May 2019 - FreeIPA-users - Fedora mailing-lists

What is transient error?
by Andrey Bondarenko 31 May '19

31 May '19

https://pagure.io/389-ds-base/pull-request/50072 says: "Transient errors are temporary conditions that usually resolve themselves." What are actually that errors are? We have some amount of them spreading somtimes. What causes them and what they actually affect or may affect in future? Can I ignore them in my automated checks at all? -- With best regards, Andrey Bondarenkomail:me@andreybondarenko.comhttps://andreybondarenko.com skype:andrey.bondarenko phone, Telegram, WhatsApp, etc:+420-773-591-443 7758 40AC 88CC 96C9 0C9A 9EE4 3B72 547B 7538 D41B

2 1

ipa server upgrade fails - dirsrv complains about Unknown attribute syntax OID
by Darac Marjal 30 May '19

30 May '19

Hello good people, Due to being unfamiliar with Fedora, my home FreeIPA server has been languishing on Fedora version 25 for ages. I recently twigged that it hadn't been updated in ages to upgraded to Fedora version 30. That seemed to go OK, but now, when I try to run ipactl start, I get the following: # ipactl start IPA version error: data needs to be upgraded (expected version '4.7.90.pre1-4.fc30', current version '4.4.4-1.fc25') Automatically running upgrade, for details see /var/log/ipaupgrade.log Be patient, this may take a few minutes. Automatic upgrade failed: IPA server upgrade failed: Inspect /var/log/ipaupgrade.log and run command ipa-server-upgrade manually. Unexpected error - see /var/log/ipaupgrade.log for details: CalledProcessError: CalledProcessError(Command ['/bin/systemctl', 'start', 'dirsrv(a)GHIBLI-DARAC-ORG-UK.service'] returned non-zero exit status 1: 'Job for dirsrv(a)GHIBLI-DARAC-ORG-UK.service failed because the control process exited with error code.\nSee "systemctl status dirsrv(a)GHIBLI-DARAC-ORG-UK.service" and "journalctl -xe" for details.\n') The ipa-server-upgrade command failed. See /var/log/ipaupgrade.log for more information See the upgrade log for more details and/or run /usr/sbin/ipa-server-upgrade again Aborting ipactl Looking into the logs for dirsrv@<REALM>, I see the following: May 29 20:30:52 yubaba.ghibli.darac.org.uk ns-slapd[9839]: [29/May/2019:20:30:52.917492045 +0100] - ERR - dse_read_one_file - The entry cn=schema in file /usr/share/dirsrv/schema/00core.ldif (lineno: 1) is invalid, error code > May 29 20:30:52 yubaba.ghibli.darac.org.uk ns-slapd[9839]: [29/May/2019:20:30:52.989705116 +0100] - ERR - setup_internal_backends - Please edit the file to correct the reported problems and then restart the server. May 29 20:30:53 yubaba.ghibli.darac.org.uk systemd[1]: dirsrv(a)GHIBLI-DARAC-ORG-UK.service: Main process exited, code=exited, status=1/FAILURE May 29 20:30:53 yubaba.ghibli.darac.org.uk systemd[1]: dirsrv(a)GHIBLI-DARAC-ORG-UK.service: Failed with result 'exit-code'. May 29 20:30:53 yubaba.ghibli.darac.org.uk systemd[1]: Failed to start 389 Directory Server GHIBLI-DARAC-ORG-UK.. Now, in an attempt to fix this, I spun up a new VM, installed freeipa-server and then copied /usr/share/dirsrv/schema/*.ldif over, but that doesn't seem do have had any effect. Can anyone assist in pointing me in a direction to fixing this? Many thanks!

