FreeIPA-users January 2024

freeipa-users@lists.fedorahosted.org

52 participants
74 discussions

Number of concurrent connections are decreased by replication.
by Jaehwan Kim 13 Mar '24

13 Mar '24

Hello. I recently encoutered a poblem that nubmer of concurrent connecitons are decreased in FreeIPA servers. [Architecutre - replication topology] My replication topology which is circular (ring-shaped), consists of 13 FreeIPA servers. These 13 servers are grouped as 3 clusters, of which members are 5, 4, 4 respectively. NLBs(network load balancers) to share request from clients for ipa login, kerberos authenticaion, ldap connections, are assinged to each cluster. Therefore 3 NLBs have 5, 4, 4 FreeIPA servers as their nlb backend pool, repectively. This architecture has been worked successfully for 2 years, but recently I encountered a problem that 867 host_add per hours to one cluster results in "# of concurrent connections decrement" for all clusters. Command to get # of concurrent connections is dsconf -D "cn=Directory Manager" ldap://server.example.com monitor server | grep currentconnections: About 2K connections are observed for each servers, by this command. I also found that if servers which replication info isn't transfered to, this symptom doesn't happen, even though those are in the same replication topology ring. Hence, I guess that "# of concurrent connections decrement" symptom is related to replcation. I tried to tune the parameters like dtablesize = 65535, repl-release-timeout = 120, nnsslapd-threadnumber = authomatic thread tuning, db and entry cache auto-sizing (nsslapd-cache-autosize = 80, with failure. I want to ask help to solve this symptom, if posible. Thank you. JHK

4 16

DNS resolution failures
by Tania Hagan 07 Mar '24

07 Mar '24

Hi Freeipa-users, We are currently running Freeipa version 4.9.11 on Rocky 8.8. We have noticed over the last few months that external name resolution e.g. google.com fails to resolve on multiple Freeipa replicas even though the service named-pkcs11 remains up and running and journalctl or logs aren’t showing up any obvious errors to why this might be happening. We temporarily fix this by restarting the service, but the problem comes back at random times. We currently have 39 DNS Zones Our DNS Global Configuration has a forward policy of forward only, though the individual zones are set to forward first. I’ve read a few articles that say maybe changing the forward policy might fix it, but nothing that mentions how to double check if changing the policy will fix it. Are there any useful troubleshooting checks I could run to either help explain why our service keeps failing at random intervals or confirm any changes would fix the issue without the risk of potential downtime of our DNS service? Many Thanks, Tania

