November 2019 - FreeIPA-users - Fedora mailing-lists

FreeIPA 4.8.1 on Fedora 31 (upgraded from F30) fails to start
by Wulf C. Krueger 05 Feb '20

05 Feb '20

Hello, my FreeIPA installation was working well on Fedora 30. After upgrading to F31, though, it fails to start: ---- # ipactl start IPA version error: data needs to be upgraded (expected version '4.8.1-4.fc31', current version '4.8.1-1.fc30') Automatically running upgrade, for details see /var/log/ipaupgrade.log Be patient, this may take a few minutes. Automatic upgrade failed: Update complete Upgrading the configuration of the IPA services [Verifying that root certificate is published] [Migrate CRL publish directory] CRL tree already moved IPA server upgrade failed: Inspect /var/log/ipaupgrade.log and run command ipa-server-upgrade manually. Unexpected error - see /var/log/ipaupgrade.log for details: CalledProcessError: CalledProcessError(Command ['/bin/systemctl', 'start', 'pki-tomcatd(a)pki-tomcat.service'] returned non-zero exit status 1: 'Job for pki-tomcatd(a)pki-tomcat.service failed because a timeout was exceeded.\nSee "systemctl status pki-tomcatd(a)pki-tomcat.service" and "journalctl -xe" for details.\n') The ipa-server-upgrade command failed. See /var/log/ipaupgrade.log for more information See the upgrade log for more details and/or run /usr/sbin/ipa-server-upgrade again Aborting ipactl ---- Logs: ipaupgrade.log: https://mailstation.de/ipa-logs/ipaupgrade.log pki-tomcatd@pki-tomcat log: https://mailstation.de/ipa-logs/pki-tomcatd@pki-tomcat.log pki-tomcat-ca-debug log: https://mailstation.de/ipa-logs/pki-tomcat-ca-debug.2019-11-02.log So it looks like the LDAP server isn't reachable but its log says it's running: https://mailstation.de/ipa-logs/dirsrv@MAILSTATION-DE.log There's nothing listening on ports 389 and 636, though. Help would be highly appreciated. Best regards, Wulf

6 24

Easiest path to provide access to shares to Windows and Mac systems
by Kevin Vasko 22 Dec '19

22 Dec '19

So I feel we have a decent process for users on Linux (Ubuntu/CentOS) to access NFS shares, however there is rumbling of people wanting to use their Mac and Windows boxes to access the data shares. The tricky part of this is we won't be able to enroll the Windows or Mac systems into FreeIPA. So is there a "simple" way to allow users on Mac and Windows that can't be enrolled into the FreeIPA domain to access kerberized NFS shares? I think this is going to be difficult in general to windows and might have to swap to SMB? For example, is there a way to download a SMB+Kerberos clients, grab the keys from IPA and allow users to manually authenticate with kinit and be able to access the NFS or a SMB share?

3 2

How to determine when host last checked in?
by Master Blaster 10 Dec '19

10 Dec '19

In large orginizations, hosts can sometimes be retired without following procedures, etc, which leaves host objects in FreeIPA for hosts that no longer exist. Is there anyway to see when a host last checked in with FreeIPA? One could then delete host objects which haven't connected in say 30/60/90 days.

3 4

In-place upgrade from RHEL 7 to RHEL 8
by Ronald Wimmer 06 Dec '19

06 Dec '19

According to a RedHat document (https://access.redhat.com/articles/4263361 ) an in-place upgrade is only possible from RHEL 7.6 to RHEL 8.1. Unfortunately, I've kept my IPA servers up-to-date so that their version is now 7.7.1908. The document also states that there will be a possibility to upgrade from the last RHEL 7.x minor version to RHEL 8. Will this happen any time soon? Is it generally recommended to perform an in-place upgrade on an IPA server or is it better to follow the steps in "Migrating IDM from RHEL 7 to 8" as documented in https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/ht… ? Cheers, Ronald

2 5

ipa-server-install error [37/44] initializing group membership: [error] NotFound: no such entry
by Michael Schefczyk 04 Dec '19

