November 2024 - FreeIPA-users - Fedora mailing-lists

Another DNSSEC question: Supported signing algorithms?
by Jostein Fossheim 08 Nov '24

08 Nov '24

Hello, Today I also tried to switch signing alogoritm from number 8 (RSA-SHA256), which work fine, to first alogoritm 13 (ECDSA P-256) and then alogoritm 15 (Ed25519) wihch neither seems to just be ignored. Is there any list when it comes to supported alogoritms? Or plans for adding new ones? Thank you in advance. Jostein

1 0

DNSSEC: Support for RFC8078 and CDS/CDNSKEY-records?
by Jostein Fossheim 08 Nov '24

08 Nov '24

hello, We are planning to set up a public freeipa instance, and diving into how to handle DNSSEC, and updating keys. Our registrar relies on fetching CDS/CDNSKEY-enteries for automating the process. Is there any way to handle this in freeipa, as of today? Jostein

1 1

ipa-healthcheck --failures-only errors I cannot solve
by LHEUREUX Bernard 08 Nov '24

08 Nov '24

Hello all, I've got a FreeIPA infra running on AlmaLinux 8.10 and totally up-to-date with a trust-AD-domain I find some strange errors when I run "ipa-healthcheck --failures-only" those errors refer to an old server that has been removed from the FreeIPA infra for a long time and all has been removed from DNS and everything, but apparently some old related things remains, but I cannot find where... I cannot find the name of that no longer existing server anywhere on the machines running the FreeIPA server and replicas... How could I fix that ? Thanks for your help. # ipa-healthcheck --failures-only Internal server error HTTPSConnectionPool(host='srvmiddl03.domain.intra', port=443): Max retries exceeded with url: /ca/rest/certs/search?size=3 (Caused by NewConnectionError('<urllib3.connection.VerifiedHTTPSConnection object at 0x7fa37a4f8dd8>: Failed to establish a new connection: [Errno -2] Name or service not known',)) Unable to reach KRA at https://srvmid03.domain.intra:443: HTTPSConnectionPool(host='srvmiddl03.domain.intra', port=443): Max retries exceeded with url: /kra/admin/kra/getStatus (Caused by NewConnectionError('<urllib3.connection.VerifiedHTTPSConnection object at 0x7fa37a4f8e48>: Failed to establish a new connection: [Errno -2] Name or service not known',)) [ { "source": "pki.server.healthcheck.clones.connectivity_and_data", "check": "ClonesConnectivyAndDataCheck", "result": "ERROR", "uuid": "6f63aaf6-2079-4f60-ac2e-c47f7a9ae03f", "when": "20241108094743Z", "duration": "0.063539", "kw": { "status": "ERROR: pki-tomcat : Internal error testing CA clone. Host: srvmiddl03.domain.intra Port: 443" } }, { "source": "pki.server.healthcheck.clones.connectivity_and_data", "check": "ClonesConnectivyAndDataCheck", "result": "ERROR", "uuid": "1f9569b5-224f-488e-823d-15cfc3fbf782", "when": "20241108094744Z", "duration": "0.982430", "kw": { "status": "ERROR: pki-tomcat : Unable to reach KRA at https://srvmid03.domain.intra:443: HTTPSConnectionPool(host='srvmiddl03.domain.intra', port=443): Max retries exceeded with url: /kra/admin/kra/getStatus (Caused by NewConnectionError('<urllib3.connection.VerifiedHTTPSConnection object at 0x7fa37a4f8e48>: Failed to establish a new connection: [Errno -2] Name or service not known',))" } }, { "source": "pki.server.healthcheck.meta.csconfig", "check": "KRADogtagCertsConfigCheck", "result": "ERROR", "uuid": "c4419f0e-0598-4f93-a92e-dc74b9418d88", "when": "20241108095410Z", "duration": "0.035134", "kw": { "key": "kra_sslserver", "nickname": "Server-Cert cert-pki-ca", "directive": "kra.sslserver.cert", "configfile": "/var/lib/pki/pki-tomcat/kra/conf/CS.cfg", "msg": "Certificate 'Server-Cert cert-pki-ca' does not match the value of kra.sslserver.cert in /var/lib/pki/pki-tomcat/kra/conf/CS.cfg" } }, { "source": "pki.server.healthcheck.meta.csconfig", "check": "KRADogtagCertsConfigCheck", "result": "ERROR", "uuid": "240a2325-0c76-4638-98a2-064ae5a5b002", "when": "20241108095410Z", "duration": "0.067181", "kw": { "key": "kra_subsystem", "nickname": "subsystemCert cert-pki-ca", "directive": "kra.subsystem.cert", "configfile": "/var/lib/pki/pki-tomcat/kra/conf/CS.cfg", "msg": "Certificate 'subsystemCert cert-pki-ca' does not match the value of kra.subsystem.cert in /var/lib/pki/pki-tomcat/kra/conf/CS.cfg" } }, { "source": "pki.server.healthcheck.meta.csconfig", "check": "KRADogtagCertsConfigCheck", "result": "ERROR", "uuid": "2b2239b4-543d-4826-b13b-d0ec736f959d", "when": "20241108095410Z", "duration": "0.099616", "kw": { "key": "kra_transport", "nickname": "transportCert cert-pki-kra", "directive": "kra.transport.cert", "configfile": "/var/lib/pki/pki-tomcat/kra/conf/CS.cfg", "msg": "Certificate 'transportCert cert-pki-kra' does not match the value of kra.transport.cert in /var/lib/pki/pki-tomcat/kra/conf/CS.cfg" } }, { "source": "pki.server.healthcheck.meta.csconfig", "check": "KRADogtagCertsConfigCheck", "result": "ERROR", "uuid": "9dd366cc-d421-4e50-86f4-62c58b512ec8", "when": "20241108095410Z", "duration": "0.132474", "kw": { "key": "kra_storage", "nickname": "storageCert cert-pki-kra", "directive": "kra.storage.cert", "configfile": "/var/lib/pki/pki-tomcat/kra/conf/CS.cfg", "msg": "Certificate 'storageCert cert-pki-kra' does not match the value of kra.storage.cert in /var/lib/pki/pki-tomcat/kra/conf/CS.cfg" } }, { "source": "pki.server.healthcheck.meta.csconfig", "check": "KRADogtagCertsConfigCheck", "result": "ERROR", "uuid": "273a6f31-b66f-43c4-90ac-7069db9d8fe4", "when": "20241108095410Z", "duration": "0.165108", "kw": { "key": "kra_audit_signing", "nickname": "auditSigningCert cert-pki-kra", "directive": "kra.audit_signing.cert", "configfile": "/var/lib/pki/pki-tomcat/kra/conf/CS.cfg", "msg": "Certificate 'auditSigningCert cert-pki-kra' does not match the value of kra.audit_signing.cert in /var/lib/pki/pki-tomcat/kra/conf/CS.cfg" } }, { "source": "ipahealthcheck.dogtag.ca", "check": "DogtagCertsConfigCheck", "result": "ERROR", "uuid": "24a3b4a5-25fc-41d4-9d98-b1e2ff4020bc", "when": "20241108095411Z", "duration": "0.456625", "kw": { "key": "transportCert cert-pki-kra", "directive": "ca.connector.KRA.transportCert", "configfile": "/var/lib/pki/pki-tomcat/conf/ca/CS.cfg", "msg": "Certificate 'transportCert cert-pki-kra' does not match the value of ca.connector.KRA.transportCert in /var/lib/pki/pki-tomcat/conf/ca/CS.cfg" } } ] [https://www.win.be/images/fr/logowin.jpg] Bernard LHEUREUX Linux & System Engineer Mob. +32 475 530 311 <tel:+32475530311> win.be <https://www.win.be/> [facebook]<http://www.youtube.com/channel/UC-rXMcRf_tMl5K4EBHKWpGg> [linkedin] <https://www.linkedin.com/company/win-s-a-/> [twitter] <https://twitter.com/win_ICTpartner> ________________________________ 1/Conform?ment ? notre certification ISO 27001, ce message et toute pi?ce jointe sont la propri?t? exclusive de Win. L'information contenue dans cet e- mail peut s'av?rer confidentielle et d?s lors prot?g?e de toute divulgation. Si vous avez re?u cette communication par erreur, veuillez nous en informer imm?diatement en r?pondant ? ce message et en le supprimant de votre ordinateur, sans le copier ni le divulguer. 2/L'acceptation de toute offre commerciale (quel qu'en soit le support) emporte l'adh?sion aux descriptifs (notamment techniques) inh?rents aux solutions offertes, ainsi qu'aux conditions commerciales g?n?rales de Win, consultables via https://www.win.be/cgv DISCLAIMER : https://www.win.be/fr-win/disclaimer.htm

