FreeIPA-users April 2025

freeipa-users@lists.fedorahosted.org

32 participants
40 discussions

IPA pubkey auth and NFS KRB5
by Ronald Wimmer 09 Apr '25

09 Apr '25

I am aware of two cases here. The first one is that I do already have a TGT that I can delegate to the target host and some magic fetches the right NFS ticket for me. The second one is that I connect to the target host and enter a password and SSSD fetches a TGT and NFS ticket for me. Both cases allow me to access a kerberized NFS share. But what is when I use SSH pubkey auth (pubkey in IPA) to connect to the target host? Should I also get a TGT and NFS ticket to access a kerberized NFS share? Cheers, Ronald

4 8

Upgrade from 4.12.2-1.el9 to 4.12.2-7.el9 on centos stream 9 failed
by Russ Long 07 Apr '25

07 Apr '25

I just upgraded, using dnf, from 4.12.2-1.el9 to 4.12.2-7.el9 on a Centos Stream 9 IPA server. During the DNF upgrade, I received the following error: Job for ipa.service failed because the control process exited with error code. See "systemctl status ipa.service" and "journalctl -xeu ipa.service" for details. After the upgrade I attempted a manual ipa-server-upgrade which was met with many errors. I attempted a reboot of the host as it needed it for a kernel update anyways. Post reboot, none of the IPA Services will start, so ipa-server-upgrade fails nearly instantly. ipactl start fails as it attempts to run the server-upgrade. ipactl start --skip-version-check fails with an error about dirsrv: [root@ipa-primary sysrestore]# ipactl start --skip-version-check Skipping version check Starting Directory Service Failed to start Directory Service: CalledProcessError(Command ['/bin/systemctl', 'start', 'dirsrv(a)REDACTED.service'] returned non-zero exit status 1) That service shows multiple errors: Jan 24 10:08:01 REDACTED ns-slapd[4763]: [24/Jan/2025:10:08:01.238214824 -0500] - ERR - plugin_setup - Required attribute nsslapd-pluginInitFunc is missing from entry "cn=Case Exact String Syntax,cn=plugins,cn=config" Jan 24 10:08:01 REDACTED ns-slapd[4763]: [24/Jan/2025:10:08:01.240364122 -0500] - ERR - slapd_bootstrap_config - The plugin entry [cn=Case Exact String Syntax,cn=plugins,cn=config]in the configfile /etc/dirsrv/slapd-REDACTED/dse.ldif was invalid. Required attribute nsslapd-pluginInitFunc is missing from entry. Jan 24 10:08:01 REDACTED ns-slapd[4763]: [24/Jan/2025:10:08:01.241806986 -0500] - EMERG - main - The configuration files in directory /etc/dirsrv/slapd-REDACTED could not be read or were not found. Please refer to the error log or output for more information. Jan 24 10:08:01 REDACTED systemd[1]: dirsrv(a)REDACTED.service: Main process exited, code=exited, status=1/FAILURE Jan 24 10:08:01 REDACTED systemd[1]: dirsrv(a)REDACTED.service: Failed with result 'exit-code'. Jan 24 10:08:01 REDACTED systemd[1]: Failed to start 389 Directory Server REDACTED.. Is there any way to save this?

6 19

Get more details in ldap access logs
by Theodor Vallier 04 Apr '25

04 Apr '25

Hello all, I'm trying to log more details when there are operations on users, such as modifications (MOD). The goal is to detect legitimate user modifications like login or password changes, and differentiate them from non-legitimate ones such as default shell modifications. I attempted to change the access log level without success; the activation of the audit plugin shows me the changes, but it is not usable (it's not syslog compliant and can't be correlated to MOD requests). Is anyone able to log which fields a MOD request changes? Thank you. Best regards, Whidix

5 8

Rekeying the Self-Signed Root CA
by N. V. 04 Apr '25

04 Apr '25

Hi, In our FreeIPA deployment we need to find a way to rekey the self-signed root CA and afterwards update the chain and the certificates all the way down. I have been unable to find detailed instructions in the official documentation or through my own research, so I am reaching out for guidance. Could someone please provide instructions or point me to any relevant resources on how to properly rekey the self-signed root CA in FreeIPA? Any advice, tips, or potential pitfalls to avoid during this process would be greatly appreciated. Thank you in advance for your assistance! Nelson V.

