December 2017 - FreeIPA-users - Fedora mailing-lists

Re: FreeIPA connection limits?
by Sumit Bose 12 Dec '17

12 Dec '17

On Mon, Dec 11, 2017 at 06:48:36PM +0000, Aaron Hicks wrote: > No, our FreeIPA instance is stand alone, but we’ll be implementing replication soon. Then it would be good to see the access logs of the directory server during the time the directory server is unresponsive or slow. You can find them at /var/log/dirsrv/slapd-YOUR-IPA-DOMAIN/access* bye, Sumit > > Get Outlook for iOS<https://aka.ms/o0ukef> > ________________________________ > From: Sumit Bose via FreeIPA-users <freeipa-users(a)lists.fedorahosted.org> > Sent: Monday, December 11, 2017 9:06:53 PM > To: freeipa-users(a)lists.fedorahosted.org > Cc: Sumit Bose > Subject: [Freeipa-users] Re: FreeIPA connection limits? > > On Mon, Dec 11, 2017 at 10:08:50AM +1300, Aaron Hicks via FreeIPA-users wrote: > > Hello the list, > > > > > > > > We've got a number (hundreds) of hosts inside a private network, these all > > query the FreeIPA server for user and group information using NAT and a > > gateway server. > > > > > > > > However we're having issues with the LDAP queries timing out or becoming > > unresponsive. > > > > > > > > Is there a limit on the number of concurrent connections from a single host > > (e.g. the NAT gateway)? > > > > > > > > Is there a way of increasing the number of simultaneous connections to > > FreeIPA/dirsrv? > > Are you using a trust to AD? In this case you might hit > https://pagure.io/freeipa/issue/5464. > > bye, > Sumit > > > > > > > > > Regards, > > > > > > > > Aaron > > > > > _______________________________________________ > > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org > > To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org > _______________________________________________ > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org > To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org

1 0

FreeIPA connection limits?
by Aaron Hicks 11 Dec '17

11 Dec '17

Hello the list, We've got a number (hundreds) of hosts inside a private network, these all query the FreeIPA server for user and group information using NAT and a gateway server. However we're having issues with the LDAP queries timing out or becoming unresponsive. Is there a limit on the number of concurrent connections from a single host (e.g. the NAT gateway)? Is there a way of increasing the number of simultaneous connections to FreeIPA/dirsrv? Regards, Aaron

4 5

IPA 4.5 upgrade or clean install on CentOS/RHEL-7.4 has never worked for us (webUI fails) -- Latest guidance?
by Chris Dagdigian 11 Dec '17

11 Dec '17

Hi folks, Stuck in a catch-22 where I can't update our existing 4.4.0 production servers nor can we stand up new working sandbox servers running IPA-4.5 In all cases (upgrade and new install) we end up with a WebUI that is not functional when deployed on RHEL 7.4 or CentOS 7.4 However I think now I have the actual error and there were hints from the mailing list archive about the culprit maybe being httpd and keytab related. Or at least it seems tightly tied to the security changes implemented between IPA 4.4 and 4.5 releases. Here is the setup from a fresh install on RHEL 7.4 - CLI installation works perfectly - AD trust setup works perfectly - All CLI tools and commands seem to work just fine - No errors in standard locations - "ipactl status" reports no issues - SELINUX is disabled - Using Chrome browser for access and testing However the WebUI is totally unusable. The front page just displays an error box that says: HTTP Error 404 Cannot connect to the server, please check API accesibility (certificate, API, proxy, etc.) Reading the lists archives this weekend I found the links that point to the security changes between 4.4 and 4.5 and I also found the helpful advice to set "debug=true" in /etc/ipa/server.conf After setting the debug=true values now I see a new message in the httpd error logs: [Sun Dec 10 03:13:08.976509 2017] [:error] [pid 7821] ipa: INFO: *** PROCESS START *** [Mon Dec 11 11:55:07.102172 2017] [auth_gssapi:error] [pid 7824] [client 172.29.XX.XX:57976] NO AUTH DATA Client did not send any authentication headers, referer: https://usaeilidmp010.XXX.org/ipa/ui/ [Mon Dec 11 11:55:07.298810 2017] [auth_gssapi:error] [pid 7824] [client 172.29.XX.XX:57976] GSS ERROR In Negotiate Auth: gss_accept_sec_context() failed: [An unsupported mechanism was requested (Unknown error)], referer: https://usaeilidmp010.XXX.org/ipa/ui/ [root@usaeilidmp010 ec2-user]# Those error messages have come up in past forum messages but the thread replies always led me into a maze of other URls or generic instructions to "regenerate the keytab for HTTPD server" I'm pretty sure the above web error is exactly why the webUI is failing however I can't find clear or concise instructions on how to fix or debug further ... Has anyone dealt with this already? I may need an idiot's guide to resolving that particular gss error as I failed at doing so myself this weekend :) I pretty much do not understand that error nor how to address it, heh. Thanks! -Chris

