December 2018 - FreeIPA-users - Fedora mailing-lists

Help to install a replica on Fedora 28
by ARNAL Laurent 31 Dec '18

31 Dec '18

Hello, I try to install a replica on a fedora 28 server using the command ipa-replica-install --principal admin --admin-password password --force-join Command failed on step [26/41]: creating DS keytab with error : =================================================== 2018-12-26T11:00:02Z DEBUG Process finished, return code=9 2018-12-26T11:00:02Z DEBUG stdout=uid=0(root) gid=0(root) groupes=0(root),39(video) 2018-12-26T11:00:02Z DEBUG stderr=Impossible d'analyser le résultat : Insufficient access rights Nouvelle tentative de récupération avec la méthode pre-4.0... Impossible d'analyser le résultat : Insufficient access rights Échec d'obtention du tableau de clés ! Échec à l'obtention du tableau de clés 2018-12-26T11:00:02Z DEBUG Traceback (most recent call last): File "/usr/lib/python3.6/site-packages/ipaserver/install/service.py", line 605, in start_creation run_step(full_msg, method) File "/usr/lib/python3.6/site-packages/ipaserver/install/service.py", line 591, in run_step method() File "/usr/lib/python3.6/site-packages/ipaserver/install/dsinstance.py", line 1315, in request_service_keytab super(DsInstance, self).request_service_keytab() File "/usr/lib/python3.6/site-packages/ipaserver/install/service.py", line 782, in request_service_keytab self.run_getkeytab(self.api.env.ldap_uri, self.keytab, self.principal) File "/usr/lib/python3.6/site-packages/ipaserver/install/service.py", line 772, in run_getkeytab ipautil.run(args, nolog=nolog) File "/usr/lib/python3.6/site-packages/ipapython/ipautil.py", line 574, in run p.returncode, arg_string, output_log, error_log Error(Command ['/usr/sbin/ipa-getkeytab', '-k', '/etc/dirsrv/ds.keytab', '-p', 'ldap/kerclaei.mydomain.com(a)MYDOMAIN.COM', '-H', 'ldaps://stellai.mydomain.com'] returned non-zero exit status 9: "Impossible d'analyser le résultat\xa0: Insufficient access rights\n\nNouvelle tentative de récupération avec la méthode pre-4.0...\nImpossible d'analyser le résultat\xa0: Insufficient access rights\n\nÉchec d'obtention du tableau de clés\xa0!\nÉchec à l'obtention du tableau de clés\n") 2018-12-26T11:00:02Z DEBUG [error] CalledProcessError: CalledProcessError(Command ['/usr/sbin/ipa-getkeytab', '-k', '/etc/dirsrv/ds.keytab', '-p', 'ldap/kerclaei.mydomain.com(a)MYDOMAIN.COM', '-H', 'ldaps://stellai.mydomain.com'] returned non-zero exit status 9: "Impossible d'analyser le résultat\xa0: Insufficient access rights\n\nNouvelle tentative de récupération avec la méthode pre-4.0...\nImpossible d'analyser le résultat\xa0: Insufficient access rights\n\nÉchec d'obtention du tableau de clés\xa0!\nÉchec à l'obtention du tableau de clés\n") 2018-12-26T11:00:02Z DEBUG Destroyed connection context.ldap2_140109927205352 =================================================== If I try to launch the ipa-getkeytab command from shell, the command succed. Can someone help me to solve this issue ? The permissions on /etc/dirsrv directory look like this: [root@kerclaei 2]# dir /etc/dirsrv -la total 0 drwxrwxr-x 1 root dirsrv 124 26 déc. 12:30 . drwxr-xr-x 1 root root 10828 26 déc. 12:27 .. drwx------ 1 dirsrv dirsrv 188 7 févr. 2018 admin-serv drwxr-xr-x 1 dirsrv dirsrv 104 23 déc. 13:07 config drwxr-xr-x 1 dirsrv dirsrv 30 7 févr. 2018 dsgw drwxr-xr-x 1 dirsrv dirsrv 22 24 août 23:12 schema drwxrwx--- 1 dirsrv dirsrv 234 26 déc. 12:30 slapd-DOMAIN-COM drwxrwx--- 1 dirsrv dirsrv 30 26 déc. 09:44 slapd-DOMAIN-COM.removed Regards, Laurent

1 1

Freeipa replica server issue
by Azim Siddiqui 29 Dec '18

29 Dec '18

Hello, Hope you are doing good. Hello All, We have a master freeipa server through which we created more two replica freeipa servers. When we create a user in master server, the user was automatically created into the two replica servers. Everything was working fine, But now I am seeing this error for one of the replica server, when running this command ipa-replica-manage -v list local-host last update status: -1 Incremental update has failed and requires administrator actionLDAP error: Can't contact LDAP server When i am checking the logs for /var/log/dirsrv/localhost, I can see this :- [24/Dec/2018:21:27:55 +0000] slapi_ldap_bind - Error: could not perform interactive bind for id [] authentication mechanism [GSSAPI]: error -1 (Can't contact LDAP server) [24/Dec/2018:21:32:20 +0000] slapi_ldap_bind - Error: could not send startTLS request: error -1 (Can't contact LDAP server) errno 2 (No such file or directory) [24/Dec/2018:21:32:55 +0000] slapd_ldap_sasl_interactive_bind - Error: could not perform interactive bind for id [] mech [GSSAPI]: LDAP error -1 (Can't contact LDAP server) ((null)) errno 107 (Transport endpoint is not connected) [24/Dec/2018:21:32:55 +0000] slapi_ldap_bind - Error: could not perform interactive bind for id [] authentication mechanism [GSSAPI]: error -1 (Can't contact LDAP server) Can you please tell me how to resolve this issue ? Thanks & Regards, Azeem

