July 2017 - FreeIPA-users - Fedora mailing-lists

Replication and SSL certs
by Mark Haney 17 Jul '17

17 Jul '17

I'm really new to FreeIPA, and this is probably a stupid question, but I just setup a replica of the primary (not in production) IPA server we have. However, the replica's SSL cert is untrusted, while the primary IPA server's cert is fine. The docs I read said the SSL certs would be carried over when building the replica GPG file and installing the replica data. Have I missed something in the replication setup process? -- Mark Haney Network Engineer at NeoNova 919-460-3330 option 1 mark.haney(a)neonova.net www.neonova.net

2 9

Re: Chrome 58 Doesn't Trust SSL Certificates Signed by FreeIPA
by Prasun Gera 17 Jul '17

17 Jul '17

Bumping this for help. I need to renew my replica's SSL certificate which will expire in a month, but I can't find any instructions. It looks like the replica's web-ui cert isn't tracked by the master or the replica. I'm using a pretty stock installation with no external CAs or certs. So ideally, all of this should have been handled automatically by ipa, but it isn't. There have also been quite a few cert related posts of late which makes me think if there are (were) some other issues with replica setup a couple of years ago, which is when the certs were originally generated. On Mon, May 1, 2017 at 5:39 AM, Prasun Gera <prasun.gera(a)gmail.com> wrote: > Any ideas why the replica's certs are not being tracked ? That looks like > an issue in itself. If they are not being tracked, the replica will fail > once they expire. Is there any way to fix the replica ? > > On Sun, Apr 23, 2017 at 10:08 PM, Prasun Gera <prasun.gera(a)gmail.com> > wrote: > >> I tried that, but the replica's "getcert list" doesn't seem to show any >> results. "Number of certificates and requests being tracked: 0." Is that >> expected ? >> >> On Sun, Apr 23, 2017 at 8:50 PM, Fraser Tweedale <ftweedal(a)redhat.com> >> wrote: >> >>> On Sun, Apr 23, 2017 at 03:32:19AM -0400, Prasun Gera wrote: >>> > Thank you. That worked for the master. How do I fix the replica's cert >>> ? >>> > This is on ipa-server-4.4.0-14.el7_3.7.x86_64 on RHEL7. I am not using >>> > ipa's DNS at all. Did this happen because of that ? >>> > >>> This is not related to DNS. >>> >>> To fix the replica, log onto the host and perform the same steps >>> with Certmonger there. The tracking Request ID will be different >>> but otherwise the process is the same. >>> >>> Cheers, >>> Fraser >>> >>> > On Thu, Apr 20, 2017 at 9:06 PM, Fraser Tweedale <ftweedal(a)redhat.com> >>> > wrote: >>> > >>> > > On Thu, Apr 20, 2017 at 07:31:16PM -0400, Prasun Gera wrote: >>> > > > I can confirm that I see this behaviour too. My ipa server install >>> is a >>> > > > pretty stock install with no 3rd party certificates. >>> > > > >>> > > > On Thu, Apr 20, 2017 at 5:46 PM, Simon Williams < >>> > > > simon.williams(a)thehelpfulcat.com> wrote: >>> > > > >>> > > > > Yesterday, Chrome on both my Ubuntu and Windows machines updated >>> to >>> > > > > version 58.0.3029.81. It appears that this version of Chrome >>> will not >>> > > > > trust certificates based on Common Name. Looking at the Chrome >>> > > > > documentation and borne out by one of the messages, from Chrome >>> 58, >>> > > > > the subjectAltName is required to identify the DNS name of the >>> host >>> > > that >>> > > > > the certificate is issued for. I would be grateful if someone >>> could >>> > > point >>> > > > > me in the direction of how to recreate my SSL certificates so >>> that >>> > > > > the subjectAltName is populated. >>> > > > > >>> > > > > Thanks in advance >>> > > > > >>> > > > > -- >>> > > > > Manage your subscription for the Freeipa-users mailing list: >>> > > > > https://www.redhat.com/mailman/listinfo/freeipa-users >>> > > > > Go to http://freeipa.org for more info on the project >>> > > > > >>> > > Which version of IPA are you using? >>> > > >>> > > The first thing you should do, which I think should be sufficient in >>> > > most cases, is to tell certmonger to submit a new cert request for >>> > > each affected certificate, instructing to include the relevant >>> > > DNSName in the subjectAltName extension in the CSR. >>> > > >>> > > To list certmonger tracking requests and look for the HTTPS >>> > > certificate. For example: >>> > > >>> > > $ getcert list >>> > > Number of certificate and requests being tracked: 11 >>> > > ... >>> > > Request ID '20170418012901': >>> > > status: MONITORING >>> > > stuck: no >>> > > key pair storage: type=NSSDB,location='/etc/ >>> > > httpd/alias',nickname='Server-Cert',token='NSS Certificate >>> > > DB',pinfile='/etc/httpd/alias/pwdfile.txt' >>> > > certificate: type=NSSDB,location='/etc/ >>> > > httpd/alias',nickname='Server-Cert',token='NSS Certificate DB' >>> > > CA: IPA >>> > > issuer: CN=Certificate Authority,O=IPA.LOCAL 201703211317 >>> > > subject: CN=f25-2.ipa.local,O=IPA.LOCAL 201703211317 >>> > > expires: 2019-03-22 03:20:19 UTC >>> > > dns: f25-2.ipa.local >>> > > key usage: digitalSignature,nonRepudiatio >>> n,keyEncipherment, >>> > > dataEncipherment >>> > > eku: id-kp-serverAuth,id-kp-clientAuth >>> > > pre-save command: >>> > > post-save command: /usr/libexec/ipa/certmonger/re >>> start_httpd >>> > > track: yes >>> > > auto-renew: yes >>> > > ... >>> > > >>> > > Using the Request ID of the HTTPS certificate, resubmit the request >>> > > but use the ``-D <hostname>`` option to specify a DNSName to include >>> > > in the SAN extension: >>> > > >>> > > $ getcert resubmit -i <Request ID> -D <hostname> >>> > > >>> > > ``-D <hostname>`` can be specified multiple times, if necessary. >>> > > >>> > > This should request a new certificate that will have the server DNS >>> > > name in the SAN extension. >>> > > >>> > > HTH, >>> > > Fraser >>> > > >>> >> >> >