3 2

FreeIPA user sync to online services?
by Dagan McGregor 11 Dec '17

11 Dec '17

Hi all, My work is taking another look at options to enable user management with a number of third party online services. Primarily to use with AWS, Github, and Datadog. I have been looking at options such as the new AWS SSO product, OneLogin, Okta, etc Is anyone using FreeIPA with one of these types of services? Is there any safe recommended method for configuring an external facing read-only replica/user account to connect to online services? We can look at installing another on-premise app to handle the integration if required, but I am hoping we can connect FreeIPA to one of these services directly. Any help would be appreciated. Cheers, Dagan McGregor

1 0

Replication & Boot Errors
by Callum Guy 11 Dec '17

11 Dec '17

Hi All, I have been carrying out some routine maintenance on our IPA installation and following a reboot I am seeing a number of errors in the 389 logs. I am struggling to understand whether any of these errors and warnings are anything I should be concerned about and how might go about retifying the situation. The server works as a replica pair and I haven't noticed any obvious problems as both instances appears to be working fine. The only symptom of a potential issue is that during reboot of either node the authentications slow down dramatically taking around a minute to login to the system even if it is the slave node being rebooted. Again I am not clear if this is expected. Any pointers would be greatly appreciated - the content of the error log (dirsrv/slapd-MYDOMAIN-NET/errors) is shown below. I've highlighted in red all the parts that concern me. Thanks, Callum *[11/Dec/2017:10:54:45.845493685 +0000] - WARN - Security Initialization - SSL alert: Sending pin request to SVRCore. You may need to run systemd-tty-ask-password-agent to provide the password.* [11/Dec/2017:10:54:45.860198563 +0000] - INFO - Security Initialization - SSL info: Enabling default cipher set. [11/Dec/2017:10:54:45.860608642 +0000] - INFO - Security Initialization - SSL info: Configured NSS Ciphers [11/Dec/2017:10:54:45.860924167 +0000] - INFO - Security Initialization - SSL info: TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384: enabled [11/Dec/2017:10:54:45.861315831 +0000] - INFO - Security Initialization - SSL info: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA: enabled [11/Dec/2017:10:54:45.861553800 +0000] - INFO - Security Initialization - SSL info: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256: enabled [11/Dec/2017:10:54:45.861794809 +0000] - INFO - Security Initialization - SSL info: TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256: enabled [11/Dec/2017:10:54:45.861975495 +0000] - INFO - Security Initialization - SSL info: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA: enabled [11/Dec/2017:10:54:45.862167830 +0000] - INFO - Security Initialization - SSL info: TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384: enabled [11/Dec/2017:10:54:45.862330320 +0000] - INFO - Security Initialization - SSL info: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA: enabled [11/Dec/2017:10:54:45.862505120 +0000] - INFO - Security Initialization - SSL info: TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256: enabled [11/Dec/2017:10:54:45.862671264 +0000] - INFO - Security Initialization - SSL info: TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256: enabled [11/Dec/2017:10:54:45.862887543 +0000] - INFO - Security Initialization - SSL info: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA: enabled [11/Dec/2017:10:54:45.863101461 +0000] - INFO - Security Initialization - SSL info: TLS_DHE_RSA_WITH_AES_256_GCM_SHA384: enabled [11/Dec/2017:10:54:45.863338463 +0000] - INFO - Security Initialization - SSL info: TLS_DHE_RSA_WITH_AES_256_CBC_SHA: