November 2018 - FreeIPA-users - Fedora mailing-lists

Installation Error in step: Configuring the web interface (httpd)
by c.monty＠web.de 26 Nov '18

26 Nov '18

3 2

IPA server upgrade fails with KDC error
by Johannes Brandstetter 23 Nov '18

23 Nov '18

Hi, I'm trying to upgrade FreeIPA through ipa-server-upgrade from 4.4 to 4.5. The command fails with an "ACIError: Insufficient access:" . I find in the kdc log that it complains about " Database module does not match KDC version - while initializing database for realm..." Does anybody know how to fix this? Some more info: $ cat /etc/redhat-release CentOS Linux release 7.4.1708 (Core) $ tail /var/log/krb5kdc.log krb5kdc: Server error - while fetching master key K/M for realm XXX krb5kdc: Database module does not match KDC version - while initializing database for realm XXX $ sudo less /var/log/ipaupgrade.log 2017-10-16T13:04:13Z DEBUG Loading StateFile from '/var/lib/ipa/sysrestore/sysrestore.state' 2017-10-16T13:04:13Z DEBUG Loading StateFile from '/var/lib/ipa/sysrestore/sysrestore.state' 2017-10-16T13:04:13Z DEBUG Saving StateFile to '/var/lib/ipa/sysrestore/sysrestore.state' 2017-10-16T13:04:13Z DEBUG Loading StateFile from '/var/lib/ipa/sysrestore/sysrestore.state' 2017-10-16T13:04:13Z DEBUG Loading StateFile from '/var/lib/ipa/sysrestore/sysrestore.state' 2017-10-16T13:04:13Z DEBUG Saving StateFile to '/var/lib/ipa/sysrestore/sysrestore.state' 2017-10-16T13:04:13Z DEBUG Loading StateFile from '/var/lib/ipa/sysrestore/sysrestore.state' 2017-10-16T13:04:13Z DEBUG duration: 0 seconds 2017-10-16T13:04:13Z ERROR IPA server upgrade failed: Inspect /var/log/ipaupgrade.log and run command ipa-server-upgrade manually. 2017-10-16T13:04:14Z DEBUG File "/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 172, in execute return_value = self.run() File "/usr/lib/python2.7/site-packages/ipaserver/install/ipa_server_upgrade.py", line 46, in run server.upgrade() File "/usr/lib/python2.7/site-packages/ipaserver/install/server/upgrade.py", line 1896, in upgrade data_upgrade.create_instance() File "/usr/lib/python2.7/site-packages/ipaserver/install/upgradeinstance.py", line 124, in create_instance runtime=90) File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 504, in start_creation run_step(full_msg, method) File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 494, in run_step method() File "/usr/lib/python2.7/site-packages/ipaserver/install/upgradeinstance.py", line 96, in __start api.Backend.ldap2.connect() File "/usr/lib/python2.7/site-packages/ipalib/backend.py", line 66, in connect conn = self.create_connection(*args, **kw) File "/usr/lib/python2.7/site-packages/ipaserver/plugins/ldap2.py", line 190, in create_connection client_controls=clientctrls) File "/usr/lib/python2.7/site-packages/ipapython/ipaldap.py", line 1111, in external_bind '', auth_tokens, server_controls, client_controls) File "/usr/lib64/python2.7/contextlib.py", line 35, in __exit__ self.gen.throw(type, value, traceback) File "/usr/lib/python2.7/site-packages/ipapython/ipaldap.py", line 1007, in error_handler raise errors.ACIError(info=info) 2017-10-16T13:04:14Z DEBUG The ipa-server-upgrade command failed, exception: ACIError: Insufficient access: 2017-10-16T13:04:14Z ERROR Insufficient access: 2017-10-16T13:04:14Z ERROR The ipa-server-upgrade command failed. See /var/log/ipaupgrade.log for more information $ sudo less /var/log/yum.log Oct 16 05:36:02 Updated: ipa-common-4.5.0-21.el7.centos.1.2.noarch Oct 16 05:36:02 Updated: ipa-client-common-4.5.0-21.el7.centos.1.2.noarch Oct 16 05:36:25 Updated: libipa_hbac-1.15.2-50.el7_4.2.x86_64 Oct 16 05:36:53 Updated: python-libipa_hbac-1.15.2-50.el7_4.2.x86_64 Oct 16 05:36:55 Updated: python2-ipalib-4.5.0-21.el7.centos.1.2.noarch Oct 16 05:36:55 Updated: python2-ipaclient-4.5.0-21.el7.centos.1.2.noarch Oct 16 05:37:23 Updated: ipa-python-compat-4.5.0-21.el7.centos.1.2.noarch Oct 16 05:38:43 Updated: ipa-server-common-4.5.0-21.el7.centos.1.2.noarch Oct 16 05:38:44 Updated: python2-ipaserver-4.5.0-21.el7.centos.1.2.noarch Oct 16 05:38:44 Updated: sssd-ipa-1.15.2-50.el7_4.2.x86_64 Oct 16 05:39:01 Installed: ipa-client-4.5.0-21.el7.centos.1.2.x86_64 Oct 16 05:39:28 Updated: ipsilon-tools-ipa-2.0.2-5.el7.centos.noarch Oct 16 05:39:29 Updated: ipa-server-4.5.0-21.el7.centos.1.2.x86_64 Oct 16 05:40:48 Erased: ipa-admintools-4.4.0-14.el7.centos.7.noarch Oct 16 05:19:30 Updated: krb5-libs-1.15.1-8.el7.x86_64 Oct 16 05:19:30 Updated: krb5-workstation-1.15.1-8.el7.x86_64 Oct 16 05:19:31 Updated: krb5-server-1.15.1-8.el7.x86_64 Oct 16 05:19:31 Updated: krb5-pkinit-1.15.1-8.el7.x86_64 Oct 16 05:38:22 Updated: sssd-krb5-common-1.15.2-50.el7_4.2.x86_64 Oct 16 05:38:57 Updated: sssd-krb5-1.15.2-50.el7_4.2.x86_64 Cheers, Johannes

