February 2025 - FreeIPA-users - Fedora mailing-lists

ansible as freeipa service authenticated with keytab on ssh connection
by Clement Bouvier 18 Feb '25

18 Feb '25

Hello everyone, I am hitting a current problem because I might misunderstand how to work different functionnality present on freeIPA. As an administrator with an user account on freeipa, I can operate with ansible on different enrolled freeipa hosts in using my kerberos ticket and using GSSAPIAuthentication with the ssh client. I usually use the ansible collection freeipa.ansible_freeipa and an admin kerberos ticket with an GSSAPI authentication on ssh without problem. However as an administrator, now I would like that my ansible playbook run inside a pipeline environment in which I would inject a keytab for authenticating the playbook as a service on IPA. The pipeline is running on a host not enrolled on the freeIPA domain. The typical usecase would be that this ansible "service" (this word might be uncorrect) can enroll an IPA client on a IPA domain. So I would expect to create a IPA service (let's name it for this example "ansible" with the principal ansible/mypipeline.test(a)IPA.TEST) not attached to any host. I would expect to create a keytab for this service and this keytab would be injected in the pipeline task. I even add this service in a group admin and create a HBAC rule where the admins group can login on ipaservers with sshd. Based on this usecase, I got the problem that my service ansible/mypipeline.test cannot get any ssh connection on a ipaserver in using the GSSAPI authentication with the ssh client. I scanned the forum threads like this one: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost… where the capacity of a FreeIPA service are illustrated (service not attached to any host and can be added as member of a group). I would image that the ssh connection with a service cannot work or it is not supported. Is it the case? The alternative way would be to create a IPA user named "ansible", request a keytab for this user and consumme this keytab in my pipeline? I can be more explicit with an example that I have in my lab but currently I think that my problem is more on my understanding on the IPA concepts and how to apply them to my workflow, so what why I am not so explicit right now. Thanks.

2 1

Changing an existing attributes properties (e.g. displayname)
by Andreas Moog 17 Feb '25

17 Feb '25

Hello there, I need to change the length and default value of an existing attribute for a user. In this case, the displayname. I thought I could simply add a plugin with: from ipaserver.plugins.user import user from ipalib import Str, _ user.takes_params += ( Str('displayname?', label=_('Display name'), default_from=lambda givenname, sn: '%s%s' % (givenname[0], sn[0:3]), maxlength=5, autofill=True, ), ) But that results in an error: AttributeError: cannot override NameSpace.displayname value... What am I doing wrong? Is this not the right way to do it? This is with FreeIPA 4.9.13 on RedHat 8. Thanks for any suggestions!

2 1

HBAC rule precedence
by Ronald Wimmer 11 Feb '25

11 Feb '25

Let's say we have a host somewhatsap.mydomain.at that is member of a hostgroup saphosts that has an HBAC rule saphhosts-ssh assigned. The host somwhatsap.mydomain.at has another HBAC rule (saphosts-ssh-somecountry) directly assigned. The user we wanted to grant access to somewhatsap.mydomain.at was only assigned to the saphosts-ssh-someounctry HBAC rule so the user could not access that particular host. ipa hbactest --user=myuser(a)MYDOMAIN.at --host=somewhatsap.mydomain.at --service=sshd -------------------- Access granted: True -------------------- Matched rules: saphosts-ssh Not matched rules: saphosts-ssh-somecountry The moment we put that user into the saphosts-ssh HBAC rule the user could access the host. So... is there some kind of HBAC rule precedence I am not aware of? I could not find an answer to this question in the official documentation... (and why does hbactest say the users is granted access when it actually is not?) Cheers, Ronald

2 1

Re: FreeIPA Client Not Auto-Discovering New Server & DNS Issues
by Florence Blanc-Renaud 10 Feb '25