enabled [11/Dec/2017:10:54:45.863544421 +0000] - INFO - Security Initialization - SSL info: TLS_DHE_DSS_WITH_AES_256_CBC_SHA: enabled [11/Dec/2017:10:54:45.863791975 +0000] - INFO - Security Initialization - SSL info: TLS_DHE_RSA_WITH_AES_256_CBC_SHA256: enabled [11/Dec/2017:10:54:45.864025763 +0000] - INFO - Security Initialization - SSL info: TLS_DHE_RSA_WITH_AES_128_GCM_SHA256: enabled [11/Dec/2017:10:54:45.864224082 +0000] - INFO - Security Initialization - SSL info: TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256: enabled [11/Dec/2017:10:54:45.864439879 +0000] - INFO - Security Initialization - SSL info: TLS_DHE_RSA_WITH_AES_128_CBC_SHA: enabled [11/Dec/2017:10:54:45.864648577 +0000] - INFO - Security Initialization - SSL info: TLS_DHE_DSS_WITH_AES_128_CBC_SHA: enabled [11/Dec/2017:10:54:45.864878026 +0000] - INFO - Security Initialization - SSL info: TLS_DHE_RSA_WITH_AES_128_CBC_SHA256: enabled [11/Dec/2017:10:54:45.865089112 +0000] - INFO - Security Initialization - SSL info: TLS_RSA_WITH_AES_256_GCM_SHA384: enabled [11/Dec/2017:10:54:45.865325308 +0000] - INFO - Security Initialization - SSL info: TLS_RSA_WITH_AES_256_CBC_SHA: enabled [11/Dec/2017:10:54:45.865519848 +0000] - INFO - Security Initialization - SSL info: TLS_RSA_WITH_AES_256_CBC_SHA256: enabled [11/Dec/2017:10:54:45.865726729 +0000] - INFO - Security Initialization - SSL info: TLS_RSA_WITH_AES_128_GCM_SHA256: enabled [11/Dec/2017:10:54:45.866530550 +0000] - INFO - Security Initialization - SSL info: TLS_RSA_WITH_AES_128_CBC_SHA: enabled [11/Dec/2017:10:54:45.866759925 +0000] - INFO - Security Initialization - SSL info: TLS_RSA_WITH_AES_128_CBC_SHA256: enabled [11/Dec/2017:10:54:45.867094660 +0000] - INFO - Security Initialization - SSL info: TLS_AES_128_GCM_SHA256: enabled [11/Dec/2017:10:54:45.867324109 +0000] - INFO - Security Initialization - SSL info: TLS_CHACHA20_POLY1305_SHA256: enabled [11/Dec/2017:10:54:45.867541305 +0000] - INFO - Security Initialization - SSL info: TLS_AES_256_GCM_SHA384: enabled [11/Dec/2017:10:54:45.882208253 +0000] - INFO - Security Initialization - slapd_ssl_init2 - Configured SSL version range: min: TLS1.2, max: TLS1.2 [11/Dec/2017:10:54:45.883120151 +0000] - INFO - main - 389-Directory/1.3.6.1 B2017.334.195 starting up [11/Dec/2017:10:54:45.906595731 +0000] - INFO - ldbm_instance_config_cachememsize_set - force a minimal value 512000 [11/Dec/2017:10:54:45.930996951 +0000] - WARN - default_mr_indexer_create - Plugin [caseIgnoreIA5Match] does not handle caseExactIA5Match [11/Dec/2017:10:54:45.936518595 +0000] - INFO - ldbm_instance_config_cachememsize_set - force a minimal value 512000 [11/Dec/2017:10:54:45.964436646 +0000] - INFO - ldbm_instance_config_cachememsize_set - force a minimal value 512000 [11/Dec/2017:10:54:45.991766644 +0000] - NOTICE - ldbm_back_start - found 65758072k physical memory [11/Dec/2017:10:54:45.992114756 +0000] - NOTICE - ldbm_back_start - found 64274224k available [11/Dec/2017:10:54:45.992292511 +0000] - NOTICE - ldbm_back_start - cache autosizing: db cache: 524288k [11/Dec/2017:10:54:45.992457300 +0000] - NOTICE - ldbm_back_start - cache autosizing: userRoot entry cache (3 total): 2031616k [11/Dec/2017:10:54:46.034980655 +0000] - NOTICE - ldbm_back_start - cache autosizing: ipaca entry cache (3 total): 2031616k [11/Dec/2017:10:54:46.061542601 +0000] - NOTICE - ldbm_back_start - cache autosizing: changelog entry cache (3 total): 2031616k [11/Dec/2017:10:54:46.089160984 +0000] - NOTICE - ldbm_back_start - total cache size: 6809452544 B; *[11/Dec/2017:10:54:46.649231467 +0000] - ERR - schema-compat-plugin - scheduled schema-compat-plugin tree scan in about 5 seconds after the server startup!