January 2018 - FreeIPA-users - Fedora mailing-lists

AD trust and SAMBA
by Николай Савельев 09 Jan '18

09 Jan '18

I have IPA domain with AD trust. AD userc can login in IPA computers. getent passwd ad_user@ad_domain and id ad_user@ad_domain I can login via ssh with kerberos ticket for ad_user@ad_domain I setup SAMBA for this article https://www.freeipa.org/page/Howto/Integrating_a_Samba_File_Server_With_IPA kinit ad_user@ad_domain smbclient -k -L sambatest.ipa.domain smbclient -k //sambatest.ipa.domain It works. \\sambatest.ipa.domain from AD domain controllers works. But from other AD domain server (not controller) - not works. There are login and password request If i use ad_user@ad_domain and his password i get "There are currently no logon servers available to service the logon request" In samba logs: name_resolve_bcast: Attempting broadcast lookup for name IPA<0x1c> [2018/01/10 00:02:34.419279, 4] ../source3/libsmb/namequery.c:3193(get_dc_list) get_dc_list: no servers found [2018/01/10 00:02:34.419330, 3] ../source3/libsmb/namequery_dc.c:175(rpc_dc_name) Could not look up dc's for domain IPA [2018/01/10 00:02:34.419340, 5] ../source3/auth/auth_domain.c:298(check_ntdomain_security) check_ntdomain_security: unable to locate a DC for domain [2018/01/10 00:02:34.419349, 5] ../source3/auth/auth.c:252(auth_check_ntlm_password) check_ntlm_password: winbind authentication for user [ad_user@ad_domain] FAILED with error NT_STATUS_NO_L OGON_SERVERS [2018/01/10 00:02:34.419360, 2] ../source3/auth/auth.c:315(auth_check_ntlm_password) check_ntlm_password: Authentication for user [ad_user@ad_domain] -> [ad_user@ad_domain] FAI LED with error NT_STATUS_NO_LOGON_SERVERS [2018/01/10 00:02:34.419370, 5] ../source3/auth/auth_ntlmssp.c:188(auth3_check_password) Checking NTLMSSP password for \ad_user@ad_domain failed: NT_STATUS_NO_LOGON_SERVERS [2018/01/10 00:02:34.419392, 5] ../auth/ntlmssp/ntlmssp_server.c:737(ntlmssp_server_check_password) ../auth/ntlmssp/ntlmssp_server.c:737: Checking NTLMSSP password for \ad_user@ad_domain failed: NT_STATUS_ NO_LOGON_SERVERS [2018/01/10 00:02:34.419405, 2] ../auth/gensec/spnego.c:768(gensec_spnego_server_negTokenTarg) SPNEGO login failed: NT_STATUS_NO_LOGON_SERVERS Aftrer AD controller reboot \\sambatest.ipa.domain stops work on controller When i check relationship in Domain and Trust it works again. IPA server name is DC AD controller name is AD What's wrong? -- С уважением, Николай.