4 11

RSA using FreeIPA as an identity source
by Angus Clarke 22 Nov '18

22 Nov '18

Hi all Excuse my ignorance, can anyone give me some pointers on getting RSA Authentication Manager 8 to use FreeIPA 4.5 as an identity source over LDAPS? Many thanks Angus

1 0

Migration from Test to Production
by Ronald Wimmer 22 Nov '18

22 Nov '18

Hi, we have been evaluating FreeIPA for quite a while now on our test setup (1 IPA server, 1 Replica) and are planning to move towards production. Can the whole setup be migrated from an ipa test to an ipa production server? (the ipa 'linux.ourdomain.at' domain should stay the same) Or would it be easier to use both test servers for production (and just adding additional replicas)? Cheers, Ronald

3 5

Can OTP use as other datasource other than LDAP?
by luckydog xf 21 Nov '18

21 Nov '18

when I deploy freeipa with build-in LDAP( 389 DS), and create user with OTP password enabled, I can integrate into freeradius with LDAP module to authenticate against Network Access Service( Switch.etc) with user's password and OTP password. My question is that, our vpn only supports MSchap authenticaion, while I want to use MS Active Directory as freeipa datastore ( Don't use 389 DS) , if OTP works as well, it's great. yet judging from https://www.freeipa.org/page/V4/OTP, it's only applicable to LDAP.

1 0

Can IPA-otp use together with MS Active Directory?
by fu-hong-quan＠pacific-textiles.com 21 Nov '18

21 Nov '18

Hi, I'm curious that can OTP of freeipa use with MS AD, it seems it's only associated with LDAP, judging from https://www.freeipa.org/page/V4/OTP Any other work around as we are going to use AD as backend user store, and auth against VPN ( using MSchap auth type, which means it supports NThash password only) login. Thanks.

1 0

New clients doesn't allow to use AD users with shortnames and showing the users/groups also with short names
by SOLER SANGUESA Miguel 21 Nov '18

