July 2024 - FreeIPA-users - Fedora mailing-lists

How does RBAC work?
by Francis Augusto Medeiros-Logeay 08 Oct '24

08 Oct '24

Ok, I am not sure how this works: I created this user, called biding. I want it to be able to create users on FreeIPA, mailing by biding Keycloak to it. So I created the role: [francis@freeipa]~% ipa role-show Role name: Keycloak biding Role name: Keycloak biding Member users: biding Privileges: User Administrators, Group Administrators, Stage User Administrators, Stage User Provisioning, Modify Users and Reset passwords, Modify Group membership, Keycloak admin Yes, too many roles, because it simply wasn’t doing it. Keycloak would fail saying the user didn’t have permissions. So what I did was to add this user to the admin group. Then it created users. But not even my admin user can delete those users created that way. Why isn’t this working? And why when giving it permissions it is creating objects that simply can’t be read by my previous biding users? Best, Francis

3 9

Removal & clean up certificates from o=ipaca
by David Goudet 30 Sep '24

30 Sep '24

Hello all, I have to clean up lot of useless certificate in dirsrv database. Because of resubmit loop on Certmonger client, i have 99,9% of certificate in dirsrv database that are useless and not obsolete (expiration in 2020) (it represent ~85 000 certificates). These useless certificates produce some issues on FreeIPA: - decrease FreeIPA performances on CLI and GUI - increase the LDAP size - increase size and time of FreeIPA backup ... Is it possible to purge these certificates in dirsrv database and how? I found two branches in LDAP directory about these certificates: dn: cn=xxx,ou=ca,ou=requests,o=ipaca dn: cn=yyy,ou=certificateRepository,ou=ca,o=ipaca I can remove all requests and certificates entry from dirsrv database but how it is supported by PKI manager Dogtag (CRL, certificate generation, OCSP)? (This topic has already been discuss on https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost…) Thank you for you help -- David GOUDET LYRA NETWORK IT Operations service Tel : +33 (0)5 32 09 09 74 | Poste : 574

4 7

sidgen_task fails with SID conflict
by Basile Pinsard 16 Aug '24

16 Aug '24

Hi, I had an existing instance of freeipa that went broken so badly (pki-tomcat unrecoverable) that the only option was spinning up a new one and `ipa migrate-ds` from the broken one. The new instance was set to reuse the same id-range as the previous one, so all is good for the users in that range. The older instance has a number of user that were imported from an even older LDAP with IDs out of the IPA range. So after import, I quickly figured out that I need to create a small (1000) `legacy` range that covers these, most of these legacy users were then able to login. Here are the id-ranges after the legacy was added. # ipa idrange-find ---------------- 3 ranges matched ---------------- Range name: DOMAIN_id_range First Posix ID of the range: 944200000 Number of IDs in the range: 200000 First RID of the corresponding RID range: 1000 First RID of the secondary RID range: 100000000 Range type: local domain range Range name: DOMAIN_id_range_legacy First Posix ID of the range: 1000 Number of IDs in the range: 1000 First RID of the corresponding RID range: 302000 First RID of the secondary RID range: 200000000 Range type: local domain range Range name: DOMAIN_subid_range First Posix ID of the range: 2147483648 Number of IDs in the range: 2147352576 First RID of the corresponding RID range: 2147283648 Domain SID of the trusted domain: S-1-5-21-738065-838566-3977953474 Range type: Active Directory domain range ---------------------------- Number of entries returned 3 ---------------------------- However, a number of the legacy users still cannot login. I tried starting the sidgen task, and from the logs it seems that there is a conflict with the ranges I chose for the legacy id range. ``` [18/Jul/2024:16:24:12.358313104 +0000] - ERR - sidgen_task_thread - [file ipa_sidgen_task.c, line 194]: Sidgen task starts ... [18/Jul/2024:16:24:12.598768115 +0000] - ERR - rid_to_sid_with_check - [file ipa_sidgen_common.c, line 384]: SID [S-1-5-21-3076474616-2786889582-2859700629-302272] is already used. [18/Jul/2024:16:24:12.637972455 +0000] - ERR - rid_to_sid_with_check - [file ipa_sidgen_common.c, line 384]: SID [S-1-5-21-3076474616-2786889582-2859700629-200000272] is already used. [18/Jul/2024:16:24:12.696381619 +0000] - ERR - find_sid_for_id - [file ipa_sidgen_common.c, line 432]: Secondary SID is used as well. [18/Jul/2024:16:24:12.746590836 +0000] - ERR - find_sid_for_ldap_entry - [file ipa_sidgen_common.c, line 532]: Cannot convert Posix ID [1272] into an unused SID. [18/Jul/2024:16:24:12.796710604 +0000] - ERR - do_work - [file ipa_sidgen_task.c, line 154]: Cannot add SID to existing entry. [18/Jul/2024:16:24:12.854320074 +0000] - ERR - sidgen_task_thread - [file ipa_sidgen_task.c, line 199]: Sidgen task finished [19]. ``` I cannot figure out what is my error and the documentation is quite scarce on how to choose first-rids, except saying that ranges shouldn't overlap, which I thought I made care of when creating the legacy range. Maybe I am too dumb to understand where is the overlap I created, or why I do get conflict. Thanks for your help and expertise!

4 5

`ipa-acme-manager --enable` command failed on master replica
by Vadim Dobroskokin 12 Aug '24

12 Aug '24

`ipa-acme-manager --enable` command failed on master replica. On other replicas, the command completes successfully. FreeIPA 4.11, RockyLinux 9.4 Output fragment from failed command: ``` ipaserver.masters: DEBUG: Discovery: available servers for service 'CA' are ipa01.example.com, ipa11.example.com, ipa02.example.com ipaserver.masters: DEBUG: Discovery: using ipa01.example.com for 'CA' service ipapython.dogtag: DEBUG: request POST https://ipa01.example.com:8443/acme/login ipapython.dogtag: DEBUG: request body '' ipapython.dogtag: DEBUG: response status 404 ipapython.dogtag: DEBUG: response headers Content-Type: text/html;charset=utf-8 Content-Language: en Content-Length: 765 ipapython.dogtag: DEBUG: response body (decoded): b'<!doctype html><html lang="en"><head><title>HTTP Status 404 \xe2\x80\x93 Not Found</title><style type="text/css">body {font-family:Tahoma,Arial,sans-serif;} h1, h2, h3, b {color:white;background-color:#525D76;} h1 {font-size:22px;} h2 {font-size:16px;} h3 {font-size:14px;} p {font-size:12px;} a {color:black;} .line {height:1px;background-color:#525D76;border:none;}</style></head><body><h1>HTTP Status 404 \xe2\x80\x93 Not Found</h1><hr class="line" /><p><b>Type</b> Status Report</p><p><b>Message</b> The requested resource [/acme/login] is not available</p><p><b>Description</b> The origin server did not find a current representation for the target resource or is not willing to disclose that one exists.</p><hr class="line" /><h3>Apache Tomcat/9.0.87</h3></body></html>' ipapython.admintool: DEBUG: File "/usr/lib/python3.9/site-packages/ipapython/admintool.py", line 180, in execute return_value = self.run() File "/usr/lib/python3.9/site-packages/ipaserver/install/ipa_acme_manage.py", line 403, in run with state as ca_api: File "/usr/lib/python3.9/site-packages/ipaserver/install/ipa_acme_manage.py", line 103, in __enter__ raise errors.RemoteRetrieveError( ipapython.admintool: DEBUG: The ipa-acme-manage command failed, exception: RemoteRetrieveError: Failed to authenticate to CA REST API ipapython.admintool: ERROR: Failed to authenticate to CA REST API ipapython.admintool: ERROR: The ipa-acme-manage command failed. ``` How can I fix this problem?

4 11

SID woes when trying to add a replica on Alma 9 freeipa
by Thomas Boroske 02 Aug '24

02 Aug '24

Hello dear FreeIPA experts, I am currently in the process of trying to migrate a system consisting of two ipa masters ipa1,ipa2 (no ca, no dns, no pkinit) running on CentOS7 to two new systems running on Alma Linux 9 (RHEL 9 based). At least some of the user-IDs and GIDs in the system are very old, however, since before IPA there was an openldap based system and the user config data traveled over when the switch to IPA was initially made. I managed to setup new system ipa3, did a test ipa server install with some (solvable) problems, looks OK. But I needed a replica of course, so rollback and try ipa-replica-install instead of server-install. This eventually worked somewhat. During the replication/setup process I got told I have user accounts without SID and if I want to convert them/add the SIDs. I went with the default option of "no" since I didn't really know if I needed that and was not sure it wouldn't damage the function of the old master servers. The result was: kinit and login to web interface only worked for the admin user. WIth ipa-user find or in the web interface it seemed that other than that the data has traveled over. Modifications we hat in the 99user.ldif also traveled over. Of course, the problem with kinit and web login is due to the missing SIDs. I found out you can redo the conversion I skipped during the replica install by using "ipa config-mod –enable-sid –add-sids" However, this didn't change anything, and from looking at the dirsrv error log I learned the script did not work because some of my uid/gid is outside the idrange configured for IPA. At this point I decided to do a rollback to do more research on how to handle those issues, so I'm back to two masters on CentOS7. My existing IPA installation only has this one idrange: [root@charon ~]# LANG=C ipa idrange-find --------------- 1 range matched --------------- Range name: NET.IDA_id_range First Posix ID of the range: 531600000 Number of IDs in the range: 200000 Range type: local domain range ---------------------------- Number of entries returned 1 ---------------------------- Note there is no primary or secondary RID base set for this range. I do have users with UID starting at 999 and GID starting at 100 that were probably created before IPA. Now I understand I have to do something like "ipa idrange-add NET.IDA_low_id_range --base-id=1 --range-size=20000 --rid-base=200000000 --secondary-rid-base=300000000" and then maybe the ipa config-mod with "--add-sids" should work. But I do have questions before I try that: First: Since my existing range has no RID set, how do I know the rid base ranges won't conflict? And then: On which point and where during the replicate-to-new-system process do I have to do what? - I guess I could even add the idranges on the old servers before creating a replica? Would it work? Is it a good idea? - what about the "ipa config-mod –enable-sid –add-sid" : - is this available on the old CentOS 7 too and should I try to enable it there before creating a replica? - or is it only possible/necessary on the new replica, but then, what will be the state of my ipa master server cluster then? Most importantly, will the old ipa servers continue to work while I test the new replica with single clients, create a second new replica etc pp? In short: At what point and where do I need to run the "ipa addrange", and at what point and where do I need to run the "ipa config mod –enable-sid –add-sid". Many thanks for any help. Kind regards, Thomas

2 2

Help with Ghost Replica removal please.
by Nicholas Cross 02 Aug '24

02 Aug '24

I am on a long journey upgrading from a mixture of different versions of freeipa to the lastest and i am almost there, currently on 4.10. After removing some older replicas yesterday, a new replica had a fault and we had to restart dirsrv. When it came back up we saw we have ghost replicas across the whole estate 6x replicas in two locations. Issues are reported via `cipa` Digging into the tombstone records, i find there are not the usual tombstone replica records but more like the below. My question is, how do i remove these redundant records? As I believe this is what `cipa` is counting to report the errors. (marked with <<<<<<<<<<<<<<) The usual things do not work: # ipa-replica-manage -p $pass clean-ruv 15 Replica ID 15 not found $ cat remove_ruv.ldif dn: cn=clean 15,cn=cleanallruv,cn=tasks,cn=config changetype: add objectclass: top objectclass: extensibleObject replica-base-dn: dc=ad,dc=companyx,dc=fm replica-id: 15 cn: clean 15 ldapmodify -Y GSSAPI -f remove_ruv.ldif Thanks in advance. Nick $ ldapsearch -D "cn=Directory Manager" -w $pass -Q -o ldif-wrap=no -LLL -b "dc=ad,dc=companyx,dc=fm" '(&(objectclass=nstombstone)(nsUniqueId=ffffffff-ffffffff-ffffffff-ffffffff))' dn: cn=replica,cn=dc\3Dad\2Cdc\3Dcompanyx\2Cdc\3Dfm,cn=mapping tree,cn=config cn: replica nsDS5Flags: 1 nsDS5ReplicaBindDN: cn=replication manager,cn=config nsDS5ReplicaBindDNGroup: cn=replication managers,cn=sysaccounts,cn=etc,dc=ad,dc=companyx,dc=fm nsDS5ReplicaBindDnGroupCheckInterval: 60 nsDS5ReplicaId: 56 nsDS5ReplicaName: a6b5640c-ad3911ed-a50980fb-6203228c nsDS5ReplicaRoot: dc=ad,dc=companyx,dc=fm nsDS5ReplicaType: 3 nsState:: OAAAAAAAAABSPEJkAAAAAAAAAAAAAAAA7AAAAAAAAAAGAAAAAAAAAA== nsds5ReplicaBackoffMax: 300 nsds5ReplicaLegacyConsumer: off nsds5ReplicaReleaseTimeout: 60 objectClass: top objectClass: nsds5replica objectClass: extensibleobject nsds50ruv: {replicageneration} 5d9e2076000000040000 nsds50ruv: {replica 56 ldap://ipa006.ad.companyx.fm:389} 63ece66f000000380000 64423d4e000000380000 nsds50ruv: {replica 46 ldap://ipa005.ad.companyx.fm:389} 63dbcc200001002e0000 64423cf6000f002e0000 nsds50ruv: {replica 21 ldap://etcd0dc.ad.companyx.fm:389} 5f2d4bc1000000150000 64319ec3276200150000 nsds50ruv: {replica 48 ldap://ipa007.ad.companyx.fm:389} 63ea4e54000100300000 6442397e000a00300000 nsds50ruv: {replica 58 ldap://ipa001dc.ad.companyx.fm:389} 643d03280001003a0000 644232c00001003a0000 nsds50ruv: {replica 60 ldap://ipa002dc.ad.companyx.fm:389} 643d19680001003c0000 644232660004003c0000 nsds50ruv: {replica 62 ldap://ipa003dc.ad.companyx.fm:389} 643d491e0001003e0000 644233340000003e0000 nsds5agmtmaxcsn: dc=ad,dc=companyx,dc=fm; ipa006.ad.companyx.fm-to-ipa003dc.ad.companyx.fm;ipa003dc.ad.companyx.fm ;389;62;644238c9000000380000 nsds5agmtmaxcsn: dc=ad,dc=companyx,dc=fm; ipa006.ad.companyx.fm-to-ipa007.ad.companyx.fm;ipa007.ad.companyx.fm ;389;48;644238c9000000380000 nsds5agmtmaxcsn: dc=ad,dc=companyx,dc=fm; ipa006.ad.companyx.fm-to-etcd2dc.ad.companyx.fm;etcd2dc.ad.companyx.fm;389;unavailable;64423cf6000f002e0000 <<<<<<<<<<<<<< nsds5agmtmaxcsn: dc=ad,dc=companyx,dc=fm; ipa006.ad.companyx.fm-to-ipa005.ad.companyx.fm;ipa005.ad.companyx.fm ;389;46;644238c9000000380000 nsruvReplicaLastModified: {replica 56 ldap://ipa006.ad.companyx.fm:389} 64423c62 nsruvReplicaLastModified: {replica 46 ldap://ipa005.ad.companyx.fm:389} 64423c0c nsruvReplicaLastModified: {replica 21 ldap://etcd0dc.ad.companyx.fm:389} 00000000 nsruvReplicaLastModified: {replica 48 ldap://ipa007.ad.companyx.fm:389} 64423894 nsruvReplicaLastModified: {replica 58 ldap://ipa001dc.ad.companyx.fm:389} 644231da nsruvReplicaLastModified: {replica 60 ldap://ipa002dc.ad.companyx.fm:389} 6442317a nsruvReplicaLastModified: {replica 62 ldap://ipa003dc.ad.companyx.fm:389} 64423249 nsruvReplicaLastModified: {replica 12} 644180f7 <<<<<<<<<<<<<< nsruvReplicaLastModified: {replica 15} 644180f7 <<<<<<<<<<<<<< nsruvReplicaLastModified: {replica 25} 644180f7 <<<<<<<<<<<<<< nsruvReplicaLastModified: {replica 23} 644180f7 <<<<<<<<<<<<<< nsruvReplicaLastModified: {replica 40} 644180f7 <<<<<<<<<<<<<< nsds5ReplicaChangeCount: 734077 nsds5replicareapactive: 0

3 14

ipa: ERROR: Cannot find specified domain or server name
by Johnnie W Adams 01 Aug '24

01 Aug '24

Hi, folks, Everywhere I check, I see this error associated with firewall issues. To get around that, I put my box on the same network segment as the ad boxes. No firewall between them. But I am still getting this message when I try to create a trust: ipa: ERROR: Cannot find specified domain or server name The error in /var/log/httpd is: [wsgi:error] [pid 506950:tid 507279] [remote <ip address>:53320] ipa: INFO: [jsonserver_session] admin(a)NET.EXAMPLE.COM: trust_add/1(' adtest1.ad.test.example.com', trust_type='ad', realm_admin='me', realm_passwd='********', range_type='ipa-ad-trust', version='2.253'): NotFound Any thoughts? What exactly is being not found? Thanks, John A -- John Adams Senior Linux/Middleware Administrator | Information Technology Services +1-501-916-3010 | jxadams(a)ualr.edu | http://ualr.edu/itservices *UA Little Rock* Reminder: IT Services will never ask for your password over the phone or in an email. Always be suspicious of requests for personal information that come via email, even from known contacts. For more information or to report suspicious email, visit IT Security <http://ualr.edu/itservices/security/>.

3 9

viewing/editing existing schema attributes in web UI admin
by Alex I 01 Aug '24

01 Aug '24

Hi, I'm upgrading a mail system (postfix, dovecot, amavis etc) with openldap backend and really would like to switch to freeipa (use it as mail accounts backend DB among other tasks). Ldap schema-wise I only had to add a new amavisAccount class as it looks like I can make use of already existing mailRecipient class (add these classes to a user and a group set of classes). I can display/modify amavisAccount/mailRecipient attributes for a user with ipa user-show --all, ipa user-mod and with ldap browser/editor (jxplorer). But I can't get these classes attributes displayed/modified in Web UI. I'm on Almalinux 9 and installed appstream packages from alma (4.11.0-15.el9_4.alma.1). I do not know python,jquery,js/css and really banging against the wall here. I know about https://abbra.fedorapeople.org/freeipa-extensibility.html https://github.com/abbra/freeipa-userstatus-plugin/blob/master/plugin/Featu… but not really understand much there obviously. Here is a forum question very close to what I'm trying to achieve: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost… Based on that I created mailalt.js: define([ 'freeipa/phases', 'freeipa/user'], function(phases, user_mod) { function get_item(array, attr, value) { for (var i=0,l=array.length; i<l; i++) { if (array[i][attr] === value) return array[i]; } return null; } var mail_alt_plugin = {}; mail_alt_plugin.add_mail_alt_pre_op = function() { var facet = get_item(user_mod.entity_spec.facets, '$type', 'details'); var section = get_item(facet.sections, 'name', 'contact'); section.fields.push({ $type: 'multivalued', name: 'mailAlternateAddress', flags: ['w_if_no_aci'], label: 'Alternative Mail' ], }); return true; }; phases.on('customization', mail_alt_plugin.add_mail_alt_pre_op); return mail_alt_plugin; }); then put it in /usr/share/ipa/ui/js/plugins/mailalt/ and executed ipa-server-upgrade But still no mailAlternateAddress field shown. Any advise here? Thank you

2 5

glibc and group merging
by Ronald Wimmer 30 Jul '24

30 Jul '24

Group merging works like expected as described by Alexander several years ago in https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost… My question is if it is possible to specify the ipa user in /etc/groups without the domain suffix? (adding default_domain_suffix in the sssd section of sssd.conf did not help) someuser@someserver:~ $ getent initgroups splunk splunk 1246640006 someuser@someserver:~ $ getent initgroups splunk(a)linux.mydomain.at splunk(a)linux.mydomain.at 1246640006 190 Why would I want that? The respective line in /etc/groups could be the same across all our domains. Cheers, Ronald

1 1

Trouble installing because DNS zone already exists.
by B Vad 29 Jul '24

29 Jul '24

Hi, I'm prepping for the RedHat IDM exam, and want to install freeipa, with integrated DNS server. However, one of the requirements is having DNS running already so hosts are resolvable both ways, and have a SRV record pointing towards the NTP server. I set up an authoritative DNS server and add the hosts, requirements met. However, whenever I try to install with DNS enable active and --forwarders=myauthoritativednsserver I run into the following error: Checking DNS domain homelab.com., please wait ...DNS zone homelab.com. already exists in DNS and is handled by server(s): r0.homelab.com. Could someone please explain how to properly setup my lab to install freeipa with the dns server installed? I've been wrestling this problem for a few days now, and I seem to be missing something !

2 1

Trouble installing because DNS zone already exists.
by B Vad 27 Jul '24

27 Jul '24

Hi, I'm prepping for the RedHat IDM exam, and want to install freeipa, with integrated DNS server. However, one of the requirements is having DNS running already so hosts are resolvable both ways, and have a SRV record pointing towards the NTP server. I set up an authoritative DNS server and add the hosts, requirements met. However, whenever I try to install with DNS enable active and --forwarders=myauthoritativednsserver I run into the following error: Checking DNS domain homelab.com., please wait ...DNS zone homelab.com. already exists in DNS and is handled by server(s): r0.homelab.com. Could someone please explain how to properly setup my lab to install freeipa with the dns server installed? I've been wrestling this problem for a few days now, and I seem to be missing something !

1 0

Trouble installing because DNS zone already exists.
by B Vad 27 Jul '24

27 Jul '24

Hi, I'm prepping for the RedHat IDM exam, and want to install freeipa, with integrated DNS server. However, one of the requirements is having DNS running already so hosts are resolvable both ways, and have a SRV record pointing towards the NTP server. I set up an authoritative DNS server and add the hosts, requirements met. However, whenever I try to install with DNS enable active and --forwarders=myauthoritativednsserver I run into the following error: Checking DNS domain homelab.com., please wait ...DNS zone homelab.com. already exists in DNS and is handled by server(s): r0.homelab.com. Could someone please explain how to properly setup my lab to install freeipa with the dns server installed? I've been wrestling this problem for a few days now, and I seem to be missing something !

