FreeIPA-users May 2023

freeipa-users@lists.fedorahosted.org

37 participants
79 discussions

ACME client certificate request from FreeIPA with DNS-01 challenge
by Djerk Geurts 04 May '23

04 May '23

Aware that ACME support is still relatively new. I'm looking at how the challenge works for an ACME client. DNS-01 seems superfluous as FreeIPA manages the DNS itself and HTTP-01 is often not an option, for example when using ACME on vSphere. If the DNS-01 verification is indeed fully local to a FreeIPA server with integrated DNS and CA then can't any machine that can reach the FreeIPA server request an internal certificate anonymously? Surely I'm missing something here?

3 6

broken trust chain resolving using 8.8.8.8 as forwarder
by Rob van Halteren 04 May '23

04 May '23

Hi, I have trouble resolving some addresses with my freeipa server . in the log there are lots of "broken trust chain" lines. like: validating gew4-spclient.spotify.com/CNAME: bad cache hit (com/DS) May 3 14:36:11 myserver named-pkcs11[30906]: validating gew4-spclient.spotify.com/CNAME: bad cache hit (com/DS) May 3 14:36:11 myserver named-pkcs11[30906]: broken trust chain resolving 'gew4-spclient.spotify.com/A/IN': 8.8.8.8#53 May 3 14:36:11 myserver named-pkcs11[30906]: broken trust chain resolving 'gew4-spclient.spotify.com/TYPE65/IN': 8.8.8.8#53 I setup a global forward to 8.8.8.8 and forward only setting in the web gui. I tried to change the dnssec settings in /etc/named.conf : dnssec-enable no; dnssec-validation no; That did not help. I run freeipa 4.6.8. Release: 5.el7.centos.12 on centos7.9 When I change forwarding to: forward disabled in the webgui, i get lots of "network unreachable resolving" in the logs. I then can resolve most addresses but not all To me looks like dns is not resolving as expected, but have no clue in where to look for a solution. Any help appreciated. Thanks, Rob.

2 3

Running 'sudo su' creates kerberos ticket for user on old IPA (4.6) not on new 4.10
by Finn Fysj 04 May '23

04 May '23

I'm trying to setup new IPA server and when I run 'sudo su' I get prompted with password, which is fine. However, when I successfully type my password on a RHEL7 instance running FreeIPA version 4.6 I get a kerberos ticket as the logged-in user in "root-mode", but when I do the same in the newer IPA instance I do not get any kerberos ticket when in root. How do I get kerberos ticket when I run 'sudo su'?

2 3

What's the proper way of creating HBAC/SUDO rules in a Primary/replica setup
by J N 03 May '23

03 May '23

Hi, I'm new to ansible and FreeIPA project, and I'm currently trying to setup HBAC and SUDO rules to my primary server and the replicas. Is the practice to only apply rules to the primary server and let it replicate to the replicas? The reason I'm asking is because when I try to create HBAC/SUDO rules on the primary and the replicas I get an error in ansible saying: changed: [192.168.204.10] fatal: [192.168.204.11]: FAILED! => {"changed": false, "msg": "sudorule_add: test_rule: sudo rule with name \"test_rule\" already exists"} However, if I try to retun the play it will work as an idempotently: ok: [192.168.204.10] ok: [192.168.204.11] Question: What's the practice when running a replicas, should only the "main" master be updated?

4 6

Auto create DNS PTR record
by Jeremy Tourville 03 May '23

03 May '23

Is it possible to create the record automatically when registering a new client to IPA? If so, how? Maybe I have missed something when reading the manuals.

2 2

Allow service '--servicecat=all' not visible in GUI
by Finn Fysj 02 May '23

02 May '23

Hi, I'm trying to set up new FreeIPA servers based on an old setup. I've only migrated users/groups to the new setup. I wasn't able to SSH into the new IPA server and after investigating it seemed to be some HBAC rules for SSHD service wans't enabled. I've intentionally not migrated the preivous HBAC rules. On the old system it had been created and included HBAC for rules using the '--servicecat=all' options, meaning I couldn't get any information from the HBAC rules looking in the GUI. Why isn't this visible?

2 4

SubCA for firewall appliance (CertProcessor: no profile policy set found)
by Djerk Geurts 02 May '23

02 May '23

Trying to follow and adapt https://frasertweedale.github.io/blog-redhat/posts/2018-08-21-ipa-subordina… for issuing a Subordinate CA for a firewall appliance. For user VPN certs and testing SSL Interception. When I try to issue the certificate I get the following error: ipa-admin@jmp0:~$ ipa cert-request ~/cert_FreeIPA_SubCA.csr --principal host/subca-fw01.domain.local --profile SubCA --certificate-out subca-fw01.pem ipa: ERROR: Request failed with status 500: Non-2xx response from CA REST API: 500. Unable to create enrollment request: Policy Set Not Found But the certprofile exists and I'm not sure what a `Policy Set` is... ipa-admin@ipa1:~$ ipa certprofile-show SubCA Profile ID: SubCA Profile description: Subordinate CA Store issued certificates: True ipa-admin@ipa1:~$ ipa caacl-show SubCA ACL name: SubCA Description: Subordinate CA Enabled: True Service category: all CAs: ipa Profiles: SubCA Users: ipa-admin Hosts: fw01.domain.local, jmp0.domain.local, subca-fw01.domain.local # /var/log/pki/pki-tomcat/ca/debug.2023-05-01.log 2023-05-01 17:03:56 [ajp-nio-127.0.0.1-8009-exec-9] SEVERE: CertProcessor: no profile policy set found 2023-05-01 17:03:56 [ajp-nio-127.0.0.1-8009-exec-9] SEVERE: Unable to create enrollment request: Policy Set Not Found # /var/log/httpd/error_log [Tue May 02 01:20:24.946972 2023] [wsgi:error] [pid 406021:tid 406343] [remote 192.168.10.12:42596] ipa: INFO: [jsonserver_kerb] ipa-admin(a)IPA.LOCAL: cert_request/1('-----BEGIN CERTIFICATE REQUEST-----\\*********************=\\n-----END CERTIFICATE REQUEST-----\\n', profile_id='SubCA', principal='host/subca-fw01.domain.local', version='2.245'): HTTPRequestError Please ignore the different timestamps, they're various attempts all with the same log messages.

2 2

What's the proper way of creating HBAC/SUDO rules in a Primary/replica setup
by J N 02 May '23

02 May '23

1 0

How to parse this under command module
by HUANG, TONY 01 May '23

01 May '23

Hi, I am trying to add ipa migrate-ds as a task using the command or shell module, but it keeps on erroring out. How should I parse this? ipa migrate-ds --bind-dn="cn=Directory Manager" --user-container=cn=users,cn=accounts --group-container=cn=groups,cn=accounts --group-objectclass=posixgroup --user-ignore-attribute={krbPrincipalName,krbextradata,krblastfailedauth,krblastpwdchange,krblastsuccessfulauth,krbloginfailedcount,krbpasswordexpiration,krbticketflags,krbpwdpolicyreference,mepManagedEntry} --user-ignore-objectclass mepOriginEntry --group-ignore-attribute=mepmanagedby --group-ignore-objectclass=mepmanagedEntry --with-compat ldap:// ipa.server.com Thanks! Tony

2 1

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users May 2023