December 2018 - FreeIPA-users - Fedora mailing-lists

Re: SSO issue on one freeipauser
by Alexander Bokovoy 05 Dec '18

05 Dec '18

Please do not drop the public mailing list. On ke, 05 joulu 2018, tarak sinha wrote: >Hi Alexander, > >We recently build new IPA servers in our DC, new IPA server realm name will >be IPA.EXAMPLE.COM and old IPA realm was EXAMPLE.COM. > >If you see only one user impacted to do SSO on this host rest of the users >are able to do SSO perfectly with new REALM (IPA.EXAMPLE.COM) You need to look into that user's environment. Perhaps, the user has own krb5.conf override by setting KRB5_CONFIG environment variable. > > >On Wed, Dec 5, 2018 at 8:27 PM Alexander Bokovoy <abokovoy(a)redhat.com> >wrote: > >> On ke, 05 joulu 2018, tarak sinha wrote: >> >user not working >> > >> >[aalevoor(a)deploy1.ops ~]$ kvno host/mstageegw3.example.com >> >kvno: Server not found in Kerberos database while getting credentials for >> >host/mstageegw3.example.com(a)EXAMPLE.COM >> >[aalevoor(a)deploy1.ops ~]$ >> > >> >*Working user on same host* >> > >> >tsinha(a)deploy1.ops ~]$ kvno host/mstageegw3.example.com >> >host/mstageegw3.example.com(a)IPA.EXAMPLE.COM: kvno = 1 >> > >> >Any further advice to check >> You need to explain how EXAMPLE.COM and IPA.EXAMPLE.COM Kerberos realms >> are related to each other. >> >> What is your deployment design? >> >> >> > >> >On Wed, Dec 5, 2018 at 5:44 PM tarak sinha <taraksinha09(a)gmail.com> >> wrote: >> > >> >> Thanks, I'll check it out. >> >> >> >> On Wed, Dec 5, 2018, 5:19 PM Alexander Bokovoy <abokovoy(a)redhat.com >> wrote: >> >> >> >>> On ke, 05 joulu 2018, tarak sinha wrote: >> >>> >Yes, I can. thanks alex for your help. Let me know what needs to be >> done. >> >>> > >> >>> >[root(a)deploy1.ops tsinha]# kvno -S host mstageegw3.example.com >> >>> >kvno: invalid option -- S >> >>> >usage: kvno [-4 | [-c ccache] [-e etype] [-k keytab]] service1 >> service2 >> >>> ... >> >>> >[root(a)deploy1.ops tsinha]# >> >>> What OS is this? >> >>> >> >>> Anyway, what happens if you get >> >>> >> >>> kvno host/mstageegw3.example.com >> >>> >> >>> Also, please show >> >>> >> >>> ipa host-show --all mstageegw3.example.com >> >>> >> >>> >> >>> >> >>> > >> >>> >On Wed, Dec 5, 2018 at 4:28 PM Alexander Bokovoy <abokovoy(a)redhat.com >> > >> >>> >wrote: >> >>> > >> >>> >> On ke, 05 joulu 2018, tarak sinha via FreeIPA-users wrote: >> >>> >> >Hi Guys, >> >>> >> > >> >>> >> >I am having issue to ssh with one host with SSO, all the users are >> >>> able to >> >>> >> >ssh without asking password but only my userid having issue with >> >>> asking >> >>> >> >password, I have tried to do kdestroy and did kinit again with >> userid >> >>> >> along >> >>> >> >with REALM but did not work. if you have any suggestions please >> let me >> >>> >> know >> >>> >> >to check further. >> >>> >> > >> >>> >> >Here it is output for ssh connection which asking password, >> >>> >> >----snip---- >> >>> >> > >> >>> >> >debug1: Authentications that can continue: >> >>> >> >publickey,gssapi-keyex,gssapi-with-mic,password >> >>> >> >debug1: Next authentication method: gssapi-with-mic >> >>> >> >debug1: Unspecified GSS failure. Minor code may provide more >> >>> information >> >>> >> >Server not found in Kerberos database >> >>> >> ^^ this is your