21 Nov '18

I've been working for 1 year with a configuration that allow us to use AD users with short names for login on RHEL 6 clients and also the information on the client was showed with shortnames. Example: ssh AD_user(a)IDM_client1.mydomain.com PASSWORD: [AD_user@IDM_client1 ~]$ ls -la total 60 drwxr-x--- 5 AD_user AD_group 4096 Nov 21 08:53 . drwxr-xr-x. 40 root root 4096 Oct 29 09:12 .. -rw------- 1 AD_user AD_group 281 Jul 27 00:13 .bash_history -rw-r----- 1 AD_user AD_group 18 Oct 8 2015 .bash_logout -rw-r----- 1 AD_user AD_group 176 Oct 8 2015 .bash_profile -rw-r----- 1 AD_user AD_group 124 Oct 8 2015 .bashrc [AD_user@IDM_client1 ~]$ id uid=1156200001(AD_user) gid=1156200014(AD_group) groups=1156200014(AD_group),10001(AD_group2),20001(IDM_group1),1156200000(admins)... My sssd configuration is (marked lines added for this configuration): [domain/ipa.mydomain.com] krb5_auth_timeout = 90 cache_credentials = True krb5_store_password_if_offline = True ipa_domain = ipa.mydomain.com id_provider = ipa auth_provider = ipa access_provider = ipa ldap_tls_cacert = /etc/ipa/ca.crt ipa_hostname = IDM_client1.mydomain.com chpass_provider = ipa ipa_server = _srv_, IDM_server1.ipa.mydomain.com, IDM_server2.ipa.mydomain.com dns_discovery_domain = ipa.mydomain.com use_fully_qualified_names = true <------------------------ subdomain_homedir=%o [sssd] config_file_version = 2 services = nss, sudo, pam, ssh domains = ipa.mydomain.com default_domain_suffix = AD_domain.mydomain.com <------------------------ full_name_format = %1$s <------------------------ [nss] filter_groups = root filter_users = root,iccsecure,tomcat,oracle reconnection_retries = 3 [pam] reconnection_retries = 3 [sudo] [ssh] But I have realized that new RHEL 6 clients are not working like that anymore. Using the SAME configuration I can not login with short name (doesn't match HABC rule because don't show IDM_groups of the user, logs at the bottom). On the console I can see that my user (short name) just have the main group of the AD, all other groups have disappeared: [AD_user@IDM_client2 ~]$ id uid=1156200001(AD_user) gid=1156200014(AD_group) groups=1156200014(AD_group) So I have commented the line on sssd.conf as workaround: #full_name_format = %1$s But now I have long names showed on the client server and it is very annoying: [AD_user@IDM_client2 ~]$ ls -la total 20 drwxr-x--- 3 AD_user(a)AD_domain.mydomain.com AD_group(a)AD_domain.mydomain.com 4096 Nov 21 08:20 . drwxr-xr-x 20 root root 4096 Mar 6 2018 .. -rw------- 1 AD_user(a)AD_domain.mydomain.com AD_group(a)AD_domain.mydomain.com 110 Nov 21 08:07 .bash_history drwx------ 2 AD_user(a)AD_domain.mydomain.com AD_group(a)AD_domain.mydomain.com 4096 Dec 14 2017 .ssh -rw------- 1 AD_user(a)AD_domain.mydomain.com AD_group(a)AD_domain.mydomain.com 138 Nov 21 08:20 .Xauthority On the servers were is working fine if I erased sssd cache and restarted sssd, then it has the problem. So should be something that has change on the latests updates and we didn't realized because we were using the cache for login. And now that we have added new servers to IDM we have discovered the problem. Can you please let me know how to configure nowadays sssd for having short names on the login for AD users and short names showed on the machine? #### versions I'm using:####### --- IDM SERVERS - RHEL 7.5: --- ipa-common-4.5.4-10.el7_5.4.4.noarch ipa-python-compat-4.5.4-10.el7_5.4.4.noarch ipa-server-4.5.4-10.el7_5.4.4.x86_64 ipa-server-common-4.5.4-10.el7_5.4.4.noarch ipa-server-dns-4.5.4-10.el7_5.4.4.noarch ipa-server-trust-ad-4.5.4-10.el7_5.4.4.x86_64 libipa_hbac-1.16.0-19.el7_5.8.x86_64 sssd-1.16.0-19.el7_5.8.x86_64 sssd-ad-1.16.0-19.el7_5.8.x86_64 