September 2017 - FreeIPA-users - Fedora mailing-lists

using freeipa with an AWS elastic load balancer
by ridha.zorgui＠infor.com 13 Oct '18

13 Oct '18

I set up a FreeIPA master and replica behind an elastic load balancer in AWS cloud. FreeIPA Clients will be contacting the replica and the master sever through the load balancer so the dns name used when configurting the clients is the ELB CNAME. The problem is when retreiving ldap data and during the authentication, the SSL handshake fails as the certificate sent back from the master or replica has a hostname different than the one used in the sssd ( the ELB CNAME). so the connection is terminated. There is a workaround which is the use reqcert=allow but this bring a security issue with a MITM attack. another solution i found is the use SAN. I was able to add the ELB DNS as a SAN in freeipa servers certificate. i made sure it is there by downloading the certificate and checking that the elb san exist but when testing it the same problem remain. Please help.

3 3

Renewal of External Third Party SSL Cert
by Alka Murali 29 Nov '17

29 Nov '17

Hello, I am using the embedded CA For FreeIPA as well as external CA Signed by Digicert. However, the certificate will be expiring next month. After renewal, do I need to install the certificate again using the same steps mentioned within the link https://www.freeipa.org/page/Using_3rd_part_certificates_for_HTTP/LDAP Similarly how will I be able to update the new certificate in my IPA Clients too. Do I need to follow the steps below on all IPA Clients? ----- certutil -A -d /etc/pki/nssdb -n 'IPA CA' -t CT,C,C -a -i ipa.crt cp ipa.crt /etc/ipa/ca.crt ------- Can you please brief up the exact procedure to follow for the third party SSL cert renewal. Thanks and Regards, Alka Murali

3 4

ipa-server-install fails on fresh install
by John R. Shannon 18 Nov '17

18 Nov '17

Running ipa-server-install I get: Configuring client side components Using existing certificate '/etc/ipa/ca.crt'. Client hostname: auth.test.internal.johnrshannon.com Realm: TEST.INTERNAL.JOHNRSHANNON.COM DNS Domain: test.internal.johnrshannon.com IPA Server: auth.test.internal.johnrshannon.com BaseDN: dc=test,dc=internal,dc=johnrshannon,dc=com Skipping synchronizing time with NTP server. New SSSD config will be created Configured sudoers in /etc/nsswitch.conf Configured /etc/sssd/sssd.conf trying https://auth.test.internal.johnrshannon.com/ipa/json [try 1]: Forwarding 'schema' to json server 'https://auth.test.internal.johnrshannon.com/ipa/json' No valid Negotiate header in server response The ipa-client-install command failed. See /var/log/ipaclient-install.log for more information ipa.ipapython.install.cli.install_tool(CompatServerMasterInstall): ERROR Configuration of client side components failed! The system is a fresh, up to date, Fedora 26: 4.12.12-300.fc26.x86_64 configured to include the FREE-IPA repository. FREE-IPA was installed yesterday with: dnf install freeipa-* and running ipa-server-install. I'm not sure how to proceed. I want to use pkinit. The log file shows that an exception was raised during the execution of: 2017-09-15T14:52:27Z DEBUG args=/usr/sbin/ipa-client-install --on-master --unattended --domain test.internal.johnrshannon.com --server auth.test.internal.johnrshannon.com --realm TEST.INTERNAL.JOHNRSHANNON.COM --hostname auth.test.internal.johnrshannon.com -- John R. Shannon john(a)johnrshannon.com

