November 2019 - FreeIPA-users - Fedora mailing-lists

Issues with certificates: X509: KEY_VALUES_MISMATCH
by Dmitri Moudraninets 25 Nov '19

25 Nov '19

Hi All, I have a werid issue with FreeIPA. I can't do anything with certificates. I also can't upgrade FreeIPA. If I run ipa-server-update I receive this: Unexpected error - see /var/log/ipaupgrade.log for details: NetworkError: cannot connect to ' https://freeipa.corp.mydomain.com:8443/ca/rest/account/login': [X509: KEY_VALUES_MISMATCH] key values mismatch (_ssl.c:2593) The ipa-server-upgrade command failed. See /var/log/ipaupgrade.log for more information If I try to vew certificates via web interface I see this error message: IPA Error 907: NetworkError cannot connect to ' https://freeipa.corp.mydomain.com:443/ca/agent/ca/displayBySerial': [X509: KEY_VALUES_MISMATCH] key values mismatch (_ssl.c:2593) Below is the list of my certificates: # getcert list | egrep '^Request|status:|subject:' Request ID '20171205153653': status: MONITORING subject: CN=freeipa.corp.mydomain.com,O=CORP.MYDOMAIN.COM Request ID '20180912151607': status: CA_UNREACHABLE subject: CN=CA Audit,O=CORP.MYDOMAIN.COM Request ID '20180912151608': status: CA_UNREACHABLE subject: CN=OCSP Subsystem,O=CORP.MYDOMAIN.COM Request ID '20180912151609': status: CA_UNREACHABLE subject: CN=CA Subsystem,O=CORP.MYDOMAIN.COM Request ID '20180912151610': status: MONITORING subject: CN=Certificate Authority,O=CORP.MYDOMAIN.COM Request ID '20180912151611': status: MONITORING subject: CN=user,O=CORP.MYDOMAIN.COM Request ID '20180912151612': status: CA_UNREACHABLE subject: CN=freeipa.corp.mydomain.com,O=CORP.MYDOMAIN.COM Request ID '20180912151613': status: MONITORING subject: CN=freeipa.corp.mydomain.com,O=CORP.MYDOMAIN.COM Request ID '20180912151615': status: MONITORING subject: CN=freeipa.corp.mydomain.com,O=CORP.MYDOMAIN.COM Request ID '20190212162113': status: MONITORING subject: CN=mail.corp.mydomain.com,O=CORP.MYDOMAIN.COM Request ID '20191017155747': status: MONITORING subject: CN=analytics-stage.corp.mydomain.com,O=CORP.MYDOMAIN.COM Request ID '20191026094947': status: MONITORING subject: CN=nas.corp.mydomain.com,O=CORP.MYDOMAIN.COM Request ID '20191026102844': status: MONITORING subject: CN=pe.corp.mydomain.com,O=CORP.MYDOMAIN.COM Request ID '20191027134809': status: CA_UNREACHABLE subject: Request ID '20191027135053': status: CA_REJECTED subject: Request ID '20191027135738': status: CA_UNREACHABLE subject: I tried to set time on the server back and I tried to restart certmonger - but result is always the same - SSL error KEY_VALUES_MISMATCH. FreeIPA, version: 4.6.4 How to solve this issue? -- WBR Dmitry

2 9

Certificates renewal - for certs issued to services like HTTP
by John Stokes 25 Nov '19

25 Nov '19

Hi all, I have a question regarding renewal of certificates issued to http services. I read somewhere that these certificates are automatically renewed but could not find any more details. My deployment is a standard one and I'm using the caIPAserviceCert profile. Can anyone shed some light on the process of renewals of certificates issued to servers? If the renewal is automatic where will the new cert (I suppose key file will be the same) be stored and when is the renewal being done (how many days before it expires)?

