FreeIPA-users September 2024

freeipa-users@lists.fedorahosted.org

29 participants
48 discussions

Re: Certificate not renewing CA_UNREACHEABLE
by Rob Crittenden 04 Sep '24

04 Sep '24

Try ipa-cert-fix. https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/7/html/li… rob Azim Siddiqui wrote: > I just checked the FreeIpa master server and the CA is managed > internally by FreeIpa. > > Validity > Not Before: Oct 30 19:52:54 2015 GMT > Not After : Oct 30 19:52:54 2035 GMT > > > Ok so you have to handle the renewals on master.ipa.free.ipa.com > <http://master.ipa.free.ipa.com> as it > is both the only CA and it is the renewal master. All work needs to > focus on that machine. > > Please advise what I can do next on this. > > > Yes, we need to see getcert list on master. > > Here's the getcert list from the master server :- > > getcert list > Number of certificates and requests being tracked: 8. > Request ID '20160825202629': > status: SUBMITTING > stuck: no > key pair storage: > type=NSSDB,location='/etc/dirsrv/slapd-IPA-FREE-IPA-COM',nickname='Server-Cert',token='NSS > Certificate DB',pinfile='/etc/dirsrv/slapd-IPA-FREE-IPA-COM/pwdfile.txt' > certificate: > type=NSSDB,location='/etc/dirsrv/slapd-IPA-FREE-IPA-COM',nickname='Server-Cert',token='NSS > Certificate DB' > CA: IPA > issuer: CN=Certificate Authority,O=IPA-FREE-IPA-COM > subject: CN=master.IPA-FREE-IPA-COM,O=IPA-FREE-IPA-COM > expires: 2023-12-18 15:52:08 UTC > principal name: ldap/master.IPA-FREE-IPA-COM@IPA-FREE-IPA-COM > key usage: > digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment > eku: id-kp-serverAuth,id-kp-clientAuth > pre-save command: > post-save command: /usr/lib64/ipa/certmonger/restart_dirsrv > IPA-FREE-IPA-COM > track: yes > auto-renew: yes > Request ID '20160825202951': > status: MONITORING > stuck: no > key pair storage: > type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert > cert-pki-ca',token='NSS Certificate DB',pin set > certificate: > type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert > cert-pki-ca',token='NSS Certificate DB' > CA: dogtag-ipa-ca-renew-agent > issuer: CN=Certificate Authority,O=IPA-FREE-IPA-COM > subject: CN=CA Audit,O=IPA-FREE-IPA-COM > expires: 2025-06-12 00:01:52 UTC > key usage: digitalSignature,nonRepudiation > pre-save command: /usr/lib64/ipa/certmonger/stop_pkicad > post-save command: /usr/lib64/ipa/certmonger/renew_ca_cert > "auditSigningCert cert-pki-ca" > track: yes > auto-renew: yes > Request ID '20160825202952': > status: SUBMITTING > stuck: no > key pair storage: > type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert cert-pki-ca',token='NSS > Certificate DB',pin set > certificate: > type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert cert-pki-ca',token='NSS > Certificate DB' > CA: dogtag-ipa-ca-renew-agent > issuer: CN=Certificate Authority,O=IPA-FREE-IPA-COM > subject: CN=OCSP Subsystem,O=IPA-FREE-IPA-COM > expires: 2023-06-29 10:16:09 UTC > eku: id-kp-OCSPSigning > pre-save command: /usr/lib64/ipa/certmonger/stop_pkicad > post-save command: /usr/lib64/ipa/certmonger/renew_ca_cert > "ocspSigningCert cert-pki-ca" > track: yes > auto-renew: yes > Request ID '20160825202953': > status: SUBMITTING > stuck: no > key pair storage: > type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert > cert-pki-ca',token='NSS Certificate DB',pin set > certificate: > type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert > cert-pki-ca',token='NSS Certificate DB' > CA: dogtag-ipa-ca-renew-agent > issuer: CN=Certificate Authority,O=IPA-FREE-IPA-COM > subject: CN=CA Subsystem,O=IPA-FREE-IPA-COM > expires: 2023-06-29 10:16:29 UTC > key usage: > digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment > eku: id-kp-serverAuth,id-kp-clientAuth > pre-save command: /usr/lib64/ipa/certmonger/stop_pkicad > post-save command: /usr/lib64/ipa/certmonger/renew_ca_cert > "subsystemCert cert-pki-ca" > track: yes > auto-renew: yes > Request ID '20160825202954': > status: MONITORING > stuck: no > key pair storage: > type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert > cert-pki-ca',token='NSS Certificate