May 2023 - FreeIPA-users - Fedora mailing-lists

Cannot get rid of a replica/agreement
by lejeczek 21 Jul '23

21 Jul '23

Hi guys. Two masters from which third got disconnected in a "dirty" manner. -> $ ipa-replica-manage del midway.ccn.priv.dom Server removal aborted: Replication topology in suffix 'domain' is disconnected: Topology does not allow server love.ccn.priv.dom to replicate with servers: midway.ccn.priv.dom Topology does not allow server midway.ccn.priv.dom to replicate with servers: love.ccn.priv.dom punch.ccn.priv.dom Topology does not allow server punch.ccn.priv.dom to replicate with servers: midway.ccn.priv.dom. -> $ ipa topologysegment-find domain ----------------- 1 segment matched ----------------- Segment name: punch.ccn.priv.dom-to-love.ccn.priv.dom Left node: punch.ccn.priv.dom Right node: love.ccn.priv.dom Connectivity: both ---------------------------- Number of entries returned 1 -> $ ipa-replica-manage del midway.ccn.priv.dom --force ipa: WARNING: /usr/lib/python3.6/site-packages/ipaserver/plugins/dogtag.py:1973: The subsystem in PKIConnection.__init__() has been deprecated (https://www.dogtagpki.org/wiki/PKI_10.8_Python_Changes) Updating DNS system records Not allowed on non-leaf entry I've tried to 'reinitialize' but without success. Anybody care to share suggestions & thoughts? many thanks, L.

4 6

Limiting access to GUI
by Entrepreneur AJ 10 Jul '23

10 Jul '23

Hey all, I have a wan facing install due to many of my team operating with mobile phone hotspots whilst visiting customers. An Issue I'm having is I want to restrict the GUI to only our admin team's IP address but editing the Apache Config with; # webUI is now completely static, and served out of that directory Alias /ipa/ui "/usr/share/ipa/ui" <Directory "/usr/share/ipa/ui"> SetHandler None AllowOverride None Satisfy Any Require all granted ExpiresActive On ExpiresDefault "access plus 1 year" <FilesMatch "(index.html|loader.js|login.html|reset_password.html)"> ExpiresDefault "access plus 0 seconds" </FilesMatch> Order allow,deny Allow from <ADMIN IP RANGE> </Directory> Is still allowing anyone with a browser to reach the IPA gui. We have Keycloak in place for staff and users to update their passwords. Any pointers? I would personally prefer to firewall it off but that effects other IPA features.

2 5

FreeIPA and AIX - sudoers_base
by Ronald Wimmer 16 Jun '23

16 Jun '23

We managed to integrate AIX IPA clients successfully some time ago. sudo was also working fine. A few weeks ago sudo stopped working. The /etc/ldap.conf on our AIX clients contains the following line: sudoers_base cn=users,cn=compat,ou=sudoers,dc=linux,dc=mydomain,dc=at If we try to look that up with an LDAP browser we do not even find a OU named "sudoers". Did the LDAP structure change in the recent past? What should the sudoers_base line contain? Cheers, Ronald

3 6

Do keytabs expire?
by Ronald Wimmer 07 Jun '23

07 Jun '23

Hi, today I found out that some entries in a keytab file seemed to have expired: Request ticket server HTTP/mwc.linux.mydomain.at(a)LINUX.MYDOMAIN.AT kvno 4 not found in keytab; keytab is likely out of date Fetching the keytab again with ipa-getkeytab fixed the problem. But why is this happening? Do keytab entries expire? I have not set any custom password or ticket policies. Regards, Ronald

4 13

dns suddenly not happy with DNSSEC
by lejeczek 31 May '23

31 May '23

Hi guys. That is on first master which was happy for short while and then suddenly: ... 29-May-2023 12:38:23.597 info: client @0x7f6484005538 127.0.0.1#43235 (onet.pl): query failed (broken trust chain) for onet.pl/IN/A at ../../../lib/ns/query.c:7355 29-May-2023 12:39:08.518 info: client @0x7f64b0080088 127.0.0.1#48441 (onet.pl): query failed (broken trust chain) for onet.pl/IN/A at ../../../lib/ns/query.c:7355 and that is for any & every query. With given forwards or no forwarders. Time is in sync, network works, everything else seem good too... and the second master/replica does not complain. What might the issue (beside the obvious)? many thanks, L.