4 6

ECC keypair generation failed with `ipa-server-instal` on HSM
by チョーチュアン 29 May '19

29 May '19

Hello, Recently I've been experimenting on HSM with FreeIPA, I got stuck at the CA generation, but it's a separate issue. I somehow achieve a successful key generation on HSM with default key_algorimth/size/ settings. RSA 3072/2048 keys showed up on the HSM even after a failed CA installation but not the case with ECC keys. The error was: Failed to configure CA instance: CalledProcessError(Command ['/usr/sbin/pkispawn', '-s', 'CA', '-f', '/tmp/tmp877ip58a'] returned non-zero exit status 1: pkihelper : ERROR Server unreachable due to SSL error: [SSL: SSLV3_ALERT_HANDSHAKE_FAILURE] sslv3 alert handshake failure (_ssl.c:1056) configuration : ERROR Server failed to restart pkispawn : ERROR Exception: server failed to restart File "/usr/lib/python3.7/site-packages/pki/server/pkispawn.py", line 547, in main scriptlet.spawn(deployer) File "/usr/lib/python3.7/site-packages/pki/server/deployment/scriptlets/configuration.py", line 670, in spawn raise Exception("server failed to restart") ') See the installation logs and the following files/directories for more information: /var/log/pki/pki-tomcat [error] RuntimeError: CA configuration failed. CA configuration failed. and configuration was: ``` [DEFAULT] ipa_key_algorithm=SHA256withEC ipa_key_size=nistp384 ipa_key_type=ecc ipa_signing_algorithm=SHA256withEC pki_ca_signing_key_size=nistp384 pki_hsm_enable=True pki_hsm_libfile=/usr/lib64/opensc-pkcs11.so pki_hsm_modulename=nitrohsm pki_token_name=UserPIN (SmartCard-HSM) pki_token_password=648219 pki_random_serial_numbers_enable=True ``` -- Regards, Quan Zhou F2999657195657205828D56F35F9E5CDBD86324B quanzhou822(a)gmail.com

4 4

SOA generation algorythm
by Andrey Bondarenko 29 May '19

29 May '19

Hello, Is the SOA generation algorithm for zones documented anywhere or anyone by chance knows what it is? We have cluster of 8 nodes and SOA is different on some IPAs in some zones (with huge amount of changes). But if I make a change I actually see it on different IPA. Also, restarting IPA increases SOA by 1. We wanted to relay on SOA on our DNS consistency check but seems like it's not a working idea, or is it? -- With best regards, Andrey Bondarenkomail:me@andreybondarenko.comhttps://andreybondarenko.com skype:andrey.bondarenko phone, Telegram, WhatsApp, etc:+420-773-591-443 7758 40AC 88CC 96C9 0C9A 9EE4 3B72 547B 7538 D41B

2 3

Re: zabbix for monitoring FreeIPA server?
by Alex Corcoles 29 May '19

29 May '19

The output of ipactl looks very similar to systemctl status. Is it doing much more than that? I'm already monitoring systemd failed units so I wonder if it's running checking ipactl. On Wed, Sep 19, 2018 at 1:33 PM Neal Harrington via FreeIPA-users < freeipa-users(a)lists.fedorahosted.org> wrote: > Hi Tony, > > > I'm monitoring using the following userparameter (basically run "ipactl > status" and grep out lines which are known good so only errors are > returned): > > > UserParameter=ipa.status,sudo /usr/sbin/ipactl status 2>&1 | egrep -v > "(INFO\: The ipactl command was successful$|: RUNNING$)" > > > ipactl needs root access so I have a file in /etc/sudoers.d/zabbix with > these lines to allow the zabbix user to sudo the ipactl status command only > without a password: > > > ## Allow zabix to query ipa status > Defaults:zabbix !requiretty > zabbix ALL = (root) NOPASSWD: /usr/sbin/ipactl status > > The final challenge I had was selinux which I had to create a custom rule > for (but most people seem to just disable selinux). > > > Then just create a trigger to alert if the returned value contains any > characters. eg this matches on any char apart from whitespace: > > {Custom Template IPA Server:ipa.status.regexp([^\s],1200)}=1 > > > If anyone else has a better way to do this I'd be interested to hear it. > > > Regards, > > Neal. > > > > > > ------------------------------ > *From:* Tony Brian Albers via FreeIPA-users < > freeipa-users(a)lists.fedorahosted.org> > *Sent:* 24 August 2018 10:50 > *To:* freeipa-users(a)lists.fedorahosted.org > *Cc:* Tony Brian Albers > *Subject:* [Freeipa-users] zabbix for monitoring FreeIPA server? > > Hi guys, > > Anyone got this working? > > And if so, how did you do it? > > I know I can monitor the components separately, but if you know of > anything that can do it easier I'd be happy to know about it. > > /tony > -- > -- > Tony Albers > Systems administrator, IT-development > Royal Danish Library, Victor Albecks Vej 1, 8000 Aarhus C, Denmark. > Tel: +45 2566 2383 / +45 8946 2316 > _______________________________________________ > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org > To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org > Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: > https://lists.fedoraproject.org/archives/list/freeipa-users@lists.fedorahos… > _______________________________________________ > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org > To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org > Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: > https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost… > -- ___ {~._.~} ( Y ) ()~*~() mail: alex at corcoles dot net (_)-(_) http://alex.corcoles.net/