1 0

Unable to start dirsrv
by pgb205 09 Jan '18

09 Jan '18

Fedora 26Freeipa 4.4 When trying to start ipactl I get the below output which never ceases. Seems like it may have a few things in common with other dirsrv issues that we've benhaving on our other CENTOS replicas. ipactl -d statusipa: DEBUG: importing all plugin modules in ipaserver.plugins...ipa: DEBUG: importing plugin module ipaserver.plugins.aciipa: DEBUG: importing plugin module ipaserver.plugins.automemberipa: DEBUG: importing plugin module ipaserver.plugins.automountipa: DEBUG: importing plugin module ipaserver.plugins.baseldapipa: DEBUG: ipaserver.plugins.baseldap is not a valid plugin moduleipa: DEBUG: importing plugin module ipaserver.plugins.baseuseripa: DEBUG: importing plugin module ipaserver.plugins.batchipa: DEBUG: importing plugin module ipaserver.plugins.caipa: DEBUG: importing plugin module ipaserver.plugins.caaclipa: DEBUG: importing plugin module ipaserver.plugins.certipa: DEBUG: importing plugin module ipaserver.plugins.certprofileipa: DEBUG: importing plugin module ipaserver.plugins.configipa: DEBUG: importing plugin module ipaserver.plugins.delegationipa: DEBUG: importing plugin module ipaserver.plugins.dnsipa: DEBUG: importing plugin module ipaserver.plugins.dnsserveripa: DEBUG: importing plugin module ipaserver.plugins.dogtagipa: DEBUG: importing plugin module ipaserver.plugins.domainlevelipa: DEBUG: importing plugin module ipaserver.plugins.groupipa: DEBUG: importing plugin module ipaserver.plugins.hbacipa: DEBUG: ipaserver.plugins.hbac is not a valid plugin moduleipa: DEBUG: importing plugin module ipaserver.plugins.hbacruleipa: DEBUG: importing plugin module ipaserver.plugins.hbacsvcipa: DEBUG: importing plugin module ipaserver.plugins.hbacsvcgroupipa: DEBUG: importing plugin module ipaserver.plugins.hbactestipa: DEBUG: importing plugin module ipaserver.plugins.hostipa: DEBUG: importing plugin module ipaserver.plugins.hostgroupipa: DEBUG: importing plugin module ipaserver.plugins.idrangeipa: DEBUG: importing plugin module ipaserver.plugins.idviewsipa: DEBUG: importing plugin module ipaserver.plugins.localipa: DEBUG: importing plugin module ipaserver.plugins.joinipa: DEBUG: importing plugin module ipaserver.plugins.krbtpolicyipa: DEBUG: importing plugin module ipaserver.plugins.ldap2ipa: DEBUG: importing plugin module ipaserver.plugins.locationipa: DEBUG: importing plugin module ipaserver.plugins.migrationipa: DEBUG: importing plugin module ipaserver.plugins.miscipa: DEBUG: importing plugin module ipaserver.plugins.netgroupipa: DEBUG: importing plugin module ipaserver.plugins.otpipa: DEBUG: ipaserver.plugins.otp is not a valid plugin moduleipa: DEBUG: importing plugin module ipaserver.plugins.otpconfigipa: DEBUG: importing plugin module ipaserver.plugins.otptokenipa: DEBUG: importing plugin module ipaserver.plugins.passwdipa: DEBUG: importing plugin module ipaserver.plugins.permissionipa: DEBUG: importing plugin module ipaserver.plugins.pingipa: DEBUG: importing plugin module ipaserver.plugins.pkinitipa: DEBUG: importing plugin module ipaserver.plugins.privilegeipa: DEBUG: importing plugin module ipaserver.plugins.pwpolicyipa: DEBUG: Starting external processipa: DEBUG: args=klist -Vipa: DEBUG: Process finished, return code=0ipa: DEBUG: stdout=Kerberos 5 version 1.15.1ipa: DEBUG: stderr=ipa: DEBUG: importing plugin module ipaserver.plugins.rabaseipa: DEBUG: ipaserver.plugins.rabase is not a valid plugin moduleipa: DEBUG: importing plugin module ipaserver.plugins.radiusproxyipa: DEBUG: importing plugin module ipaserver.plugins.realmdomainsipa: DEBUG: importing plugin module ipaserver.plugins.roleipa: DEBUG: importing plugin module ipaserver.plugins.schemaipa: DEBUG: importing plugin module ipaserver.plugins.selfserviceipa: DEBUG: importing plugin module ipaserver.plugins.selinuxusermapipa: DEBUG: importing plugin module ipaserver.plugins.serveripa: DEBUG: importing plugin module ipaserver.plugins.serverroleipa: DEBUG: importing plugin module ipaserver.plugins.serverrolesipa: DEBUG: importing plugin module ipaserver.plugins.serviceipa: DEBUG: importing plugin module ipaserver.plugins.servicedelegationipa: DEBUG: importing plugin module ipaserver.plugins.sessionipa: DEBUG: importing plugin module ipaserver.plugins.stageuseripa: DEBUG: importing plugin module ipaserver.plugins.sudoipa: DEBUG: ipaserver.plugins.sudo is not a valid plugin moduleipa: DEBUG: importing plugin module ipaserver.plugins.sudocmdipa: DEBUG: importing plugin module ipaserver.plugins.sudocmdgroupipa: DEBUG: importing plugin module ipaserver.plugins.sudoruleipa: DEBUG: importing plugin module ipaserver.plugins.topologyipa: DEBUG: importing plugin module ipaserver.plugins.trustipa: DEBUG: importing plugin module ipaserver.plugins.useripa: DEBUG: importing plugin module ipaserver.plugins.vaultipa: DEBUG: importing plugin module ipaserver.plugins.virtualipa: DEBUG: ipaserver.plugins.virtual is not a valid plugin moduleipa: DEBUG: importing plugin module ipaserver.plugins.xmlserveripa: DEBUG: Starting external processipa: DEBUG: args=/bin/systemctl is-active dirsrv(a)domain-local.serviceipa: DEBUG: Process finished, return code=3ipa: DEBUG: stdout=activatingipa: DEBUG: stderr=ipa: DEBUG: Starting external processipa: DEBUG: args=/bin/systemctl is-active dirsrv(a)domain-local.serviceipa: DEBUG: Process finished, return code=3ipa: DEBUG: stdout=activatingipa: DEBUG: stderr=ipa: DEBUG: Starting external processipa: DEBUG: args=/bin/systemctl is-active dirsrv(a)domain-local.serviceipa: DEBUG: Process finished, return code=3ipa: DEBUG: stdout=activating ..the last block continues forever.

