October 2019 - FreeIPA-users - Fedora mailing-lists

ansbile-freeipa client install
by Andrew Meyer 23 Oct '19

23 Oct '19

Hello I have setup ansible to use install freeipa client on my CentOS 7/8 machines. I am able to get the packages installed however when it goes through the configuration I am getting the following: TASK [ipaclient : Install - Ensure that IPA client packages are installed] ****************************************************************************************************************************************************************** ok: [10.150.10.15] TASK [ipaclient : Install - Set ipaclient_servers] ****************************************************************************************************************************************************************************************** skipping: [10.150.10.15] TASK [ipaclient : Install - Set ipaclient_servers from cluster inventory] ******************************************************************************************************************************************************************* skipping: [10.150.10.15] TASK [ipaclient : Install - Check that either principal or keytab is set] ******************************************************************************************************************************************************************* skipping: [10.150.10.15] TASK [ipaclient : Install - Set default principal if no keytab is given] ******************************************************************************************************************************************************************** ok: [10.150.10.15] TASK [ipaclient : Install - IPA client test] ************************************************************************************************************************************************************************************************ ok: [10.150.10.15] TASK [ipaclient : Install - Cleanup leftover ccache] **************************************************************************************************************************************************************************************** ok: [10.150.10.15] TASK [ipaclient : Install - Configure NTP] ************************************************************************************************************************************************************************************************** changed: [10.150.10.15] TASK [ipaclient : Install - Disable One-Time Password for on_master] ************************************************************************************************************************************************************************ skipping: [10.150.10.15] TASK [ipaclient : Install - Test if IPA client has working krb5.keytab] ********************************************************************************************************************************************************************* ok: [10.150.10.15] TASK [ipaclient : Install - Disable One-Time Password for client with working krb5.keytab] ************************************************************************************************************************************************** skipping: [10.150.10.15] TASK [ipaclient : Install - Keytab or password is required for otp] ************************************************************************************************************************************************************************* skipping: [10.150.10.15] TASK [ipaclient : Install - Get One-Time Password for client enrollment] ******************************************************************************************************************************************************************** skipping: [10.150.10.15] TASK [ipaclient : Install - Report error for OTP generation] ******************************************************************************************************************************************************************************** skipping: [10.150.10.15] TASK [ipaclient : Install - Store the previously obtained OTP] ****************************************************************************************************************************************************************************** skipping: [10.150.10.15] TASK [ipaclient : Install - Check if principal and keytab are set] ************************************************************************************************************************************************************************** skipping: [10.150.10.15] TASK [ipaclient : Install - Check if one of password or keytabs are set] ******************************************************************************************************************************************************************** fatal: [10.150.10.15]: FAILED! => {"changed": false, "msg": "At least one of password or keytabs must be specified"} TASK [ipaclient : Install - Restore original admin password if overwritten by OTP] ********************************************************************************************************************************************************** skipping: [10.150.10.15] TASK [ipaclient : Cleanup leftover ccache] ************************************************************************************************************************************************************************************************** ok: [10.150.10.15] PLAY RECAP ********************************************************************************************************************************************************************************************************************************** 10.150.10.15 : ok=10 changed=1 unreachable=0 failed=1 skipped=11 rescued=0 ignored=0 I am not sure that I am using the correct variables in ansible-vault for the keytabs: ipaadmin_password1: password1234 ipadm_password1: password1234 ipaserver_realm1: TEST.EXAMPLE ipaserver_domain1: test.example ipaclient_principal1: admin ipaclient_password1: password1234 Should the variable be 'ipaadmin_principal1:' ? Also should this be the password? And I want to skip installing the ntp client would this be the correct way to do it? ansible-playbook --ask-vault-pass --extra-vars 'ansible/passwd.yml' ansible-freeipa/playbooks/install-client.yml --limit=10.150.10.15 --user=user123 -e "ipaclient_no_ntp=no"

1 0

using SPAKE
by Charles Hedrick 23 Oct '19

23 Oct '19

I’d like to avoid having to use a second cache to armor 2FA requests. My impression was that SPAKE was supposed to fix this. I just installed a new kdc (replica of an old one) in Centos 8. It understands SPAKE, offering it as preauthebtication for normal users. But a user with 2FA is not offered SPAKE preach. I still have to use FAST. Have I misunderstood, or is extra configuration needed?

