September 2023 - FreeIPA-users - Fedora Mailing-Lists

by Russ Long

I have a single-server IPA environment in my homelab. I noticed today that I was unable to delete a host from IPA, and found that pki-tomcatd was down and unable to start. I found that several certificates had expired for some reason. I tried `ipa-cert-fix`, but that failed as pki-tomcat will not start. I attempted to set the server date/time to a date 24 hours before the certificates expired, and was able to get tomcat to start, however the `ipa-cert-fix` now fails with this error: CalledProcessError(Command ['pki-server', 'cert-fix', '--ldapi-socket', '/run/slapd-IPA-DOMAIN-CO.socket', '--agent-uid', 'ipara', '--cert', 'sslserver', '--cert', 'subsystem', '--cert', 'ca_ocsp_signing', '--cert', 'ca_audit_signing', '--extra-cert', '16'] returned non-zero exit status 1: "INFO: Loading instance type: pki-tomcatd\nINFO: Loading instance: pki-tomcat\nINFO: Loading global Tomcat config: /etc/tomcat/tomcat.conf\nINFO: Loading PKI Tomcat config: /usr/share/pki/etc/tomcat.conf\nINFO: Loading instance Tomcat config: /etc/pki/pki-tomcat/tomcat.conf\nINFO: Loading password config: /etc/pki/pki-tomcat/password.conf\nINFO: Loading subsystem config: /etc/pki/pki-tomcat/ca/CS.cfg\nINFO: Loading subsystem registry: /etc/pki/pki-tomcat/ca/registry.cfg\nINFO: Loading instance registry: /etc/sysconfig/pki/tomcat/pki-tomcat/pki-tomcat\nINFO: Fixing the following system certs: ['sslserver', 'subsystem', 'ca_ocsp_signing', 'ca_audit_signing']\nINFO: Renewing the following additional c erts: ['16']\nINFO: Stopping the instance to proceed with system cert renewal\nINFO: Configuring LDAP connection for CA\nINFO: Setting pkidbuser password via ldappasswd\nSASL/EXTERNAL authentication started\nSASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth\nSASL SSF: 0\n") I reviewed the blog at https://floblanc.wordpress.com/2017/09/11/troubleshooting-freeipa-pki-tom... (Thanks Flo!) but was still unable to get anything working. The Certificate password test fails with these errors: [root@master ca]# certutil -K -d /etc/pki/pki-tomcat/alias -f /tmp/pwdfile.txt -n 'subsystemCert cert-pki-ca' certutil: Checking token "NSS Certificate DB" in slot "NSS User Private Key and Certificate Services" certutil: problem listing keys: SEC_ERROR_INVALID_ARGS: security library: invalid arguments. [root@master ca]# certutil -K -d /etc/pki/pki-tomcat/alias -f /tmp/pwdfile.txt -n 'NSS Certificate DB: subsystemCert cert-pki-ca' certutil: Checking token "NSS Certificate DB" in slot "NSS User Private Key and Certificate Services" certutil: problem listing keys: SEC_ERROR_INVALID_ARGS: security library: invalid arguments. Any ideas what I can try?

2 days

3
3
0 / 0

FreeIPA PKI Certs wont renew "Adjustment limit exceeded"

by T A

On FreeIPA version 4.6.8-5 realized that pki-tomcatd wouldnt start ipactl status pki-tomcatd Service: STOPPED Ran 'getcert list' and found the 'pki-tomcat' cert was expired Rolled back the system clock to before the cert expired, now starts up ipactl status pki-tomcatd Service: STARTED Tried to renew with 'ipa-getcert resubmit -i "123456"' but it shows "status: CA_UNREACHABLE" 'ipa-cert fix' didnt work either Checked logs again 'journalctl -t certmonger' and found 'ns-slapd' was giving out this error when it tried to renew 'csngen_adjust_local_time - Adjustment limit exceeded: value - 435060 limit - 86400' Any way to change the adjustment limit or force this cert to renew anyway?