2 5

SSO of webapps on Firefox Android
by Alex Corcoles 24 Nov '19

24 Nov '19

Hi, I've managed to integrate some webapps with FreeIPA nicely, both using mod_auth_gssapi and Ipsilon. Both work great on computers joined to FreeIPA, I am signed in automatically without typing my password. Can a similar experience be achieved on Firefox Android? I can log in putting my password, but both methods require to type in my password (and quite often- when Firefox is restarted I get prompted the password again and again). I was thinking of using the FreeIPA CA to create a user/device certificate, but I see several drawbacks: * It is a bit clunky to set up. Maybe there's some OSS MDM I could use to push the certificate... * Ipsilon does not support it- so I should do it all in Apache doing the certificate authentication in addition to mod_auth_gssapi Maybe there are other methods? I see Keycloak has support for WebAuth... but I've found Ipsilon much easier to set up... Cheers, Álex -- ___ {~._.~} ( Y ) ()~*~() mail: alex at corcoles dot net (_)-(_) http://alex.corcoles.net/

1 0

OpenSSH CA with FreeIPA dogtag
by Vinícius Ferrão 22 Nov '19

22 Nov '19

Hello, I would like to know if someone was able to use OpenSSH with certificates managed from the Dogtag CA of FreeIPA. My goal is to be able to issue certificates for users and perhaps using host keys generated from this CA. I know this may be redundant since FreeIPA already manage host keys, but since the CA is already in-place, why not? My question is just to know if someone made this, or if someone already tried this and it was broken or unsupported. Thanks all. PS: If someone want to just say: leave that, it’s useless. I’m open to hear about it.

2 2

ipa-client slows down connections within the container
by Dmitry Perets 22 Nov '19

22 Nov '19

Hi, Really weird issue... We build a docker container to run some ansible playbooks within it. We notice, that IF the container has "ipa-client" package installed, there is a HUGE performance degradation to execute the same playbook. E.g. 20 seconds without ipa-client vs 2 minutes with ipa-client (6 times worse!). Note that: - We DO NOT enroll the container. We don't run "ipa-client-install" at any point. We just have the "ipa-client" package INSTALLED (like "yum install ipa-client") - The playbooks DO NOT talk to IPA in any way, neither do they run IPA commands. They are totally unrelated to ipa-client actually. The delay seems to be during the connection - i.e. it doesn't matter WHAT exactly ansible task does. It gets stuck for all tasks on something like this (note timestamp): <192.168.1.1> EXEC /bin/sh -c '/usr/bin/python /root/.ansible/tmp/ansible-tmp-1574346920.3942568-62901531545767/AnsiballZ_stat.py && sleep 0' 852 1574346920.65004: opening command with Popen() 852 1574346920.65758: done running command with Popen() 852 1574346920.65791: getting output with communicate() 852 1574346921.00213: done communicating <<<<<< note the delay here, this happens for each task 852 1574346921.00227: done with local.exec_command() So, JUST HAVING ipa-client installed somehow causes this slowness. Any idea what ipa-client package can alter in system behavior, if we don't actually enroll in IPA domain? P.S. You might be wondering WHY we actually have this ipa-client there... well, that's the point: it's totally unrelated to this particular thing... it's just that some of the playbooks need to use IPA commands, that's why we have ipa-client installed. But even NOT the playbook that we are testing above... --- Regards, Dmitry Perets

