November 2019 - FreeIPA-users - Fedora mailing-lists

Disaster Recovery Architecture for IPA servers setup replicating in full mesh
by Saurabh Garg 05 Nov '19

05 Nov '19

Hi All, Could anyone please share a Disaster Recovery Architecture for IPA servers setup replicating in full mesh with the details of backup and restore procedure. Regards, sgarg

3 2

FreeIPA having problem after upgrading from Fedora 30 to 31
by Patrick Dung 04 Nov '19

04 Nov '19

Hello, I got problem upgrading from FC30 to FC31. Before upgrade the FreeIPA in FC30 is running fine. After OS upgrade, IPA cannot start and checked that it stuck at the CA part. I run ipa-server-upgrade manually but there is problem. 2019-10-29T21:03:58Z DEBUG request GET https://home.local.nonet:8443/ca/rest/account/login 2019-10-29T21:03:58Z DEBUG request body '' 2019-10-29T21:03:58Z DEBUG response status 500 2019-10-29T21:03:58Z DEBUG response headers Content-Type: text/html;charset=utf-8 Content-Language: en Content-Length: 2481 Date: Tue, 29 Oct 2019 21:03:58 GMT Connection: close 2019-10-29T21:03:58Z DEBUG response body (decoded): b'<!doctype html><html lang="en"><head><title>HTTP Status 500 \xe2\x80\x93 Internal Server Error</title><style type="text/css">h1 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:22px;} h2 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:16px;} h3 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:14px;} body {font-family:Tahoma,Arial,sans-serif;color:black;background-color:white;} b {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;} p {font-family:Tahoma,Arial,sans-serif;background:white;color:black;font-size:12px;} a {color:black;} a.name {color:black;} .line {height:1px;background-color:#525D76;border:none;}</style></head><body><h1>HTTP Status 500 \xe2\x80\x93 Internal Server Error</h1><hr class="line" /><p><b>Type</b> Exception Report</p><p><b>Message</b> Subsystem unavailable</p><p><b>Description</b> The server encountered an unexpected condition that prevented it from fulfilling the request.</p><p><b>Exception</b></p><pre>javax.ws.rs.ServiceUnavailableException: Subsystem unavailable\n\tcom.netscape.cms.tomcat.ProxyRealm.findSecurityConstraints(ProxyRealm.java:150)\n\torg.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:515)\n\tcom.netscape.cms.tomcat.ExternalAuthenticationValve.invoke(ExternalAuthenticationValve.java:82)\n\torg.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:92)\n\torg.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:678)\n\torg.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:343)\n\torg.apache.coyote.http11.Http11Processor.service(Http11Processor.java:408)\n\torg.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:66)\n\torg.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:860)\n\torg.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1589)\n\torg.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)\n\tjava.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)\n\tjava.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)\n\torg.