1 0

sudo fails as the Kerberos realm from an alternate UPN suffix
by Marin BERNARD 09 Jan '18

09 Jan '18

Hi, We're using FreeIPA 4.5.0 on CentOS 7.4. We've set up a two-way trust between our 2 FreeIPA servers and our AD domain (forest an domain levels both on 2012 R2). So far, everything works as expected, and we're able to perform SSO to both FreeIPA instances with AD accounts. In our AD domain, the UPN suffix of most accounts is different from the DNS name of the domain, thus also from the its Kerberos realm. We use a custom UPN suffix (@pep06.fr) to match user names to email addresses. Such configuration is pretty common in AD environments. After I set up the AD trust, I added our custom UPN (@pep06.fr) to the list of alternate UPN suffices in the Trusts section of the FreeIPA Web UI. I thought this was enough to make FreeIPA aware of our custom UPN suffix, and to have all Kerberos requests for @pep06.fr directed to the KDC of the AD domain. I was wrong: while Kerberos delegation for SSO is working fine, we're unable to log in with explicit AD credentials. System logs report that sssd fails to find a KDC for the 'PEP06.FR' Kerberos realm which, indeed, does not exist, as it is constructed from our alternate UPN suffix: ``` [sssd[krb5_child[3810]]][3810]: Cannot find KDC for realm "PEP06.FR" ``` This limitation also prevents us from using IPA sudo rules involving AD users: since sssd is unable to derive the name of the real Kerberos realm, it fails to find a KDC to query, and rule evaluations always fail. This happens no matter if sudo is run from a SSO-authenticated session. Is this a known limitation of FreeIPA or a configuration issue on my side? If this is a limitation, should I expect it to be adressed any soon? Many thanks, Marin BERNARD Administrateur systèmes Pupilles de l'Enseignement Public 06 35 boulevard de la Madeleine - 06000 Nice

1 0

IPA Password Vault
by Sean Hogan 08 Jan '18

08 Jan '18

Hello, I have recently been looking into the password vault for IPA and would like to implement however I have not been able to find an answer to a compliance question on it yet. Does the IPA PW vault limit checking out the password for a shared id to one person at a time? I am thinking this would ensure that personal accountability of that ID being used instead of allowing multiple people checking out the same id password. RHEL 7.3 IPA 4.4 Sean Hogan

2 3

Plugin for simple user attribute / textfield in Gui
by Matt . 08 Jan '18

08 Jan '18

Hi Guys, Comparing to the great demo of Ab: https://github.com/abbra/freeipa-userstatus-plugin I was wondering if someone created something like it but for a simple textfield as well. Reinventing the wheel is not good so maybe someone has a working example/plugin. Thanks! Matt

1 0

Ubuntu -> Fedora and tomcat SetAllPropertiesRule warnings
by David Harvey 08 Jan '18