2 1

crawling through my logs on my freeipa-servers
by Christof Schulze 21 Nov '19

21 Nov '19

While watching my certificates to renew (hopefully not failing again) and crawling through my logs I found some Warnings on all of my master and replicas. Do I have to worry about something the "ocspSigningCert cert-pki-ca" is one of the certificates expiring in 9 days. journalctl -u pki-tomcatd@pki-tomcat on idm1 (Replication Master) Nov 20 17:13:19 idm1.example.com.example.com[9668]: WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'enableOCSP' to 'false' did not find a matching property. Nov 20 17:13:19 idm1.example.com[9668]: Nov 20, 2019 5:13:19 PM org.apache.catalina.startup.SetAllPropertiesRule begin Nov 20 17:13:19 idm1.example.com[9668]: WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'ocspResponderURL' to 'http://idm1.example.com:9080/ca/ocsp' did not find a matching property. Nov 20 17:13:19 idm1.example.com server[9668]: Nov 20, 2019 5:13:19 PM org.apache.catalina.startup.SetAllPropertiesRule begin Nov 20 17:13:19 idm1.example.com server[9668]: WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'ocspResponderCertNickname' to 'ocspSigningCert cert-pki-ca' did not find a matching property. Nov 20 17:13:19 idm1.example.com server[9668]: Nov 20, 2019 5:13:19 PM org.apache.catalina.startup.SetAllPropertiesRule begin Nov 20 17:13:19 idm1.example.com server[9668]: WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'ocspCacheSize' to '1000' did not find a matching property. Nov 20 17:13:19 idm1.example.com server[9668]: Nov 20, 2019 5:13:19 PM org.apache.catalina.startup.SetAllPropertiesRule begin Nov 20 17:13:19 idm1.example.com server[9668]: WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'ocspMinCacheEntryDuration' to '60' did not find a matching property. Nov 20 17:13:19 idm1.example.com server[9668]: Nov 20, 2019 5:13:19 PM org.apache.catalina.startup.SetAllPropertiesRule begin Nov 20 17:13:19 idm1.example.com server[9668]: WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'ocspMaxCacheEntryDuration' to '120' did not find a matching property. Nov 20 17:13:19 idm1.example.com server[9668]: Nov 20, 2019 5:13:19 PM org.apache.catalina.startup.SetAllPropertiesRule begin Nov 20 17:13:19 idm1.example.com server[9668]: WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'ocspTimeout' to '10' did not find a matching property. Nov 20 17:13:19 idm1.example.com server[9668]: Nov 20, 2019 5:13:19 PM org.apache.catalina.startup.SetAllPropertiesRule begin Nov 20 17:13:19 idm1.example.com server[9668]: WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'strictCiphers' to 'true' did not find a matching property. Nov 20 17:13:19 idm1.example.com server[9668]: Nov 20, 2019 5:13:19 PM org.apache.catalina.startup.SetAllPropertiesRule begin Nov 20 17:13:19 idm1.example.com server[9668]: WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'sslOptions' to 'ssl2=false,ssl3=false,tls=true' did not find a matching property. Nov 20 17:13:19 idm1.example.com server[9668]: Nov 20, 2019 5:13:19 PM org.apache.catalina.startup.SetAllPropertiesRule begin Nov 20 17:13:19 idm1.example.com server[9668]: WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'ssl2Ciphers' to '-SSL2_RC4_128_WITH_MD5,-SSL2_RC4_128_EXPORT40_WITH_MD5,-SSL2_RC2_128_CBC_WITH_MD5,-SSL2_RC2_128_C Nov 20 17:13:19 idm1.example.com server[9668]: Nov 20, 2019 5:13:19 PM org.apache.catalina.startup.SetAllPropertiesRule begin Nov 20 17:13:19 idm1.example.com server[9668]: WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'ssl3Ciphers' to '-SSL3_FORTEZZA_DMS_WITH_NULL_SHA,-SSL3_FORTEZZA_DMS_WITH_RC4_128_SHA,+SSL3_RSA_WITH_RC4_128_SHA,- Nov 20 17:13:19 idm1.example.com server[9668]: Nov 20, 2019 5:13:19 PM org.apache.catalina.startup.SetAllPropertiesRule begin Nov 20 17:13:19 idm1.example.com server[9668]: WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'tlsCiphers' to '-TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA,-TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA,+TLS_ECDH_RSA_WITH_3DES Nov 20 17:13:19 idm1.example.com