2 1

FreeIPA UID vs. Linux UID - what's the difference
by 74cmonty 28 Dec '18

28 Dec '18

Hi, could you please explain the difference of FreeIPA UID vs. Linux UID? When I create a user in FreeIPA the UID is this: 1227200001 But in any Linux the first user created has UID: 1000 Should I align UIDs in FreeIPA to the Linux UID? If yes, does the same apply to GID? Or should I keep the UID / GID created by FreeIPA? If yes, how does this work when a client is registered with FreeIPA? THX

2 3

FreeIPA containerization status
by Jan Pazdziora 23 Dec '18

23 Dec '18

Hello, in the past couple of week I've pushed multiple changes to the https://github.com/freeipa/freeipa-container repository, fixing and enabling Fedora 28 and Fedora 29 Dockerfiles, adding Travis CI configuration where we currently test IPA master and replica setups in images of Fedoras from 23 to rawhide and on CentOS 7: https://travis-ci.org/freeipa/freeipa-container/branches Testing on Travis' Ubuntus allowed me to reproduce and fix some issues that people have observed on non-RHEL/CentOS/Fedora docker hosts. One of the results is that docker run's --privileged or --cap-add SYS_ADMIN options should not be needed anymore, making things more confined and more secure. In fact, it's quite likely that running the FreeIPA server containers as privileged will result in https://github.com/freeipa/freeipa-container/issues/254 ... so just don't do it. Another focus of the effort was to make it possible to run the containers as read-only (docker run --read-only), making all the changes that are done during the initial ipa-server-install or during runtime properly confined to the /data volume, or pointed to discardable /tmp. While things pass in my local read-only tests, in Travis CI the initial ipa-server-install phase runs fine but starting the read-only container afterwars seems to hang: https://travis-ci.org/adelton/freeipa-container/builds/459418370 Any help with investigating why this is happening would be appreciated. -- Jan Pazdziora Senior Principal Software Engineer, Security Engineering, Red Hat

2 4

Insufficient access: SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Ticket expired)
by lune voo 22 Dec '18

