August 2017 - FreeIPA-users - Fedora mailing-lists

Re: Freeipa Certficates issues
by Florence Blanc-Renaud 01 Sep '17

01 Sep '17

On 08/29/2017 06:43 PM, Julien Honore wrote: > Hi Florence, > > Thank you for the reply. > > When I execute the command sudo kinit -kt /etc/krb5.keytab > the result is : > kinit: Clients credentials have been revoked while getting initial credentials > > When I try the command ipa-getkeytab, I don't have the same option. > Hi, (putting mailing list back in the recipients list) you are right, the --retrieve option was added only in IPA 4.x. If you run ipa-getkeytab without the -r option, it will request a new host keytab (all other keytabs previously obtained will be invalidated). So this should unblock certmonger, but if you were using the host keytab in other places you will need to overwrite them with the new keytab. Flo > Thank you. > > Julien Honore. > > ----- Original Message ----- > From: "Florence Blanc-Renaud" <flo(a)redhat.com> > To: "freeipa-users" <freeipa-users(a)lists.fedorahosted.org> > Cc: "Julien Honore" <jhonore(a)bmad.tech> > Sent: Tuesday, 29 August, 2017 12:14:10 > Subject: Re: [Freeipa-users] Freeipa Certficates issues > > On 08/29/2017 04:09 PM, Julien Honore via FreeIPA-users wrote: >> >> Hi, >> >> I have an issue with my freeipa server. >> >> The certificates expired and I can't resubmit. >> >> I put the date before the expiration of the certs. >> >> The result of ipa-getcert list : >> >> >> Number of certificates and requests being tracked: 8. >> Request ID '20150805183502': >> status: MONITORING >> ca-error: Error setting up ccache for "host" service on client using >> default keytab: Clients credentials have been revoked. >> stuck: no >> key pair storage: >> type=NSSDB,location='/etc/dirsrv/slapd-VIT-LAN',nickname='Server-Cert',token='NSS >> Certificate DB',pinfile='/etc/dirsrv/slapd-VIT-LAN/pwdfile.txt' >> certificate: >> type=NSSDB,location='/etc/dirsrv/slapd-VIT-LAN',nickname='Server-Cert',token='NSS >> Certificate DB' >> CA: IPA >> issuer: CN=Certificate Authority,O=VIT.LAN >> subject: CN=auth0.vit.lan,O=VIT.LAN >> expires:2017-08-05 18 <callto:2017-08-05 18>:35:02 UTC >> key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment >> eku: id-kp-serverAuth,id-kp-clientAuth >> pre-save command: >> post-save command: >> track: yes >> auto-renew: yes >> Request ID '20150805183539': >> status: MONITORING >> ca-error: Error setting up ccache for "host" service on client using >> default keytab: Clients credentials have been revoked. >> stuck: no >> key pair storage: >> type=NSSDB,location='/etc/dirsrv/slapd-PKI-IPA',nickname='Server-Cert',token='NSS >> Certificate DB',pinfile='/etc/dirsrv/slapd-PKI-IPA/pwdfile.txt' >> certificate: >> type=NSSDB,location='/etc/dirsrv/slapd-PKI-IPA',nickname='Server-Cert',token='NSS >> Certificate DB' >> CA: IPA >> issuer: CN=Certificate Authority,O=VIT.LAN >> subject: CN=auth0.vit.lan,O=VIT.LAN >> expires:2017-08-05 18 <callto:2017-08-05 18>:35:39 UTC >> key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment >> eku: id-kp-serverAuth,id-kp-clientAuth >> pre-save command: >> post-save command: >> track: yes >> auto-renew: yes >> Request ID '20150805183647': >> status: MONITORING >> ca-error: Error setting up ccache for "host" service on client using >> default keytab: Clients credentials have been revoked. >> stuck: no >> key pair storage: >> type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS >> Certificate DB',pinfile='/etc/httpd/alias/pwdfile.txt' >> certificate: >> type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS >> Certificate DB' >> CA: IPA >> issuer: CN=Certificate Authority,O=VIT.LAN >> subject: CN=auth0.vit.lan,O=VIT.LAN >> expires:2017-08-05 18 <callto:2017-08-05 18>:36:47 UTC >> key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment >> eku: id-kp-serverAuth,id-kp-clientAuth >> pre-save command: >> post-save command: >> track: yes >> auto-renew: yes >> >> If someone can help me with this issue ? It will be very helpful >> >> Directory Service: RUNNING >> KDC Service: RUNNING >> KPASSWD Service: RUNNING >> MEMCACHE Service: RUNNING >> HTTP Service: RUNNING >> CA Service: RUNNING >> ADTRUST Service: RUNNING >> EXTID Service: RUNNING >> >> FreeIpa V3. >> >> Thank you >> >> Julien Honore >> >> >> >> >> >> >> _______________________________________________ >> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org >> To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org >> > Hi, > > I have very little experience with IPA v3, but let's try anyway... If > things didn't change too much, certmonger's IPA helper is using > /etc/krb5.keytab to connect to IPA server. Can you check if this keytab > is still valid using > $ sudo kinit -kt /etc/krb5.keytab > > If the operation fails, this is probably the root cause of your issue. > The utility ipa-getkeytab will allow you to get the host keytab (with > the --retrieve option and --principal=host/$HOSTNAME@$DOMAINNAME). > > HTH, > Flo >

