May 2017 - FreeIPA-users - Fedora mailing-lists

Certificate renewals with external CA
by Rob Foehl 29 Aug '17

29 Aug '17

I've got a test instance of FreeIPA 4.4.4 running on F25 that was installed with --external-ca, and the resulting CSR signed with a validity period of 30 days to test behavior around expirations. Upon booting that instance today, certmonger decided to preemptively renew every IPA cert -- which is a good thing -- but did so without waiting for renewal of the IPA CA cert first, which is less good. Now that instance has a pile of certs that expire in two weeks, since they were signed with and thus tied to the expiration of the old IPA CA cert. While I'm guessing certmonger will figure this out and do the right thing within a couple weeks -- and with the expectation that this would only happen once per IPA CA renewal with a "real" deployment -- is this the intended behavior? Logs are a bit of a mess between this and a potentially-resolved SELinux issue with certmonger, but I'll wedge them all into a proper bug report if desired. -Rob

3 12

cannot connect ...Encountered end of file.
by Vinny Del Signore 22 Jun '17

22 Jun '17

Hello all, Has anyone seen this issue? We've tried to generate a new CA and SSL Cert. IPA v.3.0.0-50 # rpm -qa | grep ipa-server ipa-server-selinux-3.0.0-50.el6.1.x86_64 ipa-server-3.0.0-50.el6.1.x86_64 root ldap-srv /var/log/dirsrv/slapd-DOMAIN-COM # ipa-replica-prepare --ip-address=10.10.xx.xx rtlvxl0055.test.local Directory Manager (existing master) password: Preparing replica for rtlvxl0055.test.local from ldap-srv.domain.com Creating SSL certificate for the Directory Server preparation of replica failed: cannot connect to 'https://ldap-srv.domain..com:9444/ca/ee/ca/profileSubmitSSLClient': (PR_END_OF_FILE_ERROR) Encountered end of file. cannot connect to 'https://ldap-srv.domain..com:xxxx/ca/ee/ca/profileSubmitSSLClient': (PR_END_OF_FILE_ERROR) Encountered end of file. File "/usr/sbin/ipa-replica-prepare", line 490, in <module> main() File "/usr/sbin/ipa-replica-prepare", line 361, in main export_certdb(api.env.realm, ds_dir, dir, passwd_fname, "dscert", replica_fqdn, subject_base) File "/usr/sbin/ipa-replica-prepare", line 150, in export_certdb raise e root ldap-srv /var/log/dirsrv/slapd-DOMAIN-COM # root ldap-srv /var/log/dirsrv/slapd-DOMAIN-COM # rpm -qa | grep ipa-server ipa-server-selinux-3.0.0-50.el6.1.x86_64 ipa-server-3.0.0-50.el6.1.x86_64 root ldap-srv /var/log/dirsrv/slapd-DOMAIN-COM # uname -r 2.6.32-642.3.1.el6.x86_64 root ldap-srv /var/log/dirsrv/slapd-DOMAIN-COM # cat /etc/redhat-release Red Hat Enterprise Linux Server release 6.6 (Santiago) root ldap-srv /var/log/dirsrv/slapd-DOMAIN-COM # Kind regards, Vin

4 4

very slow remove users process
by Adrian HY 09 Jun '17

09 Jun '17

Hi folks, I have a freeipa group with 30000 users to delete. The process is very very slow. For example: # time ipa -v user-del vvv ------------------------- Deleted user "vvv" ------------------------- real 0m16.913s user 0m0.814s sys 0m0.084s The hardware parameters are normal. The hard drive is SSD. Regards.

3 4

ipa server-del results in "internal error"
by dbischof＠hrz.uni-kassel.de 03 Jun '17

03 Jun '17

Dear list, I'm in the process of upgrading my IPA installation (1 master, 1 replica, external DNS) from IPA version 3.0 to 4.4. I followed the instructions at [1]. Everything worked flawlessly (kudos to all developers and supporters!): My new 4.4 master is up and running. To my understanding, the last step would be to remove the still existing replication agreements of the old 3.0 master and replica before creating the new 4.4 replica (the new 4.4 master is new hardware with a new hostname, but i want to keep the old hardware and hostname for the 4.4 replica). My attempt to remove the old servers result in --- root@o201:~# ipa server-del poolsrv.example.org Removing poolsrv.example.org from replication topology, please wait... ipa: ERROR: an internal error has occurred --- The error occurs even if i try to remove a non-existing server with --force. Attempts to remove the server via the web interface fail as well. IPA/OS versions: --- root@o201:~# cat /etc/redhat-release CentOS Linux release 7.3.1611 (Core) root@o201:~# rpm -qa | grep -i ipa libipa_hbac-1.14.0-43.el7_3.14.x86_64 python-libipa_hbac-1.14.0-43.el7_3.14.x86_64 ipa-server-common-4.4.0-14.el7.centos.7.noarch python2-ipalib-4.4.0-14.el7.centos.7.noarch ipa-client-4.4.0-14.el7.centos.7.x86_64 ipa-common-4.4.0-14.el7.centos.7.noarch ipa-client-common-4.4.0-14.el7.centos.7.noarch python-ipaddress-1.0.16-2.el7.noarch python2-ipaserver-4.4.0-14.el7.centos.7.noarch sssd-ipa-1.14.0-43.el7_3.14.x86_64 ipa-admintools-4.4.0-14.el7.centos.7.noarch python2-ipaclient-4.4.0-14.el7.centos.7.noarch python-iniparse-0.4-9.el7.noarch ipa-server-4.4.0-14.el7.centos.7.x86_64 --- Something I could try? [1] https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/ht… Best regards, --Daniel.