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)\n\tjava.lang.Thread.run(Thread.java:748)\n</pre><p><b>Note</b> The full stack trace of the root cause is available in the server logs.</p><hr class="line" /><h3>Apache Tomcat/9.0.26</h3></body></html>' 2019-10-29T21:03:58Z ERROR IPA server upgrade failed: Inspect /var/log/ipaupgrade.log and run command ipa-server-upgrade manually. 2019-10-29T21:03:58Z DEBUG File "/usr/lib/python3.7/site-packages/ipapython/admintool.py", line 179, in execute return_value = self.run() File "/usr/lib/python3.7/site-packages/ipaserver/install/ipa_server_upgrade.py", line 54, in run server.upgrade() File "/usr/lib/python3.7/site-packages/ipaserver/install/server/upgrade.py", line 2223, in upgrade upgrade_configuration() File "/usr/lib/python3.7/site-packages/ipaserver/install/server/upgrade.py", line 2093, in upgrade_configuration ca_enable_ldap_profile_subsystem(ca) File "/usr/lib/python3.7/site-packages/ipaserver/install/server/upgrade.py", line 414, in ca_enable_ldap_profile_subsystem cainstance.migrate_profiles_to_ldap() File "/usr/lib/python3.7/site-packages/ipaserver/install/cainstance.py", line 1937, in migrate_profiles_to_ldap _create_dogtag_profile(profile_id, profile_data, overwrite=False) File "/usr/lib/python3.7/site-packages/ipaserver/install/cainstance.py", line 1943, in _create_dogtag_profile with api.Backend.ra_certprofile as profile_api: File "/usr/lib/python3.7/site-packages/ipaserver/plugins/dogtag.py", line 1315, in __enter__ raise errors.RemoteRetrieveError(reason=_('Failed to authenticate to CA REST API')) 2019-10-29T21:03:58Z DEBUG The ipa-server-upgrade command failed, exception: RemoteRetrieveError: Failed to authenticate to CA REST API 2019-10-29T21:03:58Z ERROR Unexpected error - see /var/log/ipaupgrade.log for details: RemoteRetrieveError: Failed to authenticate to CA REST API 2019-10-29T21:03:58Z ERROR The ipa-server-upgrade command failed. See /var/log/ipaupgrade.log for more information From /var/log/pki/pki-tomcat/ca/debug log file: 2019-10-30 05:03:50 [main] FINE: LdapAuthInfo: init() 2019-10-30 05:03:50 [main] FINE: LdapAuthInfo: init begins 2019-10-30 05:03:50 [main] FINEST: Getting internaldb.ldapauth.authtype=SslClientAuth 2019-10-30 05:03:50 [main] FINE: LdapAuthInfo: init ends 2019-10-30 05:03:50 [main] FINEST: Property internaldb.errorIfDown not found 2019-10-30 05:03:50 [main] FINEST: Getting internaldb.errorIfDown=true 2019-10-30 05:03:50 [main] FINEST: Property internaldb.doCloning not found 2019-10-30 05:03:50 [main] FINEST: Getting internaldb.doCloning=true 2019-10-30 05:03:50 [main] FINE: LdapBoundConnFactory: doCloning: true 2019-10-30 05:03:50 [main] FINE: LdapBoundConnFactory: mininum: 3 2019-10-30 05:03:50 [main] FINE: LdapBoundConnFactory: maximum: 15 2019-10-30 05:03:50 [main] FINE: LdapBoundConnFactory: host: home.local.nonet 2019-10-30 05:03:50 [main] FINE: LdapBoundConnFactory: port: 636 2019-10-30 05:03:50 [main] FINE: LdapBoundConnFactory: secure: true 2019-10-30 05:03:50 [main] FINE: LdapBoundConnFactory: authentication: 2 2019-10-30 05:03:50 [main] FINE: LdapBoundConnFactory: makeConnection(true) 2019-10-30 05:03:50 [main] FINEST: Getting internaldb.ldapauth.clientCertNickname=subsystemCert