FreeIPA-users December 2018

freeipa-users@lists.fedorahosted.org

63 participants
84 discussions

What is the best way to check that host has joined domain from host itself?
by d.iskandarov＠gmail.com 04 Dec '18

04 Dec '18

Hello, I'm interested if there is good way to check that host has joined IPA domain and is in good state, i.e. at least users are fetched from DC. Real story: I'm registering my nodes with configuration management system (puppet). Host is auto-registering with IPA domain. But also before node is registered with domain I'm creating localhost users. When I change anything in "users declaration manifest" which triggers host update and calling usermod, deploy is failing with such error: > Execution of '/usr/sbin/usermod -p !! john' returned 6: usermod: user 'john' does not exist in /etc/passwd Because obviously during that second run host has already joined domain and system gets user info from LDAP and not /etc/passwd. I'm creating "flag" file /root/.ipa-registered which prevents further ipa-client installation and registration steps. Obviously ipa-client install quite a few packages on the OS which I can check for existence and skip run as well. I'm interested if there is more programmatic way to test that node is functional in domain, maybe some ipa related tool exists on host which i can execute and get status. Which will allow me to judge if I should touch users on localhost. Thanks in advance Denis

2 1

pki-tomcatd not starting / wrong internal password
by Christopher Young 03 Dec '18

03 Dec '18

So, I did alot of reading after noticing that one of my IPA servers was not starting correctly. I was working from the guide here: https://floblanc.wordpress.com/2017/09/11/troubleshooting-freeipa-pki-tomca… (Honestly, THANK YOU to the people contributing to that guide because it really has been helpful) I didn't get very far down the guide before testing my NSSDB password and noticing that it does NOT appear to work. I have no idea how that may have happened or when but this obviously puts me in a weird spot with this particular server. [root@XXXX-prod-ipaXX ca]# cat /var/lib/pki/pki-tomcat/conf/password.conf | grep internal internal=<numericstuffs> I tried using the password there to open the /etc/pki/pki-tomcat/alias NSS DB with no success. Though, I think my problem is something else. I get the following error: ---- [root@XXXXX-prod-ipaXX alias]# certutil -K -d /etc/pki/pki-tomcat/alias -n -r /tmp/pwdfile.txt certutil: Checking token "NSS Certificate DB" in slot "NSS User Private Key and Certificate Services" Enter Password or Pin for "NSS Certificate DB": certutil: problem listing keys: SEC_ERROR_UNRECOGNIZED_OID: Unrecognized Object Identifier. ---- I'm just getting into this, but I feel like MAYBE this is part of my problem. If anyone has any ideas here, I'd be grateful for the help! ADDED NOTE: I actually notice that I have this same issue on BOTH IPA servers which makes me ever more nervous about the situation. ---- [root@XXXXX-prod-ipaXx ~]# sudo certutil -K -d /etc/pki/pki-tomcat/alias -f /tmp/pwdfile.txt -n 'subsystemCert cert-pki-ca' certutil: Checking token "NSS Certificate DB" in slot "NSS User Private Key and Certificate Services" certutil: problem listing keys: SEC_ERROR_UNRECOGNIZED_OID: Unrecognized Object Identifier. ---- Any thoughts? Many thanks in advance! -- Chris

1 1

Help me set up FreeIPA in an internal network that will eventually be moved to the outside world
by Ramesh Balaji 02 Dec '18

02 Dec '18

I have a domain already. I just want to test it inside my internal network, and I do not have virtual machines or CentOS servers at my disposal. I have tried to get the server to resolve either ipa.example.com or ipa.mydomain.com . First, my Ubuntu server is having issues installing freeipa-server because the package's postinstall script returns an error status (1 to be precise). If I try to set up freeipa after that package install fails with ipa-server-install --allow-zone-mismatch. It works until the 24th step of the 28th step (don't have the full logs; the first step of this part is something to do with CA certificates) at which point it says ipapython.admintool: ERROR cannot connect to 'https://ipa.mydomain.com:8443/ca/rest/account/login': [Errno 111] Connection refused. I can actually wget this URL from the same server once the installer quits, I just get a 401 error (which is probably due to a lack of credentials that FreeIPA would provide when it requests this). I cannot and will not be opening this server to the outside world when I first configure it for security reasons. How can I first set up this server on my LAN, and actually figure out how to use FreeIPA before I open it up to the world? Did I write this in the wrong place? Let me know and I will move it. Thanks in advance.

1 0

Re: Jenkins integration?
by Peter Oliver 01 Dec '18

01 Dec '18

On Sat, 11 Feb 2017, Alexander Bokovoy wrote: > On la, 11 helmi 2017, Michael Ströder wrote: > > > Jenkins' LDAP integration is pretty good and flexible. I made it work with various LDAP > > servers in customer projects. I did not have do that with FreeIPA yet but I'd be very > > surprised if it doesn't work. > > > > (Personally I'd avoid going through PAM.) > > Any specific reason for not using pam_sss? Remember, with SSSD involved > you get also authentication for trusted users from Active Directory > realms. You don't get that with generic LDAP way. Also, you'd be more > efficient in terms of utilising LDAP connections. Having come across this old thread whilst setting this up myself, it turns out that one possible reason would be that Jenkins’ LDAP plugin provides the user’s display name and email address to Jenkins, whereas its PAM plugin does not. I’m sure that the PAM plugin could be improved to provide the display name straightforwardly enough, but providing the email address would presumably require a new plugin that fetched the additional details over D-Bus. -- Peter Oliver

1 0

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users December 2018