* *[11/Dec/2017:10:54:46.683853691 +0000] - ERR - NSACLPlugin - acl_parse - The ACL target cn=groups,cn=compat,dc=mydomain,dc=net does not exist* *[11/Dec/2017:10:54:46.684455331 +0000] - ERR - NSACLPlugin - acl_parse - The ACL target cn=computers,cn=compat,dc=mydomain,dc=net does not exist* *[11/Dec/2017:10:54:46.684843652 +0000] - ERR - NSACLPlugin - acl_parse - The ACL target cn=ng,cn=compat,dc=mydomain,dc=net does not exist* *[11/Dec/2017:10:54:46.685517004 +0000] - ERR - NSACLPlugin - acl_parse - The ACL target ou=sudoers,dc=mydomain,dc=net does not exist* *[11/Dec/2017:10:54:46.685862356 +0000] - ERR - NSACLPlugin - acl_parse - The ACL target cn=users,cn=compat,dc=mydomain,dc=net does not exist* *[11/Dec/2017:10:54:46.686187616 +0000] - ERR - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=mydomain,dc=net does not exist* *[11/Dec/2017:10:54:46.686501554 +0000] - ERR - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=mydomain,dc=net does not exist* *[11/Dec/2017:10:54:46.686847159 +0000] - ERR - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=mydomain,dc=net does not exist* *[11/Dec/2017:10:54:46.687297649 +0000] - ERR - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=mydomain,dc=net does not exist* *[11/Dec/2017:10:54:46.687692409 +0000] - ERR - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=mydomain,dc=net does not exist* *[11/Dec/2017:10:54:46.688148374 +0000] - ERR - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=mydomain,dc=net does not exist* *[11/Dec/2017:10:54:46.688610518 +0000] - ERR - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=mydomain,dc=net does not exist* *[11/Dec/2017:10:54:46.689053107 +0000] - ERR - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=mydomain,dc=net does not exist* *[11/Dec/2017:10:54:46.689563126 +0000] - ERR - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=mydomain,dc=net does not exist* *[11/Dec/2017:10:54:46.689956461 +0000] - ERR - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=mydomain,dc=net does not exist* *[11/Dec/2017:10:54:46.690253805 +0000] - ERR - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=mydomain,dc=net does not exist* *[11/Dec/2017:10:54:46.700212505 +0000] - ERR - NSACLPlugin - acl_parse - The ACL target cn=ad,cn=etc,dc=mydomain,dc=net does not exist* *[11/Dec/2017:10:54:46.703349114 +0000] - ERR - NSACLPlugin - acl_parse - The ACL target cn=casigningcert cert-pki-ca,cn=ca_renewal,cn=ipa,cn=etc,dc=mydomain,dc=net does not exist* *[11/Dec/2017:10:54:46.703741088 +0000] - ERR - NSACLPlugin - acl_parse - The ACL target cn=casigningcert cert-pki-ca,cn=ca_renewal,cn=ipa,cn=etc,dc=mydomain,dc=net does not exist* *[11/Dec/2017:10:54:46.856737703 +0000] - ERR - NSACLPlugin - acl_parse - The ACL target cn=automember rebuild membership,cn=tasks,cn=config does not exist* *[11/Dec/2017:10:54:46.864338548 +0000] - ERR - cos-plugin - cos_dn_defs_cb - Skipping CoS Definition cn=Password Policy,cn=accounts,dc=mydomain,dc=net--no CoS Templates found, which should be added before the CoS Definition.* *[11/Dec/2017:10:54:46.940988881 +0000] - ERR - set_krb5_creds - Could not get initial credentials for principal [ldap/ipa1.mydomain.net(a)mydomain.NET] in keytab [FILE:/etc/dirsrv/ds.keytab]: -1765328228 (Cannot contact any KDC for requested realm)* *[11/Dec/2017:10:54:46.943069140 +0000] - ERR - slapi_ldap_bind - Error: could not bind id [cn=Replication Manager cloneAgreement1-ipa2.mydomain.net-pki-tomcat,ou=csusers,cn=config] authentication mechanism [SIMPLE]: error 32 (No such object)* *[11/Dec/2017:10:54:46.944217190 +0000] - ERR - NSMMReplicationPlugin - bind_and_check_pwp - agmt="cn=masterAgreement1-ipa2.mydomain.net-pki-tomcat" (ipa2:389) - Replication bind with SIMPLE auth failed: LDAP error 32 (No such object) ()* [11/Dec/2017:10:54:46.963313439 +0000] - ERR - schema-compat-plugin - schema-compat-plugin tree scan will start in about 5 seconds! [11/Dec/2017:10:54:46.975375127 +0000] - INFO - slapd_daemon - slapd started. Listening on All