4 4

06 Mar '24

I am running into a strange issue with a few user accounts where logging into the web interface gives them the error message "Login failed due to an unknown reason”. It also prevents them from SSH’ing into IPA bound systems using passwords. Pubkeys work fine (as long as it is manually added to the local accounts) and any services I have bound to it (Gitlab, Mattermost, Owncloud, etc) seem to work fine. I ’think’ this is kerberos related since the only services that are using it is SSH and probably the IPA web interface. Here is the apache error log for it: [Thu Jan 13 09:15:38.688228 2022] [wsgi:error] [pid 579266:tid 139812542121728] [remote xx.xxx.xx.xxx:52162] ipa: INFO: 401 Unauthorized: Major (851968): Unspecified GSS failure. Minor code may provide more information, Minor (2598844948): TGT has been revoked I ’think’ the message "TGT has been revoked” is due to the 401 error, since the user is not showing as being authorized to login. However, this user is enabled and I have tried a number of things to try to fix it: 1. Disable/Re-enable account 2. Reset passwords 3. Kinit username (seems to get a ticket, but logins still do not work) 4. Run the account migration task (using the web gui) 5. Restart the IPA server and services 6. Re-initialize the IPA server from another master Also, I can confirm that the passwords are correct since a failed password error message shows up differently and other services are using it correctly. Going down the Kerberos path, here is the krb5kdc log file: Jan 13 09:15:38 ipa.example.com krb5kdc[579226](info): AS_REQ (7 etypes {aes256-cts-hmac-sha1-96(18), aes256-cts-hmac-sha384-192(20), camellia256-cts-cmac(26), aes128-cts-hmac-sha1-96(17), aes128-cts-hmac-sha256-128(19), camellia128-cts-cmac(25), DEPRECATED:arcfour-hmac(23)}) yy.yy.yy.yy: NEEDED_PREAUTH: WELLKNOWN/ANONYMOUS(a)EXAMPLE.COM for krbtgt/EXAMPLE.COM(a)EXAMPLE.COM, Additional pre-authentication required Jan 13 09:15:38 ipa.example.com krb5kdc[579226](info): closing down fd 12 Jan 13 09:15:38 ipa.example.com krb5kdc[579226](info): AS_REQ (7 etypes {aes256-cts-hmac-sha1-96(18), aes256-cts-hmac-sha384-192(20), camellia256-cts-cmac(26), aes128-cts-hmac-sha1-96(17), aes128-cts-hmac-sha256-128(19), camellia128-cts-cmac(25), DEPRECATED:arcfour-hmac(23)}) yy.yy.yy.yy: ISSUE: authtime 1642094138, etypes {rep=aes256-cts-hmac-sha1-96(18), tkt=aes256-cts-hmac-sha1-96(18), ses=aes256-cts-hmac-sha1-96(18)}, WELLKNOWN/ANONYMOUS(a)EXAMPLE.COM for krbtgt/EXAMPLE.COM(a)EXAMPLE.COM Jan 13 09:15:38 ipa.example.com krb5kdc[579226](info): closing down fd 12 Jan 13 09:15:38 ipa.example.com krb5kdc[579225](info): AS_REQ (7 etypes {aes256-cts-hmac-sha1-96(18), aes256-cts-hmac-sha384-192(20), camellia256-cts-cmac(26), aes128-cts-hmac-sha1-96(17), aes128-cts-hmac-sha256-128(19), camellia128-cts-cmac(25), DEPRECATED:arcfour-hmac(23)}) yy.yy.yy.yy: NEEDED_PREAUTH: testuser(a)EXAMPLE.COM for krbtgt/EXAMPLE.COM(a)EXAMPLE.COM, Additional pre-authentication required Jan 13 09:15:38 ipa.example.com krb5kdc[579225](info): closing down fd 12 Jan 13 09:15:38 ipa.example.com krb5kdc[579225](info): AS_REQ (7 etypes {aes256-cts-hmac-sha1-96(18), aes256-cts-hmac-sha384-192(20), camellia256-cts-cmac(26), aes128-cts-hmac-sha1-96(17), aes128-cts-hmac-sha256-128(19), camellia128-cts-cmac(25), DEPRECATED:arcfour-hmac(23)}) yy.yy.yy.yy: ISSUE: authtime 1642094138, etypes {rep=aes256-cts-hmac-sha1-96(18), tkt=aes256-cts-hmac-sha1-96(18), ses=aes256-cts-hmac-sha1-96(18)}, testuser(a)EXAMPLE.COM for krbtgt/EXAMPLE.COM(a)EXAMPLE.COM Jan 13 09:15:38 ipa.example.com krb5kdc[579225](info): closing down fd 12 Jan 13 09:15:38 ipa.example.com krb5kdc[579226](Error): PAC issue: PAC record claims domain SID different to local domain SID or any trusted domain SID: local [S-1-5-21-997841278-3584560916-1456654135], PAC [S-1-5-21-2108153867-2082035330-3701898995] Jan 13 09:15:38 ipa.example.com krb5kdc[579226](info): TGS_REQ : handle_authdata (-1765328364) Jan 13 09:15:38 ipa.example.com krb5kdc[579226](info): TGS_REQ (7 etypes {aes256-cts-hmac-sha1-96(18), aes256-cts-hmac-sha384-192(20), camellia256-cts-cmac(26), aes128-cts-hmac-sha1-96(17), aes128-cts-hmac-sha256-128(19), camellia128-cts-cmac(25), DEPRECATED:arcfour-hmac(23)}) yy.yy.yy.yy: HANDLE_AUTHDATA: authtime 1642094138, etypes {rep=UNSUPPORTED:(0)} testuser(a)EXAMPLE.COM for HTTP/ipa.example.com(a)EXAMPLE.COM, TGT has been revoked Jan 13 09:15:38 ipa.example.com krb5kdc[579226](info): closing down fd 12 Jan 13 09:15:38 ipa.example.com krb5kdc[579226](Error): PAC issue: PAC record claims domain SID different to local domain SID or any trusted domain SID: local [S-1-5-21-997841278-3584560916-1456654135], PAC [S-1-5-21-2108153867-2082035330-3701898995] Jan 13 09:15:38 ipa.example.com krb5kdc[579226](info): TGS_REQ : handle_authdata (-1765328364) Jan 13 09:15:38 ipa.example.com krb5kdc[579226](info): TGS_REQ (7 etypes {aes256-cts-hmac-sha1-96(18), aes256-cts-hmac-sha384-192(20), camellia256-cts-cmac(26), aes128-cts-hmac-sha1-96(17), aes128-cts-hmac-sha256-128(19), camellia128-cts-cmac(25), DEPRECATED:arcfour-hmac(23)}) yy.yy.yy.yy: HANDLE_AUTHDATA: authtime 1642094138, etypes {rep=UNSUPPORTED:(0)} testuser(a)EXAMPLE.COM for HTTP/ipa.example.com(a)EXAMPLE.COM, TGT has been revoked I only see two errors that might be related: "PAC record claims domain SID different to local domain SID or any trusted domain SID” "DEPRECATED:arcfour-hmac(23)” However, those might just be red herrings or something else that is unrelated. So far, there are only a small number of accounts that have this problem, but more seem to be popping up on a daily basis. The only fix I have found is the nuclear option, where I completely remove the account and then add it back in with the same UID/GID, group memberships and policies. After that it seems to work fine. However, I would rather not want to do this to all accounts since that would be a logistical nightmare. Are there any suggestions for either troubleshooting or fixing this problem with a lighter approach? Is it possible to reset or regenerate the users kerberos authentication? Thanks, Dan West Systems Administrator Galois Inc. http://galois.com