04 Dec '19

Dear All, Trying to install ipa-server (4.7.1-11.module_el8.0.0+79+bbd20d7b package from @AppStream) on a new virtual CentOS Linux 8.0.1905 server within my LAN (fresh test install, the previous version on CentOS 7 did work), I persistently get the following error message when freipa-install tries to configure the dirsrv: [37/44]: initializing group membership [error] NotFound: no such entry I would very much welcome if anyone could point me to the right direction. I find the log content (below) not very telling. Regards, Michael Schefczyk 2019-10-13T07:21:07Z DEBUG step duration: dirsrv __add_topology_entries 0.05 sec 2019-10-13T07:21:07Z DEBUG [37/44]: initializing group membership 2019-10-13T07:21:07Z DEBUG Starting external process 2019-10-13T07:21:07Z DEBUG args=['/usr/bin/ldapmodify', '-v', '-f', '/tmp/tmpm2nl4f4x', '-H', 'ldapi://%2fvar%2frun%2fslapd-B72-COM.socket', '-Y', 'EXTERNAL'] 2019-10-13T07:21:07Z DEBUG Process finished, return code=0 2019-10-13T07:21:07Z DEBUG stdout=add objectClass: top extensibleObject add cn: IPA install add basedn: dc=b72,dc=com add filter: (objectclass=*) add ttl: 10 adding new entry "cn=IPA install 1570951250, cn=memberof task, cn=tasks, cn=config" modify complete 2019-10-13T07:21:07Z DEBUG stderr=ldap_initialize( ldapi://%2Fvar%2Frun%2Fslapd-B72-COM.socket/??base ) SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 2019-10-13T07:21:07Z DEBUG Waiting for memberof task to complete. 2019-10-13T07:21:07Z DEBUG Traceback (most recent call last): File "/usr/lib/python3.6/site-packages/ipapython/ipaldap.py", line 1022, in error_handler yield File "/usr/lib/python3.6/site-packages/ipapython/ipaldap.py", line 1514, in find_entries raise e File "/usr/lib/python3.6/site-packages/ipapython/ipaldap.py", line 1474, in find_entries result = self.conn.result3(id, 0) File "/usr/lib64/python3.6/site-packages/ldap/ldapobject.py", line 749, in result3 resp_ctrl_classes=resp_ctrl_classes File "/usr/lib64/python3.6/site-packages/ldap/ldapobject.py", line 756, in result4 ldap_result = self._ldap_call(self._l.result4,msgid,all,timeout,add_ctrls,add_intermediates,add_extop) File "/usr/lib64/python3.6/site-packages/ldap/ldapobject.py", line 329, in _ldap_call reraise(exc_type, exc_value, exc_traceback) File "/usr/lib64/python3.6/site-packages/ldap/compat.py", line 44, in reraise raise exc_value File "/usr/lib64/python3.6/site-packages/ldap/ldapobject.py", line 313, in _ldap_call result = func(*args,**kwargs) ldap.NO_SUCH_OBJECT: {'desc': 'No such object'} During handling of the above exception, another exception occurred: Traceback (most recent call last): File "/usr/lib/python3.6/site-packages/ipaserver/install/service.py", line 605, in start_creation run_step(full_msg, method) File "/usr/lib/python3.6/site-packages/ipaserver/install/service.py", line 591, in run_step method() File "/usr/lib/python3.6/site-packages/ipaserver/install/dsinstance.py", line 712, in init_memberof replication.wait_for_task(conn, dn) File "/usr/lib/python3.6/site-packages/ipaserver/install/replication.py", line 171, in wait_for_task entry = conn.get_entry(dn, attrlist) File "/usr/lib/python3.6/site-packages/ipapython/ipaldap.py", line 1571, in get_entry size_limit=size_limit, get_effective_rights=get_effective_rights, File "/usr/lib/python3.6/site-packages/ipapython/ipaldap.py", line 1383, in get_entries **kwargs) File "/usr/lib/python3.6/site-packages/ipapython/ipaldap.py", line 1521, in find_entries break File "/usr/lib64/python3.6/contextlib.py", line 99, in __exit__ self.gen.throw(type, value, traceback) File "/usr/lib/python3.6/site-packages/ipapython/ipaldap.py", line 1032, in error_handler raise errors.NotFound(reason=arg_desc or 'no such entry') ipalib.errors.NotFound: no such entry 2019-10-13T07:21:07Z DEBUG [error] NotFound: no such entry 2019-10-13T07:21:07Z DEBUG File "/usr/lib/python3.6/site-packages/ipapython/admintool.py", line 179, in execute return_value = self.run() File "/usr/lib/python3.6/site-packages/ipapython/install/cli.py", line 347, in run return cfgr.run() File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 360, in run return self.execute() File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 386, in execute for rval in self._executor(): File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 431, in __runner exc_handler(exc_info) File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 460, in _handle_execute_exception self._handle_exception(exc_info) File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 450, in _handle_exception six.reraise(*exc_info) File "/usr/lib/python3.6/site-packages/six.py", line 693, in reraise raise value File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 421, in __runner step() File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 418, in <lambda> step = lambda: next(self.