July 2017 - FreeIPA-users - Fedora mailing-lists

IPA replica with CA role problems
by Mark Haney 03 Aug '17

03 Aug '17

Prior to my employment, one of our engineers setup an IPA server to replace the horrific OpenLDAP server. One of my first tasks was to build a second IPA server and setup replication. Initially, the replication setup was smooth and simple. (I used this: https://www.howtoforge.com/installing-freeipa-with-replication for getting replica up.) However, as we were starting to consider how best to deploy it to our remote servers, and digging through the GUI I got this pop-up when looking at the Topology page: It is strongly recommended to keep the CA services installed on more than one server. As this replica needs to be a full 'replica' of the primary, I went about trying to install the CA role on the second server, which I'll call IPA1 and the master IPA0. The RH documentation says to 'Run ipa-replica-install with the --setup-ca option.' Of course, the documentation doesn't explicitly say whether that needs to be done on the initial creation of the replica, or if it can be done after the replica was created. (IOW, it just adds the CA services role and pulls from IPA0 the CA stuff it needs.) Unfortunately, that failed and I ended up uninstalling the replica with 'ipa-server-install --uninstall' after removing the replica from IPA0. After a reboot (just in case), I built a new replica GPG file on IPA0, copied it over to IPA1 and ran this: ipa-replica-install replica-info-ipa1.neonova.net.gpg --setup-ca That also failed with the exact same error as the failure from trying to install just the CA role on the existing replica. This is the error I get: [2/27]: configuring certificate server instance ipa.ipaserver.install.cainstance.CAInstance: CRITICAL Failed to configure CA instance: Command '/usr/sbin/pkispawn -s CA -f /tmp/tmpYC8gIz' returned non-zero exit status 1 ipa.ipaserver.install.cainstance.CAInstance: CRITICAL See the installation logs and the following files/directories for more information: ipa.ipaserver.install.cainstance.CAInstance: CRITICAL /var/log/pki/pki-tomcat [error] RuntimeError: CA configuration failed. Your system may be partly configured. Run /usr/sbin/ipa-server-install --uninstall to clean up. ipa.ipapython.install.cli.install_tool(Replica): ERROR CA configuration failed. ipa.ipapython.install.cli.install_tool(Replica): ERROR The ipa-replica-install command failed. See /var/log/ipareplica-install.log for more information Also, in the pki-tomcat/ca/debug log I get this: Failed to contact master using admin portjavax.ws.rs.InternalServerErrorException: HTTP 500 Internal Server Error issuer: CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs.godaddy.com/repository/,O="GoDaddy.com, Inc.",L=Scottsdale,ST=Arizona,C=US javax.ws.rs.NotFoundException: HTTP 404 Not Found We have a signed Wildcard Cert from GoDaddy on IPA0, but I can't tell why this even needs to contact the Cert CA for any reason. BTW, I had this wildcard cert setup for the IPA web interface only prior to blowing this thing to pieces over partial documentation and God knows what else isn't spelled out that I missed. Any ideas? -- Mark Haney Network Engineer at NeoNova 919-460-3330 option 1 mark.haney(a)neonova.net www.neonova.net

4 16

External Application Authentication Against FreeIPA LDAP Not Working
by bdlamprecht＠gmail.com 01 Aug '17