2 3

using external passwords
by Charles Hedrick 31 Aug '17

31 Aug '17

We have a department that would like to use IPA, but would like users to use their University passwords. I conjecture that we can do that by generating users with random passwords, but setting the default authentication as RADIUS, and using a RADIUS server that authenticates with the University using LDAP. Does this sound workable?

2 1

sudo policy doesn't work since host is installed with CNAME
by Z D 31 Aug '17

31 Aug '17

Hi there, we're using ipa-server-4.4.0 (without its own DNS) and are facing the situation with A/CNAME host. Basically a host is installed with CNAME as the OS, and IPA is aware of only A record since host is joined to IPA domain with its A record. The A record is member of proper host group and there is relevant sudo policy, but that doesn't work since CNAME is not added to IPA domain. Is there any better resolution for this, except adding CNAME to IPA domain and to relevant hostgroup. This command as expected reports error. # ipa host-show <CNAME> ipa: ERROR: <CNAME>: host not found and command # ipa host-show <A_record> gives expected output ... Host name: <FQDN> Principal name: host/<FQDN>@<DOMAIN> etc thanks, Zarko

3 5

kerbores nfs client problem
by San Zhang 30 Aug '17

30 Aug '17

I set up a kerberos-aware nfs server and some clients. I mount with "-o sec=krb5" successfully first time. For some reason, I change the krb5.keytab by copying a backup keytab and rerunnig ipa-getkeytab command, and then reboot the nfs server. Now the client mounting succesfully before is unable to mount any more unless reboot, but other new clients are able to mount. How to fix those clients without rebooting.

1 0

nfs server with multiple IP addresses
by San Zhang 30 Aug '17

30 Aug '17

I have a ipa server (ipa.example.com) with DNS service and a kerberos-aware nfs server (nfs.example.com). The nfs server has two IP addresses: 192.168.2.10, 192.168.3.10. The two networks 192.168.2.0/24 and 192.168.3.0/24 are not connected to each other directly. I hope the DNS server resolve nfs.example.com to 192.168.2.10 in 192.168.2.0/24 and to 192.168.3.10 in 192.168.3.0/24. How to setup the DNS server?