2 days, 2 hours

3
6
3 / 0

FreeIPA not starting

by Francis Augusto Medeiros-Logeay

Hi, I have a FreeIPA on a VM that I use for testing. I had to take a pause on my work with it, and after a few months, when I turn on the machine, FreeIPA won’t start. I get this error: [Fri Sep 22 18:31:03.162384 2023] [wsgi:error] [pid 2433:tid 2433] ModuleNotFoundError: No module named 'ipaserver.plugins.' [Fri Sep 22 18:31:03.183566 2023] [wsgi:error] [pid 2434:tid 2434] ipa: ERROR: Failed to start IPA: No module named 'ipaserver.plugins.' [Fri Sep 22 18:31:03.183611 2023] [wsgi:error] [pid 2434:tid 2434] mod_wsgi (pid=2434): Failed to exec Python script file '/usr/share/ipa/wsgi.py'. [Fri Sep 22 18:31:03.183634 2023] [wsgi:error] [pid 2434:tid 2434] mod_wsgi (pid=2434): Exception occurred processing WSGI script '/usr/share/ipa/wsgi.py'. [Fri Sep 22 18:31:03.184501 2023] [wsgi:error] [pid 2434:tid 2434] Traceback (most recent call last): [Fri Sep 22 18:31:03.184797 2023] [wsgi:error] [pid 2434:tid 2434] File "/usr/share/ipa/wsgi.py", line 28, in <module> [Fri Sep 22 18:31:03.184805 2023] [wsgi:error] [pid 2434:tid 2434] application = create_application() [Fri Sep 22 18:31:03.184810 2023] [wsgi:error] [pid 2434:tid 2434] ^^^^^^^^^^^^^^^^^^^^ [Fri Sep 22 18:31:03.184819 2023] [wsgi:error] [pid 2434:tid 2434] File "/usr/lib/python3.11/site-packages/ipaserver/wsgi.py", line 51, in create_application [Fri Sep 22 18:31:03.184824 2023] [wsgi:error] [pid 2434:tid 2434] api.finalize() [Fri Sep 22 18:31:03.184831 2023] [wsgi:error] [pid 2434:tid 2434] File "/usr/lib/python3.11/site-packages/ipalib/plugable.py", line 753, in finalize [Fri Sep 22 18:31:03.184836 2023] [wsgi:error] [pid 2434:tid 2434] self.__do_if_not_done('load_plugins') [Fri Sep 22 18:31:03.184844 2023] [wsgi:error] [pid 2434:tid 2434] File "/usr/lib/python3.11/site-packages/ipalib/plugable.py", line 432, in __do_if_not_done [Fri Sep 22 18:31:03.184849 2023] [wsgi:error] [pid 2434:tid 2434] getattr(self, name)() [Fri Sep 22 18:31:03.184856 2023] [wsgi:error] [pid 2434:tid 2434] File "/usr/lib/python3.11/site-packages/ipalib/plugable.py", line 633, in load_plugins [Fri Sep 22 18:31:03.184860 2023] [wsgi:error] [pid 2434:tid 2434] self.add_package(package) [Fri Sep 22 18:31:03.184867 2023] [wsgi:error] [pid 2434:tid 2434] File "/usr/lib/python3.11/site-packages/ipalib/plugable.py", line 660, in add_package [Fri Sep 22 18:31:03.184872 2023] [wsgi:error] [pid 2434:tid 2434] module = importlib.import_module(name) [Fri Sep 22 18:31:03.184876 2023] [wsgi:error] [pid 2434:tid 2434] ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ [Fri Sep 22 18:31:03.184890 2023] [wsgi:error] [pid 2434:tid 2434] File "/usr/lib64/python3.11/importlib/__init__.py", line 126, in import_module [Fri Sep 22 18:31:03.184894 2023] [wsgi:error] [pid 2434:tid 2434] return _bootstrap._gcd_import(name[level:], package, level) [Fri Sep 22 18:31:03.184898 2023] [wsgi:error] [pid 2434:tid 2434] ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ [Fri Sep 22 18:31:03.184905 2023] [wsgi:error] [pid 2434:tid 2434] File "<frozen importlib._bootstrap>", line 1204, in _gcd_import [Fri Sep 22 18:31:03.184912 2023] [wsgi:error] [pid 2434:tid 2434] File "<frozen importlib._bootstrap>", line 1176, in _find_and_load [Fri Sep 22 18:31:03.184918 2023] [wsgi:error] [pid 2434:tid 2434] File "<frozen importlib._bootstrap>", line 1126, in _find_and_load_unlocked [Fri Sep 22 18:31:03.184925 2023] [wsgi:error] [pid 2434:tid 2434] File "<frozen importlib._bootstrap>", line 241, in _call_with_frames_removed [Fri Sep 22 18:31:03.184931 2023] [wsgi:error] [pid 2434:tid 2434] File "<frozen importlib._bootstrap>", line 1204, in _gcd_import [Fri Sep 22 18:31:03.184942 2023] [wsgi:error] [pid 2434:tid 2434] File "<frozen importlib._bootstrap>", line 1176, in _find_and_load [Fri Sep 22 18:31:03.184948 2023] [wsgi:error] [pid 2434:tid 2434] File "<frozen importlib._bootstrap>", line 1140, in _find_and_load_unlocked [Fri Sep 22 18:31:03.184964 2023] [wsgi:error] [pid 2434:tid 2434] ModuleNotFoundError: No module named 'ipaserver.plugins.’ This is weird, can you help me to get it back to a usable state? Best, Francis