Interfaces port 389 for LDAP requests [11/Dec/2017:10:54:46.975614879 +0000] - INFO - slapd_daemon - Listening on All Interfaces port 636 for LDAPS requests [11/Dec/2017:10:54:46.975772722 +0000] - INFO - slapd_daemon - Listening on /var/run/slapd-mydomain-NET.socket for LDAPI requests [11/Dec/2017:10:54:49.992127949 +0000] - ERR - slapi_ldap_bind - Error: could not bind id [cn=Replication Manager cloneAgreement1-ipa2.mydomain.net-pki-tomcat,ou=csusers,cn=config] authentication mechanism [SIMPLE]: error 32 (No such object) [11/Dec/2017:10:54:52.001683823 +0000] - ERR - schema-compat-plugin - warning: no entries set up under cn=computers, cn=compat,dc=mydomain,dc=net [11/Dec/2017:10:54:52.001931063 +0000] - ERR - schema-compat-plugin - Finished plugin initialization. *[11/Dec/2017:10:54:56.518870614 +0000] - ERR - slapi_ldap_bind - Error: could not bind id [cn=Replication Manager cloneAgreement1-ipa2.mydomain.net-pki-tomcat,ou=csusers,cn=config] authentication mechanism [SIMPLE]: error 32 (No such object)* [11/Dec/2017:10:55:08.126286757 +0000] - ERR - slapi_ldap_bind - Error: could not bind id [cn=Replication Manager cloneAgreement1-ipa2.mydomain.net-pki-tomcat,ou=csusers,cn=config] authentication mechanism [SIMPLE]: error 32 (No such object) [11/Dec/2017:10:55:31.564224049 +0000] - ERR - slapi_ldap_bind - Error: could not bind id [cn=Replication Manager cloneAgreement1-ipa2.mydomain.net-pki-tomcat,ou=csusers,cn=config] authentication mechanism [SIMPLE]: error 32 (No such object) [11/Dec/2017:10:56:19.947049662 +0000] - ERR - slapi_ldap_bind - Error: could not bind id [cn=Replication Manager cloneAgreement1-ipa2.mydomain.net-pki-tomcat,ou=csusers,cn=config] authentication mechanism [SIMPLE]: error 32 (No such object) [11/Dec/2017:10:57:55.276619160 +0000] - ERR - slapi_ldap_bind - Error: could not bind id [cn=Replication Manager cloneAgreement1-ipa2.mydomain.net-pki-tomcat,ou=csusers,cn=config] authentication mechanism [SIMPLE]: error 32 (No such object) [11/Dec/2017:11:01:08.288705049 +0000] - ERR - slapi_ldap_bind - Error: could not bind id [cn=Replication Manager cloneAgreement1-ipa2.mydomain.net-pki-tomcat,ou=csusers,cn=config] authentication mechanism [SIMPLE]: error 32 (No such object) [11/Dec/2017:11:06:08.333891976 +0000] - ERR - slapi_ldap_bind - Error: could not bind id [cn=Replication Manager cloneAgreement1-ipa2.mydomain.net-pki-tomcat,ou=csusers,cn=config] authentication mechanism [SIMPLE]: error 32 (No such object) [11/Dec/2017:11:11:08.066222421 +0000] - ERR - slapi_ldap_bind - Error: could not bind id [cn=Replication Manager cloneAgreement1-ipa2.mydomain.net-pki-tomcat,ou=csusers,cn=config] authentication mechanism [SIMPLE]: error 32 (No such object) -- Callum Guy Head of Information Security X-on -- *0333 332 0000 | www.x-on.co.uk <http://www.x-on.co.uk> | ** <https://www.linkedin.com/company/x-on> <https://www.facebook.com/XonTel> <https://twitter.com/xonuk> * X-on is a trading name of Storacall Technology Ltd a limited company registered in England and Wales. Registered Office : Avaland House, 110 London Road, Apsley, Hemel Hempstead, Herts, HP3 9SD. Company Registration No. 2578478. The information in this e-mail is confidential and for use by the addressee(s) only. If you are not the intended recipient, please notify X-on immediately on +44(0)333 332 0000 and delete the message from your computer. If you are not a named addressee you must not use, disclose, disseminate, distribute, copy, print or reply to this email. Views or opinions expressed by an individual within this email may not necessarily reflect the views of X-on or its associated companies. Although X-on routinely screens for viruses, addressees should scan this email and any attachments for viruses. X-on makes no representation or warranty as to the absence of viruses in this email or any attachments.