22 Dec '18

Hello ! I contact you because I have a random problem with my 3.0.0.47 FreeIPA server. Sometimes, suddenly, I cannot use anymore the REST API and I got the following errors when I try things like ipa user-show <myuser> : Insufficient access: SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Ticket expired)] traceback : <traceback object at 0x3b917a0> The kinit works fine, klist also. My ticket is valid until the day after so no problem from there. The datetime is the same between the IPA server and the IPA client. When I check the httpd logs on the IPA server, as long as this error lasts, I don't see any logs at all. For example, today, the problem occured at 12:06:39 and in the HTTPD error logs : [Wed Oct 31 12:05:23 2018] [error] ipa: INFO: aPrincipal@MYREALM: user_show(u'anotherPincipal', rights=False, all=True, raw=False, version=u'2.49', no_members=False): SUCCESS [Wed Oct 31 12:07:23 2018] [error] ipa: INFO: aPrincipal@MYREALM: user_find(u'PrincipalPattern_', sizelimit=1000, whoami=False, all=False, raw=False, version=u'2.49', no_members=False, pkey_only=False): SUCCESS There is nothing in the dirsrv error logs at this time and around this time. Nothing neither in the PKI CA logs. When I check the logs in cli.log, I find this kind of lines : 2018-10-31T12:06:39Z 1933 MainThread ipa.ipalib.rpc.xmlclient INFO trying https://<IPA-MASTER>/ipa/xml 2018-10-31T12:06:39Z 1933 MainThread ipa.ipalib.rpc.xmlclient INFO Forwarding 'user_show' to server u'https://<IPA-MASTER>/ipa/xml' 2018-10-31T12:06:39Z 1947 MainThread ipa.ipalib.rpc.xmlclient INFO trying https://<IPA-MASTER>/ipa/xml 2018-10-31T12:06:39Z 1947 MainThread ipa.ipalib.rpc.xmlclient INFO Forwarding 'user_show' to server u'https://<IPA-MASTER>/ipa/xml' 2018-10-31T12:06:40Z 1961 MainThread ipa.ipalib.rpc.xmlclient INFO trying https://<IPA-MASTER>/ipa/xml 2018-10-31T12:06:40Z 1961 MainThread ipa.ipalib.rpc.xmlclient INFO Forwarding 'user_show' to server u'https://<IPA-MASTER>/ipa/xml' 2018-10-31T12:06:40Z 1975 MainThread ipa.ipalib.rpc.xmlclient INFO trying https://<IPA-MASTER>/ipa/xml 2018-10-31T12:06:40Z 1975 MainThread ipa.ipalib.rpc.xmlclient INFO Forwarding 'user_show' to server u'https://<IPA-MASTER>/ipa/xml' 2018-10-31T12:07:27Z 2159 MainThread ipa INFO The ipactl command was successful 2018-10-31T12:07:27Z 2160 MainThread ipa INFO The ipactl command was successful I cannot see anything special in the krb5kdc.log neither for this time. The only line corresponding to the IP of the client are the followings : Oct 31 12:06:24 <IPA-MASTER> krb5kdc[137188](info): AS_REQ (4 etypes {18 17 16 23}) <IP CLIENT>: NEEDED_PREAUTH: <MYUSER>@<MYREALM> for krbtgt/<MYREALM>@<MYREALM>, Additional pre-authentication required Oct 31 12:06:24 <IPA-MASTER> krb5kdc[137188](info): AS_REQ (4 etypes {18 17 16 23}) <IP CLIENT>: NEEDED_PREAUTH: <MYUSER>@<MYREALM> for krbtgt/<MYREALM>@<MYREALM>, Additional pre-authentication required Oct 31 12:06:24 <IPA-MASTER> krb5kdc[137188](info): closing down fd 10 Oct 31 12:06:24 <IPA-MASTER> krb5kdc[137188](info): closing down fd 10 Oct 31 12:06:24 <IPA-MASTER> krb5kdc[137181](info): AS_REQ (4 etypes {18 17 16 23}) <IP CLIENT>: ISSUE: authtime 1540983984, etypes {rep=18 tkt=18 ses=18}, <MYUSER>@<MYREALM> for krbtgt/<MYREALM>@<MYREALM> Oct 31 12:06:24 <IPA-MASTER> krb5kdc[137181](info): AS_REQ (4 etypes {18 17 16 23}) <IP CLIENT>: ISSUE: authtime 1540983984, etypes {rep=18 tkt=18 ses=18}, <MYUSER>@<MYREALM> for krbtgt/<MYREALM>@<MYREALM> Oct 31 12:06:24 <IPA-MASTER> krb5kdc[137181](info): closing down fd 10 Oct 31 12:06:24 <IPA-MASTER> krb5kdc[137181](info): closing down fd 10 We are multiple users connecting to the same server with SSH and using root. But each one of us use a different KRB5CCNAME to take a kerberos ticket. (we take different ticket, me for example I take an admin ticket, a colleague takes another principal ticket). I tried using the ipa user-show with the -d flag : ipa -d user-show <myuser> and I compared the result between one which failed and one which was successfull. The difference came at this step : When it failed : ipa: DEBUG: approved_usage = SSL Server intended_usage = SSL Server ipa: DEBUG: cert valid True for "CN=<IPA-MASTER>,O=<MYREALM>" ipa: DEBUG: handshake complete, peer = <IP>:443 ipa: DEBUG: Protocol: TLS1.2 ipa: DEBUG: Cipher: TLS_RSA_WITH_AES_128_CBC_SHA ipa: DEBUG: Caught fault 2100 from server https://<IPA-MASTER>/ipa/session/xml: Insufficient access: SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Ticket expired) ipa: DEBUG: Destroyed connection context.xmlclient ipa: ERROR: Insufficient access: SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Ticket expired) When it succeeds : ipa: DEBUG: approved_usage = SSL Server intended_usage = SSL Server ipa: DEBUG: cert valid True for "CN=<IPA-MASTER>,O=<MYREALM>" ipa: DEBUG: handshake complete, peer = <IP>:<PORT> ipa: DEBUG: Protocol: TLS1.2 ipa: DEBUG: Cipher: TLS_RSA_WITH_AES_128_CBC_SHA ipa: DEBUG: received Set-Cookie 'ipa_session=385454761d74afed915a24124ba5ef25; Domain=<IPA-MASTER>; Path=/ipa; Expires=Wed, 31 Oct 2018 15:57:45 GMT; Secure; HttpOnly' ipa: DEBUG: storing cookie 'ipa_session=385454761d74afed915a24124ba5ef25; Domain=<IPA-MASTER>; Path=/ipa; Expires=Wed, 31 Oct 2018 15:57:45 GMT; Secure; HttpOnly' for principal <myPrincipal>@<MYREALM> ipa: DEBUG: args=keyctl search @s user ipa_session_cookie:<myPrincipal>@<MYREALM> ipa: DEBUG: stdout=485338998 ipa: DEBUG: stderr= ipa: DEBUG: args=keyctl search @s user ipa_session_cookie:<myPrincipal>@<MYREALM> ipa: DEBUG: stdout=485338998 ipa: DEBUG: stderr= ipa: DEBUG: args=keyctl pupdate 485338998 ipa: DEBUG: stdout= ipa: DEBUG: stderr= ipa: DEBUG: Destroyed connection context.xmlclient So when it works, it sets a session cookie ? Some information about FreeIPA and cookies : https://vda.li/en/posts/2015/05/28/talking-to-freeipa-api-with-sessions/ May you help me please ? As a note, I found a workaround for that. I need to destroy my ticket with kdestroy and then to disconnect from the server. Then when I connect back to the server, I take a kerberos ticket and I can use the rest api. This problem is really strange, thank you in advance for your help guys. Lune

3 6

FreeIPA/Dogtag - Slow host deletion due to certificate pagination
by Jared Ledvina 21 Dec '18