2 4

is it possible to enable constrained delegation for only some users?
by Charles Hedrick 23 Oct '19

23 Oct '19

We have kerberos everywhere, and use it for access to NFS home directories. So what do we do about cron jobs? We have a solution, but it involves custom code that impersonates the KDC. I’d like to do someone more standard. Constained delegation seems like a possibility. But I’d need to be able to say “allow cron to get credentials for NFS for a specific group of users.” Since all of our systems run cron, I don’t want to allow any system to be able to get an NFS credential for any user. That would let root on any system see anyone’s files. So the user has to authorize it. Presumably if the user runs his own desktop, he’s willing to allow it to get credentials for himself. But I wouldn’t trust his machine to be able to get mine. The constrained delegation mechanism seems to handle this, except that I don’t see a way to constrain it to specific users. Am I missing something?

4 17

Retrieve private key from CA chain
by Sam Klein 22 Oct '19

22 Oct '19

Using certutil, I'm able to extract my localhost CA using this command. certutils -L -d dbm:/etc/ipa/nssdb -a -n 'Local IPA host' However, I need a signing key to create a private key. Is there a method to extract a private key that signed my localhost CA from the endpoint, or does this key exist on my server? Thank you.

2 3

Re: ns-slapd hangs several times a day
by Jared Ledvina 21 Oct '19

21 Oct '19

//Keeping the freeipa-users list included Hi Sylvain, Ah shucks. For the debug info packages, you might be able to leverage the packages available on https://dl.fedoraproject.org/pub/epel/ but, someone else on this list might know more. The only other idea that comes to mind is what was discussed on https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost… Specifically, in your 'cn=config' see if nsslapd-enable-nunc-stans is set to on, if it is, try using the ldapmodify in the above comment to disable it. For context, that defaults to off as a result of https://bugzilla.redhat.com/show_bug.cgi?id=1614501 Hope this helps, Jared On Mon, Oct 21, 2019, at 5:31 AM, Sylvain Coutant wrote: > Jared, > > Thanks for your message. To be honest, I would have expected this to be a network issue at first. All the symptoms are there. But tcpdump tells me that things are ok ... > > For the debuginfo, I already had a look but was unable to find the right packages: > > yum search --enablerepo=epel-debuginfo 389-ds > Loaded plugins: fastestmirror > Loading mirror speeds from cached hostfile > * base: centos.mirrors.proxad.net > * epel: mirrors.coreix.net > * epel-debuginfo: mirrors.coreix.net > * extras: centos.mirrors.proxad.net > * updates: centos.mirrors.proxad.net > ==================================================================================================================================================================================================================================== N/S matched: 389-ds ===================================================================================================================================================================================================================================== > 389-dsgw-debuginfo.x86_64 : Debug information for package 389-dsgw > 389-ds.noarch : 389 Directory, Administration, and Console Suite > 389-ds-base.x86_64 : 389 Directory Server (base) > 389-ds-base-devel.x86_64 : Development libraries for 389 Directory Server > 389-ds-base-libs.x86_64 : Core libraries for 389 Directory Server > 389-ds-base-snmp.x86_64 : SNMP Agent for 389 Directory Server > 389-ds-console.noarch : 389 Directory Server Management Console > 389-ds-console-doc.noarch : Web docs for 389 Directory Server Management Console > 389-dsgw.x86_64 : 389 Directory Server Gateway (dsgw) > > There's no 389-ds-base-debuginfo available. I'm probably missing something ... > > Like always, the cluster hanged during the nightly backup. The node running the backup was dead. After restarting it, I tried to disable retroCL triming as per https://bugzilla.redhat.com/show_bug.cgi?id=1751295, but still had a hang during resync. I enabled a few more logs in ds, but at first it doesn't look much helpful right now except that it stops logging anything (including housekeeping stuff) when stale. > > > /Sylvain. > > > > > Le lun. 21 oct. 2019 à 06:00, Jared Ledvina <jared(a)techsmix.net> a écrit : >> __ >> Hi Sylvain, >> >> I believe we had a similar issue in our configuration. I can dig in more tomorrow but, we had deadlocks with the retroCL plugin. >> >> If you follow the steps outlined on this