FreeIPA-users May 2023

freeipa-users@lists.fedorahosted.org

37 participants
75 discussions

Auto create DNS PTR record
by Jeremy Tourville 03 May '23

03 May '23

Is it possible to create the record automatically when registering a new client to IPA? If so, how? Maybe I have missed something when reading the manuals.

2 2

Allow service '--servicecat=all' not visible in GUI
by Finn Fysj 02 May '23

02 May '23

Hi, I'm trying to set up new FreeIPA servers based on an old setup. I've only migrated users/groups to the new setup. I wasn't able to SSH into the new IPA server and after investigating it seemed to be some HBAC rules for SSHD service wans't enabled. I've intentionally not migrated the preivous HBAC rules. On the old system it had been created and included HBAC for rules using the '--servicecat=all' options, meaning I couldn't get any information from the HBAC rules looking in the GUI. Why isn't this visible?

2 4

SubCA for firewall appliance (CertProcessor: no profile policy set found)
by Djerk Geurts 02 May '23

02 May '23

Trying to follow and adapt https://frasertweedale.github.io/blog-redhat/posts/2018-08-21-ipa-subordina… for issuing a Subordinate CA for a firewall appliance. For user VPN certs and testing SSL Interception. When I try to issue the certificate I get the following error: ipa-admin@jmp0:~$ ipa cert-request ~/cert_FreeIPA_SubCA.csr --principal host/subca-fw01.domain.local --profile SubCA --certificate-out subca-fw01.pem ipa: ERROR: Request failed with status 500: Non-2xx response from CA REST API: 500. Unable to create enrollment request: Policy Set Not Found But the certprofile exists and I'm not sure what a `Policy Set` is... ipa-admin@ipa1:~$ ipa certprofile-show SubCA Profile ID: SubCA Profile description: Subordinate CA Store issued certificates: True ipa-admin@ipa1:~$ ipa caacl-show SubCA ACL name: SubCA Description: Subordinate CA Enabled: True Service category: all CAs: ipa Profiles: SubCA Users: ipa-admin Hosts: fw01.domain.local, jmp0.domain.local, subca-fw01.domain.local # /var/log/pki/pki-tomcat/ca/debug.2023-05-01.log 2023-05-01 17:03:56 [ajp-nio-127.0.0.1-8009-exec-9] SEVERE: CertProcessor: no profile policy set found 2023-05-01 17:03:56 [ajp-nio-127.0.0.1-8009-exec-9] SEVERE: Unable to create enrollment request: Policy Set Not Found # /var/log/httpd/error_log [Tue May 02 01:20:24.946972 2023] [wsgi:error] [pid 406021:tid 406343] [remote 192.168.10.12:42596] ipa: INFO: [jsonserver_kerb] ipa-admin(a)IPA.LOCAL: cert_request/1('-----BEGIN CERTIFICATE REQUEST-----\\*********************=\\n-----END CERTIFICATE REQUEST-----\\n', profile_id='SubCA', principal='host/subca-fw01.domain.local', version='2.245'): HTTPRequestError Please ignore the different timestamps, they're various attempts all with the same log messages.

2 2

What's the proper way of creating HBAC/SUDO rules in a Primary/replica setup
by J N 02 May '23

02 May '23

Hi, I'm new to ansible and FreeIPA project, and I'm currently trying to setup HBAC and SUDO rules to my primary server and the replicas. Is the practice to only apply rules to the primary server and let it replicate to the replicas? The reason I'm asking is because when I try to create HBAC/SUDO rules on the primary and the replicas I get an error in ansible saying: changed: [192.168.204.10] fatal: [192.168.204.11]: FAILED! => {"changed": false, "msg": "sudorule_add: test_rule: sudo rule with name \"test_rule\" already exists"} However, if I try to retun the play it will work as an idempotently: ok: [192.168.204.10] ok: [192.168.204.11] Question: What's the practice when running a replicas, should only the "main" master be updated?

1 0

How to parse this under command module
by HUANG, TONY 01 May '23

01 May '23

Hi, I am trying to add ipa migrate-ds as a task using the command or shell module, but it keeps on erroring out. How should I parse this? ipa migrate-ds --bind-dn="cn=Directory Manager" --user-container=cn=users,cn=accounts --group-container=cn=groups,cn=accounts --group-objectclass=posixgroup --user-ignore-attribute={krbPrincipalName,krbextradata,krblastfailedauth,krblastpwdchange,krblastsuccessfulauth,krbloginfailedcount,krbpasswordexpiration,krbticketflags,krbpwdpolicyreference,mepManagedEntry} --user-ignore-objectclass mepOriginEntry --group-ignore-attribute=mepmanagedby --group-ignore-objectclass=mepmanagedEntry --with-compat ldap:// ipa.server.com Thanks! Tony

2 1

2025

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users May 2023