21 Dec '18

Hi folks, I recently posted a thread to pki-users, https://www.redhat.com/archives/pki-users/2018-December/msg00003.html . Working with 'cipherboy' on IRC in #dogtag-pki, we narrowed the issue down to the searches that Dogtag performs against a VLV index/search. These are being paginated to 2,000 entries. I've since, opened up: https://bugzilla.redhat.com/show_bug.cgi?id=1658280 but, haven't been able to figure out a solution. I'm hoping that someone on this list might be able to troubleshoot further with me on this. Has anyone looked at this before? So far, I'm unable to determine where the 2,000 paging size is getting set. The linked bugzilla issue should have a bunch of necessary details but, I'm happy to provide any additional details that might help. Thanks, Jared -- Jared Ledvina jared(a)techsmix.net

2 4

Cannot issue new certificate (again...)
by Peter Tselios 21 Dec '18

21 Dec '18

Hello, I have a host with 2 names: * servername.example.com * alias.example.com But the command: ======================================= ipa-getcert request \ -K HTTP/servername.example.com \ -D alias.example.com \ -f /etc/pki/tls/certs/httpd.crt \ -k /etc/pki/tls/private/httpd.key ======================================= says that I cannot do it: ======================================= ca-error: Server at https://ipa.example.com/ipa/xml denied our request, giving up: 2100 (RPC failed at server. Insufficient access: Insufficient privilege to create a certificate with subject alt name 'alias.example.com'.). ======================================= The alias.example.com is managed from the host: ======================================= ipa host-show alias.example.com Host name: alias.example.com Principal name: host/alias.example.com(a)EXAMPLE.COM Principal alias: host/alias.example.com(a)EXAMPLE.COM Password: False Keytab: False Managed by: alias.example.com, servername.example.com Any idea why???

2 2

IPA managed autofs mount timeout
by William Muriithi 20 Dec '18

20 Dec '18

Evening, I have done this before but for the life of me, I can't seem to find a way to undo my previous change. I am using autofs to mount home directories. The autofs maps are on IPA server. A while back, I adjusted the mount idle timeout from the default 5 minutes to 2 hours. I now want to undo the change, essentially bring down the timeout to 5 minutes. I can't however remember how I had increased it and google just bring up how to adjust locally from /etc/sysconfig/autofs. I recall vaguely I had done the change from IPA. Anyone who would have this info without too much googling? Regards, William