1 0

Trouble with (letsencrypt) certs after updating IPA
by Giulio Casella 26 Jul '24

26 Jul '24

Hi, I'm having trouble after this morning update: I had a setup (based on RHEL 9) with 3 IPA servers, with certificate generated by letsencrypt (https://github.com/freeipa/freeipa-letsencrypt) After updating I noticed the web UI was using self signed CA, so I run setup-le.sh. The certificates were correctly regenerated, and the browser was happy. But when I try to login it fails, and in httpd error log I find: [Thu Jul 25 18:20:53.773180 2024] [wsgi:error] [pid 15636:tid 15924] [remote 10.10.10.10:38566] ipa: INFO: 401 Unauthorized: HTTPSConnectionPool(host='dc1.example.com', port=443): Max retries exceeded with url: /ipa/session/cookie (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1129)'))) Trying to rerun setup-le.sh now the "ipa-certupdate" part fails with same error: cannot connect to 'any of the configured servers': https://dc1.example.com/ipa/json, https://dc3.example.com/ipa/json, https://dc2.example.com/ipa/json It seems some old certificate (ca or server) is still inside IPA. Other services (NFS, ssh to ipa clients, ...) seems to work. I hope it's not only the sss cache! Any ideas? TIA, gc

3 5

GSSAPI server authentication in python (WSGI)
by Aurelien Bompard 26 Jul '24

26 Jul '24

Hey folks! I'm part of Fedora Infrastructure and we maintain our FreeIPA-based auth stack (among many other things). We have mostly Python-based web applications, and while they use OpenID Connect (OIDC) for authentication, some of them are using GSSAPI authentication directly to authenticate clients (koji, fasjson, copr). Until now, we've put those apps behind apache's mod_auth_gssapi and used the env variable it sets to read the authenticated user. Unfortunately this is starting to not be sufficient, for the following two reasons: - we want to only authenticate parts of the app - running the apps behind apache in OpenShift adds another layer that is not very convenient in containers, and prevents us from using Python builder images with s2i since those only support gunicorn I'm considering writing/adapting a WSGI authentication layer that would handle GSSAPI. I've seen that somebody has already written one for ASGI (the async version of WSGI) here: https://github.com/washed-out/asgi-gssapi/ It's also based on an older WSGI implementation that was based on python-kerberos, now obsoleted by python-gssapi. So I'm considering reusing asgi-gssapi and making it do WSGI instead. Do you think it's a bad idea? Do you know of other libraries that do this? (I searched, but found nothing besides the 2 I mentionned). Most of the work will be done by python-gssapi, but there's always room for security flaws in this sort of thing, and I'm not a Kerberos/GSSAPI expert. Would somebody here be interested in this GSSAPI-WSGI layer? How about co-maintaining it? Thanks! Aurélien

2 2

Problems with ipa after recent upgrade ssh works web does not cant add new servers and fiew other problems
by Przemysław Orzechowski 26 Jul '24

26 Jul '24

Hi I'm using Oracle Linux8 on all IPA servers After IPA upgrade i noticed several problems 1) Nobody including admin can log into WEB UI (Your session has expired. Please log in again.) 2) Can't add new machines to IPA (JSON-RPC response: {"result": null, "error": {"code": 2100, "message": "Insufficient access: SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Credential cache is empty)", "data": {"info": "SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Credential cache is empty)"}, "name": "ACIError"}, "id": null, "principal": "UNKNOWN", "version": "4.9.13"}) 3) certificate reneval (ipa-getcert) fails (ca-error: Server at https://dc02.dc.makolab.pl/ipa/json denied our request, giving up: 2100 (Insufficient access: SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Credential cache is empty)).) - this command was run directly on IPA server dc02 (reneval of certificate for rsyslog TLS) Replication between IPA servers seems to be working ok Ipa healthchek does not find any errors or critical only few warnings ipa-healthcheck --output-type human --all --severity WARNING WARNING: ipahealthcheck.ipa.certs.IPACertTracking.20220104115549: certmonger tracking request 20220104115549 found and is not expected on an IPA master. <- certificate for metricbit TLS WARNING: ipahealthcheck.ipa.certs.IPACertTracking.20220104120152: certmonger tracking request 20220104120152 found and is not expected on an IPA master. <- certificate for rsyslog TLS WARNING: ipahealthcheck.ipa.idns.IPADNSSystemRecordsCheck._kpasswd.dc.makolab.pl.:krb5srv:m:tcp:dc02.dc.makolab.pl.: Expected URI record missing WARNING: ipahealthcheck.ipa.idns.IPADNSSystemRecordsCheck._kpasswd.dc.makolab.pl.:krb5srv:m:udp:dc02.dc.makolab.pl.: Expected URI record missing WARNING: ipahealthcheck.ipa.idns.IPADNSSystemRecordsCheck._kpasswd.dc.makolab.pl.:krb5srv:m:tcp:dc03.dc.makolab.pl.: Expected URI record missing WARNING: ipahealthcheck.ipa.idns.IPADNSSystemRecordsCheck._kpasswd.dc.makolab.pl.:krb5srv:m:udp:dc03.dc.makolab.pl.: Expected URI record missing WARNING: ipahealthcheck.ipa.idns.IPADNSSystemRecordsCheck._kpasswd.dc.makolab.pl.:krb5srv:m:tcp:dc04.dc.makolab.pl.: Expected URI record missing WARNING: ipahealthcheck.ipa.idns.IPADNSSystemRecordsCheck._kpasswd.dc.makolab.pl.:krb5srv:m:udp:dc04.dc.makolab.pl.: Expected URI record missing WARNING: ipahealthcheck.ipa.idns.IPADNSSystemRecordsCheck._kpasswd.dc.makolab.pl.:krb5srv:m:tcp:dc05.dc.makolab.pl.: Expected URI record missing WARNING: ipahealthcheck.ipa.idns.IPADNSSystemRecordsCheck._kpasswd.dc.makolab.pl.:krb5srv:m:udp:dc05.dc.makolab.pl.: Expected URI record missing when running ipa ping on remote machine or directly ipa server i get error: kinit admin && ipa -d ping Password for admin(a)DC.MAKOLAB.PL: ipa: DEBUG: Loading Index file from '/var/lib/ipa-client/sysrestore/sysrestore.index' ipa: DEBUG: Loading StateFile from '/var/lib/ipa-client/sysrestore/sysrestore.state' ipa: DEBUG: Loading StateFile from '/var/lib/ipa-client/sysrestore/sysrestore.state' ipa: DEBUG: failed to find session_cookie in persistent storage for principal 'admin(a)DC.MAKOLAB.PL' ipa: DEBUG: trying https://dc02.dc.makolab.pl/ipa/json ipa: DEBUG: New HTTP connection (dc02.dc.makolab.pl) ipa: DEBUG: received Set-Cookie (<class 'list'>)'['ipa_session=MagBearerToken=WX9t37J4908GxZduLpoz%2fW6IvRmXHrv21rq%2bjWklhTT1Xdk4%2fkUiAzIjGwZuHKk9Tvbb5h5WEHLpzLgN5Rn6gBFp88%2fj%2bZUjKTwSfQtcc8eaO45GUR4juCXxkoNCc9QGlPsqfeLthgHVpCy2jdP3PNyndOGLAWc8cx7kwskzQZd7NQV45VQ2WUJ5LSe3P79vAa5wvP8GgUSVJpcNdtQk2A%3d%3d;path=/ipa;httponly;secure;']' ipa: DEBUG: storing cookie 'ipa_session=MagBearerToken=WX9t37J4908GxZduLpoz%2fW6IvRmXHrv21rq%2bjWklhTT1Xdk4%2fkUiAzIjGwZuHKk9Tvbb5h5WEHLpzLgN5Rn6gBFp88%2fj%2bZUjKTwSfQtcc8eaO45GUR4juCXxkoNCc9QGlPsqfeLthgHVpCy2jdP3PNyndOGLAWc8cx7kwskzQZd7NQV45VQ2WUJ5LSe3P79vAa5wvP8GgUSVJpcNdtQk2A%3d%3d;' for principal admin(a)DC.MAKOLAB.PL ipa: INFO: Connection to https://dc02.dc.makolab.pl/ipa/json failed with Insufficient access: SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Credential cache is empty) ipa: DEBUG: trying https://dc05.dc.makolab.pl/ipa/json ipa: DEBUG: New HTTP connection (dc05.dc.makolab.pl) ipa: DEBUG: received Set-Cookie (<class 'list'>)'['ipa_session=MagBearerToken=QZfbEtCnuZSE9aKBHV%2fMhFu25SHZOdV%2b9hmiA8T2fMLWv4%2bGiIjTkmijQhBSMeMTW1usB1Ufod1k17ZtIYrF3swFZkwte7GeQVoGzSRnp66oQPlzGC6JzTrE8Sy0QvOqaIKZKDgBpKSYLltGMNkCCziKFsfsGCfulwQmDeHsa5coQ6jazBB6%2fJBhf7ZJlIKA9uHkFYQdHzkAPbkjG5T8Mw%3d%3d;path=/ipa;httponly;secure;']' ipa: DEBUG: storing cookie 'ipa_session=MagBearerToken=QZfbEtCnuZSE9aKBHV%2fMhFu25SHZOdV%2b9hmiA8T2fMLWv4%2bGiIjTkmijQhBSMeMTW1usB1Ufod1k17ZtIYrF3swFZkwte7GeQVoGzSRnp66oQPlzGC6JzTrE8Sy0QvOqaIKZKDgBpKSYLltGMNkCCziKFsfsGCfulwQmDeHsa5coQ6jazBB6%2fJBhf7ZJlIKA9uHkFYQdHzkAPbkjG5T8Mw%3d%3d;' for principal admin(a)DC.MAKOLAB.PL ipa: INFO: Connection to https://dc05.dc.makolab.pl/ipa/json failed with Insufficient access: SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Credential cache is empty) ipa: DEBUG: trying https://dc03.dc.makolab.pl/ipa/json ipa: DEBUG: New HTTP connection (dc03.dc.makolab.pl) ipa: DEBUG: received Set-Cookie (<class 'list'>)'['ipa_session=MagBearerToken=qHTfoDQ%2bsTVui5w8dxcfx6Fx9GORKX%2fHFsEAc2yoI6g7eL4qsvVXh9uNZLfrop7nSTqrJs0toSjpGQfSkjloUY6%2f338%2fwVz1xazGV5aVAMujclsd%2bVrX%2bj92r%2bsf1%2fdtPU1VLsPBflqWuwOLOFLGnTEWQKVeGgBkf%2fvZ7f3vIa%2fP0OvYtTaORQE49tf%2bXUkQ%2bQiW5I11D%2f0hBLKnjqc2Qw%3d%3d;path=/ipa;httponly;secure;']' ipa: DEBUG: storing cookie 'ipa_session=MagBearerToken=qHTfoDQ%2bsTVui5w8dxcfx6Fx9GORKX%2fHFsEAc2yoI6g7eL4qsvVXh9uNZLfrop7nSTqrJs0toSjpGQfSkjloUY6%2f338%2fwVz1xazGV5aVAMujclsd%2bVrX%2bj92r%2bsf1%2fdtPU1VLsPBflqWuwOLOFLGnTEWQKVeGgBkf%2fvZ7f3vIa%2fP0OvYtTaORQE49tf%2bXUkQ%2bQiW5I11D%2f0hBLKnjqc2Qw%3d%3d;' for principal admin(a)DC.MAKOLAB.PL ipa: INFO: Connection to https://dc03.dc.makolab.pl/ipa/json failed with Insufficient access: SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Credential cache is empty) ipa: DEBUG: trying https://dc04.dc.makolab.pl/ipa/json ipa: DEBUG: New HTTP connection (dc04.dc.makolab.pl) ipa: DEBUG: received Set-Cookie (<class 'list'>)'['ipa_session=MagBearerToken=fLBKVOskfDdrVsu%2fU7p5ZzYPDKKl2g3uCVZbUnioVPNNeH8Hrwpt4IHz4edHc%2bTrj0ERrqUK8egmfv8797SpAk27pE7%2bfDkHOPrndW9n4Uzkm4SvUa1QFnjxSwey3vdXA8L9H%2bQJaI7tDtPUbRw5nTfSzWi22bhH%2fLIsIqVcibzHjSzzRz1NB%2by6j5IIuUiTO1nokizbe1%2bV3TN7%2fWA2Dw%3d%3d;path=/ipa;httponly;secure;']' ipa: DEBUG: storing cookie 'ipa_session=MagBearerToken=fLBKVOskfDdrVsu%2fU7p5ZzYPDKKl2g3uCVZbUnioVPNNeH8Hrwpt4IHz4edHc%2bTrj0ERrqUK8egmfv8797SpAk27pE7%2bfDkHOPrndW9n4Uzkm4SvUa1QFnjxSwey3vdXA8L9H%2bQJaI7tDtPUbRw5nTfSzWi22bhH%2fLIsIqVcibzHjSzzRz1NB%2by6j5IIuUiTO1nokizbe1%2bV3TN7%2fWA2Dw%3d%3d;' for principal admin(a)DC.MAKOLAB.PL ipa: INFO: Connection to https://dc04.dc.makolab.pl/ipa/json failed with Insufficient access: SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Credential cache is empty) ipa: ERROR: cannot connect to 'any of the configured servers': https://dc02.dc.makolab.pl/ipa/json, https://dc05.dc.makolab.pl/ipa/json, https://dc03.dc.makolab.pl/ipa/json, https://dc04.dc.makolab.pl/ipa/json Checked the admin user has ipaNTSecurityIdentifier: S-1-5-21-1851759508-3520056987-880742157-500 Other users also have ipaNTSecurityIdentifier defined in ldap klist -kt /etc/dirsrv/ds.keytab Keytab name: FILE:/etc/dirsrv/ds.keytab KVNO Timestamp Principal ---- ----------------- -------------------------------------------------------- 1 12/30/21 13:09:34 ldap/dc02.dc.makolab.pl(a)DC.MAKOLAB.PL 1 12/30/21 13:09:34 ldap/dc02.dc.makolab.pl(a)DC.MAKOLAB.PL kvno -k /etc/dirsrv/ds.keytab ldap/dc02.dc.makolab.pl ldap/dc02.dc.makolab.pl(a)DC.MAKOLAB.PL: kvno = 1, keytab entry valid Problems I spotted in logs: in /var/log/dirsrv/slapd-DOMAIN/error [25/Jul/2024:12:36:11.325055589 +0000] - ERR - set_krb5_creds - Could not get initial credentials for principal [ldap/dc02.dc.makolab.pl(a)DC.MAKOLAB.PL] in keytab [FILE:/etc/dirsrv/ds.keytab]: -1765328324 (Generic error (see e-text)) [25/Jul/2024:12:36:16.399028241 +0000] - ERR - schema-compat-plugin - warning: no entries set up under cn=computers, cn=compat,dc=dc,dc=makolab,dc=pl [25/Jul/2024:12:36:16.401195077 +0000] - ERR - schema-compat-plugin - Finished plugin initialization. from httpd error_log [Fri Jul 26 10:58:46.588000 2024] [wsgi:error] [pid 11820:tid 140020710070016] [remote 172.16.129.240:59424] ipa: INFO: 401 Unauthorized: Insufficient access: SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Credential cache is empty) [Fri Jul 26 10:58:46.636457 2024] [wsgi:error] [pid 11821:tid 140020710070016] [remote 172.16.129.240:59424] ipa: INFO: 401 Unauthorized: Insufficient access: SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Credential cache is empty) I would like to ask for any help with this problems. Regards Przemyslaw Orzechowski

1 0

Creating user_add callback
by Anton PalkoBrosov 25 Jul '24

25 Jul '24

Hi, i am trying to make callback which will make API calls to external system when new user created. So i puts the script to "/usr/lib/python2.7/site-packages/ipaserver/plugins", give execute priveleges to file and restart freeipa server. Greating new user in GUI - so folder is not creating. In my script i just programmed simple action - creation of folder. Script: import os from ipalib.plugins.user import user_add from ipalib import api, plugable def verify_shell_cb(self, ldap, dn, entry_attrs, *keys, **options): folder_path = '/home/freeipa/suka' if not os.path.exists(folder_path): os.makedirs(folder_path) user_add.register_post_callback(verify_shell_cb) api.register(user_add)

2 5

Re: Azure AD / Azure AD Connect / FreeIPA sync
by Alban Meunier 24 Jul '24

24 Jul '24

On summer 2024, recent updates can be realy interesting in order to provide a better integration from freeIPA and Entra ID (former Azure AD) * Samba 4.18 + supports Entra connect cloud sync https://wiki.samba.org/index.php/Azure_AD_Connect_Cloud_sync. Is it a version used by freeIPA ? * Samba should have samba-winbinnd package to provide RPC support (refer to §1.1.1) https://docs.redhat.com/fr/documentation/red_hat_enterprise_linux/9/html/co… * freeIPA supports to authenticate users against Entra ID https://access.redhat.com/solutions/7073948 * many alternatives on the go to authenticate Entra ID users on Linux hosts : * https://www.puppeteers.net/blog/linux-azure-ad-authentication-options/ * https://learn.microsoft.com/en-gb/entra/identity/devices/howto-vm-sign-in-a… @Alexander Bokovoy : what is the roadmap for FreeIPA to provide integration features with Microsoft Entra as it becomes a must have in many corporate environments and education as well ?

1 0

Web-UI login says: "Login failed due to an unknown reason."
by Thomas Boroske 24 Jul '24

24 Jul '24

Hello all, I have a problem with logging in to the web interface (username/pw) of one of my IPA servers, ipa2. The installation is CA-less, without pkinit, and consists of master servers ipa1 and ipa2 Ipa1 works fine at this time, ipa2 fails with "Login failed due to an unknown reason." in the web ui. In the httpd error log: calledProcessError: Command '/usr/bin/kinit -n -c /var/run/ipa/ccaches/armor_11164 -X X509_anchors=FILE:/var/kerberos/krb5kdc/kdc.crt -X X509_anchors=FILE:/var/lib/ipa-client/pki/kdc-ca-bundle.pem' returned non-zero exit status 1 If I try to run /kinit -n - -X X509_anchors=FILE:/var/kerberos/krb5kdc/kdc.crt -X X509_anchors=FILE:/var/lib/ipa-client/pki/kdc-ca-bundle.pem for testing on ipa2, it asks me for a password (which I don't know). Doing the same on ipa1 will not ask for a password, but simply adds the WELLKNOWN/ANONYMOUS principal to the keyring: [root@charon run]# LANG=C klist -a Ticket cache: KEYRING:persistent:0:krb_ccache_vscxoCZ Default principal: WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS Valid starting Expires Service principal 22.07.2024 17:21:34 23.07.2024 17:21:34 krbtgt/NET.IDA(a)NET.IDA Addresses: (none) So I guess this might be part of the problem. Note that "kinit <user>" with a password I know works fine on ipa2. What can I do to fix this? I should say I had the same problem 2 years ago or so, but with reversed roles (ipa1 not allowing login, ipa2 working fine). According to my notes from back then, a "systemctl restart sssd" fixed it that time. Unfortunately this does not seem to help this time. Many thanks for any ideas, Thomas Boroske

2 4

GSSAPI authentication failure
by Bryan Carroll 23 Jul '24

23 Jul '24

Hi all, After an upgrade from 4.10.0-8 to 4.11.0-15, I'm getting an authentication failure in the access log: [11/Jul/2024:17:32:01.528294151 -0500] conn=57224 op=1 RESULT err=49 tag=97 nentries=0 wtime=0.000076683 optime=0.265358256 etime=0.265415438 - SASL(-13): authentication failure: GSSAPI Failure: gss_accept_sec_context This is preventing anyone from logging in. Kvno was saying the keytab entry is invalid and wrong principal in request: root@pacific dirsrv $ klist -kt /etc/dirsrv/ds.keytab Keytab name: FILE:/etc/dirsrv/ds.keytab KVNO Timestamp Principal ---- ------------------- ------------------------------------------------------ 1 03/08/2023 23:34:09 ldap/pacific.caps.int(a)CAPS.INT 1 03/08/2023 23:34:09 ldap/pacific.caps.int(a)CAPS.INT root@pacific ~ $ kvno -k /etc/dirsrv/ds.keytab ldap/pacific.caps.int ldap/pacific.caps.int(a)CAPS.INT: kvno = 2, keytab entry invalid kvno: Wrong principal in request while decrypting ticket for ldap/pacific.caps.int(a)CAPS.INT So I got a new ticket with ktutil and the kvno still shows it is invalid: root@pacific dirsrv $ klist -kt /etc/dirsrv/ds.keytab Keytab name: FILE:/etc/dirsrv/ds.keytab KVNO Timestamp Principal ---- ------------------- ------------------------------------------------------ 2 07/11/2024 18:54:19 ldap/pacific.caps.int(a)CAPS.INT root@pacific dirsrv $ kvno -k /etc/dirsrv/ds.keytab ldap/pacific.caps.int ldap/pacific.caps.int(a)CAPS.INT: kvno = 2, keytab entry invalid kvno: Wrong principal in request while decrypting ticket for ldap/pacific.caps.int(a)CAPS.INT I checked the database for the principal: root@pacific dirsrv $ kadmin.local Authenticating as principal capsipa/admin(a)CAPS.INT with password. kadmin.local: get_principal ldap/pacific.caps.int Principal: ldap/pacific.caps.int(a)CAPS.INT Expiration date: [never] Last password change: Mon Jul 08 10:21:07 CDT 2024 Password expiration date: [never] Maximum ticket life: 1 day 00:00:00 Maximum renewable life: 7 days 00:00:00 Last modified: Mon Jul 08 10:21:07 CDT 2024 (ldap/pacific.caps.int(a)CAPS.INT) Last successful authentication: [never] Last failed authentication: Mon Jul 08 23:54:29 CDT 2024 Failed password attempts: 4 Number of keys: 2 Key: vno 2, aes256-cts-hmac-sha1-96:special Key: vno 2, aes128-cts-hmac-sha1-96:special MKey: vno 1 Attributes: REQUIRES_PRE_AUTH Policy: [none] The ldap.conf contents: SASL_NOCANON on BASE dc=caps,dc=int TLS_CACERT /etc/ipa/ca.crt SASL_MECH GSSAPI URI ldaps://pacific.caps.int The krb5.conf contents: includedir /etc/krb5.conf.d/ [logging] default = FILE:/var/log/krb5libs.log kdc = FILE:/var/log/krb5kdc.log admin_server = FILE:/var/log/kadmind.log [libdefaults] default_realm = CAPS.INT dns_lookup_realm = false dns_lookup_kdc = true rdns = false ticket_lifetime = 24h forwardable = true udp_preference_limit = 0 default_ccache_name = KEYRING:persistent:%{uid} [realms] CAPS.INT = { kdc = pacific.caps.int:88 master_kdc = pacific.caps.int:88 kpasswd_server = pacific.caps.int:464 admin_server = pacific.caps.int:749 default_domain = caps.int pkinit_anchors = FILE:/var/lib/ipa-client/pki/kdc-ca-bundle.pem pkinit_pool = FILE:/var/lib/ipa-client/pki/ca-bundle.pem } [domain_realm] .caps.int = CAPS.INT caps.int = CAPS.INT pacific.caps.int = CAPS.INT [dbmodules] CAPS.INT = { db_library = ipadb.so } [plugins] certauth = { module = ipakdb:kdb/ipadb.so enable_only = ipakdb } I'm not sure where to go from here: Thank you, Bryan Carroll

4 10

Make email field mandatory when creationg new user in GUI
by Anton PalkoBrosov 23 Jul '24

23 Jul '24

By default when creating new user in FreeipaGUI it automatically fills email with template username@doman I need to make email filed was mandatory in new user modal window, so it was unable to create new user without specifying email

2 4

trust ad, refresh the shared account
by Jonathan Oxidnation 23 Jul '24

23 Jul '24

Hello everybody, I have a question about the objects created when we establish a trust between freeipa servers and an Active Directory Microsoft. There is something that could refresh the objects to renew the sensitive data? In my situation I used a AD account (with admin privileges) to create the trust. But after several months, the objects do not refresh themself. (WhenChanged attribute on the AD side has an old date) This question comes from our security team asking to renew the object to guarantee the security of the trust. Regards,

