January 2018 - FreeIPA-users - Fedora mailing-lists

ipa-server-install get error Configuration of CA failed
by michael_ly＠sina.cn 18 Jan '18

18 Jan '18

Hi, I was installing FreeIPA on REDHAT 6.7. I used yum install ipa-server and then ipa-server-install. But the ipa-server-install failed with below error, can anyone give some advice on why could be the root cause? Thanks ahead. [3/21]: configuring certificate server instanceipa : CRITICAL failed to configure ca instance Command '/usr/bin/perl /usr/bin/pkisilent ConfigureCA -cs_hostname esgyn001.gynsh.cn -cs_port 9445 -client_certdb_dir /tmp/tmp-V62uAl -client_certdb_pwd XXXXXXXX -preop_pin HfDrsgIoH09wCuOeHspb -domain_name IPA -admin_user admin -admin_email root@localhost -admin_password XXXXXXXX -agent_name ipa-ca-agent -agent_key_size 2048 -agent_key_type rsa -agent_cert_subject CN=ipa-ca-agent,O=GYNSH.CN -ldap_host esgyn001.gynsh.cn -ldap_port 7389 -bind_dn cn=Directory Manager -bind_password XXXXXXXX -base_dn o=ipaca -db_name ipaca -key_size 2048 -key_type rsa -key_algorithm SHA256withRSA -save_p12 true -backup_pwd XXXXXXXX -subsystem_name pki-cad -token_name internal -ca_subsystem_cert_subject_name CN=CA Subsystem,O=GYNSH.CN -ca_subsystem_cert_subject_name CN=CA Subsystem,O=GYNSH.CN -ca_ocsp_cert_subject_name CN=OCSP Subsystem,O=GYNSH.CN -ca_server_cert_subject_name CN=esgyn001.gynsh.cn,O=GYNSH.CN -ca_audit_signing_cert_subject_name CN=CA Audit,O=GYNSH.CN -ca_sign_cert_subject_name CN=Certificate Authority,O=GYNSH.CN -external false -clone false' returned non-zero exit status 255Configuration of CA failed 2018-01-18T06:55:06Z CRITICAL failed to configure ca instance Command '/usr/bin/perl /usr/bin/pkisilent ConfigureCA -cs_hostname esgyn001.gynsh.cn -cs_port 9445 -client_certdb_dir /tmp/tmp-bQZ26x -client_certdb_pwd XXXXXXXX -preop_pin LyMFcx8VY5OuwdRqnBe8 -domain_name IPA -admin_user admin -admin_email root@localhost -admin_password XXXXXXXX -agent_name ipa-ca-agent -agent_key_size 2048 -agent_key_type rsa -agent_cert_subject CN=ipa-ca-agent,O=GYNSH.CN -ldap_host esgyn001.gynsh.cn -ldap_port 7389 -bind_dn cn=Directory Manager -bind_password XXXXXXXX -base_dn o=ipaca -db_name ipaca -key_size 2048 -key_type rsa -key_algorithm SHA256withRSA -save_p12 true -backup_pwd XXXXXXXX -subsystem_name pki-cad -token_name internal -ca_subsystem_cert_subject_name CN=CA Subsystem,O=GYNSH.CN -ca_subsystem_cert_subject_name CN=CA Subsystem,O=GYNSH.CN -ca_ocsp_cert_subject_name CN=OCSP Subsystem,O=GYNSH.CN -ca_server_cert_subject_name CN=esgyn001.gynsh.cn,O=GYNSH.CN -ca_audit_signing_cert_subject_name CN=CA Audit,O=GYNSH.CN -ca_sign_cert_subject_name CN=Certificate Authority,O=GYNSH.CN -external false -clone false' returned non-zero exit status 2552018-01-18T06:55:06Z INFO File "/usr/lib/python2.6/site-packages/ipaserver/install/installutils.py", line 614, in run_script return_value = main_function() File "/usr/sbin/ipa-server-install", line 947, in main subject_base=options.subject) File "/usr/lib/python2.6/site-packages/ipaserver/install/cainstance.py", line 626, in configure_instance self.start_creation(runtime=210) File "/usr/lib/python2.6/site-packages/ipaserver/install/service.py", line 358, in start_creation method() File "/usr/lib/python2.6/site-packages/ipaserver/install/cainstance.py", line 890, in __configure_instance raise RuntimeError('Configuration of CA failed') 2018-01-18T06:55:06Z INFO The ipa-server-install command failed, exception: RuntimeError: Configuration of CA failed

1 0

freeipa-client joins keep failing : Cannot find KDC for realm
by Chris Moody 17 Jan '18

