September 2019 - FreeIPA-users - Fedora mailing-lists

getcert list status: NEED_CA issue
by Satish Patel 27 Sep '19

27 Sep '19

Few days ago my Master CA was messed up and getcert list was showing empty list (no cert to track) So i run following command to add certs manually: getcert start-tracking -d /etc/pki/pki-tomcat/alias -n 'ocspSigningCert cert-pki-ca' -P XXXXXXX getcert start-tracking -d /etc/pki/pki-tomcat/alias -n 'auditSigningCert cert-pki-ca' -P XXXXXXX getcert start-tracking -d /etc/pki/pki-tomcat/alias -n 'subsystemCert cert-pki-ca' -P XXXXXXX getcert start-tracking -d /etc/pki/pki-tomcat/alias -n 'Godaddy' -P XXXXXXX getcert start-tracking -d /etc/pki/pki-tomcat/alias -n 'Godaddy Intermediate' -P XXXXXXX And after that i am seeing this status (status: NEED_CA ) it should be MONITORING right? # getcert list Number of certificates and requests being tracked: 12. Request ID '20190915042927': status: NEED_CA stuck: yes key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert cert-pki-ca',token='NSS Certificate DB',pin set certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert cert-pki-ca',token='NSS Certificate DB' issuer: CN=Certificate Authority,O=example.com subject: CN=Certificate Authority,O=example.com expires: 2037-01-05 14:47:24 UTC key usage: digitalSignature,nonRepudiation,keyCertSign,cRLSign pre-save command: post-save command: track: yes auto-renew: yes Request ID '20190915043150': status: NEED_CA stuck: yes key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alaas',nickname='Server-Cert cert-pki-ca',token='NSS Certificate DB',pin set certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert cert-pki-ca',token='NSS Certificate DB' issuer: CN=Certificate Authority,O=example.com subject: CN=ldap-example-5-1.foo.example.com,O=example.com expires: 2020-11-17 18:30:29 UTC key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment eku: id-kp-serverAuth,id-kp-clientAuth pre-save command: post-save command: track: yes auto-renew: yes Request ID '20190915043212': status: NEED_CA stuck: yes key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert cert-pki-ca',token='NSS Certificate DB',pin set certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert cert-pki-ca',token='NSS Certificate DB' issuer: CN=Certificate Authority,O=example.com subject: CN=OCSP Subsystem,O=example.com expires: 2020-11-17 18:31:26 UTC eku: id-kp-OCSPSigning pre-save command: post-save command: track: yes auto-renew: yes

3 26

inconsistency when reading server roles ?
by Eugène Adell 27 Sep '19

27 Sep '19

Hello, I am using freeipa 4.5.0.21 (full details below) and I noticed a weird behaviour. When getting informations about a server with a regular user, it won't show the server roles while these roles will be given when checking the server roles themselves. In this case the roles are of 'configured' status instead of 'enabled' (which is probably what would be expected). As it's not documented in the official Guide and I didn't find anything in the mail archive, I believe some clarification is needed. Should server roles be found through some commands but not others ? Is there any security issue of showing them always ? (user) # ipa server-show srv3.idm.local --all dn: cn=srv3.idm.local,cn=masters,cn=ipa,cn=etc,dc=idm,dc=local Server name: srv3.idm.local Enabled server roles: objectclass: top, nsContainer, ipaReplTopoManagedServer, ipaConfigObject, ipaSupportedDomainLevelConfig (user) # ipa server-role-show srv3.idm.local 'NTP server' Server name: srv3.idm.local Role name: NTP server Role status: configured (admin) # ipa server-show srv3.idm.local --all dn: cn=srv3.idm.local,cn=masters,cn=ipa,cn=etc,dc=idm,dc=local Server name: srv3.idm.local Managed suffixes: domain, ca Min domain level: 0 Max domain level: 1 Enabled server roles: CA server, DNS server, NTP server objectclass: top, nsContainer, ipaReplTopoManagedServer, ipaConfigObject, ipaSupportedDomainLevelConfig # yum info ipa-server -v Loading "fastestmirror" plugin Config time: 0.008 Yum version: 3.4.3 rpmdb time: 0.000 Setting up Package Sacks Loading mirror speeds from cached hostfile pkgsack time: 0.004 Installed Packages Name : ipa-server Arch : x86_64 Version : 4.5.0 Release : 21.el7.centos.2.2 Size : 1.0 M Repo : installed From repo : ipa Committer : Johnny Hughes <johnny(a)centos.org> Committime : Thu Oct 19 14:00:00 2017 Buildtime : Thu Oct 19 22:52:09 2017 Install time: Mon Sep 23 21:46:46 2019 Installed by: root <root> Changed by : System <unset> Summary : The IPA authentication server URL : http://www.freeipa.org/ Licence : GPLv3+ Description : IPA is an integrated solution to provide centrally managed Identity (users, : hosts, services), Authentication (SSO, 2FA), and Authorization : (host access control, SELinux user roles, services). The solution provides : features for further integration with Linux based clients (SUDO, automount) : and integration with Active Directory based infrastructures (Trusts). : If you are installing an IPA server, you need to install this package. # cat /etc/*release* CentOS Linux release 7.4.1708 (Core) Derived from Red Hat Enterprise Linux 7.4 (Source) NAME="CentOS Linux" VERSION="7 (Core)" ID="centos" ID_LIKE="rhel fedora" VERSION_ID="7" PRETTY_NAME="CentOS Linux 7 (Core)" ANSI_COLOR="0;31" CPE_NAME="cpe:/o:centos:centos:7" HOME_URL="https://www.centos.org/" BUG_REPORT_URL="https://bugs.centos.org/" CENTOS_MANTISBT_PROJECT="CentOS-7" CENTOS_MANTISBT_PROJECT_VERSION="7" REDHAT_SUPPORT_PRODUCT="centos" REDHAT_SUPPORT_PRODUCT_VERSION="7" CentOS Linux release 7.4.1708 (Core) CentOS Linux release 7.4.1708 (Core) cpe:/o:centos:centos:7 Best regards Eugene