3 4

Mapping freeipa's groups over AD
by Lucas Diedrich 28 May '19

28 May '19

Hello guys, i found lots of tutorials helping on how to map AD (Active Directory) users over Freeipa as seen here: https://jamalshahverdiev.wordpress.com/2017/09/09/integration-freeipa-in-ce… and http://prolinuxhub.com/integrate-freeipa-with-windows-2016-active-directory/ My question is, can i make the other way around? I wan't to map the Freeipa Group (Admin) as admin over the Active Directory. Can i? I've already setup an transient two-way trust between both, authentication works nice for freeipa users over AD. I just want to setup admin users for the windows workstations. Thanks.

5 9

Active Directory Integration advise
by Prashant Bapat 27 May '19

27 May '19

Hi All, I’m to setup FreeIPA in my organization to be the central directory for users/group/SSH keys and maybe sudo rules. All the users and groups are already present in Windows Active Directory. So far I’ve tried setting up AD Trust but this does not get the users in AD to login to web UI of FreeIPA. I have looked at Passync as well but as per the docs only users will be synced that too only on a password change and groups won’t be. To give you more details below is my use case. 1. The users and groups are in AD. 2. A user in AD should be able to login to FreeIPA web UI using AD password and manage their SSH keys. 3. Groups on AD should reflect in FreeIPA. Appreciate if anyone can point me in the right direction. Regards. --Prashant

2 4

upgrade freeipa from version 4.1.4 to 4.6.4
by Fritjof Konkas 26 May '19

26 May '19

I have a old version of freeipa server version 4.1.4 running on fedora 22. Is it possible to migrate the data from ditto to version 4.6.4 on another server running centos 7? /Fritjof

2 1

sudo rule does not work for domain user
by Rob Verduijn 24 May '19

24 May '19

Hello, I'm trying to figure out why an ad-domain user cannot use sudo. When I test with ipa hbactest --user=ansible --host ipa01.linux.example.com --service sudo-i It says access granted: True however if I issue the command 'sudo -l -U ansible' on the ipa01 host it says:User ansible(a)windows.example.com is not allowed to run sudo on ipa01 It works for an ipa user using the same sudo rule. id ansible works as well on the ipa01 host uid=1958801104(ansible(a)windows.example.com) gid=1958801104( ansible(a)windows.example.com) groups=1958801104(ansible(a)windows.example.com),1958800512(domain admins(a)windows.example.com),1958800513(domain users(a)windows.example.com) the user ansible can login to the ipa01 host but cannot issue sudo -i. What am I missing ? Rob Verduijn

2 1

zabbix for monitoring FreeIPA server?
by Tony Brian Albers 24 May '19

24 May '19

Hi guys, Anyone got this working? And if so, how did you do it? I know I can monitor the components separately, but if you know of anything that can do it easier I'd be happy to know about it. /tony -- -- Tony Albers Systems administrator, IT-development Royal Danish Library, Victor Albecks Vej 1, 8000 Aarhus C, Denmark. Tel: +45 2566 2383 / +45 8946 2316

3 3

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users May 2019