server[9668]: Nov 20, 2019 5:13:19 PM org.apache.catalina.startup.SetAllPropertiesRule begin Nov 20 17:13:19 idm1.example.com server[9668]: WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'sslVersionRangeStream' to 'tls1_0:tls1_2' did not find a matching property. Nov 20 17:13:19 idm1.example.com server[9668]: Nov 20, 2019 5:13:19 PM org.apache.catalina.startup.SetAllPropertiesRule begin Nov 20 17:13:19 idm1.example.com server[9668]: WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'sslVersionRangeDatagram' to 'tls1_1:tls1_2' did not find a matching property. Nov 20 17:13:19 idm1.example.com server[9668]: Nov 20, 2019 5:13:19 PM org.apache.catalina.startup.SetAllPropertiesRule begin Nov 20 17:13:19 idm1.example.com server[9668]: WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'sslRangeCiphers' to '-TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA,-TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA,-TLS_ECDH_RSA_WITH Nov 20 17:13:19 idm1.example.com server[9668]: Nov 20, 2019 5:13:19 PM org.apache.catalina.startup.SetAllPropertiesRule begin Nov 20 17:13:19 idm1.example.com server[9668]: WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'serverCertNickFile' to '/var/lib/pki/pki-tomcat/conf/serverCertNick.conf' did not find a matching property. Nov 20 17:13:19 idm1.example.com server[9668]: Nov 20, 2019 5:13:19 PM org.apache.catalina.startup.SetAllPropertiesRule begin Nov 20 17:13:19 idm1.example.com server[9668]: WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'passwordFile' to '/var/lib/pki/pki-tomcat/conf/password.conf' did not find a matching property. Nov 20 17:13:19 idm1.example.com server[9668]: Nov 20, 2019 5:13:19 PM org.apache.catalina.startup.SetAllPropertiesRule begin Nov 20 17:13:19 idm1.example.com server[9668]: WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'passwordClass' to 'org.apache.tomcat.util.net.jss.PlainPasswordFile' did not find a matching property. Nov 20 17:13:19 idm1.example.com server[9668]: Nov 20, 2019 5:13:19 PM org.apache.catalina.startup.SetAllPropertiesRule begin Nov 20 17:13:19 idm1.example.com server[9668]: WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'certdbDir' to '/var/lib/pki/pki-tomcat/alias' did not find a matching property. Nov 20 17:13:19 idm1.example.com server[9668]: Nov 20, 2019 5:13:19 PM org.apache.tomcat.util.digester.SetPropertiesRule begin Nov 20 17:13:19 idm1.example.com server[9668]: WARNING: [SetPropertiesRule]{Server/Service/Engine/Host} Setting property 'xmlValidation' to 'false' did not find a matching property. Nov 20 17:13:19 idm1.example.com server[9668]: Nov 20, 2019 5:13:19 PM org.apache.tomcat.util.digester.SetPropertiesRule begin Nov 20 17:13:19 idm1.example.com server[9668]: WARNING: [SetPropertiesRule]{Server/Service/Engine/Host} Setting property 'xmlNamespaceAware' to 'false' did not find a matching property. Nov 20 17:13:19 idm1.example.com server[9668]: Nov 20, 2019 5:13:19 PM com.netscape.cms.tomcat.PKIListener lifecycleEvent Nov 20 17:13:19 idm1.example.com server[9668]: INFO: PKIListener: org.apache.catalina.core.StandardServer [before_init] Nov 20 17:13:19 idm1.example.com server[9668]: Nov 20, 2019 5:13:19 PM org.apache.coyote.AbstractProtocol init Nov 20 17:13:19 idm1.example.com server[9668]: INFO: Initializing ProtocolHandler ["http-bio-8080"] Nov 20 17:13:19 idm1.example.com server[9668]: Nov 20, 2019 5:13:19 PM org.apache.coyote.AbstractProtocol init Nov 20 17:13:19 idm1.example.com server[9668]: INFO: Initializing ProtocolHandler ["http-bio-8443"] Nov 20 17:13:20 idm1.example.com server[9668]: Error: SSL cipher "TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256" not recognized by tomcatjss Nov 20 17:13:20 idm1.example.com server[9668]: Error: SSL cipher "TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256" not recognized by tomcatjss and the other masters (e.g. idm2) Nov 20 17:13:15 idm2.example.com server[10334]: WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'enableOCSP' to 'false' did not find a matching property. Nov 20 17:13:15 idm2.example.com