September 2023 - FreeIPA-users - Fedora mailing-lists

Disabling Anonymous Binds - Hangs on Request - No Return to Prompt
by Marcelo Carvalho 28 Sep '23

28 Sep '23

Hi everyone I am trying on a development host to Disabling Anonymous Binds. I have ran the following command but it hangs and does not return a prompt. $ ldapmodify -x -D "cn=Directory Manager" -W -h 127.0.0.1 -p 389 -ZZ Enter LDAP Password: dn: cn=config changetype: modify replace: nsslapd-allow-anonymous-access nsslapd-allow-anonymous-access: rootdse Following instructions from: https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/ht… ipa --version: VERSION: 4.10.1, API_VERSION: 2.251 Red Hat Enterprise Linux" VERSION="9.2 Please, any advice? Many thanks Marcelo

6 10

IPA Upgrade failure during CA phase
by Vinícius Ferrão 27 Sep '23

27 Sep '23

Hello, After running yum update on a EL7.9 system FreeIPA was unable to start asking for manual upgrade. So I performed the required command, without success: [root@headnode pki]# ipa-server-upgrade Upgrading IPA:. Estimated time: 1 minute 30 seconds [1/9]: saving configuration [2/9]: disabling listeners [3/9]: enabling DS global lock [4/9]: disabling Schema Compat [5/9]: starting directory server [6/9]: updating schema [7/9]: upgrading server [8/9]: stopping directory server [9/9]: restoring configuration Done. Update complete Upgrading IPA services Upgrading the configuration of the IPA services [Verifying that root certificate is published] [Migrate CRL publish directory] CRL tree already moved [Verifying that CA proxy configuration is correct] IPA server upgrade failed: Inspect /var/log/ipaupgrade.log and run command ipa-server-upgrade manually. CA did not start in 300.0s The ipa-server-upgrade command failed. See /var/log/ipaupgrade.log for more information Tha /var/log/ipaupgrade.log file is 75k lines long, but looking at it after some hours I think the relevant data is the following: 2023-09-26T22:22:23Z DEBUG stdout=ERROR: No kra subsystem in instance pki-tomcat. 2023-09-26T22:22:35Z DEBUG stderr= 2023-09-26T22:22:35Z DEBUG Starting pki-tomcatd@pki-tomcat. 2023-09-26T22:22:35Z DEBUG Starting external process 2023-09-26T22:22:35Z DEBUG args=/bin/systemctl start pki-tomcatd(a)pki-tomcat.service 2023-09-26T22:22:36Z DEBUG Process finished, return code=0 2023-09-26T22:22:36Z DEBUG stdout= 2023-09-26T22:22:36Z DEBUG stderr= 2023-09-26T22:22:36Z DEBUG Starting external process 2023-09-26T22:22:36Z DEBUG args=/bin/systemctl is-active pki-tomcatd(a)pki-tomcat.service 2023-09-26T22:22:36Z DEBUG Process finished, return code=0 2023-09-26T22:22:36Z DEBUG stdout=active 2023-09-26T22:22:36Z DEBUG stderr= 2023-09-26T22:22:36Z DEBUG wait_for_open_ports: localhost [8080, 8443] timeout 300 2023-09-26T22:22:36Z DEBUG waiting for port: 8080 2023-09-26T22:22:36Z DEBUG Failed to connect to port 8080 tcp on ::1 2023-09-26T22:22:36Z DEBUG Failed to connect to port 8080 tcp on 127.0.0.1 2023-09-26T22:22:38Z DEBUG SUCCESS: port: 8080 2023-09-26T22:22:38Z DEBUG waiting for port: 8443 2023-09-26T22:22:38Z DEBUG SUCCESS: port: 8443 2023-09-26T22:22:38Z DEBUG Start of pki-tomcatd(a)pki-tomcat.service complete 2023-09-26T22:22:38Z DEBUG Waiting until the CA is running 2023-09-26T22:22:38Z