2 2

Issues with Free IPA (Red Hat IDM). Sporadic lookup results. Different results in EL 6 and 7.
by Bob Jones 27 Sep '19

27 Sep '19

All, First the deets of the setup: 3 IDM servers on RHEL 7.7 ipa version VERSION: 4.6.5, API_VERSION: 2.231 sssd version 1.16.4 389 directory server version 1.3.9.1-10 Clients: EL7: ipa version 5.6.5, sssd version EL6: ipa version 3.0.0.51, sssd 1.13.3.60 Servers are setup in an AD trust ipa-ad-trust-posix. I have done the performance tweaks for sssd as described at https://jhrozek.wordpress.com/2015/08/19/performance-tuning-sssd-for-large-… and we use the accounts/groups in AD for login, authorization, and file ownership. There are 3 main issues we are having. 1. On ipa clients on EL 7 servers we are running into sporadic issues. If you totally clear the sssd cache and do an ls -la on let's say /home where there are 12 unique owners of directories usually between 8 to 10 of the UID numbers come back with the the user found, but you have to wait 1 to 5 minutes before the rest of the uids owning the other directories come back as found. 2. Also on ipa clients on EL 7 servers we are running into an issue where occasionally, at what seems like totally random times, AD users that normally can access a client suddenly can't. Someone will have to go in and clear the SSSD cache after which the user will once again be able to access the system. 3. There are some users that are just not visible on the EL 6 clients. On the IDM servers and on EL 7 clients the AD users are able to be found by id and the users can login. On EL 6 those AD users just do not resolve and cannot be seen. Anyway, we have had Red Hat support looking at problem 3 for almost 2 months now with no luck. We have been poking around at problems 1 and 2 but no eureka moments as of yet. I'm hoping someone else on this list has encountered these same issues and found a solution. I would greatly appreciate any insight and help that anyone could provide. Sincerely, — Bob Jones Lead Linux Services Engineer ITS ECP - Linux Services University of Virginia rwj5d(a)virginia.edu

3 5

Configuring Windows 10 to use FreeIPA
by Joyce Babu 27 Sep '19

27 Sep '19

I followed the instructions for setting up Windows10 to use FreeIPA for authentication https://www.freeipa.org/page/Windows_authentication_against_FreeIPA After following the instruction, the default domain displayed on windows 10 login screen is EXAMPLE and EXAMPLE.COM. I am able to login by entering EXAMPLE.COM\user as the username. But when I enter the username without the leading domain name, login fails with 'Client not found in Kerberos database' error. Sep 27 17:17:58 ipa.example.org krb5kdc[419](info): AS_REQ (6 etypes {aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17), DEPRECATED:arcfour-hmac(23), DEPRECATED:arcfour-hmac-exp(24), (-135), DEPRECATED:des-cbc-md5(3)}) 192.168.0.185: CLIENT_NOT_FOUND: user@EXAMPLE for krbtgt/EXAMPLE@EXAMPLE, Client not found in Kerberos database Is it possible to change the default domain in windows login screen to EXAMPLE.COM from EXAMPLE? Thanks, Joyce Babu