__gen) File "/usr/lib/python3.6/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from six.reraise(*exc_info) File "/usr/lib/python3.6/site-packages/six.py", line 693, in reraise raise value File "/usr/lib/python3.6/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from value = gen.send(prev_value) File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 655, in _configure next(executor) File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 431, in __runner exc_handler(exc_info) File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 460, in _handle_execute_exception self._handle_exception(exc_info) File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 518, in _handle_exception self.__parent._handle_exception(exc_info) File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 450, in _handle_exception six.reraise(*exc_info) File "/usr/lib/python3.6/site-packages/six.py", line 693, in reraise raise value File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 515, in _handle_exception super(ComponentBase, self)._handle_exception(exc_info) File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 450, in _handle_exception six.reraise(*exc_info) File "/usr/lib/python3.6/site-packages/six.py", line 693, in reraise raise value File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 421, in __runner step() File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 418, in <lambda> step = lambda: next(self.__gen) File "/usr/lib/python3.6/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from six.reraise(*exc_info) File "/usr/lib/python3.6/site-packages/six.py", line 693, in reraise raise value File "/usr/lib/python3.6/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from value = gen.send(prev_value) File "/usr/lib/python3.6/site-packages/ipapython/install/common.py", line 65, in _install for unused in self._installer(self.parent): File "/usr/lib/python3.6/site-packages/ipaserver/install/server/__init__.py", line 550, in main master_install(self) File "/usr/lib/python3.6/site-packages/ipaserver/install/server/install.py", line 253, in decorated func(installer) File "/usr/lib/python3.6/site-packages/ipaserver/install/server/install.py", line 800, in install setup_pkinit=not options.no_pkinit) File "/usr/lib/python3.6/site-packages/ipaserver/install/dsinstance.py", line 345, in create_instance self.start_creation(runtime=30) File "/usr/lib/python3.6/site-packages/ipaserver/install/service.py", line 605, in start_creation run_step(full_msg, method) File "/usr/lib/python3.6/site-packages/ipaserver/install/service.py", line 591, in run_step method() File "/usr/lib/python3.6/site-packages/ipaserver/install/dsinstance.py", line 712, in init_memberof replication.wait_for_task(conn, dn) File "/usr/lib/python3.6/site-packages/ipaserver/install/replication.py", line 171, in wait_for_task entry = conn.get_entry(dn, attrlist) File "/usr/lib/python3.6/site-packages/ipapython/ipaldap.py", line 1571, in get_entry size_limit=size_limit, get_effective_rights=get_effective_rights, File "/usr/lib/python3.6/site-packages/ipapython/ipaldap.py", line 1383, in get_entries **kwargs) File "/usr/lib/python3.6/site-packages/ipapython/ipaldap.py", line 1521, in find_entries break File "/usr/lib64/python3.6/contextlib.py", line 99, in __exit__ self.gen.throw(type, value, traceback) File "/usr/lib/python3.6/site-packages/ipapython/ipaldap.py", line 1032, in error_handler raise errors.NotFound(reason=arg_desc or 'no such entry') 2019-10-13T07:21:07Z DEBUG The ipa-server-install command failed, exception: NotFound: no such entry 2019-10-13T07:21:07Z ERROR no such entry 2019-10-13T07:21:07Z ERROR The ipa-server-install command failed. See /var/log/ipaserver-install.log for more information