4 8

api authorization stopped working after upgrade to 4.9.12-11 on RHEL8
by Rasto Rickardt 27 Feb '24

27 Feb '24

Hello, i have setup of 5 IPA servers on RHEL8. This morning i upgraded with dnf upgrade IPA components to 4.9.12-11 for example: ipa-server-4.9.12-11.module+el8.9.0+20824+f2605038.x86_64 ipa-server-common-4.9.12-11.module+el8.9.0+20824+f2605038.noarch After upgrade finished without errors, i was not able to login to UI with correct password with message "Your session has expired. Please log in again." dirsrv replication looks OK. I checked logs, everytime i try to login, /var/log/httpd/error_log contain: [Thu Jan 11 17:30:03.490345 2024] [wsgi:error] [pid 3299146:tid 139867429353216] [remote 185.103.146.26:46292] ipa: INFO: 401 Unauthorized: Insufficient access: SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Credential cache is empty) I can do kinit, without any error. But when i try to use ipa user-show, not working. ipaupgrade.log attached, rest inline. If you have any idea how to fix this please, i will be gratefull. Thank you, Rasto ipa -d user-show ipa: DEBUG: Loading Index file from '/var/lib/ipa-client/sysrestore/sysrestore.index' ipa: DEBUG: Loading StateFile from '/var/lib/ipa-client/sysrestore/sysrestore.state' ipa: DEBUG: Loading StateFile from '/var/lib/ipa-client/sysrestore/sysrestore.state' ipa: DEBUG: found session_cookie in persistent storage for principal 'rrickardt@redacted', cookie: 'ipa_session=MagBearerToken=VsNzXWPFKUTUmXpNpoXBnYn%2f7kaXq3b77Vb1HDzWdZ8u1c3ZAAReJFNMYwMeRLYSv4pggL%2bb3O1YH9lpJuXswOV%2fK%2fs%2bF96bBeIykbO2%2bnklplxnRxGyjo4edYLEo4QvfYIr9P2xGoxPEsCjrDj6m%2bro3UZtiFKGIgrI9KJKfZAhLrk46ooeAZ0HF7IAR5DgI07EdHeXdoP%2bA1T70CoXYA%3d%3d' ipa: DEBUG: setting session_cookie into context 'ipa_session=MagBearerToken=VsNzXWPFKUTUmXpNpoXBnYn%2f7kaXq3b77Vb1HDzWdZ8u1c3ZAAReJFNMYwMeRLYSv4pggL%2bb3O1YH9lpJuXswOV%2fK%2fs%2bF96bBeIykbO2%2bnklplxnRxGyjo4edYLEo4QvfYIr9P2xGoxPEsCjrDj6m%2bro3UZtiFKGIgrI9KJKfZAhLrk46ooeAZ0HF7IAR5DgI07EdHeXdoP%2bA1T70CoXYA%3d%3d;' ipa: DEBUG: trying https://ipa2.id.example.com/ipa/session/json ipa: DEBUG: New HTTP connection (ipa2.id.example.com) ipa: DEBUG: HTTP connection destroyed (ipa2.id.example.com) Traceback (most recent call last): File "/usr/lib/python3.6/site-packages/ipaclient/remote_plugins/__init__.py", line 120, in get_package plugins = api._remote_plugins AttributeError: 'API' object has no attribute '_remote_plugins' During handling of the above exception, another exception occurred: Traceback (most recent call last): File "/usr/lib/python3.6/site-packages/ipalib/rpc.py", line 730, in single_request response.msg) xmlrpc.client.ProtocolError: <ProtocolError for ipa2.id.example.com/ipa/session/json: 401 Unauthorized> ipa: DEBUG: trying https://ipa2.id.example.com/ipa/session/json ipa: DEBUG: New HTTP connection (ipa2.id.example.com) ipa: DEBUG: HTTP connection destroyed (ipa2.id.example.com) Traceback (most recent call last): File "/usr/lib/python3.6/site-packages/ipaclient/remote_plugins/__init__.py", line 120, in get_package plugins = api._remote_plugins AttributeError: 'API' object has no attribute '_remote_plugins' During handling of the above exception, another exception occurred: Traceback (most recent call last): File "/usr/lib/python3.6/site-packages/ipalib/rpc.py", line 730, in single_request response.msg) xmlrpc.client.ProtocolError: <ProtocolError for ipa2.id.example.com/ipa/session/json: 401 Unauthorized> ipa: INFO: Connection to https://ipa2.id.example.com/ipa/session/json failed with <ProtocolError for ipa2.id.example.com/ipa/session/json: 401 Unauthorized> krb5kdc.log Jan 11 17:41:35 ipa7.id.example.com krb5kdc[1230](info): AS_REQ (6 etypes {aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19), aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17), camellia256-cts-cmac(26), camellia128-cts-cmac(25)}) 10.112.65.75: NEEDED_PREAUTH: rrickardt(a)id.example.com for krbtgt/id.example.com(a)id.example.com, Additional pre-authentication required Jan 11 17:41:35 ipa7.id.example.com krb5kdc[1230](info): closing down fd 12 Jan 11 17:41:35 ipa7.id.example.com krb5kdc[1230](info): AS_REQ (6 etypes {aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19), aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17), camellia256-cts-cmac(26), camellia128-cts-cmac(25)}) 10.112.65.75: ISSUE: authtime 1704991295, etypes {rep=aes256-cts-hmac-sha1-96(18), tkt=aes256-cts-hmac-sha1-96(18), ses=aes256-cts-hmac-sha1-96(18)}, rrickardt(a)id.example.com for krbtgt/id.example.com(a)id.example.com Jan 11 17:41:35 ipa7.id.example.com krb5kdc[1230](info): closing down fd 12 Jan 11 17:41:35 ipa7.id.example.com krb5kdc[1231](info): TGS_REQ (6 etypes {aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19), aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17), camellia256-cts-cmac(26), camellia128-cts-cmac(25)}) 10.112.65.75: ISSUE: authtime 1704991295, etypes {rep=aes256-cts-hmac-sha1-96(18), tkt=aes256-cts-hmac-sha1-96(18), ses=aes256-cts-hmac-sha1-96(18)}, rrickardt(a)id.example.com for HTTP/ipa7.id.example.com(a)id.example.com Jan 11 17:41:35 ipa7.id.example.com krb5kdc[1231](info): closing down fd 12 Jan 11 17:41:35 ipa7.id.example.com krb5kdc[1230](info): TGS_REQ (6 etypes {aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19), aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17), camellia256-cts-cmac(26), camellia128-cts-cmac(25)}) 10.112.65.75: S4U2PROXY_EVIDENCE_TKT_WITHOUT_PAC: authtime 1704991295, etypes {rep=UNSUPPORTED:(0)} HTTP/ipa7.id.example.com(a)id.example.com for ldap/ipa7.id.example.com(a)id.example.com, KDC policy rejects request Jan 11 17:41:35 ipa7.id.example.com krb5kdc[1230](info): ... CONSTRAINED-DELEGATION s4u-client=<unknown> Jan 11 17:41:35 ipa7.id.example.com krb5kdc[1230](info): closing down fd 12 Jan 11 17:41:35 ipa7.id.example.com krb5kdc[1230](info): TGS_REQ (6 etypes {aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19), aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17), camellia256-cts-cmac(26), camellia128-cts-cmac(25)}) 10.112.65.75: S4U2PROXY_EVIDENCE_TKT_WITHOUT_PAC: authtime 1704991295, etypes {rep=UNSUPPORTED:(0)} HTTP/ipa7.id.example.com(a)id.example.com for ldap/ipa7.id.example.com(a)id.example.com, KDC policy rejects request Jan 11 17:41:35 ipa7.id.example.com krb5kdc[1230](info): ... CONSTRAINED-DELEGATION s4u-client=<unknown> Jan 11 17:41:35 ipa7.id.example.com krb5kdc[1230](info): closing down fd 12