2 1

Versleuteld bericht
by Arjen Heidinga 20 Dec '18

20 Dec '18

All, I am here again bothering with my seemingly borked installation. The upgrade from 7.0 to 7.2 on fedora 28-29 finished (finaly), when I spotted in my journal a stacktrace. Digging into it, this appears to be the cause. all I find in the internet are ancient (solved) bugs... It appears that it has something to do with DNSSEC. Perhaps this is a clue, I do not remember setting this up. Kind Regards, Arjen [root@starkey ~]# /usr/libexec/ipa/ipa-dnskeysync-replica ipalib.plugable: DEBUG importing all plugin modules in ipaserver.plugins... ipalib.plugable: DEBUG importing plugin module ipaserver.plugins.aci ipalib.plugable: DEBUG importing plugin module ipaserver.plugins.automember ipalib.plugable: DEBUG importing plugin module ipaserver.plugins.automount ipalib.plugable: DEBUG importing plugin module ipaserver.plugins.baseldap ipalib.plugable: DEBUG ipaserver.plugins.baseldap is not a valid plugin module ipalib.plugable: DEBUG importing plugin module ipaserver.plugins.baseuser ipalib.plugable: DEBUG importing plugin module ipaserver.plugins.batch ipalib.plugable: DEBUG importing plugin module ipaserver.plugins.ca ipalib.plugable: DEBUG importing plugin module ipaserver.plugins.caacl ipalib.plugable: DEBUG importing plugin module ipaserver.plugins.cert ipalib.plugable: DEBUG importing plugin module ipaserver.plugins.certmap ipalib.plugable: DEBUG importing plugin module ipaserver.plugins.certprofile ipalib.plugable: DEBUG importing plugin module ipaserver.plugins.config ipalib.plugable: DEBUG importing plugin module ipaserver.plugins.delegation ipalib.plugable: DEBUG importing plugin module ipaserver.plugins.dns ipalib.plugable: DEBUG importing plugin module ipaserver.plugins.dnsserver ipalib.plugable: DEBUG importing plugin module ipaserver.plugins.dogtag ipalib.plugable: DEBUG importing plugin module ipaserver.plugins.domainlevel ipalib.plugable: DEBUG importing plugin module ipaserver.plugins.group ipalib.plugable: DEBUG importing plugin module ipaserver.plugins.hbac ipalib.plugable: DEBUG ipaserver.plugins.hbac is not a valid plugin module ipalib.plugable: DEBUG importing plugin module ipaserver.plugins.hbacrule ipalib.plugable: DEBUG importing plugin module ipaserver.plugins.hbacsvc ipalib.plugable: DEBUG importing plugin module ipaserver.plugins.hbacsvcgroup ipalib.plugable: DEBUG importing plugin module ipaserver.plugins.hbactest ipalib.plugable: DEBUG importing plugin module ipaserver.plugins.host ipalib.plugable: DEBUG importing plugin module ipaserver.plugins.hostgroup ipalib.plugable: DEBUG importing plugin module ipaserver.plugins.idrange ipalib.plugable: DEBUG importing plugin module ipaserver.plugins.idviews ipalib.plugable: DEBUG importing plugin module ipaserver.plugins.internal ipalib.plugable: DEBUG importing plugin module ipaserver.plugins.join ipalib.plugable: DEBUG importing plugin module ipaserver.plugins.krbtpolicy ipalib.plugable: DEBUG importing plugin module ipaserver.plugins.ldap2 ipalib.plugable: DEBUG importing plugin module ipaserver.plugins.location ipalib.plugable: DEBUG importing plugin module ipaserver.plugins.migration ipalib.plugable: DEBUG importing plugin module ipaserver.plugins.misc ipalib.plugable: DEBUG importing plugin module ipaserver.plugins.netgroup ipalib.plugable: DEBUG importing plugin module ipaserver.plugins.otp ipalib.plugable: DEBUG ipaserver.plugins.otp is not a valid plugin module ipalib.plugable: DEBUG importing plugin module ipaserver.plugins.otpconfig ipalib.plugable: DEBUG importing plugin module ipaserver.plugins.otptoken ipalib.plugable: DEBUG importing plugin module ipaserver.plugins.passwd ipalib.plugable: DEBUG importing plugin module ipaserver.plugins.permission ipalib.plugable: DEBUG importing plugin module ipaserver.plugins.ping ipalib.plugable: DEBUG importing plugin module ipaserver.plugins.pkinit ipalib.plugable: DEBUG importing plugin module ipaserver.plugins.privilege ipalib.plugable: DEBUG importing plugin module ipaserver.plugins.pwpolicy ipalib.plugable: DEBUG importing plugin module ipaserver.plugins.rabase ipalib.plugable: DEBUG ipaserver.plugins.rabase is not a valid plugin module ipalib.plugable: DEBUG importing plugin module ipaserver.plugins.radiusproxy ipalib.plugable: DEBUG importing plugin module ipaserver.plugins.realmdomains ipalib.plugable: DEBUG importing plugin module ipaserver.plugins.role ipalib.plugable: DEBUG importing plugin module ipaserver.plugins.schema ipalib.plugable: DEBUG importing plugin module ipaserver.plugins.selfservice ipalib.plugable: DEBUG importing plugin module ipaserver.plugins.selinuxusermap ipalib.plugable: DEBUG importing plugin module ipaserver.plugins.server ipalib.plugable: DEBUG importing plugin module ipaserver.plugins.serverrole ipalib.plugable: DEBUG importing plugin module ipaserver.plugins.serverroles ipalib.plugable: DEBUG importing plugin module ipaserver.plugins.service ipalib.plugable: DEBUG importing plugin module ipaserver.plugins.servicedelegation ipalib.plugable: DEBUG importing plugin module ipaserver.plugins.session ipalib.plugable: DEBUG importing plugin module ipaserver.plugins.stageuser ipalib.plugable: DEBUG importing plugin module ipaserver.plugins.sudo ipalib.plugable: DEBUG ipaserver.plugins.sudo is not a valid plugin module ipalib.plugable: DEBUG importing plugin module ipaserver.plugins.sudocmd ipalib.plugable: DEBUG importing plugin module ipaserver.plugins.sudocmdgroup ipalib.plugable: DEBUG importing plugin module ipaserver.plugins.sudorule ipalib.plugable: DEBUG importing plugin module ipaserver.plugins.topology ipalib.plugable: DEBUG importing plugin module ipaserver.plugins.trust ipalib.plugable: DEBUG importing plugin module ipaserver.plugins.user ipalib.plugable: DEBUG importing plugin module ipaserver.plugins.vault ipalib.plugable: DEBUG importing plugin module ipaserver.plugins.virtual ipalib.plugable: DEBUG ipaserver.plugins.virtual is not a valid plugin module ipalib.plugable: DEBUG importing plugin module ipaserver.plugins.whoami ipalib.plugable: DEBUG importing plugin module ipaserver.plugins.xmlserver ipa-dnskeysync-replica: DEBUG Kerberos principal: ipa-dnskeysyncd/starkey.platypusnet.org ipalib.install.kinit: DEBUG Initializing principal ipa-dnskeysyncd/starkey.platypusnet.org using keytab /etc/ipa/dnssec/ipa-dnskeysyncd.keytab ipalib.install.kinit: DEBUG using ccache /tmp/ipa-dnskeysync-replica.ccache ipalib.install.kinit: DEBUG Attempt 1/5: success ipa-dnskeysync-replica: DEBUG Got TGT ipa-dnskeysync-replica: DEBUG Connecting to LDAP ipa-dnskeysync-replica: DEBUG Connected Traceback (most recent call last): File "/usr/libexec/ipa/ipa-dnskeysync-replica", line 179, in <module> open(paths.DNSSEC_SOFTHSM_PIN).read()) File "/usr/lib/python3.7/site-packages/ipaserver/dnssec/localhsm.py", line 104, in __init__ self.p11 = _ipap11helper.P11_Helper(label, pin, library) File "/usr/lib/python3.7/site-packages/ipaserver/p11helper.py", line 866, in __init__ raise Error("No slot for label {} found".format(self.token_label)) ipaserver.p11helper.Error: No slot for label ipaDNSSEC found Exception ignored in: <function LocalHSM.__del__ at 0x7fd0d6b77158> Traceback (most recent call last): File "/usr/lib/python3.7/site-packages/ipaserver/dnssec/localhsm.py", line 107, in __del__ self.p11.finalize() AttributeError: 'LocalHSM' object has no attribute 'p11'

