May 2018 - FreeIPA-users - Fedora mailing-lists

Can't install CA from replica file - Failed to import EncryptedPrivateKeyInfo to token
by H. Frenzel 01 Oct '18

01 Oct '18

Hi, I tried to install a CA to the 2nd master a replicafile which was created on the 1st master (with self-signed CA), with fails with: ipa : DEBUG stderr=TokenException: Failed to import EncryptedPrivateKeyInfo to token: (-8152) The key does not support the requested operation. What could be wrong here? - Please find the detailed debug log of ipa-ca-install as attachment. Thx & b/r H.

3 3

How to replace a failed CA?
by Bret Wortman 26 Sep '18

26 Sep '18

I may be going about this in the hardest way possible, so let me stop and roll everything back to my root need: I have two IPA servers which manage our infrastructure. We used to have three, but a catastrophic failure on one led to its total loss. And it was our CA. So now we have no CA -- is there a way to promote an existing system to take over? I realize it may well mean distributing a new root CA cert to everyone, but that seems less painful now than trying to set up a brand new cluster of servers and try to port our data over to them... -- photo *Bret Wortman* President, Damascus Products LLC 855-644-2783 <tel:855-644-2783> | 303-523-8037 <tel:303-523-8037> | bret(a)damascusproducts.com <mailto:bret@damascusproducts.com> | http://damascusproducts.com/ | 10332 Main St Suite 319 Fairfax, VA 22030 <http://facebook.com/wrapbuddiesco> <http://twitter.com/wrapbuddiesco> <http://instagram.com/wrapbuddies> <https://facebook.com/wrapbuddiesco><https://instagram.com/wrapbuddies>

5 9

Certificates renewing with the wrong Subject
by Roderick Johnstone 21 Aug '18

21 Aug '18

Hi Our freeipa certificates need to be renewed due to passing their expiry dates. While some certificates have renewed ok, the ipaCert and auditSigningCert are renewing but the new certificates have the wrong Subject. Environment is: serverA (CRL, first, master) RHEL 7.3, ipa 4.4 serverB (replica) RHEL 7.3, ipa 4.4 serverC (replica) RHEL 7.4, ipa 4.5 Once there are renewed certificates with the wrong Subject present, there are various problems with renewing the remaining certificates, which I think might be related to the bad Subject: 1) When just ipaCert has the wrong subject no further renewals happen 2) When auditSigningCert has the wrong subject the ipa pki-tomcatd service will not start and no further renewals happen. I've been round the following loop many times on ServerA, our first master: 1) Restore good certificates from backup 2) Put the clock back to a time when certificates are all valid 3) Resubmit certificates for renewal Each time the ipaCert renews it has the same wrong Subject. The wrong Subject includes the host name of one of our ipa client systems. Each time the auditSigningCert renews it has the same wrong Subject but a different subject to the ipaCert. The wrong Subject in this case includes the host name of a system which has never been an ipa client, but might have been added and removed with ipa host-add and ipa host-del for testing something, a while ago. As far as I can see, the "cert_subject" is set correctly in the file /var/lib/certmonger/<request id> until the point at which the certificate is actually renewed. I'd be very grateful for some pointers as to which configuration options and logs to check through to resolve this problem on our production system. If its of any relevance we did change which server is the first master some time ago. Thanks Roderick Johnstone

3 21

Documented monitoring best practices
by Alex Corcoles 13 Aug '18

13 Aug '18

Hi all, Is there any official literature about how to monitor FreeIPA? The upstream guide mentions: 1) Testing clients using id https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/ht… 2) Adding a user on a replica and verifying it appears on another server https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/ht… There's also some troubleshooting appendices which look interesting. I see also ipactl, "ipa ping", there seems to be: https://www.freeipa.org/page/V4/Tool_to_Check_Status_of_All_Replicas (but it seems dead) https://www.freeipa.org/page/V4/Monitor_Replication_Topology , and also some indepedent initiatives all over the web. Is there any plan to provide an official way to monitor FreeIPA? My foremost concern would be to ensure that all clients are correctly enrolled and sudo/ssh work, so I am not locked out of my systems. Ensuring that replication works seems good and popular. Of course I can check that all services are running and ports respond. What are the most common ways for FreeIPA to break? Thoughts? Álex -- ___ {~._.~} ( Y ) ()~*~() mail: alex at corcoles dot net (_)-(_) http://alex.corcoles.net/

5 5

Getting Synology NAS to play nice with FreeIPA
by Kristian Petersen 20 Jul '18

20 Jul '18

I have a synology NAS which hosts some SMB shares on my network. I would like to be able to use FreeIPA as the LDAP provider it checks against for authenticating these shares. I have a system user that I created in FreeIPA for this purpose. I configured the NAS to connect to my FreeIPA server for LDAP, but I get a message about a failure to access some users NT passwords and how the Samba service may not work for these users. It also says it could be either a lack of NT passwords for the users or insufficient privileges to access them. After chatting with Synology support they wanted me to enable CIFS plaintext password authentication. However, if I select that option it given me a warning about the share not being able to be the remote mount target of CIFS anymore due to SMB being set to v1 only and disabling the SMB related Bonjour service. If the system user doesn't have the needed privileges, how can I fix that since I can't enroll the NAS? -- Kristian Petersen System Administrator BYU Dept. of Chemistry and Biochemistry