cert-pki-ca 2019-10-30 05:03:50 [main] FINEST: Property tcp.keepAlive not found 2019-10-30 05:03:50 [main] FINEST: Getting tcp.keepAlive=true 2019-10-30 05:03:50 [main] FINE: TCP Keep-Alive: true 2019-10-30 05:03:50 [main] FINE: LdapBoundConnection: Connecting to home.local.nonet:636 with client cert auth 2019-10-30 05:03:50 [main] FINE: ldapconn/PKISocketFactory.makeSSLSocket: begins 2019-10-30 05:03:50 [main] SEVERE: Unable to create socket: java.net.ConnectException: Connection refused (Connection refused) java.net.ConnectException: Connection refused (Connection refused) at java.net.PlainSocketImpl.socketConnect(Native Method) at java.net.AbstractPlainSocketImpl.doConnect(AbstractPlainSocketImpl.java:350) at java.net.AbstractPlainSocketImpl.connectToAddress(AbstractPlainSocketImpl.java:206) at java.net.AbstractPlainSocketImpl.connect(AbstractPlainSocketImpl.java:188) at java.net.SocksSocketImpl.connect(SocksSocketImpl.java:392) at java.net.Socket.connect(Socket.java:607) at java.net.Socket.connect(Socket.java:556) at java.net.Socket.<init>(Socket.java:452) at java.net.Socket.<init>(Socket.java:262) Some error is logged to /var/log/messages: Oct 30 05:26:50 home server[65722]: WARNING: Exception processing realm [com.netscape.cms.tomcat.ProxyRealm@5647a92b] background process Oct 30 05:26:50 home server[65722]: javax.ws.rs.ServiceUnavailableException: Subsystem unavailable Oct 30 05:26:50 home server[65722]: #011at com.netscape.cms.tomcat.ProxyRealm.backgroundProcess(ProxyRealm.java:142) Oct 30 05:26:50 home server[65722]: #011at org.apache.catalina.core.ContainerBase.backgroundProcess(ContainerBase.java:1137) Oct 30 05:26:50 home server[65722]: #011at org.apache.catalina.core.StandardContext.backgroundProcess(StandardContext.java:5566) Oct 30 05:26:50 home server[65722]: #011at org.apache.catalina.core.ContainerBase$ContainerBackgroundProcessor.processChildren(ContainerBase.java:1353) Oct 30 05:26:50 home server[65722]: #011at org.apache.catalina.core.ContainerBase$ContainerBackgroundProcessor.processChildren(ContainerBase.java:1357) Oct 30 05:26:50 home server[65722]: #011at org.apache.catalina.core.ContainerBase$ContainerBackgroundProcessor.run(ContainerBase.java:1335) Oct 30 05:26:50 home server[65722]: #011at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511) Oct 30 05:26:50 home server[65722]: #011at java.util.concurrent.FutureTask.runAndReset(FutureTask.java:308) Oct 30 05:26:50 home server[65722]: #011at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$301(ScheduledThreadPoolExecutor.java:180) Oct 30 05:26:50 home server[65722]: #011at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:294) Oct 30 05:26:50 home server[65722]: #011at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) Oct 30 05:26:50 home server[65722]: #011at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) Oct 30 05:26:50 home server[65722]: #011at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) Oct 30 05:26:50 home server[65722]: #011at java.lang.Thread.run(Thread.java:748) I am able to connect to my ldap server port 636 with TLS without problem. Thanks, Patrick