problem. >> >>> >> >> >>> >> Can you show output of >> >>> >> >> >>> >> kvno -S host mstageegw3.example.com >> >>> >> >> >>> >> on your client from where you do SSH? >> >>> >> >> >>> >> >> >>> >> >> >>> >> >debug1: Unspecified GSS failure. Minor code may provide more >> >>> information >> >>> >> >Server not found in Kerberos database >> >>> >> >debug1: Unspecified GSS failure. Minor code may provide more >> >>> information >> >>> >> >Server not found in Kerberos database >> >>> >> >debug2: we did not send a packet, disable method >> >>> >> >debug1: Next authentication method: publickey >> >>> >> >debug1: Offering public key: /uhome/aalevoor/.ssh/id_rsa >> >>> >> >debug2: we sent a publickey packet, wait for reply >> >>> >> >debug1: Authentications that can continue: >> >>> >> >publickey,gssapi-keyex,gssapi-with-mic,password >> >>> >> >debug1: Trying private key: /uhome/aalevoor/.ssh/id_dsa >> >>> >> >debug2: we did not send a packet, disable method >> >>> >> >debug1: Next authentication method: password >> >>> >> >aalevoor(a)mstageegw3.example.com's password: >> >>> >> >debug2: we sent a password packet, wait for reply >> >>> >> >debug1: Authentication succeeded (password). >> >>> >> >debug1: channel 0: new [client-session] >> >>> >> >debug2: channel 0: send open >> >>> >> >debug1: Entering interactive session. >> >>> >> >debug2: callback start >> >>> >> >debug2: client_session2_setup: id 0 >> >>> >> >debug2: channel 0: request pty-req confirm 0 >> >>> >> >debug2: channel 0: request shell confirm 0 >> >>> >> >debug2: fd 4 setting TCP_NODELAY >> >>> >> >debug2: callback done >> >>> >> >debug2: channel 0: open confirm rwindow 0 rmax 32768 >> >>> >> >debug2: channel 0: rcvd adjust 2097152 >> >>> >> >Last login: Wed Dec 5 01:53:06 2018 from 10.22.6.70 >> >>> >> > >> >>> >> >-- >> >>> >> > >> >>> >> >*Thanks,* >> >>> >> > >> >>> >> >*TS* >> >>> >> >> >>> >> >_______________________________________________ >> >>> >> >FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org >> >>> >> >To unsubscribe send an email to >> >>> >> freeipa-users-leave(a)lists.fedorahosted.org >> >>> >> >Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html >> >>> >> >List Guidelines: >> >>> https://fedoraproject.org/wiki/Mailing_list_guidelines >> >>> >> >List Archives: >> >>> >> >> >>> >> https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost… >> >>> >> >> >>> >> >> >>> >> -- >> >>> >> / Alexander Bokovoy >> >>> >> Sr. Principal Software Engineer >> >>> >> Security / Identity Management Engineering >> >>> >> Red Hat Limited, Finland >> >>> >> >> >>> > >> >>> > >> >>> >-- >> >>> > >> >>> >*Thanks,* >> >>> > >> >>> >*Tarak Nath Sinha* >> >>> > >> >>> >*Mobile: **+91 8197522750* >> >>> >> >>> -- >> >>> / Alexander Bokovoy >> >>> Sr. Principal Software Engineer >> >>> Security / Identity Management Engineering >> >>> Red Hat Limited, Finland >> >>> >> >> >> > >> >-- >> > >> >*Thanks,* >> > >> >*Tarak Nath Sinha* >> > >> >*Mobile: **+91 8197522750* >> >> -- >> / Alexander Bokovoy >> Sr. Principal Software Engineer >> Security / Identity Management Engineering >> Red Hat Limited, Finland >> > > >-- > >*Thanks,* > >*Tarak Nath Sinha* > >*Mobile: **+91 8197522750* -- / Alexander Bokovoy Sr. Principal Software Engineer Security / Identity Management Engineering Red Hat Limited, Finland

