May 2019 - FreeIPA-users - Fedora mailing-lists

systemd thinks it or something wants ipa service
by lejeczek 10 May '19

10 May '19

hi guys I have no ipa configured, not even a client set up and yet I see something constantly wants IPA: May 09 16:06:19 swir.private. systemd[1]: ipa.service: main process exited, code=exited, status=6/NOTCONFIGURED May 09 16:06:19 swir.private. systemd[1]: Failed to start Identity, Policy, Audit. May 09 16:06:19 swir.private. systemd[1]: Unit ipa.service entered failed state. May 09 16:06:19 swir.private. systemd[1]: ipa.service failed. ^[May 09 16:06:49 swir.private. systemd[1]: Starting Identity, Policy, Audit... May 09 16:06:49 swir.private. ipactl[42053]: IPA is not configured (see man pages of ipa-server-install for help) May 09 16:06:49 swir.private. systemd[1]: ipa.service: main process exited, code=exited, status=6/NOTCONFIGURED May 09 16:06:49 swir.private. systemd[1]: Failed to start Identity, Policy, Audit. May 09 16:06:49 swir.private. systemd[1]: Unit ipa.service entered failed state. May 09 16:06:49 swir.private. systemd[1]: ipa.service failed. May 09 16:07:20 swir.private. systemd[1]: Starting Identity, Policy, Audit... May 09 16:07:20 swir.private. ipactl[42275]: IPA is not configured (see man pages of ipa-server-install for help) May 09 16:07:20 swir.private. systemd[1]: ipa.service: main process exited, code=exited, status=6/NOTCONFIGURED May 09 16:07:20 swir.private. systemd[1]: Failed to start Identity, Policy, Audit. May 09 16:07:20 swir.private. systemd[1]: Unit ipa.service entered failed state. May 09 16:07:20 swir.private. systemd[1]: ipa.service failed. May 09 16:07:51 swir.private. systemd[1]: Starting Identity, Policy, Audit... May 09 16:07:51 swir.private. ipactl[42503]: IPA is not configured (see man pages of ipa-server-install for help) May 09 16:07:51 swir.private. systemd[1]: ipa.service: main process exited, code=exited, status=6/NOTCONFIGURED May 09 16:07:51 swir.private. systemd[1]: Failed to start Identity, Policy, Audit. May 09 16:07:51 swir.private. systemd[1]: Unit ipa.service entered failed state. May 09 16:07:51 swir.private. systemd[1]: ipa.service failed. Is that normal and if not then what can be the problem? many thanks, L.

2 2

host does not match the primary host name - installing replica
by lejeczek 09 May '19

09 May '19

hi guys, this must be something trivial and I must have gone blind, can you spot what I missed? $ ipa-replica-install --setup-dns --no-forwarders --ip-address=10.5.8.65 WARNING: conflicting time&date synchronization service 'chronyd' will be disabled in favor of ntpd Your system may be partly configured. Run /usr/sbin/ipa-server-install --uninstall to clean up. ipapython.admintool: ERROR The host name rider.xxx does not match the primary host name rider-ring8.xxx. Please check /etc/hosts or DNS name resolution $ host -r 10.5.8.97 97.8.5.10.in-addr.arpa domain name pointer rider.xxx. 97.8.5.10.in-addr.arpa domain name pointer rider-ring8.xxx. $ host -r 10.5.8.49 49.8.5.10.in-addr.arpa domain name pointer whale.xxx. 49.8.5.10.in-addr.arpa domain name pointer whale-ring8.xxx. $ host rider-ring8.. rider-ring8. has address 10.5.8.97 $ host rider.. rider. has address 10.5.8.97 Primary hostname of the box replica-install complains of is rider.xxx. Why IPA thinks it is rider-ring8.xxx ? What can be wrong? many thanks, L.