DB',pin set > certificate: > type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert > cert-pki-ca',token='NSS Certificate DB' > CA: dogtag-ipa-ca-renew-agent > issuer: CN=Certificate Authority,O=IPA-FREE-IPA-COM > subject: CN=Certificate Authority,O=IPA-FREE-IPA-COM > expires: 2035-10-30 19:52:54 UTC > key usage: digitalSignature,nonRepudiation,keyCertSign,cRLSign > pre-save command: /usr/lib64/ipa/certmonger/stop_pkicad > post-save command: /usr/lib64/ipa/certmonger/renew_ca_cert > "caSigningCert cert-pki-ca" > track: yes > auto-renew: yes > Request ID '20160825202955': > status: SUBMITTING > stuck: no > key pair storage: > type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert > cert-pki-ca',token='NSS Certificate DB',pin set > certificate: > type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert > cert-pki-ca',token='NSS Certificate DB' > CA: dogtag-ipa-renew-agent > issuer: CN=Certificate Authority,O=IPA-FREE-IPA-COM > subject: CN=master.IPA-FREE-IPA-COM,O=IPA-FREE-IPA-COM > expires: 2024-04-23 15:52:18 UTC > key usage: > digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment > eku: id-kp-serverAuth,id-kp-clientAuth,id-kp-emailProtection > pre-save command: /usr/lib64/ipa/certmonger/stop_pkicad > post-save command: /usr/lib64/ipa/certmonger/renew_ca_cert > "Server-Cert cert-pki-ca" > track: yes > auto-renew: yes > Request ID '20160825203104': > status: MONITORING > stuck: no > key pair storage: > type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS > Certificate DB',pinfile='/etc/httpd/alias/pwdfile.txt' > certificate: > type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS > Certificate DB' > CA: IPA > issuer: CN=Certificate Authority,O=IPA-FREE-IPA-COM > subject: CN=master.IPA-FREE-IPA-COM,O=IPA-FREE-IPA-COM > expires: 2024-10-14 20:01:14 UTC > principal name: HTTP/master.IPA-FREE-IPA-COM@IPA-FREE-IPA-COM > key usage: > digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment > eku: id-kp-serverAuth,id-kp-clientAuth > pre-save command: > post-save command: /usr/lib64/ipa/certmonger/restart_httpd > track: yes > auto-renew: yes > Request ID '20160825203110': > status: MONITORING > stuck: no > key pair storage: > type=NSSDB,location='/etc/httpd/alias',nickname='ipaCert',token='NSS > Certificate DB',pinfile='/etc/httpd/alias/pwdfile.txt' > certificate: > type=NSSDB,location='/etc/httpd/alias',nickname='ipaCert',token='NSS > Certificate DB' > CA: dogtag-ipa-ca-renew-agent > issuer: CN=Certificate Authority,O=IPA-FREE-IPA-COM > subject: CN=IPA RA,O=IPA-FREE-IPA-COM > expires: 2025-06-12 00:00:31 UTC > key usage: > digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment > eku: id-kp-serverAuth,id-kp-clientAuth > pre-save command: /usr/lib64/ipa/certmonger/renew_ra_cert_pre > post-save command: /usr/lib64/ipa/certmonger/renew_ra_cert > track: yes > auto-renew: yes > > On Wed, 4 Sept 2024 at 13:39, Rob Crittenden <rcritten(a)redhat.com > <mailto:rcritten@redhat.com>> wrote: > > Azim Siddiqui wrote: > > HI Rob, > > > > We need a bit more information. > > > > What version of IPA are you running on what distribution? > > I am running FreeIPA VERSION: 4.6.8 on Centos 7 > > > > What is your topology? Is this your only server? Does this server have > > the CA service installed? Did you use an external CA to sign the > IPA CA > > on installation? > > > > I currently have one master and one replica server in the topology. It > > appears that the certificate on the master server has expired. The > > CA_UNREACHABLE error is occurring on the replica server. > > Unfortunately, I'm not sure whether an external CA was used during the > > original installation, as I inherited the server a couple of > months ago > > and don’t have details on the initial setup. > > You'll be able to tell with the getcert output by the Issuer of your IPA > CA certificate. If the subjects match then it is self-signed and is > probably good for another decade or more. > > > > > Will ipa config-show run? What does it tell you? > > Yes the ipa config-show command is ruining on the replica server and > > this is the output :- > > > > ipa