2 3

creating a stage user disable existing user account
by Philipp Takacs 22 Jul '24

22 Jul '24

Hello I currently play a bit around with stage user. The plan is to allow a specific group to create stage user and then let an admin activate this user. I wanted to know if the UID is checked for dublicates so I created a stage user with the same UID as mine. This creates a stage user without an error or warning. Problem is now the user account with the same UID didn't work anymore. This is a bit suprising. Because this way anyone who can create stage users can practicaly disable active users. Is there some sort of workaround for this other then only allow only admins to create stage users? Philipp

2 2

trust ad, refresh the shared account
by Jonathan Oxidnation 22 Jul '24

22 Jul '24

Hello everybody, I have a question about the objects created when we establish a trust between freeipa servers and an Active Directory Microsoft. There is something that could refresh the objects to renew the sensitive data? In my situation I used a AD account (with admin privileges) to create the trust. But after several months, the objects do not refresh themself. (WhenChanged attribute on the AD side has an old date) This question comes from our security team asking to renew the object to guarantee the security of the trust. Regards, Jonathan

1 0

How to check compactDB has finished successfuly?
by seojeong kim 22 Jul '24

22 Jul '24

[root@ipa-slave2 changelog]# ls -la total 172 drwx------ 2 dirsrv dirsrv 4096 Jan 8 2022 . drwxrwx--- 5 dirsrv dirsrv 4096 Jul 22 10:03 .. -rw------- 1 dirsrv dirsrv 51 Jul 16 02:37 DBVERSION -rw------- 1 dirsrv dirsrv 16384 Jan 8 2022 aci.db -rw------- 1 dirsrv dirsrv 16384 Jan 8 2022 ancestorid.db -rw------- 1 dirsrv dirsrv 16384 Jan 8 2022 changenumber.db -rw------- 1 dirsrv dirsrv 16384 Jan 8 2022 cn.db -rw------- 1 dirsrv dirsrv 16384 Jan 8 2022 entryrdn.db -rw------- 1 dirsrv dirsrv 16384 Jan 8 2022 entryusn.db -rw------- 1 dirsrv dirsrv 16384 Jan 8 2022 id2entry.db -rw------- 1 dirsrv dirsrv 16384 Jan 8 2022 nsuniqueid.db -rw------- 1 dirsrv dirsrv 16384 Jan 8 2022 objectclass.db -rw------- 1 dirsrv dirsrv 16384 Jan 8 2022 seeAlso.db core server has been running 2 years more and we have nsslapd-db-compactdb-interval : 30 days. recently I faced out of available db lock count I get to know about the value of nsslapd-db-locks. I need to change this value with big one. but also I want to check compactdb has been running so far while I was not aware of compactDB preocess. so I entered /db/ and checked the files. under /changelog, the date of files are 2022.Jan, 8 How can I check compactDB processed so far? and if compactDB run correctly the date of files under changelog/ should be updated with the latest date ? here the nsslapd-* configurations. [root@ipa-slave2 userRoot]# dsconf -D "cn=Directory Manager" slapd-MYDOMAIN backend config get | grep "nsslapd" nsslapd-lookthroughlimit: 100000 nsslapd-mode: 600 nsslapd-idlistscanlimit: 100000 nsslapd-directory: /var/lib/dirsrv/slapd-MYDOMAIN/db nsslapd-import-cachesize: 16777216 nsslapd-idl-switch: new nsslapd-search-bypass-filter-test: on nsslapd-search-use-vlv-index: on nsslapd-exclude-from-export: entrydn entryid dncomp parentid numSubordinates tombstonenumsubordinates entryusn nsslapd-serial-lock: on nsslapd-subtree-rename-switch: on nsslapd-pagedlookthroughlimit: 0 nsslapd-pagedidlistscanlimit: 0 nsslapd-rangelookthroughlimit: 5000 nsslapd-backend-opt-level: 1 nsslapd-backend-implement: bdb nsslapd-dbcachesize: 1610612736 nsslapd-db-logdirectory: /var/lib/dirsrv/slapd-SAMSUNGSRE-COM/db nsslapd-db-home-directory: /var/lib/dirsrv/slapd-SAMSUNGSRE-COM/db nsslapd-db-durable-transaction: on nsslapd-db-transaction-wait: off nsslapd-db-checkpoint-interval: 60 nsslapd-db-compactdb-interval: 2592000 nsslapd-db-page-size: nsslapd-db-transaction-batch-val: 0 nsslapd-db-transaction-batch-min-wait: 50 nsslapd-db-transaction-batch-max-wait: 50 nsslapd-db-logbuf-size: 0 nsslapd-db-locks: 10000 nsslapd-db-private-import-mem: on nsslapd-import-cache-autosize: 0 nsslapd-cache-autosize: 80 nsslapd-cache-autosize-split: 10 nsslapd-db-deadlock-policy: 9

1 0

adjustment for nsslapd-changelogcompactdb-interval
by seojeong kim 22 Jul '24

22 Jul '24

current value of nsslapd-changelogcompactdb-interval is 30 days. we have 10 core servers. Is this value can be configured with the different value for each server? Because recently I experience core crashed because of 'out of available lock entries' and 'db error - 12 Cannot allocate memory' We have 50000 for nsslapd-db-locks and 30 days for nsslapd-changelogcompactdb-interval . 30 days ago, all core servers are restarted for some reason and 30 days later, nsslapd-changelogcompactdb-interval is expired and all server run compactDB. while running compactDB, core server raised error with 'out of available lock entries' and 'db error - 12 Cannot allocate memory' and crashed. Q1. nsslapd-changelogcompactdb-interval can be configured with different value for each server?

1 1

Plugin API Reference or Detailed Documentation
by F B 20 Jul '24

20 Jul '24

Background: I have a working FreeIPA setup that incorporates NFSv4 shares from a NAS utilising Kerberos. Part of this setup was creating an Object Class with two attributes. In order to streamline the process of configuring the attributes during user creation, I've created a plugin by scraping together information from here, the FreeIPA website, GitHub, and some other sources. The plugin works for setting the two attribute values during user creation, and during modification in the web user interface. Question: Apart from combing through the FreeIPA code, where can I find more detailed information for improving my plugin? Something akin to an API reference? Or documentation that describes the objects and methods (including parameters, and return values)? For example, where can I find a comprehensive list of facet sections? Or where can I find a full spec of the field for pushing into the section? Where can I find detailed information for the Python side of things as well? I noticed this message in the httpd error_log: ipaserver.plugins.my_plugin is not a valid plugin module However, the plugin works. My plugin isn't the only one generating this error. Some of the ones that shipped with FreeIPA also generate this message. [baseldap, hbac, otp, rabase] Is there a reason for this? I would be grateful if someone can point me in the correct direction. I'm not sure if this ask is outside the scope of what this community provides, bear with me if it is.

2 2

LDAP automatically restarted
by seojeong kim 19 Jul '24

19 Jul '24

389 directory service automatically restarted. I can't find specific error to trigger restart. there is no PANIC error and deadlock detect error... there is only just 'Incomming BER element was too long' This error situation can trigger LDAP restart automatically ? [19/Jul/2024:06:22:59.279311026 +0000] - ERR - log_ber_too_big_error - conn=6079847 fd=396 Incoming BER Element was too long, max allowable is 209715200 bytes. Change the nsslapd-maxbersize attribute in cn=config to increase. [19/Jul/2024:06:23:01.700334149 +0000] - ERR - log_ber_too_big_error - conn=6079857 fd=1452 Incoming BER Element was too long, max allowable is 209715200 bytes. Change the nsslapd-maxbersize attribute in cn=config to increase. [19/Jul/2024:06:27:57.779058899 +0000] - ERR - NSMMReplicationPlugin - changelog program - _cl5WriteOperationTxn - retry (49) the transaction (csn=669a075e000900e90000) failed (rc=-30993 (BDB0068 DB_LOCK_DEADLOCK: Locker killed to resolve a deadlock)) [19/Jul/2024:06:27:57.780583532 +0000] - ERR - NSMMReplicationPlugin - changelog program - _cl5WriteOperationTxn - Failed to write entry with csn (669a075e000900e90000); db error - -30993 BDB0068 DB_LOCK_DEADLOCK: Locker killed to resolve a deadlock [19/Jul/2024:06:27:57.781557073 +0000] - ERR - NSMMReplicationPlugin - write_changelog_and_ruv - Can't add a change for cn=penup-pre,cn=hostgroups,cn=accounts,dc=mydomain,dc=com (uniqid: 000f3c05-70fc11eb-87e9f15a-5f2429bf, optype: 8) to changelog csn 669a075e000900e90000 [19/Jul/2024:06:27:58.125647535 +0000] - ERR - NSMMReplicationPlugin - process_postop - Failed to apply update (669a075e000900e90000) error (1). Aborting replication session(conn=6075545 op=2978) [19/Jul/2024:06:30:38.073674777 +0000] - ERR - log_ber_too_big_error - conn=6081159 fd=400 Incoming BER Element was 369736146107 bytes, max allowable is 209715200 bytes. Change the nsslapd-maxbersize attribute in cn=config to increase. [19/Jul/2024:06:32:09.283886791 +0000] - ERR - connection_read_operation - conn=6081404 received a non-LDAP message (tag 0x18, expected 0x30) [19/Jul/2024:06:33:29.585984549 +0000] - ERR - log_ber_too_big_error - conn=6081679 fd=311 Incoming BER Element was too long, max allowable is 209715200 bytes. Change the nsslapd-maxbersize attribute in cn=config to increase. [19/Jul/2024:06:34:04.617847679 +0000] - ERR - slapd_system_isFIPS - Can not access /proc/sys/crypto/fips_enabled - assuming FIPS is OFF [19/Jul/2024:06:34:04.619891225 +0000] - ERR - slapd_system_isFIPS - Can not access /proc/sys/crypto/fips_enabled - assuming FIPS is OFF [19/Jul/2024:06:34:04.931778931 +0000] - INFO - util_get_hardware_threads - Automatically configuring 16 threads [19/Jul/2024:06:34:05.521184530 +0000] - WARN - Security Initialization - /tmp is not a private namespace. pem files not exported there [19/Jul/2024:06:34:05.522737820 +0000] - INFO - slapd_extract_cert - CA CERT NAME: MYDOMAIN.COM IPA CA [19/Jul/2024:06:34:05.524500653 +0000] - WARN - Security Initialization - SSL alert: Sending pin request to SVRCore. You may need to run systemd-tty-ask-password-agent to provide the password. [19/Jul/2024:06:34:05.624809111 +0000] - INFO - slapd_extract_cert - SERVER CERT NAME: Server-Cert [19/Jul/2024:06:34:05.626359141 +0000] - WARN - Security Initialization - /tmp is not a private namespace. pem files not exported there [19/Jul/2024:06:34:05.627801709 +0000] - WARN - Security Initialization - /tmp is not a private namespace. pem files not exported there [19/Jul/2024:06:34:05.854933657 +0000] - INFO - Security Initialization - SSL info: Enabling default cipher set. [19/Jul/2024:06:34:05.856382522 +0000] - INFO - Security Initialization - SSL info: Configured NSS Ciphers [19/Jul/2024:06:34:05.857556371 +0000] - INFO - Security Initialization - SSL info: TLS_AES_128_GCM_SHA256: enabled [19/Jul/2024:06:34:05.858503393 +0000] - INFO - Security Initialization - SSL info: TLS_CHACHA20_POLY1305_SHA256: enabled [19/Jul/2024:06:34:05.859485862 +0000] - INFO - Security Initialization - SSL info: TLS_AES_256_GCM_SHA384: enabled [19/Jul/2024:06:34:05.860543982 +0000] - INFO - Security Initialization - SSL info: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256: enabled [19/Jul/2024:06:34:05.861588021 +0000] - INFO - Security Initialization - SSL info: TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256: enabled [19/Jul/2024:06:34:05.862625065 +0000] - INFO - Security Initialization - SSL info: TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256: enabled [19/Jul/2024:06:34:05.863601471 +0000] - INFO - Security Initialization - SSL info: TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256: enabled [19/Jul/2024:06:34:05.864790795 +0000] - INFO - Security Initialization - SSL info: TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384: enabled [19/Jul/2024:06:34:05.865759945 +0000] - INFO - Security Initialization - SSL info: TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384: enabled [19/Jul/2024:06:34:05.866807116 +0000] - INFO - Security Initialization - SSL info: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA: enabled [19/Jul/2024:06:34:05.867919186 +0000] - INFO - Security Initialization - SSL info: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA: enabled [19/Jul/2024:06:34:05.868910775 +0000] - INFO - Security Initialization - SSL info: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA: enabled [19/Jul/2024:06:34:05.869828849 +0000] - INFO - Security Initialization - SSL info: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256: enabled [19/Jul/2024:06:34:05.870846944 +0000] - INFO - Security Initialization - SSL info: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256: enabled [19/Jul/2024:06:34:05.871884481 +0000] - INFO - Security Initialization - SSL info: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA: enabled [19/Jul/2024:06:34:05.872960919 +0000] - INFO - Security Initialization - SSL info: TLS_DHE_RSA_WITH_AES_128_GCM_SHA256: enabled [19/Jul/2024:06:34:05.873942777 +0000] - INFO - Security Initialization - SSL info: TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256: enabled [19/Jul/2024:06:34:05.874915469 +0000] - INFO - Security Initialization - SSL info: TLS_DHE_RSA_WITH_AES_256_GCM_SHA384: enabled [19/Jul/2024:06:34:05.875865057 +0000] - INFO - Security Initialization - SSL info: TLS_DHE_RSA_WITH_AES_128_CBC_SHA: enabled [19/Jul/2024:06:34:05.876812156 +0000] - INFO - Security Initialization - SSL info: TLS_DHE_RSA_WITH_AES_128_CBC_SHA256: enabled [19/Jul/2024:06:34:05.877842946 +0000] - INFO - Security Initialization - SSL info: TLS_DHE_RSA_WITH_AES_256_CBC_SHA: enabled [19/Jul/2024:06:34:05.878878446 +0000] - INFO - Security Initialization - SSL info: TLS_DHE_RSA_WITH_AES_256_CBC_SHA256: enabled [19/Jul/2024:06:34:05.879941260 +0000] - INFO - Security Initialization - SSL info: TLS_RSA_WITH_AES_128_GCM_SHA256: enabled [19/Jul/2024:06:34:05.880887578 +0000] - INFO - Security Initialization - SSL info: TLS_RSA_WITH_AES_256_GCM_SHA384: enabled [19/Jul/2024:06:34:05.881905650 +0000] - INFO - Security Initialization - SSL info: TLS_RSA_WITH_AES_128_CBC_SHA: enabled [19/Jul/2024:06:34:05.882724291 +0000] - INFO - Security Initialization - SSL info: TLS_RSA_WITH_AES_128_CBC_SHA256: enabled [19/Jul/2024:06:34:05.883536996 +0000] - INFO - Security Initialization - SSL info: TLS_RSA_WITH_AES_256_CBC_SHA: enabled [19/Jul/2024:06:34:05.884375320 +0000] - INFO - Security Initialization - SSL info: TLS_RSA_WITH_AES_256_CBC_SHA256: enabled [19/Jul/2024:06:34:06.172298339 +0000] - INFO - Security Initialization - slapd_ssl_init2 - Configured SSL version range: min: TLS1.2, max: TLS1.3 [19/Jul/2024:06:34:06.174035089 +0000] - INFO - Security Initialization - slapd_ssl_init2 - NSS adjusted SSL version range: min: TLS1.2, max: TLS1.3 [19/Jul/2024:06:34:06.175409580 +0000] - INFO - main - 389-Directory/1.4.3.12 B2020.213.0000 starting up

3 2

adjustment of 'nsslapd-changelogcompactdb-interval', nsslapd-db-locks
by seojeong kim 19 Jul '24

19 Jul '24

current value of nsslapd-changelogcompactdb-interval is 30 days. we have 10 core servers. Is this value can be configured with the different value for each server? Because recently I experience core crashed because of 'out of available lock entries' and 'db error - 12 Cannot allocate memory' We have 50000 for nsslapd-db-locks and 30 days for nsslapd-changelogcompactdb-interval . 30 days ago, all core servers are restarted for some reason and 30 days later, nsslapd-changelogcompactdb-interval is expired and all server run compactDB. while running compactDB, core server raised error with 'out of available lock entries' and 'db error - 12 Cannot allocate memory' and crashed. So tunning these values is required. Q1. nsslapd-changelogcompactdb-interval can be configured with different value for each server?

1 0

User certificate for vpn logins
by Chris Kross 18 Jul '24

18 Jul '24

Hello to all! I'm trying a lot, to setup a Firewall vpn login with certificates generated by the FreeIPA server, but i´m stucked now. I have the user certificate generated by the FreeIPA and the firewall generate the CSR then imported on the FreeIPA server, and download the pem generated by the UI and imported again in the Firewall and the firewall match the sign certificate. But when we try to connect to the VPN using certificates, the debug shows: fnbamd_auth_cert_result-Result for ldap svr[0] 'fripa.domain.net' is DENY auth_cert_success-Matched user name 'CA-Ldaps', matched group name 'CA-Ldapgrp' fnbamd_comm_send_result-Sending result 1 (error 0, nid 672) for req 454599539 delete_group_list-Delete group CA-Ldapgrp ike 3:C2-HQ_DCI:50: certificate validation failed From the firewall we can test the Ldaps users and passwords and the test is OK. Thnks to all for any advice!

2 1

Re: Authentication failures on a RHEL 9.2 IPA server
by Basile Pinsard 18 Jul '24

18 Jul '24

Hi, I have a similar issue after reimporting user with migrate-ds including users in a legacy range. I created the id-range to contain these users ids, but some users show an error similar to the one described above. Did you manage to fix it? When running the sidgen task after setting the range, these problematic users do not get assigned the required field in the LDAP. Is there a log of the sidgen task somewhere? Thanks!

1 0

2FA not working with OpenVPN Free IPA Integration
by Tinku Goyal 18 Jul '24

18 Jul '24

My setup includes a set of FreeIPA servers running on 4.9.2 version and a OpenVPN configured for the users to connect to VPN. Previously I was using IPA version 4.6.8 on CentOS7 and now installed IPA replica on 4.9.2 on OL8 and decommissioned the old one. I am using openvpn-plugin-auth-pam.so with login pam file to authenticate the IPA users logging in to OpenVPN. when I am resetting the password of users now, then users are not able to login to OpenVPN with 2FA (password+otp) whereas, with otp disabled it is working for old users for whom password is not resetted recently after change in IPA cluster, their authentication is working through OpenVPN with/without OTP both. All users(old + users whose password is resetted recently) are able to login to linux servers using password and OTP both combination, its just not authenticating in OpenVPN. I have tried multiple things but still couldn't able to get it work. Hoping if someone can help with this!!

2 6

User certificate for vpn logins
by Chris Kross 17 Jul '24

17 Jul '24

Hello to all! I'm trying a lot, to setup a Firewall vpn login with certificates generated by the FreeIPA server, but i´m stucked now. I have the user certificate generated by the FreeIPA and the firewall generate the CSR then imported on the FreeIPA server, and download the pem generated by the UI and imported again in the Firewall and the firewall match the sign certificate. But when we try to connect to the VPN using certificates, the debug shows: fnbamd_auth_cert_result-Result for ldap svr[0] 'fripa.domain.net' is DENY auth_cert_success-Matched user name 'CA-Ldaps', matched group name 'CA-Ldapgrp' fnbamd_comm_send_result-Sending result 1 (error 0, nid 672) for req 454599539 delete_group_list-Delete group CA-Ldapgrp ike 3:C2-HQ_DCI:50: certificate validation failed From the firewall we can test the Ldaps users and passwords and the test is OK. Thnks to all for any advice!

1 0

Creste ipa users via ldapmodify
by Francis Augusto Medeiros-Logeay 13 Jul '24

13 Jul '24

Hi, I am using FreeIPA with Keycloak. I’ve configure it so that I can create users in Keycloak and they are created on freeipa. It works, the users are created, but they are not displayed under “users” on FreeIPA’s admin console. I added a lot of Objectclasses to see if that was the problem, but doesn’t seem to be it. Is it a group membership I’m missing? Best, Francis __ Francis Augusto Medeiros Oslo, Norway Sent from a mobile device / Enviado a partir de dispositivo móvel

1 0

freeipa role delegation before delete and upgrade
by John Michelle 12 Jul '24

12 Jul '24

Hello I ve 3 Freeipa Server, replicated in each other as a topology. [root@ipa001 ~] ipa-replica-manage list ipa03.domain.local: master ipa02.domain.local: master ipa01.domain.local: master this is the output of the command ipa find role : [root@ipa001 ~]# ipa server-role-find --server ipa001.domain.local ------------------------------ 6 rôles serveur correspondants ------------------------------ Nom du serveur: ipa01.domain.local Nom du rôle: CA server État du rôle: enabled Nom du serveur: ipa01.domain.local Nom du rôle: DNS server État du rôle: enabled Nom du serveur: ipa01.domain.local Nom du rôle: NTP server État du rôle: enabled Nom du serveur: ipa01.domain.local Nom du rôle: AD trust agent État du rôle: absent Nom du serveur: ipa01.domain.local Nom du rôle: KRA server État du rôle: absent Nom du serveur: ipa01.domain.local Nom du rôle: AD trust controller État du rôle: absent ---------------------------- Nombre d'entrées renvoyées 6 ---------------------------- [root@ipa01 ~]# ipa server-role-find --server ipa02.domain.local ------------------------------ 6 rôles serveur correspondants ------------------------------ Nom du serveur: ipa02.domain.local Nom du rôle: CA server État du rôle: enabled Nom du serveur: ipa02.domain.local Nom du rôle: DNS server État du rôle: enabled Nom du serveur: ipa02.domain.local Nom du rôle: NTP server État du rôle: absent Nom du serveur: ipa02.domain.local Nom du rôle: AD trust agent État du rôle: absent Nom du serveur: ipa02.domain.local Nom du rôle: KRA server État du rôle: absent Nom du serveur: ipa02.domain.local Nom du rôle: AD trust controller État du rôle: absent ---------------------------- Nombre d'entrées renvoyées 6 ---------------------------- [root@ipa01 ~]# ipa server-role-find --server ipa03.domain.local ------------------------------ 6 rôles serveur correspondants ------------------------------ Nom du serveur: ipa03.domain.local Nom du rôle: CA server État du rôle: configured Nom du serveur: ipa03.domain.local Nom du rôle: DNS server État du rôle: enabled Nom du serveur: ipa03.domain.local Nom du rôle: NTP server État du rôle: absent Nom du serveur: ipa03.domain.local Nom du rôle: AD trust agent État du rôle: absent Nom du serveur: ipa03.domain.local Nom du rôle: KRA server État du rôle: absent Nom du serveur: ipa03.domain.local Nom du rôle: AD trust controller État du rôle: absent ---------------------------- Nombre d'entrées renvoyées 6 ---------------------------- [root@ipa01 ~]# when i delete the ipa01 server, i will lose the ntp role. i want to delegate the ntp role to the 2 servers, but i don't know what NTP server is configured in the IPA01. also, i see that the CA server role is configured, Any idea to see that configuration and know why this role is not enabled ? can i see all configuration and know what options is selected to install replicas ? ( --no-forwarders, etc ) Thanks

3 9

dyndns and dns forwarders
by David Harvey 12 Jul '24

12 Jul '24

Dear list, I'm thinking of making our border devices our primary port of call for DNS , and setting them to forward to FreeIPA. I found an inconclusive thread saying that this might break dyndns for my otherwise happy IPA clients. Does dyndns working rely upon clients having IPA servers setups as their DNS server? I couldn't see an sssd option of "send updates here (only use this NIC)". I am hoping to avoid having to use the route of getting DHCP to update DNS instead! Thanks as always, David

2 2

browse FreeIPA automountmap
by Kris C 11 Jul '24

11 Jul '24

Hi all, I'm looking high and low for a way to create/configure an automountmap in FreeIPA that is browsable. i.e. Something that would look like this if we were doing it old school: /etc/auto.master: /games auto.games -browse --timeout 120 in /etc/auto.games: tron -fstype nfs gameserver:/tron cod -fstype nfs gameserver:/cod I can do all of this in FreeIPA but for the life of me can't figure out how to have the equivalent of the -browse option enabled for the auto.games map entry. Am I making any sense? Thanks, -K

2 1

browse FreeIPA automountmap
by Kris C 11 Jul '24

11 Jul '24

Hi all, I'm looking high and low for a way to create/configure an automountmap in FreeIPA that is browsable. i.e. Something that would look like this if we were doing it old school: /etc/auto.master: /games auto.games -browse --timeout 120 in /etc/auto.games: tron -fstype nfs gameserver:/tron cod -fstype nfs gameserver:/cod I can do all of this in FreeIPA but for the life of me can't figure out how to have the equivalent of the -browse option enabled for the auto.games map entry. Am I making any sense? Thanks, -K

1 0

browse FreeIPA automountmap
by Kris C 11 Jul '24

11 Jul '24

Hi all, I'm looking high and low for a way to create/configure an automountmap in FreeIPA that is browsable. i.e. Something that would look like this if we were doing it old school: /etc/auto.master: /games auto.games -browse --timeout 120 in /etc/auto.games: tron -fstype nfs gameserver:/tron cod -fstype nfs gameserver:/cod I can do all of this in FreeIPA but for the life of me can't figure out how to have the equivalent of the -browse option enabled for the auto.games map entry. Am I making any sense? Thanks, -K

1 0

beginner question: external dns resolving for lan hosts?
by M B 11 Jul '24

11 Jul '24

Hey everyone, actually getting started with FreeIPA. My goal is to use FreeIPA for internal lan dns, external dns resolving (or forwarding to my opnsense unbound to get external resolving). This shouldnt work only for the FreeIPA server itself, as is already does when using named unbound as forwarder with "forward-only" policy. What i'm trying to reach is to use FreeIPA as dns server of my other lan clients to get external dns resolved. In this example: debian 12 So i'm using in my debian ENI configuration file dns-nameservers with the ip of the ipa server - resolving of its own local zone is working fine - but not the external resolving. The debian cant resolve e.g. google.com. Maybe anyone can give me hint? BTW: Actually i dont want to use the freeipa-client as i'm actually not that deep into freeipa to handle that yet. Just wanna use the DNS and NTP of freeipa for my lan clients for now.

