August 2017 - FreeIPA-users - Fedora mailing-lists

using freeipa with an AWS elastic load balancer
by ridha.zorgui＠infor.com 13 Oct '18

13 Oct '18

I set up a FreeIPA master and replica behind an elastic load balancer in AWS cloud. FreeIPA Clients will be contacting the replica and the master sever through the load balancer so the dns name used when configurting the clients is the ELB CNAME. The problem is when retreiving ldap data and during the authentication, the SSL handshake fails as the certificate sent back from the master or replica has a hostname different than the one used in the sssd ( the ELB CNAME). so the connection is terminated. There is a workaround which is the use reqcert=allow but this bring a security issue with a MITM attack. another solution i found is the use SAN. I was able to add the ELB DNS as a SAN in freeipa servers certificate. i made sure it is there by downloading the certificate and checking that the elb san exist but when testing it the same problem remain. Please help.

3 3

Renewal of External Third Party SSL Cert
by Alka Murali 29 Nov '17

29 Nov '17

Hello, I am using the embedded CA For FreeIPA as well as external CA Signed by Digicert. However, the certificate will be expiring next month. After renewal, do I need to install the certificate again using the same steps mentioned within the link https://www.freeipa.org/page/Using_3rd_part_certificates_for_HTTP/LDAP Similarly how will I be able to update the new certificate in my IPA Clients too. Do I need to follow the steps below on all IPA Clients? ----- certutil -A -d /etc/pki/nssdb -n 'IPA CA' -t CT,C,C -a -i ipa.crt cp ipa.crt /etc/ipa/ca.crt ------- Can you please brief up the exact procedure to follow for the third party SSL cert renewal. Thanks and Regards, Alka Murali

3 4

Can't create new CA replica
by john.bowman＠zayo.com 17 Nov '17

17 Nov '17

Since taking over our FreeIPA environment I've been unable to create a new CA replica. A bunch of failed attempts and upgrades over the last year and I keep running in to issues. After my latest attempt I noticed something that I had not seen before (likely a result of an recent upgrade) and I was wondering if this would cause a CA install to fail. Our env: 3 x ipa-server-3.0.0-51.el6.x86_64 3 x ipa-server-4.4.0-14.el7_3.7.x86_64 2 of the 3.x IPA servers are currently acting as CAs and I've been trying to create a new 4.x CA replica in order to start removing the 3.x IPA servers. I've been able to do a simple test with vanilla CentOS 6.9 and 7.3 and it seems to work fine as far as I can tell but when I try it in our environment it fails. I noticed this error in one of the logs and something jumped out at me that I had never seen before: [14/Jun/2017:06:49:44][http-bio-8443-exec-3]: === Finalization === [14/Jun/2017:06:49:44][http-bio-8443-exec-3]: Updating existing security domain [14/Jun/2017:06:49:44][http-bio-8443-exec-3]: isSDHostDomainMaster(): Getting domain.xml from CA... [14/Jun/2017:06:49:44][http-bio-8443-exec-3]: ConfigurationUtils: getting domain info [14/Jun/2017:06:49:44][http-bio-8443-exec-3]: ConfigurationUtils: GET https://ipa-master.domain.tld:443/ca/admin/ca/getDomainXML [14/Jun/2017:06:49:44][http-bio-8443-exec-3]: ConfigurationUtils: status: 0 [14/Jun/2017:06:49:44][http-bio-8443-exec-3]: ConfigurationUtils: domain info: <?xml version="1.0" encoding="UTF-8" standalone="no"?><DomainInfo><Name>IPA</Name><CAList><CA ><Host>ipa-master.domain.tld</Host><SecurePort>443</SecurePort><SecureAgentPort>443</SecureAgentPort><SecureAdminPort>443</SecureAdminPort><UnSecurePort>80</UnSecurePort><Sec ureEEClientAuthPort>443</SecureEEClientAuthPort><DomainManager>TRUE</DomainManager><Clone>TRUE</Clone><SubsystemName>pki-cad</SubsystemName></CA><CA><Host>ipa-replica1.domain.tld </Host><SecurePort>443</SecurePort><SecureAgentPort>443</SecureAgentPort><SecureAdminPort>443</SecureAdminPort><UnSecurePort>80</UnSecurePort><SecureEEClientAuthPort>443</S ecureEEClientAuthPort><DomainManager>TRUE</DomainManager><Clone>TRUE</Clone><SubsystemName>pki-cad</SubsystemName></CA><CA><Host>ipa-replica2.domain.tld</Host><SecurePort>443</Se curePort><SecureAgentPort>443</SecureAgentPort><SecureAdminPort>443</SecureAdminPort><UnSecurePort>80</UnSecurePort><SecureEEClientAuthPort>443</SecureEEClientAuthPort><Dom ainManager>TRUE</DomainManager><Clone>TRUE</Clone><SubsystemName>pki-cad</SubsystemName></CA><SubsystemCount>3</SubsystemCount></CAList><OCSPList><SubsystemCount>0</Subsyst emCount></OCSPList><KRAList><SubsystemCount>0</SubsystemCount></KRAList><RAList><SubsystemCount>0</SubsystemCount></RAList><TKSList><SubsystemCount>0</SubsystemCount></TKSL ist><TPSList><SubsystemCount>0</SubsystemCount></TPSList></DomainInfo> [14/Jun/2017:06:49:44][http-bio-8443-exec-3]: Cloning a domain master [14/Jun/2017:06:49:44][http-bio-8443-exec-3]: Update security domain using admin interface [14/Jun/2017:06:49:44][http-bio-8443-exec-3]: ConfigurationUtils: updateDomainXML start hostname=ipa-master.domain.tld port=443 [14/Jun/2017:06:49:44][http-bio-8443-exec-3]: ConfigurationUtils: POST https://ipa-master.domain.tld:443/ca/admin/ca/updateDomainXML [14/Jun/2017:06:49:44][http-bio-8443-exec-3]: Unable to access admin interface: javax.ws.rs.NotFoundException: HTTP 404 Not Found [14/Jun/2017:06:49:44][http-bio-8443-exec-3]: Update security domain using agent interface [14/Jun/2017:06:49:44][http-bio-8443-exec-3]: ConfigurationUtils: updateDomainXML start hostname=ipa-master.domain.tld port=443 [14/Jun/2017:06:49:44][http-bio-8443-exec-3]: updateDomainXML() nickname=subsystemCert cert-pki-ca [14/Jun/2017:06:49:44][http-bio-8443-exec-3]: ConfigurationUtils: POST https://ipa-master.domain.tld:443/ca/agent/ca/updateDomainXML [14/Jun/2017:06:49:45][http-bio-8443-exec-3]: Server certificate: [14/Jun/2017:06:49:45][http-bio-8443-exec-3]: - subject: CN=ipa-master.domain.tld,O=DOMAIN.US [14/Jun/2017:06:49:45][http-bio-8443-exec-3]: - issuer: CN=Certificate Authority,O=DOMAIN.US [14/Jun/2017:06:49:45][http-bio-8443-exec-3]: ConfigurationUtils: updateDomainXML: status=1 [14/Jun/2017:06:49:45][http-bio-8443-exec-3]: Unable to update security domain: 2 java.io.IOException: Unable to update security domain: 2 The ipa-master.domain.tld is one of the current RHEL 6.9 FreeIPA 3.x servers but the other two listed in that domainxml file one does not exist (it may have at some point been renamed) and the other server is not a CA replica but it is a replica. Is it possible this bad info would cause a failure when trying to create a new CA replica? If so is it something I can try cleaning up? Any info would be appreciated. Thanks!