1 0

[CentOS 7.5] error message during LDAP backup
by Jochen Hein 30 Aug '17

30 Aug '17

I've upgraded my FreeIPA servers to CentOS 7.5 (CR). After that I have the following new messages during backup: Aug 30 01:34:34 freeipa1 ns-slapd: [30/Aug/2017:01:34:34.225932118 +0200] - ERR - dblayer_copy_directory - Backend instance "cldb" does not exist; Instance path /var/lib/dirsrv/slapd-EXAMPLE-ORG/cldb could be invalid. Aug 30 01:34:34 freeipa1 ns-slapd: [30/Aug/2017:01:34:34.260896691 +0200] - ERR - dblayer_backup - Error in copying directory (/var/lib/dirsrv/slapd-EXAMPLE-ORG/cldb -> /var/lib/dirsrv/slapd-EXAMPLE-ORG/bak/EXAMPLE-ORG/.repl_changelog_backup): err=-1 The path /var/lib/dirsrv/slapd-EXAMPLE-ORG/cldb is valid and contains the following files: [root@freeipa1 cldb]# ls -la insgesamt 6592 drwxr-xr-x. 2 dirsrv dirsrv 4096 28. Aug 16:12 . drwxrwx---. 6 dirsrv dirsrv 47 1. Dez 2016 .. -rw-------. 1 dirsrv dirsrv 5668864 30. Aug 08:54 105a1694-b80711e6-a735c4e0-b4c95686_583b44c1000000040000.db -rw-r--r--. 1 dirsrv dirsrv 0 28. Aug 16:12 105a1694-b80711e6-a735c4e0-b4c95686.sema -rw-------. 1 dirsrv dirsrv 1064960 30. Aug 08:52 6464fab3-b80711e6-a735c4e0-b4c95686_5840787c0000000d0000.db -rw-r--r--. 1 dirsrv dirsrv 0 28. Aug 16:12 6464fab3-b80711e6-a735c4e0-b4c95686.sema -rw-------. 1 dirsrv dirsrv 30 1. Dez 2016 DBVERSION The directory /var/lib/dirsrv/slapd-EXAMPLE-ORG/bak/EXAMPLE-ORG/.repl_changelog_backup does not exist, all I have is: [root@freeipa1 cldb]# ls -la /var/lib/dirsrv/slapd-EXAMPLE-ORG/bak/ insgesamt 0 drwxrwx---. 2 dirsrv dirsrv 6 30. Aug 01:34 . drwxrwx---. 6 dirsrv dirsrv 47 1. Dez 2016 .. I'll create /var/lib/dirsrv/slapd-EXAMPLE-ORG/bak/EXAMPLE-ORG/.repl_changelog_backup manually and will see if that helps. I think it should be created during upgrade or backup if it is missing. What do you think? Jochen -- This space is intentionally left blank.

2 2

"Cannot obtain CA certificate" error when trying to install, but works on older instances; force fails
by greg＠greg-gilbert.com 30 Aug '17

