December 2018 - FreeIPA-users - Fedora mailing-lists

external ocsp ?
by veer Schlansky 04 Feb '19

04 Feb '19

My company's PIV/AD credintial is user(a)example.com. We set up our IPA credintial as user(a)linux.example.com example.com and linux.example.com are completedly seperated domain/realms, no trust or interaction whatsoever. I took the user and CA certs on the PIV card and put them into ipa. I was able to authenticate to ipa webui with my PIV card. My question is does ipa do online certificate status protocol check for the user(a)example.com cert? Any way to verify that? Thanks.

6 7

de/selecting AD's users
by lejeczek 25 Jan '19

25 Jan '19

hi guys I wonder, and hope you guys could tell if it's possible in IPA, when there is one-way trust established between AD & IPA, to allow only certain account to login & access IPA's resources? An ideal scenario I'm looking for is where all users from AD are initially disallowed to login & access IPA domain, and then admin can allow such user on per user or group basis. Is something like that "built-in" IPA's feature? many thanks, L.

2 5

CA master reinstall via replication
by Rob Foehl 21 Jan '19

21 Jan '19

If I have a pair of IPA servers and need to reinstall the one currently holding the CA master, is it actually necessary to promote the other one, or can I just follow the procedure to rebuild the current master via replication and then verify its CA configuration[1] after the fact? Thanks, -Rob [1] Specifically, everything mentioned in https://www.freeipa.org/page/Howto/Promote_CA_to_Renewal_and_CRL_Master

2 5

Abstracted NTP server configuration
by Rob Crittenden 15 Jan '19

15 Jan '19

A PR to support multiple NTP servers was submitted in https://github.com/freeipa/freeipa/pull/2169 This spawned a design at https://www.freeipa.org/page/V4/NTP_Servers_Configuration We need to discuss the design. rob

5 15

Web UI login/certificate issues, IPA 4.5.4
by dbischof＠hrz.uni-kassel.de 12 Jan '19

12 Jan '19

Hi, my IPA system consists of 2 masters with their own self-signed CAs, one of them being the certificate renewal master (ipa1). The system has been running for years and has been migrated from an IPA 3 system. Since a while, the Web UI logins on ipa1 don't work anymore ("Login failed due to an unknown reason."). Web UI logins on the other server (ipa2) work and everything else is working fine, too, ipactl status reports all services running. On login attempt: --- httpd log [...] [:error] [pid 15551] [remote 141.51.X.X:0] mod_wsgi (pid=15551): Exception occurred processing WSGI script '/usr/share/ipa/wsgi.py'. [...] [:error] [pid 15551] [remote 141.51.X.X:0] CalledProcessError: Command '/usr/bin/kinit -n -c /var/run/ipa/ccaches/armor_15551 -X X509_anchors=FILE:/var/kerberos/krb5kdc/kdc.crt -X X509_anchors=FILE:/var/lib/ipa-client/pki/kdc-ca-bundle.pem' returned non-zero exit status 1 --- --- krb5kdc.log [...] Dec 20 16:06:54 ipa1.example.com krb5kdc[15517](info): AS_REQ (8 etypes {18 17 20 19 16 23 25 26}) 141.51.X.Y: NEEDED_PREAUTH: WELLKNOWN/ANONYMOUS(a)EXAMPLE.COM for krbtgt/EXAMPLE.COM(a)EXAMPLE.COM, Additional pre-authentication required Dec 20 16:06:54 ipa1.example.com krb5kdc[15517](info): closing down fd 11 Dec 20 16:06:54 ipa1.example.com krb5kdc[15518](info): AS_REQ (8 etypes {18 17 20 19 16 23 25 26}) 141.51.X.Y: KDC_RETURN_PADATA: WELLKNOWN/ANONYMOUS(a)EXAMPLE.COM for krbtgt/EXAMPLE.COM(a)EXAMPLE.COM, Failed to verify own certificate (depth 0): certificate has expired Dec 20 16:06:54 ipa1.example.com krb5kdc[15518](info): closing down fd 11 --- --- ipa-checkcerts.py IPA version 4.5.4-10.el7.centos.3 Check CA status Check tracking Check NSS trust Check dates Checking certificates in CS.cfg Comparing certificates to requests in LDAP Checking RA certificate Checking authorities Checking host keytab Validating certificates Checking renewal master End-to-end cert API test Checking permissions and ownership Failures: Unable to find request for serial 268304391 Unable to find request for serial 268304394 Unable to find request for serial 268304393 Unable to find request for serial 268304392 Subject O=EXAMPLE.COM,CN=ipa2.example.com and template subject CN=ipa1.example.com,O=EXAMPLE.COM do not match for serial 57 --- --- ipa pkinit-status --all ----------------- 2 servers matched ----------------- Server name: ipa2.example.com PKINIT status: enabled Server name: ipa1.example.com PKINIT status: enabled ---------------------------- Number of entries returned 2 ---------------------------- To my understanding, proper certificate exchange between my two servers ceased working at some point. How do i track this down and fix it? Mit freundlichen Gruessen/With best regards, --Daniel.

