September 2023 - FreeIPA-users - Fedora mailing-lists

Another Cert Expiration Problem
by Russ Long 25 Sep '23

25 Sep '23

I have a single-server IPA environment in my homelab. I noticed today that I was unable to delete a host from IPA, and found that pki-tomcatd was down and unable to start. I found that several certificates had expired for some reason. I tried `ipa-cert-fix`, but that failed as pki-tomcat will not start. I attempted to set the server date/time to a date 24 hours before the certificates expired, and was able to get tomcat to start, however the `ipa-cert-fix` now fails with this error: CalledProcessError(Command ['pki-server', 'cert-fix', '--ldapi-socket', '/run/slapd-IPA-DOMAIN-CO.socket', '--agent-uid', 'ipara', '--cert', 'sslserver', '--cert', 'subsystem', '--cert', 'ca_ocsp_signing', '--cert', 'ca_audit_signing', '--extra-cert', '16'] returned non-zero exit status 1: "INFO: Loading instance type: pki-tomcatd\nINFO: Loading instance: pki-tomcat\nINFO: Loading global Tomcat config: /etc/tomcat/tomcat.conf\nINFO: Loading PKI Tomcat config: /usr/share/pki/etc/tomcat.conf\nINFO: Loading instance Tomcat config: /etc/pki/pki-tomcat/tomcat.conf\nINFO: Loading password config: /etc/pki/pki-tomcat/password.conf\nINFO: Loading subsystem config: /etc/pki/pki-tomcat/ca/CS.cfg\nINFO: Loading subsystem registry: /etc/pki/pki-tomcat/ca/registry.cfg\nINFO: Loading instance registry: /etc/sysconfig/pki/tomcat/pki-tomcat/pki-tomcat\nINFO: Fixing the following system certs: ['sslserver', 'subsystem', 'ca_ocsp_signing', 'ca_audit_signing']\nINFO: Renewing the following additional c erts: ['16']\nINFO: Stopping the instance to proceed with system cert renewal\nINFO: Configuring LDAP connection for CA\nINFO: Setting pkidbuser password via ldappasswd\nSASL/EXTERNAL authentication started\nSASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth\nSASL SSF: 0\n") I reviewed the blog at https://floblanc.wordpress.com/2017/09/11/troubleshooting-freeipa-pki-tomca… (Thanks Flo!) but was still unable to get anything working. The Certificate password test fails with these errors: [root@master ca]# certutil -K -d /etc/pki/pki-tomcat/alias -f /tmp/pwdfile.txt -n 'subsystemCert cert-pki-ca' certutil: Checking token "NSS Certificate DB" in slot "NSS User Private Key and Certificate Services" certutil: problem listing keys: SEC_ERROR_INVALID_ARGS: security library: invalid arguments. [root@master ca]# certutil -K -d /etc/pki/pki-tomcat/alias -f /tmp/pwdfile.txt -n 'NSS Certificate DB: subsystemCert cert-pki-ca' certutil: Checking token "NSS Certificate DB" in slot "NSS User Private Key and Certificate Services" certutil: problem listing keys: SEC_ERROR_INVALID_ARGS: security library: invalid arguments. Any ideas what I can try?

4 5

Re: Plans for integrating DHCP
by Charles Hedrick 25 Sep '23

25 Sep '23

We did most of this, and have been using it for a few years. However it depends upon the ISC DHCP server, which is now EOL. The replacement, KEA, does not support LDAP, and there are no plans for it to. I think the reason is that they didn't want to put dynamic addresses in LDAP, because LDAP is thought of as read-mostly. The way LDAP is used in IPA, of course, means there are lots of changes going on. For most sites, I suspect putting leases in LDAP would be OK. But ISC isn't going to help, I don't think. ________________________________ From: Ellsworth, Nathan Andrew via FreeIPA-users <freeipa-users(a)lists.fedorahosted.org> Sent: Monday, September 25, 2023 2:09 PM To: freeipa-users(a)lists.fedorahosted.org <freeipa-users(a)lists.fedorahosted.org> Cc: Ellsworth, Nathan Andrew <Nathan.Ellsworth(a)UTDallas.edu> Subject: [Freeipa-users] Re: Plans for integrating DHCP There is an interesting design document already for DHCP with FreeIPA. https://www.freeipa.org/page/DHCP_Integration_Design

1 0

Re: Plans for integrating DHCP
by Ellsworth, Nathan Andrew 25 Sep '23

25 Sep '23

There is an interesting design document already for DHCP with FreeIPA. https://www.freeipa.org/page/DHCP_Integration_Design

1 0

Documentation on Upgrade FreeIPA to use TLS
by Marcelo Carvalho 25 Sep '23

25 Sep '23

Hi everybody. I am back in charge of some freeipa servers and would like to check for best documentation on upgrading FreeIPA to use TLS. I have found: https://access.redhat.com/documentation/en-us/red_hat_openstack_platform/16… Is this the best I can find? Please any hint? Many thanks Marcelo

