July 2024 - FreeIPA-users - Fedora mailing-lists

trust ad, refresh the shared account
by Jonathan Oxidnation 23 Jul '24

23 Jul '24

Hello everybody, I have a question about the objects created when we establish a trust between freeipa servers and an Active Directory Microsoft. There is something that could refresh the objects to renew the sensitive data? In my situation I used a AD account (with admin privileges) to create the trust. But after several months, the objects do not refresh themself. (WhenChanged attribute on the AD side has an old date) This question comes from our security team asking to renew the object to guarantee the security of the trust. Regards,

2 3

creating a stage user disable existing user account
by Philipp Takacs 22 Jul '24

22 Jul '24

Hello I currently play a bit around with stage user. The plan is to allow a specific group to create stage user and then let an admin activate this user. I wanted to know if the UID is checked for dublicates so I created a stage user with the same UID as mine. This creates a stage user without an error or warning. Problem is now the user account with the same UID didn't work anymore. This is a bit suprising. Because this way anyone who can create stage users can practicaly disable active users. Is there some sort of workaround for this other then only allow only admins to create stage users? Philipp

2 2

trust ad, refresh the shared account
by Jonathan Oxidnation 22 Jul '24

22 Jul '24

Hello everybody, I have a question about the objects created when we establish a trust between freeipa servers and an Active Directory Microsoft. There is something that could refresh the objects to renew the sensitive data? In my situation I used a AD account (with admin privileges) to create the trust. But after several months, the objects do not refresh themself. (WhenChanged attribute on the AD side has an old date) This question comes from our security team asking to renew the object to guarantee the security of the trust. Regards, Jonathan

1 0

How to check compactDB has finished successfuly?
by seojeong kim 22 Jul '24

22 Jul '24

[root@ipa-slave2 changelog]# ls -la total 172 drwx------ 2 dirsrv dirsrv 4096 Jan 8 2022 . drwxrwx--- 5 dirsrv dirsrv 4096 Jul 22 10:03 .. -rw------- 1 dirsrv dirsrv 51 Jul 16 02:37 DBVERSION -rw------- 1 dirsrv dirsrv 16384 Jan 8 2022 aci.db -rw------- 1 dirsrv dirsrv 16384 Jan 8 2022 ancestorid.db -rw------- 1 dirsrv dirsrv 16384 Jan 8 2022 changenumber.db -rw------- 1 dirsrv dirsrv 16384 Jan 8 2022 cn.db -rw------- 1 dirsrv dirsrv 16384 Jan 8 2022 entryrdn.db -rw------- 1 dirsrv dirsrv 16384 Jan 8 2022 entryusn.db -rw------- 1 dirsrv dirsrv 16384 Jan 8 2022 id2entry.db -rw------- 1 dirsrv dirsrv 16384 Jan 8 2022 nsuniqueid.db -rw------- 1 dirsrv dirsrv 16384 Jan 8 2022 objectclass.db -rw------- 1 dirsrv dirsrv 16384 Jan 8 2022 seeAlso.db core server has been running 2 years more and we have nsslapd-db-compactdb-interval : 30 days. recently I faced out of available db lock count I get to know about the value of nsslapd-db-locks. I need to change this value with big one. but also I want to check compactdb has been running so far while I was not aware of compactDB preocess. so I entered /db/ and checked the files. under /changelog, the date of files are 2022.Jan, 8 How can I check compactDB processed so far? and if compactDB run correctly the date of files under changelog/ should be updated with the latest date ? here the nsslapd-* configurations. [root@ipa-slave2 userRoot]# dsconf -D "cn=Directory Manager" slapd-MYDOMAIN backend config get | grep "nsslapd" nsslapd-lookthroughlimit: 100000 nsslapd-mode: 600 nsslapd-idlistscanlimit: 100000 nsslapd-directory: /var/lib/dirsrv/slapd-MYDOMAIN/db nsslapd-import-cachesize: 16777216 nsslapd-idl-switch: new nsslapd-search-bypass-filter-test: on nsslapd-search-use-vlv-index: on nsslapd-exclude-from-export: entrydn entryid dncomp parentid numSubordinates tombstonenumsubordinates entryusn nsslapd-serial-lock: on nsslapd-subtree-rename-switch: on nsslapd-pagedlookthroughlimit: 0 nsslapd-pagedidlistscanlimit: 0 nsslapd-rangelookthroughlimit: 5000 nsslapd-backend-opt-level: 1 nsslapd-backend-implement: bdb nsslapd-dbcachesize: 1610612736 nsslapd-db-logdirectory: /var/lib/dirsrv/slapd-SAMSUNGSRE-COM/db nsslapd-db-home-directory: /var/lib/dirsrv/slapd-SAMSUNGSRE-COM/db nsslapd-db-durable-transaction: on nsslapd-db-transaction-wait: off nsslapd-db-checkpoint-interval: 60 nsslapd-db-compactdb-interval: 2592000 nsslapd-db-page-size: nsslapd-db-transaction-batch-val: 0 nsslapd-db-transaction-batch-min-wait: 50 nsslapd-db-transaction-batch-max-wait: 50 nsslapd-db-logbuf-size: 0 nsslapd-db-locks: 10000 nsslapd-db-private-import-mem: on nsslapd-import-cache-autosize: 0 nsslapd-cache-autosize: 80 nsslapd-cache-autosize-split: 10 nsslapd-db-deadlock-policy: 9