config-show > > Maximum username length: 32 > > Home directory base: /home > > Default shell: /bin/bash > > Default users group: users > > Default e-mail domain: > > Search time limit: 2 > > Search size limit: 1000 > > User search fields: uid,givenname,sn,telephonenumber,ou,title > > Group search fields: cn,description > > Enable migration mode: FALSE > > Certificate Subject base: O=IPA-FREE-IPA-COM > > Password Expiration Notification (days): 4 > > Password plugin features: AllowNThash > > SELinux user map order: > > Default SELinux user: > > Default PAC types: MS-PAC, nfs:NONE > > IPA masters: xyz.ipa.free-ipa.com <http://xyz.ipa.free-ipa.com> > <http://xyz.ipa.free-ipa.com>, > > master.ipa.free.ipa.com <http://master.ipa.free.ipa.com> > <http://master.ipa.free.ipa.com> > > IPA CA servers: master.ipa.free.ipa.om > <http://master.ipa.free.ipa.om> <http://master.ipa.free.ipa.om> > > IPA NTP servers: xyz.ipa.free-ipa.com > <http://xyz.ipa.free-ipa.com> <http://xyz.ipa.free-ipa.com> > > IPA CA renewal master: master.ipa.free.ipa.com > <http://master.ipa.free.ipa.com> > > <http://master.ipa.free.ipa.com> > > IPA DNS servers: xyz.ipa.free-ipa.com > <http://xyz.ipa.free-ipa.com> <http://xyz.ipa.free-ipa.com>, > > master.ipa.free.ipa.com <http://master.ipa.free.ipa.com> > <http://master.ipa.free.ipa.com> > > Ok so you have to handle the renewals on master.ipa.free.ipa.com > <http://master.ipa.free.ipa.com> as it > is both the only CA and it is the renewal master. All work needs to > focus on that machine. > > > > > You didn't include how you got this output. You want to use > getcert list > > to see all of the tracked certificates and not ipa-getcert list. > > > > I got that output by running the ipa-getcert list command. > > Yes, we need to see getcert list on master. > > rob > > > > On Tue, 3 Sept 2024 at 17:14, Rob Crittenden <rcritten(a)redhat.com > <mailto:rcritten@redhat.com> > > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com>>> wrote: > > > > Azim Siddiqui via FreeIPA-users wrote: > > > Hello, > > > > > > On one of the FreeIPA servers, I’m encountering an issue > with the > > > certificate: > > > > > > Number of certificates and requests being tracked: 1. > > > Request ID '20220930041156': > > > status: CA_UNREACHABLE > > > ca-error: Server > > at https://xyz.ipa.free-ipa.com/ipa/xml failed > > > request, will retry: 4001 (RPC failed at server. ipa: > Certificate > > > Authority not found). > > > stuck: no > > > key pair storage: > > > > > > type=NSSDB,location='/etc/dirsrv/slapd-IPA-FREE-IPA-COM',nickname='Server-Cert',token='NSS > > > Certificate > > DB',pinfile='/etc/dirsrv/slapd-IPA-FREE-IPA-COM/pwdfile.txt' > > > certificate: > > > > > > type=NSSDB,location='/etc/dirsrv/slapd-IPA-FREE-IPA-COM',nickname='Server-Cert',token='NSS > > > Certificate DB' > > > CA: IPA > > > issuer: CN=Certificate Authority,O=IPA-FREE-IPA-COM > > > subject: CN=xyz.ipa.free-ipa.com > <http://xyz.ipa.free-ipa.com> <http://xyz.ipa.free-ipa.com> > > > <http://xyz.ipa.free-ipa.com/>,O=IPA-FREE-IPA-COM > > > expires: 2024-09-30 02:22:56 UTC > > > key usage: > > > digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment > > > eku: id-kp-serverAuth,id-kp-clientAuth > > > pre-save command: > > > post-save command: > /usr/libexec/ipa/certmonger/restart_dirsrv > > > IPA-FREE-IPA-COM > > > track: yes > > > auto-renew: yes > > > > > > Could someone please guide me on how to troubleshoot and resolve > > this issue? > > > > > > > We need a bit more information. > > > > What version of IPA are you running on what distribution? > > > > What is your topology? Is this your only server? Does this > server have > > the CA service installed? Did you use an external CA to sign > the IPA CA > > on installation? > > > > Will ipa config-show run? What does it tell you? > > > > ipa: Certificate Authority not found. I'm not entirely sure > what is > > throwing this error. I think the systemd journal might tell us. > > > > You didn't include how you got this output. You want to use > getcert list > > to see all of the tracked certificates and not ipa-getcert list. > > > > rob > > >