2 days, 2 hours

2
2
0 / 0

Has anyone tried FreeIPA with RSA's SecurID® Authentication Agent for PAM ?

by White, Daniel E. (GSFC-770.0)[AEGIS]

Has anyone tried FreeIPA with RSA's SecurID® Authentication Agent for PAM ? https://community.rsa.com/t5/securid-authentication-agent-for/tkb-p/auth-...

2 days, 4 hours

1
0
0 / 0

Recovering from certificate exparation issues

by Cristian Le

I have tried my luck around with all the helpers: `pki-server cert-fix`, `ipa-cacert-manage`, `ipa-certupdate`, etc. but each one is failing on me for multiple reasons. - `ipa-cacert-manage` Cannot update the CA with `--external-cert-file` because the root ca is not detected to be in the trust list - `ipa-cert-fix` Was run without overlapping validity time, and the certificate were re-created, so now it is not recoverable, neither back in time, nor in current time - `pki-tomcat` is failing It is quite a mess and I would like to ask for some guidance on how one could recover manually from such dependency issues: - Is it possible to do a `ipa-server-install` and keep the user data? - If I sign all of the service's certificates manually, what are all of the manual steps needed to get the services back up so that the helpers can be run. - I've tried to install the CA certificate in the nssdb database, ldap, and /etc/ipa/ca.crt. Are there other locations? - I've recreated an httpd certificate signed by the root, but I can't figure how to do the same with the ones located in the nssdb database, i.e. to recreate a csr with the same data as one of the certificates there - What is the order of services that should be updated. My understanding is CA -> `certutil`'s CA -> httpd + slapd + pki-tomcat (not sure where the last one is or how to edit it) -> `ipa-certupdate`

2 days, 4 hours

2
4
0 / 0

How to I get FreeIPA running in Docker Swarm?

by Jay Smith

I have the following Setup. MK_INTERNAL_SUB_DOMAIN=example.test MK_FREEIPA_SERVER_REALM=EXAMPLE.TEST MK_FREEIPA_SERVER_DS_PASSWORD=password MK_FREEIPA_SERVER_ADMIN_PASSWORD=password MK_FREEIPA_SERVER_DNS_REVERSE_ZONE=0.18.172.in-addr.arpa MK_FREEIPA_SERVER_IP=172.18.0.10 MK_FREEIPA_SERVER_DOMAIN_NAME=ipa.example.test docker service create \ --hostname ${MK_FREEIPA_SERVER_DOMAIN_NAME} \ --name ipa \ --sysctl net.ipv6.conf.all.disable_ipv6=0 \ -e "IPA_SERVER_HOSTNAME=${MK_FREEIPA_SERVER_DOMAIN_NAME}" \ -e "IPA_SERVER_IP=${MK_FREEIPA_SERVER_IP}" \ -e "DEBUG_NO_EXIT=1" \ -e "DEBUG_TRACE=1" \ --ip "${MK_FREEIPA_SERVER_IP}" \ --add-host "${MK_FREEIPA_SERVER_DOMAIN_NAME}:${MK_FREEIPA_SERVER_IP}" \ -p "443:443" \ --privileged=true \ freeipa/freeipa-server:fedora-38-4.10.2 \ --skip-mem-check \ --domain=${MK_INTERNAL_SUB_DOMAIN} \ --realm=${MK_FREEIPA_SERVER_REALM} \ --ds-password=${MK_FREEIPA_SERVER_DS_PASSWORD} \ --ip-address=${MK_FREEIPA_SERVER_IP} \ --admin-password=${MK_FREEIPA_SERVER_ADMIN_PASSWORD} \ --no-host-dns \ --unattended \ --setup-dns \ --allow-zone-overlap \ --auto-reverse \ --reverse-zone=${MK_FREEIPA_SERVER_DNS_REVERSE_ZONE} \ --auto-forwarders \ --no-ntp The first problem is I can't run the container in privileged mode and --ip and --add-host options are missing. It is even possible to run FreeIPA in Docker Swarm?