1 0

adjustment for nsslapd-changelogcompactdb-interval
by seojeong kim 22 Jul '24

22 Jul '24

current value of nsslapd-changelogcompactdb-interval is 30 days. we have 10 core servers. Is this value can be configured with the different value for each server? Because recently I experience core crashed because of 'out of available lock entries' and 'db error - 12 Cannot allocate memory' We have 50000 for nsslapd-db-locks and 30 days for nsslapd-changelogcompactdb-interval . 30 days ago, all core servers are restarted for some reason and 30 days later, nsslapd-changelogcompactdb-interval is expired and all server run compactDB. while running compactDB, core server raised error with 'out of available lock entries' and 'db error - 12 Cannot allocate memory' and crashed. Q1. nsslapd-changelogcompactdb-interval can be configured with different value for each server?

1 1

Plugin API Reference or Detailed Documentation
by F B 20 Jul '24

20 Jul '24

Background: I have a working FreeIPA setup that incorporates NFSv4 shares from a NAS utilising Kerberos. Part of this setup was creating an Object Class with two attributes. In order to streamline the process of configuring the attributes during user creation, I've created a plugin by scraping together information from here, the FreeIPA website, GitHub, and some other sources. The plugin works for setting the two attribute values during user creation, and during modification in the web user interface. Question: Apart from combing through the FreeIPA code, where can I find more detailed information for improving my plugin? Something akin to an API reference? Or documentation that describes the objects and methods (including parameters, and return values)? For example, where can I find a comprehensive list of facet sections? Or where can I find a full spec of the field for pushing into the section? Where can I find detailed information for the Python side of things as well? I noticed this message in the httpd error_log: ipaserver.plugins.my_plugin is not a valid plugin module However, the plugin works. My plugin isn't the only one generating this error. Some of the ones that shipped with FreeIPA also generate this message. [baseldap, hbac, otp, rabase] Is there a reason for this? I would be grateful if someone can point me in the correct direction. I'm not sure if this ask is outside the scope of what this community provides, bear with me if it is.