2 1

DSREPLLE0005 in ipa-healthcheck
by alexey safonov 07 Nov '24

07 Nov '24

I tried to play with an additional replica, but in the end decided to remove it, and now getting [ { "source": "ipahealthcheck.ds.replication", "check": "ReplicationCheck", "result": "ERROR", "uuid": "ad00082d-22ae-4928-ae08-6e7177918fc6", "when": "20241104091521Z", "duration": "10.592736", "kw": { "key": "DSREPLLE0005", "items": [ "Replication", "Agreement" ], "msg": "The replication agreement (metogcp-nas-vm01.int) under \"dc=int\" is not in synchronization,\nbecause the consumer server is not reachable." } } ] That's correct. Server gcp-nas-vm01.int is not reachable anymore, but I see no such server in replica-list or agreement list. How can I clean up/remove that alarm? ipa-replica-manage list qb-mum-vm01.int: master qb-mum-vm02.int: master qb-bg-vm01.int: master ipa-csreplica-manage list Directory Manager password: qb-mum-vm01.int: master qb-mum-vm02.int: CA not configured qb-bg-vm01.int: CA not configured

3 10

dna-plugin - _dna_pre_op_add - No more values available!! trying to add group
by Brian J. Murrell 06 Nov '24

06 Nov '24

I'm getting an error trying to add a new group: # ipa group-add --desc='Bill and Ted' adv# ipa group-add --desc='Bill and Ted' adventurers ipa: ERROR: Operations error: Allocation of a new value for range cn=posix ids,cn=distributed numeric assignment plugin,cn=plugins,cn=config failed! Unable to proceed. Journal report: # journalctl -S-1m Nov 03 17:31:49 server.interlinx.bc.ca [916251]: GSSAPI client step 1 Nov 03 17:31:49 server.interlinx.bc.ca [916251]: GSSAPI client step 1 Nov 03 17:31:49 server.interlinx.bc.ca [916251]: GSSAPI client step 1 Nov 03 17:31:49 server.interlinx.bc.ca [916250]: GSSAPI client step 1 Nov 03 17:31:49 server.interlinx.bc.ca [916250]: GSSAPI client step 1 Nov 03 17:31:49 server.interlinx.bc.ca [916250]: GSSAPI client step 1 Nov 03 17:31:58 server.interlinx.bc.ca ns-slapd[232518]: [03/Nov/2024:17:31:58.593765265 -0500] - ERR - dna-plugin - _dna_pre_op_add - No more values available!! Nov 03 17:31:58 server.interlinx.bc.ca ns-slapd[232518]: [03/Nov/2024:17:31:58.638013864 -0500] - ERR - ipa_sidgen_add_post_op - [file ipa_sidgen.c, line 128]: Missing target entry. A debugging command I found while researching this issue: # ipa-replica-manage dnarange-show server-staging.interlinx.bc.ca: Connection failed: cannot connect to 'ldaps://server-staging.interlinx.bc.ca:636': Transport endpoint is not connected server.interlinx.bc.ca: No range set server-staging is a long-forgotten about replica if it's any relevance. How do I resolve the issue trying to add the new group? Cheers, b.