4 15

Can't create new CA replica
by john.bowman＠zayo.com 17 Nov '17

17 Nov '17

Since taking over our FreeIPA environment I've been unable to create a new CA replica. A bunch of failed attempts and upgrades over the last year and I keep running in to issues. After my latest attempt I noticed something that I had not seen before (likely a result of an recent upgrade) and I was wondering if this would cause a CA install to fail. Our env: 3 x ipa-server-3.0.0-51.el6.x86_64 3 x ipa-server-4.4.0-14.el7_3.7.x86_64 2 of the 3.x IPA servers are currently acting as CAs and I've been trying to create a new 4.x CA replica in order to start removing the 3.x IPA servers. I've been able to do a simple test with vanilla CentOS 6.9 and 7.3 and it seems to work fine as far as I can tell but when I try it in our environment it fails. I noticed this error in one of the logs and something jumped out at me that I had never seen before: [14/Jun/2017:06:49:44][http-bio-8443-exec-3]: === Finalization === [14/Jun/2017:06:49:44][http-bio-8443-exec-3]: Updating existing security domain [14/Jun/2017:06:49:44][http-bio-8443-exec-3]: isSDHostDomainMaster(): Getting domain.xml from CA... [14/Jun/2017:06:49:44][http-bio-8443-exec-3]: ConfigurationUtils: getting domain info [14/Jun/2017:06:49:44][http-bio-8443-exec-3]: ConfigurationUtils: GET https://ipa-master.domain.tld:443/ca/admin/ca/getDomainXML [14/Jun/2017:06:49:44][http-bio-8443-exec-3]: ConfigurationUtils: status: 0 [14/Jun/2017:06:49:44][http-bio-8443-exec-3]: ConfigurationUtils: domain info: <?xml version="1.0" encoding="UTF-8" standalone="no"?><DomainInfo><Name>IPA</Name><CAList><CA ><Host>ipa-master.domain.tld</Host><SecurePort>443</SecurePort><SecureAgentPort>443</SecureAgentPort><SecureAdminPort>443</SecureAdminPort><UnSecurePort>80</UnSecurePort><Sec ureEEClientAuthPort>443</SecureEEClientAuthPort><DomainManager>TRUE</DomainManager><Clone>TRUE</Clone><SubsystemName>pki-cad</SubsystemName></CA><CA><Host>ipa-replica1.domain.tld </Host><SecurePort>443</SecurePort><SecureAgentPort>443</SecureAgentPort><SecureAdminPort>443</SecureAdminPort><UnSecurePort>80</UnSecurePort><SecureEEClientAuthPort>443</S ecureEEClientAuthPort><DomainManager>TRUE</DomainManager><Clone>TRUE</Clone><SubsystemName>pki-cad</SubsystemName></CA><CA><Host>ipa-replica2.domain.tld</Host><SecurePort>443</Se curePort><SecureAgentPort>443</SecureAgentPort><SecureAdminPort>443</SecureAdminPort><UnSecurePort>80</UnSecurePort><SecureEEClientAuthPort>443</SecureEEClientAuthPort><Dom ainManager>TRUE</DomainManager><Clone>TRUE</Clone><SubsystemName>pki-cad</SubsystemName></CA><SubsystemCount>3</SubsystemCount></CAList><OCSPList><SubsystemCount>0</Subsyst emCount></OCSPList><KRAList><SubsystemCount>0</SubsystemCount></KRAList><RAList><SubsystemCount>0</SubsystemCount></RAList><TKSList><SubsystemCount>0</SubsystemCount></TKSL ist><TPSList><SubsystemCount>0</SubsystemCount></TPSList></DomainInfo> [14/Jun/2017:06:49:44][http-bio-8443-exec-3]: Cloning a domain master [14/Jun/2017:06:49:44][http-bio-8443-exec-3]: Update security domain using admin interface [14/Jun/2017:06:49:44][http-bio-8443-exec-3]: ConfigurationUtils: updateDomainXML start hostname=ipa-master.domain.tld port=443 [14/Jun/2017:06:49:44][http-bio-8443-exec-3]: ConfigurationUtils: POST https://ipa-master.domain.tld:443/ca/admin/ca/updateDomainXML [14/Jun/2017:06:49:44][http-bio-8443-exec-3]: Unable to access admin interface: javax.ws.rs.NotFoundException: HTTP 404 Not Found [14/Jun/2017:06:49:44][http-bio-8443-exec-3]: Update security domain using agent interface [14/Jun/2017:06:49:44][http-bio-8443-exec-3]: ConfigurationUtils: updateDomainXML start hostname=ipa-master.domain.tld port=443 [14/Jun/2017:06:49:44][http-bio-8443-exec-3]: updateDomainXML() nickname=subsystemCert cert-pki-ca [14/Jun/2017:06:49:44][http-bio-8443-exec-3]: ConfigurationUtils: POST https://ipa-master.domain.tld:443/ca/agent/ca/updateDomainXML [14/Jun/2017:06:49:45][http-bio-8443-exec-3]: Server certificate: [14/Jun/2017:06:49:45][http-bio-8443-exec-3]: - subject: CN=ipa-master.domain.tld,O=DOMAIN.US [14/Jun/2017:06:49:45][http-bio-8443-exec-3]: - issuer: CN=Certificate Authority,O=DOMAIN.US [14/Jun/2017:06:49:45][http-bio-8443-exec-3]: ConfigurationUtils: updateDomainXML: status=1 [14/Jun/2017:06:49:45][http-bio-8443-exec-3]: Unable to update security domain: 2 java.io.IOException: Unable to update security domain: 2 The ipa-master.domain.tld is one of the current RHEL 6.9 FreeIPA 3.x servers but the other two listed in that domainxml file one does not exist (it may have at some point been renamed) and the other server is not a CA replica but it is a replica. Is it possible this bad info would cause a failure when trying to create a new CA replica? If so is it something I can try cleaning up? Any info would be appreciated. Thanks!

