December 2018 - FreeIPA-users - Fedora mailing-lists

Add second hostname in FreeIPA CA
by Peter Tselios 19 Dec '18

19 Dec '18

Hello everyone, I have 2 FreeIPA servers in AWS and a LB in front of them to serve the UI and the LDAP (just the gui and just the LDAP. For Kerberos, we use DNS discovery). My problem is that I cannot use TLS with LDAP connections because the CA does not have the LB's name in SAN. Is there any way to **add** in the CA certificate the additional hostname?

3 4

dyndb-ldap - Default idnsAllowTransfer not using global option
by Bryan Mesich 17 Dec '18

17 Dec '18

Hello, This is more of a bind-dyndb-ldap question, but documentation pointed me here when asking questions. I'm using the RHEL7.6 supplied version of Bind and bind-dyndb-ldap. Versions are: bind-dyndb-ldap-11.1-4.el7 bind-9.9.4-72.el7 I'm also using an up-stream version of OpenLDAP (2.4.44). I'm having trouble with the idnsAllowTransfer attribute. Specifically, a zone will not default to the global "allow-transfer" option. Explicitly setting idnsAllowTransfer attribute in the the zone fixes the problem, but the documentation for idnsAllowTransfer states: "If not set then zone inherits global allow-transfer from named.conf." Not specifying idnsAllowQuery properly defaults to the global allow-query list in named.conf. Not sure if its a bug, or just out-of-date documentation. A point in the right direction would be appreciated. Cheers, Bryan -- Bryan Mesich Sr. System Administrator DIGI-KEY ELECTRONICS 701 Brooks Ave. South Thief River Falls, MN 56701 USA

1 1

Connecting an Cisco ISE Radius Server with FreeIPA
by Nikolaos Hatzepanagiotides 13 Dec '18

13 Dec '18

Dear Community, first of all, thank you for that great developing! Like the subject say, I try to connect a Radius Server which is on my Cisco ISE. I want to use MsChapV2 for Authentication. But I can't find a real manual on how to connect a radius server with freeIPA. Just the FreeRadius manuals which I can't apply on my setup. Do you have a manual on setting up freeipa to use the radius. I already did a ipa-adtrust-install and added the Radius-Server (ISE) with FQDN with the command: ipa service-add 'radius/FQDN' and ipa service-add-host --hosts=FQDN radius/FQDN and ipa role-add-member --hosts=FQDN But i think this is not all i have to do in order to work with the radius server. My Question is also: Do I have to create a keytab from my Radius-Server (ISE) and put it no ipa. Something like in this guide shown? http://ilcofon.net/index.php/2018/01/05/wifi-authenticate-with-radius-and-f… ipa-getkeytab -p- 'radius/FQDN-RADIUS' -s FQDN-IPA -k /root/radius.keytab (By the way: Sorry for my bad english, I hope you can read it.) Thanks in advance! Best Regards Nikoalos Hatzepanagiotides

3 3

FreeIPA with Radius Server (Cisco ISE)
by Nikolaos Hatzipanagiotidis 13 Dec '18

13 Dec '18

Dear Community, thank you for joining the Community! I am struggeling on connecting my FreeIPA with an Cisco ISE Radius Server. I want to use MsChapV2 for Authentication. But I can't find a real manual on how to connect a radius server with freeIPA. Just the FreeRadius manuals which I can't apply on my setup. Do you have a manual on setting up freeipa to use the radius. I already did a ipa-adtrust-install and added the Radius-Server (ISE) with FQDN with the command: ipa service-add 'radius/FQDN' and ipa service-add-host --hosts=FQDN radius/FQDN and ipa role-add-member --hosts=FQDN But i think this is not all i have to do in order to work with the radius server. My Question is also: Do I have to create a keytab from my Radius-Server (ISE) and put it no ipa. Something like in this guide shown? http://ilcofon.net/index.php/2018/01/05/wifi-authenticate-with-radius-and-f… *ipa-getkeytab -p- 'radius/FQDN-RADIUS' -s FQDN-IPA -k /root/radius.keytab * (By the way: Sorry for my bad english, I hope you can read it.) Thanks in advance! Best Regards Nikoalos Hatzepanagiotides

1 0

Re: ipa-replica-install error migrating CentOS 6 to 7
by Florence Blanc-Renaud 12 Dec '18