1 0

Thunderbird v. 115 with FreeIPA LDAP address book
by Antonello Ledda 11 Jul '24

11 Jul '24

Hi We're trying to set up the Thunderbird address book to get user data from FreeIPA LDAP service, but we cannot get the email address of the users, we've tried with Base DN string : cn=users,cn=accounts,dc=xxxxxx,dc=yyy , but the only field we were able to get is the username and the role in the organization . Is there some way to get all user data ? Thanks in advance Regards Antonello

4 6

demo1.freeipa.org
by veck zuo 10 Jul '24

10 Jul '24

I am deploying the freeIPA demo follwing below link. https://www.freeipa.org/page/Demo [root@localhost ~]# ping www.google.com PING www.google.com (142.250.196.68) 56(84) bytes of data. 64 bytes from maa03s46-in-f4.1e100.net (142.250.196.68): icmp_seq=1 ttl=128 time=347 ms 64 bytes from maa03s46-in-f4.1e100.net (142.250.196.68): icmp_seq=2 ttl=128 time=348 ms ^C --- www.google.com ping statistics --- 2 packets transmitted, 2 received, 0% packet loss, time 1001ms rtt min/avg/max/mdev = 346.995/347.316/347.637/0.321 ms [root@localhost ~]# [root@localhost ~]# ipa-client-install --domain demo1.freeipa.org -p admin -w Secret123 This program will set up IPA client. Version 4.9.13 Skip ipa.demo1.freeipa.org: LDAP server is not responding, unable to verify if this is an IPA server Skip ipa.demo1.freeipa.org: LDAP server is not responding, unable to verify if this is an IPA server Provide your IPA server name (ex: ipa.example.com) ^CThe ipa-client-install command failed. See /var/log/ipaclient-install.log for more information

2 3

FreeIPA docker ccaches
by Paavo Nugin 09 Jul '24

09 Jul '24

Hello! I'm trying to migrate away from our old IPA server running on Centos 7. After solving multiple problems I've reached the following setup: ipa.domain - old centos 7 VM ipa1.domain - new replica, rocky 8 freeipa docker container running on Ubuntu 22.04 (because AFAIK it's not supported to go straight from 7 to 9) ipa2.domain - new replica, rocky 9 freeipa docker container running on Ubuntu 22.04 Mostly everything seems to work fine, I can authenticate against any of 3 servers but I've hit annoying problem that I've haven't yet solved despite extensive google-fu. So scenario is as follows: 1) kinit on my laptop - works ok (ubuntu 22.04) 2) use firefox to access https://ipa2.domain - SSO works perfectly without asking any credentials. 3) restart ipa2.domain container 4) hit f5 in firefox - login screen, asks for username and password - not working quite as expected. No amount of kdestroy or kinit against any of 3 servers will solve it (I don't have IPA DNS setup and set servers manually in krb5.conf). I can login with entering username and password manually but SSO won't work (but SSO works perfectly against ipa.domain and ipa1.domain). Same scenario is happening with ipa1.domain when I restart it. I'm not really eager to restart ipa.domain since our users are using it but I'm 99% sure that it wont have the same problem since it's not running in container and previous restarts have not produced such issue. What helps - deleting cookies in browser - then SSO starts to work again - until next restart of container. httpd/error_log: [Tue Jul 09 14:51:00.648879 2024] [wsgi:error] [pid 322:tid 550] [remote myIP:38914] ipa: DEBUG: WSGI wsgi_dispatch.__call__: [Tue Jul 09 14:51:00.649030 2024] [wsgi:error] [pid 322:tid 550] [remote myIP:38914] ipa: DEBUG: WSGI jsonserver_i18n_messages.__call__: [Tue Jul 09 14:51:00.649309 2024] [wsgi:error] [pid 322:tid 550] [remote myIP:38914] ipa: DEBUG: WSGI jsonserver.__call__: [Tue Jul 09 14:51:00.649343 2024] [wsgi:error] [pid 322:tid 550] [remote myIP:38914] ipa: DEBUG: WSGI WSGIExecutioner.__call__: [Tue Jul 09 14:51:00.655929 2024] [wsgi:error] [pid 322:tid 550] [remote myIP:38914] ipa: DEBUG: raw: i18n_messages(version='2.253') [Tue Jul 09 14:51:00.656035 2024] [wsgi:error] [pid 322:tid 550] [remote myIP:38914] ipa: DEBUG: i18n_messages(version='2.253') [Tue Jul 09 14:51:00.660245 2024] [wsgi:error] [pid 322:tid 550] [remote myIP:38914] ipa: INFO: [jsonserver_i18n_messages] UNKNOWN: i18n_messages(version='2.253'): SUCCESS [Tue Jul 09 14:51:00.660291 2024] [wsgi:error] [pid 322:tid 550] [remote myIP:38914] ipa: DEBUG: [jsonserver_i18n_messages] UNKNOWN: i18n_messages(version='2.253'): SUCCESS etime=10778664 [Tue Jul 09 14:51:00.801704 2024] [:warn] [pid 326:tid 408] [client myIP:38908] KRB5CCNAME file (/run/ipa/ccaches/myuser@DOMAIN-8gyvGu) lookup failed!, referer: https://ipa2.domain/ipa/ui/ [Tue Jul 09 14:51:00.802729 2024] [wsgi:error] [pid 321:tid 553] [remote myIP:38908] ipa: DEBUG: WSGI wsgi_dispatch.__call__: [Tue Jul 09 14:51:00.802792 2024] [wsgi:error] [pid 321:tid 553] [remote myIP:38908] ipa: DEBUG: WSGI jsonserver_session.__call__: [Tue Jul 09 14:51:00.802861 2024] [wsgi:error] [pid 321:tid 553] [remote myIP:38908] ipa: DEBUG: Valid Referer https://ipa2.domain/ipa/ui/ [Tue Jul 09 14:51:00.806518 2024] [wsgi:error] [pid 321:tid 553] [remote myIP:38908] ipa: DEBUG: ccache expired or invalid, deleting session, need login [Tue Jul 09 14:51:00.806570 2024] [wsgi:error] [pid 321:tid 553] [remote myIP:38908] ipa: DEBUG: 401 Unauthorized need login [Tue Jul 09 14:51:00.818339 2024] [:warn] [pid 466:tid 486] [client myIP:38914] KRB5CCNAME file (/run/ipa/ccaches/myuser@DOMAIN-8gyvGu) lookup failed!, referer: https://ipa2.domain/ipa/ui/ [Tue Jul 09 14:51:00.819251 2024] [wsgi:error] [pid 324:tid 556] [remote myIP:38914] ipa: DEBUG: WSGI wsgi_dispatch.__call__: [Tue Jul 09 14:51:00.819313 2024] [wsgi:error] [pid 324:tid 556] [remote myIP:38914] ipa: DEBUG: WSGI KerberosLogin.__call__: [Tue Jul 09 14:51:00.819378 2024] [wsgi:error] [pid 324:tid 556] [remote myIP:38914] ipa: DEBUG: Valid Referer https://ipa2.domain/ipa/ui/ [Tue Jul 09 14:51:00.822213 2024] [wsgi:error] [pid 324:tid 556] [remote myIP:38914] ipa: DEBUG: ccache expired or invalid, deleting session, need login [Tue Jul 09 14:51:00.822279 2024] [wsgi:error] [pid 324:tid 556] [remote :38914] ipa: DEBUG: 401 Unauthorized need login /run/ipa/ccaches/ folder is indeed empty. When I delete cookies and are able to log on then I see files created in that folder but they disappear after container restart. docker command that I used to setup up replica is slight modification to one described in: https://hub.docker.com/r/freeipa/freeipa-server/ docker run -ti --dns=IP1 --dns=IP2 --name freeipa-server -h ipa2.domain --read-only -v /var/lib/ipa-data:/data:Z -v /etc/localtime:/etc/localtime:ro -v /etc/timezone:/etc/timezone:ro -p 80:80 -p 443:443 -p 389:389 -p 636:636 -p 88:88 -p 464:464 -p 88:88/udp -p 464:464/udp -p 123:123/udp freeipa/freeipa-server:rocky-9 ipa-replica-install --password 'random-password' --server=ipa1.domain --domain=domain Any ideas how to overcome this problem? BR, Paavo

3 3

zone_journal_compact: could not get zone size: not found
by Kees Bakker 09 Jul '24

09 Jul '24

Hi, At the moment I have three FreeIPA systems (replicas), recently installed with CentOS 9-Stream. All three of these show this message at irregular intervals. Jul 03 07:50:44 iparep5.example.com named[541]: zone example.com/IN: zone_journal_compact: could not get zone size: not found Jul 03 07:50:51 iparep5.example.com named[541]: zone 16.16.172.in-addr.arpa/IN: zone_journal_compact: could not get zone size: not found Jul 03 07:51:03 iparep5.example.com named[541]: zone 17.16.172.in-addr.arpa/IN: zone_journal_compact: could not get zone size: not found Jul 03 07:51:34 iparep5.example.com named[541]: zone 29.16.172.in-addr.arpa/IN: zone_journal_compact: could not get zone size: not found Jul 03 07:52:12 iparep5.example.com named[541]: zone 30.16.172.in-addr.arpa/IN: zone_journal_compact: could not get zone size: not found Jul 03 08:03:51 iparep5.example.com named[541]: zone example.com/IN: zone_journal_compact: could not get zone size: not found Jul 03 08:04:52 iparep5.example.com named[541]: zone 29.16.172.in-addr.arpa/IN: zone_journal_compact: could not get zone size: not found Jul 03 08:06:30 iparep5.example.com named[541]: zone 30.16.172.in-addr.arpa/IN: zone_journal_compact: could not get zone size: not found Jul 03 08:18:42 iparep5.example.com named[541]: zone example.com/IN: zone_journal_compact: could not get zone size: not found Jul 03 08:20:19 iparep5.example.com named[541]: zone 29.16.172.in-addr.arpa/IN: zone_journal_compact: could not get zone size: not found Jul 03 08:26:23 iparep5.example.com named[541]: zone 30.16.172.in-addr.arpa/IN: zone_journal_compact: could not get zone size: not found Jul 03 08:34:12 iparep5.example.com named[541]: zone example.com/IN: zone_journal_compact: could not get zone size: not found Jul 03 08:34:50 iparep5.example.com named[541]: zone 29.16.172.in-addr.arpa/IN: zone_journal_compact: could not get zone size: not found After posting this on the bind-users mailing list I did a bit more debugging. It turns out that the message is caused by the fact that bind-dyndb-ldap does not implement the getsize method. Now why didn't I see this message on my CentOS 8-Stream system? Well, it is because the bind package went from 9.11.26 to 9.16.23. In that newer version a new function zone_journal_compact was added which does the following: zone.c: journalsize= zone->journalsize; if(journalsize== -1) { journalsize= DNS_JOURNAL_SIZE_MAX; dns_db_currentversion(db, &ver); result= dns_db_getsize(db, ver, NULL, &dbsize); dns_db_closeversion(db, &ver, false); if(result!= ISC_R_SUCCESS) { dns_zone_log(zone, ISC_LOG_ERROR, "zone_journal_compact: " "could not get zone size: %s", isc_result_totext(result)); } elseif(dbsize< DNS_JOURNAL_SIZE_MAX/ 2) { journalsize= (int32_t)dbsize* 2; } } and dns_db_getsize executes this: isc_result_t dns_db_getsize(dns_db_t*db, dns_dbversion_t*version, uint64_t*records, uint64_t*bytes) { REQUIRE(DNS_DB_VALID(db)); REQUIRE(dns_db_iszone(db)); if(db->methods->getsize!= NULL) { return((db->methods->getsize)(db, version, records, bytes)); } return(ISC_R_NOTFOUND); } However, the getsize method is not implemented. Thus you'll get the above mentioned messages. I'm surprised that nobody reported this. Everybody with FreeIPA + DNS + CentOS 9-Stream should be getting these messages. The messages are colored in red in journalctl, as if this is a serious problem. Is it? Or can I ignore this message? -- Kees

2 1

Disable user password expiration immediately after password reset.
by luckydog xf 07 Jul '24

07 Jul '24

Once the admin changes the user password, it will expire immediately. Can we disable this policy?

3 3

Re: ipa upgrade failed
by Johannes Falke 07 Jul '24

07 Jul '24

How did you actually manage to resolve this issue? I'm seeing the same thing trying to upgrade either f35->f37 or f35->f36 (and NO ldap errors). On f35, freeipa says it's healthy.

3 5

`ipactl restart` fails with `Unknown error when retrieving list of services from LDAP: not enough values to unpack (expected 2, got 1)`
by Andrea Stacchiotti 05 Jul '24

05 Jul '24

Hello everyone, freshly installed ipa server on Oracle Linux 9, via the ansible role at https://github.com/freeipa/ansible-freeipa/blob/master/roles/ipaserver/READ… The installation goes apparently well, but if I try restarting the service I get the error in the subject, which prevents dirsrv from starting, a debug log is at the end. This is apparently a known issue, as https://access.redhat.com/solutions/5268961 exists to address it, but I don't have a subscription and I found no other results on the internet. It seems to be an issue finding services, but `ipa service-find` finds HTTP and ldap as expected. Can someone help? Thanks ------------ [root@ipa-innovation opc]# ipactl start -d ipa: DEBUG: importing all plugin modules in ipaserver.plugins... ipa: DEBUG: importing plugin module ipaserver.plugins.aci [...] Starting Directory Service ipa: DEBUG: Starting external process ipa: DEBUG: args=['/bin/systemctl', 'start', 'dirsrv(a)PRIVATE-ACUS-EU.service'] ipa: DEBUG: Process finished, return code=0 ipa: DEBUG: Starting external process ipa: DEBUG: args=['/bin/systemctl', 'is-active', 'dirsrv(a)PRIVATE-ACUS-EU.service'] ipa: DEBUG: Process finished, return code=0 ipa: DEBUG: stdout=active ipa: DEBUG: stderr= ipa: DEBUG: wait_for_open_ports: localhost [389] timeout 120 ipa: DEBUG: waiting for port: 389 ipa: DEBUG: SUCCESS: port: 389 ipa: DEBUG: Start of dirsrv(a)PRIVATE-ACUS-EU.service complete ipa: DEBUG: Starting external process ipa: DEBUG: args=['/bin/systemctl', 'is-active', 'dirsrv(a)PRIVATE-ACUS-EU.service'] ipa: DEBUG: Process finished, return code=0 ipa: DEBUG: stdout=active ipa: DEBUG: stderr= Failed to read data from service file: Unknown error when retrieving list of services from LDAP: not enough values to unpack (expected 2, got 1) Shutting down ipa: DEBUG: Starting external process ipa: DEBUG: args=['/bin/systemctl', 'stop', 'dirsrv(a)PRIVATE-ACUS-EU.service'] ipa: DEBUG: Process finished, return code=0 ipa: DEBUG: Stop of dirsrv(a)PRIVATE-ACUS-EU.service complete ipa: DEBUG: File "/usr/lib/python3.9/site-packages/ipaserver/install/installutils.py", line 781, in run_script return_value = main_function() File "/usr/lib/python3.9/site-packages/ipaserver/install/ipactl.py", line 735, in main ipa_start(options) File "/usr/lib/python3.9/site-packages/ipaserver/install/ipactl.py", line 398, in ipa_start raise IpactlError(rval=e.rval) ipa: DEBUG: The ipactl command failed, exception: IpactlError:

3 5

CentOS 7 - named-pkcs11 crashes / won't start after patches/security upgrades
by Braden McGrath 05 Jul '24

05 Jul '24

See subject... I have 3 CentOS 7 VMs running as FreeIPA Servers. I ran a standard "yum update" as root; these packages were included as part of that update: bind.x86_64 32:9.11.4-26.P2.el7_9.16 bind-dyndb-ldap.x86_64 11.1-7.el7_9.1 bind-export-libs.x86_64 32:9.11.4-26.P2.el7_9.16 bind-libs.x86_64 32:9.11.4-26.P2.el7_9.16 bind-libs-lite.x86_64 32:9.11.4-26.P2.el7_9.16 bind-license.noarch 32:9.11.4-26.P2.el7_9.16 bind-pkcs11.x86_64 32:9.11.4-26.P2.el7_9.16 bind-pkcs11-libs.x86_64 32:9.11.4-26.P2.el7_9.16 bind-pkcs11-utils.x86_64 32:9.11.4-26.P2.el7_9.16 bind-utils.x86_64 32:9.11.4-26.P2.el7_9.16 Previously, bind-dyndb-ldap had been on 11.1-7.el7 (no "_9.1" suffix) And the rest had been on the exact same versions as above, but ending in .15. After the upgrade, named-pkcs11 crashes when started by systemctl, with the following journalctl output (server domain has been anonymized but everything else was untouched): Jul 02 19:39:19 ipa3.example.net named-pkcs11[10794]: ../../../lib/dns-pkcs11/name.c:1114: REQUIRE((target != ((void *)0) && (__builtin_expect(!!((target) != ((void *)0)), 1) && __builtin_expect(!!(((const isc__magic_t *)(target))->magic == (0x42756621U)), 1))) || (target == ((void *)0) && (__builtin_expect(!!((name->buffer) != ((void *)0)), 1) && __builtin_expect(!!(((const isc__magic_t *)(name->buffer))->magic == (0x42756621U)), 1)))) failed, back trace Jul 02 19:39:19 ipa3.example.net named-pkcs11[10794]: #0 0x561df47e5130 in ?? Jul 02 19:39:19 ipa3.example.net named-pkcs11[10794]: #1 0x7fac0362b48a in ?? Jul 02 19:39:19 ipa3.example.net named-pkcs11[10794]: #2 0x7fac03930b7b in ?? Jul 02 19:39:19 ipa3.example.net named-pkcs11[10794]: #3 0x7fabfb6efb78 in ?? Jul 02 19:39:19 ipa3.example.net named-pkcs11[10794]: #4 0x7fabfb6effee in ?? Jul 02 19:39:19 ipa3.example.net named-pkcs11[10794]: #5 0x7fabfb6f198b in ?? Jul 02 19:39:19 ipa3.example.net named-pkcs11[10794]: #6 0x7fabfb6f1b89 in ?? Jul 02 19:39:19 ipa3.example.net named-pkcs11[10794]: #7 0x7fabfb6fb528 in ?? Jul 02 19:39:19 ipa3.example.net named-pkcs11[10794]: #8 0x7fac03650713 in ?? Jul 02 19:39:19 ipa3.example.net named-pkcs11[10794]: #9 0x7fac0365128b in ?? Jul 02 19:39:19 ipa3.example.net named-pkcs11[10794]: #10 0x7fac01726ea5 in ?? Jul 02 19:39:19 ipa3.example.net named-pkcs11[10794]: #11 0x7fac00799b0d in ?? Jul 02 19:39:19 ipa3.example.net named-pkcs11[10794]: exiting (due to assertion failure) Jul 02 19:39:19 ipa3.example.net systemd[1]: named-pkcs11.service: main process exited, code=killed, status=6/ABRT Jul 02 19:39:19 ipa3.example.net systemd[1]: Unit named-pkcs11.service entered failed state. Jul 02 19:39:19 ipa3.example.net systemd[1]: named-pkcs11.service failed. I was able to get named to start again by running a "yum downgrade" of the above list of bind-related packages. Obviously, now the server is "behind" on patches though. I'm not sure how to report this further to get it investigated/fixed, or if any action will even be taken at this point now that CentOS7 is EOL. I'm happy to provide additional details if requested. Regards, Braden McGrath braden(a)big-geek.net