5 11

sudo not working with hostgroups
by Michael Gusek 10 Nov '17

10 Nov '17

Hello, we are using FreeIPA in the current version 4.5 under current CentOS 7. In order to grant access we are using sudo rules in conjunction with host groups. We have found that these rules do not work under Debian 8/9 and Ubuntu 16.04, but with Centos 6/7. Suggestions from the web require a set nisdomainname (nisdomainname example.com), which does not work. In fact, the nisdomainname is not set under CentOS 6, but under Centos 7 it is. What settings under Debian/Ubuntu must be made for sudo rules to work with hostgroups? Debian 8 Debian 9 Ubuntu 16.04 Centos 6 Centos 7 sssd-Version 1.15.0-3 1.15.0-3 1.15.0-3ubuntu2~ubuntu16.04.1~ppa1 sssd-1.15.3-1.el6.x86_64 sssd-1.15.2-50.el7_4.2.x86_64 sudo-Version 1.8.10p3-1+deb8u4 1.8.19p1-2.1 1.8.16-0ubuntu1.5 sudo-1.8.6p3-29.el6_9.x86_64 sudo-1.8.19p2-11.el7_4.x86_64 Regards, Michael -- ________________________________________________ *Michael**Gusek*| System Administrator| Webtrekk GmbH | *t*+49 30 755 415 302| *f *+49 30 755 415 100 | *w *www.webtrekk.com <https://www.webtrekk.com/?wt_mc=signature.-.-.-.homepageURL> Amtsgericht/Local Court Berlin, HRB 93435 B | Geschäftsführer/CEO Christian Sauer und Wolf Lichtenstein

5 9

Find IPA user or computer account from windows
by Ronald Wimmer 08 Nov '17

08 Nov '17

Is it possible to find an IPA user or computer account from a windows (AD) machine [trust between ipa and ad domain is set up]? If I try that, all i get is a message that no object can be found. Regards, Ronald

2 2

ERROR: CIFS server communication error: Memory allocation error (both may be "None") upon establishing trust
by Bart J 13 Oct '17

13 Oct '17

Hi all, I have been trying to set up one-way trust for quite a while. I thought I have everything sorted out but when I tried to move from test environment to production, I received error below upon trying to set up trust with ipa trust add: ipa trust-add --type=ad my.domain.com --admin adminaccount --password ipa: ERROR: CIFS server communication error: code "-1073741801", message "Memory allocation error" (both may be "None") Googling returned some results that suggested upgrading samba and freeipa versions. I did so and now I am using: freeipa - 4.5.3-1.fc26 samba - 2:4.6.7-0.fc26 This however didn't change the result. What can be important here is that my.domain.com is a child domain of domain.com in terms of AD (it is a separate domain controller). Can you please advise how to fix it?