1 1

Trouble with pki-tomcat
by Arjen Heidinga 20 Dec '18

20 Dec '18

Dear all, I fear somehow my freeipa server is broken. Perhaps it is time to create a new one, however that would be very time-consuming. Yesterday everything broke, after FreeIPA was upgraded. It is worth mentioning that I had certificate issues recently. My root-CA, and httpd-cert expired. When I start the tomcat-pki daemon, I get presented the stacktrace below. Note to mention, the pcscd lines are everytime exactly there when trying to start. I'd appreciate it if someone has a clue. Kind Regards, Arjen Heidinga Dec 14 15:31:44 starkey.platypusnet.org systemd[1]: Starting PKI Tomcat Server pki-tomcat... -- Subject: Unit pki-tomcatd(a)pki-tomcat.service has begun start-up -- Defined-By: systemd -- Support: https://lists.freedesktop.org/mailman/listinfo/systemd-devel -- -- Unit pki-tomcatd(a)pki-tomcat.service has begun starting up. Dec 14 15:31:45 starkey.platypusnet.org pki-server[22909]: ---------------------------- Dec 14 15:31:45 starkey.platypusnet.org pki-server[22909]: pki-tomcat instance migrated Dec 14 15:31:45 starkey.platypusnet.org pki-server[22909]: ---------------------------- Dec 14 15:31:46 starkey.platypusnet.org pkidaemon[22936]: ----------------------- Dec 14 15:31:46 starkey.platypusnet.org pkidaemon[22936]: Banner is not installed Dec 14 15:31:46 starkey.platypusnet.org pkidaemon[22936]: ----------------------- Dec 14 15:31:46 starkey.platypusnet.org pkidaemon[22936]: ---------------------- Dec 14 15:31:46 starkey.platypusnet.org pkidaemon[22936]: Enabled all subsystems Dec 14 15:31:46 starkey.platypusnet.org pkidaemon[22936]: ---------------------- Dec 14 15:31:46 starkey.platypusnet.org systemd[1]: Started PKI Tomcat Server pki-tomcat. -- Subject: Unit pki-tomcatd(a)pki-tomcat.service has finished start-up -- Defined-By: systemd -- Support: https://lists.freedesktop.org/mailman/listinfo/systemd-devel -- -- Unit pki-tomcatd(a)pki-tomcat.service has finished starting up. -- -- The start-up result is done. Dec 14 15:31:46 starkey.platypusnet.org audit[1]: SERVICE_START pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=pki-tomcatd@pki-tomcat comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' Dec 14 15:31:46 starkey.platypusnet.org server[23062]: Java virtual machine used: /usr/lib/jvm/jre-1.8.0-openjdk/bin/java Dec 14 15:31:46 starkey.platypusnet.org server[23062]: classpath used: /usr/share/tomcat/bin/bootstrap.jar:/usr/share/tomcat/bin/tomcat-juli.jar:/usr/lib/java/commons-daemon.jar Dec 14 15:31:46 starkey.platypusnet.org server[23062]: main class used: org.apache.catalina.startup.Bootstrap Dec 14 15:31:46 starkey.platypusnet.org server[23062]: flags used: -DRESTEASY_LIB=/usr/share/java/resteasy -Djava.library.path=/usr/lib64/nuxwdog-jni Dec 14 15:31:46 starkey.platypusnet.org server[23062]: options used: -Dcatalina.base=/var/lib/pki/pki-tomcat -Dcatalina.home=/usr/share/tomcat -Djava.endorsed.dirs= -Djava.io.tmpdir=/var/lib/pki/pki-tomcat/temp -Djava.util.logging.config.file=/var/lib/pki/pki-tomcat/conf/logging.properties -Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager -Djava.security.manager -Djava.security.policy==/var/lib/pki/pki-tomcat/conf/catalina.policy Dec 14 15:31:46 starkey.platypusnet.org server[23062]: arguments used: start Dec 14 15:31:48 starkey.platypusnet.org pcscd[18754]: 99999999 auth.c:137:IsClientAuthorized() Process 23062 (user: 985) is NOT authorized for action: access_pcsc Dec 14 15:31:48 starkey.platypusnet.org pcscd[18754]: 00000420 winscard_svc.c:335:ContextThread() Rejected unauthorized PC/SC client Dec 14 15:31:48 starkey.platypusnet.org pcscd[18754]: 00029452 auth.c:137:IsClientAuthorized() Process 23062 (user: 985) is NOT authorized for action: access_pcsc Dec 14 15:31:48 starkey.platypusnet.org pcscd[18754]: 00000250 winscard_svc.c:335:ContextThread() Rejected unauthorized PC/SC client Dec 14 15:31:54 starkey.platypusnet.org server[23062]: SEVERE: Unable to create CMS engine: com.netscape.cmscore.apps.CMSEngine Dec 14 15:31:54 starkey.platypusnet.org server[23062]: java.lang.InstantiationException: com.netscape.cmscore.apps.CMSEngine Dec 14 15:31:54 starkey.platypusnet.org server[23062]: at java.lang.Class.newInstance(Class.java:427) Dec 14 15:31:54 starkey.platypusnet.org server[23062]: at com.netscape.cms.servlet.base.CMSStartServlet.init(CMSStartServlet.java:138) Dec 14 15:31:54 starkey.platypusnet.org server[23062]: at