5 11

AD trust setup woes
by Jason Beck 28 Sep '17

28 Sep '17

I have been trying to reliably get an AD trust setup for a few weeks and no matter what I try, when I goto add AD users to an external group in FreeIPA, I get: "trusted domain object not found" Googling around tends to always yield the same suggestions: 1) Check time sync 2) Check DNS 3) Check firewall I have done all of this ad nauseam in several different environments with several different versions of FreeIPA and Windows servers. I have gotten a setup to work maybe 2% of the time out of hundreds of attempts. I am currently using FreeIPA 4.5.2 on Fedora 25 (out of the COPR repo). I am trying to establish trust with a mixed Windows 2012 & 2008 forest. I have tried both one and two way trusts. Everything seems to work fine up until I try to add AD users to FreeIPA. I have verified all of the requisite DNS records exist and return the proper information on both sides, there are no firewalls between any of the hosts, and the AD servers and FreeIPA servers are synchronized by the same NTP servers. What could I possibly be missing?

7 26

Cannot access Web UI after IPA upgrade to 4.5
by Gustavo Berman 16 Sep '17

16 Sep '17

Hi there, Today we upgraded to the latest IPA 4.5, log says it upgraded just fine, ipa seems to authenticate allright, but web ui fails with: Operations ErrorSome operations failed.an internal error has occurred And the details it shows when I press the OK button are: Runtime error Web UI got in unrecoverable state during "profile" phase. Technical details: t.metadata is undefined update_logged_in@https://ipaserver.fisica.cabib/ipa/ui/ js/freeipa/app.js?40500:1:18156 choose_profile@https:// ipaserver.fisica.cabib/ipa/ui/js/freeipa/app.js?40500:1:16651 register_phases/ <https://ipaserver.fisica.cabib/ipa/ui/js/freeipa/app.js?40500:1:16651regist…> <@https://ipaserver.fisica.cabib/ipa/ui/js/freeipa/app.js?40500:1:1181 _run_phase/ <https://ipaserver.fisica.cabib/ipa/ui/js/freeipa/app.js?40500:1:1181_run_ph…> <@https://ipaserver.fisica.cabib/ipa/ui/js/freeipa/app.js?40500:1:3476 forEach@https://ipaserver.fisica.cabib/ipa/ui/js/dojo/ dojo.js?v=40500:1:29752 _run_phase@https://ipaserver.fisica.cabib/ipa/ui/js/ freeipa/app.js?40500:1:3440 next_phase@https://ipaserver. fisica.cabib/ipa/ui/js/freeipa/app.js?40500:1:3899 _run_phase/ <https://ipaserver.fisica.cabib/ipa/ui/js/freeipa/app.js?40500:1:3899_run_ph…> <@https://ipaserver.fisica.cabib/ipa/ui/js/freeipa/app.js?40500:1:3626 c@ https://ipaserver.fisica.cabib/ipa/ui/js/dojo/dojo.js?v=40500:1:60960 d/t.then@https://ipaserver.fisica.cabib/ipa/ui/js/dojo/ dojo.js?v=40500:1:62246 <https://ipaserver.fisica.cabib/ipa/ui/js/dojo/dojo.js?v=40500:1:60960d/t.th…> _run_phase@https://ipaserver.fisica.cabib/ipa/ui/js/ freeipa/app.js?40500:1:3548 next_phase@https://ipaserver. fisica.cabib/ipa/ui/js/freeipa/app.js?40500:1:3899 _run_phase/ <https://ipaserver.fisica.cabib/ipa/ui/js/freeipa/app.js?40500:1:3899_run_ph…> <@https://ipaserver.fisica.cabib/ipa/ui/js/freeipa/app.js?40500:1:3626 c@ https://ipaserver.fisica.cabib/ipa/ui/js/dojo/dojo.js?v=40500:1:60960 l@ https://ipaserver.fisica.cabib/ipa/ui/js/dojo/dojo.js?v=40500:1:60886 d/this.resolve@https://ipaserver.fisica.cabib/ipa/ui/ js/dojo/dojo.js?v=40500:1:61873 dojo/promise/all/ <https://ipaserver.fisica.cabib/ipa/ui/js/dojo/dojo.js?v=40500:1:60886d/this…> </</</<@https://ipaserver.fisica.cabib/ipa/ui/js/dojo/dojo.js?v=40500:1: 85255 c@https://ipaserver.fisica.cabib/ipa/ui/js/dojo/dojo.js? v=40500:1:60960 l@https://ipaserver.fisica.cabib/ipa/ui/js/dojo/dojo.js?v=40500:1:60886 d/this.resolve@https://ipaserver.fisica.cabib/ipa/ui/ js/dojo/dojo.js?v=40500:1:61873 register_phases/ <https://ipaserver.fisica.cabib/ipa/ui/js/dojo/dojo.js?v=40500:1:60886d/this…> </<@https://ipaserver.fisica.cabib/ipa/ui/js/freeipa/app.js?40500:1:1092 on_success@https://ipaserver.fisica.cabib/ipa/ui/js/freeipa/app.js?40500:1:34431 freeipa/rpc/ <https://ipaserver.fisica.cabib/ipa/ui/js/freeipa/app.js?40500:1:34431freeip…> </a.concurrent_command/t.on_success_all@https://ipaserver.fisica.cabib/ipa/ ui/js/freeipa/app.js?40500:1:57160 freeipa/rpc/ <https://ipaserver.fisica.cabib/ipa/ui/js/freeipa/app.js?40500:1:57160freeip…> </a.concurrent_command/t.command_completed@https://ipaserver.fisica.cabib/ ipa/ui/js/freeipa/app.js?40500:1:56953 freeipa/rpc/ <https://ipaserver.fisica.cabib/ipa/ui/js/freeipa/app.js?40500:1:56953freeip…> </a.concurrent_command/t.success_handler@https://ipaserver.fisica.cabib/ ipa/ui/js/freeipa/app.js?40500:1:56790 freeipa/rpc/ <https://ipaserver.fisica.cabib/ipa/ui/js/freeipa/app.js?40500:1:56790freeip…> </a.concurrent_command/t.execute/n.on_success</<@https://ipaserver. fisica.cabib/ipa/ui/js/freeipa/app.js?40500:1:56340 freeipa/rpc/ <https://ipaserver.fisica.cabib/ipa/ui/js/freeipa/app.js?40500:1:56340freeip…> </a.command/l.register_handlers/<@https://ipaserver.fisica.cabib/ipa/ui/ js/freeipa/app.js?40500:1:53786 f@https://ipaserver.fisica. cabib/ipa/ui/js/dojo/dojo.js?v=40500:1:49586 dojo/on/ <https://ipaserver.fisica.cabib/ipa/ui/js/dojo/dojo.js?v=40500:1:49586dojo/o…> </i.emit@https://ipaserver.fisica.cabib/ipa/ui/js/dojo/dojo.js?v=40500:1:45192 dojo/on/ <https://ipaserver.fisica.cabib/ipa/ui/js/dojo/dojo.js?v=40500:1:45192dojo/o…> </i.emit@https://ipaserver.fisica.cabib/ipa/ui/js/dojo/dojo.js?v=40500:1: 45808 emit@https://ipaserver.fisica.cabib/ipa/ui/js/dojo/dojo.js? v=40500:1:48712 c@https://ipaserver.fisica.cabib/ipa/ui/js/freeipa/app. js?40500:1:52429 l@https://ipaserver.fisica.cabib/ipa/ui/js/libs/jquery. js?v=40500:4:24877 fireWith@https://ipaserver.fisica.cabib/ipa/ui/js/libs/ jquery.js?v=40500:4:25702 k@https://ipaserver.fisica. cabib/ipa/ui/js/libs/jquery.js?v=40500:6:5346 t/ <https://ipaserver.fisica.cabib/ipa/ui/js/libs/jquery.js?v=40500:6:5346t/><@ https://ipaserver.fisica.cabib/ipa/ui/js/libs/jquery.js?v=40500:6:9152 Apache error logs shows: [Mon Aug 07 11:04:32.078630 2017] [:warn] [pid 11845] [client ##.##.##.##:45938] failed to set perms (3140) on file (/var/run/ipa/ccaches/tavo(a)FISICA.CABIB)!, referer: https://ipaserver.fisica.cabib/ipa/ui/ [Mon Aug 07 11:04:32.079589 2017] [:error] [pid 11839] ipa: DEBUG: WSGI wsgi_dispatch.__call__: [Mon Aug 07 11:04:32.079709 2017] [:error] [pid 11839] ipa: DEBUG: WSGI jsonserver_session.__call__: [Mon Aug 07 11:04:32.160389 2017] [:error] [pid 11839] ipa: DEBUG: Created connection context.ldap2_94603036533520 [Mon Aug 07 11:04:32.160485 2017] [:error] [pid 11839] ipa: DEBUG: WSGI jsonserver.__call__: [Mon Aug 07 11:04:32.160577 2017] [:error] [pid 11839] ipa: DEBUG: WSGI WSGIExecutioner.__call__: [Mon Aug 07 11:04:32.170494 2017] [:error] [pid 11839] ipa: DEBUG: raw: batch(({u'params': ([], {}), u'method': u'i18n_messages'}, {u'params': ([], {}), u'method': u'config_show'}, {u'params': ([], {}), u'method': u'whoami'}, {u'params': ([], {}), u'method': u'env'}, {u'params': ([], {}), u'method': u'dns_is_enabled'}, {u'params': ([], {}), u'method': u'trustconfig_show'}, {u'params': ([], {}), u'method': u'domainlevel_get'}, {u'params': ([], {}), u'method': u'ca_is_enabled'}, {u'params': ([], {}), u'method': u'vaultconfig_show'}), version=u'2.228') [Mon Aug 07 11:04:32.170764 2017] [:error] [pid 11839] ipa: DEBUG: batch(({u'params': ([], {}), u'method': u'i18n_messages'}, {u'params': ([], {}), u'method': u'config_show'}, {u'params': ([], {}), u'method': u'whoami'}, {u'params': ([], {}), u'method': u'env'}, {u'params': ([], {}), u'method': u'dns_is_enabled'}, {u'params': ([], {}), u'method': u'trustconfig_show'}, {u'params': ([], {}), u'method': u'domainlevel_get'}, {u'params': ([], {}), u'method': u'ca_is_enabled'}, {u'params': ([], {}), u'method': u'vaultconfig_show'}), version=u'2.228') [Mon Aug 07 11:04:32.171033 2017] [:error] [pid 11839] ipa: DEBUG: raw: i18n_messages(version=u'2.228') [Mon Aug 07 11:04:32.171215 2017] [:error] [pid 11839] ipa: DEBUG: i18n_messages(version=u'2.228') [Mon Aug 07 11:04:32.178630 2017] [:error] [pid 11839] ipa: INFO: tavo(a)FISICA.CABIB: batch: i18n_messages(): SUCCESS [Mon Aug 07 11:04:32.178857 2017] [:error] [pid 11839] ipa: DEBUG: raw: config_show(version=u'2.228') [Mon Aug 07 11:04:32.179094 2017] [:error] [pid 11839] ipa: DEBUG: config_show(rights=False, all=False, raw=False, version=u'2.228') [Mon Aug 07 11:04:32.181775 2017] [:error] [pid 11839] ipa: DEBUG: retrieving schema for SchemaCache url=ldapi://%2fvar%2frun%2fslapd-FISICA-CABIB.socket conn=<ldap.ldapobject.SimpleLDAPObject instance at 0x560a7e36a0e0> [Mon Aug 07 11:04:32.548227 2017] [:error] [pid 11839] ipa: INFO: tavo(a)FISICA.CABIB: batch: config_show(): SUCCESS [Mon Aug 07 11:04:32.548454 2017] [:error] [pid 11839] ipa: DEBUG: raw: whoami(version=u'2.228') [Mon Aug 07 