2 9

Random failures of freeipa-server
by Carlos Lopez Molina 06 Nov '24

06 Nov '24

Hi, I managed to get a working installation of freeipa-server using the docker image docker.io/freeipa/freeipa-server:rocky-9-4.11.0. I activated OTP, hbac, and sudoers rules, and got everything working without issues. I tried login in with ssh(password+OTP), doing sudo and everything worked ok. After having lunch, I tried again, and noticed that when I try to log in, I get a failure in the authentication. This is not the first time this is happenning. For example, yesterday something similar happened, and I tried several things like ipactl restart, restarting the server, to no avail. At some moment, the system resumed working again probably without my intervention. The previous days I had a similar experiencie, with the system stopping and resuming working without a clear cause for me. I'm copying some logs in case you provide some hints about how to debug the source of this error: freeipa-server: /data/var/log/krb5kdc.log <== Nov 05 16:07:12 ldap.staging.domain.com krb5kdc[278](info): AS_REQ (8 etypes {aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17), aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19), UNSUPPORTED:des3-hmac-sha1(16), DEPRECATED:arcfour-hmac(23), camellia128-cts-cmac(25), camellia256-cts-cmac(26)}) 172.16.113.76: NEEDED_PREAUTH: username4(a)STAGING.DOMAIN.COM for krbtgt/STAGING.DOMAIN.COM(a)STAGING.DOMAIN.COM, Additional pre-authentication required Nov 05 16:07:12 ldap.staging.domain.com krb5kdc[278](info): AS_REQ (8 etypes {aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17), aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19), UNSUPPORTED:des3-hmac-sha1(16), DEPRECATED:arcfour-hmac(23), camellia128-cts-cmac(25), camellia256-cts-cmac(26)}) 172.16.113.76: NEEDED_PREAUTH: username4(a)STAGING.DOMAIN.COM for krbtgt/STAGING.DOMAIN.COM(a)STAGING.DOMAIN.COM, Additional pre-authentication required Nov 05 16:07:12 ldap.staging.domain.com krb5kdc[278](info): closing down fd 12 Nov 05 16:07:12 ldap.staging.domain.com krb5kdc[278](info): closing down fd 12 Nov 05 16:07:12 ldap.staging.domain.com krb5kdc[278](info): AS_REQ (8 etypes {aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17), aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19), UNSUPPORTED:des3-hmac-sha1(16), DEPRECATED:arcfour-hmac(23), camellia128-cts-cmac(25), camellia256-cts-cmac(26)}) 172.16.113.76: NEEDED_PREAUTH: username4(a)STAGING.DOMAIN.COM for krbtgt/STAGING.DOMAIN.COM(a)STAGING.DOMAIN.COM, Additional pre-authentication required Nov 05 16:07:12 ldap.staging.domain.com krb5kdc[278](info): AS_REQ (8 etypes {aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17), aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19), UNSUPPORTED:des3-hmac-sha1(16), DEPRECATED:arcfour-hmac(23), camellia128-cts-cmac(25), camellia256-cts-cmac(26)}) 172.16.113.76: NEEDED_PREAUTH: username4(a)STAGING.DOMAIN.COM for krbtgt/STAGING.DOMAIN.COM(a)STAGING.DOMAIN.COM, Additional pre-authentication required Nov 05 16:07:12 ldap.staging.domain.com krb5kdc[278](info): closing down fd 12 Nov 05 16:07:12 ldap.staging.domain.com krb5kdc[278](info): closing down fd 12 Nov 05 16:07:12 ldap.staging.domain.com krb5kdc[278](info): preauth (otp) verify failure: Generic preauthentication failure Nov 05 16:07:12 ldap.staging.domain.com krb5kdc[278](info): preauth (otp) verify failure: Generic preauthentication failure Nov 05 16:07:12 ldap.staging.domain.com krb5kdc[278](info): AS_REQ (8 etypes {aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17), aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19), UNSUPPORTED:des3-hmac-sha1(16), DEPRECATED:arcfour-hmac(23), camellia128-cts-cmac(25), camellia256-cts-cmac(26)}) 172.16.113.76: PREAUTH_FAILED: username4(a)STAGING.DOMAIN.COM for krbtgt/STAGING.DOMAIN.COM(a)STAGING.DOMAIN.COM, Preauthentication failed Nov 05 16:07:12 ldap.staging.domain.com krb5kdc[278](info): AS_REQ (8 etypes {aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17), aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19), UNSUPPORTED:des3-hmac-sha1(16), DEPRECATED:arcfour-hmac(23), camellia128-cts-cmac(25), camellia256-cts-cmac(26)}) 172.16.113.76: PREAUTH_FAILED: username4(a)STAGING.DOMAIN.COM for krbtgt/STAGING.DOMAIN.COM(a)STAGING.DOMAIN.COM, Preauthentication failed Nov 05 16:07:12 ldap.staging.domain.com krb5kdc[278](info): closing down fd 12 Nov 05 16:07:12 ldap.staging.domain.com krb5kdc[278](info): closing down fd 12 Logs from ipa client: ==> krb5_child.log <== (2024-11-05 17:07:12): [krb5_child[3980764]] [get_and_save_tgt] (0x0020): [RID#49] 1725: [-1765328360][Preauthentication failed] ********************** PREVIOUS MESSAGE WAS TRIGGERED BY THE FOLLOWING BACKTRACE: * (2024-11-05 17:07:12): [krb5_child[3980764]] [main] (0x0400): [RID#49] krb5_child started. * (2024-11-05 17:07:12): [krb5_child[3980764]] [unpack_buffer] (0x1000): [RID#49] total buffer size: [171] * (2024-11-05 17:07:12): [krb5_child[3980764]] [unpack_buffer] (0x0100): [RID#49] cmd [241 (auth)] uid [1393800005] gid [1393800005] validate [true] enterprise principal [false] offline [false] UPN [username4(a)STAGING.DOMAIN.COM] * (2024-11-05 17:07:12): [krb5_child[3980764]] [unpack_buffer] (0x2000): [RID#49] No old ccache * (2024-11-05 17:07:12): [krb5_child[3980764]] [unpack_buffer] (0x0100): [RID#49] ccname: [KEYRING:persistent:1393800005] old_ccname: [not set] keytab: [/etc/krb5.keytab] * (2024-11-05 