server[10334]: WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'ocspResponderURL' to 'http://idm2.example.com:8080/ca/ocsp' did not find a matching property. Nov 20 17:13:15 idm2.example.com server[10334]: WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'ocspResponderCertNickname' to 'ocspSigningCert cert-pki-ca' did not find a matching property. Nov 20 17:13:15 idm2.example.com server[10334]: WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'ocspCacheSize' to '1000' did not find a matching property. Nov 20 17:13:15 idm2.example.com server[10334]: WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'ocspMinCacheEntryDuration' to '60' did not find a matching property. Nov 20 17:13:15 idm2.example.com server[10334]: WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'ocspMaxCacheEntryDuration' to '120' did not find a matching property. Nov 20 17:13:15 idm2.example.com server[10334]: WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'ocspTimeout' to '10' did not find a matching property. Nov 20 17:13:15 idm2.example.com server[10334]: WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'strictCiphers' to 'true' did not find a matching property. Nov 20 17:13:15 idm2.example.com server[10334]: WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'sslOptions' to 'ssl2=false,ssl3=false,tls=true' did not find a matching property. Nov 20 17:13:15 idm2.example.com server[10334]: WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'ssl2Ciphers' to '-SSL2_RC4_128_WITH_MD5,-SSL2_RC4_128_EXPORT40_WITH_MD5,-SSL2_RC2_128_CBC_WITH_MD5,-SSL2_RC2_128_ Nov 20 17:13:15 idm2.example.com server[10334]: WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'ssl3Ciphers' to '-SSL3_FORTEZZA_DMS_WITH_NULL_SHA,-SSL3_FORTEZZA_DMS_WITH_RC4_128_SHA,+SSL3_RSA_WITH_RC4_128_SHA, Nov 20 17:13:15 idm2.example.com server[10334]: WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'tlsCiphers' to '-TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA,-TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA,+TLS_ECDH_RSA_WITH_3DE Nov 20 17:13:15 idm2.example.com server[10334]: WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'sslVersionRangeStream' to 'tls1_0:tls1_2' did not find a matching property. Nov 20 17:13:15 idm2.example.com server[10334]: WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'sslVersionRangeDatagram' to 'tls1_1:tls1_2' did not find a matching property. Nov 20 17:13:15 idm2.example.com server[10334]: WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'sslRangeCiphers' to '-TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA,-TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA,-TLS_ECDH_RSA_WIT Nov 20 17:13:15 idm2.example.com server[10334]: WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'serverCertNickFile' to '/var/lib/pki/pki-tomcat/conf/serverCertNick.conf' did not find a matching property. Nov 20 17:13:15 idm2.example.com server[10334]: WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'passwordFile' to '/var/lib/pki/pki-tomcat/conf/password.conf' did not find a matching property. Nov 20 17:13:15 idm2.example.com server[10334]: WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'passwordClass' to 'org.apache.tomcat.util.net.jss.PlainPasswordFile' did not find a matching property. Nov 20 17:13:15 idm2.example.com server[10334]: WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'certdbDir' to '/var/lib/pki/pki-tomcat/alias' did not find a matching property. Nov 20 17:13:15 idm2.example.com server[10334]: WARNING: [SetPropertiesRule]{Server/Service/Engine/Host} Setting property 'xmlValidation' to 'false' did not find a matching property. Nov 20 17:13:15 idm2.example.com server[10334]: WARNING: [SetPropertiesRule]{Server/Service/Engine/Host} Setting property 'xmlNamespaceAware' to 'false' did not find a matching property. -- Christof Schulze Institute of Materials Simulation (WW8) Department of Materials Science Friedrich-Alexander-University Erlangen-Nürnberg Dr.-Mack-Str. 77, 90762 Fürth, Germany Tel: 0911/65078-65069 Email: christof.schulze(a)fau.de