2 5

New DNS Record - Create Reverse Option Fails
by Jeff Hochberg 30 May '23

30 May '23

Hello, I have an odd issue that just cropped up... I've been using FreeIPA for the past two or three months. I'm using it both for user/group membership as well as for internal DNS. Any time I try to add an A record with the "Create reverse" option checked, I see the "waiting" message for about 30 seconds, then I get an error message that the reverse record could not be created. Here's an example: Forward Lookup Zone: company.com Reverse Lookup Zones: 10.16.172.in-addr.arpa. 100.16.172.in-addr.arpa. 101.16.172.in-addr.arpa. 11.16.172.in-addr.arpa. 12.16.172.in-addr.arpa. Let's say I go to add an A record for "test-record" in the company.com forward lookup zone: A -> 172.16.100.123 I see the "Waiting" message for roughly 30 seconds, followed by this error message: "Cannot create reverse record for "172.16.100.123": No answers could be found in the specified lifetime for DNS reverse zone 123.100.16.172.in-addr.arpa." It looks like FreeIPA is appending 123 to the zone name (123.100.16.172.in-addr.arpa.) when it should be trying to create the PTR record in 100.16.172.in-addr.arpa. This only happens with some of the Reverse Lookup Zones - it doesn't occur consistently across all zones. For example, I just tried creating a second entry for "test-record2" in company.com: A -> 172.16.10.124 (PTR should be in 10.16.172.in-addr.arpa.) Both the A record and PTR record get created successfully. Does anyone happen to have any thoughts as to why this may be happening? I've been considering deleting the 100.16.172.in-addr.arpa. zone and recreating it, but I have a few dozen records and would prefer to not have to create them again. Thanks in advance!

1 0

ldap_sasl_interactive_bind_s: Inappropriate authentication (48) - help debugging
by Radoslaw Kujawa 30 May '23

30 May '23

Hello list. I am trying to understand a reason for certificate-based authentication failure to one of my directory servers. A have 3 IPA replicas running on CentOS 7. After running yum update on one of the nodes, PKI Tomcat failed to start. That system was not updated for last year or so, so the problem might have existed earlier and now was merely triggered by the update. At first I suspected contents of /etc/pki/tomcat being wrong, however that does not seem to be the case. Trying to understand the issue, I decided to try to replicate the authentication process "by hand": I've set: LDAPTLS_CACERTDIR="/etc/pki/pki-tomcat/alias" LDAPTLS_CERT="NSS Certificate DB:subsystemCert cert-pki-ca" However: ${NODE1}# ldapsearch -H ldaps://${NODE1}:636 -b "" -s base -Y EXTERNAL -Q -LLL dn namingcontexts ldap_sasl_interactive_bind_s: Inappropriate authentication (48) additional info: missing client certificate Interestingly, I _can_ authenticate this way to the other two nodes (from the same node where authentication to a local dir server does not work): ${NODE1}# ldapsearch -H ldaps://${NODE2}:636 -b "" -s base -Y EXTERNAL -Q -LLL dn namingcontexts dn: namingcontexts: cn=changelog namingcontexts: dc=infra,dc=linker,dc=shop namingcontexts: o=ipaca I don't understand what does "missing client certificate" mean in this case, after all client configuration is identical, I am merely changing the server to which I connect. I've investigated the contents of /tmp/openldap-tlsmc*/*/*pem and it seems to be correct (and same on all nodes), if I use ldapsearch -Y EXTERNAL. ${NODE1}# openssl x509 -in /tmp/openldap-tlsmc-alias--*/cert.pem -text Certificate: Data: Version: 3 (0x2) Serial Number: 228 (0xe4) Signature Algorithm: sha256WithRSAEncryption Issuer: O=xxx CN=Certificate Authority Validity Not Before: Jul 12 08:49:04 2022 GMT Not After : Jul 1 08:49:04 2024 GMT Subject: O=xxx, CN=CA Subsystem Subject Public Key Info: Public Key Algorithm: rsaEncryption Public-Key: (2048 bit) Modulus: ... I suspected that maybe replication is somehow messed up, but it seems to be working: ${NODE1}# ipa-replica-manage list `hostname` -v ${NODE2}: replica last update status: Error (0) Replica acquired successfully: Incremental update succeeded last update ended: 2023-05-30 14:21:10+00:00 ${NODE3}: replica last update status: Error (0) Replica acquired successfully: Incremental update succeeded last update ended: 2023-05-30 14:21:10+00:00 As I understand, the cert-pki-ca certificate and private key is shared between the nodes and can be used to authenticate to any of directory servers? What can possibly be different in directory servers between these nodes, which results in certificate authentication failing to one server, and succeeding to another? Any hints would be appreciated. Best regards, Radoslaw