4 4

Unable to access LDAP server - ipa-server-install
by Meikel Bloch 04 Jul '24

04 Jul '24

Hey everyone, just tried to install freeipa on a hetzner cloud server cause i'm actually looking for alternative to UCS. I still dont get it, why FreeIPA is in need to be reachable on a public net, but thats not the point here. I have a clean, fresh Fedora 40 with running network, hostname resolves, also reverse dns - behind a OPNsense NAT Gateway with its own ipv4 public ip. I have opened the Ports 389 & 636 When trying to run ipa-server-install, the following error occurs, where i cant understand why it cant access the LDAP server. I've checked up with nmap - port is open. Further LDAP service seems to run. Maybe someone has an idea whats going on? INFO: Loading PKI Tomcat config: /usr/share/pki/etc/tomcat.conf INFO: Connecting to LDAP server at ldap://fsn-ipa.domain.tld:389 ERROR: Unable to access LDAP server: ldap://fsn-ipa.domain.tld:389 Traceback (most recent call last): File "<frozen runpy>", line 198, in _run_module_as_main File "<frozen runpy>", line 88, in _run_code File "/usr/lib/python3.12/site-packages/pki/server/pkispawn.py", line 987, in <module> main(sys.argv) File "/usr/lib/python3.12/site-packages/pki/server/pkispawn.py", line 560, in main check_ds() File "/usr/lib/python3.12/site-packages/pki/server/pkispawn.py", line 722, in check_ds verify_ds_configuration() File "/usr/lib/python3.12/site-packages/pki/server/pkispawn.py", line 58, in verify_ds_configuration deployer.ds_bind() File "/usr/lib/python3.12/site-packages/pki/server/deployment/__init__.py", line 2442, in ds_bind self.ds_connection.simple_bind_s( File "/usr/lib64/python3.12/site-packages/ldap/ldapobject.py", line 248, in simple_bind_s msgid = self.simple_bind(who,cred,serverctrls,clientctrls) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/usr/lib64/python3.12/site-packages/ldap/ldapobject.py", line 242, in simple_bind return self._ldap_call(self._l.simple_bind,who,cred,RequestControlTuples(serverctrls),RequestControlTuples(clientctrls)) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/usr/lib64/python3.12/site-packages/ldap/ldapobject.py", line 128, in _ldap_call result = func(*args,**kwargs) ^^^^^^^^^^^^^^^^^^^^ ldap.SERVER_DOWN: {'result': -1, 'desc': "Can't contact LDAP server", 'errno': 107, 'ctrls': [], 'info': 'Transport endpoint is not connected'} 2024-06-29T10:58:32Z CRITICAL Failed to configure CA instance 2024-06-29T10:58:32Z CRITICAL See the installation logs and the following files/directories for more information: 2024-06-29T10:58:32Z CRITICAL /var/log/pki/pki-tomcat 2024-06-29T10:58:32Z DEBUG Traceback (most recent call last): File "/usr/lib/python3.12/site-packages/ipaserver/install/service.py", line 686, in start_creation run_step(full_msg, method) File "/usr/lib/python3.12/site-packages/ipaserver/install/service.py", line 672, in run_step method() File "/usr/lib/python3.12/site-packages/ipaserver/install/cainstance.py", line 678, in __spawn_instance DogtagInstance.spawn_instance( File "/usr/lib/python3.12/site-packages/ipaserver/install/dogtaginstance.py", line 227, in spawn_instance self.handle_setup_error(e) File "/usr/lib/python3.12/site-packages/ipaserver/install/dogtaginstance.py", line 609, in handle_setup_error raise RuntimeError( RuntimeError: CA configuration failed. 2024-06-29T10:58:32Z DEBUG [error] RuntimeError: CA configuration failed. 2024-06-29T10:58:32Z DEBUG Removing /root/.dogtag/pki-tomcat/ca 2024-06-29T10:58:32Z DEBUG File "/usr/lib/python3.12/site-packages/ipapython/admintool.py", line 180, in execute return_value = self.run() ^^^^^^^^^^ File "/usr/lib/python3.12/site-packages/ipapython/install/cli.py", line 344, in run return cfgr.run() ^^^^^^^^^^ File "/usr/lib/python3.12/site-packages/ipapython/install/core.py", line 360, in run return self.execute() ^^^^^^^^^^^^^^ File "/usr/lib/python3.12/site-packages/ipapython/install/core.py", line 386, in execute for rval in self._executor(): File "/usr/lib/python3.12/site-packages/ipapython/install/core.py", line 435, in __runner exc_handler(exc_info) File "/usr/lib/python3.12/site-packages/ipapython/install/core.py", line 468, in _handle_execute_exception self._handle_exception(exc_info) File "/usr/lib/python3.12/site-packages/ipapython/install/core.py", line 458, in _handle_exception six.reraise(*exc_info) File "/usr/lib/python3.12/site-packages/six.py", line 719, in reraise raise value File "/usr/lib/python3.12/site-packages/ipapython/install/core.py", line 425, in __runner step() File "/usr/lib/python3.12/site-packages/ipapython/install/core.py", line 419, in step_next return next(self.__gen) ^^^^^^^^^^^^^^^^ File "/usr/lib/python3.12/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from six.reraise(*exc_info) File "/usr/lib/python3.12/site-packages/six.py", line 719, in reraise raise value File "/usr/lib/python3.12/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from value = gen.send(prev_value) ^^^^^^^^^^^^^^^^^^^^ File "/usr/lib/python3.12/site-packages/ipapython/install/core.py", line 663, in _configure next(executor) File "/usr/lib/python3.12/site-packages/ipapython/install/core.py", line 435, in __runner exc_handler(exc_info) File "/usr/lib/python3.12/site-packages/ipapython/install/core.py", line 468, in _handle_execute_exception self._handle_exception(exc_info) File "/usr/lib/python3.12/site-packages/ipapython/install/core.py", line 526, in _handle_exception self.__parent._handle_exception(exc_info) File "/usr/lib/python3.12/site-packages/ipapython/install/core.py", line 458, in _handle_exception six.reraise(*exc_info) File "/usr/lib/python3.12/site-packages/six.py", line 719, in reraise raise value File "/usr/lib/python3.12/site-packages/ipapython/install/core.py", line 523, in _handle_exception super(ComponentBase, self)._handle_exception(exc_info) File "/usr/lib/python3.12/site-packages/ipapython/install/core.py", line 458, in _handle_exception six.reraise(*exc_info) File "/usr/lib/python3.12/site-packages/six.py", line 719, in reraise raise value File "/usr/lib/python3.12/site-packages/ipapython/install/core.py", line 425, in __runner step() File "/usr/lib/python3.12/site-packages/ipapython/install/core.py", line 419, in step_next return next(self.__gen) ^^^^^^^^^^^^^^^^ File "/usr/lib/python3.12/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from six.reraise(*exc_info) File "/usr/lib/python3.12/site-packages/six.py", line 719, in reraise raise value File "/usr/lib/python3.12/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from value = gen.send(prev_value) ^^^^^^^^^^^^^^^^^^^^ File "/usr/lib/python3.12/site-packages/ipapython/install/common.py", line 65, in _install for unused in self._installer(self.parent): File "/usr/lib/python3.12/site-packages/ipaserver/install/server/__init__.py", line 608, in main master_install(self) File "/usr/lib/python3.12/site-packages/ipaserver/install/server/install.py", line 278, in decorated func(installer) File "/usr/lib/python3.12/site-packages/ipaserver/install/server/install.py", line 960, in install ca.install_step_0(False, None, options, custodia=custodia) File "/usr/lib/python3.12/site-packages/ipaserver/install/ca.py", line 607, in install_step_0 ca.configure_instance( File "/usr/lib/python3.12/site-packages/ipaserver/install/cainstance.py", line 515, in configure_instance self.start_creation(runtime=runtime) File "/usr/lib/python3.12/site-packages/ipaserver/install/service.py", line 686, in start_creation run_step(full_msg, method) File "/usr/lib/python3.12/site-packages/ipaserver/install/service.py", line 672, in run_step method() File "/usr/lib/python3.12/site-packages/ipaserver/install/cainstance.py", line 678, in __spawn_instance DogtagInstance.spawn_instance( File "/usr/lib/python3.12/site-packages/ipaserver/install/dogtaginstance.py", line 227, in spawn_instance self.handle_setup_error(e) File "/usr/lib/python3.12/site-packages/ipaserver/install/dogtaginstance.py", line 609, in handle_setup_error raise RuntimeError( 2024-06-29T10:58:32Z DEBUG The ipa-server-install command failed, exception: RuntimeError: CA configuration failed. 2024-06-29T10:58:32Z ERROR CA configuration failed. 2024-06-29T10:58:32Z ERROR The ipa-server-install command failed. See /var/log/ipaserver-install.log for more information

4 3

Really old (expired) certificates showing up in ipa service-find and in the web ui
by Thomas Boroske 04 Jul '24

04 Jul '24

Dear Mailing List, we are running a freeipa installation using two ipa master servers. Neither the dns feature nor the CA feature are being used. VERSION: 4.6.8, API_VERSION: 2.237 Both ipa servers have ssl/tls certs associated with them that are signed by an external CA. Since these certs expire after 12 month, I had to install new certificates multiple times, and I have been doing that using ipa-server-certinstall -w -d ipa1.p12 This usually works. as in, the new cert shows up in the IPA web ui and the ipa tools (at least some of which work via the https interface) also continue to work. However, I just noticed that the certificates being displayed for the ipa servers both in ipa service-find and in the IPA web UI are old certs that are long expired (in 2021). So my question is a) Why is this the case, isn't ipa-serrver-certinstall supposed to take care of it? b) Why is it still working like that? c) Why are the certs that are actually used for the web interface not visible anywhere, or where are they? Do I maybe need to use the option -k (for kdc) too when doing ipa-server-certinstall? If so, can I fix it now by just re-running with that option? Are there risks in doing so? My understanding if FreeIPA is spotty I have to say as there are multiple complex technologies put together (kerberos, ldap, ...). Many thanks for any help, Thomas

2 1

freeIPA HSM Test Day in Fedora
by Rob Crittenden 03 Jul '24

03 Jul '24

We have scheduled test days for HSM in IPA for next week, https://fedoraproject.org/wiki/Test_Day:Test_Day:2024-07-09_IPA_HSM If you have some time to run through a couple of the scenarios it would be very helpful. If you have access to a hardware HSM even more so. thanks rob

1 0

Best way to upgrade FreeIpa version and OS
by Youssef CHTOUROU 03 Jul '24

03 Jul '24

Hello I've 3 FreeIpa Servers (version =4.6.8) runned on Centos 7. I'am looking for upgrade these servers like that : Centos 7 to Rocky 8 FreeIpa server to most recent version possible I would like to see your advice : what is the best / secure way to do this upgrade ? Thanks a lot

2 1

Re: Create IPA user via LDAP
by Ronald Wimmer 03 Jul '24

03 Jul '24

On 08.01.24 17:58, Alexander Bokovoy wrote: > On Пан, 08 сту 2024, Ronald Wimmer wrote: >> On 02.01.24 17:57, Ronald Wimmer via FreeIPA-users wrote: >>> On 02.01.24 16:27, Rob Crittenden wrote: >>>> Ronald Wimmer via FreeIPA-users wrote: >>>>> >>>>> >>>>> On 14.12.23 14:42, Alexander Bokovoy wrote: >>>>>> On Чцв, 14 сне 2023, Ronald Wimmer via FreeIPA-users wrote: >>>>>>> In our company we do have an IAM tool for user management. We >>>>>>> need to >>>>>>> create IPA users via this particular tool. I am aware of all IPA >>>>>>> commands or API calls to create/modify or delete a user. >>>>>>> >>>>>>> As the tool does not support FreeIPA yet they asked if there is a >>>>>>> way >>>>>>> to manage users by using LDAP only. Could that work? What about >>>>>>> attributes like ipaNTSecurityIdentifier, ipaUniqueID or uidNumber? >>>>>> >>>>>> Learn about lifecycle management. This is your way of integrating >>>>>> with >>>>>> such tools bvy creating staged users: >>>>>> https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/ht… >>>>>> >>>>> >>>>> I followed the instructions from the documentation. >>>>> >>>>> How could I possibly overcome >>>>> >>>>> Dec 19 09:18:39 tipa01.ipatest.mydomain.at ipa-activate-all[836863]: >>>>> ipa: ERROR: Constraint violation: pre-hashed passwords are not valid >>>>> >>>>> I need to set passwords from the external system. >>>> >>>> You need to enable migration mode (ipa config-mod --enable-migration >>>> true). >>>> >>>> By default a pre-hashed password can only be set once: during the user >>>> add operation. >>> >>> Ok. So this would not work for a password change. So if we need to >>> set an initial password and change that particular password in some >>> point in time the only feasible way is the IPA API, right? >>> >>> Can the immediate password expiration be overridden? >> >> As we have an upcoming please allow me to ask if I got the point here. >> >> I appreciate your support in this matter! >> > > I was looking over the code. The only way to accept pre-hashed passwords > is when they also have Kerberos keys set. This means you cannot use > external LDAP modify/add for that as you cannot create the Kerberos key > without knowing a Kerberos master key. > > So the only other option is to submit a clear-text password: > > userPassword: {CLEAR}text-password > > That will be accepted and if bind DN that performed this change is > either a cn=Directory Manager or a one from the passsync managers, it > would also not be marked for expiration immediately. If I try to set the userPassword attribute to some value with an LDAP browser and chose "plaintext" the value gets hashed immediately. I do see {PBKDF2_SHA256}. As a consequence the user cannot be activated. What am I doing wrong? I tried to enable migration mode and wanted to try it again but now I cannot connect to IPA's LDAP directory at all anymore... [root@tipa01 ~]# ipa config-mod --enable-migration=true Maximum username length: 32 Maximum hostname length: 64 Home directory base: /home Default shell: /bin/sh Default users group: ipausers Default e-mail domain: ipatest.mydomain.at Search time limit: 2 Search size limit: 100 User search fields: uid,givenname,sn,telephonenumber,ou,title Group search fields: cn,description Enable migration mode: True Certificate Subject base: O=IPATEST.MYDOMAIN.AT Password Expiration Notification (days): 4 Password plugin features: AllowNThash, KDC:Disable Last Success SELinux user map order: guest_u:s0$xguest_u:s0$user_u:s0$staff_u:s0-s0:c0.c1023$sysadm_u:s0-s0:c0.c1023$unconfined_u:s0-s0:c0.c1023 Default SELinux user: unconfined_u:s0-s0:c0.c1023 Default PAC types: MS-PAC, nfs:NONE IPA masters: tipa01.ipatest.mydomain.at, tipa02.ipatest.mydomain.at IPA master capable of PKINIT: tipa01.ipatest.mydomain.at, tipa02.ipatest.mydomain.at IPA CA servers: tipa01.ipatest.mydomain.at IPA CA renewal master: tipa01.ipatest.mydomain.at Domain resolution order: org.mydomain.at:ipatest.mydomain.at [root@tipa01 ~]# ipa config-mod --enable-migration=false ipa: ERROR: Major (851968): Unspecified GSS failure. Minor code may provide more information, Minor (2529638972): KDC returned error string: PROCESS_TGS

4 30

Fedora 40 - Failed to configure CA instance
by Meikel Bloch 03 Jul '24

03 Jul '24

Hey everyone, just tried to install freeipa on a hetzner cloud server cause i'm actually looking for alternative to UCS. I still dont get it, why FreeIPA is in need to be reachable on a public net, but thats not the point here. I have a clean, fresh Fedora 40 with running network, hostname resolves, also reverse dns - behind a OPNsense NAT Gateway with its own ipv4 public ip. I have opened the Ports 389 & 636 When trying to run ipa-server-install, the following error occurs, where i cant understand why it cant access the LDAP server. I've checked up with nmap - port is open. Further LDAP service seems to run. Maybe someone has an idea whats going on? INFO: Loading PKI Tomcat config: /usr/share/pki/etc/tomcat.conf INFO: Connecting to LDAP server at ldap://fsn-ipa.domain.tld:389 ERROR: Unable to access LDAP server: ldap://fsn-ipa.domain.tld:389 Traceback (most recent call last): File "<frozen runpy>", line 198, in _run_module_as_main File "<frozen runpy>", line 88, in _run_code File "/usr/lib/python3.12/site-packages/pki/server/pkispawn.py", line 987, in <module> main(sys.argv) File "/usr/lib/python3.12/site-packages/pki/server/pkispawn.py", line 560, in main check_ds() File "/usr/lib/python3.12/site-packages/pki/server/pkispawn.py", line 722, in check_ds verify_ds_configuration() File "/usr/lib/python3.12/site-packages/pki/server/pkispawn.py", line 58, in verify_ds_configuration deployer.ds_bind() File "/usr/lib/python3.12/site-packages/pki/server/deployment/__init__.py", line 2442, in ds_bind self.ds_connection.simple_bind_s( File "/usr/lib64/python3.12/site-packages/ldap/ldapobject.py", line 248, in simple_bind_s msgid = self.simple_bind(who,cred,serverctrls,clientctrls) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/usr/lib64/python3.12/site-packages/ldap/ldapobject.py", line 242, in simple_bind return self._ldap_call(self._l.simple_bind,who,cred,RequestControlTuples(serverctrls),RequestControlTuples(clientctrls)) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/usr/lib64/python3.12/site-packages/ldap/ldapobject.py", line 128, in _ldap_call result = func(*args,**kwargs) ^^^^^^^^^^^^^^^^^^^^ ldap.SERVER_DOWN: {'result': -1, 'desc': "Can't contact LDAP server", 'errno': 107, 'ctrls': [], 'info': 'Transport endpoint is not connected'} 2024-06-29T10:58:32Z CRITICAL Failed to configure CA instance 2024-06-29T10:58:32Z CRITICAL See the installation logs and the following files/directories for more information: 2024-06-29T10:58:32Z CRITICAL /var/log/pki/pki-tomcat 2024-06-29T10:58:32Z DEBUG Traceback (most recent call last): File "/usr/lib/python3.12/site-packages/ipaserver/install/service.py", line 686, in start_creation run_step(full_msg, method) File "/usr/lib/python3.12/site-packages/ipaserver/install/service.py", line 672, in run_step method() File "/usr/lib/python3.12/site-packages/ipaserver/install/cainstance.py", line 678, in __spawn_instance DogtagInstance.spawn_instance( File "/usr/lib/python3.12/site-packages/ipaserver/install/dogtaginstance.py", line 227, in spawn_instance self.handle_setup_error(e) File "/usr/lib/python3.12/site-packages/ipaserver/install/dogtaginstance.py", line 609, in handle_setup_error raise RuntimeError( RuntimeError: CA configuration failed. 2024-06-29T10:58:32Z DEBUG [error] RuntimeError: CA configuration failed. 2024-06-29T10:58:32Z DEBUG Removing /root/.dogtag/pki-tomcat/ca 2024-06-29T10:58:32Z DEBUG File "/usr/lib/python3.12/site-packages/ipapython/admintool.py", line 180, in execute return_value = self.run() ^^^^^^^^^^ File "/usr/lib/python3.12/site-packages/ipapython/install/cli.py", line 344, in run return cfgr.run() ^^^^^^^^^^ File "/usr/lib/python3.12/site-packages/ipapython/install/core.py", line 360, in run return self.execute() ^^^^^^^^^^^^^^ File "/usr/lib/python3.12/site-packages/ipapython/install/core.py", line 386, in execute for rval in self._executor(): File "/usr/lib/python3.12/site-packages/ipapython/install/core.py", line 435, in __runner exc_handler(exc_info) File "/usr/lib/python3.12/site-packages/ipapython/install/core.py", line 468, in _handle_execute_exception self._handle_exception(exc_info) File "/usr/lib/python3.12/site-packages/ipapython/install/core.py", line 458, in _handle_exception six.reraise(*exc_info) File "/usr/lib/python3.12/site-packages/six.py", line 719, in reraise raise value File "/usr/lib/python3.12/site-packages/ipapython/install/core.py", line 425, in __runner step() File "/usr/lib/python3.12/site-packages/ipapython/install/core.py", line 419, in step_next return next(self.__gen) ^^^^^^^^^^^^^^^^ File "/usr/lib/python3.12/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from six.reraise(*exc_info) File "/usr/lib/python3.12/site-packages/six.py", line 719, in reraise raise value File "/usr/lib/python3.12/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from value = gen.send(prev_value) ^^^^^^^^^^^^^^^^^^^^ File "/usr/lib/python3.12/site-packages/ipapython/install/core.py", line 663, in _configure next(executor) File "/usr/lib/python3.12/site-packages/ipapython/install/core.py", line 435, in __runner exc_handler(exc_info) File "/usr/lib/python3.12/site-packages/ipapython/install/core.py", line 468, in _handle_execute_exception self._handle_exception(exc_info) File "/usr/lib/python3.12/site-packages/ipapython/install/core.py", line 526, in _handle_exception self.__parent._handle_exception(exc_info) File "/usr/lib/python3.12/site-packages/ipapython/install/core.py", line 458, in _handle_exception six.reraise(*exc_info) File "/usr/lib/python3.12/site-packages/six.py", line 719, in reraise raise value File "/usr/lib/python3.12/site-packages/ipapython/install/core.py", line 523, in _handle_exception super(ComponentBase, self)._handle_exception(exc_info) File "/usr/lib/python3.12/site-packages/ipapython/install/core.py", line 458, in _handle_exception six.reraise(*exc_info) File "/usr/lib/python3.12/site-packages/six.py", line 719, in reraise raise value File "/usr/lib/python3.12/site-packages/ipapython/install/core.py", line 425, in __runner step() File "/usr/lib/python3.12/site-packages/ipapython/install/core.py", line 419, in step_next return next(self.__gen) ^^^^^^^^^^^^^^^^ File "/usr/lib/python3.12/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from six.reraise(*exc_info) File "/usr/lib/python3.12/site-packages/six.py", line 719, in reraise raise value File "/usr/lib/python3.12/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from value = gen.send(prev_value) ^^^^^^^^^^^^^^^^^^^^ File "/usr/lib/python3.12/site-packages/ipapython/install/common.py", line 65, in _install for unused in self._installer(self.parent): File "/usr/lib/python3.12/site-packages/ipaserver/install/server/__init__.py", line 608, in main master_install(self) File "/usr/lib/python3.12/site-packages/ipaserver/install/server/install.py", line 278, in decorated func(installer) File "/usr/lib/python3.12/site-packages/ipaserver/install/server/install.py", line 960, in install ca.install_step_0(False, None, options, custodia=custodia) File "/usr/lib/python3.12/site-packages/ipaserver/install/ca.py", line 607, in install_step_0 ca.configure_instance( File "/usr/lib/python3.12/site-packages/ipaserver/install/cainstance.py", line 515, in configure_instance self.start_creation(runtime=runtime) File "/usr/lib/python3.12/site-packages/ipaserver/install/service.py", line 686, in start_creation run_step(full_msg, method) File "/usr/lib/python3.12/site-packages/ipaserver/install/service.py", line 672, in run_step method() File "/usr/lib/python3.12/site-packages/ipaserver/install/cainstance.py", line 678, in __spawn_instance DogtagInstance.spawn_instance( File "/usr/lib/python3.12/site-packages/ipaserver/install/dogtaginstance.py", line 227, in spawn_instance self.handle_setup_error(e) File "/usr/lib/python3.12/site-packages/ipaserver/install/dogtaginstance.py", line 609, in handle_setup_error raise RuntimeError( 2024-06-29T10:58:32Z DEBUG The ipa-server-install command failed, exception: RuntimeError: CA configuration failed. 2024-06-29T10:58:32Z ERROR CA configuration failed. 2024-06-29T10:58:32Z ERROR The ipa-server-install command failed. See /var/log/ipaserver-install.log for more information