2 1

Current state of Windows client support
by Ian Pilcher 21 Nov '19

21 Nov '19

I've long believed that it wasn't possible to use FreeIPA for identity management with Windows clients (unless one was willing to pay for an Active Directory server and establish a cross-domain trust). I recently stumbled on this post, which indicates that it is possible: https://www.rootusers.com/how-to-login-to-windows-with-a-freeipa-account/ Can anyone speak to whether this is expected to work? -- ======================================================================== Ian Pilcher arequipeno(a)gmail.com -------- "I grew up before Mark Zuckerberg invented friendship" -------- ========================================================================

2 1

ipa-ca-agent cert
by N N 21 Nov '19

21 Nov '19

Hello! I have ipa 4.6.4-10, and my certmonger do not update ipa-ca-agent cert. Subject DN: CN=ipa-ca-agent, O=<my realm> How I can update it? I have few week before my certificate expire. I can't find documentation about it.

2 5

Replication issue, can't locate CSN, check_ipa_cosistency shows no errors
by Jones, Bob (rwj5d) 21 Nov '19

21 Nov '19

Hello, We have a 3 node multi-master IPA setup. These are running on Red Hat Enterprise Linux Server release 7.7 (Maipo) and all are version: Name : ipa-server Arch : x86_64 Version : 4.6.5 Release : 11.el7_7.3 Starting yesterday, we are getting the following messages approximately every 3 seconds from lidm01: [19/Nov/2019:15:48:24.221023177 -0500] - ERR - agmt="cn=caTolidm02.idm.domain.edu" (lidm02:389) - clcache_load_buffer - Can't locate CSN 5dd2adc0000100070000 in the changelog (DB rc=-30988). If replication stops, the consumer may need to be reinitialized. [19/Nov/2019:15:48:24.222186079 -0500] - ERR - NSMMReplicationPlugin - send_updates - agmt="cn=caTolidm02.idm.domain.edu" (lidm02:389): Missing data encountered. If the error persists the replica must be reinitialized. [19/Nov/2019:15:48:25.229931823 -0500] - ERR - agmt="cn=caTolidm03.idm.domain.edu" (lidm03:389) - clcache_load_buffer - Can't locate CSN 5dd2adc0000100070000 in the changelog (DB rc=-30988). If replication stops, the consumer may need to be reinitialized. [19/Nov/2019:15:48:25.231001956 -0500] - ERR - NSMMReplicationPlugin - send_updates - agmt="cn=caTolidm03.idm.domain.edu" (lidm03:389): Missing data encountered. If the error persists the replica must be reinitialized. There are no error messages on lidm02 or lidm03. I ran the command 'ipa-replica-manage re-initalize --from lidm01.idm.domain.edu’ on both lidm02 and lidm03. When that did not change anything I ran the command 'ipa-replica-manage re-initalize --from lidm02.idm.domain.edu’ on lidm01. This did not change anything either. I have run restart-dirsrv on all 3 idm servers as well. Also, here are the ipa-replica-manage list-ruv output on the 3 servers: Lidm01: Replica Update Vectors: lidm01.idm.domain.edu:389: 4 lidm02.idm.domain.edu:389: 8 lidm03.idm.domain.edu:389: 5 Certificate Server Replica Update Vectors: lidm01.idm.domain.edu:389: 7 lidm02.idm.domain.edu:389: 9 lidm03.idm.domain.edu:389: 6 Lidm02: Replica Update Vectors: lidm02.idm.domain.edu:389: 8 lidm01.idm.domain.edu:389: 4 lidm03.idm.domain.edu:389: 5 Certificate Server Replica Update Vectors: lidm02.idm.domain.edu:389: 9 lidm01.idm.domain.edu:389: 7 lidm03.idm.domain.edu:389: 6 Lidm03: Replica Update Vectors: lidm03.idm.domain.edu:389: 5 lidm01.idm.domain.edu:389: 4 lidm02.idm.domain.edu:389: 8 Certificate Server Replica Update Vectors: lidm03.idm.domain.edu:389: 6 lidm01.idm.domain.edu:389: 7 lidm02.idm.domain.edu:389: 9 check_ipa_consistency shows the following: +--------------------+----------+----------+----------+-------+ | FreeIPA servers: | lidm01 | lidm02 | lidm03 | STATE | +--------------------+----------+----------+----------+-------+ | Active Users | 8 | 8 | 8 | OK | | Stage Users | 0 | 0 | 0 | OK | | Preserved Users | 0 | 0 | 0 | OK | | Hosts | 93 | 93 | 93 | OK | | Services | 13 | 13 | 13 | OK | | User Groups | 89 | 89 | 89 | OK | | Host Groups | 15 | 15 | 15 | OK | | Netgroups | 14 | 14 | 14 | OK | | HBAC Rules | 41 | 41 | 41 | OK | | SUDO Rules | 28 | 28 | 28 | OK | | DNS Zones | 0 | 0 | 0 | OK | | Certificates | 27 | 27 | 27 | OK | | LDAP Conflicts | 0 | 0 | 0 | OK | | Ghost Replicas | 0 | 0 | 0 | OK | | Anonymous BIND | ON | ON | ON | OK | | Microsoft ADTrust | True | True | True | OK | | Replication Status | lidm02 0 | lidm03 0 | lidm02 0 | OK | | | lidm03 0 | lidm01 0 | lidm01 0 | | +--------------------+----------+----------+----------+-------+ At this point I’m not sure what to do next as most references to problems like this that I could find were solved with the re-initialize of the replication agreements. I appreciate any help anyone can provide. Thanks, — Bob Jones Lead Linux Services Engineer ITS ECP - Linux Services

2 3

Differences using sudo with local user on IPA server and client
by Jones, Bob (rwj5d) 20 Nov '19

