January 2018 - FreeIPA-users - Fedora mailing-lists

Forwarders don't work when enabled but do work when disabled
by Matt . 22 Jan '18

22 Jan '18

Hi, Happy and Healty 2018 first of all! I have something strange on: # ipa --version VERSION: 4.5.4, API_VERSION: 2.228 Forwarders are not working when they are enabled but when I disable them they work perfectly fine. What kind of strange thing is this ?

2 11

New Graphic?
by Striker Leggette 22 Jan '18

22 Jan '18

I noticed there is a new logo design on freeipa.org. Is it possible to get the scalable version of this for a printed banner?

1 0

FOSDEM reminder: Identity and Access Management devroom, Feb 3rd 2018
by Alexander Bokovoy 22 Jan '18

22 Jan '18

Hi, If you are in Europe during first weekend of February 2018, we'll be running an Identity and Access Management devroom at FOSDEM[1] on Saturday, February 3rd, 2018. FreeIPA and other free/open source identity and access management solutions will be presented there. FOSDEM is a primary free software event in Europe that is done by volunteers to volunteers every year since 2001 in Free University of Brussels, Belgium. Each year thousands people come to it to meet, discuss, and collaborate in various areas around free software and hardware. I wrote about our experience in organizing Identity Management-related events at FOSDEM in my blog some time ago[2]. It is now less than two weeks until the devroom and the greater FOSDEM event will happen, so I'd like to invite those who might have missed all the signs: it is still possible to attend. And if you are not at FOSDEM, there will be live streaming of all devrooms (42 and the main track!) too. See you in Brussels! [1] https://fosdem.org/2018/schedule/track/identity_and_access_management/ [2] https://vda.li/en/posts/2017/12/21/FOSDEM-2018-IAM-devroom/ -- / Alexander Bokovoy

1 0

Vault best practices
by Fil Di Noto 22 Jan '18

22 Jan '18

I've been using Vaults, I feel like I need some kind of version control, or historical log of values to recover from mistakenly overwriting vaults. What do most do? I notice that some docs have vault-add commands with a --source-vault-id option. My ipa version doesn't have these options. Are they upcoming or were they removed? Another option I don't have is --stdout, for vault-retrieve. I was looking for ways to pipe or set variables without writing to disk.

2 1

Here we go again, configuring Proxmox/Debian Stretch 9.3 as a FreeIPA client
by Alex Corcoles 22 Jan '18

22 Jan '18

Hi, Now that I have my FreeIPA server working in my setup, I'd like to configure my Proxmox server as an IPA client; both for UNIX users and its web/API. As you might be aware, ipa-client-install is only in sid, and it seems to be problematic. I'm posting everything I'm doing to keep this documented. $ apt install sudo $ apt install bind9utils certmonger curl krb5-user libcurl3 libnss3-tools libnss-sss libpam-sss libsasl2-modules-gssapi-mit libsss-sudo libxmlrpc-core-c3 oddjob-mkhomedir python-dnspython python-gssapi python-ldap sssd libbasicobjects0 libcollection4 libcurl3-nss libini-config5 libref-array1 gnupg2 python-cffi python-cryptography python-custodia python-dbus python-jwcrypto python-libipa-hbac python-lxml python-memcache python-netaddr python-netifaces python-nss python-pyasn1 python-qrcode python-setuptools python-usb python-yubico dnsutils keyutils python-requests $ wget http://ftp.de.debian.org/debian/pool/main/f/freeipa/freeipa-client_4.4.4-4_… http://ftp.de.debian.org/debian/pool/main/f/freeipa/freeipa-common_4.4.4-4_… http://ftp.de.debian.org/debian/pool/main/f/freeipa/python-ipaclient_4.4.4-… http://ftp.de.debian.org/debian/pool/main/f/freeipa/python-ipalib_4.4.4-4_a… $ dpkg -i *.deb $ ipa-client-install -N --mkhomedir This all seems to work successfully, the server appears on the FreeIPA web console and even: $ sss_ssh_authorizedkeys $MY_IPA_USER works! But ssh, sudo don't work. However if I patch /etc/sssd/sssd.conf and add nss and pam to [sssd] services, ssh, console login and sudo work! Questions: 1) Is there anything problematic in my procedure? 2) Whom should I report a bug so /etc/sssd/sssd.conf is generated correctly? I'm guessing Debian... 3) Proxmox supposedly uses PAM for its web/API auth, but it ignores my user. It supports LDAP for authentication, though... Would you recommend using LDAP or trying to coerce PAM into working for IPA? Cheers, Álex -- ___ {~._.~} ( Y ) ()~*~() mail: alex at corcoles dot net (_)-(_) http://alex.corcoles.net/