2 3

Re: ipa-replica-install latest failure attempt:
by Rob Crittenden 02 Dec '19

02 Dec '19

Auerbach, Steven via FreeIPA-users wrote: > Executed ipa-replica-prepare on an RHEL 6.9 server running ipa-server > 3.0.0.1_51 (name : ipa01) > > Yum installed ipa-server, ipa-server-dns, bind-dyndb-ldap on the target > Linux 7.6 server (name: ipa04) > > Copied the file to the target server to which ipa-server 4.6.5-11.0.1 is > installed (ipa04) > > Copied the file :/usr/share/ipa/copy-schema-to-ca.py from ipa v4.6 > server to the ipa v3.0 server and executed it successfully. > > Edited the /etc/resolv.con on ipa04 to include ipa01. Did not reboot. > > Executed ipa-replica-install --setup-dns --forwarder=8.8.8.8 --setup-ca > /var/lib/ipa/replica-info-ipa04.fbog.local.gpg (on ipa04) > > > 2019-11-16T16:23:24Z DEBUG The ipa-replica-install command failed, > exception: NotFound: wait_for_entry timeout on > ldap://ipa01.fbog.local:389 for > krbprincipalname=HTTP/ipa04.fbog.local(a)FBOG.LOCAL,cn=services,cn=accounts,dc=fbog,dc=local > > 2019-11-16T16:23:24Z ERROR wait_for_entry timeout on > ldap://ipa01.fbog.local:389 for > krbprincipalname=HTTP/ipa04.fbog.local(a)FBOG.LOCAL,cn=services,cn=accounts,dc=fbog,dc=local > > > > Not sure where to go from here. Did I leave out some declaration or > specification on the initial command? The problem isn't in the command invocation, replication is just slow enough for some reason that the new principal(s) weren't replicated to the existing master. I seem to recall a 389-ds option to mitigate this but I can't remember it off the to of my head (or maybe it isn't applicable for RHEL 6 master). cc'ing someone who would know. rob

4 3

openvpn-auth-ldap + FreeIPA - Cannot get 'RequireGroup' to work at all ! (tried everything..)
by Morgan Cox 29 Nov '19