1 0

One way trust between 2 different freeipa servers
by Anvar Kuchkartaev 11 Dec '17

11 Dec '17

3 2

IPa and automount
by Miguel Angel Coa M. 11 Dec '17

11 Dec '17

Hello, I'm configure automount/nfs in my IPA server but a have a question for change the remote mount point. For example, now the when user login automount "mount" the home under /home/XXXX , but i need change this directory, for example /home/remote/XXXX Example: [.................] su - foo df -h ipa.example.local:/autohome/foo 8.0G 6.2G 1.9G 77% /home/foo [.................] But i need [.................] su - foo df -h ipa.example.local:/autohome/foo 8.0G 6.2G 1.9G 77% /home/remote/foo [.................] My setting are: ipa automountlocation-add ipauserhome ipa automountmap-add ipauserhome auto.home ipa automountkey-add ipauserhome auto.home --key="*" --info="-fstype=nfs ipa.example.local:/autohome/&" ipa automountlocation-tofiles ipauserhome Thanks Saludos. --- Miguel Coa M.

2 3

FreeIPA: DNS , reverse zone and CIDR
by Thorsten Johannsen 10 Dec '17

10 Dec '17

Hello list :-) I'm currently working with some VM's in order to replicate a setup at work for which we want to use freeIPA. Though I'm familiar with Linux in general, I'm a complete "newbie" as far as freeIPA is concerned. Currently I have the following VM's running CentOS 7 in the network 128.0.208.0/21 <- I assume the netmask is the problem! Server IPA1: fully configured with IPA: 128.0.209.91/21 Server IPA2: cloned from IPA1 when IPA software was installed but not configured: 128.0.209.191/21 Server A-CM: not yet IPA configured, shall be an IPA client 128.0.211.10/21 Server B-CM: not yet IPA configured, shall be an IPA client 128.0.211.110/21 So I used the following article as reference: https://blog.christophersmart.com/articles/freeipa-how-to-fedora/ First thing I noticed was that there is no reverse zone automatically configured: ------------------------------------------------------------------------------ BIND DNS server will be configured to serve IPA domain with: [...] Reverse zone(s): No reverse zone ------------------------------------------------------------------------------ After following the article until the first IPA server was set up, I noticed that the reverse lookup does not work: ----------------------------------------------------------------------------- host 128.0.209.91 Host 91.209.0.128.in-addr.arpa. not found: 3(NXDOMAIN) ----------------------------------------------------------------------------- I logged into the WebUI and tried to create the DNS reverse zone with CIDR notation "128.0.208.0/21". The zone that was created was "0.128.in-addr.arpa." Which seems implausible since only 128.0.208.1 - 128.0.215.254 are managed by this DNS server. Then I stumbled about this (german) page: [ https://translate.google.de/translate?sl=de&tl=en&js=y&prev=_t&hl=de&ie=UTF… ] which stated: "By the way, the delegation of networks larger than|/24|is quite simple.If, for example, you want to delegate a|/22|network, then you simply delegate the 4/24 networks that make up the|/22|network." After removing the "0.128.in-addr.arpa." entry I tried to create the reverse zone for "128.0.208.0/24" up to "128.0.215.0/24" but freeIPA claimed that those would already exist. Basically I hope that someone could help me out with the following questions: ----------------------------------------------------------------------------- 1) What is the proper way to create a DNS zone (including reverse zone) for the 128.0.208.0/21 network? 2) How do I list the present zones in order to verify if "128.0.208.0/24" up to "128.0.215.0/24" really do exist? (They are not listed in the WebUI) 3) Within the reverse zone "0.128.in-addr.arpa." i needed to create a PTR entry "91.209" for my server to have "host 128.0.209.91" perform the reverse lookup. Is that the way it is supposed to be? 4) Any good pointer about setting / combining this (freeIPA DNS) with DHCP? (I haven't googled for this, I must admit. Just though of this while I was typing. So feel free to ignore question no. 4 if this is a "dumb" question and there a obvious results on google :-) PS: I studied https://tools.ietf.org/html/rfc2317 but cannot figure out how to apply this in my scenario. Thanks to everybody for their time reading and answering! Cheers, Thorsten