4 8

idrange problem
by Steve Berg 12 Feb '24

12 Feb '24

For a few weeks now I've been seeing a problem getting authenticated to my ipa domain. I can get command line and web UI stuff done by using the admin user but if I get a ticket using my account which is in the admins group I get the following on the web UI: Your session has expired. Please log in again. On the command line any ipa commands I've tried so far give me: ipa: ERROR: Insufficient access: SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Credential cache is empty) Getting a ticket as admin on command line lets me run ipa commands with no problem. I think I've got all pertinent certificates loaded up properly. Gonna try a reboot on one of the servers shortly. I have 4 servers on r different vlans, replication between seems to be working properly. I think the problem is most of the user ID's we use on this domain are not in the ID range configured. We let the install choose a default range when we first set this up. Most of our users have a UID based on their EDIPI # which is a 32-bit ID assigned when a user first gets a DoD CAC. They're usually 10 digits long. For instance the lowest EDIPI based UID we have currently is something like 1004201873 and the largest is 1658224121. (I made those but they're close to the actual UIDs.) ipa idrange-find show me this, (did some masking of the info): Range name: domain_id_range First Posix ID of the range: 824xxx000 Number of IDs in the range: 200000 First RID of the corresponding RID range: 1000 First RID of the secondary RID range: 100000000 Range name: domain_subid_range First Posix ID of the range: 214xxx3648 Number of IDs in the range: 214xxx2576 First RID of the corresponding RID range: 214xxx3648 Domain SID of the trusted domain: S-1-5-21-xxxxxx-83xx66-82xxx729 Range type: Active Directory domain range Should I adjust the range that's already there or add a third that encompasses the likely range of numbers I'm gonna see in the future? I started to add a range with appropriate values but when it wanted the primary and secondary RID base values I was not sure how to figure that out or estimate. -- //- Fixer of that which is broke -// //- Home =sberg(a)mississippi.com -// //- Sinners can repent, but stupid is forever. -//