1 0

sudo and hostgroups
by Winfried de Heiden 05 Dec '18

05 Dec '18

Hi all, On a brand new install, sudo for hostgroup seems not to work. Ik create a sudo rule for admins, only to to "averything" on all servers within the hostgroup "ipaservers": Rule name: s3_sudo_freeipa_admins Enabled: TRUE Command category: all RunAs User category: all RunAs Group category: all User Groups: admins Host Groups: ipaservers However, user admins is not allowed to to so: admin@freeipa1 ~]$ sudo -l [sudo] password for admin: Sorry, user admin may not run sudo on freeipa1. Removing the group but adding the two FreeIPA-servers: Rule name: s3_sudo_freeipa_admins Enabled: TRUE Command category: all RunAs User category: all RunAs Group category: all User Groups: admins Hosts: freeipa1.example.local, freeipa2.example.local After cleaning the sssd-cache: sudo -l [sudo] password for admin: Matching Defaults entries for admin on freeipa1: !visiblepw, always_set_home, match_group_by_gid, env_reset, env_keep="COLORS DISPLAY HOSTNAME HISTSIZE KDEDIR LS_COLORS", env_keep+="MAIL PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE", env_keep+="LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES", env_keep+="LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE", env_keep+="LC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET XAUTHORITY", secure_path=/sbin\:/bin\:/usr/sbin\:/usr/bin User admin may run the following commands on freeipa1: (ALL : ALL) ALL There are not clients yet, this issues was reproduced on a brand new CentOS 7.5 IPA installation with no modifications or else... What's hapening here? Winfried