11:04:32.548625 2017] [:error] [pid 11839] ipa: DEBUG: whoami(version=u'2.228') [Mon Aug 07 11:04:32.549205 2017] [:error] [pid 11839] ipa: INFO: tavo(a)FISICA.CABIB: batch: whoami(): PROTOCOL_ERROR [Mon Aug 07 11:04:32.549456 2017] [:error] [pid 11839] ipa: DEBUG: raw: env(None, version=u'2.228') [Mon Aug 07 11:04:32.549700 2017] [:error] [pid 11839] ipa: DEBUG: env(None, server=False, all=True, version=u'2.228') [Mon Aug 07 11:04:32.550139 2017] [:error] [pid 11839] ipa: INFO: tavo(a)FISICA.CABIB: batch: env(None): SUCCESS [Mon Aug 07 11:04:32.550350 2017] [:error] [pid 11839] ipa: DEBUG: raw: dns_is_enabled(version=u'2.228') [Mon Aug 07 11:04:32.550520 2017] [:error] [pid 11839] ipa: DEBUG: dns_is_enabled(version=u'2.228') [Mon Aug 07 11:04:32.552209 2017] [:error] [pid 11839] ipa: INFO: tavo(a)FISICA.CABIB: batch: dns_is_enabled(): SUCCESS [Mon Aug 07 11:04:32.552435 2017] [:error] [pid 11839] ipa: DEBUG: raw: trustconfig_show(version=u'2.228') [Mon Aug 07 11:04:32.552742 2017] [:error] [pid 11839] ipa: DEBUG: trustconfig_show(rights=False, trust_type=u'ad', all=False, raw=False, version=u'2.228') [Mon Aug 07 11:04:32.558903 2017] [:error] [pid 11839] ipa: INFO: tavo(a)FISICA.CABIB: batch: trustconfig_show(): SUCCESS [Mon Aug 07 11:04:32.559101 2017] [:error] [pid 11839] ipa: DEBUG: raw: domainlevel_get(version=u'2.228') [Mon Aug 07 11:04:32.559292 2017] [:error] [pid 11839] ipa: DEBUG: domainlevel_get(version=u'2.228') [Mon Aug 07 11:04:32.560543 2017] [:error] [pid 11839] ipa: INFO: tavo(a)FISICA.CABIB: batch: domainlevel_get(): SUCCESS [Mon Aug 07 11:04:32.560753 2017] [:error] [pid 11839] ipa: DEBUG: raw: ca_is_enabled(version=u'2.228') [Mon Aug 07 11:04:32.560924 2017] [:error] [pid 11839] ipa: DEBUG: ca_is_enabled(version=u'2.228') [Mon Aug 07 11:04:32.562484 2017] [:error] [pid 11839] ipa: INFO: tavo(a)FISICA.CABIB: batch: ca_is_enabled(): SUCCESS [Mon Aug 07 11:04:32.562694 2017] [:error] [pid 11839] ipa: DEBUG: raw: vaultconfig_show(version=u'2.228') [Mon Aug 07 11:04:32.562880 2017] [:error] [pid 11839] ipa: DEBUG: vaultconfig_show(all=False, raw=False, version=u'2.228') [Mon Aug 07 11:04:32.563089 2017] [:error] [pid 11839] ipa: DEBUG: raw: kra_is_enabled(version=u'2.228') [Mon Aug 07 11:04:32.563209 2017] [:error] [pid 11839] ipa: DEBUG: kra_is_enabled(version=u'2.228') [Mon Aug 07 11:04:32.564192 2017] [:error] [pid 11839] ipa: INFO: tavo(a)FISICA.CABIB: batch: vaultconfig_show(): InvocationError [Mon Aug 07 11:04:32.564462 2017] [:error] [pid 11839] ipa: INFO: [jsonserver_session] tavo(a)FISICA.CABIB: batch(({u'params': ([], {}), u'method': u'i18n_messages'}, {u'params': ([], {}), u'method': u'config_show'}, {u'params': ([], {}), u'method': u'whoami'}, {u'params': ([], {}), u'method': u'env'}, {u'params': ([], {}), u'method': u'dns_is_enabled'}, {u'params': ([], {}), u'method': u'trustconfig_show'}, {u'params': ([], {}), u'method': u'domainlevel_get'}, {u'params': ([], {}), u'method': u'ca_is_enabled'}, {u'params': ([], {}), u'method': u'vaultconfig_show'}), version=u'2.228'): SUCCESS [Mon Aug 07 11:04:32.567156 2017] [:error] [pid 11839] ipa: DEBUG: Destroyed connection context.ldap2_94603036533520 From the first line of apache log the file it refers to has this attributes: stat /var/run/ipa/ccaches/tavo(a)FISICA.CABIB File: ‘/var/run/ipa/ccaches/tavo(a)FISICA.xn--cabib-3v3b Size: 4596 Blocks: 16 IO Block: 4096 regular file Device: 12h/18d Inode: 37651 Links: 1 Access: (0600/-rw-------) Uid: ( 989/ ipaapi) Gid: ( 985/ ipaapi) Context: system_u:object_r:ipa_var_run_t:s0 Access: 2017-08-07 11:09:56.260676960 -0300 Modify: 2017-08-07 09:58:09.367597633 -0300 Change: 2017-08-07 09:58:09.367597633 -0300 Birth: - This are the ipa packages I have: rpm -qa | grep ipa python2-ipaclient-4.5.0-21.el7.noarch python-iniparse-0.4-9.el7.noarch sssd-ipa-1.15.2-50.el7.x86_64 ipa-client-4.5.0-21.el7.x86_64 python2-ipaserver-4.5.0-21.el7.noarch python-libipa_hbac-1.15.2-50.el7.x86_64 ipa-common-4.5.0-21.el7.noarch ipa-server-4.5.0-21.el7.x86_64 ipa-server-common-4.5.0-21.el7.noarch ipa-server-dns-4.5.0-21.el7.noarch python-ipaddress-1.0.16-2.el7.noarch ipa-python-compat-4.5.0-21.el7.noarch ipa-client-common-4.5.0-21.el7.noarch libipa_hbac-1.15.2-50.el7.x86_64 python2-ipalib-4.5.0-21.el7.noarch Any ideas? Thanks! -- Gustavo Berman Sysadmin - Gerencia de Física - Centro Atómico Bariloche - CNEA