2 4

ipa: ERROR: Certificate operation cannot be completed: Unable to communicate with CMS (500)
by H. Frenzel 09 May '19

09 May '19

Hi, trying to delete a host failed with "Unable to communicate with CMS (500)" # ipa host-del foo.bar.local ipa: ERROR: Certificate operation cannot be completed: Unable to communicate with CMS (500) Checking the pki logs shows "Subsystem unavailable" # /var/log/pki/pki-tomcat/localhost.YYYY-MM-DD.log SEVERE: Exception Processing /ca/rest/certs/search javax.ws.rs.ServiceUnavailableException: Subsystem unavailable Trying to troubleshoot it with help of https://floblanc.wordpress.com/2017/09/11/troubleshooting-freeipa-pki-tomca… shows an authentication error on LDAP (/var/log/pki/pki-tomcat/ca/debug), but debug it further failed in the part "Check the subsystemCert cert-pki-ca" The 1st command works: # certutil -L -d /etc/pki/pki-tomcat/alias -n 'subsystemCert cert-pki-ca' Certificate: Data: Version: 3 (0x2) Serial Number: 00:9f:ff:01:6c ... # grep internal= /var/lib/pki/pki-tomcat/conf/password.conf | cut -d= -f2 > /tmp/pwdfile.txt But then the private key can't been read: # certutil -K -d /etc/pki/pki-tomcat/alias -f /tmp/pwdfile.txt -n 'subsystemCert cert-pki-ca' certutil: Checking token "NSS Certificate DB" in slot "NSS User Private Key and Certificate Services" certutil: problem listing keys: SEC_ERROR_UNRECOGNIZED_OID: Unrecognized Object Identifier. # certutil -K -d /etc/pki/pki-tomcat/alias -f /tmp/pwdfile.txt -n 'NSS Certificate DB: subsystemCert cert-pki-ca' certutil: Checking token "NSS Certificate DB" in slot "NSS User Private Key and Certificate Services" certutil: problem listing keys: SEC_ERROR_UNRECOGNIZED_OID: Unrecognized Object Identifier. It looks as it's there: # certutil -K -d /etc/pki/pki-tomcat/alias -f /tmp/pwdfile.txt certutil: Checking token "NSS Certificate DB" in slot "NSS User Private Key and Certificate Services" < 0> rsa f7eXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX79c Server-Cert cert-pki-ca < 1> rsa 7e4XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX164 NSS Certificate DB:caSigningCert cert-pki-ca < 2> rsa f40XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX978 Server-Cert cert-pki-ca < 3> rsa 097XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXcca NSS Certificate DB:subsystemCert cert-pki-ca < 4> rsa 28cXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX8f9 (orphan) < 5> rsa 602XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX400 NSS Certificate DB:ocspSigningCert cert-pki-ca < 6> rsa b28XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX9fe NSS Certificate DB:auditSigningCert cert-pki-ca < 7> rsa 91cXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXb13 (orphan) What could be wrong here? Thanks in advance & b/r H.

2 6

commercial certificate expired
by Adrian HY 08 May '19

08 May '19

Hello all, My commercial certificate has expired today. The pki-tomcatd Service has stopped and I can´t to login at the web-gui. Is it possible to revert the original self signed certificate ? Thanks.

3 12

Trying to renew a revoked certificate
by Timothy Geier 08 May '19

08 May '19

Hello all, After going through rather nasty cert renewal issues ~2 years ago, I made sure to watch the next round of renewals very closely. Fortunately, just about everything renewed on schedule and automatically (a few certs needed the fix at https://rcritten.wordpress.com/2017/09/20/peer-certificate-cannot-be-authen… due to Invalid cookie: '' errors, though). The only remaining issue is with one cert that's showing the following: Request ID '20170609034302': status: MONITORING ca-error: Server at "http://$SERVER:8080/ca/ee/ca/profileSubmit" \ replied: Certificate serial number {0} to be renewed is revoked. \ Cannot renew a revoked certificate stuck: no key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias', \ nickname='Server-Cert cert-pki-ca',token='NSS Certificate DB',pin set certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias', \ nickname='Server-Cert cert-pki-ca', \ token='NSS Certificate DB' <snip> Said server is a CA replica and this cert has fortunately not yet expired yet (it has until about the end of the month)..after digging into it some more, I found the cert in the web interface where Revocation reason 4 was listed. That indicates that it was superseded (according to RFC 5280) but I don't know when or why this cert was revoked. Do I just need to use ipa-getcert request on 'Server-Cert cert-pki-ca' in /etc/pki/pki-tomcat/alias to create/install a new cert or is there something else that should be done here? Thanks,