2 3

Re: SSO issue on one freeipauser
by Alexander Bokovoy 05 Dec '18

05 Dec '18

On ke, 05 joulu 2018, tarak sinha wrote: >user not working > >[aalevoor(a)deploy1.ops ~]$ kvno host/mstageegw3.example.com >kvno: Server not found in Kerberos database while getting credentials for >host/mstageegw3.example.com(a)EXAMPLE.COM >[aalevoor(a)deploy1.ops ~]$ > >*Working user on same host* > >tsinha(a)deploy1.ops ~]$ kvno host/mstageegw3.example.com >host/mstageegw3.example.com(a)IPA.EXAMPLE.COM: kvno = 1 > >Any further advice to check You need to explain how EXAMPLE.COM and IPA.EXAMPLE.COM Kerberos realms are related to each other. What is your deployment design? > >On Wed, Dec 5, 2018 at 5:44 PM tarak sinha <taraksinha09(a)gmail.com> wrote: > >> Thanks, I'll check it out. >> >> On Wed, Dec 5, 2018, 5:19 PM Alexander Bokovoy <abokovoy(a)redhat.com wrote: >> >>> On ke, 05 joulu 2018, tarak sinha wrote: >>> >Yes, I can. thanks alex for your help. Let me know what needs to be done. >>> > >>> >[root(a)deploy1.ops tsinha]# kvno -S host mstageegw3.example.com >>> >kvno: invalid option -- S >>> >usage: kvno [-4 | [-c ccache] [-e etype] [-k keytab]] service1 service2 >>> ... >>> >[root(a)deploy1.ops tsinha]# >>> What OS is this? >>> >>> Anyway, what happens if you get >>> >>> kvno host/mstageegw3.example.com >>> >>> Also, please show >>> >>> ipa host-show --all mstageegw3.example.com >>> >>> >>> >>> > >>> >On Wed, Dec 5, 2018 at 4:28 PM Alexander Bokovoy <abokovoy(a)redhat.com> >>> >wrote: >>> > >>> >> On ke, 05 joulu 2018, tarak sinha via FreeIPA-users wrote: >>> >> >Hi Guys, >>> >> > >>> >> >I am having issue to ssh with one host with SSO, all the users are >>> able to >>> >> >ssh without asking password but only my userid having issue with >>> asking >>> >> >password, I have tried to do kdestroy and did kinit again with userid >>> >> along >>> >> >with REALM but did not work. if you have any suggestions please let me >>> >> know >>> >> >to check further. >>> >> > >>> >> >Here it is output for ssh connection which asking password, >>> >> >----snip---- >>> >> > >>> >> >debug1: Authentications that can continue: >>> >> >publickey,gssapi-keyex,gssapi-with-mic,password >>> >> >debug1: Next authentication method: gssapi-with-mic >>> >> >debug1: Unspecified GSS failure. Minor code may provide more >>> information >>> >> >Server not found in Kerberos database >>> >> ^^ this is your problem. >>> >> >>> >> Can you show output of >>> >> >>> >> kvno -S host mstageegw3.example.com >>> >> >>> >> on your client from where you do SSH? >>> >> >>> >> >>> >> >>> >> >debug1: Unspecified GSS failure. Minor code may provide more >>> information >>> >> >Server not found in Kerberos database >>> >> >debug1: Unspecified GSS failure. Minor code may provide more >>> information >>> >> >Server not found in Kerberos database >>> >> >debug2: we did not send a packet, disable method >>> >> >debug1: Next authentication method: publickey >>> >> >debug1: Offering public key: /uhome/aalevoor/.ssh/id_rsa >>> >> >debug2: we sent a publickey packet, wait for reply >>> >> >debug1: Authentications that can continue: >>> >> >publickey,gssapi-keyex,gssapi-with-mic,password >>> >> >debug1: Trying private key: /uhome/aalevoor/.ssh/id_dsa >>> >> >debug2: we did not send a packet, disable method >>> >> >debug1: Next authentication method: password >>> >> >aalevoor(a)mstageegw3.example.com's password: >>> >> >debug2: we sent a password packet, wait for reply >>> >> >debug1: Authentication succeeded (password). >>> >> >debug1: channel 0: new [client-session] >>> >> >debug2: channel 0: send open >>> >> >debug1: Entering interactive session. >>> >> >debug2: callback start >>> >> >debug2: client_session2_setup: id 0 >>> >> >debug2: channel 0: request pty-req confirm 0 >>> >> >debug2: channel 0: request shell confirm 0 >>> >> >debug2: fd 4 setting TCP_NODELAY >>> >> >debug2: callback done >>> >> >debug2: channel 0: open confirm rwindow 0 rmax 32768 >>> >> >debug2: channel 0: rcvd adjust 2097152 >>> >> >Last login: Wed Dec 5 01:53:06 2018 from 10.22.6.70 >>> >> > >>> >> >-- >>> >> > >>> >> >*Thanks,* >>> >> > >>> >> >*TS* >>> >> >>> >> >_______________________________________________ >>> >> >FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org >>> >> >To unsubscribe send an email to >>> >> freeipa-users-leave(a)lists.fedorahosted.org >>> >> >Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html >>> >> >List Guidelines: >>> https://fedoraproject.org/wiki/Mailing_list_guidelines >>> >> >List Archives: >>> >> >>> https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost… >>> >> >>> >> >>> >> -- >>> >> / Alexander Bokovoy >>> >> Sr. Principal Software Engineer >>> >> Security / Identity Management Engineering >>> >> Red Hat Limited, Finland >>> >> >>> > >>> > >>> >-- >>> > >>> >*Thanks,* >>> > >>> >*Tarak Nath Sinha* >>> > >>> >*Mobile: **+91 8197522750* >>> >>> -- >>> / Alexander Bokovoy >>> Sr. Principal Software Engineer >>> Security / Identity Management Engineering >>> Red Hat Limited, Finland >>> >> > >-- > >*Thanks,* > >*Tarak Nath Sinha* > >*Mobile: **+91 8197522750* -- / Alexander Bokovoy Sr. Principal Software Engineer Security / Identity Management Engineering Red Hat Limited, Finland