sssd-client-1.16.0-19.el7_5.8.x86_64 sssd-common-1.16.0-19.el7_5.8.x86_64 sssd-common-pac-1.16.0-19.el7_5.8.x86_64 sssd-dbus-1.16.0-19.el7_5.8.x86_64 sssd-ipa-1.16.0-19.el7_5.8.x86_64 sssd-krb5-1.16.0-19.el7_5.8.x86_64 sssd-krb5-common-1.16.0-19.el7_5.8.x86_64 sssd-ldap-1.16.0-19.el7_5.8.x86_64 sssd-proxy-1.16.0-19.el7_5.8.x86_64 sssd-tools-1.16.0-19.el7_5.8.x86_64 --- IDM CLIENTS - RHEL 6.10: --- ipa-admintools-3.0.0-51.el6.x86_64 ipa-client-3.0.0-51.el6.x86_64 ipa-python-3.0.0-51.el6.x86_64 libipa_hbac-1.13.3-60.el6.x86_64 python-iniparse-0.3.1-2.1.el6.noarch python-libipa_hbac-1.13.3-60.el6.x86_64 python-sssdconfig-1.13.3-60.el6.noarch sssd-1.13.3-60.el6.x86_64 sssd-ad-1.13.3-60.el6.x86_64 sssd-client-1.13.3-60.el6.x86_64 sssd-common-1.13.3-60.el6.x86_64 sssd-common-pac-1.13.3-60.el6.x86_64 sssd-ipa-1.13.3-60.el6.x86_64 sssd-krb5-1.13.3-60.el6.x86_64 sssd-krb5-common-1.13.3-60.el6.x86_64 sssd-ldap-1.13.3-60.el6.x86_64 sssd-proxy-1.13.3-60.el6.x86_64 sssd-tools-1.13.3-60.el6.x86_64 ##### LOGS ##### * /var/log/sssd/sssd_ipa.mydomain.com.log (debug_level = 8): ... [sssd[be[ipa.mydomain.com]]] [get_groups_dns] (0x0400): Root domain uses fully-qualified names, objects might not be correctly added to groups with short names. [sssd[be[ipa.mydomain.com]]] [get_groups_dns] (0x0400): Root domain uses fully-qualified names, objects might not be correctly added to groups with short names. [sssd[be[ipa.mydomain.com]]] [ipa_s2n_save_objects] (0x2000): Updating memberships for AD_user [sssd[be[ipa.mydomain.com]]] [sysdb_mod_group_member] (0x0080): ldb_modify failed: [Attribute or value exists](20)[attribute 'member': value #0 on 'name=IDM_group1,cn=groups,cn=ipa.mydomain.com,cn=sysdb' already exists] [sssd[be[ipa.mydomain.com]]] [sysdb_mod_group_member] (0x0400): Error: 17 (File exists) [sssd[be[ipa.mydomain.com]]] [sysdb_update_members_ex] (0x0020): Could not add member [AD_user] to group [name=IDM_group1,cn=groups,cn=ipa.mydomain.com,cn=sysdb]. Skipping. ----- (repeated with all IDM_groups) ----- .... ----- the request ----- [sssd[be[ipa.mydomain.com]]] [be_pam_handler] (0x0100): Got request with the following data [sssd[be[ipa.mydomain.com]]] [pam_print_data] (0x0100): command: SSS_PAM_ACCT_MGMT [sssd[be[ipa.mydomain.com]]] [pam_print_data] (0x0100): domain: AD_domain.mydomain.com [sssd[be[ipa.mydomain.com]]] [pam_print_data] (0x0100): user: AD_user [sssd[be[ipa.mydomain.com]]] [pam_print_data] (0x0100): service: sshd [sssd[be[ipa.mydomain.com]]] [pam_print_data] (0x0100): tty: ssh [sssd[be[ipa.mydomain.com]]] [pam_print_data] (0x0100): ruser: [sssd[be[ipa.mydomain.com]]] [pam_print_data] (0x0100): rhost: 10.XX.XX.XX [sssd[be[ipa.mydomain.com]]] [pam_print_data] (0x0100): authtok type: 0 [sssd[be[ipa.mydomain.com]]] [pam_print_data] (0x0100): newauthtok type: 0 [sssd[be[ipa.mydomain.com]]] [pam_print_data] (0x0100): priv: 1 [sssd[be[ipa.mydomain.com]]] [pam_print_data] (0x0100): cli_pid: 54232 [sssd[be[ipa.mydomain.com]]] [pam_print_data] (0x0100): logon name: not set [sssd[be[ipa.mydomain.com]]] [sdap_access_send] (0x0400): Performing access check for user [AD_user] [sssd[be[ipa.mydomain.com]]] [sdap_account_expired_rhds] (0x0400): Performing RHDS access check for user [AD_user] ----- result (doesn't find any group for the user) ----- [sssd[be[ipa.mydomain.com]]] [hbac_shost_attrs_to_rule] (0x0400): Processing source hosts for rule [All server access] [sssd[be[ipa.mydomain.com]]] [hbac_shost_attrs_to_rule] (0x2000): Source hosts disabled, setting ALL [sssd[be[ipa.mydomain.com]]] [hbac_eval_user_element] (0x1000): No groups for [AD_user] <----------------------------------------------- [sssd[be[ipa.mydomain.com]]] [ipa_hbac_evaluate_rules] (0x0080): Access