5 9

certmonger error on ubuntu
by Robson Francisco de Souza 08 Feb '24

08 Feb '24

Hello! I've been running FreeIPA 4.3.1 on Ubuntu 16.04 for almost two years and most certificates should expire within three weeks. As this deadline approaches, I noticed certmonger has been unable to renew certificates due to the error below. After googling for two days, I found this issue has been observed by many people before, mostly after expiration of the certificates, as in https://tinyurl.com/vajmocw Still, I couldn't find a solution to this problem. If it is impossible to fix this issue while using FreeIPA 4.3.1, I would like to: 1) Find a way to renew all certificates even if certmonger can't be fixed. This would allow me to postpone the solution to after the next OS and/or FreeIPA upgrade 2) Find out what version of FreeIPA I should upgrade to while the operating system remains Ubuntu 16.04 Any help would be appreciated! Thanks! Robson ======> Command: systemctl status certmonger Nov 17 20:53:08 ipa.cefapnet.icb.usp.br certmonger[3873125]: 2019-11-17 20:53:08 [3873125] Error 77 connecting to https://ipa.cefapnet.icb.usp.br:8443/ca/agent/ca/profileReview: Problem with the SSL CA cert (path? access rights?). Nov 17 21:10:13 ipa.cefapnet.icb.usp.br dogtag-ipa-ca-renew-agent-submit[3875188]: Forwarding request to dogtag-ipa-renew-agent Nov 17 21:10:13 ipa.cefapnet.icb.usp.br dogtag-ipa-ca-renew-agent-submit[3875188]: dogtag-ipa-renew-agent returned 3 Nov 17 21:10:13 ipa.cefapnet.icb.usp.br certmonger[3873125]: 2019-11-17 21:10:13 [3873125] Error 77 connecting to https://ipa.cefapnet.icb.usp.br:8443/ca/agent/ca/profileReview: Problem with the SSL CA cert (path? access rights?). Nov 17 21:25:20 ipa.cefapnet.icb.usp.br dogtag-ipa-ca-renew-agent-submit[3875738]: Forwarding request to dogtag-ipa-renew-agent Nov 17 21:25:20 ipa.cefapnet.icb.usp.br dogtag-ipa-ca-renew-agent-submit[3875738]: dogtag-ipa-renew-agent returned 3 Nov 17 21:25:21 ipa.cefapnet.icb.usp.br certmonger[3873125]: 2019-11-17 21:25:21 [3873125] Error 77 connecting to https://ipa.cefapnet.icb.usp.br:8443/ca/agent/ca/profileReview: Problem with the SSL CA cert (path? access rights?). Nov 17 21:25:31 ipa.cefapnet.icb.usp.br dogtag-ipa-ca-renew-agent-submit[3875766]: Forwarding request to dogtag-ipa-renew-agent Nov 17 21:25:31 ipa.cefapnet.icb.usp.br dogtag-ipa-ca-renew-agent-submit[3875766]: dogtag-ipa-renew-agent returned 3 Nov 17 21:25:31 ipa.cefapnet.icb.usp.br certmonger[3873125]: 2019-11-17 21:25:31 [3873125] Error 77 connecting to https://ipa.cefapnet.icb.usp.br:8443/ca/agent/ca/profileReview: Problem with the SSL CA cert (path? access rights?). -- Robson Francisco de Souza, PhD Laboratório de Estrutura e Evolução de Proteínas (LEEP/PSEL) Departamento de Microbiologia Instituto de Ciências Biomédicas Universidade de São Paulo Av. Prof. Lineu Prestes, 1374 - Ed. Biomédicas II - Sala 250 - 2o. andar Tel: 3091-0891 Cidade Universitária - CEP 05508-900 - São Paulo - SP - Brasil ---- Robson Francisco de Souza, PhD Protein Structure and Evolution Laboratory (LEEP/PSEL) Microbiology Departament Biomedical Sciences Institute University of Sao Paulo Av. Prof. Lineu Prestes, 1374 - Biomédicas II - Sala 250 Phone: 55-11-3091-0891 Cidade Universitária - ZIP 05508-900 - São Paulo - SP - Brazil