1 0

TOTP generators producing different values
by Brian Topping 05 Dec '18

05 Dec '18

Hi all, I have a question about TOTP authenticators (Google Authenticator, Authy, FreeOTP): Why is it that a given URL/QRCode can load into all three authenticators, but all three give different OTP values at any given time and only FreeOTP actually works? When I run `ipa otp-sync` with values from Authy, it crashes: ``` [root@ns-0 /]# ipa otptoken-sync 752f744e-1879-4499-a9c5-8932f739d26a User ID: player1 Password: First Code: Second Code: ipa: ERROR: non-public: AttributeError: 'NoneType' object has no attribute 'name' Traceback (most recent call last): File "/usr/lib/python2.7/site-packages/ipalib/backend.py", line 139, in execute result = self.Command[_name](*args, **options) File "/usr/lib/python2.7/site-packages/ipalib/frontend.py", line 447, in __call__ return self.__do_call(*args, **options) File "/usr/lib/python2.7/site-packages/ipalib/frontend.py", line 475, in __do_call ret = self.run(*args, **options) File "/usr/lib/python2.7/site-packages/ipalib/frontend.py", line 1199, in run return self.forward(*args, **options) File "/usr/lib/python2.7/site-packages/ipaclient/plugins/otptoken.py", line 168, in forward query['token'] = DN((obj.primary_key.name, args[0]), AttributeError: 'NoneType' object has no attribute 'name' ipa: ERROR: an internal error has occurred ``` Thanks kindly for any leads on this! Brian