17 Jan '18

Hello all. First want to thank everyone for all the hard work going into continually making this platform a better and better offering. I'm running into some challenges though in joining clients to a relatively fresh install for a client. I have a pair of replicating IPA nodes that are responding on all ports and services as expected. If I make manual connections to the nodes from clients, I am able to talk successfully via the various services (LDAP, KRB, DNS, NTP). My trouble comes when trying to join clients to the IPA servers. If I run the following: ===== ipa-client-install -p admin --mkhomedir --hostname=`hostname` -d ===== The client looks up all the name records correctly, prompts for the admin credentials, then starts exchanging certs, making https calls, and so on, but never completes successfully in joining the client. I keep getting the dreaded "Client uninstall complete." whenever the client-install completes. Parsing through the /var/log/ipaclient-install.log, I see what I believe to be the culprit component of the join process: ===== ...[output truncated]... 2018-01-15T21:55:24Z DEBUG Writing Kerberos configuration to /etc/krb5.conf: 2018-01-15T21:55:24Z DEBUG #File modified by ipa-client-install includedir /var/lib/sss/pubconf/krb5.include.d/ [libdefaults] default_realm = IPA.XYZ.COM dns_lookup_realm = true dns_lookup_kdc = true rdns = false ticket_lifetime = 24h forwardable = true udp_preference_limit = 0 default_ccache_name = KEYRING:persistent:%{uid} [realms] IPA.XYZ.COM = { pkinit_anchors = FILE:/etc/ipa/ca.crt } [domain_realm] .xyz.com = IPA.XYZ.COM xyz.com = IPA.XYZ.COM 2018-01-15T21:55:24Z INFO Configured /etc/krb5.conf for IPA realm IPA.XYZ.COM 2018-01-15T21:55:24Z DEBUG Starting external process 2018-01-15T21:55:24Z DEBUG args=keyctl search @s user ipa_session_cookie:host/sfca-do-1.xyz.com@IPA.XYZ.COM 2018-01-15T21:55:24Z DEBUG Process finished, return code=1 2018-01-15T21:55:24Z DEBUG stdout= 2018-01-15T21:55:24Z DEBUG stderr=keyctl_search: Required key not available 2018-01-15T21:55:24Z DEBUG Starting external process 2018-01-15T21:55:24Z DEBUG args=/usr/bin/certutil -d /tmp/tmpoXIXYU -N -f /tmp/tmpfNulOs 2018-01-15T21:55:24Z DEBUG Process finished, return code=0 2018-01-15T21:55:24Z DEBUG stdout= 2018-01-15T21:55:24Z DEBUG stderr= 2018-01-15T21:55:24Z DEBUG Starting external process 2018-01-15T21:55:24Z DEBUG args=/usr/bin/certutil -d /tmp/tmpoXIXYU -A -n CA certificate 1 -t C,, 2018-01-15T21:55:24Z DEBUG Process finished, return code=0 2018-01-15T21:55:24Z DEBUG stdout= 2018-01-15T21:55:24Z DEBUG stderr= 2018-01-15T21:55:24Z DEBUG Starting external process 2018-01-15T21:55:24Z DEBUG args=/usr/bin/certutil -d /tmp/tmpoXIXYU -A -n CA certificate 2 -t C,, 2018-01-15T21:55:24Z DEBUG Process finished, return code=0 2018-01-15T21:55:24Z DEBUG stdout= 2018-01-15T21:55:24Z DEBUG stderr= 2018-01-15T21:55:24Z DEBUG Starting external process 2018-01-15T21:55:24Z DEBUG args=/usr/bin/certutil -d /tmp/tmpoXIXYU -A -n CA certificate 3 -t C,, 2018-01-15T21:55:24Z DEBUG Process finished, return code=0 2018-01-15T21:55:24Z DEBUG stdout= 2018-01-15T21:55:24Z DEBUG stderr= 2018-01-15T21:55:24Z DEBUG Starting external process 2018-01-15T21:55:24Z DEBUG args=/usr/bin/certutil -d /tmp/tmpoXIXYU -A -n CA certificate 4 -t C,, 2018-01-15T21:55:24Z DEBUG Process finished, return code=0 2018-01-15T21:55:24Z DEBUG stdout= 2018-01-15T21:55:24Z DEBUG stderr= 2018-01-15T21:55:24Z DEBUG Starting external process 2018-01-15T21:55:24Z DEBUG args=/usr/bin/certutil -d /tmp/tmpoXIXYU -A -n CA certificate 5 -t C,, 2018-01-15T21:55:24Z DEBUG Process finished, return code=0 2018-01-15T21:55:24Z DEBUG stdout= 2018-01-15T21:55:24Z DEBUG stderr= 2018-01-15T21:55:24Z DEBUG failed to find session_cookie in persistent storage for principal 'host/sfca-do-1.xyz.com(a)IPA.XYZ.COM' 2018-01-15T21:55:24Z INFO trying https://sfca-do-4.ipa.xyz.com/ipa/json 2018-01-15T21:55:24Z DEBUG Created connection context.rpcclient_140336485358096 2018-01-15T21:55:24Z DEBUG Try RPC connection 2018-01-15T21:55:24Z INFO Forwarding 'ping' to json server 'https://sfca-do-4.ipa.xyz.com/ipa/json' 2018-01-15T21:55:24Z DEBUG Destroyed connection context.rpcclient_140336485358096 2018-01-15T21:55:24Z INFO Cannot connect to the server due to Kerberos error: Major (851968): Unspecified GSS failure. Minor code may provide more information, Minor (2529639066): Cannot find KDC for realm "IPA.XYZ.COM". Trying with delegate=True 2018-01-15T21:55:24Z INFO trying https://sfca-do-4.ipa.xyz.com/ipa/json 2018-01-15T21:55:24Z DEBUG Created connection context.rpcclient_140336485358096 2018-01-15T21:55:24Z DEBUG Try RPC connection 2018-01-15T21:55:24Z INFO Forwarding 'ping' to json server 'https://sfca-do-4.ipa.xyz.com/ipa/json' 2018-01-15T21:55:24Z WARNING Second connect with delegate=True also failed: Major (851968): Unspecified GSS failure. Minor code may provide more information, Minor (2529639066): Cannot find KDC for realm "IPA.XYZ.COM" 2018-01-15T21:55:24Z ERROR Cannot connect to the IPA server RPC interface: Major (851968): Unspecified GSS failure. Minor code may provide more information, Minor (2529639066): Cannot find KDC for realm "IPA.XYZ.COM" 2018-01-15T21:55:24Z ERROR Installation failed. Rolling back changes. ===== But where I'm confused is in why I keep hitting this 'cannot find kdc' error. I have tried manually setting /etc/krb5.conf to the contents that get generated & display during the verbose client-install process (as seen above), that manually spell out the KDC details, and am able to run a 'kinit admin' just fine from the CLI on the client, so kerberos DOES function from the client. It talks to the KDC beautifully and authenticates just fine... so I'm not sure how the client-install process is getting confused/lost when trying to find/contact the KDC. Any hints or suggestions are greatly appreciated. I'm essentially stuck on finishing roll-out of these IPA servers into production because of this one component. Thanks, -Chris