1 0

LDAP System User permissions
by Ronald Wimmer 04 Sep '24

04 Sep '24

As I do not now anything about LDAP users and permissions I would like to ask for advice in this matter. I need an LDAP user that is capable of creating users in the staging area as well as modifying or deleting existing users. I am aware of how to create a system user (https://www.freeipa.org/page/HowTo/LDAP ) but I do not know if there is some kind of permission management (apart from putting the user in cn=sysaccounts and assigning the right objectclasses). Cheers, Ron

3 13

FreeIPA + LDAP + HOTP -Problems
by John Bublitz 04 Sep '24

04 Sep '24

Hi, We use freeipa on centos to establish vpn-connections with Yubikey + HOTP. The VPN-Server is connected via LDAPS and Password+otp is the only way to authenticate. Everything works perfect until the last FreeIPA-Updates. Password+otp still works fine, but now it is possible to authenticate with password to. The checkboxes for password in the web interface are not activated. A test with phpldapadmin shows the same behavior. The FreeIPA web interface works correctly, only password + otp. It looks like the ldap server is not working properly. Does anyone have the same problems? Our Setup: - Centos 9 - FreeIPA 4.12.2 - Sophos XG (LDAPS-Connection to FreeIPA)

2 1

time out for an external domain
by Ranbir 04 Sep '24

04 Sep '24

Hi Everyone, I'm running into a weird DNS resolution problem (at home) for an external subdomain. rogersbank.com can be looked up from my Fedora 40 host joined to a two server AlmaLinux 9 IdM domain: $ dig rogersbank.com ; <<>> DiG 9.18.28 <<>> rogersbank.com ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 40375 ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 65494 ;; QUESTION SECTION: ;rogersbank.com. IN A ;; ANSWER SECTION: rogersbank.com. 20 IN A 23.9.149.95 ;; Query time: 26 msec ;; SERVER: 127.0.0.53#53(127.0.0.53) (UDP) ;; WHEN: Wed Aug 28 13:39:18 EDT 2024 ;; MSG SIZE rcvd: 5 But, the lookup for rbaccess.rogersbank.com fails: $ dig rbaccess.rogersbank.com ;; communications error to 127.0.0.53#53: timed out ;; communications error to 127.0.0.53#53: timed out ;; communications error to 127.0.0.53#53: timed out ; <<>> DiG 9.18.28 <<>> rbaccess.rogersbank.com ;; global options: +cmd ;; no servers could be reached It doesn't actually work from any of the IdM enrolled hosts or the IdM servers themselves. However, from outside my network, the name rbaccess.rogersbank.com resolves without issue. $ dig @8.8.8.8 rbaccess.rogersbank.com ; <<>> DiG 9.18.28 <<>> @8.8.8.8 rbaccess.rogersbank.com ; (1 server found) ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 49010 ;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 512 ;; QUESTION SECTION: ;rbaccess.rogersbank.com. IN A ;; ANSWER SECTION: rbaccess.rogersbank.com. 72 IN CNAME rbaccess.rogersbank.tsysecom.com. rbaccess.rogersbank.tsysecom.com. 0 IN A 67.231.80.94 ;; Query time: 48 msec ;; SERVER: 8.8.8.8#53(8.8.8.8) (UDP) ;; WHEN: Wed Aug 28 15:18:27 EDT 2024 ;; MSG SIZE rcvd: 111 Here are the errors from query_errors.log: (rbaccess.rogersbank.com) query failed (timed out) for rbaccess.rogersbank.com/IN/A at ../../../lib/ns/query.c:7389 (rbaccess.rogersbank.com) query failed (timed out) for rbaccess.rogersbank.com/IN/A at ../../../lib/ns/query.c:7389 (rbaccess.rogersbank.com) query failed (timed out) for rbaccess.rogersbank.com/IN/A at ../../../lib/ns/query.c:7389 (rbaccess.rogersbank.tsysecom.com) query failed (SERVFAIL) for rbaccess.rogersbank.tsysecom.com/IN/A at ../../../lib/ns/query.c:6659 While trying to figure out what the problem is, I found the "authoritative nameserver" setting for the zone had the name of a decommissioned IdM host. I ran 'ipa-healthcheck --failures-only', got an error for "ipa-ca" missing one of my two IdM servers, updated the "authoritative nameserver" and saw no more DNS related failures reported by ipa-healthcheck. But, the DNS resolution for rbaccess.rogersbank.com is still failing. A couple of times the resolution has worked (ping was successful). I don't understand what's happening. Anyone have any tips that would help me narrow this down? Thanks. -- Ranbir