3 3

Issue setting up FreeIPA and Samba
by Robert Byrne 05 Dec '18

05 Dec '18

Hi, I am trying to setup FreeIPA to authenticate users logging into Linux systems, but would also like to use this to authenticate users accessing Samba shares from Windows clients. The problem is that I cannot access the shares at all from Windows clients and when I try to access a share from a Linux client, the following error message is printed: robert@workstation 14:13:09 > smbclient //192.168.0.xx/samba -U robert WARNING: The "syslog" option is deprecated krb5_init_context failed (Invalid argument) smb_krb5_context_init_basic failed (Invalid argument) Enter WORKGROUP\robert's password: krb5_init_context failed (Invalid argument) smb_krb5_context_init_basic failed (Invalid argument) session setup failed: NT_STATUS_LOGON_FAILURE Information regarding the setup: - The FreeIPA + Samba server (samba.linux.company.local) is a VM running CentOS 7. The FreeIPA version is "VERSION: 4.5.4, API_VERSION: 2.228". The Samba version is 4.7.1. - The firewalls on the server, VM host and clients are turned off for debugging purposes. - SELINUX is also turned off. - This was a fresh install and FreeIPA was setup with the following commands: sudo yum install ipa-server sudo ipa-server-install Do you want to configure integrated DNS (BIND)? [no]: no Server host name [ipa.company.local]: samba.linux.company.local Please confirm the domain name [company.local]: samba.linux.company.local Please provide a realm name [SAMBA.COMPANY.LOCAL]: SAMBA.LINUX.COMPANY.LOCAL - The users can log into the Linux workstations that have been enrolled, suggesting that the setup is at least partly correct. The Windows clients are not enrolled into the FreeIPA domain and are instead in the domain company.local. I followed the instructions here (https://www.freeipa.org/page/Howto/Integrating_a_Samba_File_Server_With_IPA…) with the following options: yum install ipa-server-trust-ad sudo ipa-adtrust-install Enable trusted domains support in slapi-nis? [no]: no NetBIOS domain name [LINUX]: LINUX Do you want to run the ipa-sidgen task? [no]: yes Followed by: sudo mkdir /samba sudo chmod 777 /samba sudo net conf addshare samba /samba writeable=y guest_ok=n sudo systemctl restart smb Running sudo net conf list produces the following output: [global] workgroup = LINUX netbios name = SAMBA realm = LINUX.COMPANY.LOCAL kerberos method = dedicated keytab dedicated keytab file = /etc/samba/samba.keytab create krb5 conf = no security = user domain master = yes domain logons = yes log level = 1 max log size = 100000 log file = /var/log/samba/log.%m passdb backend = ipasam:ldapi://%2fvar%2frun%2fslapd-LINUX-COMPANY-LOCAL.socket disable spoolss = yes ldapsam:trusted = yes ldap ssl = off ldap suffix = dc=linux,dc=company,dc=local ldap user suffix = cn=users,cn=accounts ldap group suffix = cn=groups,cn=accounts ldap machine suffix = cn=computers,cn=accounts rpc_server:epmapper = external rpc_server:lsarpc = external rpc_server:lsass = external rpc_server:lsasd = external rpc_server:samr = external rpc_server:netlogon = external rpc_server:tcpip = yes rpc_daemon:epmd = fork rpc_daemon:lsasd = fork [samba] path = /samba guest ok = yes read only = no When I try to mount the share on Windows clients (either with \\192.168.0.xx\samba or \\samba.linux.company.local in Explorer) it states that 'The user name or password is incorrect.' I am not convinced that this is the case, however, since the same message is displayed even if the share is created with the option 'guest_ok=y'. If I try to mount the 'guest_ok=y' share from a Linux client in the FreeIPA realm, I at least get an error message: robert@workstation 14:13:09 > smbclient //192.168.0.xx/samba -U username WARNING: The "syslog" option is deprecated krb5_init_context failed (Invalid argument) smb_krb5_context_init_basic failed (Invalid argument) Enter LINUX\robert's password: krb5_init_context failed (Invalid argument) smb_krb5_context_init_basic failed (Invalid argument) session setup failed: NT_STATUS_LOGON_FAILURE Under both Windows and Linux I have tried all combinations of domain (LINUX, SAMBA, WORKGROUP) and various user that I can think of, but with no success. Does anyone have an idea what the issue might be? I previously created the above setup on a pair of VMs and everything worked as expected, but am having difficulty reproducing it here.... Many thanks in advance for any help and suggestions! Please let me know if you need any more information. Rob

3 4

SSO issue on one freeipauser
by tarak sinha 05 Dec '18

05 Dec '18

Hi Guys, I am having issue to ssh with one host with SSO, all the users are able to ssh without asking password but only my userid having issue with asking password, I have tried to do kdestroy and did kinit again with userid along with REALM but did not work. if you have any suggestions please let me know to check further. Here it is output for ssh connection which asking password, ----snip---- debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password debug1: Next authentication method: gssapi-with-mic debug1: Unspecified GSS failure. Minor code may provide more information Server not found in Kerberos database debug1: Unspecified GSS failure. Minor code may provide more information Server not found in Kerberos database debug1: Unspecified GSS failure. Minor code may provide more information Server not found in Kerberos database debug2: we did not send a packet, disable method debug1: Next authentication method: publickey debug1: Offering public key: /uhome/aalevoor/.ssh/id_rsa debug2: we sent a publickey packet, wait for reply debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password debug1: Trying private key: /uhome/aalevoor/.ssh/id_dsa debug2: we did not send a packet, disable method debug1: Next authentication method: password aalevoor(a)mstageegw3.example.com's password: debug2: we sent a password packet, wait for reply debug1: Authentication succeeded (password). debug1: channel 0: new [client-session] debug2: channel 0: send open debug1: Entering interactive session. debug2: callback start debug2: client_session2_setup: id 0 debug2: channel 0: request pty-req confirm 0 debug2: channel 0: request shell confirm 0 debug2: fd 4 setting TCP_NODELAY debug2: callback done debug2: channel 0: open confirm rwindow 0 rmax 32768 debug2: channel 0: rcvd adjust 2097152 Last login: Wed Dec 5 01:53:06 2018 from 10.22.6.70 -- *Thanks,* *TS*