20 Nov '19

Hello all, In our Nagios system we have some checks that require the nrpe user to use sudo in order to elevate privileges. This works fine on our IPA clients but not on our IPA servers. It appears that on the IPA servers it tries to find the nrpe user as nrpe(a)LIDS.VIRGINIA.EDU, which does not exist, and on the client it’s just the local nrpe user. The nrpe user exists identically in the /etc/passwd and /etc/shadow files on both servers. Any insight that anyone could give into what is going on here would be greatly appreciated. Now some relevant info/logs: Server is running on Red Hat Enterprise Linux Server release 7.7 (Maipo) and is version: Name : ipa-server Arch : x86_64 Version : 4.6.5 Release : 11.el7_7.3 Client is running on CentOS Linux release 7.7.1908 (Core) and is version: Name : ipa-client Arch : x86_64 Version : 4.6.5 Release : 11.el7.centos.3 The client and server have identical /etc/pam.d/system-auth and /etc/nsswitch.conf files. Here are the sssd.conf files for both. Server: -------------------------------------------------------------------------- [domain/idm.domain.edu] cache_credentials = True krb5_store_password_if_offline = True ipa_domain = idm.domain.edu id_provider = ipa auth_provider = ipa access_provider = ipa ldap_tls_cacert = /etc/ipa/ca.crt ipa_hostname = lidm01.idm.domain.edu chpass_provider = ipa ipa_server = lidm01.idm.domain.edu ipa_server_mode = True ignore_group_members = True ldap_purge_cache_timeout = 0 subdomain_inherit = ignore_group_members, ldap_purge_cache_timeout dns_discovery_domain = idm.domain.edu [sssd] services = nss, sudo, ifp, pam, ssh domains = idm.domain.edu [nss] homedir_substring = /home override_homedir = /home/%u entry_negative_timeout = 0 local_negative_timeout = 0 [pam] [sudo] [autofs] [ssh] [pac] [ifp] allowed_uids = ipaapi, root [secrets] [session_recording] -------------------------------------------------------------------------- Client: -------------------------------------------------------------------------- [domain/idm.domain.edu] cache_credentials = True krb5_store_password_if_offline = True ipa_domain = idm.domain.edu id_provider = ipa auth_provider = ipa access_provider = ipa ldap_tls_cacert = /etc/ipa/ca.crt ipa_hostname = dbm3.it.domain.edu chpass_provider = ipa ipa_server = _srv_, lidm01.idm.domain.edu krb5_auth_timeout = 30 dns_discovery_domain = idm.domain.edu [sssd] services = nss, sudo, pam, ssh domains = idm.domain.edu [nss] homedir_substring = /home override_homedir = /home/%u entry_negative_timeout = 0 local_negative_timeout = 0 [pam] pam_id_timeout = 30 [sudo] [autofs] [ssh] [pac] [ifp] [secrets] [session_recording] -------------------------------------------------------------------------- Okay, here are the pertinent messages in /var/log/secure when nrpe tries to use sudo: Server: -------------------------------------------------------------------------- Nov 20 16:56:05 lidm01.idm.domain.edu sudo[15034]: nrpe : unable to open /run/sudo/ts/nrpe : Permission denied ; TTY=unknown ; PWD=/ ; USER=root ; COMMAND=EXAMPLE_COMMAND Nov 20 16:56:05 lidm01.idm.domain.edu sudo[15034]: pam_unix(sudo:auth): conversation failed Nov 20 16:56:05 lidm01.idm.domain.edu sudo[15034]: pam_unix(sudo:auth): auth could not identify password for [nrpe] Nov 20 16:56:05 lidm01.idm.domain.edu sudo[15034]: pam_sss(sudo:auth): authentication failure; logname= uid=995 euid=0 tty= ruser=nrpe rhost= user=nrpe Nov 20 16:56:05 lidm01.idm.domain.edu sudo[15034]: pam_sss(sudo:auth): received for user nrpe: 10 (User not known to the underlying authentication module) Nov 20 16:56:05 lidm01.idm.domain.edu sudo[15034]: pam_krb5[15034]: authentication fails for 'nrpe' (nrpe(a)LIDS.VIRGINIA.EDU): User not known to the underlying authentication module (Client not found in Kerberos database) Nov 20 16:56:07 lidm01.idm.domain.edu sudo[15034]: nrpe : command not allowed ; TTY=unknown ; PWD=/ ; USER=root ; COMMAND=/bin/systemctl start sssd -------------------------------------------------------------------------- Client: -------------------------------------------------------------------------- Nov 20 16:58:23 dbm3.it.domain.edu sudo[11533]: nrpe : TTY=unknown ; PWD=/ ; USER=root ; COMMAND=EXAMPLE_COMMAND Nov 20 16:58:23 dbm3.it.domain.edu sudo[11533]: pam_unix(sudo:session): session opened for user root by (uid=0) Nov 20 16:58:26 dbm3.it.domain.edu sudo[11533]: pam_unix(sudo:session): session closed for user root -------------------------------------------------------------------------- Thanks, — Bob Jones Lead Linux Services Engineer ITS ECP - Linux Services

1 0

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users November 2019