08 Jan '18

Dear list, In trying to escape from the various issues facing the ubuntu freeipa, I attempted to make the switch to Fedora 26 (same freeipa version 4.4.4). This seemed to go well (adding new replica first, and then replacing the ubuntu based installs), but I notice on my fedora boxes several warnings in /v/l/messages (pasted below). Firstly, are these harmful, and what might I need to rectify!? I have a half baked theory that this might relate to some of the aspects that were broken in ubuntu and carrying their breakage across to the new platform! Secondly - could they relate to an issue I am seeing where one specific LDAPS client application is failing to verify the ldap server cert (even thought other clients are quite happy talking to it) since the ipa server reinstall? Advice appreciated, thank you in advance! David Jan 4 11:53:09 ipa3 server[1357]: WARNING: Problem with JAR file [/usr/share/pki/server/common/lib/symkey.jar], exists: [false], canRead: [false] Jan 4 11:53:09 ipa3 ntpd[1200]: Soliciting pool server 45.79.111.114 Jan 4 11:53:10 ipa3 server[1357]: WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'enableOCSP' to 'false' did not find a matching property. Jan 4 11:53:10 ipa3 server[1357]: WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'ocspResponderURL' to 'http://ipa3.thomac.net:9080/ca/ocsp' did not find a matching property. Jan 4 11:53:10 ipa3 server[1357]: WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'ocspResponderCertNickname' to 'ocspSigningCert cert-pki-ca' did not find a matching property. Jan 4 11:53:10 ipa3 server[1357]: WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'ocspCacheSize' to '1000' did not find a matching property. Jan 4 11:53:10 ipa3 server[1357]: WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'ocspMinCacheEntryDuration' to '60' did not find a matching property. Jan 4 11:53:10 ipa3 server[1357]: WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'ocspMaxCacheEntryDuration' to '120' did not find a matching property. Jan 4 11:53:10 ipa3 server[1357]: WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'ocspTimeout' to '10' did not find a matching property. Jan 4 11:53:10 ipa3 server[1357]: WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'strictCiphers' to 'true' did not find a matching property. Jan 4 11:53:10 ipa3 server[1357]: WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'sslOptions' to 'ssl2=false,ssl3=false,tls=true' did not find a matching property. Jan 4 11:53:10 ipa3 server[1357]: WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'ssl2Ciphers' to '-SSL2_RC4_128_WITH_MD5,-SSL2_RC4_128_EXPORT40_WITH_MD5,-SSL2_RC2_128_CBC_WITH_MD5,-SSL2_RC2_128_CBC_EXPORT40_WITH_MD5,-SSL2_DES_64_CBC_WITH_MD5,-SSL2_DES_192_EDE3_CBC_WITH_MD5' did not find a matching property. Jan 4 11:53:10 ipa3 server[1357]: WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'ssl3Ciphers' to '-SSL3_FORTEZZA_DMS_WITH_NULL_SHA,-SSL3_FORTEZZA_DMS_WITH_RC4_128_SHA,+SSL3_RSA_WITH_RC4_128_SHA,-SSL3_RSA_EXPORT_WITH_RC4_40_MD5,+SSL3_RSA_WITH_3DES_EDE_CBC_SHA,-SSL3_RSA_WITH_DES_CBC_SHA,-SSL3_RSA_EXPORT_WITH_RC2_CBC_40_MD5,-SSL3_FORTEZZA_DMS_WITH_FORTEZZA_CBC_SHA,-SSL_RSA_FIPS_WITH_DES_CBC_SHA,+SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA,-SSL3_RSA_WITH_NULL_MD5,-TLS_RSA_EXPORT1024_WITH_RC4_56_SHA,-TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA,+TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA' did not find a matching property. Jan 4 11:53:10 ipa3 server[1357]: WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'tlsCiphers' to '-TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA,-TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA,+TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA,+TLS_ECDH_RSA_WITH_AES_128_CBC_SHA,+TLS_ECDH_RSA_WITH_AES_256_CBC_SHA,-TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA,+TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,+TLS_RSA_WITH_3DES_EDE_CBC_SHA,+TLS_RSA_WITH_AES_128_CBC_SHA,+TLS_RSA_WITH_AES_256_CBC_SHA,+TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA,+TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,-TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,-TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,-TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,+TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA,+TLS_DHE_DSS_WITH_AES_128_CBC_SHA,+TLS_DHE_DSS_WITH_AES_256_CBC_SHA,+TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA,+TLS_DHE_RSA_WITH_AES_128_CBC_SHA,+TLS_DHE_RSA_WITH_AES_256_CBC_SHA' did not find a matching property. Jan 4 11:53:10 ipa3 server[1357]: WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'sslVersionRangeStream' to 'tls1_0:tls1_2' did not find a matching property. Jan 4 11:53:10 ipa3 server[1357]: WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'sslVersionRangeDatagram' to 'tls1_1:tls1_2' did not find a matching property. Jan 4 11:53:10 ipa3 server[1357]: WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'sslRangeCiphers' to '-TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA,-TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA,-TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA,-TLS_ECDH_RSA_WITH_AES_128_CBC_SHA,-TLS_ECDH_RSA_WITH_AES_256_CBC_SHA,-TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA,-TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,-TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA,-TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,-TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,-TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,-TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,-TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA,-TLS_DHE_DSS_WITH_AES_128_CBC_SHA,-TLS_DHE_DSS_WITH_AES_256_CBC_SHA,-TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA,-TLS_DHE_RSA_WITH_AES_128_CBC_SHA,-TLS_DHE_RSA_WITH_AES_256_CBC_SHA,-TLS_DHE_RSA_WITH_AES_128_CBC_SHA256,-TLS_DHE_RSA_WITH_AES_256_CBC_SHA256,-TLS_DHE_RSA_WITH_AES_128_GCM_SHA256,-TLS_DHE_DSS_WITH_AES_128_GCM_SHA256,-TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,-TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,-TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,-TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,-TLS_RSA_WITH_AES_128_CBC_SHA256,-TLS_RSA_WITH_AES_256_CBC_SHA256,-TLS_RSA_WITH_AES_128_GCM_SHA256,+TLS_RSA_WITH_3DES_EDE_CBC_SHA,+TLS_RSA_WITH_AES_128_CBC_SHA,+TLS_RSA_WITH_AES_256_CBC_SHA' did not find a matching property. Jan 4 11:53:10 ipa3 server[1357]: WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'serverCertNickFile' to '/var/lib/pki/pki-tomcat/conf/serverCertNick.conf' did not find a matching property. Jan 4 11:53:10 ipa3 server[1357]: WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'passwordFile' to '/var/lib/pki/pki-tomcat/conf/password.conf' did not find a matching property. Jan 4 11:53:10 ipa3 server[1357]: WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'passwordClass' to 'org.apache.tomcat.util.net.jss.PlainPasswordFile' did not find a matching property. Jan 4 11:53:10 ipa3 server[1357]: WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'certdbDir' to '/var/lib/pki/pki-tomcat/alias' did not find a matching property. Jan 4 11:53:10 ipa3 server[1357]: WARNING: [SetPropertiesRule]{Server/Service/Engine/Host/Valve} Setting property 'resolveHosts' to 'false' did not find a matching property.

