FreeIPA-users October 2024

freeipa-users@lists.fedorahosted.org

30 participants
42 discussions

OTP strange behaviour
by Damiano Giuliani 24 Oct '24

24 Oct '24

Hi guys, im facing a strange behaviour about freeipa OTP, we installed freeipa 4.11 on RockyLinux 9.4 and configure all user to authenticate using OTP which is working fine except for this behaviour: when a user connect using ssh using hostname to the first client (ssh user@hostname1), freeipa correclty asks for 2FA, then once logged in, if i ssh to a second server using hostname (ssh user@hostname2) it doesnt ask me any 2FA, instead if i use the ip (ssh user@ip_of_hostname2) it asks me it. it's a strange behaviour, shouldnt it ask always 2FA? can u guys enlight me and help to make freeipa ask always 2fa for each ssh? thanks Damiano

2 4

freeipa.py plugin for AWX dynamic inventory not available
by slek kus 23 Oct '24

23 Oct '24

Hi, is there a possibility to have the below plugin avialable in Ansible Galaxy FreeIPA collection? https://github.com/ansible/ansible/blob/stable-2.9/contrib/inventory/freeip… Trying to use dynamic inventory by using the plugin. but this is not being included/downloaded with the collection. I create a dynamic inventory (sourced from project, a git where I have the following folder and file): inventories/clients_and_controllers.yml, where the contents of the .yml is a single line: ``` plugin: freeipa ``` The collections used are: ``` collections: - name: freeipa.ansible_freeipa - name: community.general ``` The error message trying to sync the resource for the dynamic inventory is: [WARNING]: * Failed to parse /runner/project/inventories/clients_and_controllers.yml with auto plugin: inventory config ‘/runner/project/inventories/clients_and_controllers.yml ’ specifies unknown plugin ‘freeipa.py’ Kind regards!

3 4

OTP strange behaviour
by Damiano Giuliani 23 Oct '24

23 Oct '24

1 0

OTP strange behaviour
by Damiano Giuliani 23 Oct '24

23 Oct '24

1 0

OTP strange behaviour
by Damiano Giuliani 23 Oct '24

23 Oct '24

1 0

Re: [Freeipa-devel] ipa-replica-install fails with the error "RuntimeError: Certificate issuance failed (CA_UNREACHABLE)"
by Florence Blanc-Renaud 23 Oct '24

23 Oct '24

Hi, I moved this conversation to freeipa-users instead of freeipa-devel (the devel mailing list is for development topics, not user help). On Wed, Oct 23, 2024 at 9:04 AM Kao via FreeIPA-devel < freeipa-devel(a)lists.fedorahosted.org> wrote: > Issue： > > I'm deploying FreeIPA replica on azure VM，using Rocky 9.3 on both Master > and client(replica) VM, and borh version of FreeIPA is 4.11.0. This two vm > is in the same virtual network > > master and client deployment is fine, but when installing replica on > client vm, it always get error： > > [1/3]: configuring TLS for DS instance > [error] RuntimeError: Certificate issuance failed (CA_UNREACHABLE) > Your system may be partly configured. > Run /usr/sbin/ipa-server-install --uninstall to clean up. > > ipa.ipapython.install.cli.install_tool(CompatServerReplicaInstall): ERROR > Certificate issuance failed (CA_UNREACHABLE) > ipa.ipapython.install.cli.install_tool(CompatServerReplicaInstall): ERROR > The ipa-replica-install command failed. See > /var/log/ipareplica-install.log for more information > > i've already check firewall and access right of the ca file on master. > > it have spend two days on this, really need some help！！ > Please provide the whole log for /var/log/ipareplica-install.log. Did you use --skip-conncheck argument when installing the replica? What was the umask on the server when it got installed? The replica gets information from the master, can you check the content of /var/log/httpd/error_log? Do you see a line with cert_request from the replica? flo > -- > _______________________________________________ > FreeIPA-devel mailing list -- freeipa-devel(a)lists.fedorahosted.org > To unsubscribe send an email to freeipa-devel-leave(a)lists.fedorahosted.org > Fedora Code of Conduct: > https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: > https://lists.fedorahosted.org/archives/list/freeipa-devel@lists.fedorahost… > Do not reply to spam, report it: > https://pagure.io/fedora-infrastructure/new_issue >

1 0

disable admin user in FreeIPA 4.10.2
by Ales Rozmarin 22 Oct '24

22 Oct '24

Hi Guys I'm trying to disable admin user in Freeipa 4.10.2 and I get this: user admin cannot be deleted/modified: privileged user I did create new user with admin privileges add to group admins. But I can't disable admin user. This worked up to version FreeIPA 4.10.1 but not anymore. anyone know why is that or how can I disable admin user in 4.10.2. thanks Ales