page, https://directory.fedoraproject.org/docs/389ds/FAQ/faq.html#debug_hangs to get a stack trace, I can try to see if you're hitting the same thing. >> >> See https://bugzilla.redhat.com/show_bug.cgi?id=1751295 for some more details on the issue. >> >> Hope that helps, >> Jared >> >> On Sun, Oct 20, 2019, at 3:55 PM, Sylvain Coutant via FreeIPA-users wrote: >>> Hello gurus, >>> >>> We are running a 3 nodes FreeIPA cluster for some time without major trouble. One server may stale from time to time, without real trouble to restart it. >>> >>> A few days ago, we had to migrate the VMs between two clouds (disk image copied from one to the other). They have been renumbered from old to new IPv4 address space. Not that easy, but we finally got it done with all DNS entries in sync. Yet, since the migration, ns-slapd process hangs randomly way more often than before (went from once every few months to several times a day) and is especially hard to restart on any node. >>> >>> While starting up, the netstat output is like: >>> >>> Active Internet connections (w/o servers) >>> Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name >>> tcp6 184527 0 10.217.151.3:389 10.217.151.2:52314 ESTABLISHED 29948/ns-slapd >>> >>> Netstat and tcpdump show it processes very slowly the recvq (sometimes like 79 bytes per 1-2 seconds). At some point it just stops processing it and hangs (only kill -9 works to take it down). When stale, strace shows the process loops only on : >>> >>> getpeername(8, 0x7ffe62c49fd0, 0x7ffe62c49f94) = -1 ENOTCONN (Transport endpoint is not connected) >>> poll([{fd=50, events=POLLIN}, {fd=7, events=POLLIN}, {fd=8, events=POLLIN}, {fd=9, events=POLLIN}, {fd=117, events=POLLIN}, {fd=116, events=POLLIN}, {fd=115, events=POLLIN}, {fd=114, events=POLLIN}, {fd=89, events=POLLIN}, {fd=85, events=POLLIN}, {fd=83, events=POLLIN}, {fd=82, events=POLLIN}, {fd=81, events=POLLIN}, {fd=80, events=POLLIN}, {fd=79, events=POLLIN}, {fd=78, events=POLLIN}, {fd=77, events=POLLIN}, {fd=76, events=POLLIN}, {fd=67, events=POLLIN}, {fd=72, events=POLLIN}, {fd=69, events=POLLIN}, {fd=64, events=POLLIN}, {fd=66, events=POLLIN}], 23, 250) = 0 (Timeout) >>> >>> If it can go through startup replication, one of the server will hang a little bit later, freezing the whole cluster. Forcing us to restart the faulty node to unlock things. >>> >>> When stale, the dirsrv access log only contains entries like: >>> [20/Oct/2019:17:52:46.950029525 +0100] conn=86 fd=131 slot=131 connection from 10.217.151.4 to 10.217.151.4 >>> [20/Oct/2019:17:52:51.280412883 +0100] conn=87 fd=132 slot=132 SSL connection from 10.217.151.10 to 10.217.151.4 >>> [20/Oct/2019:17:52:54.956204031 +0100] conn=88 fd=133 slot=133 connection from 10.217.151.4 to 10.217.151.4 >>> [20/Oct/2019:17:53:04.966542441 +0100] conn=89 fd=134 slot=134 connection from 10.217.151.2 to 10.217.151.4 >>> [20/Oct/2019:17:53:22.659053020 +0100] conn=90 fd=135 slot=135 SSL connection from 10.217.151.10 to 10.217.151.4 >>> [20/Oct/2019:17:53:51.006707605 +0100] conn=91 fd=136 slot=136 connection from 10.217.151.4 to 10.217.151.4 >>> [20/Oct/2019:17:53:54.514162543 +0100] conn=92 fd=137 slot=137 SSL connection from 10.217.151.10 to 10.217.151.4 >>> [20/Oct/2019:17:53:59.011602776 +0100] conn=93 fd=138 slot=138 connection from 10.217.151.3 to 10.217.151.4 >>> [20/Oct/2019:17:54:09.019296900 +0100] conn=94 fd=139 slot=139 connection from 10.217.151.4 to 10.217.151.4 >>> >>> And netstat lists 10s of accepted network connections that are stale like : >>> tcp6 286 0 10.217.151.4:389 10.217.151.10:32512 ESTABLISHED 29948/ns-slapd >>> >>> >>> The underlying network seams clean and uses jumbo frames. tcpdump and ping show 0 packet loss and no retransmit. Being afraid it could be a jumbo frame issue, mtu was even forced down to 1500. Without success. >>> >>> Entropy seems fine as well : >>> # cat /proc/sys/kernel/random/entropy_avail >>> 3138 >>> >>> Running version on all servers: >>> ipa-client-4.6.5-11.el7.centos.x86_64 >>> ipa-client-common-4.6.5-11.el7.centos.noarch >>> ipa-common-4.6.5-11.el7.centos.noarch >>> ipa-server-4.6.5-11.el7.centos.x86_64 >>> ipa-server-common-4.6.5-11.el7.centos.noarch >>> ipa-server-dns-4.6.5-11.el7.centos.noarch >>> >>> >>> I'd happily listen to any hint regarding this critical problem. >>> >>> /Sylvain. >>> _______________________________________________ >>> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org >>> To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org >>> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ >>> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines >>> List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost… >>> >>