12 Dec '18

On 12/5/18 3:12 PM, Marc Wiatrowski wrote: > hello flo, > > I attached the log to only you... Wasn't sure if there was anything in > there that wasn't ok to go to the whole list. > Hi Marc, (adding the list in cc) indeed the error happens in a code path that wasn't fixed. Could you open a new pagure ticket (https://pagure.io/freeipa/new_issue)? Please attach the end of the logs, after the line [28/41]: setting up initial replication (you can replace your domain name with XX). thanks, flo > thanks for looking! > Marc > > On Wed, Dec 5, 2018 at 3:55 AM Florence Blanc-Renaud <flo(a)redhat.com > <mailto:flo@redhat.com>> wrote: > > On 12/4/18 9:55 PM, Marc Wiatrowski via FreeIPA-users wrote: > > I'm trying to migrate a CentOS 6 IPA setup to CentOS 7. Both > are fully > > updated CentOS 6.10 (ipa-server-3.0.0-51) and CentOS 7.6 > > (ipa-server-4.6.4-10) > > > > I've been following: > > > https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/ht… > > > > I ran copy-schema-to-ca.py on centos6 and created the replica > info file > > without any issues. But then: > > > > [root@centos7]$ ipa-replica-install > > /var/lib/ipa/replica-info-centos7.gpg --setup-ca --ip-address > > 192.168.1.1 --setup-dns --no-forwarders > > Directory Manager (existing master) password: > > > > Run connection check to master > > admin(a)DOMAIN.NET <mailto:admin@DOMAIN.NET> > <mailto:admin@DOMAIN.NET <mailto:admin@DOMAIN.NET>> password: > > Connection check OK > > Adding [192.168.1.1 centos7.domain.net > <http://centos7.domain.net> <http://centos7.domain.net>] to > > your /etc/hosts file > > Configuring NTP daemon (ntpd) > > [1/4]: stopping ntpd > > [2/4]: writing configuration > > [3/4]: configuring ntpd to start on boot > > [4/4]: starting ntpd > > Done configuring NTP daemon (ntpd). > > Configuring directory server (dirsrv). Estimated time: 30 seconds > > [1/41]: creating directory server instance > > [2/41]: enabling ldapi > > .... > > [27/41]: ignore time skew for initial replication > > [28/41]: setting up initial replication > > [error] DatabaseError: Server is unwilling to perform: > modification > > of attribute nsds5replicabinddngroupcheckinterval is not allowed in > > replica entry > > Your system may be partly configured. > > Run /usr/sbin/ipa-server-install --uninstall to clean up. > > > > ipapython.admintool: ERROR Server is unwilling to perform: > > modification of attribute nsds5replicabinddngroupcheckinterval is > not > > allowed in replica entry > > ipapython.admintool: ERROR The ipa-replica-install command > failed. > > See /var/log/ipareplica-install.log for more information > > > > centos6:/var/log/dirsrv/slapd/errors: > > [04/Dec/2018:14:58:13 -0500] NSMMReplicationPlugin - > > replica_config_modify: modification of attribute > > nsds5replicabinddngroupcheckinterval is not allowed in replica entry > > > > The ipareplica-install.log contains the same errors at the end. > I have > > googled and seen similar issues but the solutions span from fixed > > already in a previous release to not having an answer in the > thread. It > > appears CentOS 6 shouldn't have this attribute and that should be > ok? > > but fails all the same. > > > > Any suggestions? > Hi Marc, > > can you provide the full content of ipareplica-install.log? The exact > stack trace will help me check if we forgot some places when fixing the > issue. > > Thanks, > flo > > Thank you in advance, > > Marc > > > > _______________________________________________ > > FreeIPA-users mailing list -- > freeipa-users(a)lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org> > > To unsubscribe send an email to > freeipa-users-leave(a)lists.fedorahosted.org > <mailto:freeipa-users-leave@lists.fedorahosted.org> > > Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html > > List Guidelines: > https://fedoraproject.org/wiki/Mailing_list_guidelines > > List Archives: > https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost… > > >

2 2

Installation Replica reports error: Full PKINIT configuration did not succeed
by 74cmonty 11 Dec '18

11 Dec '18

Hi, after completing master installation I started setup of replica. This means I first enrolled the replica server as a client and then executed this command: ipa-replica-install The installation log reports this error: Full PKINIT configuration did not succeed The setup will only install bits essential to the server functionality You can enable PKINIT after the setup completed using 'ipa-pkinit-manage' Is this an error or normal behavior of replica installation? Configuring certificate server (pki-tomcatd) [1/2]: configure certmonger for renewals [2/2]: Importing RA key Done configuring certificate server (pki-tomcatd). Configuring Kerberos KDC (krb5kdc) [1/1]: installing X509 Certificate for PKINIT Full PKINIT configuration did not succeed The setup will only install bits essential to the server functionality You can enable PKINIT after the setup completed using 'ipa-pkinit-manage' Done configuring Kerberos KDC (krb5kdc). Applying LDAP updates Upgrading IPA:. Estimated time: 1 minute 30 seconds [1/10]: stopping directory server [2/10]: saving configuration [3/10]: disabling listeners [4/10]: enabling DS global lock [5/10]: disabling Schema Compat [6/10]: starting directory server [7/10]: upgrading server [8/10]: stopping directory server [9/10]: restoring configuration [10/10]: starting directory server Done. Finalize replication settings Restarting the KDC