4 6

Re: IPA host certificate and TPM
by Rob Crittenden 04 Apr '25

04 Apr '25

Ronald Wimmer wrote: > On 04.04.25 15:12, Rob Crittenden wrote: >> Ronald Wimmer wrote: >>> On 04.04.25 14:30, Rob Crittenden via FreeIPA-users wrote: >>>> Ronald Wimmer via FreeIPA-users wrote: >>>>> Is there a way to ensure that an IPA host certificate can only be used >>>>> on a specific device? Like one can do it with a TPM module? >>>>> >>>>> What other approaches would be feasible? >>>> >>>> Can you expand on what you're asking? What does "work" mean here? >>> >>> I do not see where I used the word "work" here... but I will explain my >>> use case a litte more in detail. >>> >>> What we want is a certificate that is used for VPN auth that >>> cannot/should not leave the device because we want to disallow VPN >>> connections for private devices. >>> >>>> I assume by mentioning TPM you want a secure place to store the private >>>> key so it can't be extracted? >>> >>> Yes. That is our intention. >>> >>>> IIRC there is a pkcs#11 driver for TPM so perhaps that could even work >>>> with certmonger. I've never tried. >>> Ok. I'll look into it. Would such a cert be managable via IPA? >> >> The trouble you may have is that any IPA-enrolled host can obtain a >> certificate for itself or for its services. You can protect the private >> key on the TPM but IPA has no idea (or cares) where the private key >> lives. If it gets an authenticated request with a CSR for a valid IPA >> host or service then it will issue a certificate for it. >> >> There is not currently, to my knowledge, a way to layer on additional >> restrictions onto the certificate request. >> >> So if you are not allowing private devices (BYO laptop or phone for >> example) to enroll as an IPA client then that would be one way to >> restrict the certificates. If they can't get a certificate at all they >> can't use the VPN. > You are right. As the VPN Gateway has to trust IPA's CA this will be a > good way. (But one could still copy over such a cert plus key to another > host, right?) Yes one could copy certificates and keys (assuming not on the TPM). I don't know how your VPN handles authentication. I'd be surprised it if would/could support validating that the originating host matches the subject of the certificate. This would be a NAT nightmare. But if you store the private key on the TPM then yeah, even if someone had a copy of the cert that would do them no good. But I have no idea whether a TPM can do that. What size keys are supported, etc. And it may vary by motherboard manufacturer, how virtual TPM would work, etc. It's a sticky problem for sure. rob

1 0

Re: IPA host certificate and TPM
by Rob Crittenden 04 Apr '25

04 Apr '25

Ronald Wimmer wrote: > On 04.04.25 14:30, Rob Crittenden via FreeIPA-users wrote: >> Ronald Wimmer via FreeIPA-users wrote: >>> Is there a way to ensure that an IPA host certificate can only be used >>> on a specific device? Like one can do it with a TPM module? >>> >>> What other approaches would be feasible? >> >> Can you expand on what you're asking? What does "work" mean here? > > I do not see where I used the word "work" here... but I will explain my > use case a litte more in detail. > > What we want is a certificate that is used for VPN auth that > cannot/should not leave the device because we want to disallow VPN > connections for private devices. > >> I assume by mentioning TPM you want a secure place to store the private >> key so it can't be extracted? > > Yes. That is our intention. > >> IIRC there is a pkcs#11 driver for TPM so perhaps that could even work >> with certmonger. I've never tried. > Ok. I'll look into it. Would such a cert be managable via IPA? The trouble you may have is that any IPA-enrolled host can obtain a certificate for itself or for its services. You can protect the private key on the TPM but IPA has no idea (or cares) where the private key lives. If it gets an authenticated request with a CSR for a valid IPA host or service then it will issue a certificate for it. There is not currently, to my knowledge, a way to layer on additional restrictions onto the certificate request. So if you are not allowing private devices (BYO laptop or phone for example) to enroll as an IPA client then that would be one way to restrict the certificates. If they can't get a certificate at all they can't use the VPN. rob

1 0

IPA host certificate and TPM
by Ronald Wimmer 04 Apr '25

04 Apr '25

Is there a way to ensure that an IPA host certificate can only be used on a specific device? Like one can do it with a TPM module? What other approaches would be feasible? Cheers, Ronald

2 1

FreeIPA-4.12-2 & dogtag-pki-base-11.6.0-1.fc41.2: Failed to initialize component [Connector["ajp-nio-127.0.0.1-8009"]]... Caused by: java.net.BindException: Address already in use
by Anthony Messina 02 Apr '25