denied by HBAC rules [sssd[be[ipa.mydomain.com]]] [be_pam_handler_callback] (0x0100): Backend returned: (0, 6, <NULL>) [Success] [sssd[be[ipa.mydomain.com]]] [be_pam_handler_callback] (0x0100): Sending result [6][AD_domain.mydomain.com] [sssd[be[ipa.mydomain.com]]] [be_pam_handler_callback] (0x0100): Sent result [6][AD_domain.mydomain.com] [sssd[be[ipa.mydomain.com]]] [sdap_process_result] (0x2000): Trace: sh[0xc4a3c0], connected[1], ops[(nil)], ldap[0xc4f480] [sssd[be[ipa.mydomain.com]]] [sdap_process_result] (0x2000): Trace: ldap_result found nothing! [sssd[be[ipa.mydomain.com]]] [sbus_remove_watch] (0x2000): 0xc60100/0xc5ccf0 [sssd[be[ipa.mydomain.com]]] [sbus_remove_watch] (0x2000): 0xc60100/0xc61480 [sssd[be[ipa.mydomain.com]]] [sbus_dispatch] (0x0080): Connection is not open for dispatching. [sssd[be[ipa.mydomain.com]]] [be_client_destructor] (0x0400): Removed PAC client [sssd[be[ipa.mydomain.com]]] [sbus_remove_watch] (0x2000): 0xc4c890/0xc4b5e0 [sssd[be[ipa.mydomain.com]]] [sbus_remove_watch] (0x2000): 0xc4c890/0xc4b4a0 [sssd[be[ipa.mydomain.com]]] [sbus_dispatch] (0x0080): Connection is not open for dispatching. [sssd[be[ipa.mydomain.com]]] [be_client_destructor] (0x0400): Removed SSH client [sssd[be[ipa.mydomain.com]]] [sbus_remove_watch] (0x2000): 0xc475d0/0xc45780 [sssd[be[ipa.mydomain.com]]] [sbus_remove_watch] (0x2000): 0xc475d0/0xc45730 [sssd[be[ipa.mydomain.com]]] [sbus_dispatch] (0x0080): Connection is not open for dispatching. [sssd[be[ipa.mydomain.com]]] [be_client_destructor] (0x0400): Removed PAM client [sssd[be[ipa.mydomain.com]]] [sbus_remove_watch] (0x2000): 0xc4ed40/0xc4c9e0 [sssd[be[ipa.mydomain.com]]] [sbus_remove_watch] (0x2000): 0xc4ed40/0xc4c990 [sssd[be[ipa.mydomain.com]]] [sbus_dispatch] (0x0080): Connection is not open for dispatching. [sssd[be[ipa.mydomain.com]]] [be_client_destructor] (0x0400): Removed SUDO client [sssd[be[ipa.mydomain.com]]] [sbus_remove_watch] (0x2000): 0xc42380/0xc3e080 [sssd[be[ipa.mydomain.com]]] [sbus_remove_watch] (0x2000): 0xc42380/0xc21350 [sssd[be[ipa.mydomain.com]]] [remove_krb5_info_files] (0x0200): Could not remove [/var/lib/sss/pubconf/kpasswdinfo.IPA.MYDOMAIN.ORG], [2][No such file or directory] [sssd[be[ipa.mydomain.com]]] [be_ptask_destructor] (0x0400): Terminating periodic task [SUDO Smart Refresh] [sssd[be[ipa.mydomain.com]]] [be_ptask_destructor] (0x0400): Terminating periodic task [SUDO Full Refresh] [sssd[be[ipa.mydomain.com]]] [sdap_handle_release] (0x2000): Trace: sh[0xc4a3c0], connected[1], ops[(nil)], ldap[0xc4f480], destructor_lock[0], release_memory[0] [sssd[be[ipa.mydomain.com]]] [sbus_remove_watch] (0x2000): 0xc24320/0xc248e0 On the contrary on other IPA client without removing cache and same configuration it founds 13 groups: [sssd[be[ipa.mydomain.com]]] [hbac_shost_attrs_to_rule] (0x0400): Processing source hosts for rule [All server access] [sssd[be[ipa.mydomain.com]]] [hbac_shost_attrs_to_rule] (0x2000): Source hosts disabled, setting ALL [sssd[be[ipa.mydomain.com]]] [hbac_eval_user_element] (0x1000): [13] groups for [AD_user] <---------------------------------------------- [sssd[be[ipa.mydomain.com]]] [hbac_eval_user_element] (0x1000): Added group [IDM_group1] for user [AD_user] ------ 12 groups more ------ [sssd[be[ipa.mydomain.com]]] [ipa_hbac_evaluate_rules] (0x0080): Access granted by HBAC rule [Full ssh for admins] [sssd[be[ipa.mydomain.com]]] [be_pam_handler_callback] (0x0100): Backend returned: (0, 0, <NULL>) [Success] [sssd[be[ipa.mydomain.com]]] [sdap_process_result] (0x2000): Trace: sh[0x1f72630], connected[1], ops[(nil)], ldap[0x1f75390] [sssd[be[ipa.mydomain.com]]] [sdap_process_result] (0x2000): Trace: ldap_result found nothing! Thanks & Regards.