2 14

Re: Testing requested - certificate checking tool
by SOLER SANGUESA Miguel 11 Jan '19

11 Jan '19

Hello, I have run the tool on an environment where I've installed my own certificate for HTTPS (following this tutorial: https://www.freeipa.org/page/Using_3rd_part_certificates_for_HTTP/LDAP), and it complains when find the root certificate of my certificate: # python2 ipa-checkcerts.py ipa: INFO: IPA version 4.6.4-10.el7 IPA version 4.6.4-10.el7 ipa: INFO: Check CA status Check CA status ipa: INFO: Check tracking Check tracking ipa: INFO: Check NSS trust Check NSS trust Traceback (most recent call last): File "ipa-checkcerts.py", line 931, in <module> sys.exit(c.run()) File "ipa-checkcerts.py", line 190, in run self.check_trust() File "ipa-checkcerts.py", line 439, in check_trust expected = expected_trust[nickname] KeyError: 'ICC-root' Is this normal? Because I have tried to add a RHEL 6 client and I get the error: " Successfully retrieved CA cert Subject: CN=Certificate Authority,O=IPA.TESTAD.LOCAL Issuer: CN=Certificate Authority,O=IPA.TESTAD.LOCAL Valid From: Mon Jan 30 10:52:18 2017 UTC Valid Until: Fri Jan 30 10:52:18 2037 UTC Joining realm failed: libcurl failed to execute the HTTP POST transaction. Peer certificate cannot be authenticated with known CA certificates" Thanks & Regards.

3 9

PAM OTP login requirements
by Brian Topping 09 Jan '19

09 Jan '19

Hi all, I hope this is the best place to ask this, please let me know if not. I am setting up a PAM client (libreswan, using the `pluto` service). When I log in with a non-OTP account, everything works fine, but not with an OTP account. I have tested the OTP account by logging into the node with SSH and the OTP user and it works fine, so I know both that the token works and that the client configuration are both correct. I’ve tried a few different PAM stacks to see if I could get around this, including the sshd stack to no avail. In all cases, the FreeIPA server logs state `Additional pre-authentication required` and then `Preauthentication failed`. Preauthentication makes sense, I just don’t understand why sshd works fine with both password factors concatenated in the first factor and libreswan (and xl2tpd when I was testing it) both fail with preauth issues. What am I missing? Are there good docs on this somewhere? [1] was the best I could come up with and it seems to be out-of-date (pam_sss takes different parameters for some of the same functions in the final form). Cheers! Brian [1] https://docs.pagure.org/SSSD.sssd/design_pages/pam_conversation_for_otp.html

2 2

Service named-pkcs11.service on replica reports error: Failed to get initial credentials (TGT) using principal 'DNS/ipa-replica.example.com' and keytab 'FILE:/etc/named.keytab' (Generic error (see e-text))
by 74cmonty 04 Jan '19