17:07:12): [krb5_child[3980764]] [k5c_precreate_ccache] (0x4000): [RID#49] Recreating ccache * (2024-11-05 17:07:12): [krb5_child[3980764]] [k5c_setup_fast] (0x0100): [RID#49] Fast principal is set to [host/db.preprod.domain.com(a)STAGING.DOMAIN.COM] * (2024-11-05 17:07:12): [krb5_child[3980764]] [find_principal_in_keytab] (0x4000): [RID#49] Trying to find principal host/db.preprod.domain.com(a)STAGING.DOMAIN.COM in keytab. * (2024-11-05 17:07:12): [krb5_child[3980764]] [match_principal] (0x1000): [RID#49] Principal matched to the sample (host/db.preprod.domain.com(a)STAGING.DOMAIN.COM) * (2024-11-05 17:07:12): [krb5_child[3980764]] [check_fast_ccache] (0x0200): [RID#49] FAST TGT is still valid. * (2024-11-05 17:07:12): [krb5_child[3980764]] [become_user] (0x0200): [RID#49] Trying to become user [1393800005][1393800005]. * (2024-11-05 17:07:12): [krb5_child[3980764]] [main] (0x2000): [RID#49] Running as [1393800005][1393800005]. * (2024-11-05 17:07:12): [krb5_child[3980764]] [set_lifetime_options] (0x0100): [RID#49] No specific renewable lifetime requested. * (2024-11-05 17:07:12): [krb5_child[3980764]] [set_lifetime_options] (0x0100): [RID#49] No specific lifetime requested. * (2024-11-05 17:07:12): [krb5_child[3980764]] [set_canonicalize_option] (0x0100): [RID#49] Canonicalization is set to [true] * (2024-11-05 17:07:12): [krb5_child[3980764]] [main] (0x0400): [RID#49] Will perform auth * (2024-11-05 17:07:12): [krb5_child[3980764]] [main] (0x0400): [RID#49] Will perform online auth * (2024-11-05 17:07:12): [krb5_child[3980764]] [tgt_req_child] (0x1000): [RID#49] Attempting to get a TGT * (2024-11-05 17:07:12): [krb5_child[3980764]] [get_and_save_tgt] (0x0400): [RID#49] Attempting kinit for realm [STAGING.DOMAIN.COM] * (2024-11-05 17:07:12): [krb5_child[3980764]] [sss_krb5_responder] (0x4000): [RID#49] Got question [otp]. * (2024-11-05 17:07:12): [krb5_child[3980764]] [get_and_save_tgt] (0x0020): [RID#49] 1725: [-1765328360][Preauthentication failed] ********************** BACKTRACE DUMP ENDS HERE ********************************* (2024-11-05 17:07:12): [krb5_child[3980764]] [map_krb5_error] (0x0020): [RID#49] 1854: [-1765328360][Preauthentication failed] ==> /var/log/auth.log <== Nov 5 16:07:12 db sshd[3980717]: pam_sss(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=172.16.113.180 user=username4 Nov 5 16:07:12 db sshd[3980717]: pam_sss(sshd:auth): received for user username4: 7 (Authentication failure) Nov 5 16:07:15 db sshd[3980713]: error: PAM: Authentication failure for username4 from 172.16.113.180 Nov 5 16:07:15 db sshd[3980713]: Postponed keyboard-interactive for username4 from 172.16.113.180 port 55090 ssh2 [preauth] Any hint you can give about how to find the cause of these errors would be greatly appreciated.