3 7

Radius authentication trouble
by Steve Weeks 15 Sep '17

15 Sep '17

We are running FreeIPA 4.4 on Centos 7 and trying to use radius authentication. Using radtest and radclient work fine and we can authenticate a user. The radius proxy and secret are set to match the values from radclient. The user has the radius check box checked and the other two fields set to appropriate values. hbactest shows that the user has permission for any host. When I do " su -l rsa-user", I'm requested for the first and second factors. After I enter them, I get "su: Authentication failure". Using a non-radius user works fine. The sssd_pam log has [sssd[pam]] [pam_dp_process_reply] (0x0200): received: [17 (Failure setting user credentials)][idm.bbn.com] [sssd[pam]] [pam_reply] (0x0200): pam_reply called with result [17]: Failure setting user credentials. Unchecking the radius checkbox and the account works fine. Any ideas what to try or look at next?

3 2

Kvno error on validating one-way trust: "kvno: Decrypt integrity check failed while getting credentials"
by bogusmaster＠o2.pl 07 Sep '17

07 Sep '17

Hi All, I am setting up a one-way trust from FreeIPA server to AD domain with a pre-shared key. It seems that it was set up successfully but I cannot verify the Kerberos configuration when I follow the steps described here: https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/ht…. Although I successfuly kinit with a username from AD domain and obtain a ticket: klist Ticket cache: KEYRING:persistent:0:0 Default principal: testuser(a)DOMAIN.COM Valid starting Expires Service principal 08/22/2017 09:47:41 08/22/2017 19:47:41 krbtgt/DOMAIN.COM(a)DOMAIN.COM renew until 08/23/2017 09:47:34 I am not able to request service tickets for a service within IdM domain: [root@idm1 ~]# KRB5_TRACE=/dev/stdout kvno -S host idm1.ipa.domain.com [16119] 1503409696.153004: Getting credentials testuser(a)DOMAIN.COM -> host/idm1.ipa.domain.com(a)IPA.DOMAIN.COM using ccache KEYRING:persistent:0:0 [16119] 1503409696.153288: Retrieving testuser(a)DOMAIN.COM -> host/idm1.ipa.domain.com(a)IPA.DOMAIN.COM from KEYRING:persistent:0:0 with result: -1765328243/Matching credential not found [16119] 1503409696.153422: Retrieving testuser(a)DOMAIN.COM -> krbtgt/IPA.DOMAIN.COM(a)IPA.DOMAIN.COM from KEYRING:persistent:0:0 with result: -1765328243/Matching credential not found [16119] 1503409696.153520: Retrieving testuser(a)DOMAIN.COM -> krbtgt/DOMAIN.COM(a)DOMAIN.COM from KEYRING:persistent:0:0 with result: 0/Success [16119] 1503409696.153536: Starting with TGT for client realm: testuser(a)DOMAIN.COM -> krbtgt/DOMAIN.COM(a)DOMAIN.COM [16119] 1503409696.153600: Retrieving testuser(a)DOMAIN.COM -> krbtgt/IPA.DOMAIN.COM(a)IPA.DOMAIN.COM from KEYRING:persistent:0:0 with result: -1765328243/Matching credential not found [16119] 1503409696.153609: Requesting TGT krbtgt/IPA.DOMAIN.COM(a)DOMAIN.COM using TGT krbtgt/DOMAIN.COM(a)DOMAIN.COM [16119] 1503409696.153663: Generated subkey for TGS request: aes256-cts/A13D [16119] 1503409696.153718: etypes requested in TGS request: aes256-cts, aes128-cts, des3-cbc-sha1, rc4-hmac, camellia128-cts, camellia256-cts, des-cbc-crc, des, des-cbc-md4 [16119] 1503409696.153875: Encoding request body and padata into FAST request [16119] 1503409696.153942: Sending request (1851 bytes) to DOMAIN.COM [16119] 1503409696.154236: Resolving hostname domain.com [16119] 1503409696.290796: Initiating TCP connection to stream 10.10.10.10:88 [16119] 1503409696.398086: Sending TCP request to stream 10.10.10.10:88 [16119] 1503409696.836098: Received answer (1551 bytes) from stream 10.10.10.10:88 [16119] 1503409696.836121: Terminating TCP connection to stream 10.10.10.10:88 [16119] 1503409696.836212: Response was from master KDC [16119] 1503409696.836258: Decoding FAST response [16119] 1503409696.836423: TGS reply is for testuser(a)DOMAIN.COM -> krbtgt/ipa.domain.com(a)DOMAIN.COM with session key aes256-cts/C0B1 [16119] 1503409696.836454: TGS request result: 0/Success [16119] 1503409696.836461: Received TGT for offpath realm ipa.domain.com [16119] 1503409696.836468: Requesting TGT krbtgt/IPA.DOMAIN.COM(a)ipa.domain.com using TGT krbtgt/ipa.domain.com(a)DOMAIN.COM [16119] 1503409696.836486: Generated subkey for TGS request: aes256-cts/743D [16119] 1503409696.836523: etypes requested in TGS request: aes256-cts, aes128-cts, des3-cbc-sha1, rc4-hmac, camellia128-cts, camellia256-cts, des-cbc-crc, des, des-cbc-md4 [16119] 1503409696.836579: Encoding request body and padata into FAST request [16119] 1503409696.836648: Sending request (1854 bytes) to ipa.domain.com [16119] 1503409696.904352: Resolving hostname idm1.ipa.domain.com. [16119] 1503409696.938147: Sending initial UDP request to dgram 10.10.10.11:88 [16119] 1503409696.943465: Received answer (146 bytes) from dgram 10.10.10.11:88 [16119] 1503409696.977047: Response was from master KDC [16119] 1503409696.977102: TGS request result: -1765328353/Decrypt integrity check failed kvno: Decrypt integrity check failed while getting credentials for host/idm1.ipa.domain.com(a)IPA.DOMAIN.COM Can you please advise me on how to resolve this issue? Bart

4 6

Re: Krb5.conf only sees first two kdc servers
by pgb205 01 Sep '17

01 Sep '17

Sumit, thank you very much for this. Very helpful, but I am still not seeing the problem So at first I will try with the following in krb5.confkdc=server1 <--shut off on the network#kdc=server2 <--shut off on the network and commented out in krb5.confkdc=server3 <--up and running KRB5_TRACE=/dev/stdout kinit user(a)test.domain [12583] 1501113245.556036: Getting initial credentials for user(a)test.domain [12583] 1501113245.556244: Sending request (181 bytes) to test.domain [12583] 1501113245.556282: Resolving hostname server1 [12583] 1501113245.557235: Sending initial UDP request to dgram ip_addr_server1:88 [12583] 1501113246.558328: Resolving hostname server3 [12583] 1501113246.558974: Sending initial UDP request to dgram ip_addr_server3:88 [12583] 1501113246.729059: Received answer (275 bytes) from dgram ip_addr_server3:88 [12583] 1501113246.729111: Response was from master KDC [12583] 1501113246.729155: Received error from KDC: -1765328359/Additional pre-authentication required [12583] 1501113246.729219: Processing preauth types: 136, 19, 2, 133 [12583] 1501113246.729245: Selected etype info: etype aes256-cts, salt "pY;=XB+5_*EjJC%S", params "" [12583] 1501113246.729254: Received cookie: MIT Password for user(a)test.domain <--get prompted for password Now with all three kdc uncommentedkdc=server1 <-shut off and uncommentedkdc=server2 <--shut off and uncommentedkdc=server3 <--up and running KRB5_TRACE=/dev/stdout kinit user(a)test.domain [12536] 1501112935.251721: Getting initial credentials for user(a)test.domain [12536] 1501112935.251917: Sending request (181 bytes) to test.domain [12536] 1501112935.251956: Resolving hostname server1 [12536] 1501112935.252875: Sending initial UDP request to dgram server1_ip:88 [12536] 1501112936.253962: Resolving hostname server2 [12536] 1501112936.255680: Retrying AS request with master KDC [12536] 1501112936.255699: Getting initial credentials for user(a)test.domain [12536] 1501112936.255763: Sending request (181 bytes) to test.domain (master) [12536] 1501112936.255779: Resolving hostname server1 [12536] 1501112936.256379: Sending initial UDP request to dgram server1_ip:88 [12536] 1501112937.257451: Resolving hostname server2 kinit: Invalid argument while getting initial credentials > So as you can see server3 is never even tried for authentication. One of my theories is that there might be maximum number of kdc's to tryor maximum total authentication timeout?! Just a wild guess as I'm reaching for straws. -------------------------------My other question with regards to how sssd and krb work together was prompted by sssd.confipa_server= _srv_ option which supposed to find available IPA servers from DNS records. We do indeed have this option set in sssd.confand are able to resolve server1,server2 server3 when querying for following records _ldap._tcp _kerberos._tcp _kerberos._udp _kerberos-master._tcp _kerberos-master._udp _ntp._udp If the _srv_ is enabled then am i correct in assuming that we wouldn't even need kdc= records in krb5.conf ??I tried removing kdc= linesand was unable to authenticate.