30 Aug '17

I'm really at a loss on this one. I have a bunch of old server images (from 2 months ago) that can run ipa-client-install just fine. When I created a new image, though, I get this error (from the install logs): DEBUG flushing ldap://ipa.services.example:389 from SchemaCache DEBUG retrieving schema for SchemaCache url=ldap://ipa.services.example:389 conn=<ldap.ldapobject.SimpleLDAPObject instance at 0x7ff6a4e67560> DEBUG get_ca_certs_from_ldap() error: 'ipa.services.example' doesn't have a certificate. DEBUG 'ipa.services.example' doesn't have a certificate. ERROR In unattended mode without a One Time Password (OTP) or without --ca-cert-file You must specify --force to retrieve the CA cert using HTTP ERROR Cannot obtain CA certificate HTTP certificate download requires --force ERROR Installation failed. Rolling back changes. ERROR IPA client is not configured on this system. For comparison, the old images work as expected: DEBUG flushing ldap://ipa.services.example:389 from SchemaCache DEBUG retrieving schema for SchemaCache url=ldap://ipa.services.example:389 conn=<ldap.ldapobject.SimpleLDAPObject instance at 0x7f2a0cb6e128> INFO Successfully retrieved CA cert Subject: CN=Certificate Authority,O=IPA.SERVICES.example Issuer: CN=Certificate Authority,O=IPA.SERVICES.example Valid From: Wed Apr 05 21:11:13 2017 UTC Valid Until: Sun Apr 05 21:11:13 2037 UTC It's literally the same build script, so nothing there has changed. The old images still work even now, so I don't think it's a DNS issue. I tried running update-ca-certificates, but that did nothing. I tried restarting the FreeIPA server, nothing changed. If I try --forceing the install, this happens: Enrolled in IPA realm IPA.SERVICES.EXAMPLE Created /etc/ipa/default.conf Traceback (most recent call last): File "/usr/sbin/ipa-client-install", line 3099, in <module> sys.exit(main()) File "/usr/sbin/ipa-client-install", line 3080, in main rval = install(options, env, fstore, statestore) File "/usr/sbin/ipa-client-install", line 2727, in install api.finalize() File "/usr/lib/python2.7/dist-packages/ipalib/plugable.py", line 656, in finalize self.__do_if_not_done('load_plugins') File "/usr/lib/python2.7/dist-packages/ipalib/plugable.py", line 370, in __do_if_not_done getattr(self, name)() File "/usr/lib/python2.7/dist-packages/ipalib/plugable.py", line 534, in load_plugins self.import_plugins(module) File "/usr/lib/python2.7/dist-packages/ipalib/plugable.py", line 572, in import_plugins module = importlib.import_module(name) File "/usr/lib/python2.7/importlib/__init__.py", line 37, in import_module __import__(name) File "/usr/lib/python2.7/dist-packages/ipalib/plugins/cert.py", line 29, in <module> from ipalib import pkcs10 File "/usr/lib/python2.7/dist-packages/ipalib/pkcs10.py", line 79, in <module> class _PrincipalName(univ.Sequence): File "/usr/lib/python2.7/dist-packages/ipalib/pkcs10.py", line 84, in _PrincipalName namedtype.NamedType('name-string', univ.SequenceOf(char.GeneralString()).subtype( TypeError: __init__() takes exactly 1 argument (2 given) Really not sure what's going on here; does anyone have advice on how to fix this? Thanks!

5 11

Why "w" does not list AD users
by Supratik Goswami 29 Aug '17

29 Aug '17

I have configured trust between AD and IPA and Linux machines are member of IPA domain. When I log into any of the Linux machine and type "w" it does not list the user AD user with which I just logged in. Is this a expected behaviour or am I missing something? -- Warm Regards Supratik

2 17

User ID overrides staying persistent in cache for AD users
by Eddleman, David 29 Aug '17

29 Aug '17

So I've created a ID override on the IPA master called "TestShellView" to test out changing per-user requirements for shells. Verify the ID override on the master: [root@ipamaster01 ~]# ipa idoverrideuser-find TestShellView -------------------------- 1 User ID override matched -------------------------- Anchor to override: user@domain GECOS: TEST ID VIEW Login shell: /bin/ksh ---------------------------- Number of entries returned 1 ---------------------------- Good, looks as expected. I also tested the GECOS override just in case such a thing was needed in the future. [root@rhel7template ~]# getent passwd user@domain user@domain:*:689709720:689709720:TEST ID VIEW:/home/domain/user:/bin/ksh Looks good. It's doing what it's supposed to be doing. So now we remove the GECOS and shell settings in the webUI and verify via CLI that they're gone: [root@ipamaster01 ~]# ipa idoverrideuser-find TestShellView -------------------------- 1 User ID override matched -------------------------- Anchor to override: user@domain ---------------------------- Number of entries returned 1 ---------------------------- Still good so far. No overrides defined. Clear the cache to verify that the data is fresh. [root@rhel7template ~]# sss_cache -E [root@rhel7template ~]# getent passwd user@domain user@domain:*:689709720:689709720:TEST ID VIEW:/home/domain/user:/bin/ksh That's not right... The default and fallback don't call for ksh either: [root@rhel7template ~]# cat /etc/sssd/sssd.conf | grep shell allowed_shells = /bin/bash,/bin/sh,/bin/ksh shell_fallback = /sbin/nologin default_shell = /bin/bash So let's try purging the cache files... [root@rhel7template ~]# cd /var/lib/sss/db/ [root@rhel7template db]# ls <cache file listing> [root@rhel7template db]# rm -f * [root@rhel7template db]# ls [root@rhel7template db]# service sssd restart Redirecting to /bin/systemctl restart sssd.service [root@rhel7template db]# getent passwd user@domain user@domain:*:689709720:689709720:Username:/home/domain/user:/bin/bash Now it's showing what it's supposed to. This shouldn't be happening. If we have to purge sss cache files each time we make an ID Override change, this won't work. Is this expected behavior, or is this a bug? David Eddleman