10 Feb '25

Hi, As a side-note, please keep the mailing list in the recipients list. On Mon, Feb 10, 2025 at 5:40 PM azeem <azeemshopping93(a)gmail.com> wrote: > Hi Florence, > > Thanks for the response. > > Yes, I have added the new FreeIPA server's hostname in the /etc/hosts > file, and when I add the new FreeIPA server's IP to /etc/resolv.conf, the > client is able to discover the new FreeIPA server. However, do I need to > manually add the new FreeIPA server IP in the /etc/resolv.conf file every > time I set up a new client? I thought the command: > > ipa-client-install --hostname=$(hostname -f) --mkhomedir --server= > newfreeipa.ipa.testing.com --domain=ipa.testing.com --realm= > IPA.TESTING.COM > would automatically discover the FreeIPA server without needing to > manually add it to the /etc/resolv.conf file. > Please read the "Autodiscovery" section of the man page for ipa-client-install. Autodiscovery means that the installer finds the right server based on its own domain and the DNS records for _ldap._tcp.$DOMAIN or _ldap._tcp.$PARENTDOMAIN etc... The client must be properly configured for DNS otherwise it won't find any SRV record for _ldap._tcp.$DOMAIN. As Rafael pointed out, if you use ansible to automate the client installation, it is possible to have ansible-freeipa automate the DNS setup for you. If you are using the command-line, the DNS configuration is a prerequisite. Hope this clarifies, flo > > Also, when I run this command on the client, before adding the new FreeIPA > server IP to /etc/resolv.conf: > > dig _ldap._tcp.ipa.clear-markets.com SRV > > It lists the old FreeIPA servers instead of the new one. This is where I’m > stuck – it seems like auto-discovery isn’t working unless I explicitly add > the new FreeIPA server's IP in /etc/resolv.conf. > > On Mon, Feb 10, 2025 at 5:36 AM Florence Blanc-Renaud <flo(a)redhat.com> > wrote: > >> Hi, >> >> do your clients use the new IPA server as DNS server? This can be done >> prior to calling ipa-client-install. >> flo >> >> On Fri, Feb 7, 2025 at 5:01 PM azeem via FreeIPA-users < >> freeipa-users(a)lists.fedorahosted.org> wrote: >> >>> Hello All, >>> >>> I have two FreeIPA servers running in AWS—one primary and one >>> replica—with the DNS entry ipa.testing.com. These servers are running >>> an older version of FreeIPA on CentOS 7 with expired certificates. I >>> inherited this setup from a previous admin. >>> >>> Since the certificates have expired, I attempted multiple renewal >>> methods, including rolling back the system time, but nothing worked. As a >>> solution, I set up a new FreeIPA primary server with the same DNS entry ( >>> ipa.testing.com) and added it to the AWS DHCP configuration alongside >>> the old servers. >>> Steps Taken: >>> >>> 1. >>> >>> Added the new FreeIPA server to the /etc/hosts 123.234.543 >>> test.ipa.testing.com test >>> 2. >>> >>> Installed FreeIPA using the following command:- ipa-server-install >>> --setup-dns --allow-zone-overlap >>> 3. >>> >>> The installation completed successfully. I can log into the UI, >>> create users, and manage configurations without issues. >>> >>> The Problem: >>> >>> When installing a FreeIPA client, it does not auto-discover the new >>> FreeIPA server unless I explicitly specify it in the command: >>> >>> ipa-client-install --hostname=$(hostname -f) --mkhomedir --server=newfreeipa.ipa.testing.com --domain=ipa.testing.com --realm=IPA.TESTING.COM >>> >>> Without the --server parameter, auto-discovery fails. >>> >>> Additionally, after successfully enrolling two clients (client-a and >>> client-b), I am unable to resolve their hostnames between them. When I >>> attempt to ping client-a from client-b, I receive: >>> >>> Name or service not known >>> >>> What am I missing? >>> >>> - >>> >>> Why isn’t the client auto-discovering the new FreeIPA server? >>> - >>> >>> Why can’t the clients resolve each other’s hostnames after >>> enrollment? >>> - >>> >>> Is there anything I need to adjust in DNS or DHCP to ensure proper >>> resolution and discovery? >>> >>> Any help would be greatly appreciated! Thanks in advance. >>> -- >>> _______________________________________________ >>> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org >>> To unsubscribe send an email to >>> freeipa-users-leave(a)lists.fedorahosted.org >>> Fedora Code of Conduct: >>> https://docs.fedoraproject.org/en-US/project/code-of-conduct/ >>> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines >>> List Archives: >>> https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost… >>> Do not reply to spam, report it: >>> https://pagure.io/fedora-infrastructure/new_issue >>> >>