3 6

IPA setup without DNS entries
by Sarah PETER 22 Oct '24

22 Oct '24

Dear all, TLDR; We have an IPA setup consisting of four replicas (2 CA, 2 non-CA) without any of the DNS records that ‘ipa dns-update-system-records‘ suggests and we share our DNS domain with AD. Will we have any issues, assuming that we are not using Kerberos automatic discovery, the krb, sssd and ipa configuration files have the servers explicitly configured and we are not using trust to Active Directory? I have inherited a 10-year-old FreeIPA setup with four replicas, which is in a non-supported configuration according to RedHat support, but has always worked fine for us. I would like to know if we can keep it running like it is, or if we will face issues in the future and if yes, which ones. We are a small sub-group in a bigger organization managing our own Linux VMs. We manage SSH login with sssd and LDAP logins to web services with FreeIPA. Our parent organization runs Active Directory and the DNS servers on the same domain that we have configured in FreeIPA. We do not have any trust relationship with the Active Directory and won’t ever be allowed to have it, either. We do not want any auto-discovery to happen, to make sure other people’s machines don’t accidentally try to contact or enroll with our infrastructure. Therefore, we have no DNS records at all anywhere pointing to our IPA servers and instead always configure this explicitly in the client and server install and ipa, sssd and krb configuration files. We are in the process of migrating to RHEL 8 and the new ipa-healthcheck complains on various levels about the missing DNS records (error for ipa-ca, warning for the rest). RedHat support insisted that we need to migrate our setup to a different domain and create the DNS records. However, migration would be a huge challenge, because there is no procedure to migrate all data in IPA (we have quite extensive HBAC rules) and the DNS records we don’t want to create to prevent auto-discovery and also wouldn’t be allowed from the parent organization. I would appreciate if someone could tell me the actual issues that we could encounter running this setup with multiple (2 CA, 2 non-CA) replicas. I’m mostly concerned about complications with replication or certificates (renewal). Best regards, Sarah

3 5

Re: Inquery about ipa healthcheck api
by Alexander Bokovoy 22 Oct '24

22 Oct '24

Please do not drop the mailing list. On Аўт, 22 кас 2024, 정가희 wrote: > >What kind of traffic you are load-balancing? > > > > > >If your load-balancer only supports HTTP protocols, chances are that it > > >is unable to utilize Kerberos over HTTPS either, so it cannot access any > > >of IPA API end-points. It also means it cannot really validate IPA > > >server HTTP end-points are working beyond a simple 'yes, it responded, > > >with whatever status code'. > > First of all, As i mentioned, our load balancer only supports HTTP > protocol **for healthcheck, > > And for traffic routing, the lb supports necessary protocols in IPA such > as TCP, UDP. > > > > We're using external passthrough network load balancer of GCP and > configure routing protocol like below. > > TCP > > 389, 636: LDAP/LDAPS > > 88, 464: kerberos > > UDP > > 464: kerberos > > And gcp team guide like below. > > https://cloud.google.com/load-balancing/docs/network/networklb-target-pools… > > "External passthrough Network Load Balancers rely on legacy HTTP health > checks to determine instance health. Even if your service does not use > HTTP, you must run a basic web server on each instance that the health > check system can query. > > Legacy HTTPS health checks aren't supported for external passthrough > Network Load Balancers and cannot be used with most other types of load > balancers." > > https://cloud.google.com/load-balancing/docs/health-check-concepts#success-… > > "If the response received by the legacy health check probe is HTTP 200 OK, > the probe is considered successful. All other HTTP response codes, > including a redirect (301, 302), are considered unhealthy." > > They guided that their NLB only support HTTP protocol for healthcheck and > the healthcheck of NLB consider 'HTTP 200 OK' as healthy status. > > So, we're finding the HTTP API with status code. (heatlthy : 200 / > unhealty : whatever except 200) > > Is there any API we can check the status of ipa servers? > > >curl -X POST \ > -H 'Accept-Language: en' > --data > '{"method":"i18n_messages", "params":[[],{}]}' \ > --referer > [1]https://ipa-server.hostname/ipa/ \ > > [2]https://ipa-server.hostname/ipa/i18n_messages > > And when i ran the curl you mentioned, I got error message below. > > "curl: (60) SSL certificate problem: self signed certificate in > certificate chain > > More details here: https://curl.haxx.se/docs/sslcerts.html > > curl failed to verify the legitimacy of the server and therefore could not > > establish a secure connection to it. To learn more about this situation > and > > how to fix it, please visit the web page mentioned above." You need to trust your own IPA CA on the client side where you run that curl command. You can learn more in the API documentation I provided (e.g. pass --cacert /etc/ipa/ca.crt to curl as well). For the rest -- as I said, FreeIPA team does not support load-balanced configurations. You are explicitly on your own. -- / Alexander Bokovoy Sr. Principal Software Engineer Security / Identity Management Engineering Red Hat Limited, Finland

1 0

Re: Inquery about ipa healthcheck api
by 정가희 22 Oct '24

22 Oct '24

1 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users October 2024