2 days, 8 hours

1
0
1 / 0

Get running FreeIPA in Docker in Docker

by Jay Smith

For a test setup I try to get running a FreeIPA server within a docker container(DinD). But I get some errors and I don't know why. 1. Create docker in docker container => docker run --privileged -itd --name docker_swarm -v /sys/fs/cgroup:/sys/fs/cgroup docker 2. Connect to docker container and run the FreeIPA server => docker exec -it docker_swarm \ sh -c "docker run --sysctl net.ipv6.conf.all.disable_ipv6=0 --privileged=true --name ipa -ti -h ipa.example.test --cgroupns=host \ -v /sys/fs/cgroup:/sys/fs/cgroup:rw -v /tmp/freeipa-data:/data freeipa/freeipa-server:fedora-38-4.10.2 --skip-mem-check --no-ntp" The error I get is: docker: Error response from daemon: failed to create task for container: failed to create shim task: OCI runtime create failed: runc create failed: unable to start container process: unable to apply cgroup configuration: failed to write 670: write /sys/fs/cgroup/docker/3c2cc48a075d3f62143d70718aefe4c55938e4332262894e67f31328eaa5a006/cgroup.procs: no such file or directory: unknown. ERRO[0038] error waiting for container: The command is working outside of Docker in Docker. Maybe it is possible to deactivated all the cgroups stuff? I don't need all features of FreeIPA just certificates, authentication(LDAP), DNS, ...

2 days, 8 hours

3
3
2 / 0

Lost password for CA private key

by John Stokes

I have an IPA CA that is running fine for several years now. I also have two replicas installed. Today while creating a backup I realized I don't know the password for the file /root/cacert.p12 where the private key of the CA should be stored. The one I thought it should be (same as the pass for my admin user) does not seem to be working. Is there a way to reexport the private key of the CA? As I said everything is working fine and I have access to the server. If not how should I proceed? Should I destroy the whole CA and build a new one?

2 days, 12 hours

3
8
1 / 0

prevent 'sudo -i ' from executing

by Nathanaël Blanchet

Hello, I don't want my users to become root with simply executing the 'sudo -i' command so they can execute all root commands. Users should only execute with sudo the allowed defined commands. I'm able to prevent them from executing 'sudo su -', but I didn't find any informations about forbidding 'sudo -i'. Thank you for your help. -- Nathanaël Blanchet Administrateur Systèmes et Réseaux Service Informatique et REseau (SIRE) Département des systèmes d'information 227 avenue Professeur-Jean-Louis-Viala 34193 MONTPELLIER CEDEX 5 Tél. 33 (0)4 67 54 84 55 Fax 33 (0)4 67 54 84 14 blanchet(a)abes.fr

3 days, 1 hour

5
7
0 / 0

RedHat and 2FA Problem

by Sirio Sannipoli

Hello everyone, I've already done searches without success, I need someone to point me in the direction of resolving a strange behavior I'm experiencing on servers with the RedHat/Centos operating system. I have installed FreeIPA 4.10.1 on Oracle Linux 9 and all users by default have Radius authentication via a Cisco server, users can access via SSH to 100 Servers configured, we have OS of all types (Debian, RedHat, Centos, Ubuntu). The behavior I get is the following: Debian based distro: SSH Login and SUDO work perfectly using the Radius credentials RedHat based distro: SSH Login prompt ask for 2FA, first factor & second factor (optional) and i can login by entering the Radius credentials and using the same password 2 times, SUDO ask for 2FA and authentication fails when entering the same password 2 times. I don't understand if the problem is on the FreeIPA client or server or why there is a difference in behavior between Debian and RedHat systems. Can anyone give me directions to understand what's happening? Note: I have never set up 2FA authentication on the FreeIPA server, the users are correctly configured and the "ipa user-show" command confirms "User authentication types: radius", if i change user configuration with the password, everything works fine.

3 days, 2 hours

4
4
0 / 0

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users September 2023