August 2019 - FreeIPA-users - Fedora mailing-lists

Enroll & Install IPA Client on Redhat 5.4 with IPA Server on 4.6.4
by Karim Bourenane 08 Aug '19

08 Aug '19

Hello Team Can you tell me, if i can enroll a old Redhat 5.4 Tikanga i386 (kernel v:2.6.18-164) to IPA Server 4.6.4 ? I yes, can you please give the steps or link to do please ? Thanks you Mr Karim Bourenane

2 3

ipa user-del and UI fails, as well, ldapdelete
by Sandor Juhasz 08 Aug '19

08 Aug '19

We have an entry, what after clicking delete on the UI got partially deleted. The compat tree entry is gone. The accounts tree entry is there. ldapsearch finds the entry by uid, but does fail by dn. ipa user-show <USERID> finds the user ipa user-del <USERID> says no such user ldapdelete fails to delete the entry by dn with err=32 Web ui shows user User content can be modified from ipa cli and web ui - like name, shell, but cannot be deleted Other entries can be created and deleted without issue. We have 4way master-master replication. Tried cli on 3 and got same result and issue. The third is not touched and the entry is available there both accounts and compat tree. ipa-server-4.6.4-10.el7.centos.3.x86_64 CentOS Linux release 7.6.1810 (Core) On full broken master: # <USERID>, users, accounts, cxn dn: uid=<USERID>,cn=users,cn=accounts,dc=cxn gecos: FOO BAR displayName: FOO BAR krbLastAdminUnlock: 20190807124134Z krbLoginFailedCount: 0 memberOf: cn=ipausers,cn=groups,cn=accounts,dc=cxn memberOf: cn=somegroup1,cn=groups,cn=accounts,dc=cxn memberOf: cn=somegroupt2,cn=groups,cn=accounts,dc=cxn gidNumber: <GID> uidNumber: <UID> ipaUniqueID: <RANDOMUNIQUEID> cn: BAZ givenName: FOO krbPrincipalName: <USERID>@CXN mail: <MAIL> homeDirectory: /home/<USERID> sn: BAR initials: cU loginShell: /bin/false objectClass: ipaobject objectClass: person objectClass: top objectClass: ipasshuser objectClass: inetorgperson objectClass: organizationalperson objectClass: krbticketpolicyaux objectClass: krbprincipalaux objectClass: inetuser objectClass: posixaccount objectClass: ipaSshGroupOfPubKeys objectClass: mepOriginEntry krbCanonicalName: <USERID>@CXN uid: <USERID> mepManagedEntry: cn=<USERID>,cn=groups,cn=accounts,dc=cxn krbPasswordExpiration: 20170615133527Z krbLastPwdChange: 20170615133527Z krbExtraData:: AAIfjUJZcm9vdC9hZG1pbkBDWE4A On untouched master: # <USERID>, users, compat, cxn dn: uid=<USERID>,cn=users,cn=compat,dc=cxn objectClass: posixAccount objectClass: ipaOverrideTarget objectClass: top gecos: BAZ cn: BAZ uidNumber: <UID> gidNumber: <GID> loginShell: /bin/false homeDirectory: /home/<USERID> ipaAnchorUUID:: somerandomuuid uid: <USERID> # <USERID>, users, accounts, cxn dn: uid=<USERID>,cn=users,cn=accounts,dc=cxn gecos: FOO BAR displayName: FOO BAR krbLastAdminUnlock: 20190807124134Z memberOf: cn=ipausers,cn=groups,cn=accounts,dc=cxn memberOf: cn=group1,cn=groups,cn=accounts,dc=cxn memberOf: cn=group2,cn=groups,cn=accounts,dc=cxn gidNumber: <GID> krbExtraData:: AAIfjUJZcm9vdC9hZG1pbkBDWE4A krbLastPwdChange: 20170615133527Z krbPasswordExpiration: 20170615133527Z mepManagedEntry: cn=<USERID>,cn=groups,cn=accounts,dc=cxn uid: <USERID> krbCanonicalName: <USERID>@CXN objectClass: ipaobject objectClass: person objectClass: top objectClass: ipasshuser objectClass: inetorgperson objectClass: organizationalperson objectClass: krbticketpolicyaux objectClass: krbprincipalaux objectClass: inetuser objectClass: posixaccount objectClass: ipaSshGroupOfPubKeys objectClass: mepOriginEntry loginShell: /bin/false initials: cU sn: BAR homeDirectory: /home/<USERID> mail: <MAIL> krbPrincipalName: <USERID>@CXN givenName: FOO cn: BAZ ipaUniqueID: randomuniqueid uidNumber: <UID> -- *Sándor Juhász* System Administrator *ChemAxon* *Kft*. Building Hx, GraphiSoft Park, Záhony utca 7, Budapest, Hungary, H-1031 Cell: +36704258964