01 Aug '17

I've been trying to get this to work for a few days now all to no avail... I'm been running "FreeIPA, version: 4.3.1" for a few months now to authenticate a number of VMs that I grew tired of managing permissions on a individual basis and so far have been very pleased. Now, I'm attempt to use the LDAP functionality to authenticate an external application against it. I've been able to get the basic auth to work well, however, I can't seem to get the group permissions to work at all. From my FreeIPA server's "/var/log/dirsrv/slapd/access.log": Without group permissions (working): [31/Jul/2017:16:21:07 -0600] conn=6138 fd=121 slot=121 SSL connection from 9.0.49.10 to 9.0.49.11 [31/Jul/2017:16:21:07 -0600] conn=6138 TLS1.2 128-bit AES-GCM [31/Jul/2017:16:21:07 -0600] conn=6138 op=0 BIND dn="uid=bl839s,cn=users,cn=accounts,dc=coc,dc=ibm,dc=com" method=128 version=3 [31/Jul/2017:16:21:07 -0600] conn=6138 op=0 RESULT err=0 tag=97 nentries=0 etime=0 dn="uid=bl839s,cn=users,cn=accounts,dc=coc,dc=ibm,dc=com" [31/Jul/2017:16:21:07 -0600] conn=6138 op=1 BIND dn="" method=128 version=3 [31/Jul/2017:16:21:07 -0600] conn=6138 op=1 RESULT err=0 tag=97 nentries=0 etime=0 dn="" [31/Jul/2017:16:21:07 -0600] conn=6138 op=2 SRCH base="uid=bl839s,cn=users,cn=accounts,dc=coc,dc=ibm,dc=com" scope=0 filter="(objectClass=*)" attrs=ALL [31/Jul/2017:16:21:07 -0600] conn=6138 op=2 RESULT err=0 tag=101 nentries=1 etime=0 [31/Jul/2017:16:21:07 -0600] conn=6138 op=3 UNBIND [31/Jul/2017:16:21:07 -0600] conn=6138 op=3 fd=121 closed - U1 Using group permissions (NOT working): [31/Jul/2017:16:32:54 -0600] conn=6162 fd=126 slot=126 SSL connection from 9.0.49.10 to 9.0.49.11 [31/Jul/2017:16:32:54 -0600] conn=6162 TLS1.2 128-bit AES-GCM [31/Jul/2017:16:32:54 -0600] conn=6162 op=0 BIND dn="uid=bl839s,cn=users,cn=accounts,dc=coc,dc=ibm,dc=com" method=128 version=3 [31/Jul/2017:16:32:54 -0600] conn=6162 op=0 RESULT err=0 tag=97 nentries=0 etime=0 dn="uid=bl839s,cn=users,cn=accounts,dc=coc,dc=ibm,dc=com" [31/Jul/2017:16:32:54 -0600] conn=6162 op=1 BIND dn="" method=128 version=3 [31/Jul/2017:16:32:54 -0600] conn=6162 op=1 RESULT err=0 tag=97 nentries=0 etime=0 dn="" [31/Jul/2017:16:32:54 -0600] conn=6162 op=2 CMP dn="cn=netbox-users,cn=groups,cn=accounts,dc=coc,dc=ibm,dc=com" attr="member" [31/Jul/2017:16:32:54 -0600] conn=6162 op=2 RESULT err=50 tag=111 nentries=0 etime=0 [31/Jul/2017:16:32:54 -0600] conn=6162 op=3 UNBIND [31/Jul/2017:16:32:54 -0600] conn=6162 op=3 fd=126 closed - U1 In the 2nd example above the "op=2 RESULT err=50" indicates that "LDAP_INSUFFICIENT_ACCESS" is what is being returned, but when I do the following "ldapsearch" command: ldapsearch -D "uid=bl839s,cn=users,cn=accounts,dc=coc,dc=ibm,dc=com" -W uid=bl839s Enter LDAP Password: # extended LDIF # # LDAPv3 # base <dc=coc,dc=ibm,dc=com> (default) with scope subtree # filter: uid=bl839s # requesting: ALL # # bl839s, users, accounts, coc.ibm.com dn: uid=bl839s,cn=users,cn=accounts,dc=coc,dc=ibm,dc=com krbLastSuccessfulAuth: 20170731223600Z memberOf: cn=admins,cn=groups,cn=accounts,dc=coc,dc=ibm,dc=com ---SNIP--- memberOf: cn=netbox-users,cn=groups,cn=accounts,dc=coc,dc=ibm,dc=com ---SNIP--- I can see that I AM a "member" of the the dn="cn=netbox-users,cn=groups,cn=accounts,dc=coc,dc=ibm,dc=com" group. That being said, when I try to search for members of the group directly, I get a similar error: root@ipa1:~# ldapsearch -D "cn=netbox-users,cn=groups,cn=accounts,dc=coc,dc=ibm,dc=com" -W uid=bl839s Enter LDAP Password: ldap_bind: Inappropriate authentication (48) I would appreciate any help I can get in understanding what I don't have configured properly. Thanks in advance, Brady

