July 2023 - FreeIPA-users - Fedora mailing-lists

For automember rules is there any documentation about the regex library that is in use?
by Chris Cowan 14 Jul '23

14 Jul '23

I created some rules, and they worked as expected, but there's no guidance that I can find of which metacharacters are supported. Perhaps if I knew they were using the perl regex library, or whatever that might help. Also, it seems like the inclusive rules are OR'ed together, but that is not discussed either. I may not be looking in the right places for documentation. So, far I have found that this worked as expected. departmentnumber = ^(ABC|DEF|GHI) And I was able to accomplish the same thing with 3 distinct rules. Just wondering what flexibility, I have here.

2 1

ipa-replica-manage dnanextrange-del ?
by Harald Dunkel 12 Jul '23

12 Jul '23

Hi folks, being tired I have set a dnanextrange on 2 servers, instead of a dnarange. Very painful. Now our favorite ID range is blocked. Is there some kind of ipa-replica-manage dnanextrange-del to drop a dnanextrange and to return it to the available pool of IDs? Every helpful comment is highly appreciated. Harri

2 1

AccountPolicy erroring for some users
by LUCAS GUILHERME DIEDRICH 12 Jul '23

12 Jul '23

Hey, Since i updated to the lastest Freeipa version (IPA, version: 4.10.1), i started noticing some error in the 389 error.log. [11/Jul/2023:13:50:20.591388308 -0300] - ERR - acct_update_login_history - Modify error 20 on entry 'uid=xyz,cn=users,cn=accounts,dc=unila,dc=intranet' [11/Jul/2023:13:51:52.993254666 -0300] - ERR - attrlist_replace - attr_replace (lastLoginHistory, 20230710114037Z) failed. [11/Jul/2023:13:51:52.995079255 -0300] - ERR - attrlist_replace - attr_replace (lastLoginHistory, 20230710114037Z) failed. [11/Jul/2023:13:51:53.014918310 -0300] - ERR - acct_update_login_history - Modify error 20 on entry 'uid=abc,cn=users,cn=accounts,dc=unila,dc=intranet' [11/Jul/2023:13:52:12.898523693 -0300] - ERR - attrlist_replace - attr_replace (lastLoginHistory, 20230711165203Z) failed. [11/Jul/2023:13:52:12.901073197 -0300] - ERR - attrlist_replace - attr_replace (lastLoginHistory, 20230711165203Z) failed. [11/Jul/2023:13:52:12.914936792 -0300] - ERR - acct_update_login_history - Modify error 20 on entry 'uid=abc,cn=users,cn=accounts,dc=unila,dc=intranet' [11/Jul/2023:13:52:21.897598474 -0300] - ERR - attrlist_replace - attr_replace (lastLoginHistory, 20230711165144Z) failed. [11/Jul/2023:13:52:21.899560503 -0300] - ERR - attrlist_replace - attr_replace (lastLoginHistory, 20230711165144Z) failed. [11/Jul/2023:13:52:21.913459796 -0300] - ERR - acct_update_login_history - Modify error 20 on entry 'uid=xyz,cn=users,cn=accounts,dc=unila,dc=intranet' [11/Jul/2023:13:52:42.939623733 -0300] - ERR - attrlist_replace - attr_replace (lastLoginHistory, 20230710221057Z) failed. [11/Jul/2023:13:52:42.942050331 -0300] - ERR - attrlist_replace - attr_replace (lastLoginHistory, 20230710221057Z) failed. [11/Jul/2023:13:52:42.955004117 -0300] - ERR - acct_update_login_history - Modify error 20 on entry 'fqdn=hostname.unila.intranet,cn=computers,cn=accounts,dc=unila,dc=intranet' I'm not sure why this is happening and how can i fix this, unfortunetly i'm using the account_plugin to update the last auth date via LDAP, but the field lastLoginHistory seems to be something added in the lastest releases. I have 3 replicas, but the account_plugin is enabled only in the machines which is currently erroring. Any ideas how to fix this? Thanks.