2 1

Is the admins group special?
by Remco Kranenburg 21 Nov '18

21 Nov '18

Hi all, We received a question from one of our auditors about who has the permission to do certain actions in FreeIPA itself. This is managed by the RBAC system: you can for example configure that certain groups are allowed to manage certain parts of FreeIPA. We currently only have two roles: normal users and admins. Normal users have the default self-service permissions, and admins can do anything within FreeIPA. However, for that last part we cannot figure out how this is specified within FreeIPA. There is no RBAC role that gives admins all permissions. Is the admins group maybe special, in that it is hardcoded to be able to change anything within FreeIPA? -- Remco Kranenburg

2 1

Info - cli - Powershell module for FreeIPA published and available on GitHub
by Lucas Cueff 19 Nov '18

19 Nov '18

Hello FreeIPA world, First thanks for this great product, I was looking for an Active Directory 'clone' for the opensource world and I have successfully tested and deployed a FreeIPA infra, thanks to your great job guys ! Because I am also a Windows admin sys working from Windows platform, I wanted to keep PowerShell as my main shell and script platform. I have started to port the Python cli in a Powershell module. For the Powershell user, my work is available at : https://github.com/MS-LUF/Manage-FreeIPA Currently, the APIs already implemented in the v0.1 are : config_mod config_show env group_add group_add_member group_del group_find group_mod group_remove_member group_show Host_add Host_del Host_mod Host_show passwd permission_add permission_add_member permission_add_Noaci permission_find permission_mod permission_remove_member permission_show privilege_add privilege_add_member privilege_add_permission privilege_del privilege_find privilege_mod privilege_remove_member privilege_remove_permission privilege_show role_add role_add_member role_add_privilege role_del role_find role_mod role_remove_member role_remove_privilege role_show sessionlogout user_add user_del user_disable user_Enable user_find user_mod user_show user_status user_unlock host_find More, to come soon. @+ Luf35