3 4

FreeIPA Trust with Microsoft Active Directory Domain Controllers.
by Marcelo Carvalho 25 Sep '23

25 Sep '23

I need to create a trust between a MS Domain Controller and my FreeIPA. Documentation I found is https://www.freeipa.org/page/Active_Directory_trust_setup Can anybody confirm that the above is the most recommended documentation related to FreeIPA Trust with Microsoft Active Directory Domain Controllers? Are there other documentation I should take in consideration? Please advise. Many thanks. Marcelo

3 2

Get running FreeIPA in Docker in Docker
by Jay Smith 25 Sep '23

25 Sep '23

For a test setup I try to get running a FreeIPA server within a docker container(DinD). But I get some errors and I don't know why. 1. Create docker in docker container => docker run --privileged -itd --name docker_swarm -v /sys/fs/cgroup:/sys/fs/cgroup docker 2. Connect to docker container and run the FreeIPA server => docker exec -it docker_swarm \ sh -c "docker run --sysctl net.ipv6.conf.all.disable_ipv6=0 --privileged=true --name ipa -ti -h ipa.example.test --cgroupns=host \ -v /sys/fs/cgroup:/sys/fs/cgroup:rw -v /tmp/freeipa-data:/data freeipa/freeipa-server:fedora-38-4.10.2 --skip-mem-check --no-ntp" The error I get is: docker: Error response from daemon: failed to create task for container: failed to create shim task: OCI runtime create failed: runc create failed: unable to start container process: unable to apply cgroup configuration: failed to write 670: write /sys/fs/cgroup/docker/3c2cc48a075d3f62143d70718aefe4c55938e4332262894e67f31328eaa5a006/cgroup.procs: no such file or directory: unknown. ERRO[0038] error waiting for container: The command is working outside of Docker in Docker. Maybe it is possible to deactivated all the cgroups stuff? I don't need all features of FreeIPA just certificates, authentication(LDAP), DNS, ...

4 4

Migration of DNS Zones and it's records from one FreeIPA server to other
by Srikanth C 25 Sep '23

25 Sep '23

Hi, I am looking for the process to migrate the DNS Zones and it's records from one FreeIPA to other FreeIPA server. I have gone through the documentation but didn't find any automated way for this. Any idea how can we migrate? Thanks.

2 1

Managing FreeIPA installations without Trusts between them
by dweller dweller 25 Sep '23

25 Sep '23

We have a requirement to segregate different types of users, including customers, administrators, clients, and infrastructure hosts, into separate realms or unique IPA installations. While this is potentially feasible through the Trust feature, considering its ongoing development state, we're looking for alternative solutions. (see pic https://imgur.com/a/uqtbjly) Our objectives are: 1) Admin users within the ADMIN.NOVALOCAL realm should secure sudo access to hosts within the realms of CUSTOMER1.NOVALOCAL and CUSTOMER2.NOVALOCAL. 2) Admin users should also possess the capability to manage IPA entities within both customer installations of FreeIPA. We possess a rudimentary understanding of how to tackle the second objective. However, for the first one, our strategy is less clear. One available method is to instantiate hosts with a custom PAM configuration and administer access to administrators via the pam_ldap module. But we are also open to better suggestions if anyone can put forward.

2 3

FreeIPA PKI Certs wont renew "Adjustment limit exceeded"
by T A 22 Sep '23

22 Sep '23

On FreeIPA version 4.6.8-5 realized that pki-tomcatd wouldnt start ipactl status pki-tomcatd Service: STOPPED Ran 'getcert list' and found the 'pki-tomcat' cert was expired Rolled back the system clock to before the cert expired, now starts up ipactl status pki-tomcatd Service: STARTED Tried to renew with 'ipa-getcert resubmit -i "123456"' but it shows "status: CA_UNREACHABLE" 'ipa-cert fix' didnt work either Checked logs again 'journalctl -t certmonger' and found 'ns-slapd' was giving out this error when it tried to renew 'csngen_adjust_local_time - Adjustment limit exceeded: value - 435060 limit - 86400' Any way to change the adjustment limit or force this cert to renew anyway?