2 2

ipa: ERROR: No valid Negotiate header in server response
by Matt . 21 Jan '18

21 Jan '18

Hello, I'm facing an issue on my IPA server (currently 4.6.1, same happened on 4.5.4) with kerberos tickets. As was investigating this and tried to add a server with a admin ticket I get the following on and the IPA server itself and on a client with freeipa-admintools as well: $kinit admin $klist Ticket cache: KEYRING:persistent:0:0 Default principal: admin(a)DOMAIN.TLD Valid starting Expires Service principal 01/21/2018 22:52:35 01/22/2018 22:52:29 HTTP/ipa-01.domain.tld(a)DOMAIN.TLD 01/21/2018 22:52:30 01/22/2018 22:52:29 krbtgt/DOMAIN.TLD(a)DOMAIN.TLD $ipa service-add HTTP/client-01.domain.tld(a)DOMAIN.TLD ipa: ERROR: No valid Negotiate header in server response What is going wrong here ? I cannot find much about it. Thanks, Matt

1 1

Login failed due to unknow reason on the WebUI on new FreeIPA 4.5 installation
by Alexandre Pitre 18 Jan '18

18 Jan '18

Hi, I recently deployed a new FreeIPA domain running on CentOS 7.4 and FreeIPA 4.5 The installation went without hiccups but the WebUI isn't working as expected. Logging in with admin failed with this error: Login failed due to an unknow reason. I've seen this issue with every FreeIPA 4.5 replica I've built. As you may know this is pretty common error with 4.5. I usually just chmod 444 /var/lib/ipa-client/pki/* as pointed out in https://access.redhat.com/solutions/3178971 and the logging start working again but not this time with a brand new domain installation. Permissions are correct for the PEM ll /var/lib/pki/* -r--r--r-- 1 root root 4406 Jan 9 14:49 ca-bundle.pem -r--r--r-- 1 root root 4406 Jan 9 14:49 kdc-ca-bundle.pem Here's the output of /var/log/httpd/error_log [Thu Jan 18 01:14:40.543272 2018] [suexec:notice] [pid 12537] AH01232: suEXEC mechanism enabled (wrapper: /usr/sbin/suexec) [Thu Jan 18 01:14:40.543348 2018] [:warn] [pid 12537] NSSSessionCacheTimeout is deprecated. Ignoring. [Thu Jan 18 01:14:40.766070 2018] [auth_digest:notice] [pid 12537] AH01757: generating secret for digest authentication ... [Thu Jan 18 01:14:40.766623 2018] [lbmethod_heartbeat:notice] [pid 12537] AH02282: No slotmem from mod_heartmonitor [Thu Jan 18 01:14:40.766640 2018] [:warn] [pid 12537] NSSSessionCacheTimeout is deprecated. Ignoring. [Thu Jan 18 01:14:40.843105 2018] [mpm_prefork:notice] [pid 12537] AH00163: Apache/2.4.6 (CentOS) mod_auth_gssapi/1.5.1 mod_nss/1.0.14 NSS/3.28.4 mod_wsgi/3.4 Python/2.7.5 configured -- resuming normal operations [Thu Jan 18 01:14:40.843134 2018] [core:notice] [pid 12537] AH00094: Command line: '/usr/sbin/httpd -D FOREGROUND' [Thu Jan 18 01:14:48.465191 