4 4

ipa-csreplica-manage -v list: duplicate replica ID detected
by Harald Dunkel 11 Jul '23

11 Jul '23

Hi folks, I have almost completed the FreeIPA migration from CentOS7 to Rocky8 (FreeIPA 4.9.11). Domain replications seems to be fine, but I get a replication error for ca: [root@ipa2 ~]# ipa-csreplica-manage -v list ipaca8.example.com Directory Manager password: ipa2.example.com last init status: Error (0) Total update succeeded last init ended: 2023-07-08 14:35:09+00:00 last update status: Error (0) Replica acquired successfully: Incremental update succeeded last update ended: 2023-07-08 16:20:37+00:00 ipabak.ac.example.com last init status: Error (0) Total update succeeded last init ended: 2023-07-08 16:06:05+00:00 last update status: Error (0) Replica acquired successfully: Incremental update succeeded last update ended: 2023-07-08 16:20:37+00:00 ipa0.example.com last update status: Error (0) Replica acquired successfully: Incremental update succeeded last update ended: 2023-07-08 16:20:37+00:00 [root@ipa2 ~]# ipa-csreplica-manage -v list ipa2.example.com Directory Manager password: ipaca8.example.com last update status: Error (11) Replication error acquiring replica: Unable to acquire replica: the replica has the same Replica ID as this one. Replication is aborting. (duplicate replica ID detected) last update ended: 2023-07-08 15:03:47+00:00 ipa1.example.com last update status: Error (0) Replica acquired successfully: Incremental update succeeded last update ended: 2023-07-08 16:20:40+00:00 Obviously replication between ipaca8 (the CA) amd ipa2 is bad. Here is the topology for ca: [root@ipa2 ~]# ipa topologysegment-find ca | sed s/aixigo.de/example.com/g ------------------ 5 segments matched ------------------ Segment name: ipa0.example.com-to-ipa1.example.com Left node: ipa0.example.com Right node: ipa1.example.com Connectivity: both Segment name: ipa0.example.com-to-ipaca8.example.com Left node: ipa0.example.com Right node: ipaca8.example.com Connectivity: both Segment name: ipa1.example.com-to-ipa2.example.com Left node: ipa1.example.com Right node: ipa2.example.com Connectivity: both Segment name: ipa2.example.com-to-ipaca8.example.com Left node: ipa2.example.com Right node: ipaca8.example.com Connectivity: both Segment name: ipabak.ac.example.com-to-ipaca8.example.com Left node: ipabak.ac.example.com Right node: ipaca8.example.com Connectivity: both ---------------------------- Number of entries returned 5 ---------------------------- Every helpful hint is highly appreciated Harri

2 3

Limiting access to GUI
by Entrepreneur AJ 10 Jul '23

10 Jul '23

Hey all, I have a wan facing install due to many of my team operating with mobile phone hotspots whilst visiting customers. An Issue I'm having is I want to restrict the GUI to only our admin team's IP address but editing the Apache Config with; # webUI is now completely static, and served out of that directory Alias /ipa/ui "/usr/share/ipa/ui" <Directory "/usr/share/ipa/ui"> SetHandler None AllowOverride None Satisfy Any Require all granted ExpiresActive On ExpiresDefault "access plus 1 year" <FilesMatch "(index.html|loader.js|login.html|reset_password.html)"> ExpiresDefault "access plus 0 seconds" </FilesMatch> Order allow,deny Allow from <ADMIN IP RANGE> </Directory> Is still allowing anyone with a browser to reach the IPA gui. We have Keycloak in place for staff and users to update their passwords. Any pointers? I would personally prefer to firewall it off but that effects other IPA features.

2 5

Help-Installing Third-Party Certificates for HTTP or LDAP
by Polavarapu Manideep Sai 10 Jul '23

10 Jul '23

Hi Team, I have generated central.csr and central.key in my ipa server and shared this central.csr to third-party certificate authority and i got certificates from certificate authority with two directories one as apache directory and it's certificates are 1f1f7ab616938168.crt, 1f1f7ab616938168.pem and gd_bundle-g2-g1.crt and another directory with tomcat name and its certficates are 1f1f7ab616938168.crt, 1f1f7ab616938168.pem, gd_bundle-g2-g1.crt and gdig2.crt.pem, now i want to install these certficates in my ipa server can you please guide on the same ? I tried this, but getting the below error, can you please share the steps to install this SSL certficates [root@ Apache]# ipa --version VERSION: 4.5.0, API_VERSION: 2.228 ipa-server-certinstall --http --dirsrv ssl.key ssl.crt [root@Apache]# ipa-server-certinstall --http --dirsrv central.key gd_bundle-g2-g1.crt Directory Manager password: Enter private key unlock password: No matching certificate found for private key from central.key Regards Sai ________________________________ DISCLAIMER: The information in this message is confidential and may be legally privileged. It is intended solely for the addressee. Access to this message by anyone else is unauthorized. If you are not the intended recipient, any disclosure, copying, or distribution of the message, or any action or omission taken by you in reliance on it, is prohibited and may be unlawful. Please immediately contact the sender if you have received this message in error. Further, this e-mail may contain viruses and all reasonable precaution to minimize the risk arising there from is taken by OnMobile. OnMobile is not liable for any damage sustained by you as a result of any virus in this e-mail. All applicable virus checks should be carried out by you before opening this e-mail or any attachment thereto. Thank you - OnMobile Global Limited.