1 1

Unable to log into FreeIPA UI or use ipa commands after certificate expiration and replacement
by Toma Morris 02 Jul '24

02 Jul '24

## Problem and version info I recently took over as the sysadmin for a system that was previously set up, and has not had a sysadmin for 6+ months, plus appears to have been fairly neglected even before then. It has three FreeIPA nodes that have not seen a system update in several years, and CentOS can no longer be updated so I cannot update them. I'm planning to replace them but have not created the replacements yet and need the current system to continue functioning, both in general and also in order to enroll new nodes and replicate to them before bringing down the old ones. ``` $ ipa --version VERSION: 4.9.6, API_VERSION: 2.245 $ lsb_release -a LSB Version: :core-4.1-amd64:core-4.1-noarch Distributor ID: Fedora Description: Fedora release 34 (Thirty Four) Release: 34 Codename: ThirtyFour ``` I have been working my way through system updates and improvements, but had not checked the expiration dates on the server certificates yet, and the certificates expired on June 21. I saw this and got a new (wildcard, as before) certificate and began replacing them. I'm new to FreeIPA and had only used it to add a handful of users and set a few DNS entries. I bypassed the certificate error in the browser to go to the FreeIPA web UI (https://freeipa1.mydomain.com/ipa/ui/#) and tried to log in and got the error message "Login failed due to an unknown reason". I am certain of my password. I saw that it runs httpd, so I copied the new cert onto the server and changed the httpd config to point to it and the appropriate key. Now, when I navigate to the web UI I no longer get a certificate error, but I continue to get the same error message when I try to log in. FreeIPA appears to be working partially, because it governs `sudo` access and login within this system and I am still able to login and `sudo`. When I try to use any `ipa` commands, however, I get the following or something similar: ``` $ sudo ipa-certupdate Connection to https://freeipa1.mydomain.com/ipa/json failed with [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1129) Connection to https://freeipa2.mydomain.com/ipa/json failed with [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1129) Connection to https://freeipa3.mydomain.com/ipa/json failed with [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1129) cannot connect to 'any of the configured servers': https://freeipa1.mydomain.com/ipa/json, https://freeipa2.mydomain.com/ipa/json, https://freeipa3.mydomain.com/ipa/json The ipa-certupdate command failed. ``` and ``` $ ipa user-find ipa: ERROR: cannot connect to 'any of the configured servers': https://freeipa1.mydomain.com/ipa/json, https://freeipa2.mydomain.com/ipa/json, https://freeipa3.mydomain.com/ipa/json ``` I am able to get correct responses from `id [username]` and `getent passwd [username]`, and am able to `kinit`, `ssh`, and `sudo` using credentials that are governed by these servers. ## What I have tried - I replaced the old certificate in the httpd config with a new one that is essentially the same except it has an updated valid date window, and is signed with RSA384 instead of RSA356 (I don't think this matters, but including for completeness), and then restarted httpd - I did `ipactl restart` and `systemctl restart sssd` - I put the old certificate back in place, disabled NTP on the server and set the time back to a date when the prior certificate was valid - I have looked through sssd_* and /var/log/secure for relevant logs. I found one at /var/log/sssd/sssd_mydomain.com.log, with error logs that appear relevant, but I'm not able to tell what is not working. I have not found other relevant-looking entries in other sssd logs - `dig -t SRV _ldap._tcp.freeipa1.mydomain.com @127.0.0.1` from the freeipa1 terminal gave a reasonable response I also tried an ldapsearch that had worked previously: ``` $ ldapsearch -x -b "dc=mydomain,dc=com" -H ldap://freeipa1.mydomain.com -D "cn=admin,dc=mydomain,dc=com" -W Enter LDAP Password: ldap_bind: Invalid credentials (49) ``` ## Logs Here is a snippet from a very large log file from freeipa3.mydomain.com:/var/log/sssd/sssd_mydomain.com.log. I elided portions that seem to be generic, and kept lines that mention mydomain.com and what appears to be related context. It's possible I elided something important, and can provide unelided logs or specific portions if needed. There are 3 backtraces here, the first is long and elided and the last two are short and included in full. I notice the conspicuous "Network is unreachable" messages, and checked to confirm that I am able to ping all three servers from everywhere in the network (including from these servers themselves), so I don't believe it is actually a network outage. ``` (2024-06-27 9:24:14): [be[mydomain.com]] [server_setup] (0x1f7c0): Starting with debug level = 0x0070 (2024-06-27 9:24:16): [be[mydomain.com]] [sssd_async_connect_send] (0x0020): [RID#1] connect failed [101][Network is unreachable]. ********************** PREVIOUS MESSAGE WAS TRIGGERED BY THE FOLLOWING BACKTRACE: * [be[mydomain.com]] [become_user] (0x0200): Trying to become user [0][0]. * [be[mydomain.com]] [become_user] (0x0200): Already user [0]. * [be[mydomain.com]] [ldb] (0x0400): server_sort:Unable to register control with rootdse! * (2024-06-27 9:24:14): [be[mydomain.com]] [server_setup] (0x0400): CONFDB: /var/lib/sss/db/config.ldb * (2024-06-27 9:24:14): [be[mydomain.com]] [dp_get_options] (0x0400): Option lookup_family_order has value ipv4_first * (2024-06-27 9:24:14): [be[mydomain.com]] [dp_get_options] (0x0400): Option dns_resolver_timeout has value 6 * (2024-06-27 9:24:14): [be[mydomain.com]] [dp_get_options] (0x0400): Option dns_resolver_op_timeout has value 3 * (2024-06-27 9:24:14): [be[mydomain.com]] [dp_get_options] (0x0400): Option dns_resolver_server_timeout has value 1000 * (2024-06-27 9:24:14): [be[mydomain.com]] [dp_get_options] (0x0400): Option dns_discovery_domain has no value * (2024-06-27 9:24:14): [be[mydomain.com]] [be_res_get_opts] (0x0100): Lookup order: ipv4_first * (2024-06-27 9:24:14): [be[mydomain.com]] [recreate_ares_channel] (0x0100): Initializing new c-ares channel * (2024-06-27 9:24:14): [be[mydomain.com]] [fo_context_init] (0x0400): Created new fail over context, retry timeout is 30 * (2024-06-27 9:24:14): [be[mydomain.com]] [confdb_get_domain_internal] (0x0400): No enumeration for [implicit_files]! * (2024-06-27 9:24:14): [be[mydomain.com]] [confdb_get_domain_internal] (0x0400): Please note that when enumeration is disabled `getent passwd` does not return all users by design. See sssd.conf man page for more detailed information * (2024-06-27 9:24:14): [be[mydomain.com]] [confdb_get_domain_internal] (0x1000): pwd_expiration_warning is -1 * (2024-06-27 9:24:14): [be[mydomain.com]] [confdb_get_domain_internal] (0x0400): No enumeration for [mydomain.com] * (2024-06-27 9:24:14): [be[mydomain.com]] [confdb_get_domain_internal] (0x0400): Please note that when enumeration is disabled `getent passwd` does not return all users by design. See sssd.conf man page for more detailed information * (2024-06-27 9:24:14): [be[mydomain.com]] [confdb_get_domain_internal] (0x1000): pwd_expiration_warning is -1 * (2024-06-27 9:24:14): [be[mydomain.com]] [sss_domain_get_state] (0x1000): Domain mydomain.com is Active * (2024-06-27 9:24:14): [be[mydomain.com]] [sysdb_domain_init_internal] (0x0200): DB File for mydomain.com: /var/lib/sss/db/cache_mydomain.com.ldb * (2024-06-27 9:24:14): [be[mydomain.com]] [sysdb_domain_init_internal] (0x0200): Timestamp file for mydomain.com: /var/lib/sss/db/timestamps_mydomain.com.ldb * (2024-06-27 9:24:14): [be[mydomain.com]] [ldb] (0x0400): asq: Unable to register control with rootdse! * (2024-06-27 9:24:14): [be[mydomain.com]] [sss_domain_get_state] (0x1000): Domain mydomain.com is Active * (2024-06-27 9:24:14): [be[mydomain.com]] [sss_names_init_from_args] (0x0100): Using re [(((?P<domain>[^\\]+)\\(?P<name>.+$))|((?P<name>[^@]+)@(?P<domain>.+$))|(^(?P<name>[^@\\]+)$))]. * (2024-06-27 9:24:14): [be[mydomain.com]] [sss_fqnames_init] (0x0100): Using fq format [%1$s@%2$s]. * (2024-06-27 9:24:14): [be[mydomain.com]] [sbus_server_socket_listen] (0x0400): D-BUS Server listening on unix:path=/var/lib/sss/pipes/private/sbus-dp_mydomain.com.849,guid=1f7cd8ed5f762a097bce948b667d67fe * (2024-06-27 9:24:14): [be[mydomain.com]] [sbus_server_symlink_create] (0x1000): Symlinking the dbus path /var/lib/sss/pipes/private/sbus-dp_mydomain.com.849 to a link /var/lib/sss/pipes/private/sbus-dp_mydomain.com ... * (2024-06-27 9:24:14): [be[mydomain.com]] [sbus_connect_private_done] (0x0400): Connected to unix:path=/var/lib/sss/pipes/private/sbus-dp_mydomain.com bus as sssd.domain_2emydomain_2ecom ... * (2024-06-27 9:24:15): [be[mydomain.com]] [krb5_service_new] (0x0100): write_kdcinfo for realm mydomain.com set to true * (2024-06-27 9:24:15): [be[mydomain.com]] [fo_new_service] (0x0400): Creating new service 'IPA' * (2024-06-27 9:24:15): [be[mydomain.com]] [resolv_is_address] (0x4000): [freeipa3.mydomain.com] does not look like an IP address * (2024-06-27 9:24:15): [be[mydomain.com]] [fo_add_server_to_list] (0x0400): Inserted primary server 'freeipa3.mydomain.com:0' to service 'IPA' * (2024-06-27 9:24:15): [be[mydomain.com]] [_ipa_servers_init] (0x0400): Added Server freeipa3.mydomain.com ... * (2024-06-27 9:24:15): [be[mydomain.com]] [ipa_get_id_options] (0x0400): Option ldap_search_base set to cn=accounts,dc=mydomain,cs=com * (2024-06-27 9:24:15): [be[mydomain.com]] [common_parse_search_base] (0x0100): Search base added: [DEFAULT][cn=accounts,dc=mydomain,cs=com][SUBTREE][] * (2024-06-27 9:24:15): [be[mydomain.com]] [ipa_get_id_options] (0x0400): Option krb5_realm set to mydomain.com * (2024-06-27 9:24:15): [be[mydomain.com]] [sdap_set_sasl_options] (0x0100): Will look for freeipa3.mydomain.com(a)mydomain.com in default keytab * (2024-06-27 9:24:15): [be[mydomain.com]] [select_principal_from_keytab] (0x0200): trying to select the most appropriate principal from keytab * (2024-06-27 9:24:15): [be[mydomain.com]] [find_principal_in_keytab] (0x4000): Trying to find principal freeipa3.mydomain.com(a)mydomain.com in keytab. * (2024-06-27 9:24:15): [be[mydomain.com]] [find_principal_in_keytab] (0x0400): No principal matching freeipa3.mydomain.com(a)mydomain.com found in keytab. * (2024-06-27 9:24:15): [be[mydomain.com]] [find_principal_in_keytab] (0x4000): Trying to find principal FREEIPA3$(a)mydomain.com in keytab. * (2024-06-27 9:24:15): [be[mydomain.com]] [find_principal_in_keytab] (0x0400): No principal matching FREEIPA3$(a)mydomain.com found in keytab. * (2024-06-27 9:24:15): [be[mydomain.com]] [find_principal_in_keytab] (0x4000): Trying to find principal host/freeipa3.mydomain.com(a)mydomain.com in keytab. * (2024-06-27 9:24:15): [be[mydomain.com]] [match_principal] (0x1000): Principal matched to the sample (host/freeipa3.mydomain.com(a)mydomain.com) * (2024-06-27 9:24:15): [be[mydomain.com]] [select_principal_from_keytab] (0x0200): Selected primary: host/freeipa3.mydomain.com * (2024-06-27 9:24:15): [be[mydomain.com]] [select_principal_from_keytab] (0x0200): Selected realm: mydomain.com * (2024-06-27 9:24:15): [be[mydomain.com]] [sdap_set_sasl_options] (0x0100): Option ldap_sasl_authid set to host/freeipa3.mydomain.com * (2024-06-27 9:24:15): [be[mydomain.com]] [sdap_set_sasl_options] (0x0100): Option ldap_sasl_realm set to mydomain.com * (2024-06-27 9:24:15): [be[mydomain.com]] [ipa_get_id_options] (0x0400): Option ldap_user_search_base set to cn=accounts,dc=mydomain,cs=com * (2024-06-27 9:24:15): [be[mydomain.com]] [common_parse_search_base] (0x0100): Search base added: [USER][cn=accounts,dc=mydomain,cs=com][SUBTREE][] * (2024-06-27 9:24:15): [be[mydomain.com]] [ipa_get_id_options] (0x0400): Option ldap_user_search_base expanded to cover cn=trusts base * (2024-06-27 9:24:15): [be[mydomain.com]] [ipa_get_id_options] (0x0400): Option ldap_group_search_base set to cn=accounts,dc=mydomain,cs=com * (2024-06-27 9:24:15): [be[mydomain.com]] [common_parse_search_base] (0x0100): Search base added: [GROUP][cn=accounts,dc=mydomain,cs=com][SUBTREE][] * (2024-06-27 9:24:15): [be[mydomain.com]] [ipa_get_id_options] (0x0400): Option ldap_netgroup_search_base set to cn=ng,cn=alt,dc=mydomain,cs=com * (2024-06-27 9:24:15): [be[mydomain.com]] [common_parse_search_base] (0x0100): Search base added: [NETGROUP][cn=ng,cn=alt,dc=mydomain,cs=com][SUBTREE][] * (2024-06-27 9:24:15): [be[mydomain.com]] [ipa_get_id_options] (0x0100): Option ldap_host_search_base set to cn=accounts,dc=mydomain,cs=com * (2024-06-27 9:24:15): [be[mydomain.com]] [common_parse_search_base] (0x0100): Search base added: [HOST][cn=accounts,dc=mydomain,cs=com][SUBTREE][] * (2024-06-27 9:24:15): [be[mydomain.com]] [ipa_get_id_options] (0x0400): Option ipa_hbac_search_base set to cn=hbac,dc=mydomain,cs=com * (2024-06-27 9:24:15): [be[mydomain.com]] [common_parse_search_base] (0x0100): Search base added: [IPA_HBAC][cn=hbac,dc=mydomain,cs=com][SUBTREE][] * (2024-06-27 9:24:15): [be[mydomain.com]] [ipa_get_id_options] (0x0100): Option ipa_selinux_search_base set to cn=selinux,dc=mydomain,cs=com * (2024-06-27 9:24:15): [be[mydomain.com]] [common_parse_search_base] (0x0100): Search base added: [IPA_SELINUX][cn=selinux,dc=mydomain,cs=com][SUBTREE][] * (2024-06-27 9:24:15): [be[mydomain.com]] [ipa_get_id_options] (0x0400): Option ipa_deskprofile_search_base set to cn=desktop-profile,dc=mydomain,cs=com * (2024-06-27 9:24:15): [be[mydomain.com]] [common_parse_search_base] (0x0100): Search base added: [IPA_DESKPROFILE][cn=desktop-profile,dc=mydomain,cs=com][SUBTREE][] * (2024-06-27 9:24:15): [be[mydomain.com]] [ipa_get_id_options] (0x0400): Option ldap_service_search_base set to cn=ipservices,cn=accounts,dc=mydomain,cs=com * (2024-06-27 9:24:15): [be[mydomain.com]] [common_parse_search_base] (0x0100): Search base added: [SERVICE][cn=ipservices,cn=accounts,dc=mydomain,cs=com][SUBTREE][] * (2024-06-27 9:24:15): [be[mydomain.com]] [ipa_get_id_options] (0x0100): Option ipa_subdomains_search_base set to cn=trusts,dc=mydomain,cs=com * (2024-06-27 9:24:15): [be[mydomain.com]] [common_parse_search_base] (0x0100): Search base added: [IPA_SUBDOMAINS][cn=trusts,dc=mydomain,cs=com][SUBTREE][] * (2024-06-27 9:24:15): [be[mydomain.com]] [ipa_get_id_options] (0x0100): Option ipa_master_domain_search_base set to cn=ad,cn=etc,dc=mydomain,cs=com * (2024-06-27 9:24:15): [be[mydomain.com]] [common_parse_search_base] (0x0100): Search base added: [IPA_MASTER_DOMAIN][cn=ad,cn=etc,dc=mydomain,cs=com][SUBTREE][] * (2024-06-27 9:24:15): [be[mydomain.com]] [ipa_get_id_options] (0x0100): Option ipa_ranges_search_base set to cn=ranges,cn=etc,dc=mydomain,cs=com * (2024-06-27 9:24:15): [be[mydomain.com]] [common_parse_search_base] (0x0100): Search base added: [IPA_RANGES][cn=ranges,cn=etc,dc=mydomain,cs=com][SUBTREE][] * (2024-06-27 9:24:15): [be[mydomain.com]] [ipa_get_id_options] (0x0100): Option ipa_views_search_base set to cn=views,cn=accounts,dc=mydomain,cs=com * (2024-06-27 9:24:15): [be[mydomain.com]] [common_parse_search_base] (0x0100): Search base added: [IPA_VIEWS][cn=views,cn=accounts,dc=mydomain,cs=com][SUBTREE][] ... * (2024-06-27 9:24:15): [be[mydomain.com]] [sdap_id_setup_tasks] (0x0400): Setting up cleanup task for mydomain.com * (2024-06-27 9:24:15): [be[mydomain.com]] [sysdb_update_view_name] (0x4000): View name already in place. * (2024-06-27 9:24:15): [be[mydomain.com]] [ipa_init_server_mode] (0x0100): The value of dns_discovery_domain will be ignored in ipa_server_mode * (2024-06-27 9:24:15): [be[mydomain.com]] [sysdb_get_certmap] (0x0400): No certificate maps found. * (2024-06-27 9:24:15): [be[mydomain.com]] [sdap_setup_certmap] (0x4000): No certmap data, nothing to do. * (2024-06-27 9:24:15): [be[mydomain.com]] [dp_copy_options_ex] (0x0400): Option ipa_domain has value mydomain.com * (2024-06-27 9:24:15): [be[mydomain.com]] [dp_copy_options_ex] (0x0400): Option ipa_server has value freeipa3.mydomain.com * (2024-06-27 9:24:15): [be[mydomain.com]] [dp_copy_options_ex] (0x0400): Option ipa_backup_server has no value * (2024-06-27 9:24:15): [be[mydomain.com]] [dp_copy_options_ex] (0x0400): Option ipa_hostname has value freeipa3.mydomain.com * (2024-06-27 9:24:15): [be[mydomain.com]] [dp_copy_options_ex] (0x0400): Option ipa_hbac_search_base has value cn=hbac,dc=mydomain,cs=com * (2024-06-27 9:24:15): [be[mydomain.com]] [dp_copy_options_ex] (0x0400): Option ipa_host_search_base has no value * (2024-06-27 9:24:15): [be[mydomain.com]] [dp_copy_options_ex] (0x0400): Option ipa_selinux_search_base has value cn=selinux,dc=mydomain,cs=com * (2024-06-27 9:24:15): [be[mydomain.com]] [dp_copy_options_ex] (0x0400): Option ipa_subdomains_search_base has value cn=trusts,dc=mydomain,cs=com * (2024-06-27 9:24:15): [be[mydomain.com]] [dp_copy_options_ex] (0x0400): Option ipa_master_domain_search_base has value cn=ad,cn=etc,dc=mydomain,cs=com * (2024-06-27 9:24:15): [be[mydomain.com]] [dp_copy_options_ex] (0x0400): Option krb5_realm has value mydomain.com * (2024-06-27 9:24:15): [be[mydomain.com]] [dp_copy_options_ex] (0x0400): Option ipa_hbac_refresh has value 5 * (2024-06-27 9:24:15): [be[mydomain.com]] [dp_copy_options_ex] (0x0400): Option ipa_selinux_refresh has value 5 * (2024-06-27 9:24:15): [be[mydomain.com]] [dp_copy_options_ex] (0x0400): Option ipa_hbac_support_srchost is FALSE * (2024-06-27 9:24:15): [be[mydomain.com]] [dp_copy_options_ex] (0x0400): Option ipa_automount_location has value default * (2024-06-27 9:24:15): [be[mydomain.com]] [dp_copy_options_ex] (0x0400): Option ipa_ranges_search_base has value cn=ranges,cn=etc,dc=mydomain,cs=com * (2024-06-27 9:24:15): [be[mydomain.com]] [dp_copy_options_ex] (0x0400): Option ipa_enable_dns_sites is FALSE * (2024-06-27 9:24:15): [be[mydomain.com]] [dp_copy_options_ex] (0x0400): Option ipa_server_mode is TRUE * (2024-06-27 9:24:15): [be[mydomain.com]] [dp_copy_options_ex] (0x0400): Option ipa_views_search_base has value cn=views,cn=accounts,dc=mydomain,cs=com * (2024-06-27 9:24:15): [be[mydomain.com]] [dp_copy_options_ex] (0x0400): Option krb5_confd_path has value /var/lib/sss/pubconf/krb5.include.d * (2024-06-27 9:24:15): [be[mydomain.com]] [dp_copy_options_ex] (0x0400): Option ipa_deskprofile_search_base has value cn=desktop-profile,dc=mydomain,cs=com * (2024-06-27 9:24:15): [be[mydomain.com]] [dp_copy_options_ex] (0x0400): Option ipa_deskprofile_refresh has value 5 * (2024-06-27 9:24:15): [be[mydomain.com]] [dp_copy_options_ex] (0x0400): Option ipa_deskprofile_request_interval has value 60 ... * (2024-06-27 9:24:15): [be[mydomain.com]] [krb5_try_kdcip] (0x0100): No KDC found in configuration, trying legacy option * (2024-06-27 9:24:15): [be[mydomain.com]] [ipa_get_auth_options] (0x0400): Option krb5_realm set to mydomain.com * (2024-06-27 9:24:15): [be[mydomain.com]] [ipa_get_auth_options] (0x0100): Option krb5_fast_principal set to host/freeipa3.mydomain.com(a)mydomain.com ... * (2024-06-27 9:24:15): [be[mydomain.com]] [common_parse_search_base] (0x0100): Search base added: [SUDO][cn=sudo,dc=mydomain,cs=com][SUBTREE][] ... * (2024-06-27 9:24:15): [be[mydomain.com]] [ipa_get_autofs_options] (0x1000): Option ldap_autofs_search_base set to cn=default,cn=automount,dc=mydomain,cs=com * (2024-06-27 9:24:15): [be[mydomain.com]] [common_parse_search_base] (0x0100): Search base added: [AUTOFS][cn=default,cn=automount,dc=mydomain,cs=com][SUBTREE][] ... * (2024-06-27 9:24:15): [be[mydomain.com]] [ipa_subdom_reinit] (0x2000): Re-initializing domain mydomain.com * (2024-06-27 9:24:15): [be[mydomain.com]] [sss_write_krb5_localauth_snippet] (0x0200): File for localauth plugin configuration is [/var/lib/sss/pubconf/krb5.include.d/localauth_plugin] * (2024-06-27 9:24:15): [be[mydomain.com]] [sss_write_krb5_libdefaults_snippet] (0x0200): File for KRB5 kibdefaults configuration is [/var/lib/sss/pubconf/krb5.include.d/krb5_libdefaults] * (2024-06-27 9:24:15): [be[mydomain.com]] [sss_domain_get_state] (0x1000): Domain mydomain.com is Active * (2024-06-27 9:24:16): [be[mydomain.com]] [sss_write_domain_mappings] (0x0200): Mapping file for domain [mydomain.com] is [/var/lib/sss/pubconf/krb5.include.d/domain_realm_mydomain_com] ... * (2024-06-27 9:24:16): [be[mydomain.com]] [sbus_dispatch] (0x4000): Dispatching. * (2024-06-27 9:24:16): [be[mydomain.com]] [sbus_method_handler] (0x2000): Received D-Bus method sssd.dataprovider.getDomains on /sssd * (2024-06-27 9:24:16): [be[mydomain.com]] [sbus_senders_lookup] (0x2000): Looking for identity of sender [sssd.ssh] * (2024-06-27 9:24:16): [be[mydomain.com]] [dp_attach_req] (0x0400): [RID#1] DP Request [Subdomains #1]: REQ_TRACE: New request. Flags [0000]. * (2024-06-27 9:24:16): [be[mydomain.com]] [dp_attach_req] (0x0400): [RID#1] Number of active DP request: 1 * (2024-06-27 9:24:16): [be[mydomain.com]] [sdap_id_op_connect_step] (0x4000): [RID#1] beginning to connect * (2024-06-27 9:24:16): [be[mydomain.com]] [fo_resolve_service_send] (0x0100): [RID#1] Trying to resolve service 'IPA' * (2024-06-27 9:24:16): [be[mydomain.com]] [get_server_status] (0x1000): [RID#1] Status of server 'freeipa3.mydomain.com' is 'name not resolved' * (2024-06-27 9:24:16): [be[mydomain.com]] [get_port_status] (0x1000): [RID#1] Port status of port 0 for server 'freeipa3.mydomain.com' is 'neutral' * (2024-06-27 9:24:16): [be[mydomain.com]] [fo_resolve_service_activate_timeout] (0x2000): [RID#1] Resolve timeout [dns_resolver_timeout] set to 6 seconds * (2024-06-27 9:24:16): [be[mydomain.com]] [get_server_status] (0x1000): [RID#1] Status of server 'freeipa3.mydomain.com' is 'name not resolved' * (2024-06-27 9:24:16): [be[mydomain.com]] [resolv_is_address] (0x4000): [RID#1] [freeipa3.mydomain.com] does not look like an IP address * (2024-06-27 9:24:16): [be[mydomain.com]] [resolv_gethostbyname_step] (0x2000): [RID#1] Querying files * (2024-06-27 9:24:16): [be[mydomain.com]] [resolv_gethostbyname_files_send] (0x0100): [RID#1] Trying to resolve A record of 'freeipa3.mydomain.com' in files * (2024-06-27 9:24:16): [be[mydomain.com]] [set_server_common_status] (0x0100): [RID#1] Marking server 'freeipa3.mydomain.com' as 'resolving name' * (2024-06-27 9:24:16): [be[mydomain.com]] [set_server_common_status] (0x0100): [RID#1] Marking server 'freeipa3.mydomain.com' as 'name resolved' * (2024-06-27 9:24:16): [be[mydomain.com]] [be_resolve_server_process] (0x1000): [RID#1] Saving the first resolved server * (2024-06-27 9:24:16): [be[mydomain.com]] [be_resolve_server_process] (0x0200): [RID#1] Found address for server freeipa3.mydomain.com: [192.168.6.13] TTL 7200 * (2024-06-27 9:24:16): [be[mydomain.com]] [ipa_resolve_callback] (0x0400): [RID#1] Constructed uri 'ldap://freeipa3.mydomain.com' * (2024-06-27 9:24:16): [be[mydomain.com]] [unique_filename_destructor] (0x2000): [RID#1] Unlinking [/var/lib/sss/pubconf/.krb5info_dummy_D5zpou] * (2024-06-27 9:24:16): [be[mydomain.com]] [unlink_dbg] (0x2000): [RID#1] File already removed: [/var/lib/sss/pubconf/.krb5info_dummy_D5zpou] * (2024-06-27 9:24:16): [be[mydomain.com]] [sssd_async_socket_init_send] (0x4000): [RID#1] Using file descriptor [22] for the connection. * (2024-06-27 9:24:16): [be[mydomain.com]] [sssd_async_connect_send] (0x0020): [RID#1] connect failed [101][Network is unreachable]. ********************** BACKTRACE DUMP ENDS HERE ********************************* (2024-06-27 9:24:16): [be[mydomain.com]] [sssd_async_socket_init_done] (0x0020): [RID#1] sdap_async_sys_connect request failed: [101]: Network is unreachable.(2024-06-27 9:24:16): [be[mydomain.com]] [sss_ldap_init_sys_connect_done] (0x0020): [RID#1] sssd_async_socket_init request failed: [101]: Network is unreachable. ********************** PREVIOUS MESSAGE WAS TRIGGERED BY THE FOLLOWING BACKTRACE: * (2024-06-27 9:24:16): [be[mydomain.com]] [sssd_async_socket_init_send] (0x0400): [RID#1] Setting 6 seconds timeout [ldap_network_timeout] for connecting * (2024-06-27 9:24:16): [be[mydomain.com]] [sssd_async_socket_init_done] (0x0020): [RID#1] sdap_async_sys_connect request failed: [101]: Network is unreachable. * (2024-06-27 9:24:16): [be[mydomain.com]] [sssd_async_socket_state_destructor] (0x0400): [RID#1] closing socket [22] * (2024-06-27 9:24:16): [be[mydomain.com]] [sss_ldap_init_sys_connect_done] (0x0020): [RID#1] sssd_async_socket_init request failed: [101]: Network is unreachable. ********************** BACKTRACE DUMP ENDS HERE ********************************* (2024-06-27 9:24:16): [be[mydomain.com]] [sdap_sys_connect_done] (0x0020): [RID#1] sdap_async_connect_call request failed: [101]: Network is unreachable. (2024-06-27 9:24:16): [be[mydomain.com]] [fo_resolve_service_send] (0x0020): [RID#1] No available servers for service 'IPA' ********************** PREVIOUS MESSAGE WAS TRIGGERED BY THE FOLLOWING BACKTRACE: * (2024-06-27 9:24:16): [be[mydomain.com]] [sdap_sys_connect_done] (0x0020): [RID#1] sdap_async_connect_call request failed: [101]: Network is unreachable. * (2024-06-27 9:24:16): [be[mydomain.com]] [sdap_handle_release] (0x2000): [RID#1] Trace: sh[0x55aae80acbd0], connected[0], ops[(nil)], ldap[(nil)], destructor_lock[0], release_memory[0] * (2024-06-27 9:24:16): [be[mydomain.com]] [_be_fo_set_port_status] (0x8000): [RID#1] Setting status: PORT_NOT_WORKING. Called from: src/providers/ldap/sdap_async_connection.c: sdap_cli_connect_done: 1633 * (2024-06-27 9:24:16): [be[mydomain.com]] [fo_set_port_status] (0x0100): [RID#1] Marking port 0 of server 'freeipa3.mydomain.com' as 'not working' * (2024-06-27 9:24:16): [be[mydomain.com]] [fo_set_port_status] (0x0400): [RID#1] Marking port 0 of duplicate server 'freeipa3.mydomain.com' as 'not working' * (2024-06-27 9:24:16): [be[mydomain.com]] [fo_resolve_service_send] (0x0100): [RID#1] Trying to resolve service 'IPA' * (2024-06-27 9:24:16): [be[mydomain.com]] [get_server_status] (0x1000): [RID#1] Status of server 'freeipa3.mydomain.com' is 'name resolved' * (2024-06-27 9:24:16): [be[mydomain.com]] [get_port_status] (0x1000): [RID#1] Port status of port 0 for server 'freeipa3.mydomain.com' is 'not working' * (2024-06-27 9:24:16): [be[mydomain.com]] [get_port_status] (0x0080): [RID#1] SSSD is unable to complete the full connection request, this internal status does not necessarily indicate network port issues. * (2024-06-27 9:24:16): [be[mydomain.com]] [fo_resolve_service_send] (0x0020): [RID#1] No available servers for service 'IPA' ********************** BACKTRACE DUMP ENDS HERE ********************************* ```