6 10

FreeIPA Upgrade - overwrites custom authselect config
by Finn Fysj 06 Feb '24

06 Feb '24

I've recently tried to run an upgrade of my IPA server (4.10.2) because of some CVE fix for 4.10.3. At the end of upgrade the IPA server tries to run: CalledProcessError(Command ['/usr/bin/authselect', 'select', 'sssd', 'with-sudo', '--force'], why does it do this? The upgrade in my case fails because I've set made following files immutable: /etc/authselect/{password-auth,system-auth}.

3 10

CentOS 7 FreeIPA upgrade, 4.5 to 4.6.8: certmonger hanger
by Melissa Ferreira da Silva Boiko 05 Feb '24

05 Feb '24

Hello all. I'm trying to replace an ancient FreeIPA 4.5.0 master (and primary CA master) on CentOS 7.4. I am having problems trying to make replicas with FreeIPA 4.11, and past threads suggest the errors are due to incompatibility of password hash algorithms, which are supposed to be fixed on the older releases rather than the newer. Therefore I'm trying to upgrade the old server to the current version in the CentOS 7 repos, 4.6.8, to try to create fresh replicas from there. But I'm having issues with the certmonger systemd service hanging, and breaking ipa-server-upgrade--whether I update the whole CentOS to 7.9.2009, or just ipa-server and its dependencies, the result is the same. This is where ipa-server-upgrade breaks: [Verifying that root certificate is published] [Migrate CRL publish directory] CRL tree already moved [Verifying that CA proxy configuration is correct] IPA server upgrade failed: Inspect /var/log/ipaupgrade.log and run command ipa-server-upgrade manually. Unexpected error - see /var/log/ipaupgrade.log for details: CalledProcessError: Command '/bin/systemctl start certmonger.service' returned non-zero exit status 1 The ipa-server-upgrade command failed. See /var/log/ipaupgrade.log for more information This is because certmonger.service hangs until timeout. That happens when starting the service manually, too. Logs for certmonger.service are not informative: -- Subject: Unit certmonger.service has begun start-up -- Unit certmonger.service has begun starting up. Jan 31 14:38:59 vm-ipa-1.intra.viaboxxsystems.de systemd[1]: certmonger.service start operation timed out. Terminating. Jan 31 14:40:29 vm-ipa-1.intra.viaboxxsystems.de systemd[1]: certmonger.service stop-sigterm timed out. Killing. Jan 31 14:40:29 vm-ipa-1.intra.viaboxxsystems.de systemd[1]: certmonger.service: main process exited, code=killed, status=9/KILL -- Subject: Unit certmonger.service has failed -- Unit certmonger.service has failed. Jan 31 14:40:29 vm-ipa-1.intra.viaboxxsystems.de systemd[1]: Unit certmonger.service entered failed state. Jan 31 14:40:29 vm-ipa-1.intra.viaboxxsystems.de systemd[1]: certmonger.service failed. root@vm-ipa-1.intra.viaboxxsystems.de[lxc](e:0,1s)(j:0) ~ Running `certmonger -S -n -d 9` seems to run ok. The only difference in the systemd service file is, I think, whatever it is that the BusName setting does. dbus is running seemingly without issue, nothing on logs. Restarting dbus.service doesn't help. The machine is an LXC container with 4GiB RAM, which doesn't come close to being exhausted when trying to restart certmonger. No OOM in logs. I saw this thread about certmonger problems with ulimit in containers: https://bugzilla.redhat.com/show_bug.cgi?id=1656519 But the suggested workaround (make sure ulimit -n is the same in container and host) doesn't apply because it's already the same for us. How should I proceed from here?