5 10

Unable to create an Active Directory Trust
by PAESSENS Daniel (BCS/PSD) 01 Sep '17

01 Sep '17

Hello, When performing a trust between IPA & AD I get the following error: CIFS server communication error: code "-1073741771", message "The object name already exists." (both may be "None") For testing purpose did I remove the trust and want to re-add him like before. Regards, Daniel ________________________________ **** DISCLAIMER**** http://www.bics.com/maildisclaimer/

2 3

FreeIPA failover not working
by Michael Gusek 01 Sep '17

01 Sep '17

Hi, we are testing a FreeIPA trust to an Active Directory. Trust itself works, we are happy. Now we tested a failure on FreeIPA site. We have two instances, both with same roles. If we poweroff first installed server, and clean sssd caches with restart of sssd on client side , sssd service can’t establish a connection to second instance. ipa-lx-test-01.ipa.example.com is the first installed FreeIPA with ipa-server-4.4.0-14.el7.centos.7.x86_64 on latest CentOS7 ipa-lx-test-02.ipa.example.com is the second installed FreeIPA with ipa-server-4.4.0-14.el7.centos.7.x86_64 on latest CentOS7 ipa-lx-test-debian9.ipa.example.com is a latest Debian 9.1 with sssd 1.15.0-3 For deeper inspection full log is attached. In logs we found something like this: |(Wed Aug 23 16:07:06 2017) [sssd[be[ipa.example.com]]] [set_server_common_status] (0x0100): Marking server 'ipa-lx-test-01.ipa.example.com' as 'name resolved' (Wed Aug 23 16:07:06 2017) [sssd[be[ipa.example.com]]] [be_resolve_server_process] (0x1000): Saving the first resolved server (Wed Aug 23 16:07:06 2017) [sssd[be[ipa.example.com]]] [be_resolve_server_process] (0x0200): Found address for server ipa-lx-test-01.ipa.example.com: [x.x.x.x] TTL 1200 (Wed Aug 23 16:07:06 2017) [sssd[be[ipa.example.com]]] [ipa_resolve_callback] (0x0400): Constructed uri 'ldap://ipa-lx-test-01.ipa.example.com' (Wed Aug 23 16:07:06 2017) [sssd[be[ipa.example.com]]] [unique_filename_destructor] (0x2000): Unlinking [/var/lib/sss/pubconf/.krb5info_dummy_2zXOse] (Wed Aug 23 16:07:06 2017) [sssd[be[ipa.example.com]]] [unlink_dbg] (0x2000): File already removed: [/var/lib/sss/pubconf/.krb5info_dummy_2zXOse] (Wed Aug 23 16:07:06 2017) [sssd[be[ipa.example.com]]] [sssd_async_socket_init_send] (0x4000): Using file descriptor [19] for the connection. (Wed Aug 23 16:07:06 2017) [sssd[be[ipa.example.com]]] [sssd_async_socket_init_send] (0x0400): Setting 6 seconds timeout for connecting (Wed Aug 23 16:07:09 2017) [sssd[be[ipa.example.com]]] [sssd_async_connect_done] (0x0020): connect failed [113][Keine Route zum Zielrechner]. (Wed Aug 23 16:07:09 2017) [sssd[be[ipa.example.com]]] [sssd_async_socket_init_done] (0x0020): sdap_async_sys_connect request failed: [113]: Keine Route zum Zielrechner. (Wed Aug 23 16:07:09 2017) [sssd[be[ipa.example.com]]] [sssd_async_socket_state_destructor] (0x0400): closing socket [19] (Wed Aug 23 16:07:09 2017) [sssd[be[ipa.example.com]]] [sss_ldap_init_sys_connect_done] (0x0020): sssd_async_socket_init request failed: [113]: Keine Route zum Zielrechner. (Wed Aug 23 16:07:09 2017) [sssd[be[ipa.example.com]]] [sdap_sys_connect_done] (0x0020): sdap_async_connect_call request failed: [113]: Keine Route zum Zielrechner. (Wed Aug 23 16:07:09 2017) [sssd[be[ipa.example.com]]] [sdap_handle_release] (0x2000): Trace: sh[0x558252c36770], connected[0], ops[(nil)], ldap[(nil)], destructor_lock[0], release_memory[0] (Wed Aug 23 16:07:09 2017) [sssd[be[ipa.example.com]]] [_be_fo_set_port_status] (0x8000): Setting status: PORT_NOT_WORKING. Called from: ../src/providers/ldap/sdap_async_connection.c: sdap_cli_connect_done: 1572 (Wed Aug 23 16:07:09 2017) [sssd[be[ipa.example.com]]] [fo_set_port_status] (0x0100): Marking port 389 of server 'ipa-lx-test-01.ipa.example.com' as 'not working' (Wed Aug 23 16:07:09 2017) [sssd[be[ipa.example.com]]] [fo_set_port_status] (0x0400): Marking port 389 of duplicate server 'ipa-lx-test-01.ipa.example.com' as 'not working' | Thats true, ‘Keine Route zum Zielrechner’ means ‘no route to host’, first instance is poweroff. Well looking forward in logfile |(Wed Aug 23 16:07:09 2017) [sssd[be[ipa.example.com]]] [fo_resolve_service_send] (0x0100): Trying to resolve service 'IPA' (Wed Aug 23 16:07:09 2017) [sssd[be[ipa.example.com]]] [get_server_status] (0x1000): Status of server 'ipa-lx-test-02.ipa.example.com' is 'name not resolved' (Wed Aug 23 16:07:09 2017) [sssd[be[ipa.example.com]]] [get_port_status] (0x1000): Port status of port 389 for server 'ipa-lx-test-02.ipa.example.com' is 'neutral' (Wed Aug 23 16:07:09 2017) [sssd[be[ipa.example.com]]] [fo_resolve_service_activate_timeout] (0x2000): Resolve timeout set to 6 seconds (Wed Aug 23 16:07:09 2017) [sssd[be[ipa.example.com]]] [resolve_srv_send] (0x0200): The status of SRV lookup is resolved (Wed Aug 23 16:07:09 2017) [sssd[be[ipa.example.com]]] [get_server_status] (0x1000): Status of server 'ipa-lx-test-02.ipa.example.com' is 'name not resolved' (Wed Aug 23 16:07:09 2017) [sssd[be[ipa.example.com]]] [resolv_is_address] (0x4000): [ipa-lx-test-02.ipa.example.com] does not look like an IP address (Wed Aug 23 16:07:09 2017) [sssd[be[ipa.example.com]]] [resolv_gethostbyname_step] (0x2000): Querying files (Wed Aug 23 16:07:09 2017) [sssd[be[ipa.example.com]]] [resolv_gethostbyname_files_send] (0x0100): Trying to resolve A record of 'ipa-lx-test-02.ipa.example.com' in files (Wed Aug 23 16:07:09 2017) [sssd[be[ipa.example.com]]] [set_server_common_status] (0x0100): Marking server 'ipa-lx-test-02.ipa.example.com' as 'resolving name' (Wed Aug 23 16:07:09 2017) [sssd[be[ipa.example.com]]] [resolv_gethostbyname_step] (0x2000): Querying files (Wed Aug 23 16:07:09 2017) [sssd[be[ipa.example.com]]] [resolv_gethostbyname_files_send] (0x0100): Trying to resolve AAAA record of 'ipa-lx-test-02.ipa.example.com' in files (Wed Aug 23 16:07:09 2017) [sssd[be[ipa.example.com]]] [resolv_gethostbyname_next] (0x0200): No more address families to retry (Wed Aug 23 16:07:09 2017) [sssd[be[ipa.example.com]]] [resolv_gethostbyname_step] (0x2000): Querying DNS (Wed Aug 23 16:07:09 2017) [sssd[be[ipa.example.com]]] [resolv_gethostbyname_dns_query] (0x0100): Trying to resolve A record of 'ipa-lx-test-02.ipa.example.com' in DNS (Wed Aug 23 16:07:09 2017) [sssd[be[ipa.example.com]]] [schedule_request_timeout] (0x2000): Scheduling