2 2

How to insert parameters from FreeIPA in CA profile
by Alexey Filimonov 05 Nov '24

05 Nov '24

I want to make a certificate profile that can issue certificates for hosts, but I want values in certprofile be filled by FreeIPA, and not from certificate request. I can not understand how FreeIPA integrates with DogTag when some IPA-joined host requests certificate with certmonger. In some profiles I see `$request.req_subject_name.cn$`, but I don't understand if FreeIPA took this value from request or from ldap, did ipa validated this CN owned by requestor or not? In different profiles I found there is `$request.upn$` placeholder, but it just does not work when it's requested by certmonger. Is there a list of parameters FreeIPA passes to DogTag, with information about source of those values and validation against directory?

5 7

Host has 10k certificates - how do I delete them?
by Bo Lind 05 Nov '24

05 Nov '24

I have a host that, for some inexplicable reason, has 10536 certificates, all made in a two month period in the spring. How do I simply delete all of these?

2 1

ipa replica cleanup hanging
by Orion Poplawski 05 Nov '24

05 Nov '24

We have some issues with installing new replicas, apparently triggered by incomplete replication between the existing servers. I'm trying to cleanup the orphaned replica agreements: dn: cn=ipa-seattle01.nwra.com-to-ipa-bld01.cora.nwra.com,cn=replica,cn=dc\3Dnw ra\2Cdc\3Dcom,cn=mapping tree,cn=config nsDS5ReplicaLastUpdateStatus: Error (-1) Problem connecting to replica - LDAP error: Can't contact LDAP server (connection error) dn: cn=ipa-seattle01.nwra.com-to-ipa-bld01.cora.nwra.com,cn=replica,cn=o\3Dipa ca,cn=mapping tree,cn=config nsDS5ReplicaLastUpdateStatus: Error (-1) Problem connecting to replica - LDAP error: Can't contact LDAP server (connection error) But that appears to be hanging: # ldapmodify -h ipa-seattle01.nwra.com -D "cn=directory manager" -W <<EOF > dn: cn=ipa-seattle01.nwra.com-to-ipa-bld01.cora.nwra.com,cn=replica,cn=o\3Dipaca,cn=mapping tree,cn=config > changetype: delete > > dn: cn=ipa-seattle01.nwra.com-to-ipa-bld01.cora.nwra.com,cn=replica,cn=dc\3Dnwra\2Cdc\3Dcom,cn=mapping tree,cn=config > changetype: delete > EOF Enter LDAP Password: deleting entry "cn=ipa-seattle01.nwra.com-to-ipa-bld01.cora.nwra.com,cn=replica,cn=o\3Dipaca,cn=mapping tree,cn=config" Any idea what would cause this? access on ipa-seattle01: [30/Oct/2024:14:59:53.669549056 -0700] conn=351148 fd=248 slot=248 connection from 10.10.41.3 to 10.30.10.11 [30/Oct/2024:14:59:53.670365938 -0700] conn=351148 op=0 BIND dn="cn=directory manager" method=128 version=3 [30/Oct/2024:14:59:53.670564728 -0700] conn=351148 op=0 RESULT err=0 tag=97 nentries=0 wtime=0.000495680 optime=0.000235976 etime=0.000728682 dn="cn=directory manager" [30/Oct/2024:14:59:53.701779783 -0700] conn=351148 op=1 DEL dn="cn=ipa-seattle01.nwra.com-to-ipa-bld01.cora.nwra.com,cn=replica,cn=o\3Dipaca,cn=mapping tree,cn=config" errors: [30/Oct/2024:14:58:48.666432741 -0700] - WARN - NSMMReplicationPlugin - prot_stop - Incremental protocol for replica "agmt="cn=ipa-seattle01.nwra.com-to-ipa-bld01.cora.nwra.com" (ipa-bld01:389)" did not shut down properly. [30/Oct/2024:15:01:53.781236011 -0700] - WARN - NSMMReplicationPlugin - prot_stop - Incremental protocol for replica "agmt="cn=ipa-seattle01.nwra.com-to-ipa-bld01.cora.nwra.com" (ipa-bld01:389)" did not shut down properly. -- Orion Poplawski he/him/his - surely the least important thing about me Manager of IT Systems 720-772-5637 NWRA, Boulder Office FAX: 303-415-9702 3380 Mitchell Lane orion(a)nwra.com Boulder, CO 80301 https://www.nwra.com/

3 4

ubuntu freeipa client how to enable sudo
by Carlos Lopez Molina 04 Nov '24

04 Nov '24

Hi, I managed to have a freeipa client version 4.9.8 working on Ubuntu 22.04 with the following features: - ssh authentication with ldap. - OTP for ssh authentication with password For the record, I'm using this docker image docker.io/freeipa/freeipa-server:rocky-9-4.11.0 to run freeipa-server. I'm struggling to enable sudo authorization using freeipa server policies. The main blocker is that the instructions I found(https://freeipa.readthedocs.io/en/latest/workshop/8-sudorule.html) points to use authselect: [client]$ sudo authselect enable-feature with-sudo to reconfigure sssd, but seems that this tool is only available on fedora/redhat flavours, and not for ubuntu. Is there any way to use authselect in ubuntu. Or anybody knows which changes would do authselect in the ubuntu client? Any help would be greatly appreciated.

3 5

2025

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users November 2024