4 13

CCacheError: did not receive Kerberos credentials
by Dimitris Zilaskos 17 Jan '18

17 Jan '18

Hello, I have been asked to look into an ipa server running in CentOS 6. The server was missbehaving for some time, with some certificates expiring back in October. Also / was full. I have cleaned up some space, set the date back before the certificates expired, restarted/rebooted but renewal of certs fails: [Wed Oct 25 00:00:21 2017] [info] Connection to child 0 established (server portal.cloud.local, client 10.142.20.10) [Wed Oct 25 00:00:21 2017] [debug] nss_engine_init.c(1948): SNI: Found nickname Server-Cert for vhost: portal.cloud.local [Wed Oct 25 00:00:21 2017] [debug] nss_engine_init.c(1970): SNI: Successfully paired vhost portal.cloud.local with nickname: Server-Cert [Wed Oct 25 00:00:21 2017] [debug] nss_engine_kernel.c(93): SNI request for portal.cloud.local [Wed Oct 25 00:00:21 2017] [info] Initial (No.1) HTTPS request received for child 0 (server portal.cloud.local:443) [Wed Oct 25 00:00:21 2017] [error] ipa: DEBUG: WSGI wsgi_dispatch.__call__: [Wed Oct 25 00:00:21 2017] [error] ipa: DEBUG: WSGI xmlserver.__call__: [Wed Oct 25 00:00:21 2017] [error] ipa: ERROR: 500 Internal Server Error: xmlserver.__call__: KRB5CCNAME not defined in HTTP request environment [Wed Oct 25 00:00:21 2017] [error] ipa: DEBUG: response: CCacheError: did not receive Kerberos credentials [Wed Oct 25 00:00:21 2017] [info] Connection to child 0 closed (server portal.cloud.local:443, client 10.142.20.10) I can do kinit admin without problems. Please any hints how can I resoleve this? Best regards, Dimitrios