a timeout of 6 seconds (Wed Aug 23 16:07:09 2017) [sssd[be[ipa.example.com]]] [schedule_timeout_watcher] (0x2000): Scheduling DNS timeout watcher (Wed Aug 23 16:07:10 2017) [sssd[be[ipa.example.com]]] [check_fd_timeouts] (0x4000): Checking for DNS timeouts (Wed Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]] [check_fd_timeouts] (0x4000): Checking for DNS timeouts (Wed Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]] [unschedule_timeout_watcher] (0x4000): Unscheduling DNS timeout watcher (Wed Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]] [resolv_gethostbyname_dns_parse] (0x1000): Parsing an A reply (Wed Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]] [request_watch_destructor] (0x0400): Deleting request watch (Wed Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]] [set_server_common_status] (0x0100): Marking server 'ipa-lx-test-02.ipa.example.com' as 'name resolved' (Wed Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]] [be_resolve_server_process] (0x0200): Found address for server ipa-lx-test-02.ipa.example.com: [x.x.x.x] TTL 1200 (Wed Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]] [ipa_resolve_callback] (0x0400): Constructed uri 'ldap://ipa-lx-test-02.ipa.example.com' (Wed Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]] [unique_filename_destructor] (0x2000): Unlinking [/var/lib/sss/pubconf/.krb5info_dummy_U1QQrA] (Wed Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]] [unlink_dbg] (0x2000): File already removed: [/var/lib/sss/pubconf/.krb5info_dummy_U1QQrA] (Wed Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]] [sssd_async_socket_init_send] (0x4000): Using file descriptor [19] for the connection. (Wed Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]] [sssd_async_socket_init_send] (0x0400): Setting 6 seconds timeout for connecting (Wed Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]] [sdap_ldap_connect_callback_add] (0x1000): New LDAP connection to [ldap://ipa-lx-test-02.ipa.example.com:389/??base] with fd [19]. (Wed Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]] [sdap_get_rootdse_send] (0x4000): Getting rootdse (Wed Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]] [sdap_print_server] (0x2000): Searching x.x.x.x:389 (Wed Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(objectclass=*)][]. (Wed Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [*] (Wed Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [altServer] (Wed Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [namingContexts] (Wed Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [supportedControl] (Wed Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [supportedExtension] (Wed Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [supportedFeatures] (Wed Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [supportedLDAPVersion] (Wed Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [supportedSASLMechanisms] (Wed Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [domainControllerFunctionality] (Wed Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [defaultNamingContext] (Wed Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [lastUSN] (Wed Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [highestCommittedUSN] (Wed Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]] [sdap_get_generic_ext_step] (0x2000): ldap_search_ext called, msgid = 1 (Wed Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]] [sdap_op_add] (0x2000): New operation 1 timeout 6 (Wed Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]] [sdap_process_result] (0x2000): Trace: sh[0x558252c35750], connected[1], ops[0x558252c36640], ldap[0x558252c130c0] (Wed Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]] [sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_ENTRY] (Wed Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]] [sdap_parse_entry] (0x1000): OriginalDN: []. (Wed Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]] [sdap_parse_range] (0x2000): No sub-attributes for [objectClass] (Wed Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]] [sdap_parse_range] (0x2000): No sub-attributes for [vendorName] (Wed Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]] [sdap_parse_range] (0x2000): No sub-attributes for [vendorVersion] (Wed Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]] [sdap_parse_range] (0x2000): No sub-attributes for [dataversion] (Wed Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]] [sdap_parse_range] (0x2000): No sub-attributes for [netscapemdsuffix] (Wed Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]] [sdap_parse_range] (0x2000): No sub-attributes for [changeLog] (Wed Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]] [sdap_parse_range] (0x2000): No sub-attributes for [firstchangenumber] (Wed Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]] [sdap_parse_range] (0x2000): No sub-attributes for [lastchangenumber] (Wed Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]] [sdap_parse_range] (0x2000): No sub-attributes for [ipatopologypluginversion] (Wed Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]] [sdap_parse_range] (0x2000): No sub-attributes for [ipatopologyismanaged] (Wed Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]] [sdap_parse_range] (0x2000): No sub-attributes for [ipaDomainLevel] (Wed Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]] [sdap_parse_range] (0x2000): No sub-attributes for [namingContexts] (Wed Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]] [sdap_parse_range] (0x2000): No sub-attributes for [supportedControl] (Wed Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]] [sdap_parse_range] (0x2000): No sub-attributes for [supportedExtension] (Wed Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]] [sdap_parse_range] (0x2000): No sub-attributes for [supportedFeatures] (Wed Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]] [sdap_parse_range] (0x2000): No sub-attributes for [supportedLDAPVersion] (Wed Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]] [sdap_parse_range] (0x2000): No sub-attributes for [supportedSASLMechanisms] (Wed Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]] [sdap_parse_range] (0x2000): No sub-attributes for [defaultNamingContext] (Wed Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]] [sdap_parse_range] (0x2000): No