1 0

SSH Hostbased Authentication with FreeIPA
by Vinícius Ferrão 21 Oct '19

21 Oct '19

Hello, I’m trying to implement SSH Hostbased Authentication between IPA joined machines but I’m with difficulties regarding: * The /etc/ssh/ssh_known_hosts file. In a FreeIPA environment the known_hosts are stored on IPA, and I’m aware of the ProxyCommand /usr/bin/sss_ssh_knownhostsproxy; but how can I create this file with the entries from FreeIPA? * Another issue is with the /etc/ssh/shosts.equiv file. It supports plain hostnames or netgroups, which is a NIS thing. FreeIPA offers any netgroups compatibility? I’m expecting to put something like: @nodes on this file to keep it simple. Any changes on IPA hosts would be reflected automatically. Thanks, PS: Further documentation about SSH Hostbased Authentication: https://en.wikibooks.org/wiki/OpenSSH/Cookbook/Host-based_Authentication

3 11

Re: Ipa user can't login via ssh
by Rob Crittenden 21 Oct '19

21 Oct '19

Elhamsadat Azarian wrote: > Hi Rob > Thank you for helping > I disabled default HBAC rule and add a new rule that user "elham" could > login and ssh on hosts "ipa-client and ipa-server" > Now it can ssh to ipa-server but still it had problem with ipa-client. > So rules couldnt solve my problem. I don't know what to tell you without more details. rob > > On Tue, 15 Oct 2019, 16:44 Rob Crittenden, <rcritten(a)redhat.com > <mailto:rcritten@redhat.com>> wrote: > > Please keep freeipa-users in the responses. > > Elhamsadat Azarian wrote: > > Hi Rob > > I did it and i got this answer: > > > > Access granted : false > > > > What can i do now? > > IPA ships with a default HBAC rule, allow_all, which allows all users to > authenticate on all hosts. I can only assume you've deleted or disabled > that, and that's fine. > > But if you do then you need to create the set of rules to grant access > to hosts for the appropriate users. > > To provide specific assistance you'd need to share a bit of internal > details, current HBAC rules, etc. It is understandable if you can't > do that. > > But basically you need to evaluate your HBAC rules to find out why this > user can't log into hosts. The user may be missing from a group, for > example. > > rob > > > > On Mon, 14 Oct 2019, 18:07 Rob Crittenden, <rcritten(a)redhat.com > <mailto:rcritten@redhat.com> > > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com>>> wrote: > > > > Elhamsadat Azarian wrote: > > > I tryed to add HBAC rules to my user but it said : some > operation > > > failed. Users cannot be added when user category = all > > > > Adding list back. > > > > Try something like: > > > > ipa hbactest --user elham --service ssh --host <your host> > > > > There is an equivalent way to do it in the UI. > > > > rob > > > > > > > > On Wed, 9 Oct 2019, 17:19 Rob Crittenden, > <rcritten(a)redhat.com <mailto:rcritten@redhat.com> > > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com>> > > > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com> > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com>>>> wrote: > > > > > > Kevin Vasko via FreeIPA-users wrote: > > > > Have you made sure your “elham” user has the correct > permissions > > > to access the machines? Take a look in the UI at the > > > groups/permissions that user elham has. Take a look at > your HBAC > > > rules as well. That would be my first recommendation to > check > > if it > > > was me. > > > > > > Right, and the