5 7

number of topology segments for 3 servers clean setup?
by lejeczek 04 Nov '19

04 Nov '19

hi everyone, I wanted to ask about number of segments after a clean IPA setup with 3 servers. I see for both 'domain' & 'ca' two segments created by master/replica installations, which makes me wonder - should there not be three? no/yes & why? many thanks, L.

4 5

Not able to login into IPA UI after full server backup, error says: "Your session has expired. Please re-login."
by Saurabh Garg 04 Nov '19

04 Nov '19

All IPA services work else than IPA UI login. For Admin account it throws the error "Your session has expired. Please re-login." # cat /var/log/httpd/error_log | grep error [Mon Nov 04 03:30:57.855012 2019] [:error] [pid 26165] ipa: INFO: Starting new HTTP connection (1): ipaserver.home.mydomain.com [Mon Nov 04 03:30:57.858643 2019] [:error] [pid 26165] ipa: INFO: Starting new HTTPS connection (1): ipaserver.home.mydomain.com [Mon Nov 04 04:14:57.945806 2019] [:error] [pid 31576] ipa: INFO: *** PROCESS START *** [Mon Nov 04 04:14:57.973073 2019] [:error] [pid 31579] ipa: INFO: *** PROCESS START *** [Mon Nov 04 04:14:57.977523 2019] [:error] [pid 31578] ipa: INFO: *** PROCESS START *** [Mon Nov 04 04:14:57.993765 2019] [:error] [pid 31577] ipa: INFO: *** PROCESS START *** [Mon Nov 04 04:15:26.343676 2019] [:error] [pid 31578] ipa: INFO: Starting new HTTP connection (1): ipaserver.home.mydomain.com [Mon Nov 04 04:15:26.347563 2019] [:error] [pid 31578] ipa: INFO: Starting new HTTPS connection (1): ipaserver.home.mydomain.com # kinit admin Password for admin(a)MYDOMAIN.COM: # klist Ticket cache: KEYRING:persistent:0:0 Default principal: admin(a)MYDOMAIN.COM Valid starting Expires Service principal 11/04/2019 04:39:36 11/05/2019 04:39:23 krbtgt/MYDOMAIN.COM(a)MYDOMAIN.COM # ipa -v ping ipa: INFO: trying https://ipaserver.home.mydomain.com/ipa/json ipa: INFO: [try 1]: Forwarding 'schema' to json server 'https://ipaserver.home.mydomain.com/ipa/json' ipa: INFO: trying https://ipaserver.home.mydomain.com/ipa/session/json ipa: INFO: [try 1]: Forwarding 'ping/1' to json server 'https://ipaserver.home.mydomain.com/ipa/session/json' ------------------------------------------- IPA server version 4.6.5. API version 2.231 ------------------------------------------- # kinit -kt /var/lib/ipa/gssproxy/http.keytab http(a)MYDOMAIN.COM kinit: Keytab contains no suitable keys for http(a)MYDOMAIN.COM while getting initial credentials # kinit -kt /var/lib/ipa/gssproxy/http.keytab HTTP/ipaserver.home.mydomain.com # klist Ticket cache: KEYRING:persistent:0:krb_ccache_jTRWw54 Default principal: HTTP/ipaserver.home.mydomain.com(a)MYDOMAIN.COM Valid starting Expires Service principal 11/04/2019 04:42:26 11/05/2019 04:42:26 krbtgt/MYDOMAIN.COM(a)MYDOMAIN.COM Can someone please help me with what might me the issue? Any suggestions? PS: I have already restarted restart krb5kdc,sssd & httpd services. Thanks in advance, Saurabh Garg

2 1

ipa-client password
by TomK 04 Nov '19

04 Nov '19

Hey All, Given a line like this: ipa-client-install --force-join -p admin -w "*********" --fixed-primary --server=idmipa01.nix.mds.xyz --server=idmipa02.nix.mds.xyz --domain=nix.mds.xyz --realm=NIX.MDS.XYZ -U 1) Is there a way to pull the password from a safe store before passing it in or pull from a safe store directly? or 2) Can I specify an unprevilidged user to register with? or 3) Register without the use of a password? Looking to register clients in ways that don't reveal any account passwords with which the registration has occurred with. -- Thx, TK.

2 1

remove self service privileges/permissions for specific users
by Joshua Hoblitt 03 Nov '19

03 Nov '19

Hello, I would like to be able to create a small number of user accounts which are not able to perform any self service (change passwd, set ssh pub keys), while leaving the default self service abilities enabled for most users. It appears that it is not possible to remove or negate permissions via privileges or roles. It also appears that it is not possible to remove the global self service privileges and replace them with a role as it isn't possible to constrain generic privileges to "self". Is that correct? Is there any existing way to achieve non-self-service users? Thanks, -Josh

1 0

Resilience to network/interface interruption
by lejeczek 01 Nov '19

01 Nov '19

hi guys, I think my IPA goes down when there is problem with the interface. Around the time this happens: .. netxen_nic: p3p1 NIC Link is down netxen_nic: p3p1 NIC Link is up netxen_nic: p3p1 NIC Link is down netxen_nic: p3p1 NIC Link is up netxen_nic: p3p1 NIC Link is down netxen_nic: p3p1 NIC Link is up netxen_nic: p3p1 NIC Link is down .. IPA is lost. There is probably more to it as IPAs run in containers but this is first thing I'd like to check. Are there any tuning which could be done to IPA/OS/kernel in order to help IPA and make system more resilient that way? many thanks, L.