1 1

deleted replica/master - can it be re added/connected?
by lejeczek 07 May '19

07 May '19

hi everyone. can a replica deleted with - ipa-replica-manage del - reconnected, re-added back to topology, somehow? many thanks, L.

2 3

upgrade 7 to 8
by Charles Hedrick 07 May '19

07 May '19

I see that RHEL 8 has been released. It has an in place upgrade option. How well (if at all) has inplace upgrade on an IPA server been tested?

2 1

free-ipa-client with otp (sssd) on linux laptop how to keep working on different networks.
by Jelle de Jong 06 May '19

06 May '19

Hello everybody, What would be the way to configure a linux laptop free-ipa-client (sssd) with freeipa users with otp (2fa) passwords, to keep working on other networks then the local lan of the freeipa server? Is there a sssd config option that can be used or port forwardings on firewalls? Kind regards, Jelle de Jong

2 2

input_userauth_request: invalid user on FreeIPA server
by Milos Cuculovic 06 May '19

06 May '19

We have one FreeIPA server and several clients. The ssh connection works well on clients, however this is not working on the server itslef. I can use the default ssh user (outside of the FreeIPA), however when trying to use a FreeIPA user to login over SSH, I’m getting: Invalid user xxxx from aaa.bbb.ccc.ddd input_userauth_request: invalid user xxxx [preauth] Connection closed by aaa.bbb.ccc.ddd port 64321 [preauth] Any idea? Do we need to explicitly enable the FreeIPA clients login on the FreeIPA server? Is there a possibility to get additional logs? Thank you. Milos.

2 1

Trust-Controller offline Trust-Agents not handling AD user Kerberos authentication
by David McDaniel 04 May '19

04 May '19

Environment: Single Site Two FreeIPA Idm Servers (1 Trust-Controller 1 Trust-Agent) We ran into an issue were our Trust-Controller was offline and Kerberos authentication began failing for AD users. We do not allow interactive password auth. via sshd_config on IPA clients, only Pubkey or GSSAPI. From the clients we could resolve AD users without issue but AD user Kerberos authentication was failing with error regarding KDC not reachable. Once we got the Trust-Controller back online, all was well and working again. Clearly our Trust-Controller was handling the KDC role in this use-case. Example of klist output after Trust-Controller was back online. Hostnames/Users changed to protect the innocent of course. Client: aduser @ AD-DOMAIN.COM Server: host/ipaclient.freeipadomain.com @ FREEIPADOMAIN.COM KerbTicket Encryption Type: AES-256-CTS-HMAC-SHA1-96 Ticket Flags 0x40a90000 -> forwardable renewable pre_authent name_canonicalize 0x80000 Start Time: 4/29/2019 6:35:26 (local) End Time: 4/29/2019 16:06:39 (local) Renew Time: 5/6/2019 6:06:39 (local) Session Key Type: AES-256-CTS-HMAC-SHA1-96 Cache Flags: 0 Kdc Called: freeipa-trust-controller.freeipadomain.com My question is this; since we are only doing Kerberos auth for AD users, is it necessary we add the Trust-Agent to some/all MSDCS SRV records within FreeIPA DNS for this to work, in the event Trust-Controller is offline? It's been awhile since needing to dig into FreeIPA, so perhaps I am missing something. Thanks -Dave

2 2

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users May 2019