FreeIPA-users May 2023

freeipa-users@lists.fedorahosted.org

37 participants
79 discussions

2FA only for certain hosts/host groups
by Ronald Wimmer 04 Sep '23

04 Sep '23

Is it possible to enforce the second factor for a user only when trying to login to specific hosts/host groups? List here says yes... https://blog.delouw.ch/2016/10/16/freeipa-selective-2fa-authentication-indi… I'm gonna give it a try. Cheers, Ronald

2 4

Custom ssl cert for freeipa docker
by Leo O 25 Aug '23

25 Aug '23

Hello Guys, I'm would like to use custom ssl certificates for http and ldap, I saw the following: https://www.freeipa.org/page/Using_3rd_part_certificates_for_HTTP/LDAP But I wonder how would this be done when using freeipa in a docker/podman container. I mean the container is started with "--read-only" flag. So it's not clear to me what the correct approach here would be. I hope it's not that you have to re-build an own image with the ssl certificates every time? Background Info: I'm using acme.sh in a VM, which creates my wildcard letsencrypt certificates and puts them on an nfs share. Freeipa should simply use that certificates for http and ldap and that's it. No renewing as this is done by the acme.sh VM itself.

3 10

Visibility/access of Freeipa users to windows on trusted AD
by Francis Augusto Medeiros-Logeay 09 Aug '23

09 Aug '23

Hi, I have searched this everywhere, but can't find it. I want to grant access to a FreeIPA user to a Windows machine. When I try to grant the user access on windows, adding it like FREEIPADOMAIN\freeipauser, I get an error. There is a trust between both domains, but every place where I see the trusted domain on Windows (for example when configuring a GPO) I can't search for FreeIPA users. Is this how it is supposed to be, or how can I see my FreeIPA users on Windows the same way I see AD users on my freeipa linux clients? Best, Francis -- Francis Augusto Medeiros-Logeay Oslo, Norway

2 4

Cannot get rid of a replica/agreement
by lejeczek 21 Jul '23

21 Jul '23

Hi guys. Two masters from which third got disconnected in a "dirty" manner. -> $ ipa-replica-manage del midway.ccn.priv.dom Server removal aborted: Replication topology in suffix 'domain' is disconnected: Topology does not allow server love.ccn.priv.dom to replicate with servers: midway.ccn.priv.dom Topology does not allow server midway.ccn.priv.dom to replicate with servers: love.ccn.priv.dom punch.ccn.priv.dom Topology does not allow server punch.ccn.priv.dom to replicate with servers: midway.ccn.priv.dom. -> $ ipa topologysegment-find domain ----------------- 1 segment matched ----------------- Segment name: punch.ccn.priv.dom-to-love.ccn.priv.dom Left node: punch.ccn.priv.dom Right node: love.ccn.priv.dom Connectivity: both ---------------------------- Number of entries returned 1 -> $ ipa-replica-manage del midway.ccn.priv.dom --force ipa: WARNING: /usr/lib/python3.6/site-packages/ipaserver/plugins/dogtag.py:1973: The subsystem in PKIConnection.__init__() has been deprecated (https://www.dogtagpki.org/wiki/PKI_10.8_Python_Changes) Updating DNS system records Not allowed on non-leaf entry I've tried to 'reinitialize' but without success. Anybody care to share suggestions & thoughts? many thanks, L.

4 6

Limiting access to GUI
by Entrepreneur AJ 10 Jul '23

10 Jul '23

Hey all, I have a wan facing install due to many of my team operating with mobile phone hotspots whilst visiting customers. An Issue I'm having is I want to restrict the GUI to only our admin team's IP address but editing the Apache Config with; # webUI is now completely static, and served out of that directory Alias /ipa/ui "/usr/share/ipa/ui" <Directory "/usr/share/ipa/ui"> SetHandler None AllowOverride None Satisfy Any Require all granted ExpiresActive On ExpiresDefault "access plus 1 year" <FilesMatch "(index.html|loader.js|login.html|reset_password.html)"> ExpiresDefault "access plus 0 seconds" </FilesMatch> Order allow,deny Allow from <ADMIN IP RANGE> </Directory> Is still allowing anyone with a browser to reach the IPA gui. We have Keycloak in place for staff and users to update their passwords. Any pointers? I would personally prefer to firewall it off but that effects other IPA features.

2 5

FreeIPA and AIX - sudoers_base
by Ronald Wimmer 16 Jun '23

16 Jun '23

We managed to integrate AIX IPA clients successfully some time ago. sudo was also working fine. A few weeks ago sudo stopped working. The /etc/ldap.conf on our AIX clients contains the following line: sudoers_base cn=users,cn=compat,ou=sudoers,dc=linux,dc=mydomain,dc=at If we try to look that up with an LDAP browser we do not even find a OU named "sudoers". Did the LDAP structure change in the recent past? What should the sudoers_base line contain? Cheers, Ronald

3 6

Do keytabs expire?
by Ronald Wimmer 07 Jun '23

07 Jun '23

Hi, today I found out that some entries in a keytab file seemed to have expired: Request ticket server HTTP/mwc.linux.mydomain.at(a)LINUX.MYDOMAIN.AT kvno 4 not found in keytab; keytab is likely out of date Fetching the keytab again with ipa-getkeytab fixed the problem. But why is this happening? Do keytab entries expire? I have not set any custom password or ticket policies. Regards, Ronald

4 13

dns suddenly not happy with DNSSEC
by lejeczek 31 May '23

31 May '23

Hi guys. That is on first master which was happy for short while and then suddenly: ... 29-May-2023 12:38:23.597 info: client @0x7f6484005538 127.0.0.1#43235 (onet.pl): query failed (broken trust chain) for onet.pl/IN/A at ../../../lib/ns/query.c:7355 29-May-2023 12:39:08.518 info: client @0x7f64b0080088 127.0.0.1#48441 (onet.pl): query failed (broken trust chain) for onet.pl/IN/A at ../../../lib/ns/query.c:7355 and that is for any & every query. With given forwards or no forwarders. Time is in sync, network works, everything else seem good too... and the second master/replica does not complain. What might the issue (beside the obvious)? many thanks, L.