3 9

Unable to perform cross forest trust with AD
by Darvid Kairne 07 Aug '19

07 Aug '19

Attempting to create a one-way trust from freeIPA to AD. Both are fresh installations and up to date. ADDS on 2k19 and FreeIPA on CentOS 7. After running `ipa-adtrust-install` running 'smbclient -L ipaserver.ipa.example.net -k' only returns `Reconnecting with SMB1 for workgroup listing.` The error I receive when running `ipa trust-add` is `ipa: ERROR: an internal error has occurred`. At this point the trust appears in the incoming trusts in AD. Both firewalls disabled. Both realms have integrated dns and conditional forwarders set up. All SRV records are resolvable in both directions. I manually created `_kerberos._udp.dc._msdcs.ad.example.com.` as it was not present.

2 2

CA Master Confusion
by Auerbach, Steven 06 Aug '19

06 Aug '19

As I work through understanding the current state of my CA mastering in this realm I am getting results I do not understand from these ipa commands (on the v4.6.4 server) and from the ldapsearch commands (on the v3.0.0 server): On the v4.6.4 replica (ipa<3>): $ sudo ipa config-show |grep 'CA renewal master' [sudo] password for <user>: $ $ On the v3.0.0 (ipa<1>): $ sudo ldapsearch -H ldap://$HOSTNAME -D 'cn=Directory Manager' -W -b 'cn=masters,cn=ipa,cn=etc,dc=fbog,dc=local' '(&(cn=CA)(ipaConfigString=caRenewalMaster))' dn [sudo] password for <user>: Enter LDAP Password: # extended LDIF # # LDAPv3 # base <cn=masters,cn=ipa,cn=etc,dc=<mydomain>,dc=local> with scope subtree # filter: (&(cn=CA)(ipaConfigString=caRenewalMaster)) # requesting: dn # # search result search: 2 result: 0 Success # numResponses: 1 Neither tells me anything. Is it possible that the original installation never had a CA master at all? This seems odd considering when I look for CA Master(s), on the v4.6.4 (ipa<3>) tells me: $ sudo ipa server-role-find --role 'CA server' [sudo] password for <user>: ---------------------- 3 server roles matched ---------------------- Server name: ipa<2>.mydomain.local Role name: CA server Role status: absent Server name: ipa<1>.mydomain.local Role name: CA server Role status: enabled Server name: ipa<3>.mydomain.local Role name: CA server Role status: absent ---------------------------- Number of entries returned 3 ---------------------------- And on the v3.0.0 (ipa<1>) I get: $ sudo ldapsearch -H ldap://$HOSTNAME -D 'cn=Directory Manager' -W -b 'cn=masters,cn=ipa,cn=etc,dc=<mydomain>,dc=local' '(&(cn=CA)(ipaConfigString=caServer))' dn Enter LDAP Password: # extended LDIF # # LDAPv3 # base <cn=masters,cn=ipa,cn=etc,dc=fbog,dc=local> with scope subtree # filter: (&(cn=CA)(ipaConfigString=caServer)) # requesting: dn # # search result search: 2 result: 0 Success # numResponses: 1 I know I am missing something basic and fundamental here. Is there a CA Master or not? If not, would I want to just enable the CA Master on the newest server (ipa<3>)? The way forward is not clear. -Steven Auerbach