sub-attributes for [lastUSN] (Wed Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]] [sdap_process_result] (0x2000): Trace: sh[0x558252c35750], connected[1], ops[0x558252c36640], ldap[0x558252c130c0] (Wed Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]] [sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_RESULT] (Wed Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]] [sdap_get_generic_op_finished] (0x0400): Search result: Success(0), no errmsg set (Wed Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]] [sdap_op_destructor] (0x2000): Operation 1 finished (Wed Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]] [sdap_get_rootdse_done] (0x2000): Got rootdse (Wed Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]] [sdap_get_rootdse_done] (0x2000): Skipping auto-detection of match rule (Wed Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]] [get_naming_context] (0x0200): Using value from [defaultNamingContext] as naming context. (Wed Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]] [sdap_set_search_base] (0x0100): Setting option [ldap_sudo_search_base] to [dc=ipa,dc=example,dc=com]. (Wed Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]] [common_parse_search_base] (0x0100): Search base added: [SUDO][dc=ipa,dc=example,dc=com][SUBTREE][] (Wed Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]] [sdap_get_server_opts_from_rootdse] (0x4000): USN value: 41151 (int: 41151) (Wed Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]] [sdap_kinit_send] (0x0400): Attempting kinit (default, host/ipa-lx-test-debian9.ipa.example.com, ipa.example.com, 86400) (Wed Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]] [sdap_kinit_next_kdc] (0x1000): Resolving next KDC for service IPA (Wed Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]] [fo_resolve_service_send] (0x0100): Trying to resolve service 'IPA' (Wed Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]] [get_server_status] (0x1000): Status of server 'ipa-lx-test-02.ipa.example.com' is 'name resolved' (Wed Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]] [fo_resolve_service_activate_timeout] (0x2000): Resolve timeout set to 6 seconds (Wed Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]] [resolve_srv_send] (0x0200): The status of SRV lookup is resolved (Wed Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]] [get_server_status] (0x1000): Status of server 'ipa-lx-test-02.ipa.example.com' is 'name resolved' (Wed Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]] [be_resolve_server_process] (0x1000): Saving the first resolved server (Wed Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]] [be_resolve_server_process] (0x0200): Found address for server ipa-lx-test-02.ipa.example.com: [x.x.x.x] TTL 1200 (Wed Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]] [sdap_kinit_kdc_resolved] (0x1000): KDC resolved, attempting to get TGT... (Wed Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]] [create_tgt_req_send_buffer] (0x0400): buffer size: 81 (Wed Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]] [child_handler_setup] (0x2000): Setting up signal handler up for pid [2104] (Wed Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]] [child_handler_setup] (0x2000): Signal handler set up for pid [2104] (Wed Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]] [set_tgt_child_timeout] (0x0400): Setting 6 seconds timeout for tgt child (Wed Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]] [sdap_process_result] (0x2000): Trace: sh[0x558252c35750], connected[1], ops[(nil)], ldap[0x558252c130c0] (Wed Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]] [sdap_process_result] (0x2000): Trace: end of ldap_result list (Wed Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]] [write_pipe_handler] (0x0400): All data has been sent! (Wed Aug 23 16:07:17 2017) [sssd[be[ipa.example.com]]] [get_tgt_timeout_handler] (0x4000): timeout for sending SIGTERM to tgt child [2104] reached. (Wed Aug 23 16:07:17 2017) [sssd[be[ipa.example.com]]] [get_tgt_timeout_handler] (0x0400): Setting 2 seconds timeout for sending SIGKILL to tgt child (Wed Aug 23 16:07:17 2017) [sssd[be[ipa.example.com]]] [read_pipe_handler] (0x0400): EOF received, client finished (Wed Aug 23 16:07:17 2017) [sssd[be[ipa.example.com]]] [child_sig_handler] (0x1000): Waiting for child [2104]. (Wed Aug 23 16:07:17 2017) [sssd[be[ipa.example.com]]] [child_sig_handler] (0x0020): child [2104] failed with status [7]. (Wed Aug 23 16:07:17 2017) [sssd[be[ipa.example.com]]] [child_callback] (0x0020): LDAP child was terminated due to timeout (Wed Aug 23 16:07:17 2017) [sssd[be[ipa.example.com]]] [sdap_kinit_done] (0x0080): Communication with KDC timed out, trying the next one (Wed Aug 23 16:07:17 2017) [sssd[be[ipa.example.com]]] [_be_fo_set_port_status] (0x8000): Setting status: PORT_NOT_WORKING. Called from: ../src/providers/ldap/sdap_async_connection.c: sdap_kinit_done: 1207 (Wed Aug 23 16:07:17 2017) [sssd[be[ipa.example.com]]] [fo_set_port_status] (0x0100): Marking port 389 of server 'ipa-lx-test-02.ipa.example.com' as 'not working' (Wed Aug 23 16:07:17 2017) [sssd[be[ipa.example.com]]] [fo_set_port_status] (0x0400): Marking port 389 of duplicate server 'ipa-lx-test-02.ipa.example.com' as 'not working' | Ok, second server was found, but we ran in an timeout getting a TGT. If i manually try to get a kerberos ticket it works, but with a long delay. ipa-lx-test-debian9.ipa.example.com’s sssd.conf: |[domain/ipa.example.com] cache_credentials = True krb5_store_password_if_offline = True ipa_domain = ipa.example.com id_provider = ipa auth_provider = ipa access_provider = ipa ipa_hostname = ipa-lx-test-debian9.ipa.example.com chpass_provider = ipa ipa_dyndns_update = True ipa_server = _srv_, ipa-lx-test-01.ipa.example.com ldap_tls_cacert = /etc/ipa/ca.crt #subdomain_homedir = /home/%u fallback_homedir = /home/%u default_shell = /bin/bash shell_fallback = /bin/bash debug_level = 10 [sssd] services = nss, sudo, pam, ssh config_file_version = 2 domains = nbg.webtrekk.com default_domain_suffix = example.com full_name_format = %1$s debug_level = 10 [nss] debug_level = 10 [pam] [sudo] [autofs] [ssh] debug_level = 10 [pac] [ifp] | So some need is help. Michael

2 6

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users August 2017