2 2

LDAP automatically restarted
by seojeong kim 19 Jul '24

19 Jul '24

389 directory service automatically restarted. I can't find specific error to trigger restart. there is no PANIC error and deadlock detect error... there is only just 'Incomming BER element was too long' This error situation can trigger LDAP restart automatically ? [19/Jul/2024:06:22:59.279311026 +0000] - ERR - log_ber_too_big_error - conn=6079847 fd=396 Incoming BER Element was too long, max allowable is 209715200 bytes. Change the nsslapd-maxbersize attribute in cn=config to increase. [19/Jul/2024:06:23:01.700334149 +0000] - ERR - log_ber_too_big_error - conn=6079857 fd=1452 Incoming BER Element was too long, max allowable is 209715200 bytes. Change the nsslapd-maxbersize attribute in cn=config to increase. [19/Jul/2024:06:27:57.779058899 +0000] - ERR - NSMMReplicationPlugin - changelog program - _cl5WriteOperationTxn - retry (49) the transaction (csn=669a075e000900e90000) failed (rc=-30993 (BDB0068 DB_LOCK_DEADLOCK: Locker killed to resolve a deadlock)) [19/Jul/2024:06:27:57.780583532 +0000] - ERR - NSMMReplicationPlugin - changelog program - _cl5WriteOperationTxn - Failed to write entry with csn (669a075e000900e90000); db error - -30993 BDB0068 DB_LOCK_DEADLOCK: Locker killed to resolve a deadlock [19/Jul/2024:06:27:57.781557073 +0000] - ERR - NSMMReplicationPlugin - write_changelog_and_ruv - Can't add a change for cn=penup-pre,cn=hostgroups,cn=accounts,dc=mydomain,dc=com (uniqid: 000f3c05-70fc11eb-87e9f15a-5f2429bf, optype: 8) to changelog csn 669a075e000900e90000 [19/Jul/2024:06:27:58.125647535 +0000] - ERR - NSMMReplicationPlugin - process_postop - Failed to apply update (669a075e000900e90000) error (1). Aborting replication session(conn=6075545 op=2978) [19/Jul/2024:06:30:38.073674777 +0000] - ERR - log_ber_too_big_error - conn=6081159 fd=400 Incoming BER Element was 369736146107 bytes, max allowable is 209715200 bytes. Change the nsslapd-maxbersize attribute in cn=config to increase. [19/Jul/2024:06:32:09.283886791 +0000] - ERR - connection_read_operation - conn=6081404 received a non-LDAP message (tag 0x18, expected 0x30) [19/Jul/2024:06:33:29.585984549 +0000] - ERR - log_ber_too_big_error - conn=6081679 fd=311 Incoming BER Element was too long, max allowable is 209715200 bytes. Change the nsslapd-maxbersize attribute in cn=config to increase. [19/Jul/2024:06:34:04.617847679 +0000] - ERR - slapd_system_isFIPS - Can not access /proc/sys/crypto/fips_enabled - assuming FIPS is OFF [19/Jul/2024:06:34:04.619891225 +0000] - ERR - slapd_system_isFIPS - Can not access /proc/sys/crypto/fips_enabled - assuming FIPS is OFF [19/Jul/2024:06:34:04.931778931 +0000] - INFO - util_get_hardware_threads - Automatically configuring 16 threads [19/Jul/2024:06:34:05.521184530 +0000] - WARN - Security Initialization - /tmp is not a private namespace. pem files not exported there [19/Jul/2024:06:34:05.522737820 +0000] - INFO - slapd_extract_cert - CA CERT NAME: MYDOMAIN.COM IPA CA [19/Jul/2024:06:34:05.524500653 +0000] - WARN - Security Initialization - SSL alert: Sending pin request to SVRCore. You may need to run systemd-tty-ask-password-agent to provide the password. [19/Jul/2024:06:34:05.624809111 +0000] - INFO - slapd_extract_cert - SERVER CERT NAME: Server-Cert [19/Jul/2024:06:34:05.626359141 +0000] - WARN - Security Initialization - /tmp is not a private namespace. pem files not exported there [19/Jul/2024:06:34:05.627801709 +0000] - WARN - Security Initialization - /tmp is not a private namespace. pem files not exported there [19/Jul/2024:06:34:05.854933657 +0000] - INFO - Security Initialization - SSL info: Enabling default cipher set. [19/Jul/2024:06:34:05.856382522 +0000] - INFO - Security Initialization - SSL info: Configured NSS Ciphers [19/Jul/2024:06:34:05.857556371 +0000] - INFO - Security Initialization - SSL info: TLS_AES_128_GCM_SHA256: enabled [19/Jul/2024:06:34:05.858503393 +0000] - INFO - Security Initialization - SSL info: TLS_CHACHA20_POLY1305_SHA256: enabled [19/Jul/2024:06:34:05.859485862 +0000] - INFO - Security Initialization - SSL info: TLS_AES_256_GCM_SHA384: enabled [19/Jul/2024:06:34:05.860543982 +0000] - INFO - Security Initialization - SSL info: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256: enabled [19/Jul/2024:06:34:05.861588021 +0000] - INFO - Security Initialization - SSL info: TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256: enabled [19/Jul/2024:06:34:05.862625065 +0000] - INFO - Security Initialization - SSL info: TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256: enabled [19/Jul/2024:06:34:05.863601471 +0000] - INFO - Security Initialization - SSL info: TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256: enabled [19/Jul/2024:06:34:05.864790795 +0000] - INFO - Security Initialization - SSL info: TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384: enabled [19/Jul/2024:06:34:05.865759945 +0000] - INFO - Security Initialization - SSL info: TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384: enabled [19/Jul/2024:06:34:05.866807116 +0000] - INFO - Security Initialization - SSL info: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA: enabled [19/Jul/2024:06:34:05.867919186 +0000] - INFO - Security Initialization - SSL info: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA: enabled [19/Jul/2024:06:34:05.868910775 +0000] - INFO - Security Initialization - SSL info: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA: enabled [19/Jul/2024:06:34:05.869828849 +0000] - INFO - Security Initialization - SSL info: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256: enabled [19/Jul/2024:06:34:05.870846944 +0000] - INFO - Security Initialization - SSL info: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256: enabled [19/Jul/2024:06:34:05.871884481 +0000] - INFO - Security Initialization - SSL info: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA: enabled [19/Jul/2024:06:34:05.872960919 +0000] - INFO - Security Initialization - SSL info: TLS_DHE_RSA_WITH_AES_128_GCM_SHA256: enabled [19/Jul/2024:06:34:05.873942777 +0000] - INFO - Security Initialization - SSL info: TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256: enabled [19/Jul/2024:06:34:05.874915469 +0000] - INFO - Security Initialization - SSL info: TLS_DHE_RSA_WITH_AES_256_GCM_SHA384: enabled [19/Jul/2024:06:34:05.875865057 +0000] - INFO - Security Initialization - SSL info: TLS_DHE_RSA_WITH_AES_128_CBC_SHA: enabled [19/Jul/2024:06:34:05.876812156 +0000] - INFO - Security Initialization - SSL info: TLS_DHE_RSA_WITH_AES_128_CBC_SHA256: enabled [19/Jul/2024:06:34:05.877842946 +0000] - INFO - Security Initialization - SSL info: TLS_DHE_RSA_WITH_AES_256_CBC_SHA: enabled [19/Jul/2024:06:34:05.878878446 +0000] - INFO - Security Initialization - SSL info: TLS_DHE_RSA_WITH_AES_256_CBC_SHA256: enabled [19/Jul/2024:06:34:05.879941260 +0000] - INFO - Security Initialization - SSL info: TLS_RSA_WITH_AES_128_GCM_SHA256: enabled [19/Jul/2024:06:34:05.880887578 +0000] - INFO - Security Initialization - SSL info: TLS_RSA_WITH_AES_256_GCM_SHA384: enabled [19/Jul/2024:06:34:05.881905650 +0000] - INFO - Security Initialization - SSL info: TLS_RSA_WITH_AES_128_CBC_SHA: enabled [19/Jul/2024:06:34:05.882724291 +0000] - INFO - Security Initialization - SSL info: TLS_RSA_WITH_AES_128_CBC_SHA256: enabled [19/Jul/2024:06:34:05.883536996 +0000] - INFO - Security Initialization - SSL info: TLS_RSA_WITH_AES_256_CBC_SHA: enabled [19/Jul/2024:06:34:05.884375320 +0000] - INFO - Security Initialization - SSL info: TLS_RSA_WITH_AES_256_CBC_SHA256: enabled [19/Jul/2024:06:34:06.172298339 +0000] - INFO - Security Initialization - slapd_ssl_init2 - Configured SSL version range: min: TLS1.2, max: TLS1.3 [19/Jul/2024:06:34:06.174035089 +0000] - INFO - Security Initialization - slapd_ssl_init2 - NSS adjusted SSL version range: min: TLS1.2, max: TLS1.3 [19/Jul/2024:06:34:06.175409580 +0000] - INFO - main - 389-Directory/1.4.3.12 B2020.213.0000 starting up