2 2

Time Skew on Amazon nodes?
by pgb205 01 Aug '17

01 Aug '17

I have noticed that we had a broken replication agreement between replica in amazon and on another physical node. I have attempted to re-initialize but receivedUpdate failed! Status: [2 Replication error acquiring replica: excessive clock skew] I had triple verified that time on both is correct and at most within seconds of each other. in dirsrv logs I get Excessive clock skew from supplier RUVUnable to acquire replica: error: excessive clock skew After doing a bit of searching I found this beauty:https://www.redhat.com/archives/freeipa-users/2014-February/msg00007… The article mentions that the time skew might occur due to server being virtualied, and I'm wondering if this is applicable to Amazon. The steps mentioned in the article look intrusive (and intimidating) . I'm curious what other avenues are available to me to fix this?If I blow away the replica and re-set up the new one from scratch would that fix the problem.

3 6

Errors in enrolling Ubuntu 14.04 Client to FreeIPA
by Alka Murali 31 Jul '17

31 Jul '17

I Cannot enrol and do the ipa-client-install on Ubuntu 14.04 to IPA Server (4.4). My IPA Server is having third party certificates for HTTP/LDAP. I have installed it using the suggestions in https://www.freeipa.org/page/Using_3rd_part_certificates_for_HTTP/LDAP Other version of Ubuntu like 16.04 is enrolled fine. Here is the error message that I get during the installation ---- cert validation failed for "CN=*.*.*,O=*.*,((SEC_ERROR_UNTRUSTED_ISSUER) Peer's certificate issuer has been marked as not trusted by the user.) Cannot connect to the server due to generic error: cannot connect to 'https://*.*.*.*/ipa/xml': [Errno -8172] (SEC_ERROR_UNTRUSTED_ISSUER) Peer's certificate issuer has been marked as not trusted by the user. Installation failed. Rolling back changes. certmonger failed to start: [Errno 2] No such file or directory: '/var/run/ipa/services.list' certmonger failed to stop: [Errno 2] No such file or directory: '/var/run/ipa/services.list' Unenrolling client from IPA server Unenrolling host failed: Error getting default Kerberos realm: Configuration file does not specify default realm. Removing Kerberos service principals from /etc/krb5.keytab Disabling client Kerberos and LDAP configurations Redundant SSSD configuration file /etc/sssd/sssd.conf was moved to /etc/sssd/sssd.conf.deleted SSSD service could not be stopped Restoring client configuration files nscd daemon is not installed, skip configuration nslcd daemon is not installed, skip configuration Client uninstall complete. ----- Is it due to my third part cert? If so, please provide a suggestion so that I can enrol my Ubuntu Client to my IPA Server. I am attaching the logs for your reference.

2 6

External Application Authentication Against FreeIPA LDAP Not Working
by Brady Lamprecht 31 Jul '17