2 5

New DNS Record - Create Reverse Option Fails
by Jeff Hochberg 30 May '23

30 May '23

Hello, I have an odd issue that just cropped up... I've been using FreeIPA for the past two or three months. I'm using it both for user/group membership as well as for internal DNS. Any time I try to add an A record with the "Create reverse" option checked, I see the "waiting" message for about 30 seconds, then I get an error message that the reverse record could not be created. Here's an example: Forward Lookup Zone: company.com Reverse Lookup Zones: 10.16.172.in-addr.arpa. 100.16.172.in-addr.arpa. 101.16.172.in-addr.arpa. 11.16.172.in-addr.arpa. 12.16.172.in-addr.arpa. Let's say I go to add an A record for "test-record" in the company.com forward lookup zone: A -> 172.16.100.123 I see the "Waiting" message for roughly 30 seconds, followed by this error message: "Cannot create reverse record for "172.16.100.123": No answers could be found in the specified lifetime for DNS reverse zone 123.100.16.172.in-addr.arpa." It looks like FreeIPA is appending 123 to the zone name (123.100.16.172.in-addr.arpa.) when it should be trying to create the PTR record in 100.16.172.in-addr.arpa. This only happens with some of the Reverse Lookup Zones - it doesn't occur consistently across all zones. For example, I just tried creating a second entry for "test-record2" in company.com: A -> 172.16.10.124 (PTR should be in 10.16.172.in-addr.arpa.) Both the A record and PTR record get created successfully. Does anyone happen to have any thoughts as to why this may be happening? I've been considering deleting the 100.16.172.in-addr.arpa. zone and recreating it, but I have a few dozen records and would prefer to not have to create them again. Thanks in advance!

1 0

ldap_sasl_interactive_bind_s: Inappropriate authentication (48) - help debugging
by Radoslaw Kujawa 30 May '23

30 May '23

Hello list. I am trying to understand a reason for certificate-based authentication failure to one of my directory servers. A have 3 IPA replicas running on CentOS 7. After running yum update on one of the nodes, PKI Tomcat failed to start. That system was not updated for last year or so, so the problem might have existed earlier and now was merely triggered by the update. At first I suspected contents of /etc/pki/tomcat being wrong, however that does not seem to be the case. Trying to understand the issue, I decided to try to replicate the authentication process "by hand": I've set: LDAPTLS_CACERTDIR="/etc/pki/pki-tomcat/alias" LDAPTLS_CERT="NSS Certificate DB:subsystemCert cert-pki-ca" However: ${NODE1}# ldapsearch -H ldaps://${NODE1}:636 -b "" -s base -Y EXTERNAL -Q -LLL dn namingcontexts ldap_sasl_interactive_bind_s: Inappropriate authentication (48) additional info: missing client certificate Interestingly, I _can_ authenticate this way to the other two nodes (from the same node where authentication to a local dir server does not work): ${NODE1}# ldapsearch -H ldaps://${NODE2}:636 -b "" -s base -Y EXTERNAL -Q -LLL dn namingcontexts dn: namingcontexts: cn=changelog namingcontexts: dc=infra,dc=linker,dc=shop namingcontexts: o=ipaca I don't understand what does "missing client certificate" mean in this case, after all client configuration is identical, I am merely changing the server to which I connect. I've investigated the contents of /tmp/openldap-tlsmc*/*/*pem and it seems to be correct (and same on all nodes), if I use ldapsearch -Y EXTERNAL. ${NODE1}# openssl x509 -in /tmp/openldap-tlsmc-alias--*/cert.pem -text Certificate: Data: Version: 3 (0x2) Serial Number: 228 (0xe4) Signature Algorithm: sha256WithRSAEncryption Issuer: O=xxx CN=Certificate Authority Validity Not Before: Jul 12 08:49:04 2022 GMT Not After : Jul 1 08:49:04 2024 GMT Subject: O=xxx, CN=CA Subsystem Subject Public Key Info: Public Key Algorithm: rsaEncryption Public-Key: (2048 bit) Modulus: ... I suspected that maybe replication is somehow messed up, but it seems to be working: ${NODE1}# ipa-replica-manage list `hostname` -v ${NODE2}: replica last update status: Error (0) Replica acquired successfully: Incremental update succeeded last update ended: 2023-05-30 14:21:10+00:00 ${NODE3}: replica last update status: Error (0) Replica acquired successfully: Incremental update succeeded last update ended: 2023-05-30 14:21:10+00:00 As I understand, the cert-pki-ca certificate and private key is shared between the nodes and can be used to authenticate to any of directory servers? What can possibly be different in directory servers between these nodes, which results in certificate authentication failing to one server, and succeeding to another? Any hints would be appreciated. Best regards, Radoslaw

1 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users May 2023