2 1

FreeIPA Client Not Auto-Discovering New Server & DNS Issues
by azeem 10 Feb '25

10 Feb '25

Hello All, I have two FreeIPA servers running in AWS—one primary and one replica—with the DNS entry ipa.testing.com. These servers are running an older version of FreeIPA on CentOS 7 with expired certificates. I inherited this setup from a previous admin. Since the certificates have expired, I attempted multiple renewal methods, including rolling back the system time, but nothing worked. As a solution, I set up a new FreeIPA primary server with the same DNS entry ( ipa.testing.com) and added it to the AWS DHCP configuration alongside the old servers. Steps Taken: 1. Added the new FreeIPA server to the /etc/hosts 123.234.543 test.ipa.testing.com test 2. Installed FreeIPA using the following command:- ipa-server-install --setup-dns --allow-zone-overlap 3. The installation completed successfully. I can log into the UI, create users, and manage configurations without issues. The Problem: When installing a FreeIPA client, it does not auto-discover the new FreeIPA server unless I explicitly specify it in the command: ipa-client-install --hostname=$(hostname -f) --mkhomedir --server=newfreeipa.ipa.testing.com --domain=ipa.testing.com --realm=IPA.TESTING.COM Without the --server parameter, auto-discovery fails. Additionally, after successfully enrolling two clients (client-a and client-b), I am unable to resolve their hostnames between them. When I attempt to ping client-a from client-b, I receive: Name or service not known What am I missing? - Why isn’t the client auto-discovering the new FreeIPA server? - Why can’t the clients resolve each other’s hostnames after enrollment? - Is there anything I need to adjust in DNS or DHCP to ensure proper resolution and discovery? Any help would be greatly appreciated! Thanks in advance.

3 2

FreeIPA servers falling out of sync?
by Martin Jackson 10 Feb '25

10 Feb '25

I'm experiencing this pretty regularly. srv-ds-2 will show messages of the following type: ``` [14/Dec/2024:15:29:58.343703946 -0600] - ERR - NSMMReplicationPlugin - changelog program - repl_plugin_name_cl - agmt="cn=meTosrv-ds-1.imladris.lan" (srv-ds-1:389): CSN 675de299000600140000 not found, we aren't as up to date, or we purged [14/Dec/2024:15:29:58.354587507 -0600] - ERR - NSMMReplicationPlugin - send_updates - agmt="cn=meTosrv-ds-1.imladris.lan" (srv-ds-1:389): Data required to update replica has been purged from the changelog. If the error persists the replica must be reinitialized. [14/Dec/2024:15:30:01.404036067 -0600] - ERR - agmt="cn=meTosrv-ds-1.imladris.lan" (srv-ds-1:389) - clcache_load_buffer - Can't locate CSN 675de299000600140000 in the changelog (DB rc=-12797). If replication stops, the consumer may need to be reinitialized. ``` Both are on current Fedora 41 (specifically 389-ds-base 3.1.1-3 and freeipa-server 4.12.2-6) using lmdb databases (I just finished migrating this domain to lmdb, by deleting the previous ipa servers one at a time and rebuilding new ones in their place.) Is there a way to configure how long to keep the changelog? I can (and have) re-initialized ds-2 a couple of times at this point, but after the third time in as many days, it seems like I should look for other solutions than re-initialization. Thanks!

3 2

Re: Upgrade from 4.12.2-1.el9 to 4.12.2-7.el9 on centos stream 9 failed
by Rob Crittenden 05 Feb '25

05 Feb '25

Russell Long wrote: > Here is the obfuscated sosreport. It looks like the CA restart that happened immediately before the first 404 was successful. At least it doesn't report any errors beyond the usual LDAP connection failures at startup. The startup looks to be basically done around 2025-02-03 14:37:56 The CA returned 404's at 2025-02-03T19:39:34Z in the upgrade log. We don't have the tomcat access logs in the sosreport so we can't see the requests but they would likely also report 404 and no other details. If you manually start things can you communicate with the CA? # ipactl --skip-version-check Does the CA start? If not add --ignore-service-failures Once everything else is up and settled, if the CA start failed run: systemctl restart pki-tomcatd@pki-tomcat And see if that is successful. I think it should succeed since it appears to have done so in the recent past. If so try a basic cert command: # openssl x509 -serial -noout -in /etc/ipa/ca.crt # ipa cert-show <that serial number> Does it give you data or a connection error? rob > > > On Wed, Feb 5, 2025 at 2:33 AM Alexander Bokovoy <abokovoy(a)redhat.com > <mailto:abokovoy@redhat.com>> wrote: > > On Пан, 03 лют 2025, Russell Long via FreeIPA-users wrote: > >Here is the log, sorry for the delay. Logs are redacted, but the > only thing > >changed was the domain names and DNs. > > The upgrade log chokes on the CA application not being registered in > tomcat container (the corresponding /ca/rest/... path is giving 404 > error). > > So we get back to the same point as before. An upgrade has been in > progress but somehow was interrupted. Directory server was having some > of listeners disabled to avoid external communication during the upgrade > and those listeners weren't recovered due to an interruption. You > recovered some of them but it looks like there is still something that > messes up. > > If you are saying all services are working fine, just the upgrade kicks > in every time 'ipactl restart' is run (which is part of ipa.service > machinery), it means the logged IPA data version is older than what IPA > sees in the RPM database. Temporarily, this can be fixed by looking at > /var/lib/ipa/sysupgrade/sysupgrade.state and changing ipa.data_version > value to be exact same as the RPM package version-release values. > > However, it would help to understand why an upgrade causes CA apps to > fail to register with the tomcat container. It looks like we have at > least three such cases on this list over past week or so, all on CentOS > 9 Stream, so there might be something? > > May be you can install sos report tool and collect a larger amount of > data altogether so that we can see a greater picture? > > # dnf install sos > # sos report --profile={identity,security,system,services,network} > --clean -a > > This should produce logs with consistently obfuscated hostnames and > domains across all files. You can add more domains to obfuscate with > `--domains={domain1,domain2,..}` to `sos report` tool. > > > > > > > > >On Wed, Jan 29, 2025 at 4:51 PM Rob Crittenden <rcritten(a)redhat.com > <mailto:rcritten@redhat.com>> wrote: > > > >> Russ Long via FreeIPA-users wrote: > >> > Things are functional, however IPA still thinks it needs an > upgrade, so > >> any time the service restarts, it breaks again. > >> > > >> > >> If you have time to run the upgrade again and send us a compressed > >> /var/log/ipaupgrade.log we can see if we can identify the root cause. > >> > >> rob > >> > >> > > > > > -- > / Alexander Bokovoy > Sr. Principal Software Engineer > Security / Identity Management Engineering > Red Hat Limited, Finland >