1 2

freeipa client working on ubuntu 16.04 but not 14.04
by Cody Rathgeber 07 Jan '18

07 Jan '18

Hello, I'm trying to deploy freeipa to an environment running a mix of ubuntu 16.04 and 14.04 servers. on 16.04 the servers join and can pull down users no problem, on 14.04 when joining it'll throw a "Unable to find 'admin' user with 'getent passwd admin(a)redacted.net'!:" And sure enough getent passwd won't pull details, and thus no accounts can be pulled down as far as I can tell. It works on every 16.04 machine and fails on every 14.04. Anyone have any tips/ideas on how i'd go about troubleshooting this? This is with doing an apt-get install freeipa-client and ipa-client-install. Thanks!

5 8

nss certs and Certificate not found error
by lejeczek 06 Jan '18

06 Jan '18

hi everyone apologies first and foremost as this does not concert IPA directly, I've tried apache's list but no help I found there(yet). So I know Apache's experts traverse here thus maybe more luck here. I'm experiencing a weird thing. What I'm trying to do I believe must be so common that many of you have done it and thus could advice. I converted my let's encrypt cert into a new cert8.db(but also tried cert9.db, as belowe), and I have in config: <VirtualHost none.net:443> DocumentRoot /usr/share/wordpress.none DirectoryIndex index.php index.html ServerName none.net ServerAlias www NSSEngine on NSSCipherSuite +rsa_rc4_128_md5,+rsa_rc4_128_sha,+rsa_3des_sha,-rsa_des_sha,-rsa_rc4_40_md5,-rsa_rc2_40_md5,-rsa_null_md5,-rsa_null_sha,+fips_3des_sha,-fips_des_sha,-fortezza,-fortezza_rc4_128_sha,-fortezza_null,-rsa_des_56_sha,-rsa_rc4_56_sha,+rsa_aes_128_sha,+rsa_aes_256_sha NSSCertificateDatabase sql:/etc/httpd/none NSSNickname "none.net - Let's Encrypt" ErrorLog /var/log/httpd/none.net_443-error.log CustomLog /var/log/httpd/none.net_443-access.log common When I do: $ certutil -L -d sql:/etc/httpd/none/ Certificate Nickname Trust Attributes SSL,S/MIME,JAR/XPI none.net - Let's Encrypt u,u,u Let's Encrypt Authority X3 - Digital Signature Trust Co. CT,C,C So all good, right? Cert is there in the database, yet Apache fails to start. ... [Thu Jan 04 15:34:17.188664 2018] [:error] [pid 21849:tid 140612518500608] Certificate not found: 'none.net' ... Is this not ... well, strange. I presume NSS can handle multiple NSSCertificateDatabase(per VirtualHost) ? Not files permission, not selinux. What can be a problem here? many thanks, L.

2 2

One of the ldap service principals is missing. Replication agreement cannot be converted.
by pgb205 05 Jan '18

05 Jan '18

I've had a short conversation about this in irc channel, but figured I'd open a ticket to keep a track of things. We are trying to reinstall a replica (replica-x1) but it errors out with the above error message. The logs of ipa-replica-install.log are belowI've tried following a similar issue hereRe: [Freeipa-users] Error setting up Replication: ldap service principal | | | Re: [Freeipa-users] Error setting up Replication: ldap service principal | | | but am having problem executing a command as suggested by Ludwig.I'm tryingdb2index.pl -D cn='Directory Manager' -v -w - -t entryrdn on the server.pop.domain (source server) but that just gives --help message. At any rate speaking to Rob this may not even be the correct step to take.PS: I have made sure to uninstall the original replica and also ipa-replica del replica-x1.pop --force on the source server.2018-01-05T21:23:57Z DEBUG Process finished, return code=02018-01-05T21:23:57Z DEBUG stdout=add objectclass:2018-01-05T21:23:57Z DEBUG stderr=ldap_initialize( ldapi://%2Fvar%2Frun%2Fslapd-DOMAIN-LOCAL.socket/??base )2018-01-05T21:23:57Z DEBUG duration: 0 seconds2018-01-05T21:23:57Z DEBUG [5/7]: enable GSSAPI for replication2018-01-05T21:23:57Z DEBUG flushing ldaps://replica-x1.pop.domain.local:636 from SchemaCache2018-01-05T21:23:57Z DEBUG retrieving schema for SchemaCache url=ldaps://replica-x1.pop.domain.local:636 conn=<ldap.ldapobject.SimpleLDAPObject instance at 0x74bd098>2018-01-05T21:24:00Z DEBUG flushing ldaps://server.pop.domain.local:636 from SchemaCache2018-01-05T21:24:00Z DEBUG retrieving schema for SchemaCache url=ldaps://server.pop.domain.local:636 conn=<ldap.ldapobject.SimpleLDAPObject instance at 0xb76f128>2018-01-05T21:24:03Z DEBUG Unable to find entry for (krbprincipalname=ldap/replica-x1.pop.domain.local(a)domain.local) on server.pop.domain.local:636......2018-01-05T21:27:37Z DEBUG Unable to find entry for (krbprincipalname=ldap/replica-x1.pop.domain.local(a)domain.local) on server.pop.domain.local:6362018-01-05T21:27:39Z DEBUG Traceback (most recent call last):2018-01-05T21:27:39Z DEBUG [error] RuntimeError: One of the ldap service principals is missing. Replication agreement cannot be converted.2018-01-05T21:27:39Z DEBUG File "/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 171, in execute2018-01-05T21:27:39Z DEBUG The ipa-replica-install command failed, exception: RuntimeError: One of the ldap service principals is missing. Replication agreement cannot be converted.root(a)replica-x1.pop.domain.local: /var/log/ipa$