1 0

Nested groups & ID-view
by Kimmo Rantala 01 Nov '19

01 Nov '19

Hello all. We encountered a situation where ID views broke authentication... or at least we think so. The situation was as follows: Customer insisted that they have to have a "hardened" SSH config like this: AllowGroups staff. This staff (GID 500) group was/is a local group in 100+ machines. They did this "to control who can login" despite me and a couple of my colleagues trying to tell them (sometimes with strong words attached) that FreeIPA's HBAC rules will handle this very thing but to no avail. Of course this resulted into situation where the IPA users could not login because sshd prevented it. We came up with a solution where we would create this ID-view: Anchor to override: res_staff Group name: staff GID: 500 and apply that to those 100+ clients. We didn't like the idea to abuse ID-views like this especially after the client insisted that the res_staff group should be a nested group like this: dev-team -> res_staff + <insert a bunch of other groups> ops-team -> res_staff + <insert a bunch of other groups> . . . (I have to admit that after seeing and hearing about this, I considered telling my bosses to outright fire this customer) For a while everything worked but then logins started to fail. Upon examining, it turned out that id command would no longer return the full list of groups of a user and the "hardened" sshd config killed the login. After we cleared the SSSD caches and restarted SSSD, the logins would work for a while and id command would return all the groups where user belonged to. It is also worth mentioning that this client has a fetish for nested groups so it is not uncommon to see groups 4-5 "deep" and it is a general mess. Also: No AD trust here. Just ye olde IPA domain. The good thing is that the environment is extremely homogeneous. All the IPA servers CentOS 7.6 and the clients CentOS 7.x. We have the logs with debug level 6 but before I'll send them for examination, I would like to ask that is there a limitation/bug in the ID-views functionality where it fails when the anchor group is nested? Thank you. PS. Alexander, you are awesome.

3 6

Nested groups & ID-view
by Kimmo Rantala 01 Nov '19

01 Nov '19

Hello all. We encountered a situation where ID views broke authentication... or at least we think so. The situation was as follows: Customer insisted that they have to have a "hardened" SSH config like this: AllowGroups staff. This staff (GID 500) group was/is a local group in 100+ machines. They did this "to control who can login" despite me and a couple of my colleagues trying to tell them (sometimes with strong words attached) that FreeIPA's HBAC rules will handle this very thing but to no avail. Of course this resulted into situation where the IPA users could not login because sshd prevented it. We came up with a solution where we would create this ID-view: Anchor to override: res_staff Group name: staff GID: 500 and apply that to those 100+ clients. We didn't like the idea to abuse ID-views like this especially after the client insisted that the res_staff group should be a nested group like this: dev-team -> res_staff + <insert a bunch of other groups> ops-team -> res_staff + <insert a bunch of other groups> . . . (I have to admit that after seeing and hearing about this, I considered telling my bosses to outright fire this customer) For a while everything worked but then logins started to fail. Upon examining, it turned out that id command would no longer return the full list of groups of a user and the "hardened" sshd config killed the login. After we cleared the SSSD caches and restarted SSSD, the logins would work for a while and id command would return all the groups where user belonged to. It is also worth mentioning that this client has a fetish for nested groups so it is not uncommon to see groups 4-5 "deep" and it is a general mess. Also: No AD trust here. Just ye olde IPA domain. The good thing is that the environment is extremely homogeneous. All the IPA servers CentOS 7.6 and the clients CentOS 7.x. We have the logs with debug level 6 but before I'll send them for examination, I would like to ask that is there a limitation/bug in the ID-views functionality where it fails when the anchor group is nested? Thank you. PS. Alexander, you are awesome.

1 1

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users November 2019