javax.servlet.GenericServlet.init(GenericServlet.java:158) Dec 14 15:31:54 starkey.platypusnet.org server[23062]: at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) Dec 14 15:31:54 starkey.platypusnet.org server[23062]: at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) Dec 14 15:31:54 starkey.platypusnet.org server[23062]: at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) Dec 14 15:31:54 starkey.platypusnet.org server[23062]: at java.lang.reflect.Method.invoke(Method.java:498) Dec 14 15:31:54 starkey.platypusnet.org server[23062]: at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:282) Dec 14 15:31:54 starkey.platypusnet.org server[23062]: at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:279) Dec 14 15:31:54 starkey.platypusnet.org server[23062]: at java.security.AccessController.doPrivileged(Native Method) Dec 14 15:31:54 starkey.platypusnet.org server[23062]: at javax.security.auth.Subject.doAsPrivileged(Subject.java:549) Dec 14 15:31:54 starkey.platypusnet.org server[23062]: at org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:314) Dec 14 15:31:54 starkey.platypusnet.org server[23062]: at org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:170) Dec 14 15:31:54 starkey.platypusnet.org server[23062]: at org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:123) Dec 14 15:31:54 starkey.platypusnet.org server[23062]: at org.apache.catalina.core.StandardWrapper.initServlet(StandardWrapper.java:1132) Dec 14 15:31:54 starkey.platypusnet.org server[23062]: at org.apache.catalina.core.StandardWrapper.loadServlet(StandardWrapper.java:1091) Dec 14 15:31:54 starkey.platypusnet.org server[23062]: at org.apache.catalina.core.StandardWrapper.load(StandardWrapper.java:983) Dec 14 15:31:54 starkey.platypusnet.org server[23062]: at org.apache.catalina.core.StandardContext.loadOnStartup(StandardContext.java:4978) Dec 14 15:31:54 starkey.platypusnet.org server[23062]: at org.apache.catalina.core.StandardContext.startInternal(StandardContext.java:5290) Dec 14 15:31:54 starkey.platypusnet.org server[23062]: at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:150) Dec 14 15:31:54 starkey.platypusnet.org server[23062]: at org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.java:754) Dec 14 15:31:54 starkey.platypusnet.org server[23062]: at org.apache.catalina.core.ContainerBase.access$000(ContainerBase.java:129) Dec 14 15:31:54 starkey.platypusnet.org server[23062]: at org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(ContainerBase.java:150) Dec 14 15:31:54 starkey.platypusnet.org server[23062]: at org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(ContainerBase.java:140) Dec 14 15:31:54 starkey.platypusnet.org server[23062]: at java.security.AccessController.doPrivileged(Native Method) Dec 14 15:31:54 starkey.platypusnet.org server[23062]: at org.apache.catalina.core.ContainerBase.addChild(ContainerBase.java:728) Dec 14 15:31:54 starkey.platypusnet.org server[23062]: at org.apache.catalina.core.StandardHost.addChild(StandardHost.java:734) Dec 14 15:31:54 starkey.platypusnet.org server[23062]: at org.apache.catalina.startup.HostConfig.deployDescriptor(HostConfig.java:629) Dec 14 15:31:54 starkey.platypusnet.org server[23062]: at org.apache.catalina.startup.HostConfig$DeployDescriptor.run(HostConfig.java:1839) Dec 14 15:31:54 starkey.platypusnet.org server[23062]: at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511) Dec 14 15:31:54 starkey.platypusnet.org server[23062]: at java.util.concurrent.FutureTask.run(FutureTask.java:266) Dec 14 15:31:54 starkey.platypusnet.org server[23062]: at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) Dec 14 15:31:54 starkey.platypusnet.org server[23062]: at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) Dec 14 15:31:54 starkey.platypusnet.org server[23062]: at java.lang.Thread.run(Thread.java:748) Dec 14 15:31:54 starkey.platypusnet.org server[23062]: Caused by: java.lang.NoSuchMethodException: com.netscape.cmscore.apps.CMSEngine.<init>() Dec 14 15:31:54 starkey.platypusnet.org server[23062]: at java.lang.Class.getConstructor0(Class.java:3082) Dec 14 15:31:54 starkey.platypusnet.org server[23062]: at java.lang.Class.newInstance(Class.java:412) Dec 14 15:31:54 starkey.platypusnet.org server[23062]: ... 