1 0

Maintenance mode
by Lachlan Musicman 07 Dec '17

07 Dec '17

Stupid question, but to stop anyone from logging in anywhere - for instance during a maintenance period - is there an easy maintenance mode in IPA? Or is the best method to disable all HBAC rules? cheers L. ------ "The antidote to apocalypticism is *apocalyptic civics*. Apocalyptic civics is the insistence that we cannot ignore the truth, nor should we panic about it. It is a shared consciousness that our institutions have failed and our ecosystem is collapsing, yet we are still here — and we are creative agents who can shape our destinies. Apocalyptic civics is the conviction that the only way out is through, and the only way through is together. " *Greg Bloom* @greggish https://twitter.com/greggish/status/873177525903609857

2 2

Reinitializing replica fails?
by Jonathan Kelley 07 Dec '17

07 Dec '17

ipa-server-4.5.0-21.el7.centos.2.2.x86_64 ipa-server-common-4.5.0-21.el7.centos.2.2.noarch I was getting this error in errors.log: Data required to update replica has been purged from the changelog. If the error persists the replica must be reinitialized. This has been known to fix the issue: [root@auth2 /]# ipa-replica-manage re-initialize --from auth1.mydomain.com --verbose ipa: ERROR: DNS query for auth1.mydomain.com. A failed: Text input is malformed. Traceback (most recent call last): File "/sbin/ipa-replica-manage", line 1615, in <module> main(options, args) File "/sbin/ipa-replica-manage", line 1530, in main if (not test_connection(realm, host, options.nolookup) or File "/sbin/ipa-replica-manage", line 142, in test_connection enforce_host_existence(host) File "/sbin/ipa-replica-manage", line 840, in enforce_host_existence verify_host_resolvable(host) File "/usr/lib/python2.7/site-packages/ipalib/util.py", line 91, in verify_host_resolvable raise errors.DNSResolverError(exception=ex) DNSResolverError: Text input is malformed. Unexpected error: Text input is malformed. I assumed I had a DNS issue, but can't seem to find one unless PTR records are broken. [root@auth2 /]# nslookup auth1.mydomain.com Server: 127.0.0.1 Address: 127.0.0.1#53 Name: auth1.mydomain.com Address: 192.168.0.33 [root@auth2 /]# dig auth1.mydomain.com @127.0.0.1 ; <<>> DiG 9.9.4-RedHat-9.9.4-51.el7 <<>> auth1.mydomain.com @127.0.0.1 ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 433 ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 2 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4096 ;; QUESTION SECTION: ;auth1.mydomain.com. IN A ;; ANSWER SECTION: auth1.mydomain.com. 1200 IN A 192.168.0.33 Do I just need to build a new replica and forget this one? -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error, please notify the system manager. Please note that any views or opinions presented in this email are solely those of the author and do not necessarily represent those of the company. Finally, the recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email.

1 0

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users December 2017