2 2

Moving an enrolled host to a different subnet
by Bo Lind 02 Jul '24

02 Jul '24

I'm moving a host from one subnet to another, so I need to change it's IP. Anything else remains unchanged. What is the procedure for that? I'm guessing just changing the forward and reverse DNS in IPA should be enough?

2 1

Re: Install freeipa client on fedora12
by Alexander Bokovoy 02 Jul '24

02 Jul '24

On Аўт, 02 ліп 2024, Elhamsadat Azarian wrote: >Hi Mr. Bokovy >Thanks for your reply. >So it means, i can't have freeipa control on feora12 servers? Isn't it? Please do not drop the mailing list off the discussion. Since Fedora Linux 12 is not a supported version of Fedora anymore, for more than 12.5 years, there is nothing can be done with existing code. You, of course, may try to set things up for older environments yourself. However, I do not recommend keeping such old systems online, it is not a reasonable approach. Please consider updating. > >On Tue, 2 Jul 2024, 11:24 Alexander Bokovoy, <abokovoy(a)redhat.com> wrote: > >> On Аўт, 02 ліп 2024, Elhamsadat Azarian via FreeIPA-users wrote: >> >Hi >> >we have a network contains some Fedora12 and Oracle linux 9 >> >i am going to install FreeIPA server on oracle linux9 and others(Fedora12 >> and oraclelinux9) connect it as clients. >> >i couldn't find a package for fedora12 as freeipa client! >> >can you guide me is it possible that having FreeIPA in this network? >> >> Fedora Linux 12 was released in 2009 and its end of life happened in >> December 2010. FreeIPA has not been packaged in Fedora at that time. >> >> >> >> -- >> / Alexander Bokovoy >> Sr. Principal Software Engineer >> Security / Identity Management Engineering >> Red Hat Limited, Finland >> >> -- / Alexander Bokovoy Sr. Principal Software Engineer Security / Identity Management Engineering Red Hat Limited, Finland

1 0

Install freeipa client on fedora12
by Elhamsadat Azarian 02 Jul '24

02 Jul '24

Hi we have a network contains some Fedora12 and Oracle linux 9 i am going to install FreeIPA server on oracle linux9 and others(Fedora12 and oraclelinux9) connect it as clients. i couldn't find a package for fedora12 as freeipa client! can you guide me is it possible that having FreeIPA in this network? Thanks

2 1

freeipa client for Fedora 12
by Elhamsadat Azarian 02 Jul '24

02 Jul '24

Hi we have a network contains some Fedora12 and Oracle linux 9 i am going to install FreeIPA server on oracle linux9 and others(Fedora12 and oraclelinux9) connect it as clients. i couldn't find a package for fedora12 as freeipa client! can you guide me is it possible that having FreeIPA in this network? Thanks

1 0

Disable user password expiration immediately after password reset.
by luckydog xf 02 Jul '24

02 Jul '24

Once the admin changes the user password, it will expire immediately. Can we disable this policy?

1 0

Unable to access FreeIPA UI after certificate expiration and renewal
by Toma Morris 01 Jul '24