troubleshooting page suggests that (and > > increasing debug > > > logging). > > > > > > Please provide the output of the things you have already > > looked at. > > > > > > rob > > > > > > > > > > > -Kevin > > > > > > > >> On Oct 9, 2019, at 7:23 AM, Elhamsadat Azarian via > > FreeIPA-users > > > <freeipa-users(a)lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org> > > <mailto:freeipa-users@lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org>> > > > <mailto:freeipa-users@lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org> > > <mailto:freeipa-users@lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org>>>> wrote: > > > >> > > > >> ### Request for enhancement > > > >> as a Linux admin i want to login into my ipa client > with a user > > > that is defined in ipa-server UI. > > > >> > > > >> ### Issue > > > >> I installed Ipa-server and an Ipa-client on CentOS7.6 > > > >> I defined Internal DNS on ipa-server and i defined A > and PTR > > > records for client on ipa-server. > > > >> now i can see my client in ipa-UI and i defined a > user with > > name > > > "elham" and i expect that it can login into ipa-client. > > > >> when i login with root in ipa-client and i do sudo > elham, it > > > works and kinit elham works too but > > > >> when i do ssh into ipa-client with this user, it show > > "Access denied" > > > >> i have errors with this context: > > > >> pam_reply : authentication failure to the client > > > >> pam_sss: authentication falure > > > >> > > > >> im tired of this issue. please help me if you know the > > solution. > > > >> > > > >> #### Steps to Reproduce > > > >> 1. define new user "elham" in ipa UI > > > >> 2. SSH to ipa-client with elham > > > >> 3. access denied > > > >> > > > >> #### Actual behavior > > > >> (what happens) > > > >> > > > >> #### Expected behavior > > > >> login into ipa-client successfully > > > >> > > > >> #### Version/Release/Distribution > > > >> ipa-server 4.6.5-11.el7 > > > >> ipa-client 4.6.4-10.el7.centos.3 > > > >> Log files and config files are added below: > > > >> > > > >> > > > >> > > > >> krb5.conf > > > >> ------------ > > > >> #File modified by ipa-client-install > > > >> > > > >> includedir /etc/krb5.conf.d/ > > > >> includedir /var/lib/sss/pubconf/krb5.include.d/ > > > >> > > > >> > > > >> [logging] > > > >> default = FILE:/var/log/krb5libs.log > > > >> kdc = FILE:/var/log/krb5kdc.log > > > >> admin_server = FILE:/var/log/kadmind.log > > > >> [libdefaults] > > > >> default_realm = LSHS.DC > > > >> dns_lookup_realm = false > > > >> dns_lookup_kdc = false > > > >> rdns = false > > > >> ticket_lifetime = 24h > > > >> forwardable = yes > > > >> allow_weak_crypto = true > > > >> default_ccache_name = KEYRING:persistent:%{uid} > > > >> > > > >> [realms] > > > >> LSHS.DC = { > > > >> kdc = ipa-irvlt01.example.dc:88 > > > >> admin_server = ipa-irvlt01.example.dc:749 > > > >> default_domain = example.dc > > > >> } > > > >> [domain_realm] > > > >> .example.com <http://example.com> > <http://example.com> <http://example.com> = > > LSHS.DC > > > >> example.com <http://example.com> <http://example.com> > <http://example.com> = LSHS.DC > > > >> ############################################ > > > >> > > > >> > > > >> sssd.conf > > > >> ------------- > > > >> [domain/example.dc] > > > >> > > > >> cache_credentials = True > > > >> krb5_store_password_if_offline = True > > > >> ipa_domain = example.dc > > > >> id_provider = ipa > > > >> auth_provider = ipa > > > >> access_provider = ipa > > > >> ldap_tls_cacert = /etc/ipa/ca.crt > > > >> ipa_hostname = ipacli-irvlt01.example.dc > > > >> chpass_provider = ipa > > > >> dyndns_update = True > > > >> ipa_server = _srv_, ipa-irvlt01.example.dc > > > >> dyndns_iface = ens160 > > > >> dns_discovery_domain = example.dc > > > >> > > > >> debug_level = 10 > > > >> [sssd] > > > >> ########### AFTER IPA ################### > > > >> #services = nss, sudo, pam, ssh > > > >> services = nss, pam > > > >> config_file_version = 2 > > > >> ######################################### > > > >> domains = example.dc > > > >> > > > >> debug_level = 10 > > > >> [nss] > > > >> homedir_substring = /home > > > >> > > > >> [pam] > > > >> debug_level = 10 > > > >> > > > >> [sudo] > > > >> > > > >> [autofs] > > > >> > > > >> [ssh] > > > >> > > > >> [pac] > > > >> > > > >> [ifp] > > > >> > > > >> [secrets] > > > >> > > > >> [session_recording] > > > >> > > > >> ########################################## > > > >> > > > >> > > > >> _______________________________________________ > > > >> FreeIPA-users mailing list -- > > > freeipa-users(a)lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org> > > <mailto:freeipa-users@lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org>> > > > <mailto:freeipa-users@lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org> > > <mailto:freeipa-users@lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org>>> > > > >> To unsubscribe send an email to > > > freeipa-users-leave(a)lists.fedorahosted.org > <mailto:freeipa-users-leave@lists.fedorahosted.org> > > <mailto:freeipa-users-leave@lists.fedorahosted.org > <mailto:freeipa-users-leave@lists.fedorahosted.org>> > > > <mailto:freeipa-users-leave@lists.fedorahosted.org > <mailto:freeipa-users-leave@lists.fedorahosted.org> > > <mailto:freeipa-users-leave@lists.fedorahosted.org > <mailto:freeipa-users-leave@lists.fedorahosted.org>>> > > > >> Fedora Code of Conduct: > > > > https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > > > >> List Guidelines: > > > https://fedoraproject.org/wiki/Mailing_list_guidelines > > > >> List Archives: > > > > > > https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost… > > > > _______________________________________________ > > > > FreeIPA-users mailing list -- > > freeipa-users(a)lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org> > > <mailto:freeipa-users@lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org>> > > > <mailto:freeipa-users@lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org> > > <mailto:freeipa-users@lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org>>> > > > > To unsubscribe send an email to > > > freeipa-users-leave(a)lists.fedorahosted.org > <mailto:freeipa-users-leave@lists.fedorahosted.org> > > <mailto:freeipa-users-leave@lists.fedorahosted.org > <mailto:freeipa-users-leave@lists.fedorahosted.org>> > > > <mailto:freeipa-users-leave@lists.fedorahosted.org > <mailto:freeipa-users-leave@lists.fedorahosted.org> > > <mailto:freeipa-users-leave@lists.fedorahosted.org > <mailto:freeipa-users-leave@lists.fedorahosted.org>>> > > > > Fedora Code of Conduct: > > > > https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > > > > List Guidelines: > > > https://fedoraproject.org/wiki/Mailing_list_guidelines > > > > List Archives: > > > > > > https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost… > > > > > > > > > >