2018] [:error] [pid 12545] ipa: INFO: *** PROCESS START *** [Thu Jan 18 01:14:48.470206 2018] [:error] [pid 12546] ipa: INFO: *** PROCESS START *** [Thu Jan 18 01:15:14.020600 2018] [:error] [pid 12545] ipa: INFO: 401 Unauthorized: [Errno 13] Permission denied Output of /var/log/messages show weird errors: Jan 18 01:14:36 bo2-tnt-ipa-001 ipa-dnskeysyncd: ipa : ERROR syncrepl_poll: LDAP error ({'desc': "Can't contact LDAP server"}) Jan 18 01:14:38 bo2-tnt-ipa-001 ns-slapd: [18/Jan/2018:01:14:38.102629780 +0000] - ERR - schema-compat-plugin - scheduled schema-compat-plugin tree scan in about 5 seconds after the server startup! Jan 18 01:14:38 bo2-tnt-ipa-001 ns-slapd: [18/Jan/2018:01:14:38.115268733 +0000] - ERR - NSACLPlugin - acl_parse - The ACL target cn=groups,cn=compat,dc=ipa,dc=domain,dc=com does not exist Jan 18 01:14:38 bo2-tnt-ipa-001 ns-slapd: [18/Jan/2018:01:14:38.116680963 +0000] - ERR - NSACLPlugin - acl_parse - The ACL target cn=computers,cn=compat,dc=ipa,dc=domain,dc=com does not exist Jan 18 01:14:38 bo2-tnt-ipa-001 ns-slapd: [18/Jan/2018:01:14:38.117878580 +0000] - ERR - NSACLPlugin - acl_parse - The ACL target cn=ng,cn=compat,dc=ipa,dc=domain,dc=com does not exist Jan 18 01:14:38 bo2-tnt-ipa-001 ns-slapd: [18/Jan/2018:01:14:38.119338367 +0000] - ERR - NSACLPlugin - acl_parse - The ACL target ou=sudoers,dc=ipa,dc=domain,dc=com does not exist Jan 18 01:14:38 bo2-tnt-ipa-001 ns-slapd: [18/Jan/2018:01:14:38.120503775 +0000] - ERR - NSACLPlugin - acl_parse - The ACL target cn=users,cn=compat,dc=ipa,dc=domain,dc=com does not exist Jan 18 01:14:38 bo2-tnt-ipa-001 ns-slapd: [18/Jan/2018:01:14:38.122000132 +0000] - ERR - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=ipa,dc=domain,dc=com does not exist Jan 18 01:14:38 bo2-tnt-ipa-001 ns-slapd: [18/Jan/2018:01:14:38.123149308 +0000] - ERR - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=ipa,dc=domain,dc=com does not exist Jan 18 01:14:38 bo2-tnt-ipa-001 ns-slapd: [18/Jan/2018:01:14:38.124282277 +0000] - ERR - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=ipa,dc=domain,dc=com does not exist Jan 18 01:14:38 bo2-tnt-ipa-001 ns-slapd: [18/Jan/2018:01:14:38.125837472 +0000] - ERR - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=ipa,dc=domain,dc=com does not exist Jan 18 01:14:38 bo2-tnt-ipa-001 ns-slapd: [18/Jan/2018:01:14:38.126966928 +0000] - ERR - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=ipa,dc=domain,dc=com does not exist Jan 18 01:14:38 bo2-tnt-ipa-001 ns-slapd: [18/Jan/2018:01:14:38.128085824 +0000] - ERR - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=ipa,dc=domain,dc=com does not exist Jan 18 01:14:38 bo2-tnt-ipa-001 ns-slapd: [18/Jan/2018:01:14:38.129501796 +0000] - ERR - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=ipa,dc=domain,dc=com does not exist Jan 18 01:14:38 bo2-tnt-ipa-001 ns-slapd: [18/Jan/2018:01:14:38.130686657 +0000] - ERR - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=ipa,dc=domain,dc=com does not exist Jan 18 01:14:38 bo2-tnt-ipa-001 ns-slapd: [18/Jan/2018:01:14:38.132301267 +0000] - ERR - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=ipa,dc=domain,dc=com does not exist Jan 18 01:14:38 bo2-tnt-ipa-001 ns-slapd: [18/Jan/2018:01:14:38.134575956 +0000] - ERR - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=ipa,dc=domain,dc=com does not exist Jan 18 01:14:38 bo2-tnt-ipa-001 ns-slapd: [18/Jan/2018:01:14:38.135778559 +0000] - ERR - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=ipa,dc=domain,dc=com does not exist Jan 18 01:14:38 bo2-tnt-ipa-001 ns-slapd: [18/Jan/2018:01:14:38.142405173 +0000] - ERR - NSACLPlugin - acl_parse - The ACL target cn=casigningcert cert-pki-ca,cn=ca_renewal,cn=ipa,cn=etc,dc=ipa,dc=domain,dc=com does not exist Jan 18 01:14:38 bo2-tnt-ipa-001 ns-slapd: [18/Jan/2018:01:14:38.143655721 +0000] - ERR - NSACLPlugin - acl_parse - The ACL target cn=casigningcert cert-pki-ca,cn=ca_renewal,cn=ipa,cn=etc,dc=ipa,dc=domain,dc=com does not exist Jan 18 01:14:38 bo2-tnt-ipa-001 ns-slapd: [18/Jan/2018:01:14:38.233078350 +0000] - ERR - NSACLPlugin - acl_parse - The ACL target cn=automember rebuild membership,cn=tasks,cn=config does not exist Jan 18 01:14:38 bo2-tnt-ipa-001 ns-slapd: [18/Jan/2018:01:14:38.238586332 +0000] - ERR - cos-plugin - cos_dn_defs_cb - Skipping CoS Definitcomn cn=Password Policy,cn=accounts,dc=ipa,dc=domain,dc=com--no CoS Templates found, which should be added before the CoS Definitcomn. Jan 18 01:14:38 bo2-tnt-ipa-001 ns-slapd: [18/Jan/2018:01:14:38.261575767 +0000] - ERR - schema-compat-plugin - schema-compat-plugin tree scan will start in about 5 seconds! Jan 18 01:14:43 bo2-tnt-ipa-001 ns-slapd: [18/Jan/2018:01:14:43.268319379 +0000] - ERR - schema-compat-plugin - warning: no entries set up under ou=sudoers,dc=ipa,dc=domain,dc=com Jan 18 01:14:43 bo2-tnt-ipa-001 ns-slapd: [18/Jan/2018:01:14:43.272302862 +0000] - ERR - schema-compat-plugin - warning: no entries set up under cn=ng, cn=compat,dc=ipa,dc=domain,dc=com Jan 18 01:14:43 bo2-tnt-ipa-001 ns-slapd: [18/Jan/2018:01:14:43.279547839 +0000] - ERR - schema-compat-plugin - warning: no entries set up under cn=computers, cn=compat,dc=ipa,dc=domain,dc=com Jan 18 01:14:43 bo2-tnt-ipa-001 ns-slapd: [18/Jan/2018:01:14:43.285336505 +0000] - ERR - schema-compat-plugin - Finished plugin initializatcomn. Any ideas why ? Thanks Alexandre Pitre