1 0

[IPA4.6.4 with VCSA6.7] LDAP Authentification
by Karim Bourenane 06 Aug '19

06 Aug '19

Hello All, Do someone know i must configure my IPA server + the VCenter VSCA to authenticate in LDAP ? I found several demo, but nothing run. Thanks you in advance. Regard Mr Karim Bourenane

3 5

Re: Replacing IPA v3.0.0-51 on OEL6 with IPA v4.6.4-10 on OEL7: Making the newest replica the master
by François Cami 06 Aug '19

06 Aug '19

On Tue, Aug 6, 2019 at 3:55 PM Auerbach, Steven <Steven.Auerbach(a)flbog.edu> wrote: > > Pure genius. FQDN on ipa commands..... Unless I read the documentation cover-to-cover before starting anything I would never have found this. Thanks. Our (collective) pleasure to help. Thanks for thanking us :) François > -Steven Auerbach > > -----Original Message----- > From: François Cami <fcami(a)redhat.com> > Sent: Tuesday, August 6, 2019 9:28 AM > To: FreeIPA users list <freeipa-users(a)lists.fedorahosted.org> > Cc: Rob Crittenden <rcritten(a)redhat.com>; Auerbach, Steven <Steven.Auerbach(a)flbog.edu> > Subject: Re: [Freeipa-users] Re: Replacing IPA v3.0.0-51 on OEL6 with IPA v4.6.4-10 on OEL7: Making the newest replica the master > > On Tue, Aug 6, 2019 at 2:59 PM Auerbach, Steven via FreeIPA-users <freeipa-users(a)lists.fedorahosted.org> wrote: > > > > When I add the --no-lookup option on the v4.6.4 ipa server I get the same results I received on the v3.0.0 server: > > " Cannot find ipa<#> in public server list" > > Are you using the FQDN of your IPA servers? > The ipa-replica-manage command will not find IPA servers by their shortnames (and that's expected). > > > > If I cannot even verify these servers in the group, how am I supposed to test the integrity of current inter-version replication? And how will I ever migrate the whole directory and all the inter-related services of IPA to two new servers of version 4.6.4? The functions do not appear to work as documented, and my trust that the command operations will behave as documented is really shaken. > > > > Is my best option to build a new IPA server pair in version 4.6.4 and de-enroll all the clients and users from the older v3.0.0 IPA and then enroll them into the v4.6.4 IPA? > > > > -----Original Message----- > > From: Rob Crittenden <rcritten(a)redhat.com> > > Sent: Monday, August 5, 2019 5:16 PM > > To: FreeIPA users list <freeipa-users(a)lists.fedorahosted.org> > > Cc: Auerbach, Steven <Steven.Auerbach(a)flbog.edu> > > Subject: Re: [Freeipa-users] Re: Replacing IPA v3.0.0-51 on OEL6 with > > IPA v4.6.4-10 on OEL7: Making the newest replica the master > > > > Auerbach, Steven via FreeIPA-users wrote: > > > From the master-master original IPA v3.0.0 server - <ipa1> - I ran and received the following responses: > > > NOTE: using aliases within arrow points for ambiguation. > > > > > > [<user>@<ipa1> ~]$ sudo ipa-replica-manage list -v '<ipa1>' > > > [sudo] password for <user>: > > > Cannot find <ipa1> in public server list > > > > > > [<user>@<ipa1> ~]$ sudo ipa-replica-manage list -v '<ipa2>' > > > Directory Manager password: > > > > > > Cannot find <ipa2> in public server list > > > > > > [<user>@<ipa1> ~]$ sudo ipa-replica-manage list -v '<ipa3>' > > > Directory Manager password: > > > > > > Cannot find <ipa3> in public server list > > > > It is looking for the list of masters in cn=masters,cn=ipa,cn=etc,dc=example,dc=com. I'd search that to see what is there. > > > > A plain ipa-replica-manage list will list all masters and IIRC they do show. > > > > > From the replica-master server recently made with IPA v4.6.5 - <ipa3> - I ran and received the following responses: > > > NOTE: using aliases within arrow points for ambiguation. > > > > > > [<user>@<ipa3> ~]$ sudo ipa-replica-manage list -v '<ipa1>' > > > [sudo] password for <user>: > > > Unknown host <ipa1>: Host '<ipa1>' does not have corresponding DNS > > > A/AAAA record > > > > > > [<user>@<ipa3> ~]$ sudo ipa-replica-manage list -v '<ipa2>' > > > Directory Manager password: > > > > > > Unknown host ipa-r02: Host 'ipa-r02' does not have corresponding DNS > > > A/AAAA record > > > > > > [<user>@<ipa3> ~]$ sudo ipa-replica-manage list -v '<ipa3>' > > > Directory Manager password: > > > > > > Unknown host ipa03: Host 'ipa03' does not have corresponding DNS > > > A/AAAA record > > > > Try adding --no-lookup to the command to skip the lookup. > > > > rob > > > > > > > > > > > > > > Steven Auerbach > > > Assistant Director of Information Systems Information Technology & > > > Security State University System of Florida Board of Governors > > > 325 W. Gaines Street, Suite 1625 > > > Tallahassee, Florida 32399 > > > (850) 245-9592 > > > Steven.auerbach(a)flbog.edu > > >