1 0

Freeipa homedir overrides
by Matthias Salzmann 21 Oct '19

21 Oct '19

Hello together I'am a newby in Freeipa I have a ( one-side ) cross-forrest trust with an Active Directory Domain. AD user are able to login with ssh on the linux server. That works fine. With sssd i am able to override the homedir. (override_homedir = /home/%u) Unfortunately it is not possible to override the homedir with an additional variable. Example: /home/%g/%u ( %g = $group ) The default group of each user should be included in homedir like /home/merchandising/paul in FreeIpa server i am able to override a user homedir with ID views but only for a single user. Does it anyone knows how i can override the homedir for a special group? Many Thanks Matthias

1 0

ns-slapd hangs several times a day
by Sylvain Coutant 20 Oct '19

20 Oct '19

Hello gurus, We are running a 3 nodes FreeIPA cluster for some time without major trouble. One server may stale from time to time, without real trouble to restart it. A few days ago, we had to migrate the VMs between two clouds (disk image copied from one to the other). They have been renumbered from old to new IPv4 address space. Not that easy, but we finally got it done with all DNS entries in sync. Yet, since the migration, ns-slapd process hangs randomly way more often than before (went from once every few months to several times a day) and is especially hard to restart on any node. While starting up, the netstat output is like: Active Internet connections (w/o servers) Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp6 184527 0 10.217.151.3:389 10.217.151.2:52314 ESTABLISHED 29948/ns-slapd Netstat and tcpdump show it processes very slowly the recvq (sometimes like 79 bytes per 1-2 seconds). At some point it just stops processing it and hangs (only kill -9 works to take it down). When stale, strace shows the process loops only on : getpeername(8, 0x7ffe62c49fd0, 0x7ffe62c49f94) = -1 ENOTCONN (Transport endpoint is not connected) poll([{fd=50, events=POLLIN}, {fd=7, events=POLLIN}, {fd=8, events=POLLIN}, {fd=9, events=POLLIN}, {fd=117, events=POLLIN}, {fd=116, events=POLLIN}, {fd=115, events=POLLIN}, {fd=114, events=POLLIN}, {fd=89, events=POLLIN}, {fd=85, events=POLLIN}, {fd=83, events=POLLIN}, {fd=82, events=POLLIN}, {fd=81, events=POLLIN}, {fd=80, events=POLLIN}, {fd=79, events=POLLIN}, {fd=78, events=POLLIN}, {fd=77, events=POLLIN}, {fd=76, events=POLLIN}, {fd=67, events=POLLIN}, {fd=72, events=POLLIN}, {fd=69, events=POLLIN}, {fd=64, events=POLLIN}, {fd=66, events=POLLIN}], 23, 250) = 0 (Timeout) If it can go through startup replication, one of the server will hang a little bit later, freezing the whole cluster. Forcing us to restart the faulty node to unlock things. When stale, the dirsrv access log only contains entries like: [20/Oct/2019:17:52:46.950029525 +0100] conn=86 fd=131 slot=131 connection from 10.217.151.4 to 10.217.151.4 [20/Oct/2019:17:52:51.280412883 +0100] conn=87 fd=132 slot=132 SSL connection from 10.217.151.10 to 10.217.151.4 [20/Oct/2019:17:52:54.956204031 +0100] conn=88 fd=133 slot=133 connection from 10.217.151.4 to 10.217.151.4 [20/Oct/2019:17:53:04.966542441 +0100] conn=89 fd=134 slot=134 connection from 10.217.151.2 to 10.217.151.4 [20/Oct/2019:17:53:22.659053020 +0100] conn=90 fd=135 slot=135 SSL connection from 10.217.151.10 to 10.217.151.4 [20/Oct/2019:17:53:51.006707605 +0100] conn=91 fd=136 slot=136 connection from 10.217.151.4 to 10.217.151.4 [20/Oct/2019:17:53:54.514162543 +0100] conn=92 fd=137 slot=137 SSL connection from 10.217.151.10 to 10.217.151.4 [20/Oct/2019:17:53:59.011602776 +0100] conn=93 fd=138 slot=138 connection from 10.217.151.3 to 10.217.151.4 [20/Oct/2019:17:54:09.019296900 +0100] conn=94 fd=139 slot=139 connection from 10.217.151.4 to 10.217.151.4 And netstat lists 10s of accepted network connections that are stale like : tcp6 286 0 10.217.151.4:389 10.217.151.10:32512 ESTABLISHED 29948/ns-slapd The underlying network seams clean and uses jumbo frames. tcpdump and ping show 0 packet loss and no retransmit. Being afraid it could be a jumbo frame issue, mtu was even forced down to 1500. Without success. Entropy seems fine as well : # cat /proc/sys/kernel/random/entropy_avail 3138 Running version on all servers: ipa-client-4.6.5-11.el7.centos.x86_64 ipa-client-common-4.6.5-11.el7.centos.noarch ipa-common-4.6.5-11.el7.centos.noarch ipa-server-4.6.5-11.el7.centos.x86_64 ipa-server-common-4.6.5-11.el7.centos.noarch ipa-server-dns-4.6.5-11.el7.centos.noarch I'd happily listen to any hint regarding this critical problem. /Sylvain.