31 Jul '17

I've been trying to get this to work for a few days now all to no avail... I'm been running "FreeIPA, version: 4.3.1" for a few months now to authenticate a number of VMs that I grew tired of managing permissions on a individual basis and so far have been very pleased. Now, I'm attempting to use the LDAP functionality to authenticate an external application against it. I've been able to get the basic auth to work well, however, I can't seem to get the group permissions to work at all. From my FreeIPA server's "/var/log/dirsrv/slapd/access.log": Without group permissions (working): [31/Jul/2017:16:21:07 -0600] conn=6138 fd=121 slot=121 SSL connection from 9.0.49.10 to 9.0.49.11 [31/Jul/2017:16:21:07 -0600] conn=6138 TLS1.2 128-bit AES-GCM [31/Jul/2017:16:21:07 -0600] conn=6138 op=0 BIND dn="uid=bl839s,cn=users,cn=accounts,dc=coc,dc=ibm,dc=com" method=128 version=3 [31/Jul/2017:16:21:07 -0600] conn=6138 op=0 RESULT err=0 tag=97 nentries=0 etime=0 dn="uid=bl839s,cn=users,cn=accounts,dc=coc,dc=ibm,dc=com" [31/Jul/2017:16:21:07 -0600] conn=6138 op=1 BIND dn="" method=128 version=3 [31/Jul/2017:16:21:07 -0600] conn=6138 op=1 RESULT err=0 tag=97 nentries=0 etime=0 dn="" [31/Jul/2017:16:21:07 -0600] conn=6138 op=2 SRCH base="uid=bl839s,cn=users,cn=accounts,dc=coc,dc=ibm,dc=com" scope=0 filter="(objectClass=*)" attrs=ALL [31/Jul/2017:16:21:07 -0600] conn=6138 op=2 RESULT err=0 tag=101 nentries=1 etime=0 [31/Jul/2017:16:21:07 -0600] conn=6138 op=3 UNBIND [31/Jul/2017:16:21:07 -0600] conn=6138 op=3 fd=121 closed - U1 Using group permissions (NOT working): [31/Jul/2017:16:32:54 -0600] conn=6162 fd=126 slot=126 SSL connection from 9.0.49.10 to 9.0.49.11 [31/Jul/2017:16:32:54 -0600] conn=6162 TLS1.2 128-bit AES-GCM [31/Jul/2017:16:32:54 -0600] conn=6162 op=0 BIND dn="uid=bl839s,cn=users,cn=accounts,dc=coc,dc=ibm,dc=com" method=128 version=3 [31/Jul/2017:16:32:54 -0600] conn=6162 op=0 RESULT err=0 tag=97 nentries=0 etime=0 dn="uid=bl839s,cn=users,cn=accounts,dc=coc,dc=ibm,dc=com" [31/Jul/2017:16:32:54 -0600] conn=6162 op=1 BIND dn="" method=128 version=3 [31/Jul/2017:16:32:54 -0600] conn=6162 op=1 RESULT err=0 tag=97 nentries=0 etime=0 dn="" [31/Jul/2017:16:32:54 -0600] conn=6162 op=2 CMP dn="cn=netbox-users,cn=groups,cn=accounts,dc=coc,dc=ibm,dc=com" attr="member" [31/Jul/2017:16:32:54 -0600] conn=6162 op=2 RESULT err=50 tag=111 nentries=0 etime=0 [31/Jul/2017:16:32:54 -0600] conn=6162 op=3 UNBIND [31/Jul/2017:16:32:54 -0600] conn=6162 op=3 fd=126 closed - U1 In the 2nd example above, the "op=2 RESULT err=50" indicates that "LDAP_INSUFFICIENT_ACCESS" is what is being returned, but when I do the following "ldapsearch" command: ldapsearch -D "uid=bl839s,cn=users,cn=accounts,dc=coc,dc=ibm,dc=com" -W uid=bl839s Enter LDAP Password: # extended LDIF # # LDAPv3 # base <dc=coc,dc=ibm,dc=com> (default) with scope subtree # filter: uid=bl839s # requesting: ALL # # bl839s, users, accounts, coc.ibm.com dn: uid=bl839s,cn=users,cn=accounts,dc=coc,dc=ibm,dc=com krbLastSuccessfulAuth: 20170731223600Z memberOf: cn=admins,cn=groups,cn=accounts,dc=coc,dc=ibm,dc=com ---SNIP--- memberOf: cn=netbox-users,cn=groups,cn=accounts,dc=coc,dc=ibm,dc=com ---SNIP--- I can see that I AM a "member" of the the dn="cn=netbox-users,cn=groups,cn=accounts,dc=coc,dc=ibm,dc=com" group. That being said, when I try to search for members of the group directly, I get a similar access error: root@ipa1:~# ldapsearch -D "cn=netbox-users,cn=groups,cn=accounts,dc=coc,dc=ibm,dc=com" -W uid=bl839s Enter LDAP Password: ldap_bind: Inappropriate authentication (48) I would appreciate any help I can get in understanding what I don't have configured properly. Thanks in advance, Brady