33 more Dec 14 15:31:59 starkey.platypusnet.org kernel: FINAL_REJECT: IN=ens6 OUT= MAC=33:33:00:00:00:01:10:be:f5:b2:f9:00:86:dd SRC=2a00:0f60:0000:0001:0000:0000:0001:0059 DST=ff02:0000:0000:0000:0000:0000:0000:0001 LEN=377 TC=0 HOPLIMIT=255 FLOWLBL=0 PROTO=UDP SPT=62976 DPT=62976 LEN=337 Dec 14 15:32:04 starkey.platypusnet.org server[23062]: WARNING: Exception processing realm [com.netscape.cms.tomcat.ProxyRealm@13f78b53] background process Dec 14 15:32:04 starkey.platypusnet.org server[23062]: javax.ws.rs.ServiceUnavailableException: Subsystem unavailable Dec 14 15:32:04 starkey.platypusnet.org server[23062]: at com.netscape.cms.tomcat.ProxyRealm.backgroundProcess(ProxyRealm.java:142) Dec 14 15:32:04 starkey.platypusnet.org server[23062]: at org.apache.catalina.core.ContainerBase.backgroundProcess(ContainerBase.java:1152) Dec 14 15:32:04 starkey.platypusnet.org server[23062]: at org.apache.catalina.core.StandardContext.backgroundProcess(StandardContext.java:5648) Dec 14 15:32:04 starkey.platypusnet.org server[23062]: at org.apache.catalina.core.ContainerBase$ContainerBackgroundProcessor.processChildren(ContainerBase.java:1390) Dec 14 15:32:04 starkey.platypusnet.org server[23062]: at org.apache.catalina.core.ContainerBase$ContainerBackgroundProcessor.processChildren(ContainerBase.java:1394) Dec 14 15:32:04 starkey.platypusnet.org server[23062]: at org.apache.catalina.core.ContainerBase$ContainerBackgroundProcessor.run(ContainerBase.java:1362) Dec 14 15:32:04 starkey.platypusnet.org server[23062]: at java.lang.Thread.run(Thread.java:748) Dec 14 15:32:09 starkey.platypusnet.org [sssd[ldap_child[23172]]][23172]: Failed to initialize credentials using keytab [MEMORY:/etc/krb5.keytab]: Cannot contact any KDC for realm 'PLATYPUSNET.ORG'. Unable to create GSSAPI-encrypted LDAP connection. Dec 14 15:32:09 starkey.platypusnet.org [sssd[ldap_child[23173]]][23173]: Failed to initialize credentials using keytab [MEMORY:/etc/krb5.keytab]: Cannot contact any KDC for realm 'PLATYPUSNET.ORG'. Unable to create GSSAPI-encrypted LDAP connection. Dec 14 15:32:14 starkey.platypusnet.org server[23062]: WARNING: Exception processing realm [com.netscape.cms.tomcat.ProxyRealm@13f78b53] background process Dec 14 15:32:14 starkey.platypusnet.org server[23062]: javax.ws.rs.ServiceUnavailableException: Subsystem unavailable Dec 14 15:32:14 starkey.platypusnet.org server[23062]: at com.netscape.cms.tomcat.ProxyRealm.backgroundProcess(ProxyRealm.java:142) Dec 14 15:32:14 starkey.platypusnet.org server[23062]: at org.apache.catalina.core.ContainerBase.backgroundProcess(ContainerBase.java:1152) Dec 14 15:32:14 starkey.platypusnet.org server[23062]: at org.apache.catalina.core.StandardContext.backgroundProcess(StandardContext.java:5648) Dec 14 15:32:14 starkey.platypusnet.org server[23062]: at org.apache.catalina.core.ContainerBase$ContainerBackgroundProcessor.processChildren(ContainerBase.java:1390) Dec 14 15:32:14 starkey.platypusnet.org server[23062]: at org.apache.catalina.core.ContainerBase$ContainerBackgroundProcessor.processChildren(ContainerBase.java:1394) Dec 14 15:32:14 starkey.platypusnet.org server[23062]: at org.apache.catalina.core.ContainerBase$ContainerBackgroundProcessor.run(ContainerBase.java:1362) Dec 14 15:32:14 starkey.platypusnet.org server[23062]: at java.lang.Thread.run(Thread.java:748) Dec 14 15:32:24 starkey.platypusnet.org server[23062]: WARNING: Exception processing realm [com.netscape.cms.tomcat.ProxyRealm@13f78b53] background process Dec 14 15:32:24 starkey.platypusnet.org server[23062]: javax.ws.rs.ServiceUnavailableException: Subsystem unavailable Dec 14 15:32:24 starkey.platypusnet.org server[23062]: at com.netscape.cms.tomcat.ProxyRealm.backgroundProcess(ProxyRealm.java:142) Dec 14 15:32:24 starkey.platypusnet.org server[23062]: at org.apache.catalina.core.ContainerBase.backgroundProcess(ContainerBase.java:1152) Dec 14 15:32:24 starkey.platypusnet.org server[23062]: at org.apache.catalina.core.StandardContext.backgroundProcess(StandardContext.java:5648) Dec 14 15:32:24 starkey.platypusnet.org server[23062]: at org.apache.catalina.core.ContainerBase$ContainerBackgroundProcessor.processChildren(ContainerBase.java:1390) Dec 14 15:32:24 starkey.platypusnet.org server[23062]: at org.apache.catalina.core.ContainerBase$ContainerBackgroundProcessor.processChildren(ContainerBase.java:1394) Dec 14 15:32:24 starkey.platypusnet.org server[23062]: at org.apache.catalina.core.ContainerBase$ContainerBackgroundProcessor.run(ContainerBase.java:1362) Dec 14 15:32:24 starkey.platypusnet.org server[23062]: at java.lang.Thread.run(Thread.java:748)

2 4

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users December 2018