02 Apr '25

After upgrading dogtag-pki on my Fedora 41 FreeIPA instances to dogtag-pki-base-11.6.0-1.fc41.2, I see the following errors on pki-tomcatd@pki-tomcat startup. I'm running freeipa-server-4.12.2-8.fc41 (including KRA). After startup, I do see that "java" is listening on 127.0.0.1:8009 and [::1]:8009. So far, I have not been able to determine if this has affected functionality on either of my FreeIPA replicas. Googling has only revealed others with port conflicts for non-FreeIPA applications, so I'm looking for some FreeIPA-specific guidance. Thanks. -A Starting pki-tomcatd(a)pki-tomcat.service - PKI Tomcat Server pki-tomcat... NOTE: Picked up JDK_JAVA_OPTIONS: --add-opens=java.base/java.lang=ALL-UNNAMED --add-opens=java.base/java.io=ALL-UNNAMED --add-opens=java.base/java.util=ALL-UNNAMED --add-opens=java.base/java.util.concurrent=ALL-UNNAMED --add-opens=java.rmi/sun.rmi.transport=ALL-UNNAMED AJP connector requiredSecret: None AJP connector requiredSecret: None AJP connector requiredSecret: None AJP connector requiredSecret: None Java virtual machine used: /usr/lib/jvm/jre-21-openjdk/bin/java classpath used: /usr/share/tomcat/bin/bootstrap.jar:/usr/share/tomcat/bin/tomcat-juli.jar: main class used: org.apache.catalina.startup.Bootstrap flags used: -Dcom.redhat.fips=false options used: -Dcatalina.base=/var/lib/pki/pki-tomcat -Dcatalina.home=/usr/share/tomcat -Djava.endorsed.dirs= -Djava.io.tmpdir=/var/lib/pki/pki-tomcat/temp -Djava.util.logging.config.file=/var/lib/pki/pki-tomcat/conf/logging.properties -Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager -Djava.security.manager -Djava.security.policy==/var/lib/pki/pki-tomcat/conf/catalina.policy arguments used: start NOTE: Picked up JDK_JAVA_OPTIONS: --add-opens=java.base/java.lang=ALL-UNNAMED --add-opens=java.base/java.io=ALL-UNNAMED --add-opens=java.base/java.util=ALL-UNNAMED --add-opens=java.base/java.util.concurrent=ALL-UNNAMED --add-opens=java.rmi/sun.rmi.transport=ALL-UNNAMED WARNING: A command line option has enabled the Security Manager WARNING: The Security Manager is deprecated and will be removed in a future release pki.client: /usr/libexec/ipa/ipa-pki-wait-running:61: The subsystem in PKIConnection.__init__() has been deprecated (https://github.com/dogtagpki/pki/wiki/PKI-10.8-Python-Changes) ipa-pki-wait-running: Created connection http://ipa4b.example.com:8080/ca ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='ipa4b.example.com', port=8080): Max retries exceeded with url: /ca/admin/ca/getStatus (Caused by NewConnectionError('<urllib3.connection.HTTPConnection object at 0x7fb3ee0ee510>: Failed to establish a new connection: [Errno 111] Connection refused')) ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='ipa4b.example.com', port=8080): Max retries exceeded with url: /ca/admin/ca/getStatus (Caused by NewConnectionError('<urllib3.connection.HTTPConnection object at 0x7fb3ee296e90>: Failed to establish a new connection: [Errno 111] Connection refused')) WARNING: Tomcat interprets the [protocols] attribute in a manner consistent with the latest OpenSSL development branch. Some of the specified [protocols] are not supported by the configured SSL engine for this connector (which may use JSSE or an older OpenSSL version) and have been skipped: [[TLSv1, TLSv1.1]] SEVERE: Failed to initialize component [Connector["ajp-nio-127.0.0.1-8009"]] org.apache.catalina.LifecycleException: Protocol handler initialization failed at org.apache.catalina.connector.Connector.initInternal(Connector.java:1027) at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:122) at org.apache.catalina.core.StandardService.initInternal(StandardService.java:525) at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:122) at org.apache.catalina.core.StandardServer.initInternal(StandardServer.java:986) at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:122) at org.apache.catalina.startup.Catalina.load(Catalina.java:690) at org.apache.catalina.startup.Catalina.load(Catalina.java:713) at java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:103) at java.base/java.lang.reflect.Method.invoke(Method.java:580) at org.apache.catalina.startup.Bootstrap.load(Bootstrap.java:302) at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:472) Caused by: java.net.BindException: Address already in use at java.base/sun.nio.ch.Net.bind0(Native Method) at java.base/sun.nio.ch.Net.bind(Net.java:565) at java.base/sun.nio.ch.ServerSocketChannelImpl.netBind(ServerSocketChannelImpl.java:344) at java.base/sun.nio.ch.ServerSocketChannelImpl.bind(ServerSocketChannelImpl.java:301) at org.apache.tomcat.util.net.NioEndpoint.initServerSocket(NioEndpoint.java:268) at org.apache.tomcat.util.net.NioEndpoint.bind(NioEndpoint.java:223) at org.apache.tomcat.util.net.AbstractEndpoint.bindWithCleanup(AbstractEndpoint.java:1373) at org.apache.tomcat.util.net.AbstractEndpoint.init(AbstractEndpoint.java:1386) at org.apache.coyote.AbstractProtocol.init(AbstractProtocol.java:663) at org.apache.catalina.connector.Connector.initInternal(Connector.java:1025) ... 11 more SEVERE: Failed to initialize component [Connector["ajp-nio-0:0:0:0:0:0:0:1-8009"]] org.apache.catalina.LifecycleException: Protocol handler initialization failed at org.apache.catalina.connector.Connector.initInternal(Connector.java:1027) at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:122) at org.apache.catalina.core.StandardService.initInternal(StandardService.java:525) at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:122) at org.apache.catalina.core.StandardServer.initInternal(StandardServer.java:986) at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:122) at org.apache.catalina.startup.Catalina.load(Catalina.java:690) at org.apache.catalina.startup.Catalina.load(Catalina.java:713) at java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:103) at java.base/java.lang.reflect.Method.invoke(Method.java:580) at org.apache.catalina.startup.Bootstrap.load(Bootstrap.java:302) at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:472) Caused by: java.net.BindException: Address already in use at java.base/sun.nio.ch.Net.bind0(Native Method) at java.base/sun.nio.ch.Net.bind(Net.java:565) at java.base/sun.nio.ch.ServerSocketChannelImpl.netBind(ServerSocketChannelImpl.java:344) at java.base/sun.nio.ch.ServerSocketChannelImpl.bind(ServerSocketChannelImpl.java:301) at org.apache.tomcat.util.net.NioEndpoint.initServerSocket(NioEndpoint.java:268) at org.apache.tomcat.util.net.NioEndpoint.bind(NioEndpoint.java:223) at org.apache.tomcat.util.net.AbstractEndpoint.bindWithCleanup(AbstractEndpoint.java:1373) at org.apache.tomcat.util.net.AbstractEndpoint.init(AbstractEndpoint.java:1386) at org.apache.coyote.AbstractProtocol.init(AbstractProtocol.java:663) at org.apache.catalina.connector.Connector.initInternal(Connector.java:1025) ... 11 more ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='ipa4b.example.com', port=8080): Read timed out. (read timeout=1.0) ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='ipa4b.example.com', port=8080): Read timed out. (read timeout=1.0) ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='ipa4b.example.com', port=8080): Read timed out. (read timeout=1.0) ipa-pki-wait-running: Success, subsystem ca is running! Started pki-tomcatd(a)pki-tomcat.service - PKI Tomcat Server pki-tomcat.