1 0

IP address in certificate
by Mikaël ANDRE 31 Jul '17

31 Jul '17

Hi evrybody, With my IPA version 4.4.0 on CentOS 7 64 Bits, I need to sign my ESXi and HP ILO certificates to my FreeIPA server. I create csr with the following command: "openssl req -new -sha256 -nodes -config openssl.cfg -newkey rsa:2048 -keyout esxi.key -out esxi.csr" My OpenSSL configuration file contains the following informations: [ req ] default_bits = 2048 default_keyfile = rui.key distinguished_name = req_distinguished_name encrypt_key = no prompt = no string_mask = nombstr req_extensions = v3_req [ v3_req ] basicConstraints = CA:FALSE keyUsage = digitalSignature, keyEncipherment, dataEncipherment extendedKeyUsage = serverAuth, clientAuth subjectAltName = DNS:esxi, IP:X.X.X.X, DNS:esxi.example.com [ req_distinguished_name ] countryName = FR stateOrProvinceName = Province localityName = Town 0.organizationName = Corporate organizationalUnitName = IT Services commonName = esxi.example.com Then, I use the "cat" command to display the certificate signin request, I copy it and I paste into my FreeIPA. On my FreeIPA WebGui, I declare a host named esxi, I click on it, then on the "action" button and finally "New certificate". I select IPA for Certificate Authority, I use caIPAserviceCert profil ID, I paste the CSR and click. I get the following error message: Insufficient access : Subject alt name type IP Address is forbidden I need to keep IP Address in SAN. Is there a way to authorize IPA to sign my certificate? Many thanks. -- Cordialement/Best regards, Mikaël ANDRÉ Mobile : +33 6 28 71 19 89 Mail : mikael.andre.1989(a)gmail.com

2 1

Custom certificate
by Per Qvindesland 31 Jul '17

31 Jul '17

Hi All I installed a custom signed certificate from quovadis, the install on the ipa server wen’t fine but when I try to add a client (centos 6) it gives error: LDAP Error: Connect error: TLS error -8172:Peer's certificate issuer has been marked as not trusted by the user. The standard google searching doesn’t give any answers from what I can see. Is there any workaround for this? Regards Per

4 3

Removal of obsolete certificates from o=ipaca
by Adam Tkac 31 Jul '17

31 Jul '17

Hello all, we are currently facing issue with huge number of outdated certificate entries in o=ipaca LDAP subtree (many servers no longer exists, certificates already expired etc) and we would like to remove them to decrease number of entries in LDAP and also to speed-up initial replication of o=ipaca subtree (we have more than 700 000 DNs in o=ipaca and deploy of new replica takes quite long). Does anyone tried to do something like this? I'm quite affraid if simple ldapdelete of many DNs in o=ipaca subtree wouldn't break DogTag somehow. Do you have any ideas if something can break by removal of old (expired and also non-expired) certificates from o=ipaca ? Thanks in advance for any advice. Regards, Adam -- Adam Tkac

3 2

can not restart httpd service after certificate renewal
by Karl Forner 31 Jul '17