2 4

Basic Certificate Creation Question
by Callum Guy 17 Jan '18

17 Jan '18

Hi All, I'm planning to add a subdomain certificate for an internal web service using FreeIPA CA however in my example I am applying the certificate to an interim proxy server. For example I want to sign a certificate for "web.domain.com" and serve it on host "proxy.domain.com". Based on what I have learnt from using FreeIPA so far I presume the correct way to do this is via service principal: HTTP/proxy.domain.com(a)DOMAIN.COM When I attempt to create the certificate from my CSR I get the following error report: "invalid 'csr': hostname in subject of request 'web.domain.com' does not match name or aliases of principal 'HTTP/proxy.domain.com(a)DOMAIN.COM'" Ii have tried adding aliases to the principal however I haven't been able to make it work - a lack of understanding I think! I am sure that I am just doing something wrong and it would be great if someone could help explain what I should be doing. Many thanks, Callum -- Callum Guy Head of Information Security X-on -- *0333 332 0000 | www.x-on.co.uk <http://www.x-on.co.uk> | ** <https://www.linkedin.com/company/x-on> <https://www.facebook.com/XonTel> <https://twitter.com/xonuk> * X-on is a trading name of Storacall Technology Ltd a limited company registered in England and Wales. Registered Office : Avaland House, 110 London Road, Apsley, Hemel Hempstead, Herts, HP3 9SD. Company Registration No. 2578478. The information in this e-mail is confidential and for use by the addressee(s) only. If you are not the intended recipient, please notify X-on immediately on +44(0)333 332 0000 and delete the message from your computer. If you are not a named addressee you must not use, disclose, disseminate, distribute, copy, print or reply to this email. Views or opinions expressed by an individual within this email may not necessarily reflect the views of X-on or its associated companies. Although X-on routinely screens for viruses, addressees should scan this email and any attachments for viruses. X-on makes no representation or warranty as to the absence of viruses in this email or any attachments.

2 5

FreeIPA NFS Automount with Kerberos troubleshooting help needed
by jcccb 16 Jan '18

16 Jan '18

I got an FreeIPA Server (F27) up and running on a proxmox host in a vm fine so far with an Centos client as an NFS-Server. I setup a second ubuntu client (17.10) with indirect mounts for home an some storage folders. The home automount points are working fine but the others i cant access... i guess i could have something to do with file permissions and maybe u can point me in the right direction. folder on the server for HOME= [root@nfs_server~]# ls -la /home/ total 22 drwx------ 2 username username 6 Dec 26 01:01 username drwxrwxrwt 2 root root 4 Jan 6 22:41 public STORAGE= [root@nfs server~]# ls -la /storage/ total 32 drw-r--r-- 6 root root 6 Dec 17 02:23 . drwxr-xr-x 21 root root 26 Jan 7 03:56 .. drw-r--r-- 4 root root 5 Dec 12 01:08 data drw-r-Sr-- 7 1976250001 1976250004 17 Dec 21 18:29 downloads drwxrwxrwt 10 root root 12 Oct 15 05:58 media drw-r--r-- 2 root root 2 Nov 13 03:34 software UBUNTUCLIENT= username@client:/root$ ls -la /storage/ total 9 drwxr-xr-x 6 root root 0 Jan 7 20:29 . drwxr-xr-x 23 root root 23 Jan 7 20:29 .. dr-xr-xr-x 2 root root 0 Jan 7 20:29 data dr-xr-xr-x 2 root root 0 Jan 7 20:29 downloads dr-xr-xr-x 2 root root 0 Jan 7 20:29 media dr-xr-xr-x 2 root root 0 Jan 7 20:29 software username@client:/root$ ls -la /home/ipa/ total 1 drwxr-xr-x 3 root root 0 Jan 7 20:29 . drwxr-xr-x 3 root root 3 Dec 26 03:06 .. dr-xr-xr-x 2 root root 0 Jan 7 20:29 public if i wanna access for example the the downloads folder i get an: username@leech:/root$ ls /storage/downloads/ ls: cannot access '/storage/downloads/': No such file or directory actually right now it even seems that i can only access the public folder and get the same "noch such file or directory error" if i try to access user home folder "username". i remember that this worked before somehow. suspected the proxmox lxc container messing probably something up with the uids or guids? i disabled the unpriviliged containers anyways for bugfixing. Any Help would be much apprecciated i will provide any needed additonal logs.