1 0

autofs.service on NFS clients and servers
by Petros Triantafyllidis 14 Jul '17

14 Jul '17

Hi all, I am very new to IPA and still a bit before going into production, so apologies in advance. The plan is to have a number of servers that each one shares a space via kerberized nfs4 to the others, which makes all of them NFS clients and servers at the same time. On my attempt to setup automount globally via IdM and sssd, I realized that when a machine is configured as nfs server, it needs autofs.service to be stopped in order to access it's local shares mounted via fstab. If I use /etc/auto.master to mount the local shares instead of fstab, then autofs.service may (actually must) run and everything works properly but, doing so, I don't have the advantage of one central configuration location any more. The preferred scenario for each server would be to mount its local shares via fstab and the remote shares via sssd automount. Am I missing something? Thanks in advance, Petros

3 4

dirsrv will not start, tried cp dse.ldif.startOK to dse.ldif but issue remains.
by email＠ml.jacobdevans.com 14 Jul '17

14 Jul '17

IPA Users, I'm not sure when the last time this service was running/working, any ideas are appreciated. IPA Version: ipa-server-4.4.0-14.el7.centos.7.x86_64 ipa-server-upgrade Upgrading IPA: [1/8]: saving configuration [2/8]: disabling listeners [3/8]: enabling DS global lock [4/8]: starting directory server [error] CalledProcessError: Command '/bin/systemctl start dirsrv(a)IPA-EXAMPLE-COM.service' returned non-zero exit status 1 [cleanup]: stopping directory server [cleanup]: restoring configuration IPA server upgrade failed: Inspect /var/log/ipaupgrade.log and run command ipa-server-upgrade manually. Unexpected error - see /var/log/ipaupgrade.log for details: CalledProcessError: Command '/bin/systemctl start dirsrv(a)IPA-EXAMPLE-COM.service' returned non-zero exit status 1 The ipa-server-upgrade command failed. See /var/log/ipaupgrade.log for more information #tail -n 100 /var/log/ipaupgrade.log 2017-07-14T16:03:53Z DEBUG stderr=Job for dirsrv(a)IPA-EXAMPLE-COM.service failed because a fatal signal was delivered to the control process. See "systemctl status dirsrv(a)IPA-EXAMPLE-COM.service" and "journalctl -xe" for details. 2017-07-14T16:03:53Z DEBUG Traceback (most recent call last): File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 449, in start_creation run_step(full_msg, method) File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 439, in run_step method() File "/usr/lib/python2.7/site-packages/ipaserver/install/upgradeinstance.py", line 94, in __start services.service(self.service_name).start(self.serverid, ldapi=True) File "/usr/lib/python2.7/site-packages/ipaplatform/redhat/services.py", line 157, in start instance_name, capture_output=capture_output, wait=wait) File "/usr/lib/python2.7/site-packages/ipaplatform/base/services.py", line 285, in start skip_output=not capture_output) File "/usr/lib/python2.7/site-packages/ipapython/ipautil.py", line 494, in run raise CalledProcessError(p.returncode, arg_string, str(output)) CalledProcessError: Command '/bin/systemctl start dirsrv(a)IPA-EXAMPLE-COM.service' returned non-zero exit status 