2 1

Restrict User Information on FreeIPA-Clients
by Finn Krein-Schuch 02 Apr '25

02 Apr '25

Hello, is it possible to restrict information about users or usergroups from being passed to a FreeIPA client? Using HBAC we can configure clients to only allow login by specific user groups, but `id` and `getent passwd` will still list these users and give out information about them. Is it possible to restrict this, either server-side or by sssd configuration? My motivation for this is integrating a client database into the freeipa. These users should only authenticate to a specific service (keycloak) but otherwise be transparent on the managed clients. I am aware that FreeIPA does not support OUs but maybe this use case can be covered somehow. Thanks for the great work with FreeIPA and best regards, Finn

2 3

IPA and trust, what works? and what dosen’t?
by Jostein Fossheim 02 Apr '25

02 Apr '25

Hello all, We are playing with trust-setups in our lab-environment. I was hoping to create a setup with a "single computer active directory domain" acting as a domain controller and file-server (SMB and NFS), with a one-way trust relationship to our main ipa-realm. That is this (mini) AD-Realm trusts IPA and not the other way around. I am not sure it will work though, so far windows will not resolve my IPA users, even thought the trust-setup seems to validate (but neither are ipa, so there is something wrong with the current config). If we define a two-way trust relationship we are not able to do this: https://www.server-world.info/en/note?os=AlmaLinux_9&p=freeipa&f=8 I know that full windows-logon won’t work. But I had hopes that file services in question would. If manual user-mapping (via ksetup or something similar, that can make windows-logon with kerberos credentials work) is possible that would suffice as well. And how about samba, does anyone know, if such a setup would work there? That is: A samba AD populated with the real users and groups, and a Microsoft Server running it’s own AD trusting the samba realm, but not the other way around? (yes I know that the server could join the samba domain instead, but this is not the point in this lab-excersise). Is there any information about the work on IPA-to-IPA trust? I read with great enjoyment lasts year’s progress report on this: https://vda.li/posts/2024/05/31/ipa-ipa-trust-progress/ Best Regards, Jostein

2 20

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users April 2025