4 26

Samba integration
by Николай Савельев 11 Dec '18

11 Dec '18

Hello. I try to set up samba with freeipa. I use this article https://www.freeipa.org/page/Howto/Integrating_a_Samba_File_Server_With_IPA But I have strange error: дек 10 13:48:58 nfs.fs.lan smbd[14242]: [2018/12/10 13:48:58.758419, 0] ../source3/auth/auth_util.c:1372(make_new_session_info_guest) дек 10 13:48:58 nfs.fs.lan smbd[14242]: create_local_token failed: NT_STATUS_NO_MEMORY дек 10 13:48:58 nfs.fs.lan smbd[14242]: [2018/12/10 13:48:58.758577, 0] ../source3/smbd/server.c:1993(main) дек 10 13:48:58 nfs.fs.lan smbd[14242]: ERROR: failed to setup guest info. дек 10 13:48:58 nfs.fs.lan systemd[1]: smb.service: main process exited, code=exited, status=255/n/a дек 10 13:48:58 nfs.fs.lan systemd[1]: Failed to start Samba SMB Daemon. What does it mean? -- С уважением, Николай.

2 2

How to prevent non-admin users of FreeIPA from reading the list of users in the web interface?
by cdknight 11 Dec '18

11 Dec '18

When a user signs in to FreeIPA, I do not want them to be able to view the list of users in my LDAP server under the "Active users" link. I still want them to be able to administer self-service, so they can reset their password, add OTP tokens, etc. How would I go about doing this? The users will only be able to access the web interface, so it doesn't matter whether they can access it from other sources.

3 4

FreeIPA ca for kerberos
by stephan.schultchen＠gmail.com 11 Dec '18

11 Dec '18

Hello, if possible i would like to use the FreeIPA ca for Kubernetes. but kubernetes has some requirements on the CN and O. the CN has to match the pattern system:node:$FQDN and O has to match system:node also see: https://github.com/kelseyhightower/kubernetes-the-hard-way/blob/master/docs… is this possible with the FreeIPA CA, or do i need to use another ca for Kubernetes? Kind Regards, Stephan

3 2

client ldap issue
by Jaroslav Shejbal 11 Dec '18

11 Dec '18

Hi everyone, I am pretty new to freeipa and i like it a lot but I have one problem which I cannot solve I am using ipa-server (freeipa-server) on ubuntu 18.10 and ipa-clients debian 9, so I am not using ipa-client package only nscd & sssd and configuration. All clients are successfully enrolled provided with keytab file. Some clients works fine and it looks like this (in /var/log/auth.log): Nov 26 17:54:02 ipa krb5kdc[1345]: AS_REQ (8 etypes {18 17 20 19 16 23 25 26}) AA.BB.CC.DD: NEEDED_PREAUTH: host/some-working-host.domain.com(a)DOMAIN.COM for krbtgt/DOMAIN.COM(a)DOMAIN.COM, Additional pre-authentication required Nov 26 17:54:02 ipa krb5kdc[1345]: AS_REQ (8 etypes {18 17 20 19 16 23 25 26}) AA.BB.CC.DD: ISSUE: authtime 1543254842, etypes {rep=18 tkt=18 ses=18}, host/some-working-host.domain.com(a)DOMAIN.COM for krbtgt/DOMAIN.COM(a)DOMAIN.COM Nov 26 17:54:02 ipa krb5kdc[1345]: TGS_REQ (8 etypes {18 17 20 19 16 23 25 26}) AA.BB.CC.DD: ISSUE: authtime 1543254842, etypes {rep=18 tkt=18 ses=18}, host/some-working-host.domain.com(a)DOMAIN.COM for ldap/ipa.domain.com(a)DOMAIN.COM and some are not provided with the ldap line: Nov 26 18:12:51 ipa krb5kdc[1345]: AS_REQ (8 etypes {18 17 20 19 16 23 25 26}) AA.BB.CC.DD: NEEDED_PREAUTH: host/some-not-working-host.domain.com(a)DOMAIN.COM for krbtgt/DOMAIN.COM(a)DOMAIN.COM, Additional pre-authentication required Nov 26 18:12:51 ipa krb5kdc[1345]: AS_REQ (8 etypes {18 17 20 19 16 23 25 26}) AA.BB.CC.DD: ISSUE: authtime 1543255971, etypes {rep=18 tkt=18 ses=18}, host/some-not-working-host.domain.com(a)DOMAIN.COM for krbtgt/DOMAIN.COM(a)DOMAIN.COM (lines with "closing down fd 12" was omitted, also hostnames IPs and domains was replaced) I've checked DNS settings, time difference and various logs but with no success. I've also try to remove rm -f /var/lib/sss/db/* and reinstall client packages. Do you have any idea where and what should I look for regarding this issue?

2 3

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users December 2018