DEBUG request POST http://DOMAIN:8080/ca/admin/ca/getStatus 2023-09-26T22:22:38Z DEBUG request body '' 2023-09-26T22:22:42Z DEBUG response status 500 2023-09-26T22:22:42Z DEBUG response headers Server: Apache-Coyote/1.1 2023-09-26T22:22:42Z DEBUG response body '<html><head><title>Apache Tomcat/7.0.76 - Error report</title><style></style> </head><body><h1>HTTP Status 500 - Subsystem unavailable</h1><HR size="1" noshade="noshade"><p><b>type</b> Exception report</p><p><b>message</b> <u>Subsystem unavailable</u></p><p><b>description</b> <u>The server encountered an internal error that prevented it from fulfilling this request.</u></p><p><b>exception</b> <pre>javax.ws.rs.ServiceUnavailableException: Subsystem unavailable\n\tcom.netscape.cms.tomcat.ProxyRealm.findSecurityConstraints(ProxyRealm.java:145)\n\torg.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:492)\n\torg.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:103)\n\torg.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:962)\n\torg.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:445)\n\torg.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1091)\n\torg.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:637)\n\torg.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:316)\n\tjava.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)\n\tjava.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)\n\torg.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)\n\tjava.lang.Thread.run(Thread.java:750)\n</pre></p><p><b>note</b> <u>The full stack trace of the root cause is available in the Apache Tomcat/7.0.76 logs.</u></p><HR size="1" noshade="noshade"><h3>Apache Tomcat/7.0.76</h3></body></html>' 2023-09-26T22:22:42Z DEBUG The CA status is: check interrupted due to error: Retrieving CA status failed with status 500 2023-09-26T22:22:42Z DEBUG Waiting for CA to start… So it seems that the CA is broken. On /var/log/pki; I can find this: cat pki-server-upgrade-10.5.* Upgrading PKI server configuration at Mon Sep 18 01:38:43 -03 2023. Upgrading from version 10.5.9 to 10.5.17: 1. Update audit events Upgrading from version 10.5.17 to 10.5.18: 1. Fix EC admin certificate profile Upgrading from version 10.5.18 to 10.5.18: 1. Add caAuditSigningCert profile 2. Fix the authentication for caServerKeygen_UserCert profile ERROR: [Errno 2] No such file or directory: '/var/lib/pki/pki-tomcat/ca/profiles/ca/caServerKeygen_UserCert.cfg' Failed upgrading pki-tomcat/ca subsystem. Upgrade failed in pki-tomcat/ca: [Errno 2] No such file or directory: '/var/lib/pki/pki-tomcat/ca/profiles/ca/caServerKeygen_UserCert.cfg' Continue (Yes/No) [Y]? Traceback (most recent call last): File "/sbin/pki-server-upgrade", line 211, in <module> main(sys.argv) File "/sbin/pki-server-upgrade", line 204, in main upgrader.upgrade() File "/usr/lib/python2.7/site-packages/pki/upgrade.py", line 623, in upgrade self.upgrade_version(version) File "/usr/lib/python2.7/site-packages/pki/upgrade.py", line 613, in upgrade_version case_sensitive=False).lower() File "/usr/lib/python2.7/site-packages/pki/__init__.py", line 142, in read_text value = input(message) EOFError: EOF when reading a line But nothing more. Any ideia of what I should be looking for? Thanks.