31 Jul '17

Hello, Today I realized that the https certificate for my freeipa web ui has expired. I tried to renew it using: #ipa-cacert-manage renew Renewing CA certificate, please wait CA certificate successfully renewed The ipa-cacert-manage command was successful So it seemed to went well. I tried to restart ipa but it failed: # ipactl start Starting Directory Service Starting krb5kdc Service Starting kadmin Service Starting named Service Starting ipa_memcached Service Starting httpd Service Job for httpd.service failed because the control process exited with error code. See "systemctl status httpd.service" and "journalctl -xe" for details. Failed to start httpd Service Shutting down What went wrong ? I'm running in a freeipa-server docker on a linux server... It is quite a big deal since I can not run my master freeipa anymore even from a backup ! Moreover, even after starting from a backup of the ipa data, the httpd service still fails. Could it be caused by the replica server ? Thanks. logs === # systemctl status httpd.service * httpd.service - The Apache HTTP Server Loaded: loaded (/usr/lib/systemd/system/httpd.service) Drop-In: /usr/lib/systemd/system/httpd.service.d `-abc.conf Active: failed (Result: exit-code) since Tue 2017-07-11 17:21:57 CEST; 3min 52s ago Process: 28719 ExecStopPost=/usr/bin/kdestroy -A (code=exited, status=0/SUCCESS) Process: 28717 ExecStart=/usr/sbin/httpd $OPTIONS -DFOREGROUND (code=exited, status=1/FAILURE) Process: 28716 ExecStartPre=/usr/libexec/ipa/ipa-httpd-kdcproxy (code=exited, status=0/SUCCESS) Main PID: 28717 (code=exited, status=1/FAILURE) Jul 11 17:21:56 ipa.quartzbio.com systemd[1]: Starting The Apache HTTP Server... Jul 11 17:21:56 ipa.quartzbio.com ipa-httpd-kdcproxy[28716]: ipa : INFO KDC proxy enabled Jul 11 17:21:57 ipa.quartzbio.com systemd[1]: httpd.service: Main process exited, code=exited, status=1/FAILURE Jul 11 17:21:57 ipa.quartzbio.com systemd[1]: Failed to start The Apache HTTP Server. Jul 11 17:21:57 ipa.quartzbio.com systemd[1]: httpd.service: Unit entered failed state. Jul 11 17:21:57 ipa.quartzbio.com systemd[1]: httpd.service: Failed with result 'exit-code'. Jul 11 17:21:57 ipa.quartzbio.com systemd[1]: Stopped The Apache HTTP Server. and (excerpt from journalctl -xe) -- The start-up result is done. Jul 11 17:29:15 ipa.quartzbio.com polkitd[28301]: Unregistered Authentication Agent for unix-process:28918:604682378 (system bus name :1.41, object path /org/freedesktop/PolicyKit1/AuthenticationAgent, locale C) (disconnected from bus) Jul 11 17:29:15 ipa.quartzbio.com polkitd[28301]: Registered Authentication Agent for unix-process:28932:604682393 (system bus na me :1.42 [/usr/bin/pkttyagent --notify-fd 5 --fallback], object path /org/freedesktop/PolicyKit1/AuthenticationAgent, locale C) Jul 11 17:29:15 ipa.quartzbio.com systemd[1]: systemd-hwdb-update.service: Cannot add dependency job, ignoring: Unit systemd-hwdb -update.service is masked. Jul 11 17:29:15 ipa.quartzbio.com systemd[1]: dev-hugepages.mount: Cannot add dependency job, ignoring: Unit dev-hugepages.mount is masked. Jul 11 17:29:15 ipa.quartzbio.com systemd[1]: ldconfig.service: Cannot add dependency job, ignoring: Unit ldconfig.service is mas ked. Jul 11 17:29:15 ipa.quartzbio.com systemd[1]: swap.target: Cannot add dependency job, ignoring: Unit swap.target is masked. Jul 11 17:29:15 ipa.quartzbio.com systemd[1]: sys-fs-fuse-connections.mount: Cannot add dependency job, ignoring: Unit sys-fs-fus e-connections.mount is masked. Jul 11 17:29:15 ipa.quartzbio.com systemd[1]: local-fs.target: Cannot add dependency job, ignoring: Unit local-fs.target is maske d. Jul 11 17:29:15 ipa.quartzbio.com systemd[1]: systemd-update-done.service: Cannot add dependency job, ignoring: Unit systemd-upda te-done.service is masked. Jul 11 17:29:15 ipa.quartzbio.com systemd[1]: slices.target: Cannot add dependency