4 6

HBAC Lookups by host rather than user/group
by Louis Abel 16 Jan '18

16 Jan '18

Hello. I was curious if there is something built in to FreeIPA (4.5.0 on CentOS) as a whole or if someone has created scripts or the like that perform access rights lookups without doing the typical hbac rule lookups which requires user -> host -> service (as far as I know), where those things are required to actually perform the access granted/denied test. Basically, what I'm trying to figure out is there a way to pick a host for example, and get a list of who can access the system on a specific service (or any service for that matter). The reason I ask is I'm trying to figure out how to properly perform "audits" at my place of work, ie for PCI and SOX. And as far as I can tell, there's no easy way to do this when we have for example, two HBAC policies that allow all hosts (so there's no "member" attributes on the directory objects, just hostCategory all) and then majority of the policies are using groups rather than specific individuals, so I'd have to get a list of all of the users, including the ones that are in AD across the trust. If there isn't something like this built in, has someone done something like this before? I'd like to try to avoid rolling my own solution if possible, but if I had to roll my own solution, I could use some advisement or hints on something like this.

2 2

Get user ssh key instead of fingerprint.
by Maciej Drobniuch 16 Jan '18

16 Jan '18

Hi all. Is there any way to get the user's ssh key (not fingerprint) via console? Maybe LDAP? Or only via a https request ? Thanks -- Best regards Maciej Drobniuch Network Security Engineer Collective-Sense,LLC

3 3

ubuntu smbclient error connecting to fedora freeipa + samba server
by Crashbunny 16 Jan '18

16 Jan '18

Hi, On a xenial desktop I have installed freeipa-client, and it seems to be working OK. I'm still learning freeipa and related technologies like kerberos. I can for example run the command "id freeipauser1" and see the uid uid=1098200003 I can kinit and authenticate, I can run klist and see the ticket If I run smbclient -k -L 192.168.1.1 I get SPNEGO: Could not find a suitable mechtype in NEG_TOKEN_INIT session setup failed: NT_STATUS_NO_MEMORY There's a few hits in search engines with those errors, but nothing I found helped me fix the problem. If I run smbclient -L 192.168.1.1 it asks me for my password and it works OK. If I run smbcliebt -k -L localhost on the samba server it works OK How do I debug this please?

1 0

Corosync or user multi environment seem conflict with ipa
by barrykfl＠gmail.com 15 Jan '18

15 Jan '18

Hi: I have the corosyc peacemaker cluster working fine on basic function. BUt tried to reboot one node the HA work ...but after reboot . It "sometimes" make certmonger.service fail? 10 times may 6 times fail but reboot several times it work again. I discovered that the most case happen together is that session-1.scope or session-2.scope not load at that time. Any idea ? is it dependency issue ? I already tried many combination . e.g. start certmonger.service before coroysnc / dbus.service same happening. Normal: session-1.scope loaded active running Session 1 of user root alsa-state.service loaded active running Manage Sound Card State (restore and store) atd.service loaded active running Job spooling tools certmonger.service loaded active running Certificate monitoring and PKI en coroysnc.service Running Fail: alsa-state.service loaded active running Manage Sound Card State (restore and store) atd.service loaded active running Job spooling tools certmonger.service Failed Certificate monitoring and PKI en coroysnc.service Running

1 0

Problems with KeyRetrieverClass when setting up replica with CA
by Aljaž Srebrnič 15 Jan '18

15 Jan '18

Hello! Yesterday I tried migrating a physical machine (ipa1) that was a FreeIPA CA CRL master in my VM cluster. I followed the guide at [1] to migrate che CRL master to another replica (ipa2) and uninstalled the replica ipa1. Then I set up a VM with the same hostname and IP address as the physical machine, and installed Fedora 27. When I tried setting up the replica with CA, the install stopped at: [4/25]: configuring certificate server instance And in my /var/log/pki/pki-tomcat/ca/debug I see a bunch of log entries like this, with increasing time stamps: Unable to read key retriever class from CS.cfg: Property features.authority.keyRetrieverClass missing value Retrying in 14778 seconds I checked the /etc/pki/pki-tomcat/ca/CS.cfg file and I don’t actually have that entry at all, I only have: features.authority.description=Lightweight CAs features.authority.enabled=true features.authority.version=1.0 However, if I manually add them by copying the value from the good replica, nothing changes and the installer is still blocked on that line (maybe the CS.cfg file isn’t re-read on each retry). Moreover, it looks like that file (CS.cfg) is generated by the installer script… How can I solve this? Thanks, Aljaž [1]: https://www.freeipa.org/page/Howto/Promote_CA_to_Renewal_and_CRL_Master#Pro… -- Aljaž Srebrnič a.k.a g5pw My public key: https://g5pw.me/key Key fingerprint = 2109 8131 60CA 01AF 75EC 01BF E140 E1EE A54E E677

2 3

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users January 2018