2 4

Installation problems fro version 4.5.0 on centos 7
by Mathew Vandystadt 11 Oct '17

11 Oct '17

Hello, I'm having problems with the installation of freeipa on a fresh centos 7 box. The installation always fails on [6/45]: starting directory server. I do see that the daemon is up and that its listening on localhost. My audit logs are ok and I get the same result with selinux in permissive mode. There seems to be a problem with the ldap daemon after the initial configuration. Thanks Installation logs: 017-09-25T21:38:16Z DEBUG [6/45]: starting directory server 2017-09-25T21:38:16Z DEBUG Starting external process 2017-09-25T21:38:16Z DEBUG args=/bin/systemctl start dirsrv(a)MYDOMAIN.service 2017-09-25T21:38:17Z DEBUG Process finished, return code=0 2017-09-25T21:38:17Z DEBUG stdout= 2017-09-25T21:38:17Z DEBUG stderr= 2017-09-25T21:38:17Z DEBUG Starting external process 2017-09-25T21:38:17Z DEBUG args=/bin/systemctl is-active dirsrv(a)MYDOMAIN.service 2017-09-25T21:38:17Z DEBUG Process finished, return code=0 2017-09-25T21:38:17Z DEBUG stdout=active 2017-09-25T21:38:17Z DEBUG stderr= 2017-09-25T21:38:17Z DEBUG wait_for_open_ports: localhost [389] timeout 300 2017-09-25T21:43:17Z DEBUG Traceback (most recent call last): dirsrv access logs: [25/Sep/2017:17:43:07.606371827 -0400] conn=291 fd=64 slot=64 connection from 127.0.0.1 to 127.0.0.1 [25/Sep/2017:17:43:07.606484146 -0400] conn=291 op=-1 fd=64 closed - B1 [25/Sep/2017:17:43:08.608386567 -0400] conn=292 fd=64 slot=64 connection from 127.0.0.1 to 127.0.0.1 [25/Sep/2017:17:43:08.608537683 -0400] conn=292 op=-1 fd=64 closed - B1 [25/Sep/2017:17:43:09.610325914 -0400] conn=293 fd=64 slot=64 connection from 127.0.0.1 to 127.0.0.1 [25/Sep/2017:17:43:09.610426954 -0400] conn=293 op=-1 fd=64 closed - B1 [25/Sep/2017:17:43:10.612250521 -0400] conn=294 fd=64 slot=64 connection from 127.0.0.1 to 127.0.0.1 [25/Sep/2017:17:43:10.612362078 -0400] conn=294 op=-1 fd=64 closed - B1 [25/Sep/2017:17:43:11.614026066 -0400] conn=295 fd=64 slot=64 connection from 127.0.0.1 to 127.0.0.1 [25/Sep/2017:17:43:11.614107541 -0400] conn=295 op=-1 fd=64 closed - B1 [25/Sep/2017:17:43:12.616101124 -0400] conn=296 fd=64 slot=64 connection from 127.0.0.1 to 127.0.0.1 [25/Sep/2017:17:43:12.616200037 -0400] conn=296 op=-1 fd=64 closed - B1 [25/Sep/2017:17:43:13.617882733 -0400] conn=297 fd=64 slot=64 connection from 127.0.0.1 to 127.0.0.1 [25/Sep/2017:17:43:13.617985060 -0400] conn=297 op=-1 fd=64 closed - B1 [25/Sep/2017:17:43:14.619732290 -0400] conn=298 fd=64 slot=64 connection from 127.0.0.1 to 127.0.0.1 [25/Sep/2017:17:43:14.619876088 -0400] conn=298 op=-1 fd=64 closed - B1 [25/Sep/2017:17:43:15.621493992 -0400] conn=299 fd=64 slot=64 connection from 127.0.0.1 to 127.0.0.1 [25/Sep/2017:17:43:15.621573126 -0400] conn=299 op=-1 fd=64 closed - B1 [25/Sep/2017:17:43:16.623358799 -0400] conn=300 fd=64 slot=64 connection from 127.0.0.1 to 127.0.0.1 [25/Sep/2017:17:43:16.623456716 -0400] conn=300 op=-1 fd=64 closed - B1 [25/Sep/2017:17:43:17.625111898 -0400] conn=301 fd=64 slot=64 connection from 127.0.0.1 to 127.0.0.1 [25/Sep/2017:17:43:17.625196358 -0400] conn=301 op=-1 fd=64 closed - B1 dirsrv error logs: [25/Sep/2017:17:38:15.521393910 -0400] - INFO - slapd_daemon - slapd started. Listening on All Interfaces port 389 for LDAP requests [25/Sep/2017:17:38:15.589204700 -0400] - INFO - postop_modify_config_dse - The change of nsslapd-ldapilisten will not take effect until the server is restarted [25/Sep/2017:17:38:15.679382495 -0400] - INFO - op_thread_cleanup - slapd shutting down - signaling operation threads - op stack size 1 max work q size 1 max work q stack size 1 [25/Sep/2017:17:38:15.681271086 -0400] - INFO - slapd_daemon - slapd shutting down - waiting for 14 threads to terminate [25/Sep/2017:17:38:15.682461202 -0400] - INFO - slapd_daemon - slapd shutting down - closing down internal subsystems and plugins [25/Sep/2017:17:38:15.688537034 -0400] - INFO - dblayer_pre_close - Waiting for 4 database threads to stop [25/Sep/2017:17:38:16.398165344 -0400] - INFO - dblayer_pre_close - All database threads now stopped [25/Sep/2017:17:38:16.405905222 -0400] - INFO - ldbm_back_instance_set_destructor - Set of instances destroyed [25/Sep/2017:17:38:16.408961140 -0400] - INFO - connection_post_shutdown_cleanup - slapd shutting down - freed 1 work q stack objects - freed 1 op stack objects [25/Sep/2017:17:38:16.521431280 -0400] - INFO - main - slapd stopped. [25/Sep/2017:17:38:16.783464475 -0400] - INFO - main - 389-Directory/1.3.6.1 B2017.249.1616 starting up [25/Sep/2017:17:38:16.795854380 -0400] - INFO - ldbm_instance_config_cachememsize_set - force a minimal value 512000 [25/Sep/2017:17:38:16.805586585 -0400] - NOTICE - ldbm_back_start - found 3882072k physical memory [25/Sep/2017:17:38:16.807181104 -0400] - NOTICE - ldbm_back_start - found 866472k available [25/Sep/2017:17:38:16.808666579 -0400] - NOTICE - ldbm_back_start - cache autosizing: db cache: 155282k [25/Sep/2017:17:38:16.809929384 -0400] - NOTICE - ldbm_back_start - cache autosizing: userRoot entry cache (1 total): 262144k [25/Sep/2017:17:38:16.814989583 -0400] - NOTICE - ldbm_back_start - total cache size: 412420406 B; [25/Sep/2017:17:38:16.817344364 -0400] - NOTICE - dblayer_start - Resizing max db lock count: 10000 -> 50000 [25/Sep/2017:17:38:17.011113138 -0400] - INFO - slapd_daemon - slapd started. Listening on All Interfaces port 389 for LDAP requests [25/Sep/2017:17:38:17.022249715 -0400] - INFO - slapd_daemon - Listening on /var/run/MYDOMAIN.socket for LDAPI requests