1 0

Failed to read service file. Hostname does not match any master server in LDAP
by pgb205 05 Jan '18

05 Jan '18

Hello everyone. Periodically and seemingly at random our replicas crash with the above error. Dirsrv shows as stopped and restarting doesn't help.Someone suggested earlier that this is due to problems with topology plugin but I don't think that the cause as we are still ondomainlevel=0. I'm not sure if it's a problem with 389ds or with some other part of freeipa. The only other clue I can think of is that often we see inconsistenciesbetween replicas. IE a user that is supposed to be present everywhere goes missing on just one of the many replicas. I'm quite at a loss on how to troubleshoot this further. I hope that someone can assist. ipactl startStarting Directory ServiceFailed to read data from service file: Failed to get list of services to probe status!Configured hostname 'server.pop.domain.local' does not match any master server in LDAP:No master found because of error: no such entryShutting down cat errors[26/Dec/2017:21:15:56.234793153 +0000] SSL alert: Sending pin request to SVRCore. You may need to run systemd-tty-ask-password-agent to provide the password.[26/Dec/2017:21:15:56.236060353 +0000] SSL alert: Security Initialization: Enabling default cipher set.[26/Dec/2017:21:15:56.236362922 +0000] SSL alert: Configured NSS Ciphers[26/Dec/2017:21:15:56.236652729 +0000] SSL alert: TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384: enabled[26/Dec/2017:21:15:56.236921632 +0000] SSL alert: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA: enabled[26/Dec/2017:21:15:56.237114079 +0000] SSL alert: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256: enabled[26/Dec/2017:21:15:56.237317678 +0000] SSL alert: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA: enabled[26/Dec/2017:21:15:56.237526365 +0000] SSL alert: TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384: enabled[26/Dec/2017:21:15:56.237746660 +0000] SSL alert: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA: enabled[26/Dec/2017:21:15:56.237908539 +0000] SSL alert: TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256: enabled[26/Dec/2017:21:15:56.238087338 +0000] SSL alert: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA: enabled[26/Dec/2017:21:15:56.238306056 +0000] SSL alert: TLS_DHE_RSA_WITH_AES_256_GCM_SHA384: enabled[26/Dec/2017:21:15:56.238517868 +0000] SSL alert: TLS_DHE_RSA_WITH_AES_256_CBC_SHA: enabled[26/Dec/2017:21:15:56.238724920 +0000] SSL alert: TLS_DHE_DSS_WITH_AES_256_CBC_SHA: enabled[26/Dec/2017:21:15:56.238889982 +0000] SSL alert: TLS_DHE_RSA_WITH_AES_256_CBC_SHA256: enabled[26/Dec/2017:21:15:56.239048124 +0000] SSL alert: TLS_DHE_RSA_WITH_AES_128_GCM_SHA256: enabled[26/Dec/2017:21:15:56.239233534 +0000] SSL alert: TLS_DHE_RSA_WITH_AES_128_CBC_SHA: enabled[26/Dec/2017:21:15:56.239402097 +0000] SSL alert: TLS_DHE_DSS_WITH_AES_128_CBC_SHA: enabled[26/Dec/2017:21:15:56.239767245 +0000] SSL alert: TLS_DHE_RSA_WITH_AES_128_CBC_SHA256: enabled[26/Dec/2017:21:15:56.239997083 +0000] SSL alert: TLS_RSA_WITH_AES_256_GCM_SHA384: enabled[26/Dec/2017:21:15:56.240177269 +0000] SSL alert: TLS_RSA_WITH_AES_256_CBC_SHA: enabled[26/Dec/2017:21:15:56.240376177 +0000] SSL