2 5

Certificate not renewing CA_UNREACHEABLE
by Azim Siddiqui 03 Sep '24

03 Sep '24

Hello, On one of the FreeIPA servers, I’m encountering an issue with the certificate: Number of certificates and requests being tracked: 1. Request ID '20220930041156': status: CA_UNREACHABLE ca-error: Server at https://xyz.ipa.free-ipa.com/ipa/xml failed request, will retry: 4001 (RPC failed at server. ipa: Certificate Authority not found). stuck: no key pair storage: type=NSSDB,location='/etc/dirsrv/slapd-IPA-FREE-IPA-COM',nickname='Server-Cert',token='NSS Certificate DB',pinfile='/etc/dirsrv/slapd-IPA-FREE-IPA-COM/pwdfile.txt' certificate: type=NSSDB,location='/etc/dirsrv/slapd-IPA-FREE-IPA-COM',nickname='Server-Cert',token='NSS Certificate DB' CA: IPA issuer: CN=Certificate Authority,O=IPA-FREE-IPA-COM subject: CN=xyz.ipa.free-ipa.com,O=IPA-FREE-IPA-COM expires: 2024-09-30 02:22:56 UTC key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment eku: id-kp-serverAuth,id-kp-clientAuth pre-save command: post-save command: /usr/libexec/ipa/certmonger/restart_dirsrv IPA-FREE-IPA-COM track: yes auto-renew: yes Could someone please guide me on how to troubleshoot and resolve this issue?

2 1

FreeIPA / sudo rules / option / secure_path
by alexey safonov 03 Sep '24

03 Sep '24

Hi, I've checked all related output in Google search and this mailing list, but still have no answer to a question, why secure_path option is ignored by IPA? here is what I have in IPA Sudo Option: !requiretty, !authenticate, secure_path=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin:/usr/local/sbin here is the output [aaa@bbbb ~]$ sudo printenv PATH /sbin:/bin:/usr/sbin:/usr/bin for some reason that path is only taken from /etc/sudoers file thanks in advance for your help Alex

2 2

ipa-replica-manage re-initialize fails with [Error (49) - LDAP error: Invalid credentials - no response received]
by Tomas Dusek 03 Sep '24

03 Sep '24

Hello, where to find additional information to "ipa-replica-manage re-initialize --from master.example.com fails with [Error (49) - LDAP error: Invalid credentials - no response received]"? root@serverB: ipa-replica-manage re-initialize --from master.example.com -d ... ipa: DEBUG: retrieving schema for SchemaCache url=ldaps://master.example.com:636 conn=<ldap.ldapobject.SimpleLDAPObject object at 0x7fbafdaaa748> ipa: DEBUG: retrieving schema for SchemaCache url=ldaps://master.example.com:636 conn=<ldap.ldapobject.SimpleLDAPObject object at 0x7fbafd451828> ipa: INFO: Setting agreement cn=serverB.example.com-to-master.example.com,cn=replica,cn=dc\=ipa\,dc\=example\,dc\=com,cn=mapping tree,cn=config schedule to 2358-2359 0 to force synch ipa: INFO: Deleting schedule 2358-2359 0 from agreement cn=serverB.example.com-to-master.example.com,cn=replica,cn=dc\=ipa\,dc\=example\,dc\=com,cn=mapping tree,cn=config Update in progress, 15 seconds elapsed [ldaps://serverB.example.com:636] reports: Update failed! Status: [Error (49) - LDAP error: Invalid credentials - no response received] ipa: DEBUG: Destroyed connection context.ldap2_140441096464368 ... On serverB in /var/log/slapd-serverB/errors: [29/Aug/2024:12:20:11.311481133 +0200] - ERR - set_krb5_creds - Could not get initial credentials for principal [ldap/serverB.example.com(a)EXAMPLE.COM] in keytab [FILE:/etc/dirsrv/ds.keytab]: -1765328360 (Preauthentication failed) The admin PWD has been recently changed, but the change has not been replicated to serverB. Which credentials are invalid? serverB: RHEL 8.10 & IPA 4.9.13 master: RHEL 9.4 & IPA 4.11 Thanks Tomas

2 2

proper sssd timeout configuration to prevent NAT timeout
by Jaehwan Kim 03 Sep '24

03 Sep '24

Hello. We've got a number (thousands) of hosts inside a private network of cloud environment. These all query the FreeIPA server for user and group information using NAT and a gateway server. However we're having issues with the LDAP queries timing out or becoming unresponsive due to NAT timeout. In order to prevent hosts (clients) from being disconnected due to NAT timeout, we wish to try some sssd timeout values. Because we have difficulty to find out proper timeout of sssd.conf.5 manual pages (website), can you advice us on the proper timeout or propose other way? Thank you. JHK

2 3

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users September 2024