2 3

ipa-client-install combined with 'authconfig --enablenis --update'
by paul＠kenla.nl 01 Jun '17

01 Jun '17

Hi, I have boot problem when i combine a ipa-client-install with 'authconfig --enablenis --update' According to the ovirt/RHEV docs [1] I have to do this to make SSO to the VM possible. Messages during boot are: Failed to start RealtimeKit for Policy Services Failed to start Authorization Manager Dependency failed for Dynamic System tuning deamon My setup is: All systems Centos 7.3(1611) oVirt 4.1 IPA server 4.4 IPA client 4.4 If i use an old VM with Centos 7.2(1511) and ipa-client 4.2 there are no problems and SSO is working so oVirt and IPA seem to be configured correct. My findings so far: - Centos 7.3 does not include ypbind. If i install manually it sometimes boots (but takes a long time) but the other times stops at same point as mentioned before. This could imply some kind of race condition during boot. - I tried different versions of ipa-client (ipa-client-4.4.0-12.el7.centos.x86_64 up to ipa-client-4.4.0-14.el7.centos.7.x86_64) none worked. Older versions i could not find anymore. Can anyone comfirm my findings or point me in some direction? Kind regards, Paul [1]https://access.redhat.com/documentation/en-us/red_hat_virtualization/4.1/…

2 5

SSH Key replication time/issues
by Jake 01 Jun '17

01 Jun '17

Hey again, I'm trying to track down how to ensure ssh keys are added AND removed quickly. Right now it seems I must restart ipa services or sss_cache -E to force them to update, and there doesn't seem to be a determinate amount of time to allow replication. Note, SSH keys are stored in the "Default View" for external users (external one-way trust with AD). Thanks, -Jake

3 5

Get rid of manually calling kinit with SSSD
by Ronald Wimmer 01 Jun '17

01 Jun '17

Hi, I read Jakub Hrozeks post https://jhrozek.wordpress.com/2015/07/17/get-rid-of-calling-manually-callin… and found that it is exactly what I need. The only problem is that I am using Ubuntu and not Fedora or CentOS. In sssd_pamlog i only see a SSS_PAM_OPEN_SESSION but no SSS_PAM_AUTHENTICATE - so most likely the pam config is still wrong. Is anybody here who got this working under Ubuntu? This is how my /etc/pam.d/common-auth looks: auth [success=2 default=ignore] pam_unix.so nullok_secure try_first_pass auth [success=1 default=ignore] pam_sss.so use_first_pass auth requisite pam_deny.so auth required pam_permit.so auth optional pam_ecryptfs.so unwrap auth optional pam_cap.so And this is my nsswitch.conf passwd: compat group: compat shadow: compat hosts: files wins mdns4_minimal [NOTFOUND=return] resolve [!UNAVAIL=return] dns myhostname networks: files protocols: db files services: db files ethers: db files rpc: db files netgroup: nis sudoers: files sss Any ideas on this matter would be highly appreciated! Regards, Ronald

3 5

Custom attributes - Php Api
by Ivan Joaquim (Pichot) 31 May '17

31 May '17

Hi, I'm integrating an app in PHP with the freeIPA API using this library.https://github.com/gnumoksha/php-freeipa I'm using extras schemas with custom attributes and can't access those attributes via API. Can someone show me how can I manage these attributes such read and modify them? Thanks in advance for your time! Cheers, Ivan Joaquim.