2 1

Server install fails on Ubuntu due to missing crypto.fips_enabled
by Kees Bakker 27 Jun '18

27 Jun '18

Hey, Trying to do a test installation of a FreeIPA server on Ubuntu 18.04. It fails setting up the certificate server (pki-tomcatd). Configuring certificate server (pki-tomcatd). Estimated time: 3 minutes [1/28]: configuring certificate server instance ipaserver.install.dogtaginstance: CRITICAL Failed to configure CA instance: CalledProcessError(Command ['/usr/sbin/pkispawn', '-s', 'CA', '-f', '/tmp/tmp5ejwx5'] returned non-zero exit status 1: u"pkispawn : ERROR ....... subprocess.CalledProcessError: Command '['sysctl', 'crypto.fips_enabled', '-bn']' returned non-zero exit status 255!\npkispawn : ERROR ........... server did not start after 60s\npkispawn : ERROR ....... server failed to restart\n") ipaserver.install.dogtaginstance: CRITICAL See the installation logs and the following files/directories for more information: ipaserver.install.dogtaginstance: CRITICAL /var/log/pki/pki-tomcat [error] RuntimeError: CA configuration failed. ipapython.admintool: ERROR CA configuration failed. ipapython.admintool: ERROR The ipa-server-install command failed. See /var/log/ipaserver-install.log for more information The failing command is: sysctl crypto.fips_enabled -bn On my system there is no /proc/sys/crypto. BTW. I'm installing in a LXC container, the host is Ubuntu 16.04. That should not matter, because none of my Ubuntu systems (16.04 and 18.04) have /proc/sys/crypto. The problem seems to be in pki/server/deployment/pkihelper.py When the sysctl commands fails due to a missing /proc/sys/crypto/fips_enabled or even /proc/sys/crypto it raises an exception. Notice that there is a ipaplatform with is_fips_enabled. Shouldn't that be used in pkihelper.py ? -- Kees

5 9

Promoting CA replica to master
by Carlos Fernández Manteiga 26 Jun '18

26 Jun '18

Hi, We've created a new replica from our FreeIPA infrastructure, with CA capabilities. Now we want it to be the CA renewal master, as it's written here: https://www.freeipa.org/page/Howto/Promote_CA_to_Renewal_and_CRL_Master However, the first step, knowing which is the present master, is blocking us. ldapsearch does not return the info we need: ldapsearch -D 'cn=Directory Manager' -W -b 'cn=masters,cn=ipa,cn=etc,dc=bitban,dc=int' '(ipaConfigString=caRenewalMaster)' dn Enter LDAP Password: # extended LDIF # # LDAPv3 # base <cn=masters,cn=ipa,cn=etc,dc=bitban,dc=int> with scope subtree # filter: (ipaConfigString=caRenewalMaster) # requesting: dn # # search result search: 2 result: 0 Success # numResponses: 1 Neither one of the servers have "ca.crl.MasterCRL.enableCRLUpdates=true" on /etc/pki/pki-tomcat/ca/CS.cfg Is there any more updated doc about this? All FreeIPA servers are: CentOS Linux release 7.5.1804 (Core) VERSION: 4.5.4, API_VERSION: 2.228 Thank you

2 6

rotate host keytabs
by Natxo Asenjo 22 Jun '18

22 Jun '18

hi, does anybody rotate host keytabs? Is it worth it security-wise? Reading on how AD computer objects reset their password every 30 days ( https://blogs.technet.microsoft.com/askds/2009/02/15/machine-account-passwo…) got me thinking about the host keytabs ... Any ideas about this? -- Groeten, natxo

3 4

auth to pther providers still using freeipa
by Andrew Meyer 22 Jun '18

22 Jun '18

My company is wanting to use FreeIPA for everything. However we also utilize other external services that have their own auth system but can support oauth, or gsuite/facebook etc etc. Is this possible w/ FreeIPA? Also,Searching through google I found this - Ipsilon. Would you recommend I use that? | | | Ipsilon By Ipsilon Project Ipsilon identity provider project homepage | | | Thank you!