1 0

Need some advice on current Replica Best Practices (LDAP only, no AD)
by Chris Cowan 30 May '23

30 May '23

I work for a large corporation where we like to switch from OpenLDAP (with Krb5) to RedHat idM. I'll call it xyz.com The IAM system we are refactoring was setup more than a decade ago, and based on OpenLDAP. We had a primary or master server in one location, with multiple RO replicas, geographically distributed. The user and group spaces were flat, from an LDAP OU and kerberos 5 perspective. There was only a single realm. DNS was not used for kerberos, with krb5.conf files managed so clients are pushed to the closest KDC. After the system was running, the CIO implemented a corporate SSO using an Enterprise Directory (which also Open LDAP or some other 389 descendant). There are isolated pockets of AD, and nothing in the TLD. So, AD is not really used at the Enterprise level. I'm exploring the replication options using the following assumptions. - Not using AD, only OpenLDAP, RHDS, or some 389 variant. - There will be a minimum of 3 but eventually 7 locations with an IdM server deployed. Each location uses a unique subdomain under xyz.com - We allocate uids and gids starting at 100K. We still want it to be flat. - We would like to use a Pass Through Agent (PTA) to our Enterprise Directory, for this block of users, if possible, for the LDAP binding. - We would like have a single kerberos realm for all of these locations. - There is no expectation that the LDAP and Kerberos passwords will be synced. I've seen some conversations in the mailing list archives, but nothing recent. Hopefully, someone can give me some pointers or websites which discuss replication/deployment scenarios. -- Chris

2 1

repl conflict which is not there - ?
by lejeczek 30 May '23

30 May '23

Hi guys. for what 'ipa-healthcheck' complains of: { "source": "ipahealthcheck.ds.replication", "check": "ReplicationCheck", "result": "WARNING", "uuid": "720d7af6-5a11-486f-a610-f6f06ec4d9e2", "when": "20230526202306Z", "duration": "0.054683", "kw": { "key": "DSREPLLE0002", "items": [ "Replication", "Conflict Entries" ], "msg": "There were 1 conflict entries found under the replication suffix \"o=ipaca\"." } }, and old trick finds not culprit: -> $ ldapsearch -LLL -H ldaps://$(hostname) -Y GSSAPI -D 'cn=Directory Manager' -b 'o=ipaca' '(&(objectClass=ldapSubEntry)(nsds5ReplConflict=*))' nsds5ReplConflict SASL/GSSAPI authentication started SASL username: admin(a)MINE.PRIV SASL SSF: 256 SASL data security layer installed. where is it hiding? many thanks, L.

2 2

Can't add CA to replica - invalid 'cn': must be
by Nicholas Cross 26 May '23

26 May '23

We are in the process of adding a new a CA replica. We install in the following fashion: 1. ipa-replica-install 2. ipa-dns-install 3. ipa-ca-install All goes well until step3. ipa-ca-install, where we get the error: 2023-05-22T16:51:30Z ERROR ERROR: Remote master check failed with following error message(s): invalid 'cn': must be "ipa011.ad.company.fm" If we do --skip-conn-check (not recommended) at step 3 we get a complete install, but it does not allow kinit to work on that server. Any thoughts on how to diagnose and/or fix? Thanks Nick.

3 15

2025

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users May 2023