1 0

No Kerberos credentials available: Disk quota exceeded
by Djerk Geurts 05 Feb '25

05 Feb '25

Hi All, Testing an Ansible playbook, I’m running into what looks like throttling issues. But the ssh debug logs list something else. Has anyone seen this happen before? debug1: kex_input_ext_info: publickey-hostbound(a)openssh.com=<0> debug3: receive packet: type 6 debug2: service_accept: ssh-userauth debug1: SSH2_MSG_SERVICE_ACCEPT received debug3: send packet: type 50 debug3: receive packet: type 51 debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password,keyboard-interactive debug3: start over, passed a different list publickey,gssapi-keyex,gssapi-with-mic,password,keyboard-interactive debug3: preferred gssapi-with-mic,gssapi-keyex,hostbased,publickey debug3: authmethod_lookup gssapi-with-mic debug3: remaining preferred: gssapi-keyex,hostbased,publickey debug3: authmethod_is_enabled gssapi-with-mic debug1: Next authentication method: gssapi-with-mic debug1: No credentials were supplied, or the credentials were unavailable or inaccessible No Kerberos credentials available: Disk quota exceeded debug1: No credentials were supplied, or the credentials were unavailable or inaccessible No Kerberos credentials available: Disk quota exceeded debug2: we did not send a packet, disable method debug3: authmethod_lookup gssapi-keyex debug3: remaining preferred: hostbased,publickey debug3: authmethod_lookup publickey debug3: remaining preferred: ,publickey debug3: authmethod_is_enabled publickey debug1: Next authentication method: publickey SSH between the hosts works fine, and the playbook runs fine until some/all/most ssh sessions start to fail like this. Disk quota is fine on the Ansible host and the targets. The solution is probably to use key-based authentication, but as Kerberos is attempted first, I want to make sure I’m not hammering/killing an IPA server by Ansible trying Kerberos auth to 150 servers sequentially. Also, I want to be prepared for if/when another user ends up doing the same thing. -- Thanks, Djerk Geurts

2 2

Re: Fedora 41 - ssl/tls alert handshake failure on CA subsystem
by Cort Tompkins 04 Feb '25

04 Feb '25

I have had this exact error trying to create a replica. Rob's advice on the httpd log levels was very helpful (thank you!). The httpd logs showed this: ipa: DEBUG: request GET https://ipa.ipconfigure.com:443/ca/rest/account/login ipa: DEBUG: request body '' AH01972: could not resolve address of OCSP responder ipc-ca.ipconfigure.com AH02039: Certificate Verification: Error (50): application verification failure I don't remember having a DNS record for the CA (ipc-ca) separate from my primary FreeIPA server's hostname (newipa), but evidently I lost that DNS record somewhere along the way. After creating/restoring the DNS record for the CA, ipa-replica-install completes without error.

1 0

choosing auth indicator
by Charles Hedrick 04 Feb '25

04 Feb '25

We will have two external radius services, one which uses OTP and one which doesn't. As far as I can tell, IPA uses a radius auth indicator for all radius servers. Is there a way to set up one service to set the OTP indicator or its own unique indicator?

2 1

2025

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users February 2025