2 1

NFS Home directories: ipa-client-automount on Ubuntu 18.04
by TomK 19 Oct '19

19 Oct '19

Hey All, Are there any recent instructions available for configuring NFS home directories using ipa-client-automount ? Currently above command generates: stderr= Started rpcidmapd Starting external process args=['/bin/systemctl', 'enable', 'nfs-idmapd.service'] Process finished, return code=0 stdout= stderr=The unit files have no installation config (WantedBy, RequiredBy, Also, Alias settings in the [Install] section, and DefaultInstance for template units). This means they are not meant to be enabled using systemctl. Possible reasons for having this kind of units are: 1) A unit may be statically enabled by being symlinked from another unit's .wants/ or .requires/ directory. 2) A unit's purpose may be to act as a helper for some other unit which has a requirement dependency on it. 3) A unit may be started when needed via activation (socket, path, timer, D-Bus, udev, scripted systemctl call, ...). 4) In case of template units, the unit is meant to be enabled with some instance name specified. stderr= Started rpcgssd Starting external process args=['/bin/systemctl', 'enable', 'rpc-gssd.service'] Process finished, return code=0 stdout= stderr=The unit files have no installation config (WantedBy, RequiredBy, Also, Alias settings in the [Install] section, and DefaultInstance for template units). This means they are not meant to be enabled using systemctl. Possible reasons for having this kind of units are: 1) A unit may be statically enabled by being symlinked from another unit's .wants/ or .requires/ directory. 2) A unit's purpose may be to act as a helper for some other unit which has a requirement dependency on it. 3) A unit may be started when needed via activation (socket, path, timer, D-Bus, udev, scripted systemctl call, ...). 4) In case of template units, the unit is meant to be enabled with some instance name specified. And mount doesn't work. -- Thx, TK.

1 1

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users October 2019