1 2017-07-14T16:03:53Z DEBUG [error] CalledProcessError: Command '/bin/systemctl start dirsrv(a)IPA-EXAMPLE-COM.service' returned non-zero exit status 1 2017-07-14T16:03:53Z DEBUG [cleanup]: stopping directory server 2017-07-14T16:03:53Z DEBUG Starting external process 2017-07-14T16:03:53Z DEBUG args=/bin/systemctl stop dirsrv(a)IPA-EXAMPLE-COM.service 2017-07-14T16:03:53Z DEBUG Process finished, return code=0 2017-07-14T16:03:53Z DEBUG stdout= 2017-07-14T16:03:53Z DEBUG stderr= 2017-07-14T16:03:53Z DEBUG duration: 0 seconds 2017-07-14T16:03:53Z DEBUG [cleanup]: restoring configuration 2017-07-14T16:03:53Z DEBUG Loading StateFile from '/var/lib/ipa/sysrestore/sysrestore.state' 2017-07-14T16:03:53Z DEBUG Loading StateFile from '/var/lib/ipa/sysrestore/sysrestore.state' 2017-07-14T16:03:53Z DEBUG Saving StateFile to '/var/lib/ipa/sysrestore/sysrestore.state' 2017-07-14T16:03:53Z DEBUG Loading StateFile from '/var/lib/ipa/sysrestore/sysrestore.state' 2017-07-14T16:03:53Z DEBUG Loading StateFile from '/var/lib/ipa/sysrestore/sysrestore.state' 2017-07-14T16:03:53Z DEBUG Saving StateFile to '/var/lib/ipa/sysrestore/sysrestore.state' 2017-07-14T16:03:53Z DEBUG Loading StateFile from '/var/lib/ipa/sysrestore/sysrestore.state' 2017-07-14T16:03:53Z DEBUG duration: 0 seconds 2017-07-14T16:03:53Z ERROR IPA server upgrade failed: Inspect /var/log/ipaupgrade.log and run command ipa-server-upgrade manually. 2017-07-14T16:03:53Z DEBUG File "/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 171, in execute return_value = self.run() File "/usr/lib/python2.7/site-packages/ipaserver/install/ipa_server_upgrade.py", line 46, in run server.upgrade() File "/usr/lib/python2.7/site-packages/ipaserver/install/server/upgrade.py", line 1846, in upgrade data_upgrade.create_instance() File "/usr/lib/python2.7/site-packages/ipaserver/install/upgradeinstance.py", line 119, in create_instance show_service_name=False) File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 449, in start_creation run_step(full_msg, method) File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 439, in run_step method() File "/usr/lib/python2.7/site-packages/ipaserver/install/upgradeinstance.py", line 94, in __start services.service(self.service_name).start(self.serverid, ldapi=True) File "/usr/lib/python2.7/site-packages/ipaplatform/redhat/services.py", line 157, in start instance_name, capture_output=capture_output, wait=wait) File "/usr/lib/python2.7/site-packages/ipaplatform/base/services.py", line 285, in start skip_output=not capture_output) File "/usr/lib/python2.7/site-packages/ipapython/ipautil.py", line 494, in run raise CalledProcessError(p.returncode, arg_string, str(output)) 2017-07-14T16:03:53Z DEBUG The ipa-server-upgrade command failed, exception: CalledProcessError: Command '/bin/systemctl start dirsrv(a)IPA-EXAMPLE-COM.service' returned non-zero exit status 1 2017-07-14T16:03:53Z ERROR Unexpected error - see /var/log/ipaupgrade.log for details: CalledProcessError: Command '/bin/systemctl start dirsrv(a)IPA-EXAMPLE-COM.service' returned non-zero exit status 1 2017-07-14T16:03:53Z ERROR The ipa-server-upgrade command failed. See /var/log/ipaupgrade.log for more information Thank You, -Jake