2 4

ipa-replica-install error migrating CentOS 6 to 7
by Marc Wiatrowski 05 Dec '18

05 Dec '18

I'm trying to migrate a CentOS 6 IPA setup to CentOS 7. Both are fully updated CentOS 6.10 (ipa-server-3.0.0-51) and CentOS 7.6 (ipa-server-4.6.4-10) I've been following: https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/ht… I ran copy-schema-to-ca.py on centos6 and created the replica info file without any issues. But then: [root@centos7]$ ipa-replica-install /var/lib/ipa/replica-info-centos7.gpg --setup-ca --ip-address 192.168.1.1 --setup-dns --no-forwarders Directory Manager (existing master) password: Run connection check to master admin(a)DOMAIN.NET password: Connection check OK Adding [192.168.1.1 centos7.domain.net] to your /etc/hosts file Configuring NTP daemon (ntpd) [1/4]: stopping ntpd [2/4]: writing configuration [3/4]: configuring ntpd to start on boot [4/4]: starting ntpd Done configuring NTP daemon (ntpd). Configuring directory server (dirsrv). Estimated time: 30 seconds [1/41]: creating directory server instance [2/41]: enabling ldapi .... [27/41]: ignore time skew for initial replication [28/41]: setting up initial replication [error] DatabaseError: Server is unwilling to perform: modification of attribute nsds5replicabinddngroupcheckinterval is not allowed in replica entry Your system may be partly configured. Run /usr/sbin/ipa-server-install --uninstall to clean up. ipapython.admintool: ERROR Server is unwilling to perform: modification of attribute nsds5replicabinddngroupcheckinterval is not allowed in replica entry ipapython.admintool: ERROR The ipa-replica-install command failed. See /var/log/ipareplica-install.log for more information centos6:/var/log/dirsrv/slapd/errors: [04/Dec/2018:14:58:13 -0500] NSMMReplicationPlugin - replica_config_modify: modification of attribute nsds5replicabinddngroupcheckinterval is not allowed in replica entry The ipareplica-install.log contains the same errors at the end. I have googled and seen similar issues but the solutions span from fixed already in a previous release to not having an answer in the thread. It appears CentOS 6 shouldn't have this attribute and that should be ok? but fails all the same. Any suggestions? Thank you in advance, Marc

3 3

FreeIPA 4.6.4 Web GUI - Login failed due to an unknown reason.
by Andrey Ptashnik 04 Dec '18

04 Dec '18

Dear FreeIPA Team, I have an issue with Web GUI throwing error message "Login failed due to an unknown reason" when login through Web interface. Other functionality like directory service, DNS and authentication with ipa-clients seems to work fine. I first spotted this issue in 4.5.0 and tried troubleshooting steps from previous thread, however that did not help. Hoping that issue is solved in higher versions I tried upgrading ipa-server packages via: # yum upgrade ipa-server # ipa-server-upgrade However it did not solve the issue in 4.6.6 and exactly the same behavior I saw in version 4.5.0 # rpm -q ipa-server.x86_64 krb5-libs.x86_64 krb5-server.x86_64 cyrus-sasl-gssapi.x86_64 sssd-krb5.x86_64 httpd.x86_64 ipa-server-4.6.4-10.el7.centos.x86_64 krb5-libs-1.15.1-34.el7.x86_64 krb5-server-1.15.1-34.el7.x86_64 cyrus-sasl-gssapi-2.1.26-23.el7.x86_64 sssd-krb5-1.16.2-13.el7.x86_64 httpd-2.4.6-88.el7.centos.x86_64 # cat /etc/*release* CentOS Linux release 7.4.1708 (Core) What could be the next troubleshooting step in my case? Thanks in advance, Andrey