1 0

Re: Replacing IPA v3.0.0-51 on OEL6 with IPA v4.6.4-10 on OEL7: Making the newest replica the master
by François Cami 06 Aug '19

06 Aug '19

On Tue, Aug 6, 2019 at 2:59 PM Auerbach, Steven via FreeIPA-users <freeipa-users(a)lists.fedorahosted.org> wrote: > > When I add the --no-lookup option on the v4.6.4 ipa server I get the same results I received on the v3.0.0 server: > " Cannot find ipa<#> in public server list" Are you using the FQDN of your IPA servers? The ipa-replica-manage command will not find IPA servers by their shortnames (and that's expected). > If I cannot even verify these servers in the group, how am I supposed to test the integrity of current inter-version replication? And how will I ever migrate the whole directory and all the inter-related services of IPA to two new servers of version 4.6.4? The functions do not appear to work as documented, and my trust that the command operations will behave as documented is really shaken. > > Is my best option to build a new IPA server pair in version 4.6.4 and de-enroll all the clients and users from the older v3.0.0 IPA and then enroll them into the v4.6.4 IPA? > > -----Original Message----- > From: Rob Crittenden <rcritten(a)redhat.com> > Sent: Monday, August 5, 2019 5:16 PM > To: FreeIPA users list <freeipa-users(a)lists.fedorahosted.org> > Cc: Auerbach, Steven <Steven.Auerbach(a)flbog.edu> > Subject: Re: [Freeipa-users] Re: Replacing IPA v3.0.0-51 on OEL6 with IPA v4.6.4-10 on OEL7: Making the newest replica the master > > Auerbach, Steven via FreeIPA-users wrote: > > From the master-master original IPA v3.0.0 server - <ipa1> - I ran and received the following responses: > > NOTE: using aliases within arrow points for ambiguation. > > > > [<user>@<ipa1> ~]$ sudo ipa-replica-manage list -v '<ipa1>' > > [sudo] password for <user>: > > Cannot find <ipa1> in public server list > > > > [<user>@<ipa1> ~]$ sudo ipa-replica-manage list -v '<ipa2>' > > Directory Manager password: > > > > Cannot find <ipa2> in public server list > > > > [<user>@<ipa1> ~]$ sudo ipa-replica-manage list -v '<ipa3>' > > Directory Manager password: > > > > Cannot find <ipa3> in public server list > > It is looking for the list of masters in cn=masters,cn=ipa,cn=etc,dc=example,dc=com. I'd search that to see what is there. > > A plain ipa-replica-manage list will list all masters and IIRC they do show. > > > From the replica-master server recently made with IPA v4.6.5 - <ipa3> - I ran and received the following responses: > > NOTE: using aliases within arrow points for ambiguation. > > > > [<user>@<ipa3> ~]$ sudo ipa-replica-manage list -v '<ipa1>' > > [sudo] password for <user>: > > Unknown host <ipa1>: Host '<ipa1>' does not have corresponding DNS > > A/AAAA record > > > > [<user>@<ipa3> ~]$ sudo ipa-replica-manage list -v '<ipa2>' > > Directory Manager password: > > > > Unknown host ipa-r02: Host 'ipa-r02' does not have corresponding DNS > > A/AAAA record > > > > [<user>@<ipa3> ~]$ sudo ipa-replica-manage list -v '<ipa3>' > > Directory Manager password: > > > > Unknown host ipa03: Host 'ipa03' does not have corresponding DNS > > A/AAAA record > > Try adding --no-lookup to the command to skip the lookup. > > rob > > > > > > > > > Steven Auerbach > > Assistant Director of Information Systems Information Technology & > > Security State University System of Florida Board of Governors > > 325 W. Gaines Street, Suite 1625 > > Tallahassee, Florida 32399 > > (850) 245-9592 > > Steven.auerbach(a)flbog.edu > > > > _______________________________________________ > > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org > > To unsubscribe send an email to > > freeipa-users-leave(a)lists.fedorahosted.org > > Fedora Code of Conduct: > > https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdocs > > .fedoraproject.org%2Fen-US%2Fproject%2Fcode-of-conduct%2F&data=02% > > 7C01%7CSteven.Auerbach%40flbog.edu%7C4f2f8ff3a0be4ddb3c8d08d719ea0d02% > > 7C63bf107bcb6f41738c1c1406bb5cb794%7C0%7C0%7C637006365346901243&sd > > ata=Cxz0ohxpRe51I%2FSImlMCpbkmVKehGKn%2BzcBzbQaUS5E%3D&reserved=0 > > List Guidelines: > > https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Ffedo > > raproject.org%2Fwiki%2FMailing_list_guidelines&data=02%7C01%7CStev > > en.Auerbach%40flbog.edu%7C4f2f8ff3a0be4ddb3c8d08d719ea0d02%7C63bf107bc > > b6f41738c1c1406bb5cb794%7C0%7C0%7C637006365346911237&sdata=GWg7INn > > f%2FptaoK5HoSjC62DsshZ0VoF%2BHieWgFOxkGg%3D&reserved=0 > > List Archives: > > https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Flist > > s.fedorahosted.org%2Farchives%2Flist%2Ffreeipa-users%40lists.fedorahos > > ted.org&data=02%7C01%7CSteven.Auerbach%40flbog.edu%7C4f2f8ff3a0be4 > > ddb3c8d08d719ea0d02%7C63bf107bcb6f41738c1c1406bb5cb794%7C0%7C0%7C63700 > > 6365346911237&sdata=F6pb9RhzSs7Yd%2BJGLoPN%2BYnlZ7f%2F1IZJfTXwZlnh > > d5k%3D&reserved=0 > > > > _______________________________________________ > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org > To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org > Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost…