3 3

IPA Server Upgrade Error
by Alka Murali 06 Oct '17

06 Oct '17

Hello, Currently my server is running on IPA Server Version 4.4. I have tried to upgrade the Version to 4.5 using the ipa-server-upgrade command and got ended with the following error: -------- 2017-09-26T02:27:32Z DEBUG stderr= 2017-09-26T02:27:50Z DEBUG Loading Index file from '/var/lib/ipa/sysrestore/sysrestore.index' 2017-09-26T02:27:53Z DEBUG Starting external process 2017-09-26T02:27:53Z DEBUG args=/usr/bin/certutil -d /etc/dirsrv/slapd-LGA-NET-SG -L -n Server-Cert -a -f /etc/dirsrv/slapd-LGA-NET-SG/pwdfile.txt 2017-09-26T02:27:56Z DEBUG Process finished, return code=255 2017-09-26T02:27:56Z DEBUG stdout= 2017-09-26T02:27:56Z DEBUG stderr=certutil: Could not find cert: Server-Cert : PR_FILE_NOT_FOUND_ERROR: File not found 2017-09-26T02:27:56Z ERROR IPA server upgrade failed: Inspect /var/log/ipaupgrade.log and run command ipa-server-upgrade manually. 2017-09-26T02:27:56Z DEBUG File "/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 172, in execute return_value = self.run() File "/usr/lib/python2.7/site-packages/ipaserver/install/ipa_server_upgrade.py", line 46, in run server.upgrade() File "/usr/lib/python2.7/site-packages/ipaserver/install/server/upgrade.py", line 1913, in upgrade upgrade_configuration() File "/usr/lib/python2.7/site-packages/ipaserver/install/server/upgrade.py", line 1788, in upgrade_configuration certificate_renewal_update(ca, ds, http), File "/usr/lib/python2.7/site-packages/ipaserver/install/server/upgrade.py", line 1018, in certificate_renewal_update ds.start_tracking_certificates(serverid) File "/usr/lib/python2.7/site-packages/ipaserver/install/dsinstance.py", line 1046, in start_tracking_certificates 'restart_dirsrv %s' % serverid) File "/usr/lib/python2.7/site-packages/ipaserver/install/certs.py", line 362, in track_server_cert cert_obj = x509.load_certificate(cert) File "/usr/lib/python2.7/site-packages/ipalib/x509.py", line 119, in load_certificate return cryptography.x509.load_der_x509_certificate(data, default_backend()) File "/usr/lib64/python2.7/site-packages/cryptography/x509/base.py", line 47, in load_der_x509_certificate return backend.load_der_x509_certificate(data) File "/usr/lib64/python2.7/site-packages/cryptography/hazmat/backends/multibackend.py", line 350, in load_der_x509_certificate return b.load_der_x509_certificate(data) File "/usr/lib64/python2.7/site-packages/cryptography/hazmat/backends/openssl/backend.py", line 1185, in load_der_x509_certificate raise ValueError("Unable to load certificate") 2017-09-26T02:27:56Z DEBUG The ipa-server-upgrade command failed, exception: ValueError: Unable to load certificate 2017-09-26T02:27:56Z ERROR Unexpected error - see /var/log/ipaupgrade.log for details: ValueError: Unable to load certificate 2017-09-26T02:27:56Z ERROR The ipa-server-upgrade command failed. See /var/log/ipaupgrade.log for more information ------- I am using a third party signed certificate along with my IPA-CA. Is it an issue with my current CA. I can see that while fetching for the certificate, the name given to be "Server-cert" instead of the exact CA name. -- Regards, Alka Murali

4 11

Smartcard not working on Ubuntu 16.04
by Steve Weeks 05 Oct '17

05 Oct '17

We have smartcards (PIV) working just fine on Fedora 25 with FreeIPA client version 4.4.4 (SSSD 1.14.2). However on Ubuntu 16.04, FreeIPA client 4.3.1, SSSD 1.13.4 the smartcard seems to be ignored. The smartcard is readable using pkcs11-tools and pkcs15-tools on both systems. On both systems sssd.conf contains: [pam] pam_cert_auth = True I've turned the sssd logging up to 9 on both systems and it looks like p11_child is never called on the Ubuntu system. On the Ubuntu system p11_child.log is empty and there is no sign of it being started in the sssd_pam.log. Any suggestions on what I should look at next? Thanks, Steve

2 10

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users September 2017