2 1

IPA Servers will not start - dirsrv
by email＠ml.jacobdevans.com 14 Jul '17

14 Jul '17

IPA-Users, We relocated a rack recently across the states and are no longer able to start dirsrv389. sudo ipactl start Starting Directory Service Failed to start Directory Service: Command '/bin/systemctl start dirsrv(a)IPA-EXAMPLE-COM.service' returned non-zero exit status 1 Thousands of log entries: ns-slapd[15125]: [14/Jul/2017:09:09:11.167235367 -0400] valueset_value_syntax_cmp: slapi_attr_values2keys_sv failed for type attributetypes ns-slapd[15125]: [14/Jul/2017:09:09:11.167240900 -0400] valueset_value_syntax_cmp: slapi_attr_values2keys_sv failed for type attributetypes ns-slapd[15125]: [14/Jul/2017:09:09:11.167245957 -0400] valueset_value_syntax_cmp: slapi_attr_values2keys_sv failed for type attributetypes ns-slapd[15125]: [14/Jul/2017:09:09:11.167250923 -0400] valueset_value_syntax_cmp: slapi_attr_values2keys_sv failed for type attributetypes ns-slapd[15125]: [14/Jul/2017:09:09:11.167256433 -0400] valueset_value_syntax_cmp: slapi_attr_values2keys_sv failed for type attributetypes ns-slapd[15125]: [14/Jul/2017:09:09:11.167261853 -0400] valueset_value_syntax_cmp: slapi_attr_values2keys_sv failed for type attributetypes ns-slapd[15125]: [14/Jul/2017:09:09:11.167268487 -0400] valueset_value_syntax_cmp: slapi_attr_values2keys_sv failed for type attributetypes These servers were offline for 2-3 weeks, do they have the same tombstone effect as windows ad controllers? Any other information I can provide? Thanks -Jake

2 2

Unable to login as user
by patrick.mchale＠nzx.com 14 Jul '17

14 Jul '17

Hi, I am getting an error logging into a FreeIPA server from a new FreeIPA client. I have reset the password for the user using "kinit admin" but still no joy. Is there another password that is needing to be set?. Jul 14 13:53:41 ipa-client [sssd[krb5_child[2457]]]: Password has expired Jul 14 13:53:41 ipa-client [sssd[krb5_child[2457]]]: Decrypt integrity check failed Jul 14 13:54:40 ipa-client [sssd[krb5_child[2466]]]: Password has expired Jul 14 13:54:40 ipa-client [sssd[krb5_child[2466]]]: Decrypt integrity check failed Any advice would be appreciated. Patrick

3 4

Cannot get a second FreeIPA client authentication working.
by Patrick McHale 14 Jul '17

14 Jul '17

Hi, I have had a success with installing the FreeIPA system but I needed to add another client in order to reproduce the steps required for building a client to authenticate with the server. I did the same steps as before but I cannot get "another" client to authenticate with the server. The new client shows up in the hosts lists, and this indicates it has been enrolled. Is there something else that needs to be run, on the new client in order for the FreeIPA server to take charge of the new client machine authentication. I know the server is running correctly, because the original client works fine. Would be grateful for some advice. Patrick

2 1

`ipa-getcert request` for a sub-CA?
by John Morris 13 Jul '17

13 Jul '17

Is it possible to use certmonger to request a cert from a FreeIPA sub-CA? What is the `ipa-getcert request` command-line usage for that? The certmonger man-pages seem to indicate the `ipa-getcert request -X ISSUER` argument. However I've been unable to find usage examples, and using neither the ipa sub-CA's name nor subject DN for ISSUER seem to work. I haven't dug into the source yet, but the certmonger puppet module readme [1] seems to indicate the plumbing is there for request `issuer` and `issuerdn`. Thanks for any tips. John [1]: https://forge.puppet.com/saltedsignal/certmonger

1 1

Caching server for freeipa?
by Robert Söderlund 13 Jul '17

13 Jul '17

Hi all! In my setup I have 2 FreeIPA servers, both are masters (using location without greater success, but I think that issue is a problem in layer 8 (between keyboard and chair)). Now when I have used FreeIPA for a while I'm comfortable to let my home network use the FreeIPA for different kind of services. But I don't want to setup a full replica at home for a number for reasons: 1. I only use low-energy devices for the "house needs" (like raspberry pi and other low end machines) 2. I don't really trust how the replication will work during different kind of outages (when I tear down the network and rebuild it for test something new, or when my ISP having unannounced maintenance for a couple of hours). The main purpose for stretch the ldap directory to my home network is to have a simple single sign-on (some services are just using ldap insted of true kerberos) for my family from some web logins and wifi authentication. I don't expect the users to change the password when they connect to services that are using the FreeIPA cache, so I don't thing I need a read-write proxy. Thanks in advanced //Robert

1 0

OpenLdap - Freeipa - overview of all Fields?
by Tobi Berninger 13 Jul '17

13 Jul '17

Hey, I am pretty new to this whole OpenLdap / Freeipa Buisness. Is there any overview of all fields that openldap offers? can anyone recommend me an good introduction to this topic ? thank you all j.

3 2

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users July 2017