04 Jan '19

Hi, when I start service `named-pkcs11.service` on replica server I get these error messages: ``` Dez 29 17:33:28 ipa-replica.example.com named-pkcs11[3936]: Failed to get initial credentials (TGT) using principal 'DNS/ipa-replica.example.com' and keytab 'FILE:/etc/named.keytab' (Generic error (see e-text)) [...] Dez 29 17:34:04 ipa-replica.example.com ipa-dnskeysyncd[3942]: ipa-dnskeysyncd: CRITICAL Kerberos authentication failed: Major (851968): Unspecified GSS failure. Minor code may provide more information, Minor (2529638972): Generic error (see e-text) Dez 29 17:34:04 ipa-replica.example.com systemd[1]: ipa-dnskeysyncd.service: Main process exited, code=exited, status=1/FAILURE ``` The service is starting successfully though. The full log is available here: http://freetexthost.com/e53jnsslf1 What's causing this error?

2 2

FreeIPA not working (Segfault in Kerberos) after upgrading to Fedora 29
by Patrick Dung 03 Jan '19

03 Jan '19

Hello, After upgrading to Fedora 29, Kerberos on the primary Free IPA is not working. Another FreeIPA replica failed to start. It is because Kerberos (GSSAPI) is not working and ns-slapd cannot start. Replication agreement cannot be established via Kerberos (GSSAPI) I got this messages in for the kernel log. Dec 27 02:00:05 server1 kernel: [ 2551.272984] krb5_child[25058]: segfault at 6e ip 00007f58ae29464e sp 00007fffb5047bf0 error 4 in libkrb5.so.3.3[7f58ae26b000+71000] Dec 27 02:00:05 server1 kernel: [ 2551.273449] Code: fc bf 28 00 00 00 55 53 48 83 ec 18 64 48 8b 04 25 28 00 00 00 48 89 44 24 08 31 c0 e8 2b 9b fd ff 48 85 c0 0f 84 02 01 00 00 <f3> 41 0f 6f 07 f3 41 0f 6f 4f 10 48 89 c3 49 63 7f 20 0f 11 00 0f Dec 27 02:00:05 server1 kernel: [ 2551.272984] krb5_child[25058]: segfault at 6e ip 00007f58ae29464e sp 00007fffb5047bf0 error 4 in libkrb5.so.3.3[7f58ae26b000+71000] Dec 27 02:00:05 server1 kernel: [ 2551.273449] Code: fc bf 28 00 00 00 55 53 48 83 ec 18 64 48 8b 04 25 28 00 00 00 48 89 44 24 08 31 c0 e8 2b 9b fd ff 48 85 c0 0f 84 02 01 00 00 <f3> 41 0f 6f 07 f3 41 0f 6f 4f 10 48 89 c3 49 63 7f 20 0f 11 00 0f Any ideas? FYI I had already opened a ticket in bugzilla: 1662175 – Segfault in freeipa/krb5_child after upgrading to Fedora 29 | | | | 1662175 – Segfault in freeipa/krb5_child after upgrading to Fedora 29 | | | Thanks,Patrick

3 2

Service named-pkcs11.service on master fails: Process 3946 (named-pkcs11) of user 25 dumped core
by 74cmonty 02 Jan '19