29 Nov '19

HI. I have a freeIPA server, on the server I have a group 'ovpn-users' which is designed to be a group to allow access to our OpenVPN server and to enforce OTP when connecting to the VPN. My current setup works 'fine' - however it is allowing any user from any group access to the VPN, as soon as I enable RequireGroup True I cannot login at all. I have tried every combination I can think of and altered the Group BaseDN, whatever I try doesn't work. My workaround/hack to get this to work is to leave 'RequireGroup False' and change the user search filter to SearchFilter "(uid=ovpn-%u)" As all VPN usernames start with prefix ovpn- i.e ovpn-user1 Which means when they login to VPN then omit the prefix ovpn- (i.e in above case use = user1) Can anyone help get 'RequireGroup' working ? With ldapsearch I can see ovpn-users user uid's using (I have omitted domain/user names) --- # ldapsearch -Y gssapi -b cn=groups,cn=accounts,dc=xxxx,dc=xxxx '(cn=ovpn-users)' SASL/GSSAPI authentication started SASL username: xxxx(a)xxxx.xxxx SASL SSF: 256 SASL data security layer installed. # extended LDIF # # LDAPv3 # base <cn=groups,cn=accounts,dc=xxxx,dc=xxxx> with scope subtree # filter: (cn=ovpn-users) # requesting: ALL # # ovpn-users, groups, accounts, xxxx.xxxx dn: cn=ovpn-users,cn=groups,cn=accounts,dc=xxxx,dc=xxxx member: uid=ovpn-xxxxx,cn=users,cn=accounts,dc=xxxx,dc=xxxx member: uid=ovpn-xxxxx,cn=users,cn=accounts,dc=xxxx,dc=xxxx member: uid=ovpn-xxxxx,cn=users,cn=accounts,dc=xxxx,dc=xxxx memberOf: ipaUniqueID=d1fbb816-1071-11ea-ab30-063361404bd4,cn=hbac,dc=xxxx,dc= xxxx cn: ovpn-users description: OpenVPN users objectClass: top objectClass: groupofnames objectClass: nestedgroup objectClass: ipausergroup objectClass: ipaobject objectClass: posixgroup ipaUniqueID: e6415bdc-1071-11ea-814c-063361404bd4 gidNumber: 1928600030 # search result search: 4 result: 0 Success # numResponses: 2 # numEntries: 1 --- And I have tried in the config --- <Group> BaseDN "cn=groups,cn=accounts,dc=xxxx,dc=xxxx" SearchFilter "(cn=ovpn-users)" MemberAttribute member # Add group members to a PF table (disabled) #PFTable ips_vpn_eng </Group> -- I have also tried replacing the 'MemberAttribute' field with - member - memberUid - memberOF And have tried (probably over 100) different values in Group and user BaseDN [1] Has anyone got RequireGroup to work ? Also I have these oquestions .. [2] Also : What can I do about RHEL8 ? with the auth-ldap package ? There is no package on rhel/centos8 and you cannot compile it as objective C support is removed from rhel8 [3] Are there going to be changes to IPA and PAM so I can use openvpn+IPA+OTP without need for auth-ldap? Thanks ---

2 5

krb5kdc segfault
by David Harvey 29 Nov '19

29 Nov '19

Hi FreeIPA users, I've been haunted across installs by a sporadic krb5kdc segfault, the especially fun part is that it seems to bring the service down on all of the servers at once! Restarting it brings everything back again quite happily.. The last and only useful krb5kdc.log entry is: Nov 29 12:12:13 ipa1.redacted.net krb5kdc[20700](Error): worker 20705 exited with status 139 and in terms of segfault related, dmesg: [271761.231312] krb5kdc[20705]: segfault at fffffffffffffff8 ip 00007fe492d56b80 sp 00007ffc55c38c80 error 5 in ipadb.so[7fe492d4c000+19000] I was hoping that moving from our Fedora based install to CentOS would make this go away, but it seems to have followed us! Any advice as to where best to seek more useful log data? Best, David

2 2

Re: freeipa communication to dogtag broken after certificates expired and ipa-cert-fix run
by Fraser Tweedale 28 Nov '19