2 1

Keytab issues after upgrade to Fedora 38
by Djerk Geurts 27 Sep '23

27 Sep '23

Today was my second attempt to lift FreeIPA servers to Fedora 38 from 37. Again it failed. Sync and healthchecks were fine, but an (admin) user can't log into the WebUI and can't do sudo. Login works because I do key based authentication. Kinit admin works, but kinit alone doesn't. I have a hunch that a keytab gets corrupted somewhere, but I'm baffled as to why this wouldn't present as different errors. Has anyone experienced similar issues? I've rolled the servers back, so don't have much in the way of logs at the moment.

2 1

Error during ipa-replica-install on RHEL 9
by Michal Konecny 27 Sep '23

27 Sep '23

Hi everyone, I'm currently trying to update Fedora IPA installation on staging from RHEL 8 to RHEL 9. I'm using this guide https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/ht… for it. I'm currently stuck on error "RuntimeError: Failed to start replication" and I don't see anything strange in the logs. Here is the log from `ipa-replica-install` run: https://paste.centos.org/view/a0e2c2b9 . Maybe somebody here will know what seems to be the problem. For those interested the ticket for this work is here https://pagure.io/fedora-infrastructure/issue/10358 Michal

3 6

FreeIpa LDAP authentication
by Duarte Petiz 27 Sep '23

27 Sep '23

Hey everyone! I have been using freeipa since 2 months ago. Now i asked for an internal pentest and the pentesters found this: Without authentication they can obtain information about our freeipa (that uses ldap as backend as you know). ldapsearch -x -b "dc=example,dc=com" -H ldap://10.0.0.9:389 "(objectClass=*)" There is any way to protect it? How can I achieve that? -- *Kind Regards* *Duarte Petiz* *DevOps Team Lead *| jscrambler.com

1 1

Disabling Anonymous Binds - Hangs on Request - No Return to Prompt
by Marcelo Carvalho 26 Sep '23

26 Sep '23

Hi everyone I am trying on a development host to Disabling Anonymous Binds. I have ran the following command but it hangs and does not return a prompt. $ ldapmodify -x -D "cn=Directory Manager" -W -h 127.0.0.1 -p 389 -ZZ Enter LDAP Password: dn: cn=config changetype: modify replace: nsslapd-allow-anonymous-access nsslapd-allow-anonymous-access: rootdse Following instructions from: https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/ht… ipa --version: VERSION: 4.10.1, API_VERSION: 2.251 Red Hat Enterprise Linux" VERSION="9.2 Please, any advice? Many thanks Marcelo

1 0

How to set the "no_auth_data_required" Kerberos option on a principal?
by Julien Fremont 26 Sep '23

26 Sep '23

Hi everyone, I'm currently setting up a FreeIPA based central repository for our small business (few users, but a number of VMs and attached services) with 3 IPA servers. As we are a Linux-centric company, FreeIPA seems to be a good fit for our use. Everything seems to work expected, except regarding our Synology NAS and its NFSv4 shares. If I don’t set the automount to use Kerberos (no ‘-sec=krb5’ parameter), the NFS share works without a itch. But if I do, it seems that said NAS doesn’t to manage Kerberos well. Every time I try to connect a client to a NFS share, DSM more or less hang-up with a svcgssd process pegging up at 100% CPU. The webui lock-up, most of the command-line stop working properly, etc. This appears to be a relatively well-known issue with svcgssd as noted here for example: https://bugs.launchpad.net/ubuntu/+source/nfs-utils/+bug/1466654 https://linux-nfs.vger.kernel.narkive.com/rpgli1dr/question-re-no-auth-data… The fix seems relatively simple, as I just need to set the "no_auth_data_required" setting on the affected Kerberos principal on the FreeIPA side. The problem is, how do I do this? For a standalone KDC server, it looks like this command should do the trick: → kadmin -p "admin(a)INTERNAL.DOMAIN.ORG" modify_principal +no_auth_data_required "nfs/nas.domain.tld(a)INTERNAL.DOMAIN.ORG" But from what I understand, using kadmin directly with FreeIPA is not an option. But how to set "no_auth_data_required" option with FreeIPA is not clear to me. Can anyone direct me to a solution? For reference: → The NAS is a Synology RS2421RP+ running DSM 7.2-64570 Update 3 (the latest). Its kernel is 4.4.302+ → We are running FreeIPA 4.10.1 → The 3 FreeIPA server run on Rocky Linux 9.2 → The current test client is a Rocky Linux 8.7 VM, but we have a variety of Linux flavor in our environment. → We do not have an Active Directory server and do not plan to add one. → This FreeIPA deployment is still at an early stage of deployment. → I have no previous experience with FreeIPA, LDAP or Kerberos, nor with AD. Regards, Julien Fremont