2 5

Connect to WebUI fails: ERR_CONNECTION_TIMED_OUT
by 74cmonty 18 Nov '18

18 Nov '18

Hi, I have completed installation on Fedora Server 29 w/o issues. Before I tried WebUI I ensured that administrative ticket is valid. '''' [root@ipa ~]# ipa user-show admin Anmeldename: admin Nachname: Administrator Home-Verzeichnis: /home/admin Anmeldeshell: /bin/bash Principal alias: admin@<MYDOMAIN>.DE UID: 202400000 Gruppen-ID: 202400000 Konto ist deaktiviert: False Passwort: True Mitglied der Gruppen: admins, trust admins Kerberos-Schlüssel verfügbar: True '''' When I try to access WebUI using this URL https://ipa.<mydomain>.de/ipa/ui I get this error: ERR_CONNECTION_TIMED_OUT '''' [root@ipa ~]# date -R Mon, 19 Nov 2018 00:08:03 +0100 semanage port -l | grep ssh [root@ipa ~]# journalctl -u httpd -- Logs begin at Sun 2018-11-18 13:18:31 CET, end at Mon 2018-11-19 00:08:50 CET. -- Nov 18 16:56:22 ipa.<mydomain>.de systemd[1]: Starting The Apache HTTP Server... Nov 18 16:56:23 ipa.<mydomain>.de ipa-httpd-kdcproxy[7343]: ipa: INFO: KDC proxy enabled Nov 18 16:56:23 ipa.<mydomain>.de ipa-httpd-kdcproxy[7343]: ipa-httpd-kdcproxy: INFO KDC proxy enabled Nov 18 16:56:23 ipa.<mydomain>.de httpd[7345]: Server configured, listening on: port 443, port 80 Nov 18 16:56:23 ipa.<mydomain>.de systemd[1]: Started The Apache HTTP Server. Nov 18 16:57:57 ipa.<mydomain>.de systemd[1]: Stopping The Apache HTTP Server... Nov 18 16:57:58 ipa.<mydomain>.de systemd[1]: Stopped The Apache HTTP Server. Nov 18 16:57:58 ipa.<mydomain>.de systemd[1]: Starting The Apache HTTP Server... Nov 18 16:57:58 ipa.<mydomain>.de ipa-httpd-kdcproxy[7948]: ipa: INFO: KDC proxy enabled Nov 18 16:57:58 ipa.<mydomain>.de ipa-httpd-kdcproxy[7948]: ipa-httpd-kdcproxy: INFO KDC proxy enabled Nov 18 16:57:59 ipa.<mydomain>.de httpd[7950]: Server configured, listening on: port 443, port 80 Nov 18 16:57:59 ipa.<mydomain>.de systemd[1]: Started The Apache HTTP Server. Nov 18 16:58:05 ipa.<mydomain>.de [7957]: GSSAPI client step 1 Nov 18 16:58:05 ipa.<mydomain>.de [7957]: GSSAPI client step 1 Nov 18 16:58:05 ipa.<mydomain>.de [7957]: GSSAPI client step 1 Nov 18 16:58:06 ipa.<mydomain>.de [7959]: GSSAPI client step 1 Nov 18 16:58:06 ipa.<mydomain>.de [7959]: GSSAPI client step 1 Nov 18 16:58:06 ipa.<mydomain>.de [7959]: GSSAPI client step 1 Nov 18 16:58:06 ipa.<mydomain>.de [7956]: GSSAPI client step 1 Nov 18 16:58:06 ipa.<mydomain>.de [7956]: GSSAPI client step 1 Nov 18 16:58:06 ipa.<mydomain>.de [7956]: GSSAPI client step 1 Nov 18 16:58:07 ipa.<mydomain>.de [7960]: GSSAPI client step 1 Nov 18 16:58:07 ipa.<mydomain>.de [7960]: GSSAPI client step 1 Nov 18 16:58:07 ipa.<mydomain>.de [7960]: GSSAPI client step 1 Nov 18 17:00:57 ipa.<mydomain>.de [7957]: GSSAPI client step 1 Nov 18 17:00:57 ipa.<mydomain>.de [7957]: GSSAPI client step 1 Nov 18 17:00:57 ipa.<mydomain>.de [7957]: GSSAPI client step 1 Nov 18 17:06:00 ipa.<mydomain>.de systemd[1]: Stopping The Apache HTTP Server... Nov 18 17:06:02 ipa.<mydomain>.de systemd[1]: Stopped The Apache HTTP Server. -- Reboot -- Nov 18 17:06:21 ipa.<mydomain>.de systemd[1]: Starting The Apache HTTP Server... Nov 18 17:06:21 ipa.<mydomain>.de ipa-httpd-kdcproxy[926]: ipa: INFO: KDC proxy enabled Nov 18 17:06:21 ipa.<mydomain>.de ipa-httpd-kdcproxy[926]: ipa-httpd-kdcproxy: INFO KDC proxy enabled Nov 18 17:06:21 ipa.<mydomain>.de httpd[930]: Server configured, listening on: port 443, port 80 Nov 18 17:06:21 ipa.