28 Nov '19

On Tue, Nov 26, 2019 at 09:46:02AM +0300, Александер Скобельцын wrote: > Of course. > > dn: uid=ipara,ou=people,o=ipaca > cn: ipara > objectClass: top > objectClass: person > objectClass: organizationalPerson > objectClass: inetOrgPerson > objectClass: cmsuser > userCertificate: > MIIDXDCCAkSgAwIBAgIBEDANBgkqhkiG9w0BAQsFADAxMQ8wDQYDVQQKDAZUS > VMuUksxHjAcBgNVBAMMFUNlcnRpZmljYXRlIEF1dGhvcml0eTAeFw0xOTExMDUwOTI3NTBaFw0yMT > EwMjUwOTI3NTBaMCIxDzANBgNVBAoMBlRJUy5SSzEPMA0GA1UEAxMGSVBBIFJBMIIBIjANBgkqhki > G9w0BAQEFAAOCAQ8AMIIBCgKCAQEA61dhtR4A8SqnP7t/L3xhg07moXfwvDBD+jOnY45GarO9DM0+ > y+YRdJ1duMC7QYcEcvFuVonW2ZhNF4flS4isf7dweMTsHexDz/0sfuEZGNW+yBpDEZUSRMiTDbYYi > kGv298Bbp1NmNHiUTayrsA1IlweESPmwR8r67n3qkWG+yIQ8Fz0iFue5GzK97/Gg7i+FJaFCeqaZR > UB6RTeM/DPyBG50hLWfqt3CSh2S5J+3Ch9ZtsRM+iEqtE2JNJRAef1VmbufS9xkweg9OAVw1oJrzN > 3wP/un3hmceH/DvxFETOk9FmT9AaXf/XCDwptxCJ+A7cV80vwG8zigLYrKpUgQQIDAQABo4GNMIGK > MB8GA1UdIwQYMBaAFMLNVVXxp/y1I2CbR7V3sf7Ak/9iMDgGCCsGAQUFBwEBBCwwKjAoBggrBgEFB > QcwAYYcaHR0cDovL2lwYS1jYS50aXMucmsvY2Evb2NzcDAOBgNVHQ8BAf8EBAMCBPAwHQYDVR0lBB > YwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMA0GCSqGSIb3DQEBCwUAA4IBAQAFv2Vl7DIc0s7YCdNmA07 > SrM/GIKeDbmgLqzinFqjMEH6/oR6bGqBcwDXr+0ss0lXYz2ndhRbEG1MI52POT/+sbJG48xJyQehd > /r+VeWNgMzKRUGQoLLiHctevxn9ugJHLBpxZzgTqm7tG8r/O71JgHlY1u9b7a/j6uXFCjAz5yuu0h > EHNYCaAViSwbAUFXu8906qOK087CFr8eFAY6Ng5oNLp8cAEkOQctoe1+Nubns2h5KN/W3fISnjOH/ > ATjJo1dsJGdlRN5rlatKpi7ryijXAeA7M5+8WMwF+PIhVBULhFSLXQj3MT4mU5HBp9PJj0n+uyhWY > PNrY+sTNX7U3S > userstate: 1 > usertype: agentType > sn: ipara > uid: ipara > description: 2;16;CN=Certificate Authority,O=TIS.RK;CN=IPA RA,O=TIS.RK > userPassword:: > e1NTSEE1MTJ9b3dvbTJCcXZQczljaW91OFVVMkFVdWxZUVg4b2FkY0Q0a1MwaDM > xS2FkYU0wNTcxaVFGK0M5L213M2hnMHBZNkhBVFlrclBlckJucGtPYTVRWGYzYWZta2haNnRjMVlW > Hi Alexander, I just noticed what the problem (probably) is. The userCertificate attribute is binary data. It should be represented with TWO colons ("::") after the attribute name, i.e.: userCertificate:: MII... Could you please update the LDAP entry and try again? Thanks, Fraser

2 1

FreeIPA regularly fails to restart after ipa-backup
by LHEUREUX Bernard 28 Nov '19

28 Nov '19

Hi all, I regularly face a problem where FreeIPA fails to restart just after the completion of ipa-backup, smb semms to have troubles restarting and ipa fails, if I run ipactl restart everything is restarting correctly... That happens randomly on any server of our IPA domain What could I do to solve it ? Thanks for your help. Ce message transmis par voie ?lectronique ainsi que toutes ses annexes contiennent des informations qui peuvent ?tre confidentielles ou prot?g?es. Ces informations sont uniquement destin?es ? l'usage des personnes ou des entit?s pr?cis?es dans les champs 'A', 'Cc' et 'Cci'. Si vous n'?tes pas l'un de ces destinataires, soyez conscient que toute forme, partielle ou compl?te, de divulgation, copie, distribution ou utilisation de ces informations est strictement interdite. Si vous avez re?u ce message par erreur, veuillez nous en informer par t?l?phone ou par message ?lectronique et d?truire les informations imm?diatement. Ce message n'engage que son signataire et aucunement son employeur.

1 0

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users November 2019