2 1

Re: Replacing IPA v3.0.0-51 on OEL6 with IPA v4.6.4-10 on OEL7: Making the newest replica the master
by Rob Crittenden 06 Aug '19

06 Aug '19

Auerbach, Steven via FreeIPA-users wrote: > From the master-master original IPA v3.0.0 server - <ipa1> - I ran and received the following responses: > NOTE: using aliases within arrow points for ambiguation. > > [<user>@<ipa1> ~]$ sudo ipa-replica-manage list -v '<ipa1>' > [sudo] password for <user>: > Cannot find <ipa1> in public server list > > [<user>@<ipa1> ~]$ sudo ipa-replica-manage list -v '<ipa2>' > Directory Manager password: > > Cannot find <ipa2> in public server list > > [<user>@<ipa1> ~]$ sudo ipa-replica-manage list -v '<ipa3>' > Directory Manager password: > > Cannot find <ipa3> in public server list It is looking for the list of masters in cn=masters,cn=ipa,cn=etc,dc=example,dc=com. I'd search that to see what is there. A plain ipa-replica-manage list will list all masters and IIRC they do show. > From the replica-master server recently made with IPA v4.6.5 - <ipa3> - I ran and received the following responses: > NOTE: using aliases within arrow points for ambiguation. > > [<user>@<ipa3> ~]$ sudo ipa-replica-manage list -v '<ipa1>' > [sudo] password for <user>: > Unknown host <ipa1>: Host '<ipa1>' does not have corresponding DNS A/AAAA record > > [<user>@<ipa3> ~]$ sudo ipa-replica-manage list -v '<ipa2>' > Directory Manager password: > > Unknown host ipa-r02: Host 'ipa-r02' does not have corresponding DNS A/AAAA record > > [<user>@<ipa3> ~]$ sudo ipa-replica-manage list -v '<ipa3>' > Directory Manager password: > > Unknown host ipa03: Host 'ipa03' does not have corresponding DNS A/AAAA record Try adding --no-lookup to the command to skip the lookup. rob > > > > Steven Auerbach > Assistant Director of Information Systems > Information Technology & Security > State University System of Florida > Board of Governors > 325 W. Gaines Street, Suite 1625 > Tallahassee, Florida 32399 > (850) 245-9592 > Steven.auerbach(a)flbog.edu > > _______________________________________________ > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org > To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org > Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost… >