4 6

hardening question
by Natxo Asenjo 18 Jan '18

18 Jan '18

hi, in chapter 36 (https://access.redhat.com/documentation/en-us/red_hat_ enterprise_linux/7/pdf/linux_domain_identity_authentication_and_policy_ guide/Red_Hat_Enterprise_Linux-7-Linux_Domain_Identity_ Authentication_and_Policy_Guide-en-US.pdf) we have instructions on disabling anonymous binds. Can I set these settings in dse.ldif instead of using the ldapmodify commando? I think cn=config is not replicated So I could still set this in dse.ldif (both to disable anonymous binds as to force using encryption): nsslapd-allow-anonymous-access: rootdse nsslapd-minssf: 56 Thanks! -- -- Groeten, natxo

2 1

Contribute How-To: LDAP Authentication for Isilon OneFS using FreeIPA
by Aravindh Sampathkumar 18 Jan '18

18 Jan '18

Hello all. I'm a new user having recently deployed a FreeIPA server to supply authentication for a small scale cluster. One of the first things I did was to make our storage system (Isilon cluster running OneFS) use FreeIPA as a authentication provider via LDAP. Though straightforward, I wish this information was available directly on the wiki and showed up on Google search for "How to configure Isilon/OneFS to use FreeIPA". I'd be happy to add this information into a wiki entry if someone could give me access to it. Login to FreeIPA server over SSH, and run the command: [root@freeipa1 ~]# ldapsearch -x uid=admin | grep dn: dn: uid=admin,cn=users,cn=compat,dc=nghpc,dc=dk dn: uid=admin,cn=users,cn=accounts,dc=nghpc,dc=dk Note down uid=admin, cn=accounts,dc=nghpc,dc=dk and head to Isilon OneFS, where you may configure LDAP using one of the two methods: (1) Using the web UI: Access --> Authentication Providers --> LDAP + Add an LDAP provider Enter an LDAP provider name of choice that is easy to understand. Server URI: ldaps://<ip address or fqdn of FreeIPA server> Note: If you are using the fqdn, make sure the DNS settings resolve the fqdn from the command line using nslookup <fqdn> Base Distinguished Name: dc=nghpc,dc=dk (Enter the details as obtained from the search command earlier) Bind to: uid=admin,cn=users,cn=accounts,dc=nghpc,dc=dk (Enter the details as obtained from the search command earlier) Enter the password for Admin user and you would have successfully connected Isilon to FreeIPa via LDAP. (2) Using the commandline: Get the status of auth providers before beginning the configuration: isi auth status Create a new LDAP provider using the command, isi auth ldap create test-ldap \ --base-dn="dc=nghpc,dc=dk" \ --bind-dn="uid=admin,cn=users,cn=accounts,dc=nghpc,dc=dk" \ --bind-password="mypasswd" \ --server-uris="ldaps://<ip address or fqdn of FreeIPA server>" \ --groupnet=<groupnet name> Run the ldap search from the Isilon node to test whether the LDAP connection works fine:ldapsearch -x uid=admin You can use the troubleshooting guide from EMC : https://www.emc.com/collateral/TechnicalDocument/docu63147.pdf Thanks, -- Aravindh Sampathkumar aravindh(a)fastmail.com

2 1

how to avoid ntpd?
by Harald Dunkel 18 Jan '18

18 Jan '18

Hi folks, some ipa servers in my environment are not permitted to change the clock. If I use "systemctl mask ntpd" to avoid the "degraded" returned by "systemctl status", then ipactl fails without the ntpd service: # ipactl restart Stopping pki-tomcatd Service Restarting Directory Service Restarting krb5kdc Service Restarting kadmin Service Restarting httpd Service Restarting ipa-custodia Service Restarting pki-tomcatd Service Restarting ipa-otpd Service Starting ntpd Service Failed to start ntpd Service Shutting down Hint: You can use --ignore-service-failure option for forced start in case that a non-critical service failed Aborting ipactl If I unmask ntpd, then systemctl status returns "degrarded" again, but ipa is fine. The option "--ignore-service-failures" ignores *all* service failures. I wonder how I can tell freeipa to ignore ntpd and rely upon sysvinit or systemd to start it, if necessary? Every helpful comment is highly appreciated. Harri

5 8

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users January 2018