=people,o=ipaca did not replicate to ldap://ipam.i.gpmidi.net:389 2023-03-01T18:01:32Z DEBUG The ipa-replica-install command failed, exception: NotFound: uid=admin-ipa0.i.gpmidi.net,ou=people,o=ipaca did not replicate to ldap://ipam.i.gpmidi.net:389 While Waiting For User Sync/Validation... *tl;dr The user seems to exist on both sides!* [root@ipa0 ~]# ldapsearch -x -D "cn=Directory Manager" -W -b "uid=admin-ipa0.i.gpmidi.net,ou=people,o=ipaca" ldap://ipam.i.gpmidi.net:389 Enter LDAP Password: # extended LDIF # # LDAPv3 # base <uid=admin-ipa0.i.gpmidi.net,ou=people,o=ipaca> with scope subtree # filter: (objectclass=*) # requesting: ldap://ipam.i.gpmidi.net:389 # # admin-ipa0.i.gpmidi.net, people, ipaca dn: uid=admin-ipa0.i.gpmidi.net,ou=people,o=ipaca # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 [root@ipa0 ~]# ldapsearch -x -D "cn=Directory Manager" -W -b "uid=admin-ipa0.i.gpmidi.net,ou=people,o=ipaca" ldap://localhost Enter LDAP Password: # extended LDIF # # LDAPv3 # base <uid=admin-ipa0.i.gpmidi.net,ou=people,o=ipaca> with scope subtree # filter: (objectclass=*) # requesting: ldap://localhost # # admin-ipa0.i.gpmidi.net, people, ipaca dn: uid=admin-ipa0.i.gpmidi.net,ou=people,o=ipaca # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 ------------------------------ The EnvironmentSource Distro: CentOS 7.9.2009 FreeIPA: 4.6.8 TargetOriginally Distro: Fedora Server 36 FreeIPA: 4.9.11 Later Distro: Fedora Server 37 FreeIPA: 4.10.1 Install CommandsStep 1 - Client ipa-client-install --ssh-trust-dns --mkhomedir --realm=I.GPMIDI.NET --ntp-pool=0.pool.ntp.org --force-join --enable-dns-updates --subid --hostname=ipa0.i.gpmidi.net --ntp-server=1.pool.ntp.org Step 2 - kinit kinit <MY PERSONAL USER> Step 3 - Replica Install ipa-replica-install --setup-adtrust --setup-ca --setup-dns --no-forwarders --skip-conncheck --add-sids Sometimes the `--debug` flag was also used. The installer would ask about trusted domain support - answered "no" via no entry unless noted otherwise. Enable trusted domains support in slapi-nis? [no]: Cleanup Commands Used after a failure to reset the environment. Step 1 - Uninstall /usr/sbin/ipa-server-install --uninstall Step 2 - Validated Server Removed Browsed to https://ipam.i.gpmidi.net/ipa/ui/#/e/server/search and validated that the new server, ipa0, wasn't listed. Deleted if it was. ------------------------------ Related Links - FreeIPA Users thread <https://lists.fedoraproject.org/archives/list/freeipa-users@lists.fedorahos…> - Red Hat Bugzilla – Bug 2151071 <https://bugzilla.redhat.com/show_bug.cgi?id=2151071> ------------------------------ Attempted Fixes Changed Replication Wait Time Created ` /etc/ipa/installer.conf` (see below) and changed the time in seconds. # cat /etc/ipa/installer.conf [global] replication_wait_timeout=30 Result 30s = No change 300s = No change 600s = No change *Left at 30s for further testing - keeps it quick - provides more than enough time since my ldap db is small. * Update Source IPA Box From C7 To C8Result Upgrade from c7 to c8 failed badly. Might try again later. Update Source IPA Box 389 `root` Password Hash Type # /usr/bin/pwdhash -D /etc/dirsrv/slapd-YOUR-DOMAIN-NET -s PBKDF2_SHA256 '<Current DirSrv Root Password>' {PBKDF2_SHA256}xxxxxxxxxxxxxxxxxxxxxxxx Result No change Updated Target IPA Box To Fedora Server 37 Updated target IPA box from f36 to f37. This changed the IPA version from 4.9.11 to 4.10.1. Result No change Changing Password Storage Scheme On Source # dsconf -D "cn=Directory Manager" -W ldaps://ipam.i.gpmidi.net config replace passwordStorageScheme=PBKDF2_SHA256 Enter password for cn=Directory Manager on ldaps://ipam.i.gpmidi.net: <ENTERED ROOT PW> Successfully replaced "passwordStorageScheme" Result No change Trusted Domains Answer = Yes Answered 'yes' to trusted domains. Enable trusted domains support in slapi-nis? [no]: yes Result No change Restarted IPA On Source Since the `dsconf` change above to the password storage scheme the IPA server on the source box hasn't been restarted. Restarted it via... # ipactl restasrt Result No change

3 3

Configuration of server on DO droplet in Docker container and clients behind router's NAT
by Georgiy Odisharia 02 Mar '23

02 Mar '23

Hi there, I know that it is not secure but I have exposed to the internet FreeIPA instance for uniform logging between all my machines. They're reside at my home network behind OpenWRT-based router (behind NAT). Public IP address of router is getting via ISP's DHCP. I want to properly set up FreeIPA server in Docker container running on the DigitalOcean droplet, set up DNS entries in DigitalOcean panel, and properly set up client for allowing LDAP authentication (sssd.conf, krb5.conf and so on). I don't know where to start and debug so if anybody will help me in general I would be highly appreciated.

2 2

Re: FreeIPA Replica Install Issue
by Rob Crittenden 01 Mar '23

01 Mar '23

Jerome Talbert via FreeIPA-users wrote: > Hello, > > > > We had an issue with one of replicas and decided to remove it from the > topology and run the ipa-server-install –uninstall command on the > replica. I also went through and removed all the SRV records related to > the replica. > > > > The idea was to reinstall the same server as replica again using the > command: > > ipa-replica-install --setup-dns --setup-ca --principal=admin > --password='############' --no-forwarders > > > > When I try to run the command, I get the following error message: > > ipapython.admintool: ERROR Cannot install replica of a server of > higher version ((u'00000004', u'00000006', u'00000008', '*final')) than > the local version ((u'00000004', u'00000006', u'00000006', '*final')) > > ipapython.admintool: ERROR The ipa-replica-install command failed. > See /var/log/ipareplica-install.log for more information > > > > Any ideas what might be going on here? Do I have something left-over on > the replica that needs to be cleaned up manually first? As the message says, you are trying to create a new server using a lower version than the remote server. A higher local version is allowed for upgrades but not the other way around. (4.6.8 remote, 4.6.6 local). Updating the IPA packages on your replica should fix it. rob

2 1

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users March 2023