alert: TLS_RSA_WITH_AES_256_CBC_SHA256: enabled[26/Dec/2017:21:15:56.240585031 +0000] SSL alert: TLS_RSA_WITH_AES_128_GCM_SHA256: enabled[26/Dec/2017:21:15:56.240745192 +0000] SSL alert: TLS_RSA_WITH_AES_128_CBC_SHA: enabled[26/Dec/2017:21:15:56.240897126 +0000] SSL alert: TLS_RSA_WITH_AES_128_CBC_SHA256: enabled[26/Dec/2017:21:15:56.241075071 +0000] SSL alert: TLS_AES_128_GCM_SHA256: enabled[26/Dec/2017:21:15:56.241245788 +0000] SSL alert: TLS_CHACHA20_POLY1305_SHA256: enabled[26/Dec/2017:21:15:56.241456256 +0000] SSL alert: TLS_AES_256_GCM_SHA384: enabled[26/Dec/2017:21:15:56.241617090 +0000] SSL alert: TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256: enabled[26/Dec/2017:21:15:56.241766851 +0000] SSL alert: TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256: enabled[26/Dec/2017:21:15:56.241947040 +0000] SSL alert: TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256: enabled[26/Dec/2017:21:15:56.249524586 +0000] SSL Initialization - Configured SSL version range: min: TLS1.0, max: TLS1.2[26/Dec/2017:21:15:56.249909319 +0000] 389-Directory/1.3.5.10 B2017.102.203 starting up[26/Dec/2017:21:15:56.261829771 +0000] default_mr_indexer_create: warning - plugin [caseIgnoreIA5Match] does not handle caseExactIA5Match[26/Dec/2017:21:15:56.269563770 +0000] WARNING: changelog: entry cache size 2097152 B is less than db size 149151744 B; We recommend to increase the entry cache size nsslapd-cachememsize.[26/Dec/2017:21:15:56.300878069 +0000] schema-compat-plugin - scheduled schema-compat-plugin tree scan in about 5 seconds after the server startup![26/Dec/2017:21:15:56.399266161 +0000] NSACLPlugin - The ACL target cn=automember rebuild membership,cn=tasks,cn=config does not exist[26/Dec/2017:21:15:56.406444789 +0000] dna-plugin - dna_parse_config_entry: Unable to locate shared configuration entry (cn=posix-ids,cn=dna,cn=ipa,cn=etc,dc=domain,dc=local)[26/Dec/2017:21:15:56.406758873 +0000] dna-plugin - dna_parse_config_entry: Invalid config entry [cn=posix ids,cn=distributed numeric assignment plugin,cn=plugins,cn=config] skipped[26/Dec/2017:21:15:56.423696836 +0000] schema-compat-plugin - schema-compat-plugin tree scan will start in about 5 seconds![26/Dec/2017:21:15:56.434117007 +0000] slapd started. Listening on All Interfaces port 389 for LDAP requests[26/Dec/2017:21:15:56.434370916 +0000] Listening on All Interfaces port 636 for LDAPS requests[26/Dec/2017:21:15:56.434602326 +0000] Listening on /var/run/slapd-domain-local.socket for LDAPI requests[26/Dec/2017:21:15:56.517403933 +0000] slapd shutting down - signaling operation threads - op stack size 1 max work q size 1 max work q stack size 1[26/Dec/2017:21:15:56.517944438 +0000] slapd shutting down - waiting for 28 threads to terminate[26/Dec/2017:21:15:56.518216669 +0000] slapd shutting down - closing down local subsystems and plugins[26/Dec/2017:21:16:01.429082375 +0000] Waiting for 4 database threads to stop[26/Dec/2017:21:16:02.283796028 +0000] All database threads now stopped[26/Dec/2017:21:16:02.302693986 +0000] slapd shutting down - freed 1 work q stack objects - freed 1 op stack objects[26/Dec/2017:21:16:02.439672563 +0000] slapd stopped.

2 7

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users January 2018