02 Jan '19

Hi, starting service `named-pkcs11.service` fails with a core dump: ``` Dez 29 17:32:25 ipa-master.example.com systemd-coredump[2901]: Process 2895 (named-pkcs11) of user 25 dumped core. Stack trace of thread 2897: #0 0x00007f2b386c753f raise (libc.so.6) #1 0x00007f2b386b1895 abort (libc.so.6) #2 0x00007f2b386b1769 __assert_fail_base.cold.0 (libc.so.6) #3 0x00007f2b386bf9f6 __assert_fail (libc.so.6) #4 0x00007f2b38fb8c95 n/a (libkrb5.so.3) #5 0x00007f2b38fb96ef n/a (libkrb5.so.3) #6 0x00007f2b38fc2d0c n/a (libkrb5.so.3) #7 0x00007f2b38fbc8b3 n/a (libkrb5.so.3) #8 0x00007f2b38fbb9dd krb5_cc_select (libkrb5.so.3) #9 0x00007f2b3909b959 n/a (libgssapi_krb5.so.2) #10 0x00007f2b390a4a82 n/a (libgssapi_krb5.so.2) #11 0x00007f2b390a5b06 n/a (libgssapi_krb5.so.2) #12 0x00007f2b3908f0bb gss_init_sec_context (libgssapi_krb5.so.2) #13 0x00007f2b34824667 gssapi_client_mech_step (libgssapiv2.so) #14 0x00007f2b34907471 sasl_client_step (libsasl2.so.3) #15 0x00007f2b349075fa sasl_client_start (libsasl2.so.3) #16 0x00007f2b3494624b ldap_int_sasl_bind (libldap-2.4.so.2) #17 0x00007f2b349498ec ldap_sasl_interactive_bind (libldap-2.4.so.2) #18 0x00007f2b34949b0a ldap_sasl_interactive_bind_s (libldap-2.4.so.2) #19 0x00007f2b34992c6f ldap_connect (ldap.so) #20 0x00007f2b3499fa90 new_ldap_instance (ldap.so) #21 0x00007f2b34990292 dyndb_init (ldap.so) #22 0x00007f2b3943f75a dns_dyndb_load (libdns-pkcs11.so.1102) #23 0x00005612e6a46718 n/a (named-pkcs11) #24 0x00005612e6a53ed3 n/a (named-pkcs11) #25 0x00005612e6a54f47 n/a (named-pkcs11) #26 0x00007f2b3938d899 n/a (libisc-pkcs11.so.169) #27 0x00007f2b38bd458e start_thread (libpthread.so.0) #28 0x00007f2b3878c6a3 __clone (libc.so.6) Stack trace of thread 2898: #0 0x00007f2b38bdaa8a pthread_cond_timedwait@@GLIBC_2.3.2 (libpthread.so.0) #1 0x00007f2b393ad2b0 isc_condition_waituntil (libisc-pkcs11.so.169) #2 0x00007f2b39394683 n/a (libisc-pkcs11.so.169) #3 0x00007f2b38bd458e start_thread (libpthread.so.0) #4 0x00007f2b3878c6a3 __clone (libc.so.6) Stack trace of thread 2899: #0 0x00007f2b3878c9d7 epoll_wait (libc.so.6) #1 0x00007f2b393a501c n/a (libisc-pkcs11.so.169) #2 0x00007f2b38bd458e start_thread (libpthread.so.0) #3 0x00007f2b3878c6a3 __clone (libc.so.6) Stack trace of thread 2896: #0 0x00007f2b38bda73c pthread_cond_wait@@GLIBC_2.3.2 (libpthread.so.0) #1 0x00007f2b3938d695 n/a (libisc-pkcs11.so.169) #2 0x00007f2b38bd458e start_thread (libpthread.so.0) #3 0x00007f2b3878c6a3 __clone (libc.so.6) Stack trace of thread 2895: #0 0x00007f2b386c78ee __sigsuspend (libc.so.6) #1 0x00007f2b3939713e isc__app_ctxrun (libisc-pkcs11.so.169) #2 0x00007f2b39397d73 isc_app_run (libisc-pkcs11.so.169) #3 0x00005612e6a07d05 n/a (named-pkcs11) #4 0x00007f2b386b3413 __libc_start_main (libc.so.6) #5 0x00005612e6a0865e n/a (named-pkcs11) Dez 29 17:32:25 ipa-master.example.com audit[1]: SERVICE_STOP pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=systemd-coredump@10-2900-0 comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' ``` Full log is available here: http://freetexthost.com/nx1e4xhmyi Assuming this issue is related to file /usr/lib64/bind/ldap.so I tried to scp from replica server. However this fails with this weird error: ```[root@ipa-master ~]# ssh -p 22202 ipa-replica.example.com ssh_exchange_identification: Connection closed by remote host [root@ipa-master ~]# scp -P 22201 ipa-replica.example.com:/usr/lib64/bind/ldap.so /home/ Password: \033[0m\033[1;34m /:-------------:\ \033[0m\033[1;34m root\033[0m\033[1m(a)\033[0m\033[0m\033[1;34mipa-replica.example.com\033[0m ````

2 1

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users December 2018