2 2

Recovering from certificate exparation issues
by Cristian Le 26 Sep '23

26 Sep '23

I have tried my luck around with all the helpers: `pki-server cert-fix`, `ipa-cacert-manage`, `ipa-certupdate`, etc. but each one is failing on me for multiple reasons. - `ipa-cacert-manage` Cannot update the CA with `--external-cert-file` because the root ca is not detected to be in the trust list - `ipa-cert-fix` Was run without overlapping validity time, and the certificate were re-created, so now it is not recoverable, neither back in time, nor in current time - `pki-tomcat` is failing It is quite a mess and I would like to ask for some guidance on how one could recover manually from such dependency issues: - Is it possible to do a `ipa-server-install` and keep the user data? - If I sign all of the service's certificates manually, what are all of the manual steps needed to get the services back up so that the helpers can be run. - I've tried to install the CA certificate in the nssdb database, ldap, and /etc/ipa/ca.crt. Are there other locations? - I've recreated an httpd certificate signed by the root, but I can't figure how to do the same with the ones located in the nssdb database, i.e. to recreate a csr with the same data as one of the certificates there - What is the order of services that should be updated. My understanding is CA -> `certutil`'s CA -> httpd + slapd + pki-tomcat (not sure where the last one is or how to edit it) -> `ipa-certupdate`

3 6

automount keys on multiple domains
by Nathanaël Blanchet 25 Sep '23

25 Sep '23

Hello, I have a trusted AD domain levant.abes.fr I'm trying to get my to auto.home map get working with automount keys. Everything is ok with the wildcard on the trusted domain * vm701-dev.couchant.abes.fr:/export/home/levant.abes.fr/& In addition to this, is there a way to do the same with the IPA domain knowing that the '*' key already exists? Second question: the same user may exist on both domains. how should I format the key to determine which domain I want the mapping for(I already tried with user@domain as the key but it doesn't work) Thank you by advance (I hope to be clear enough) -- Nathanaël Blanchet Administrateur Systèmes et Réseaux Service Informatique et REseau (SIRE) Département des systèmes d'information 227 avenue Professeur-Jean-Louis-Viala 34193 MONTPELLIER CEDEX 5 Tél. 33 (0)4 67 54 84 55 Fax 33 (0)4 67 54 84 14 blanchet(a)abes.fr

1 0

How to I get FreeIPA running in Docker Swarm?
by Jay Smith 25 Sep '23

25 Sep '23

I have the following Setup. MK_INTERNAL_SUB_DOMAIN=example.test MK_FREEIPA_SERVER_REALM=EXAMPLE.TEST MK_FREEIPA_SERVER_DS_PASSWORD=password MK_FREEIPA_SERVER_ADMIN_PASSWORD=password MK_FREEIPA_SERVER_DNS_REVERSE_ZONE=0.18.172.in-addr.arpa MK_FREEIPA_SERVER_IP=172.18.0.10 MK_FREEIPA_SERVER_DOMAIN_NAME=ipa.example.test docker service create \ --hostname ${MK_FREEIPA_SERVER_DOMAIN_NAME} \ --name ipa \ --sysctl net.ipv6.conf.all.disable_ipv6=0 \ -e "IPA_SERVER_HOSTNAME=${MK_FREEIPA_SERVER_DOMAIN_NAME}" \ -e "IPA_SERVER_IP=${MK_FREEIPA_SERVER_IP}" \ -e "DEBUG_NO_EXIT=1" \ -e "DEBUG_TRACE=1" \ --ip "${MK_FREEIPA_SERVER_IP}" \ --add-host "${MK_FREEIPA_SERVER_DOMAIN_NAME}:${MK_FREEIPA_SERVER_IP}" \ -p "443:443" \ --privileged=true \ freeipa/freeipa-server:fedora-38-4.10.2 \ --skip-mem-check \ --domain=${MK_INTERNAL_SUB_DOMAIN} \ --realm=${MK_FREEIPA_SERVER_REALM} \ --ds-password=${MK_FREEIPA_SERVER_DS_PASSWORD} \ --ip-address=${MK_FREEIPA_SERVER_IP} \ --admin-password=${MK_FREEIPA_SERVER_ADMIN_PASSWORD} \ --no-host-dns \ --unattended \ --setup-dns \ --allow-zone-overlap \ --auto-reverse \ --reverse-zone=${MK_FREEIPA_SERVER_DNS_REVERSE_ZONE} \ --auto-forwarders \ --no-ntp The first problem is I can't run the container in privileged mode and --ip and --add-host options are missing. It is even possible to run FreeIPA in Docker Swarm?

2 1

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users September 2023