3 10

Propose "SSLOCSPEnable on no_ocsp_for_cert_ok" alternative to "off" when enabling smartcard (client cert) auth
by Jernej Jakob 10 Jul '23

10 Jul '23

The "ipa-advise config-client-for-smart-card-auth" script enables OCSP checks in httpd, the RHEL docs say to disable it if the client certificates don't have an OCSP responder URL (third-party CA). [1] Apache httpd has an undocumented flag "no_ocsp_for_cert_ok" which will pass certificates without OCSP URLs as valid but still perform OCSP server checks for certificates that do have an OCSP URL. [2][3] [1] https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/ht… [2] https://bz.apache.org/bugzilla/show_bug.cgi?id=62112 [3] https://svn.apache.org/viewvc/httpd/httpd/tags/2.4.57/modules/ssl/ssl_engin…

2 1

pki-tomcatd service stopped
by Polavarapu Manideep Sai 07 Jul '23

07 Jul '23

Hi Team, As we checked pki-tomcatd service was stopped, couldn't possible to set the clock back as other certificates will not valid PFB details, please let us know if more details required on this As you can see Unable to communicate with CMS (404) when performed ipa cert-show for the serial no , ipa version is VERSION: 4.5.0 Please guide us to proceed further [root@sai ~]# certutil -L -d /etc/pki/pki-tomcat/alias -n "Server-Cert cert-pki-ca" |grep -i after Not After : Mon Jan 10 06:35:46 2022 [root@sai ~]# [root@sai ~]# certutil -L -d /etc/pki/pki-tomcat/alias -n "Server-Cert cert-pki-ca" |grep -i before Not Before: Tue Jan 21 06:35:46 2020 [root@sai ~]# [root@sai ~]# [root@sai ~]# certutil -L -d /etc/pki/pki-tomcat/alias -n "Server-Cert cert-pki-ca" |grep -i serial Serial Number: 80 (0x50) [root@sai ~]# [root@sai ~]# [root@sai ~]# ipa cert-show 80 ipa: ERROR: Certificate operation cannot be completed: Unable to communicate with CMS (404) [root@sai ~]# [root@sai ~]# [root@sai ~]# # Not possible to reset clock back , because other certificates were not valid [root@sai ~]# [root@sai ~]# [root@sai ~]# [root@sai ~]# ipa --version VERSION: 4.5.0, API_VERSION: 2.228 [root@sai ~]# [root@sai ~]# Regards Sai ________________________________ DISCLAIMER: The information in this message is confidential and may be legally privileged. It is intended solely for the addressee. Access to this message by anyone else is unauthorized. If you are not the intended recipient, any disclosure, copying, or distribution of the message, or any action or omission taken by you in reliance on it, is prohibited and may be unlawful. Please immediately contact the sender if you have received this message in error. Further, this e-mail may contain viruses and all reasonable precaution to minimize the risk arising there from is taken by OnMobile. OnMobile is not liable for any damage sustained by you as a result of any virus in this e-mail. All applicable virus checks should be carried out by you before opening this e-mail or any attachment thereto. Thank you - OnMobile Global Limited.

3 5

migrating CA renewal server to RHEL 8 (using an external root CA)
by Harald Dunkel 06 Jul '23

06 Jul '23

Hi folks, https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/ht… describes how to move the CA renewal server from RHEL 7 to a new host with RHEL 8, apparently for using a self-signed root CA. Is this the same procedure for using an external root CA? Do I have to create a CSR for the new host first, to be signed by the external CA, and then import it? Sorry for asking, but I have the impression this detail is missing in RedHat's documentation. Every insightful comment is highly appreciated. Harri

2 1

PKINIT questions
by alexey safonov 06 Jul '23

06 Jul '23

Hi, I've a FreeIPA setup 4.10.1 (that's a long-living setup that was upgraded many times). It is CA-less setup (Inititally we had CA, but than it was removed). So now 4 of my servers are saying that PKINIT is enabled and one server is saying "disabled". I tried to re-install replica, but it says CA-less mode can't issue a certificate, so I tried with kdc-cert-file, but than it says cert is not valid (where it's definitly works for web and ldap). Anything I can do here and enable pkinit on that replica? Alex

3 5

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users July 2023