2 5

Host vs. service certificates
by Rob Foehl 04 Dec '18

04 Dec '18

Are there any practical differences between IPA-issued certificates for hosts and services (ipa-getcert -K service/hostname for the latter), if they're only being used to identify the host in a non-Kerberos-aware TLS context? I'd like to omit the service management if it's not useful in this case. -Rob

3 5

yubikey csr not working
by Natxo Asenjo 04 Dec '18

04 Dec '18

hi, I am testing smartcard authentication with a yubikey neo like described in https://frasertweedale.github.io/blog-redhat/posts/2016-08-12-yubikey-sc-lo… I successfully generated a key using the yubico-piv-tool, and with that a csr. yubico-piv-tool -a verify-pin -a request-certificate -s 9e -S "/CN=user50/" Enter PIN: Successfully verified PIN. -----BEGIN CERTIFICATE REQUEST----- MIICVjCCAT4CAQAwETEPMA0GA1UEAwwGdXNlcjUwMIIBIjANBgkqhkiG9w0BAQEF AAOCAQ8AMIIBCgKCAQEAkWjUxl0qInlYB4TiZ7GkJkgBdomTTzk5GfK76ZizbsGV 4xyPmUgf+7eEO3GEvkGiBPJxk0NVJuamuEJTIXtn7h7Wgz6ghCE0uCCupjAJqa57 Hdm3h3GvofwWuE442YIRHvXydaSkrCAGsL/M3g4tVi7Xn+jTaWrzKsAeqJxQVRPD h4R9bN4BIzXL+62qGI9jriM8dJEWCrGFzg6viCujRlybkhQhiLxCGvS8lO3HQ7tF lDRZN6Ey/nvFxIC1MtGZgrN3nj/Z37nIBWF4s20CcJau8mfalJQEFjqLkjMh7X8K hWKrSdNj43nBTlO0So3qezs4roLkZFSN1hQnCG/pCQIDAQABoAAwDQYJKoZIhvcN AQELBQADggEBAH22PLW7Tuc6y5VxIpnaqdsborbp+Twr/kPoDnibJPjV8JBYqC4G iQCHDJn+uuJSpiBxTUtYX45CscOiwD8kiDoYIH/DCXUqPAhRudsBpJWDn9TKeFC5 b0PrwuN5cDo+yKYZW590eLL8/xdjtb9p/M3AU5tSJTbG3dCA5Rp4MdgE97pOYkPg 3kUHR19YjH/GnZHeuv8Af+WIJVMvDVGKF+MvJEImSjg/ZQUV6hzBI+oAWr9Hj21q KABjiO5AhMyo+uC6WXajkltzUP30cbBlNl0Z34Dw452Ym5uILWAF+ZmlT0sp0Mg4 lwNPSwst5mhUtQL7AmNHYHg7cAAgXx9Xql0= -----END CERTIFICATE REQUEST----- Successfully generated a certificate request. With this csr I try generating a certificate but it fails: $ ipa cert-request user50.csr --principal user50 --raw ipa: ERROR: Request failed with status 500: Non-2xx response from CA REST API: 500. Invalid Request In the pki logs I only see this error. 192.168.5.10 - ipara [08/Nov/2018:22:37:12 +0100] "GET /ca/rest/authorities/edb13864-3c75-4c7d-b5b8-dd4322789437/cert HTTP/1.1" 200 920 192.168.5.10 - ipara [08/Nov/2018:22:37:12 +0100] "GET /ca/rest/account/logout HTTP/1.1" 204 - 192.168.5.10 - - [08/Nov/2018:22:37:13 +0100] "POST /ca/rest/certrequests?issuer-id=edb13864-3c75-4c7d-b5b8-dd4322789437 HTTP/1.1" 500 123 Any ideas as to what is going wrong? Thanks! -- Groeten, natxo

3 5

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users December 2018