2 1

Re: Replacing IPA v3.0.0-51 on OEL6 with IPA v4.6.4-10 on OEL7: Making the newest replica the master
by Rob Crittenden 05 Aug '19

05 Aug '19

Auerbach, Steven via FreeIPA-users wrote: > I am struggling through this. I have a new server built and IPA 4.6.4-10 > installed. I made it a replica from the v3.0.0-51 master. I can't tell the context in which these commands are being executed, on which master. What I would do instead is on each master run: # ipa-replica-manage list -v `hostname` This should provide the topology you are looking for. rob > > > > Ipa-replica-manage shows 3 ipa servers, the original 2 v3.0.0-51 servers > and the new ipa v4.6.4-10 server. But when I poll for replication > agreements I get no answer. > > > > From <server1> I issued the following commands: > > $ sudo ipa-replica-manage list > > Directory Manager password: > > > > <server1>.mydomain.local: master > > <server2>.mydomain.local: master > > <server3 – new>.mydomain.local: master > > > > $ sudo ipa-replica-manage list <server2> > > [sudo] password for <user>: > > Cannot find servername in public server list > > > > $ sudo ipa-replica-manage list <server3> > > [sudo] password for <user>: > > Cannot find servername in public server list > > > > $ ldapsearch -x -D 'cn=directory manager' -W -b 'cn=mapping tree,cn=config' > > Enter LDAP Password: > > > > There is an extensive response that includes: > > # dc\3Dmydomain\2Cdc\3Dlocal, mapping tree, config > > . > > . > > nsslapd-referral: > ldap://<server3>.mydomain..local:389/dc%3Dmydomain%2Cdc%3Dlocal > > nsslapd-referral: > ldap://<server2>.mydomain.local:389/dc%3Dmydomain%2Cdc%3Dlocal > > > > # replica, dc\3Dmydomain\2Cdc\3Dlocal, mapping tree, config > > dn: cn=replica,cn=dc\3Dmydomain\2Cdc\3Dlocal,cn=mapping tree,cn=config > > cn: replica > > nsDS5Flags: 1 > > objectClass: top > > objectClass: nsds5replica > > objectClass: extensibleobject > > nsDS5ReplicaType: 3 > > nsDS5ReplicaRoot: dc=mydomain,dc=local > > nsds5ReplicaLegacyConsumer: off > > nsDS5ReplicaId: 4 > > nsDS5ReplicaBindDN: cn=replication manager,cn=config > > nsDS5ReplicaBindDN: krbprincipalname=ldap/<invalid, removed server that > should not even appear > here>.mydomain.local(a)MYDOMAIN.LOCAL,cn=services,cn=accounts,dc=mydomain,dc=local > > nsDS5ReplicaBindDN: > krbprincipalname=ldap/<server2>.mydomain.local(a)MYDOMAIN.LOCAL,cn=services,cn=accounts,dc=mydomain,dc=local > > nsDS5ReplicaBindDN: > krbprincipalname=ldap/<server3>.mydomain.local(a)MYDOMAIN.LOCAL,cn=services,cn=accounts,dc=mydomain,dc=local > > nsState:: BAAAAAAAAAA+CUNdAAAAAGEAAAAAAAAAkgAAAAAAAAAEAAAAAAAAAA== > > nsDS5ReplicaName: a5641a0e-252711e3-96afcc83-6ff9b802 > > nsds5ReplicaChangeCount: 3768023 > > nsds5replicareapactive: 0 > > > > # meTo<server2>.mydomain.local, replica, dc\3Dmydomain\2Cdc\3Dlocal, > mapping tree, config > > dn: > cn=meTo<server2>.mydomain.local,cn=replica,cn=dc\3Dmydomain\2Cdc\3Dlocal,cn=mapping > tree,cn=config > > cn: meTo<server2>.mydomain.local > > objectClass: nsds5replicationagreement > > objectClass: top > > nsDS5ReplicaTransportInfo: LDAP > > description: me to <server2>.mydomain.local > > nsDS5ReplicaRoot: dc=mydomain,dc=local > > nsDS5ReplicaHost: <server2>.mydomain.local > > nsds5replicaTimeout: 120 > > nsDS5ReplicaPort: 389 > > nsDS5ReplicatedAttributeList: (objectclass=*) $ EXCLUDE memberof > idnssoaserialentryusn krblastsuccessfulauth krblastfailedauth > krbloginfailedcount > > nsDS5ReplicaBindMethod: SASL/GSSAPI > > nsDS5ReplicatedAttributeListTotal: (objectclass=*) $ EXCLUDE entryusn > krblastsuccessfulauth krblastfailedauth krbloginfailedcount > > nsds50ruv: {replicageneration} 5241a52a000000040000 > > nsds50ruv: {replica 7 ldap://<server2>.mydomain.local:389} > 54c80f57000000070000 5d271a1b000700070000 > > nsds50ruv: {replica 4 ldap://<server1>.mydomain.local:389} > 5241a584000800040000 5d271866000300040000 > > nsds50ruv: {replica 8 ldap://<server3>.mydomain.local:389} > 5d166840000000080000 5d270db6000500080000 > > nsruvReplicaLastModified: {replica 7 > ldap://<server2>.mydomain.local:389} 00000000 > > nsruvReplicaLastModified: {replica 4 > ldap://<server1>.mydomain.local:389} 00000000 > > nsruvReplicaLastModified: {replica 8 > ldap://<server3>.mydomain.local:389} 00000000 > > nsds5ReplicaStripAttrs: modifiersName modifyTimestamp > internalModifiersName internalModifyTimestamp > > nsds5replicareapactive: 0 > > nsds5replicaLastUpdateStart: 20190801154606Z > > nsds5replicaLastUpdateEnd: 20190801154607Z > > nsds5replicaChangesSentSinceStartup:: NDo2MDAvMjI1MjE1OSA4OjM1OS8wIA== > > nsds5replicaLastUpdateStatus: 0 Replica acquired successfully: > Incremental update succeeded > > nsds5replicaUpdateInProgress: FALSE > > nsds5replicaLastInitStart: 0 > > nsds5replicaLastInitEnd: 0 > > > > # meTo<server3>.mydomain.local, replica, dc\3Dmydomain\2Cdc\3Dlocal, > mapping tree, config > > dn: > cn=meTo<server3>.mydomain.local,cn=replica,cn=dc\3Dmydomain\2Cdc\3Dlocal,cn=mapping > tree,cn=config > > cn: meTo<server3>.mydomain.local > > objectClass: nsds5replicationagreement > > objectClass: top > > nsDS5ReplicaTransportInfo: LDAP > > nsds5ReplicaStripAttrs: modifiersName modifyTimestamp > internalModifiersName in > > ternalModifyTimestamp > > nsDS5ReplicaRoot: dc=mydomain,dc=local > > nsDS5ReplicaHost: <server3>.mydomain.local > > nsds5replicaTimeout: 120 > > nsDS5ReplicaPort: 389 > > nsDS5ReplicaBindMethod: SASL/GSSAPI > > nsDS5ReplicatedAttributeList: (objectclass=*) $ EXCLUDE memberof > idnssoaserialentryusn krblastsuccessfulauth krblastfailedauth > krbloginfailedcount > > description: me to <server3>.mydomain.local > > nsDS5ReplicatedAttributeListTotal: (objectclass=*) $ EXCLUDE entryusn > krblastsuccessfulauth krblastfailedauth krbloginfailedcount > > nsds50ruv: {replicageneration} 5241a52a000000040000 > > nsds50ruv: {replica 8 ldap://<server3>.mydomain.local:389} > 5d166840000000080000 5d271a1b000000080000 > > nsds50ruv: {replica 4 ldap://<server1>.mydomain.local:389} > 5241a584000800040000 5d271866000300040000 > > nsds50ruv: {replica 7 ldap://<server2>.mydomain.local:389} > 54c80f57000000070000 5d2717a3000300070000 > > nsruvReplicaLastModified: {replica 8 > ldap://<server3>.mydomain.local:389} 00000000 > > nsruvReplicaLastModified: {replica 4 > ldap://<server1>.mydomain.local:389} 00000000 > > nsruvReplicaLastModified: {replica 7 > ldap://<server2>.mydomain.local:389} 00000000 > > nsds5replicareapactive: 0 > > nsds5replicaLastUpdateStart: 20190801154606Z > > nsds5replicaLastUpdateEnd: 20190801154607Z > > nsds5replicaChangesSentSinceStartup:: NDo2MDAvMTkyNTgzNyA3OjUxMi8wIA== > > nsds5replicaLastUpdateStatus: 0 Replica acquired successfully: > Incremental update succeeded > > nsds5replicaUpdateInProgress: FALSE > > nsds5replicaLastInitStart: 0 > > nsds5replicaLastInitEnd: 0 > > > > # search result > > search: 2 > > result: 0 Success > > > > # numResponses: 6 > > # numEntries: 5 > > > > Are there no replication agreements between these servers or is there > something missing in “public server list” that the agreements cannot be > found? > > > > I imagine that all parts need to be seeing each other properly at this > point before I even begin to try and make <server3> the new ultimate > master. I will then add a <server4> ipa server and replicate it from > <server3> once it is the master and retire <server1> and <server2>. At > least that is the scope of the project. > > > > Steven Auerbach > > Assistant Director of Information Systems > > Information Technology & Security > > State University System of Florida > > Board of Governors > > 325 W. Gaines Street, Suite 1625 > > Tallahassee, Florida 32399 > > (850) 245-9592 > > Steven.auerbach(a)flbog.edu <mailto:Steven.auerbach@flbog.edu> | > www.flbog.edu <http://www.flbog.edu/> > > email_sig > > > > > > _______________________________________________ > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org > To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org > Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost… >