3 8

Freeipa Certficates issues
by Julien Honore 29 Aug '17

29 Aug '17

Hi, I have an issue with my freeipa server. The certificates expired and I can't resubmit. I put the date before the expiration of the certs. The result of ipa-getcert list : Number of certificates and requests being tracked: 8. Request ID '20150805183502': status: MONITORING ca-error: Error setting up ccache for "host" service on client using default keytab: Clients credentials have been revoked. stuck: no key pair storage: type=NSSDB,location='/etc/dirsrv/slapd-VIT-LAN',nickname='Server-Cert',token='NSS Certificate DB',pinfile='/etc/dirsrv/slapd-VIT-LAN/pwdfile.txt' certificate: type=NSSDB,location='/etc/dirsrv/slapd-VIT-LAN',nickname='Server-Cert',token='NSS Certificate DB' CA: IPA issuer: CN=Certificate Authority,O=VIT.LAN subject: CN=auth0.vit.lan,O=VIT.LAN expires: 2017-08-05 18 :35:02 UTC key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment eku: id-kp-serverAuth,id-kp-clientAuth pre-save command: post-save command: track: yes auto-renew: yes Request ID '20150805183539': status: MONITORING ca-error: Error setting up ccache for "host" service on client using default keytab: Clients credentials have been revoked. stuck: no key pair storage: type=NSSDB,location='/etc/dirsrv/slapd-PKI-IPA',nickname='Server-Cert',token='NSS Certificate DB',pinfile='/etc/dirsrv/slapd-PKI-IPA/pwdfile.txt' certificate: type=NSSDB,location='/etc/dirsrv/slapd-PKI-IPA',nickname='Server-Cert',token='NSS Certificate DB' CA: IPA issuer: CN=Certificate Authority,O=VIT.LAN subject: CN=auth0.vit.lan,O=VIT.LAN expires: 2017-08-05 18 :35:39 UTC key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment eku: id-kp-serverAuth,id-kp-clientAuth pre-save command: post-save command: track: yes auto-renew: yes Request ID '20150805183647': status: MONITORING ca-error: Error setting up ccache for "host" service on client using default keytab: Clients credentials have been revoked. stuck: no key pair storage: type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS Certificate DB',pinfile='/etc/httpd/alias/pwdfile.txt' certificate: type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS Certificate DB' CA: IPA issuer: CN=Certificate Authority,O=VIT.LAN subject: CN=auth0.vit.lan,O=VIT.LAN expires: 2017-08-05 18 :36:47 UTC key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment eku: id-kp-serverAuth,id-kp-clientAuth pre-save command: post-save command: track: yes auto-renew: yes If someone can help me with this issue ? It will be very helpful Directory Service: RUNNING KDC Service: RUNNING KPASSWD Service: RUNNING MEMCACHE Service: RUNNING HTTP Service: RUNNING CA Service: RUNNING ADTRUST Service: RUNNING EXTID Service: RUNNING FreeIpa V3. Thank you Julien Honore

2 1

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users August 2017