3 2

adjustment of 'nsslapd-changelogcompactdb-interval', nsslapd-db-locks
by seojeong kim 19 Jul '24

19 Jul '24

current value of nsslapd-changelogcompactdb-interval is 30 days. we have 10 core servers. Is this value can be configured with the different value for each server? Because recently I experience core crashed because of 'out of available lock entries' and 'db error - 12 Cannot allocate memory' We have 50000 for nsslapd-db-locks and 30 days for nsslapd-changelogcompactdb-interval . 30 days ago, all core servers are restarted for some reason and 30 days later, nsslapd-changelogcompactdb-interval is expired and all server run compactDB. while running compactDB, core server raised error with 'out of available lock entries' and 'db error - 12 Cannot allocate memory' and crashed. So tunning these values is required. Q1. nsslapd-changelogcompactdb-interval can be configured with different value for each server?

1 0

User certificate for vpn logins
by Chris Kross 18 Jul '24

18 Jul '24

Hello to all! I'm trying a lot, to setup a Firewall vpn login with certificates generated by the FreeIPA server, but i´m stucked now. I have the user certificate generated by the FreeIPA and the firewall generate the CSR then imported on the FreeIPA server, and download the pem generated by the UI and imported again in the Firewall and the firewall match the sign certificate. But when we try to connect to the VPN using certificates, the debug shows: fnbamd_auth_cert_result-Result for ldap svr[0] 'fripa.domain.net' is DENY auth_cert_success-Matched user name 'CA-Ldaps', matched group name 'CA-Ldapgrp' fnbamd_comm_send_result-Sending result 1 (error 0, nid 672) for req 454599539 delete_group_list-Delete group CA-Ldapgrp ike 3:C2-HQ_DCI:50: certificate validation failed From the firewall we can test the Ldaps users and passwords and the test is OK. Thnks to all for any advice!

2 1

Re: Authentication failures on a RHEL 9.2 IPA server
by Basile Pinsard 18 Jul '24

18 Jul '24

Hi, I have a similar issue after reimporting user with migrate-ds including users in a legacy range. I created the id-range to contain these users ids, but some users show an error similar to the one described above. Did you manage to fix it? When running the sidgen task after setting the range, these problematic users do not get assigned the required field in the LDAP. Is there a log of the sidgen task somewhere? Thanks!

1 0

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users July 2024