2 1

How to get IPA client log data
by Boyd Ako 05 Aug '19

05 Aug '19

Anybody know how to get more log information on what the IPA client does? I already know about the stuff in /var/log/sssd, but I'm looking for something in regards to dynamic dns updates failing. When I ran `ipa-client-install` with the --enable-dns-updates option it kicked out an error saying it couldn't update the dns record. It doesn't show up in the server; obviously. I checked the ipaclient-install.log and tried to run the `nsupdate` command with a recreated command file or what ever. At best I got the following.... ============================== [root@luna ipa]# klist Ticket cache: KEYRING:persistent:0:0 Default principal: admin(a)NEVERLAND.DDNS.ME Valid starting Expires Service principal 08/01/2019 02:04:26 08/02/2019 02:04:20 krbtgt/NEVERLAND.DDNS.ME(a)NEVERLAND.DDNS.ME [root@luna ipa]# cat /etc/ipa/.dns_update.txt update delete luna.neverland.ddns.me. IN A show send update delete luna.neverland.ddns.me. IN AAAA show send update add luna.neverland.ddns.me. 1200 IN A 10.0.0.19 show send update add luna.neverland.ddns.me. 1200 IN AAAA 2605:e000:1127:713::7 show send [root@luna ipa]# /usr/bin/nsupdate -v -g /etc/ipa/.dns_update.txt Outgoing update query: ;; ->>HEADER<<- opcode: UPDATE, status: NOERROR, id: 0 ;; flags:; ZONE: 0, PREREQ: 0, UPDATE: 0, ADDITIONAL: 0 ;; UPDATE SECTION: luna.neverland.ddns.me. 0 ANY A response to SOA query was unsuccessful

4 7

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users August 2019