3 6

FreeIPA not starting
by Francis Augusto Medeiros-Logeay 22 Sep '23

22 Sep '23

Hi, I have a FreeIPA on a VM that I use for testing. I had to take a pause on my work with it, and after a few months, when I turn on the machine, FreeIPA won’t start. I get this error: [Fri Sep 22 18:31:03.162384 2023] [wsgi:error] [pid 2433:tid 2433] ModuleNotFoundError: No module named 'ipaserver.plugins.' [Fri Sep 22 18:31:03.183566 2023] [wsgi:error] [pid 2434:tid 2434] ipa: ERROR: Failed to start IPA: No module named 'ipaserver.plugins.' [Fri Sep 22 18:31:03.183611 2023] [wsgi:error] [pid 2434:tid 2434] mod_wsgi (pid=2434): Failed to exec Python script file '/usr/share/ipa/wsgi.py'. [Fri Sep 22 18:31:03.183634 2023] [wsgi:error] [pid 2434:tid 2434] mod_wsgi (pid=2434): Exception occurred processing WSGI script '/usr/share/ipa/wsgi.py'. [Fri Sep 22 18:31:03.184501 2023] [wsgi:error] [pid 2434:tid 2434] Traceback (most recent call last): [Fri Sep 22 18:31:03.184797 2023] [wsgi:error] [pid 2434:tid 2434] File "/usr/share/ipa/wsgi.py", line 28, in <module> [Fri Sep 22 18:31:03.184805 2023] [wsgi:error] [pid 2434:tid 2434] application = create_application() [Fri Sep 22 18:31:03.184810 2023] [wsgi:error] [pid 2434:tid 2434] ^^^^^^^^^^^^^^^^^^^^ [Fri Sep 22 18:31:03.184819 2023] [wsgi:error] [pid 2434:tid 2434] File "/usr/lib/python3.11/site-packages/ipaserver/wsgi.py", line 51, in create_application [Fri Sep 22 18:31:03.184824 2023] [wsgi:error] [pid 2434:tid 2434] api.finalize() [Fri Sep 22 18:31:03.184831 2023] [wsgi:error] [pid 2434:tid 2434] File "/usr/lib/python3.11/site-packages/ipalib/plugable.py", line 753, in finalize [Fri Sep 22 18:31:03.184836 2023] [wsgi:error] [pid 2434:tid 2434] self.__do_if_not_done('load_plugins') [Fri Sep 22 18:31:03.184844 2023] [wsgi:error] [pid 2434:tid 2434] File "/usr/lib/python3.11/site-packages/ipalib/plugable.py", line 432, in __do_if_not_done [Fri Sep 22 18:31:03.184849 2023] [wsgi:error] [pid 2434:tid 2434] getattr(self, name)() [Fri Sep 22 18:31:03.184856 2023] [wsgi:error] [pid 2434:tid 2434] File "/usr/lib/python3.11/site-packages/ipalib/plugable.py", line 633, in load_plugins [Fri Sep 22 18:31:03.184860 2023] [wsgi:error] [pid 2434:tid 2434] self.add_package(package) [Fri Sep 22 18:31:03.184867 2023] [wsgi:error] [pid 2434:tid 2434] File "/usr/lib/python3.11/site-packages/ipalib/plugable.py", line 660, in add_package [Fri Sep 22 18:31:03.184872 2023] [wsgi:error] [pid 2434:tid 2434] module = importlib.import_module(name) [Fri Sep 22 18:31:03.184876 2023] [wsgi:error] [pid 2434:tid 2434] ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ [Fri Sep 22 18:31:03.184890 2023] [wsgi:error] [pid 2434:tid 2434] File "/usr/lib64/python3.11/importlib/__init__.py", line 126, in import_module [Fri Sep 22 18:31:03.184894 2023] [wsgi:error] [pid 2434:tid 2434] return _bootstrap._gcd_import(name[level:], package, level) [Fri Sep 22 18:31:03.184898 2023] [wsgi:error] [pid 2434:tid 2434] ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ [Fri Sep 22 18:31:03.184905 2023] [wsgi:error] [pid 2434:tid 2434] File "<frozen importlib._bootstrap>", line 1204, in _gcd_import [Fri Sep 22 18:31:03.184912 2023] [wsgi:error] [pid 2434:tid 2434] File "<frozen importlib._bootstrap>", line 1176, in _find_and_load [Fri Sep 22 18:31:03.184918 2023] [wsgi:error] [pid 2434:tid 2434] File "<frozen importlib._bootstrap>", line 1126, in _find_and_load_unlocked [Fri Sep 22 18:31:03.184925 2023] [wsgi:error] [pid 2434:tid 2434] File "<frozen importlib._bootstrap>", line 241, in _call_with_frames_removed [Fri Sep 22 18:31:03.184931 2023] [wsgi:error] [pid 2434:tid 2434] File "<frozen importlib._bootstrap>", line 1204, in _gcd_import [Fri Sep 22 18:31:03.184942 2023] [wsgi:error] [pid 2434:tid 2434] File "<frozen importlib._bootstrap>", line 1176, in _find_and_load [Fri Sep 22 18:31:03.184948 2023] [wsgi:error] [pid 2434:tid 2434] File "<frozen importlib._bootstrap>", line 1140, in _find_and_load_unlocked [Fri Sep 22 18:31:03.184964 2023] [wsgi:error] [pid 2434:tid 2434] ModuleNotFoundError: No module named 'ipaserver.plugins.’ This is weird, can you help me to get it back to a usable state? Best, Francis

2 2

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users September 2023