01 Jul '24

## Problem and version info I recently took over as the sysadmin for a system that was previously set up, and has not had a sysadmin for 6+ months, plus appears to have been fairly neglected even before then. It has three FreeIPA nodes that have not seen a system update in several years, and CentOS can no longer be updated so I cannot update them. I'm planning to replace them but have not created the replacements yet and need the current system to continue functioning, both in general and also in order to enroll new nodes and replicate to them before bringing down the old ones. ``` $ ipa --version VERSION: 4.9.6, API_VERSION: 2.245 $ lsb_release -a LSB Version: :core-4.1-amd64:core-4.1-noarch Distributor ID: Fedora Description: Fedora release 34 (Thirty Four) Release: 34 Codename: ThirtyFour ``` I have been working my way through system updates and improvements, but had not checked the expiration dates on the server certificates yet, and the certificates expired on June 21. I saw this and got a new (wildcard, as before) certificate and began replacing them. I'm new to FreeIPA and had only used it to add a handful of users and set a few DNS entries. I bypassed the certificate error in the browser to go to the FreeIPA web UI ( https://freeipa1.mydomain.com/ipa/ui/#) and tried to log in and got the error message "Login failed due to an unknown reason". I am certain of my password. I saw that it runs httpd, so I copied the new cert onto the server and changed the httpd config to point to it and the appropriate key. Now, when I navigate to the web UI I no longer get a certificate error, but I continue to get the same error message when I try to log in. FreeIPA appears to be working partially, because it governs `sudo` access and login within this system and I am still able to login and `sudo`. When I try to use any `ipa` commands, however, I get the following or something similar: ``` $ sudo ipa-certupdate Connection to https://freeipa1.mydomain.com/ipa/json failed with [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1129) Connection to https://freeipa2.mydomain.com/ipa/json failed with [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1129) Connection to https://freeipa3.mydomain.com/ipa/json failed with [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1129) cannot connect to 'any of the configured servers': https://freeipa1.mydomain.com/ipa/json, https://freeipa2.mydomain.com/ipa/json, https://freeipa3.mydomain.com/ipa/json The ipa-certupdate command failed. ``` and ``` $ ipa user-find ipa: ERROR: cannot connect to 'any of the configured servers': https://freeipa1.mydomain.com/ipa/json, https://freeipa2.mydomain.com/ipa/json, https://freeipa3.mydomain.com/ipa/json ``` I am able to get correct responses from `id [username]` and `getent passwd [username]`, and am able to `kinit`, `ssh`, and `sudo` using credentials that are governed by these servers. ## What I have tried - I replaced the old certificate in the httpd config with a new one that is essentially the same except it has an updated valid date window, and is signed with RSA384 instead of RSA356 (I don't think this matters, but including for completeness), and then restarted httpd - I did `ipactl restart` and `systemctl restart sssd` - I put the old certificate back in place, disabled NTP on the server and set the time back to a date when the prior certificate was valid - I have looked through sssd_* and /var/log/secure for relevant logs. I found one at /var/log/sssd/sssd_mydomain.com.log, with error logs that appear relevant, but I'm not able to tell what is not working. I have not found other relevant-looking entries in other sssd logs - `dig -t SRV _ldap._tcp.freeipa1.mydomain.com @127.0.0.1` from the freeipa1 terminal gave a reasonable response I also tried an ldapsearch that had worked previously: ``` $ ldapsearch -x -b "dc=mydomain,dc=com" -H ldap://freeipa1.mydomain.com -D "cn=admin,dc=mydomain,dc=com" -W Enter LDAP Password: ldap_bind: Invalid credentials (49) ``` ## Logs Here is a snippet from a very large log file from freeipa3.mydomain.com:/var/log/sssd/sssd_mydomain.com.log. I elided portions that seem to be generic, and kept lines that mention mydomain.com and what appears to be related context. It's possible I elided something important, and can provide unelided logs or specific portions if needed. There are 3 backtraces here, the first is long and elided and the last two are short and included in full. I notice the conspicuous "Network is unreachable" messages, and checked to confirm that I am able to ping all three servers from everywhere in the network (including from these servers themselves), so I don't believe it is actually a network outage. ``` (2024-06-27 9:24:14): [be[mydomain.com]] [server_setup] (0x1f7c0): Starting with debug level = 0x0070 (2024-06-27 9:24:16): [be[mydomain.com]] [sssd_async_connect_send] (0x0020): [RID#1] connect failed [101][Network is unreachable]. ********************** PREVIOUS MESSAGE WAS TRIGGERED BY THE FOLLOWING BACKTRACE: * [be[mydomain.com]] [become_user] (0x0200): Trying to become user [0][0]. * [be[mydomain.com]] [become_user] (0x0200): Already user [0]. * [be[mydomain.com]] [ldb] (0x0400): server_sort:Unable to register control with rootdse! * (2024-06-27 9:24:14): [be[mydomain.com]] [server_setup] (0x0400): CONFDB: /var/lib/sss/db/config.ldb * (2024-06-27 9:24:14): [be[mydomain.com]] [dp_get_options] (0x0400): Option lookup_family_order has value ipv4_first * (2024-06-27 9:24:14): [be[mydomain.com]] [dp_get_options] (0x0400): Option dns_resolver_timeout has value 6 * (2024-06-27 9:24:14): [be[mydomain.com]] [dp_get_options] (0x0400): Option dns_resolver_op_timeout has value 3 * (2024-06-27 9:24:14): [be[mydomain.com]] [dp_get_options] (0x0400): Option dns_resolver_server_timeout has value 1000 * (2024-06-27 9:24:14): [be[mydomain.com]] [dp_get_options] (0x0400): Option dns_discovery_domain has no value * (2024-06-27 9:24:14): [be[mydomain.com]] [be_res_get_opts] (0x0100): Lookup order: ipv4_first * (2024-06-27 9:24:14): [be[mydomain.com]] [recreate_ares_channel] (0x0100): Initializing new c-ares channel * (2024-06-27 9:24:14): [be[mydomain.com]] [fo_context_init] (0x0400): Created new fail over context, retry timeout is 30 * (2024-06-27 9:24:14): [be[mydomain.com]] [confdb_get_domain_internal] (0x0400): No enumeration for [implicit_files]! * (2024-06-27 9:24:14): [be[mydomain.com]] [confdb_get_domain_internal] (0x0400): Please note that when enumeration is disabled `getent passwd` does not return all users by design. See sssd.conf man page for more detailed information * (2024-06-27 9:24:14): [be[mydomain.com]] [confdb_get_domain_internal] (0x1000): pwd_expiration_warning is -1 * (2024-06-27 9:24:14): [be[mydomain.com]] [confdb_get_domain_internal] (0x0400): No enumeration for [mydomain.com] * (2024-06-27 9:24:14): [be[mydomain.com]] [confdb_get_domain_internal] (0x0400): Please note that when enumeration is disabled `getent passwd` does not return all users by design. See sssd.conf man page for more detailed information * (2024-06-27 9:24:14): [be[mydomain.com]] [confdb_get_domain_internal] (0x1000): pwd_expiration_warning is -1 * (2024-06-27 9:24:14): [be[mydomain.com]] [sss_domain_get_state] (0x1000): Domain mydomain.com is Active * (2024-06-27 9:24:14): [be[mydomain.com]] [sysdb_domain_init_internal] (0x0200): DB File for mydomain.com: /var/lib/sss/db/cache_mydomain.com.ldb * (2024-06-27 9:24:14): [be[mydomain.com]] [sysdb_domain_init_internal] (0x0200): Timestamp file for mydomain.com: /var/lib/sss/db/timestamps_mydomain.com.ldb * (2024-06-27 9:24:14): [be[mydomain.com]] [ldb] (0x0400): asq: Unable to register control with rootdse! * (2024-06-27 9:24:14): [be[mydomain.com]] [sss_domain_get_state] (0x1000): Domain mydomain.com is Active * (2024-06-27 9:24:14): [be[mydomain.com]] [sss_names_init_from_args] (0x0100): Using re [(((?P<domain>[^\\]+)\\(?P<name>.+$))|((?P<name>[^@]+)@(?P<domain>.+$))|(^(?P<name>[^@\\]+)$))]. * (2024-06-27 9:24:14): [be[mydomain.com]] [sss_fqnames_init] (0x0100): Using fq format [%1$s@%2$s]. * (2024-06-27 9:24:14): [be[mydomain.com]] [sbus_server_socket_listen] (0x0400): D-BUS Server listening on unix:path=/var/lib/sss/pipes/private/sbus-dp_mydomain.com.849,guid=1f7cd8ed5f762a097bce948b667d67fe * (2024-06-27 9:24:14): [be[mydomain.com]] [sbus_server_symlink_create] (0x1000): Symlinking the dbus path /var/lib/sss/pipes/private/sbus-dp_mydomain.com.849 to a link /var/lib/sss/pipes/private/sbus-dp_mydomain.com ... * (2024-06-27 9:24:14): [be[mydomain.com]] [sbus_connect_private_done] (0x0400): Connected to unix:path=/var/lib/sss/pipes/private/ sbus-dp_mydomain.com bus as sssd.domain_2emydomain_2ecom ... * (2024-06-27 9:24:15): [be[mydomain.com]] [krb5_service_new] (0x0100): write_kdcinfo for realm mydomain.com set to true * (2024-06-27 9:24:15): [be[mydomain.com]] [fo_new_service] (0x0400): Creating new service 'IPA' * (2024-06-27 9:24:15): [be[mydomain.com]] [resolv_is_address] (0x4000): [freeipa3.mydomain.com] does not look like an IP address * (2024-06-27 9:24:15): [be[mydomain.com]] [fo_add_server_to_list] (0x0400): Inserted primary server 'freeipa3.mydomain.com:0' to service 'IPA' * (2024-06-27 9:24:15): [be[mydomain.com]] [_ipa_servers_init] (0x0400): Added Server freeipa3.mydomain.com ... * (2024-06-27 9:24:15): [be[mydomain.com]] [ipa_get_id_options] (0x0400): Option ldap_search_base set to cn=accounts,dc=mydomain,cs=com * (2024-06-27 9:24:15): [be[mydomain.com]] [common_parse_search_base] (0x0100): Search base added: [DEFAULT][cn=accounts,dc=mydomain,cs=com][SUBTREE][] * (2024-06-27 9:24:15): [be[mydomain.com]] [ipa_get_id_options] (0x0400): Option krb5_realm set to mydomain.com * (2024-06-27 9:24:15): [be[mydomain.com]] [sdap_set_sasl_options] (0x0100): Will look for freeipa3.mydomain.com(a)mydomain.com in default keytab * (2024-06-27 9:24:15): [be[mydomain.com]] [select_principal_from_keytab] (0x0200): trying to select the most appropriate principal from keytab * (2024-06-27 9:24:15): [be[mydomain.com]] [find_principal_in_keytab] (0x4000): Trying to find principal freeipa3.mydomain.com(a)mydomain.com in keytab. * (2024-06-27 9:24:15): [be[mydomain.com]] [find_principal_in_keytab] (0x0400): No principal matching freeipa3.mydomain.com(a)mydomain.com found in keytab. * (2024-06-27 9:24:15): [be[mydomain.com]] [find_principal_in_keytab] (0x4000): Trying to find principal FREEIPA3$(a)mydomain.com in keytab. * (2024-06-27 9:24:15): [be[mydomain.com]] [find_principal_in_keytab] (0x0400): No principal matching FREEIPA3$(a)mydomain.com found in keytab. * (2024-06-27 9:24:15): [be[mydomain.com]] [find_principal_in_keytab] (0x4000): Trying to find principal host/freeipa3.mydomain.com(a)mydomain.com in keytab. * (2024-06-27 9:24:15): [be[mydomain.com]] [match_principal] (0x1000): Principal matched to the sample (host/freeipa3.mydomain.com(a)mydomain.com) * (2024-06-27 9:24:15): [be[mydomain.com]] [select_principal_from_keytab] (0x0200): Selected primary: host/ freeipa3.mydomain.com * (2024-06-27 9:24:15): [be[mydomain.com]] [select_principal_from_keytab] (0x0200): Selected realm: mydomain.com * (2024-06-27 9:24:15): [be[mydomain.com]] [sdap_set_sasl_options] (0x0100): Option ldap_sasl_authid set to host/freeipa3.mydomain.com * (2024-06-27 9:24:15): [be[mydomain.com]] [sdap_set_sasl_options] (0x0100): Option ldap_sasl_realm set to mydomain.com * (2024-06-27 9:24:15): [be[mydomain.com]] [ipa_get_id_options] (0x0400): Option ldap_user_search_base set to cn=accounts,dc=mydomain,cs=com * (2024-06-27 9:24:15): [be[mydomain.com]] [common_parse_search_base] (0x0100): Search base added: [USER][cn=accounts,dc=mydomain,cs=com][SUBTREE][] * (2024-06-27 9:24:15): [be[mydomain.com]] [ipa_get_id_options] (0x0400): Option ldap_user_search_base expanded to cover cn=trusts base * (2024-06-27 9:24:15): [be[mydomain.com]] [ipa_get_id_options] (0x0400): Option ldap_group_search_base set to cn=accounts,dc=mydomain,cs=com * (2024-06-27 9:24:15): [be[mydomain.com]] [common_parse_search_base] (0x0100): Search base added: [GROUP][cn=accounts,dc=mydomain,cs=com][SUBTREE][] * (2024-06-27 9:24:15): [be[mydomain.com]] [ipa_get_id_options] (0x0400): Option ldap_netgroup_search_base set to cn=ng,cn=alt,dc=mydomain,cs=com * (2024-06-27 9:24:15): [be[mydomain.com]] [common_parse_search_base] (0x0100): Search base added: [NETGROUP][cn=ng,cn=alt,dc=mydomain,cs=com][SUBTREE][] * (2024-06-27 9:24:15): [be[mydomain.com]] [ipa_get_id_options] (0x0100): Option ldap_host_search_base set to cn=accounts,dc=mydomain,cs=com * (2024-06-27 9:24:15): [be[mydomain.com]] [common_parse_search_base] (0x0100): Search base added: [HOST][cn=accounts,dc=mydomain,cs=com][SUBTREE][] * (2024-06-27 9:24:15): [be[mydomain.com]] [ipa_get_id_options] (0x0400): Option ipa_hbac_search_base set to cn=hbac,dc=mydomain,cs=com * (2024-06-27 9:24:15): [be[mydomain.com]] [common_parse_search_base] (0x0100): Search base added: [IPA_HBAC][cn=hbac,dc=mydomain,cs=com][SUBTREE][] * (2024-06-27 9:24:15): [be[mydomain.com]] [ipa_get_id_options] (0x0100): Option ipa_selinux_search_base set to cn=selinux,dc=mydomain,cs=com * (2024-06-27 9:24:15): [be[mydomain.com]] [common_parse_search_base] (0x0100): Search base added: [IPA_SELINUX][cn=selinux,dc=mydomain,cs=com][SUBTREE][] * (2024-06-27 9:24:15): [be[mydomain.com]] [ipa_get_id_options] (0x0400): Option ipa_deskprofile_search_base set to cn=desktop-profile,dc=mydomain,cs=com * (2024-06-27 9:24:15): [be[mydomain.com]] [common_parse_search_base] (0x0100): Search base added: [IPA_DESKPROFILE][cn=desktop-profile,dc=mydomain,cs=com][SUBTREE][] * (2024-06-27 9:24:15): [be[mydomain.com]] [ipa_get_id_options] (0x0400): Option ldap_service_search_base set to cn=ipservices,cn=accounts,dc=mydomain,cs=com * (2024-06-27 9:24:15): [be[mydomain.com]] [common_parse_search_base] (0x0100): Search base added: [SERVICE][cn=ipservices,cn=accounts,dc=mydomain,cs=com][SUBTREE][] * (2024-06-27 9:24:15): [be[mydomain.com]] [ipa_get_id_options] (0x0100): Option ipa_subdomains_search_base set to cn=trusts,dc=mydomain,cs=com * (2024-06-27 9:24:15): [be[mydomain.com]] [common_parse_search_base] (0x0100): Search base added: [IPA_SUBDOMAINS][cn=trusts,dc=mydomain,cs=com][SUBTREE][] * (2024-06-27 9:24:15): [be[mydomain.com]] [ipa_get_id_options] (0x0100): Option ipa_master_domain_search_base set to cn=ad,cn=etc,dc=mydomain,cs=com * (2024-06-27 9:24:15): [be[mydomain.com]] [common_parse_search_base] (0x0100): Search base added: [IPA_MASTER_DOMAIN][cn=ad,cn=etc,dc=mydomain,cs=com][SUBTREE][] * (2024-06-27 9:24:15): [be[mydomain.com]] [ipa_get_id_options] (0x0100): Option ipa_ranges_search_base set to cn=ranges,cn=etc,dc=mydomain,cs=com * (2024-06-27 9:24:15): [be[mydomain.com]] [common_parse_search_base] (0x0100): Search base added: [IPA_RANGES][cn=ranges,cn=etc,dc=mydomain,cs=com][SUBTREE][] * (2024-06-27 9:24:15): [be[mydomain.com]] [ipa_get_id_options] (0x0100): Option ipa_views_search_base set to cn=views,cn=accounts,dc=mydomain,cs=com * (2024-06-27 9:24:15): [be[mydomain.com]] [common_parse_search_base] (0x0100): Search base added: [IPA_VIEWS][cn=views,cn=accounts,dc=mydomain,cs=com][SUBTREE][] ... * (2024-06-27 9:24:15): [be[mydomain.com]] [sdap_id_setup_tasks] (0x0400): Setting up cleanup task for mydomain.com * (2024-06-27 9:24:15): [be[mydomain.com]] [sysdb_update_view_name] (0x4000): View name already in place. * (2024-06-27 9:24:15): [be[mydomain.com]] [ipa_init_server_mode] (0x0100): The value of dns_discovery_domain will be ignored in ipa_server_mode * (2024-06-27 9:24:15): [be[mydomain.com]] [sysdb_get_certmap] (0x0400): No certificate maps found. * (2024-06-27 9:24:15): [be[mydomain.com]] [sdap_setup_certmap] (0x4000): No certmap data, nothing to do. * (2024-06-27 9:24:15): [be[mydomain.com]] [dp_copy_options_ex] (0x0400): Option ipa_domain has value mydomain.com * (2024-06-27 9:24:15): [be[mydomain.com]] [dp_copy_options_ex] (0x0400): Option ipa_server has value freeipa3.mydomain.com * (2024-06-27 9:24:15): [be[mydomain.com]] [dp_copy_options_ex] (0x0400): Option ipa_backup_server has no value * (2024-06-27 9:24:15): [be[mydomain.com]] [dp_copy_options_ex] (0x0400): Option ipa_hostname has value freeipa3.mydomain.com * (2024-06-27 9:24:15): [be[mydomain.com]] [dp_copy_options_ex] (0x0400): Option ipa_hbac_search_base has value cn=hbac,dc=mydomain,cs=com * (2024-06-27 9:24:15): [be[mydomain.com]] [dp_copy_options_ex] (0x0400): Option ipa_host_search_base has no value * (2024-06-27 9:24:15): [be[mydomain.com]] [dp_copy_options_ex] (0x0400): Option ipa_selinux_search_base has value cn=selinux,dc=mydomain,cs=com * (2024-06-27 9:24:15): [be[mydomain.com]] [dp_copy_options_ex] (0x0400): Option ipa_subdomains_search_base has value cn=trusts,dc=mydomain,cs=com * (2024-06-27 9:24:15): [be[mydomain.com]] [dp_copy_options_ex] (0x0400): Option ipa_master_domain_search_base has value cn=ad,cn=etc,dc=mydomain,cs=com * (2024-06-27 9:24:15): [be[mydomain.com]] [dp_copy_options_ex] (0x0400): Option krb5_realm has value mydomain.com * (2024-06-27 9:24:15): [be[mydomain.com]] [dp_copy_options_ex] (0x0400): Option ipa_hbac_refresh has value 5 * (2024-06-27 9:24:15): [be[mydomain.com]] [dp_copy_options_ex] (0x0400): Option ipa_selinux_refresh has value 5 * (2024-06-27 9:24:15): [be[mydomain.com]] [dp_copy_options_ex] (0x0400): Option ipa_hbac_support_srchost is FALSE * (2024-06-27 9:24:15): [be[mydomain.com]] [dp_copy_options_ex] (0x0400): Option ipa_automount_location has value default * (2024-06-27 9:24:15): [be[mydomain.com]] [dp_copy_options_ex] (0x0400): Option ipa_ranges_search_base has value cn=ranges,cn=etc,dc=mydomain,cs=com * (2024-06-27 9:24:15): [be[mydomain.com]] [dp_copy_options_ex] (0x0400): Option ipa_enable_dns_sites is FALSE * (2024-06-27 9:24:15): [be[mydomain.com]] [dp_copy_options_ex] (0x0400): Option ipa_server_mode is TRUE * (2024-06-27 9:24:15): [be[mydomain.com]] [dp_copy_options_ex] (0x0400): Option ipa_views_search_base has value cn=views,cn=accounts,dc=mydomain,cs=com * (2024-06-27 9:24:15): [be[mydomain.com]] [dp_copy_options_ex] (0x0400): Option krb5_confd_path has value /var/lib/sss/pubconf/krb5.include.d * (2024-06-27 9:24:15): [be[mydomain.com]] [dp_copy_options_ex] (0x0400): Option ipa_deskprofile_search_base has value cn=desktop-profile,dc=mydomain,cs=com * (2024-06-27 9:24:15): [be[mydomain.com]] [dp_copy_options_ex] (0x0400): Option ipa_deskprofile_refresh has value 5 * (2024-06-27 9:24:15): [be[mydomain.com]] [dp_copy_options_ex] (0x0400): Option ipa_deskprofile_request_interval has value 60 ... * (2024-06-27 9:24:15): [be[mydomain.com]] [krb5_try_kdcip] (0x0100): No KDC found in configuration, trying legacy option * (2024-06-27 9:24:15): [be[mydomain.com]] [ipa_get_auth_options] (0x0400): Option krb5_realm set to mydomain.com * (2024-06-27 9:24:15): [be[mydomain.com]] [ipa_get_auth_options] (0x0100): Option krb5_fast_principal set to host/ freeipa3.mydomain.com(a)mydomain.com ... * (2024-06-27 9:24:15): [be[mydomain.com]] [common_parse_search_base] (0x0100): Search base added: [SUDO][cn=sudo,dc=mydomain,cs=com][SUBTREE][] ... * (2024-06-27 9:24:15): [be[mydomain.com]] [ipa_get_autofs_options] (0x1000): Option ldap_autofs_search_base set to cn=default,cn=automount,dc=mydomain,cs=com * (2024-06-27 9:24:15): [be[mydomain.com]] [common_parse_search_base] (0x0100): Search base added: [AUTOFS][cn=default,cn=automount,dc=mydomain,cs=com][SUBTREE][] ... * (2024-06-27 9:24:15): [be[mydomain.com]] [ipa_subdom_reinit] (0x2000): Re-initializing domain mydomain.com * (2024-06-27 9:24:15): [be[mydomain.com]] [sss_write_krb5_localauth_snippet] (0x0200): File for localauth plugin configuration is [/var/lib/sss/pubconf/krb5.include.d/localauth_plugin] * (2024-06-27 9:24:15): [be[mydomain.com]] [sss_write_krb5_libdefaults_snippet] (0x0200): File for KRB5 kibdefaults configuration is [/var/lib/sss/pubconf/krb5.include.d/krb5_libdefaults] * (2024-06-27 9:24:15): [be[mydomain.com]] [sss_domain_get_state] (0x1000): Domain mydomain.com is Active * (2024-06-27 9:24:16): [be[mydomain.com]] [sss_write_domain_mappings] (0x0200): Mapping file for domain [mydomain.com] is [/var/lib/sss/pubconf/krb5.include.d/domain_realm_mydomain_com] ... * (2024-06-27 9:24:16): [be[mydomain.com]] [sbus_dispatch] (0x4000): Dispatching. * (2024-06-27 9:24:16): [be[mydomain.com]] [sbus_method_handler] (0x2000): Received D-Bus method sssd.dataprovider.getDomains on /sssd * (2024-06-27 9:24:16): [be[mydomain.com]] [sbus_senders_lookup] (0x2000): Looking for identity of sender [sssd.ssh] * (2024-06-27 9:24:16): [be[mydomain.com]] [dp_attach_req] (0x0400): [RID#1] DP Request [Subdomains #1]: REQ_TRACE: New request. Flags [0000]. * (2024-06-27 9:24:16): [be[mydomain.com]] [dp_attach_req] (0x0400): [RID#1] Number of active DP request: 1 * (2024-06-27 9:24:16): [be[mydomain.com]] [sdap_id_op_connect_step] (0x4000): [RID#1] beginning to connect * (2024-06-27 9:24:16): [be[mydomain.com]] [fo_resolve_service_send] (0x0100): [RID#1] Trying to resolve service 'IPA' * (2024-06-27 9:24:16): [be[mydomain.com]] [get_server_status] (0x1000): [RID#1] Status of server 'freeipa3.mydomain.com' is 'name not resolved' * (2024-06-27 9:24:16): [be[mydomain.com]] [get_port_status] (0x1000): [RID#1] Port status of port 0 for server 'freeipa3.mydomain.com' is 'neutral' * (2024-06-27 9:24:16): [be[mydomain.com]] [fo_resolve_service_activate_timeout] (0x2000): [RID#1] Resolve timeout [dns_resolver_timeout] set to 6 seconds * (2024-06-27 9:24:16): [be[mydomain.com]] [get_server_status] (0x1000): [RID#1] Status of server 'freeipa3.mydomain.com' is 'name not resolved' * (2024-06-27 9:24:16): [be[mydomain.com]] [resolv_is_address] (0x4000): [RID#1] [freeipa3.mydomain.com] does not look like an IP address * (2024-06-27 9:24:16): [be[mydomain.com]] [resolv_gethostbyname_step] (0x2000): [RID#1] Querying files * (2024-06-27 9:24:16): [be[mydomain.com]] [resolv_gethostbyname_files_send] (0x0100): [RID#1] Trying to resolve A record of 'freeipa3.mydomain.com' in files * (2024-06-27 9:24:16): [be[mydomain.com]] [set_server_common_status] (0x0100): [RID#1] Marking server 'freeipa3.mydomain.com' as 'resolving name' * (2024-06-27 9:24:16): [be[mydomain.com]] [set_server_common_status] (0x0100): [RID#1] Marking server 'freeipa3.mydomain.com' as 'name resolved' * (2024-06-27 9:24:16): [be[mydomain.com]] [be_resolve_server_process] (0x1000): [RID#1] Saving the first resolved server * (2024-06-27 9:24:16): [be[mydomain.com]] [be_resolve_server_process] (0x0200): [RID#1] Found address for server freeipa3.mydomain.com: [192.168.6.13] TTL 7200 * (2024-06-27 9:24:16): [be[mydomain.com]] [ipa_resolve_callback] (0x0400): [RID#1] Constructed uri 'ldap://freeipa3.mydomain.com' * (2024-06-27 9:24:16): [be[mydomain.com]] [unique_filename_destructor] (0x2000): [RID#1] Unlinking [/var/lib/sss/pubconf/.krb5info_dummy_D5zpou] * (2024-06-27 9:24:16): [be[mydomain.com]] [unlink_dbg] (0x2000): [RID#1] File already removed: [/var/lib/sss/pubconf/.krb5info_dummy_D5zpou] * (2024-06-27 9:24:16): [be[mydomain.com]] [sssd_async_socket_init_send] (0x4000): [RID#1] Using file descriptor [22] for the connection. * (2024-06-27 9:24:16): [be[mydomain.com]] [sssd_async_connect_send] (0x0020): [RID#1] connect failed [101][Network is unreachable]. ********************** BACKTRACE DUMP ENDS HERE ********************************* (2024-06-27 9:24:16): [be[mydomain.com]] [sssd_async_socket_init_done] (0x0020): [RID#1] sdap_async_sys_connect request failed: [101]: Network is unreachable.(2024-06-27 9:24:16): [be[mydomain.com]] [sss_ldap_init_sys_connect_done] (0x0020): [RID#1] sssd_async_socket_init request failed: [101]: Network is unreachable. ********************** PREVIOUS MESSAGE WAS TRIGGERED BY THE FOLLOWING BACKTRACE: * (2024-06-27 9:24:16): [be[mydomain.com]] [sssd_async_socket_init_send] (0x0400): [RID#1] Setting 6 seconds timeout [ldap_network_timeout] for connecting * (2024-06-27 9:24:16): [be[mydomain.com]] [sssd_async_socket_init_done] (0x0020): [RID#1] sdap_async_sys_connect request failed: [101]: Network is unreachable. * (2024-06-27 9:24:16): [be[mydomain.com]] [sssd_async_socket_state_destructor] (0x0400): [RID#1] closing socket [22] * (2024-06-27 9:24:16): [be[mydomain.com]] [sss_ldap_init_sys_connect_done] (0x0020): [RID#1] sssd_async_socket_init request failed: [101]: Network is unreachable. ********************** BACKTRACE DUMP ENDS HERE ********************************* (2024-06-27 9:24:16): [be[mydomain.com]] [sdap_sys_connect_done] (0x0020): [RID#1] sdap_async_connect_call request failed: [101]: Network is unreachable. (2024-06-27 9:24:16): [be[mydomain.com]] [fo_resolve_service_send] (0x0020): [RID#1] No available servers for service 'IPA' ********************** PREVIOUS MESSAGE WAS TRIGGERED BY THE FOLLOWING BACKTRACE: * (2024-06-27 9:24:16): [be[mydomain.com]] [sdap_sys_connect_done] (0x0020): [RID#1] sdap_async_connect_call request failed: [101]: Network is unreachable. * (2024-06-27 9:24:16): [be[mydomain.com]] [sdap_handle_release] (0x2000): [RID#1] Trace: sh[0x55aae80acbd0], connected[0], ops[(nil)], ldap[(nil)], destructor_lock[0], release_memory[0] * (2024-06-27 9:24:16): [be[mydomain.com]] [_be_fo_set_port_status] (0x8000): [RID#1] Setting status: PORT_NOT_WORKING. Called from: src/providers/ldap/sdap_async_connection.c: sdap_cli_connect_done: 1633 * (2024-06-27 9:24:16): [be[mydomain.com]] [fo_set_port_status] (0x0100): [RID#1] Marking port 0 of server 'freeipa3.mydomain.com' as 'not working' * (2024-06-27 9:24:16): [be[mydomain.com]] [fo_set_port_status] (0x0400): [RID#1] Marking port 0 of duplicate server 'freeipa3.mydomain.com' as 'not working' * (2024-06-27 9:24:16): [be[mydomain.com]] [fo_resolve_service_send] (0x0100): [RID#1] Trying to resolve service 'IPA' * (2024-06-27 9:24:16): [be[mydomain.com]] [get_server_status] (0x1000): [RID#1] Status of server 'freeipa3.mydomain.com' is 'name resolved' * (2024-06-27 9:24:16): [be[mydomain.com]] [get_port_status] (0x1000): [RID#1] Port status of port 0 for server 'freeipa3.mydomain.com' is 'not working' * (2024-06-27 9:24:16): [be[mydomain.com]] [get_port_status] (0x0080): [RID#1] SSSD is unable to complete the full connection request, this internal status does not necessarily indicate network port issues. * (2024-06-27 9:24:16): [be[mydomain.com]] [fo_resolve_service_send] (0x0020): [RID#1] No available servers for service 'IPA' ********************** BACKTRACE DUMP ENDS HERE ********************************* ```

1 0

Best way to upgrade FreeIpa version and OS
by Youssef CHTOUROU 01 Jul '24

01 Jul '24

Hello I've 3 FreeIpa Servers (version =4.6.8) runned on Centos 7. I'am looking for upgrade these servers like that : Centos 7 to Rocky 8 FreeIpa server to most recent version possible I would like to see your advice : what is the best / secure way to do this upgrade ? Thanks a lot

1 0

Kerberos / Samba authentication issue after updating to 4.9.13-10
by Florian Spicher 01 Jul '24

01 Jul '24

Hello, We experience some problems with Kerberos / Samba authentication after updating our two FreeIPA servers. The issue appeared after updating the following packages: ipa-server-trust-ad-4.9.13-10.module_el8.10.0+3857+9c8da539.x86_64 ipa-server-dns-4.9.13-10.module_el8.10.0+3857+9c8da539.noarch ipa-server-4.9.13-10.module_el8.10.0+3857+9c8da539.x86_64 python3-ipaserver-4.9.13-10.module_el8.10.0+3857+9c8da539.noarch ipa-client-4.9.13-10.modue_el8.10.0+3857+9c8da539.x86_64 python3-ipaclient-4.9.13-10.module_el8.10.0+3857+9c8da539.noarch python3-ipalib-4.9.13-10.module_el8.10.0+3857+9c8da539.noarch ipa-common-4.9.13-10.module_el8.10.0+3857+9c8da539.noarch ipa-selinux-4.9.13-10.module_el8.10.0+3857+9c8da539.noarch ipa-server-common-4.9.13-10.module_el8.10.0+3857+9c8da539.noarch ipa-client-common-4.9.13-10.module_el8.10.0+3857+9c8da539.noarch We've running an Samba server which uses FreeIPA for authentication, set up with "ipa-client-samba". After the updates, the authentication failed. Samba Log Error: ../../auth/gensec/spnego.c:1245(gensec_spnego_server_negTokenInit_step) gensec_spnego_server_negTokenInit_step: gse_krb5: parsing NEG_TOKEN_INIT content failed (next[(null)]): NT_STATUS_LOGON_FAILURE krb5kdc.log Error: krb5kdc[1903](Information): TGS_REQ (5 etypes {aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17), DEPRECATED:arcfour-hmac(23), DEPRECATED:arcfour-hmac-exp(24), UNSUPPORTED:(-135)}) SERVER NOT ALLOWED: authtime 0, etypes {rep=UNSUPPORTED:(0)} user@ad for cifs/host@IPA Der Server-Principal ist nur für »user2user« gültig Has anyone experienced a similar issue or an idea why the issue appeared? Thanks, Florian

2 1

Disable user password expiration immediately after password reset.
by luckydog xf 01 Jul '24

01 Jul '24

Once the admin changes the user password, it will expire immediately. Can we disable this policy?

1 0

replica in DMZ with trust-agent
by slek kus 01 Jul '24

01 Jul '24

Hi I deployed a third replica in a dmz network for clients that do not route to the main ipa masters. Not sure if this is a workable setup. I can join clients using --fixed-primary and can logon with AD (one-way trust). This third replica has the trust-agent role. I might be approaching this incorrectly. Posting here for advise, has anyone attepted this and how to approach? It seems to be working, except the sudo rules. I have posted a diagram here: https://ibb.co/WkQj9yD

3 5

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users July 2024