<mydomain>.de systemd[1]: Started The Apache HTTP Server. Nov 18 23:50:30 ipa.<mydomain>.de [938]: GSSAPI client step 1 Nov 18 23:50:30 ipa.<mydomain>.de [938]: GSSAPI client step 1 Nov 18 23:50:30 ipa.<mydomain>.de [938]: GSSAPI client step 1 Nov 18 23:50:31 ipa.<mydomain>.de [940]: GSSAPI client step 1 Nov 18 23:50:31 ipa.<mydomain>.de [940]: GSSAPI client step 1 Nov 18 23:50:31 ipa.<mydomain>.de [940]: GSSAPI client step 1 Nov 19 00:08:44 ipa.<mydomain>.de systemd[1]: Stopping The Apache HTTP Server... Nov 19 00:08:46 ipa.<mydomain>.de systemd[1]: Stopped The Apache HTTP Server. Nov 19 00:08:46 ipa.<mydomain>.de systemd[1]: Starting The Apache HTTP Server... Nov 19 00:08:47 ipa.<mydomain>.de ipa-httpd-kdcproxy[1954]: ipa: INFO: KDC proxy enabled Nov 19 00:08:47 ipa.<mydomain>.de ipa-httpd-kdcproxy[1954]: ipa-httpd-kdcproxy: INFO KDC proxy enabled Nov 19 00:08:47 ipa.<mydomain>.de httpd[1956]: Server configured, listening on: port 443, port 80 Nov 19 00:08:47 ipa.<mydomain>.de systemd[1]: Started The Apache HTTP Server. [root@ipa ~]# tail /var/log/httpd/access_log 192.168.100.200 - host/ipa.<mydomain>.de@<mydomain>.DE [18/Nov/2018:16:58:01 +0100] "POST /ipa/json HTTP/1.1" 200 97382 192.168.100.200 - host/ipa.<mydomain>.de@<mydomain>.DE [18/Nov/2018:16:58:06 +0100] "POST /ipa/session/json HTTP/1.1" 200 310 192.168.100.200 - host/ipa.<mydomain>.de@<mydomain>.DE [18/Nov/2018:16:58:06 +0100] "POST /ipa/session/json HTTP/1.1" 200 158 192.168.100.200 - host/ipa.<mydomain>.de@<mydomain>.DE [18/Nov/2018:16:58:07 +0100] "POST /ipa/session/json HTTP/1.1" 200 917 192.168.100.200 - admin@<MYDOMAIN>.DE [18/Nov/2018:17:00:57 +0100] "POST /ipa/json HTTP/1.1" 200 300 192.168.100.200 - admin@<MYDOMAIN>.DE [18/Nov/2018:23:50:30 +0100] "POST /ipa/json HTTP/1.1" 200 97388 192.168.100.200 - admin@<MYDOMAIN>.DE [18/Nov/2018:23:50:31 +0100] "POST /ipa/session/json HTTP/1.1" 200 318 [root@ipa ~]# tail /var/log/httpd/error_log [Mon Nov 19 00:08:44.866365 2018] [mpm_event:notice] [pid 930:tid 140260991723776] AH00492: caught SIGWINCH, shutting down gracefully [Mon Nov 19 00:08:47.145079 2018] [core:notice] [pid 1956:tid 140406450063616] SELinux policy enabled; httpd running as context system_u:system_r:httpd_t:s0 [Mon Nov 19 00:08:47.145750 2018] [suexec:notice] [pid 1956:tid 140406450063616] AH01232: suEXEC mechanism enabled (wrapper: /usr/sbin/suexec) [Mon Nov 19 00:08:47.175352 2018] [lbmethod_heartbeat:notice] [pid 1956:tid 140406450063616] AH02282: No slotmem from mod_heartmonitor [Mon Nov 19 00:08:47.182262 2018] [mpm_event:notice] [pid 1956:tid 140406450063616] AH00489: Apache/2.4.37 (Fedora) OpenSSL/1.1.1 mod_wsgi/4.6.4 Python/3.7 mod_auth_gssapi/1.6.1 configured -- resuming normal operations [Mon Nov 19 00:08:47.182286 2018] [core:notice] [pid 1956:tid 140406450063616] AH00094: Command line: '/usr/sbin/httpd -D FOREGROUND' [Mon Nov 19 00:08:50.622921 2018] [wsgi:error] [pid 1964:tid 140406450063616] ipa: INFO: *** PROCESS START *** [Mon Nov 19 00:08:50.648152 2018] [wsgi:error] [pid 1963:tid 140406450063616] ipa: INFO: *** PROCESS START *** [Mon Nov 19 00:08:50.654892 2018] [wsgi:error] [pid 1962:tid 140406450063616] ipa: INFO: *** PROCESS START *** [Mon Nov 19 00:08:50.690071 2018] [wsgi:error] [pid 1965:tid 140406450063616] ipa: INFO: *** PROCESS START *** '''' What's causing this issue? THX

1 0

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users November 2018