job, ignoring: Unit slices.target is masked. Jul 11 17:29:15 ipa.quartzbio.com systemd[1]: dnf-makecache.timer: Cannot add dependency job, ignoring: Unit dnf-makecache.timer is masked. Jul 11 17:29:15 ipa.quartzbio.com systemd[1]: fedora-autorelabel-mark.service: Cannot add dependency job, ignoring: Unit fedora-a utorelabel-mark.service is masked. Jul 11 17:29:15 ipa.quartzbio.com systemd[1]: rpcbind.socket: Cannot add dependency job, ignoring: Unit rpcbind.socket is masked. Jul 11 17:29:15 ipa.quartzbio.com systemd[1]: Starting The Apache HTTP Server... -- Subject: Unit httpd.service has begun start-up -- Defined-By: systemd -- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel -- -- Unit httpd.service has begun starting up. Jul 11 17:29:15 ipa.quartzbio.com named-pkcs11[28910]: checkhints: unable to get root NS rrset from cache: not found Jul 11 17:29:15 ipa.quartzbio.com named-pkcs11[28910]: zone 70.9.10.in-addr.arpa/IN: sending notifies (serial 1499786955) Jul 11 17:29:15 ipa.quartzbio.com named-pkcs11[28910]: zone 70.9.10.in-addr.arpa/IN: loaded serial 1499786955 Jul 11 17:29:15 ipa.quartzbio.com named-pkcs11[28910]: zone 0.17.172.in-addr.arpa/IN: sending notifies (serial 1499786955) Jul 11 17:29:15 ipa.quartzbio.com named-pkcs11[28910]: zone 0.17.172.in-addr.arpa/IN: loaded serial 1499786955 Jul 11 17:29:15 ipa.quartzbio.com named-pkcs11[28910]: zone quartzbio.com/IN: sending notifies (serial 1499786955) Jul 11 17:29:15 ipa.quartzbio.com named-pkcs11[28910]: zone quartzbio.com/IN: loaded serial 1499786955 Jul 11 17:29:15 ipa.quartzbio.com named-pkcs11[28910]: 3 master zones from LDAP instance 'ipa' loaded (3 zones defined, 0 inactive, 0 f ailed to load) Jul 11 17:29:15 ipa.quartzbio.com named-pkcs11[28910]: checkhints: unable to get root NS rrset from cache: not found Jul 11 17:29:16 ipa.quartzbio.com ns-slapd[28813]: GSSAPI client step 1 Jul 11 17:29:16 ipa.quartzbio.com ns-slapd[28813]: GSSAPI client step 1 Jul 11 17:29:16 ipa.quartzbio.com ipa-httpd-kdcproxy[28938]: ipa : INFO KDC proxy enabled Jul 11 17:29:16 ipa.quartzbio.com systemd[1]: httpd.service: Main process exited, code=exited, status=1/FAILURE Jul 11 17:29:16 ipa.quartzbio.com systemd[1]: Failed to start The Apache HTTP Server. -- Subject: Unit httpd.service has failed -- Defined-By: systemd -- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel -- -- Unit httpd.service has failed. -- -- The result is failed. Jul 11 17:29:16 ipa.quartzbio.com systemd[1]: httpd.service: Unit entered failed state. Jul 11 17:29:16 ipa.quartzbio.com systemd[1]: httpd.service: Failed with result 'exit-code'. Jul 11 17:29:16 ipa.quartzbio.com polkitd[28301]: Unregistered Authentication Agent for unix-process:28932:604682393 (system bus name :1.42, object path /org/freedesktop/PolicyKit1/AuthenticationAgent, locale C) (disconnected from bus) Jul 11 17:29:16 ipa.quartzbio.com polkitd[28301]: Registered Authentication Agent for unix-process:28944:604682474 (system bus na me :1.43 [/usr/bin/pkttyagent --notify-fd 5 --fallback], object path /org/freedesktop/PolicyKit1/AuthenticationAgent, locale C) Jul 11 17:29:16 ipa.quartzbio.com systemd[1]: Stopping Kerberos 5 KDC... -- Subject: Unit krb5kdc.service has begun shutting down -- Defined-By: systemd -- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel

2 2

Password History
by John Trump 31 Jul '17

31 Jul '17

I am using FreeIPA 4.4 and have implemented a password policy where password history is set to 24. If a password admin or the user "admin" resets a users password, the user is forced to change their password upon logging in. At this point, the user is able to reuse the previous password even though it should be in their password history. How do I make it so a password reset by an admin does not wipe out the users' password history? Thanks.

3 2

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users July 2017