3 4

Issues with sudo permissions
by slek kus 05 Feb '24

05 Feb '24

Hi, created an account which is meant to automate things with Ansible AWX. Tried to grant this account sudo access to the linux clients but things seem not to work out. Not sure why. hbactests returns OK. ---- [root@idm01 ~]# ipa hbactest --user=ansible --host=debclient1.linux.<redacted>.services --service=sshd -------------------- Access granted: True -------------------- Matched rules: allow_ansible_ssh2idm Not matched rules: allow_systemd-user Not matched rules: test_aduser [root@idm01 ~]# ipa hbactest --user=ansible --host=debclient1.linux.<redacted>.services --service=sudo-i -------------------- Access granted: True -------------------- Matched rules: allow_ansible_ssh2idm Not matched rules: allow_systemd-user Not matched rules: test_aduser [root@idm01 ~]# ipa hostgroup-show all_clients_hg Host-group: all_clients_hg Description: This group contains all clients registered to this IdM. Member hosts: debclient2.linux.<redacted>.services, debclient1.linux.<redacted>.services Member of HBAC rule: allow_ansible_ssh2idm, test_aduser [root@idm01 ~]# ipa hbacrule-show allow_ansible_ssh2idm Rule name: allow_ansible_ssh2idm Enabled: True Users: ansible Host Groups: ipaservers, all_clients_hg HBAC Services: sshd, sudo, sudo-i HBAC Service Groups: Sudo ---- I can login with user ansible onto debclient2, using a ssh pub key set in IDM just fine. But when trying to sudo, this is not allowed. Even though I have locally enabled it in sudoers (which should't be nessecary). ---- root@debclient2:~# su - ansible@linux.<redacted>.services su: Permission denied root@debclient2:~# getent passwd ansible@linux.<redacted>.services ansible:*:996000008:996000008:Automation User:/home/ansible:/bin/bash ansible@debclient2:~$ sudo -i [sudo] password for ansible: ansible is not allowed to run sudo on debclient2. ansible@debclient2:~$ id uid=996000008(ansible) gid=996000008(ansible) groups=996000008(ansible) -----

4 7

FreeIPA cluster, backup and restore
by Finn Fysj 02 Feb '24

02 Feb '24

Have a cluster setup with is setup using Ansible FreeIPA roles ipaserver & ipareplica. Running ipabackup using script as the ipabackup role doesn't work as wanted or intended, meaning not able to take backup of data. Multiple master, only one with CA installed. When I run ipabackup to backup data I get the following: Error: Local roles do not match globally used roles CA. A backup done on this host would not be complete enough to restore a fully functional, identical cluster. The ipa-backup command failed. See /var/log/ipabackup.log for more information. The error message is somewhat understandable. We don't use FreeIPA CA capabilities, so that's the reason we don't have it installed on replicas, unless you guys would recommend otherwise? I've tried to test a little using these ansible roles. What happens if my Master with the only backup goes down? Yes, I'll have a replica making sure everything works as normal, so I can scrap the master, rebuild it and restore the data backup I took. However, once the node is restored, there's still not any connection between the two nodes now, since a re-run of the ipareplica won't do anything since it's already installed. Does that mean we need to rebuild this node as well? A normal data restore of a node will stop the replication connection between the two nodes, meaning it needs to be "re-connected", this is also not something that can be done using these roles? One final question: If we have a working cluster setup, and some sausage fingers manages to delete the replica from the "CA node". How can I re-initalize this with the ansible replica role, or is rebuild the only option?

4 6

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users January 2024