2 1

Two way trust setup issue
by Merritt, Todd R - (tmerritt) 15 Jun '18

15 Jun '18

Hi, I'm trying to establish a two way trust with an AD domain and seem to be running into some issues. I am able to establish a one way trust following the guide at https://www.freeipa.org/page/Active_Directory_trust_setup without any issues. When I destroy that trust and try to establish a new one with two-way specified to the same AD domain it throws what I believe to be a misleading error message and the trust is not established. [root(a)IPA.DOMAIN /]# ipa trust-add --type=ad AD_DOMAIN --admin AD_ADMIN_USER --password --two-way=true Active Directory domain administrator's password: ipa: ERROR: AD DC was unable to reach any IPA domain controller. Most likely it is a DNS or firewall issue I've checked that both the AD DC and the free IPA hosts can resolve the service entries and verified that there are no firewall blocks in place between these two hosts. I believe the issue is an LDAP permission issue of some sort based on the following log snippet [29/May/2018:16:59:07 +0000] conn=1227 op=25 ADD dn="krbPrincipalName=krbtgt/AD_DOMAIN(a)IPA.DOMAIN,cn=AD_DOMAIN,cn=ad,cn=trusts,dc=arizona,dc=cui" [29/May/2018:16:59:07 +0000] conn=1227 op=25 RESULT err=0 tag=105 nentries=0 etime=0 csn=5b0d876e000c00040000 [29/May/2018:16:59:07 +0000] conn=1227 op=26 EXT oid="2.16.840.1.113730.3.8.10.1" name="Keytab Retrieval Extended Operation" [29/May/2018:16:59:07 +0000] conn=1227 op=26 RESULT err=0 tag=120 nentries=0 etime=0 [29/May/2018:16:59:07 +0000] conn=1227 op=27 SRCH base="cn=ad,cn=trusts,dc=IPA,dc=DOMAIN" scope=2 filter="(&(objectClass=ipaNTTrustedDomain)(|(ipaNTFlatName=AD_DOMAIN)(ipaNTTrustPartner=AD_DOMAIN)(cn=AD_DOMAIN)))" attrs=ALL [29/May/2018:16:59:07 +0000] conn=1227 op=27 RESULT err=0 tag=101 nentries=1 etime=0 [29/May/2018:16:59:07 +0000] conn=1227 op=28 SRCH base="cn=ad,cn=trusts,dc=IPA,dc=DOMAIN" scope=2 filter="(&(objectClass=ipaNTTrustedDomain)(ipaNTTrustedDomainSID=S-1-5-21-3264147221-199175665-3033697611))" attrs=ALL [29/May/2018:16:59:07 +0000] conn=1227 op=28 RESULT err=0 tag=101 nentries=1 etime=0 [29/May/2018:16:59:07 +0000] conn=1227 op=29 SRCH base="cn=ad,cn=trusts,dc=IPA,dc=DOMAIN" scope=2 filter="(&(objectClass=ipaNTTrustedDomain)(|(ipaNTFlatName=AD_DOMAIN)(ipaNTTrustPartner=AD_DOMAIN)(cn=AD_DOMAIN)))" attrs=ALL [29/May/2018:16:59:07 +0000] conn=1227 op=29 RESULT err=0 tag=101 nentries=1 etime=0 [29/May/2018:16:59:07 +0000] conn=1227 op=30 MOD dn="cn=AD_DOMAIN,cn=ad,cn=trusts,dc=IPA,dc=DOMAIN" [29/May/2018:16:59:07 +0000] conn=1227 op=30 RESULT err=50 tag=103 nentries=0 etime=0 csn=5b0d876e000f00040000 [29/May/2018:16:59:07 +0000] conn=1227 op=31 SRCH base="cn=ad,cn=trusts,dc=IPA,dc=DOMAIN" scope=2 filter="(&(objectClass=ipaNTTrustedDomain)(ipaNTTrustedDomainSID=S-1-5-21-3264147221-199175665-3033697611))" attrs=ALL [29/May/2018:16:59:07 +0000] conn=1227 op=31 RESULT err=0 tag=101 nentries=1 etime=0 [29/May/2018:16:59:07 +0000] conn=1227 op=32 SRCH base="cn=ad,cn=trusts,dc=IPA,dc=DOMAIN" scope=2 filter="(&(objectClass=ipaNTTrustedDomain)(ipaNTTrustedDomainSID=S-1-5-21-3264147221-199175665-3033697611))" attrs=ALL [29/May/2018:16:59:07 +0000] conn=1227 op=32 RESULT err=0 tag=101 nentries=1 etime=0 [29/May/2018:16:59:07 +0000] conn=1227 op=33 SRCH base="cn=ad,cn=trusts,dc=IPA,dc=DOMAIN" scope=2 filter="(&(objectClass=ipaNTTrustedDomain)(|(ipaNTFlatName=AD_DOMAIN)(ipaNTTrustPartner=AD_DOMAIN)(cn=AD_DOMAIN)))" attrs=ALL [29/May/2018:16:59:07 +0000] conn=1227 op=33 RESULT err=0 tag=101 nentries=1 etime=0 [29/May/2018:16:59:07 +0000] conn=1227 op=34 MOD dn="cn=AD_DOMAIN,cn=ad,cn=trusts,dc=IPA,dc=DOMAIN" [29/May/2018:16:59:07 +0000] conn=1227 op=34 RESULT err=50 tag=103 nentries=0 etime=0 csn=5b0d876e001000040000 I have run kinit prior to issuing the trust-add in both the two-way and one-way setup commands. Any thoughts where I should go from here? Thanks, Todd

2 8

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users May 2018