1 0

DatabaseError: Server is unwilling to perform: Too many failed logins.
by Jose Alvarez R. 31 May '17

31 May '17

Hi A question, I have the following errors on my server FreeIPA 4.3.3 cat /var/log/httpd/error_log Wed May 31 11:27:59.079315 2017] [wsgi:error] [pid 2024] [remote 192.168.0.114:200] mod_wsgi (pid=2024): Exception occurred processing WSGI script '/usr/share/ipa/wsgi [Wed May 31 11:27:59.079432 2017] [wsgi:error] [pid 2024] [remote 192.168.0.114:200] Traceback (most recent call last): [Wed May 31 11:27:59.079486 2017] [wsgi:error] [pid 2024] [remote 192.168.0.114:200] File "/usr/share/ipa/wsgi.py", line 63, in application [Wed May 31 11:27:59.079675 2017] [wsgi:error] [pid 2024] [remote 192.168.0.114:200] return api.Backend.wsgi_dispatch(environ, start_response) [Wed May 31 11:27:59.079703 2017] [wsgi:error] [pid 2024] [remote 192.168.0.114:200] File "/usr/lib/python2.7/site-packages/ipaserver/rpcserver.py", line 261, in __ca [Wed May 31 11:27:59.080261 2017] [wsgi:error] [pid 2024] [remote 192.168.0.114:200] return self.route(environ, start_response) [Wed May 31 11:27:59.080298 2017] [wsgi:error] [pid 2024] [remote 192.168.0.114:200] File "/usr/lib/python2.7/site-packages/ipaserver/rpcserver.py", line 273, in rout [Wed May 31 11:27:59.080343 2017] [wsgi:error] [pid 2024] [remote 192.168.0.114:200] return app(environ, start_response) [Wed May 31 11:27:59.080401 2017] [wsgi:error] [pid 2024] [remote 192.168.0.114:200] File "/usr/lib/python2.7/site-packages/ipaserver/rpcserver.py", line 811, in __ca [Wed May 31 11:27:59.080437 2017] [wsgi:error] [pid 2024] [remote 192.168.0.114:200] self.create_context(ccache=ipa_ccache_name) [Wed May 31 11:27:59.080455 2017] [wsgi:error] [pid 2024] [remote 192.168.0.114:200] File "/usr/lib/python2.7/site-packages/ipalib/backend.py", line 123, in create_co [Wed May 31 11:27:59.080578 2017] [wsgi:error] [pid 2024] [remote 192.168.0.114:200] self.Backend.ldap2.connect(ccache=ccache) [Wed May 31 11:27:59.080611 2017] [wsgi:error] [pid 2024] [remote 192.168.0.114:200] File "/usr/lib/python2.7/site-packages/ipalib/backend.py", line 66, in connect [Wed May 31 11:27:59.080654 2017] [wsgi:error] [pid 2024] [remote 192.168.0.114:200] conn = self.create_connection(*args, **kw) [Wed May 31 11:27:59.080691 2017] [wsgi:error] [pid 2024] [remote 192.168.0.114:200] File "/usr/lib/python2.7/site-packages/ipaserver/plugins/ldap2.py", line 202, in [Wed May 31 11:27:59.080973 2017] [wsgi:error] [pid 2024] [remote 192.168.0.114:200] client_controls=clientctrls) [Wed May 31 11:27:59.081019 2017] [wsgi:error] [pid 2024] [remote 192.168.0.114:200] File "/usr/lib/python2.7/site-packages/ipapython/ipaldap.py", line 1085, in gssap [Wed May 31 11:27:59.081653 2017] [wsgi:error] [pid 2024] [remote 192.168.0.114:200] '', auth_tokens, server_controls, client_controls) [Wed May 31 11:27:59.081678 2017] [wsgi:error] [pid 2024] [remote 192.168.0.114:200] File "/usr/lib64/python2.7/contextlib.py", line 35, in __exit__ [Wed May 31 11:27:59.081835 2017] [wsgi:error] [pid 2024] [remote 192.168.0.114:200] self.gen.throw(type, value, traceback) [Wed May 31 11:27:59.081897 2017] [wsgi:error] [pid 2024] [remote 192.168.0.114:200] File "/usr/lib/python2.7/site-packages/ipapython/ipaldap.py", line 998, in error_ [Wed May 31 11:27:59.081955 2017] [wsgi:error] [pid 2024] [remote 192.168.0.114:200] raise errors.DatabaseError(desc=desc, info=info) [Wed May 31 11:27:59.082028 2017] [wsgi:error] [pid 2024] [remote 192.168.0.114:200] DatabaseError: Server is unwilling to perform: Too many failed logins. I checked this link: https://pagure.io/freeipa/issue/5653 But I'm not sure, How can I solve that? Thanks, Regards Jose Alvarez

1 0

ipa command breaks by setting "NSSVerifyClient require"
by Ivars Strazdiņš 31 May '17

31 May '17

Hi there, our IPA servers' https port is exposed to internet. I wanted to restrict access to Web UI by requesting a user certificate issued by IPA and enabling Apache setting "NSSVerifyClient require" (or "optional") in /etc/httpd/conf.d/nss.conf This, however, broke "ipa" command, which now started to fail like: [user@im conf.d]$ ipa user-show user ipa: ERROR: cannot connect to 'https://a.b.c.d/ipa/json': (SSL_ERROR_BAD_CERT_ALERT) SSL peer cannot verify your certificate. Questions: Is it possible for "ipa" command to present sertificate to Apache server? Anything else is going to break by such approach? Thanks, Ivars

4 8

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users May 2017