1 0

Terminating replication agreement
by Randy Morgan 26 Sep '19

26 Sep '19

I have a two year image of one of my IPA servers that I am trying to bring live. Unfortunately all of the certs except the CA are expired. I have attempted to follow the instructions for updating the certs, but it has failed to update them. After careful and extensive digging, I have found that the issue is two replication agreements from other IPA servers that have since been rebuilt. Because of the expired certs I can't login to the web UI, so I can't terminate the agreements that way, and the IPA commands fail. Is there a way to terminate these agreements manually by removing the references to the two servers? Randy Morgan -- Randy Morgan CSR Department of Chemistry/BioChemistry Brigham Young University

3 5

IPA integration with AD - trust issues and controversy
by Pieter Baele 26 Sep '19

26 Sep '19

Hi, We use an IPA domain for a large part of our internal servers. Our first one-way trust implementation was not properly working because of routing issues. Two-way trust in our environment is not possible, because normal users are limited. (we can resolve 'system/service' accounts without those limitations) After finding out about this limitation, we did again configure one-way trust. This time, we found about the registry / GPO solution to direct windows clients to the IPA KDC's. ( https://gpo.wiki/wiki/Kerberos.admx:Computer_Configuration#Define_host_name… ) And all is working properly... Last week we received a request from an external company that wants AD integration. They will manage their own set of RHEL servers for a specific project. I proposed they can use the IDM domain for feature-full integration with the AD domain. But.... there is some discussion going on.... our AD architect(s) calls the IPA integration with AD lacking. Their opinion is that windows clients should discover automatically when they need a IPA KDC Also, they find it a severe issue that everything is hidden after one SID (which is given permissions with the correct search scope) As such they can' t see/discover anything in the IPA domain (logically...) So the Windows / AD guys propose a direct integration using a keytab - without thinking about the requirements, and comparing with network devices or appliances I am not talking about realmd. What is the up-to-date opinion on SSSD realmd integration versus IDM integration? Or other options? What will the external company be losing in features? And which has most risks? But most of all: what can we do to make IPA domain<-> AD domain integration better? Sincerely, Pieter

1 0

How to archive this?
by Andreas Kucher 26 Sep '19

26 Sep '19

Hi There, i have a FreeIPA 4.6.4 Sever and two replica Servers up and running. So far so good. Now i want to connect my hosts to my Synology NAS running DSM 6.2.2. My first thougth was to use Kerberos and NFS4 but unfortunaly i did not figure out how to do this. Maybe you have a good tutorial? In the End i found this Page: https://frederik.lindenaar.nl/2019/07/14/integrating-synology-ds-with-freei… I think i will try to do this and just access the shares with "LDAP". My question is: if i want to install "ipa-adtrust-install" but it was not installed using yum (because i thougth i was no neccecarry) can i simple install it? Do i have to run it on the replicas as well? Maybe you can have a look at the Page of Frederik and share your thoughts about it? Thank you in advice Andy

1 0

Manually join machines in stateless environment
by Vinícius Ferrão 26 Sep '19

26 Sep '19

Hello, the subject of the message may sound a little bit strange, but let me explain what I’m trying to do. I have a machine with an provisioner (xCAT) that is able to boot and control different types of computer nodes. A stateless node is just a machine that boots over the network from a shared image on the server. What I’m trying to do? Join those stateless nodes to FreeIPA Server. To do this, I’m aware that I can’t just run freeipa-client-install on the image chroot, since it will not behave as expected. At this point xCAT (the provisioner) can create the DNS registers of the stateless nodes on FreeIPA integrated DNS (using TSIG keys). But I need to properly join the nodes to the server. There’s a way to manually register the nodes on the server? And about the users? How to enable them? Just Configure SSSD on the image and it should be fine? The certificates, client certificates and things like this? There’s something that I need to do? Automount? Any help is really appreciated. Thanks,

5 10

Re:
by Nazan CENGİZ 25 Sep '19

25 Sep '19

Hi, Who is the name of the community? Do you have an existing slack group? Thanks. [cid:imageb28ec2.PNG@d1da10fa.4cb398f7]<http://www.havelsan.com.tr> [cid:image8c8aa2.JPG@a93b5b5c.498f306c] Nazan CENGİZ AR-GE MÜHENDİSİ Mustafa Kemal Mahallesi 2120 Cad. No:39 06510 Çankaya Ankara TÜRKİYE [cid:image9f30dc.PNG@eaef3c98.49a0f6ac] +90 312 219 57 87 [cid:image2c5a21.PNG@c874ceae.4a8947a5] +90 312 219 57 97 [cid:imageb831d2.JPG@5f6f348c.44a74e32] YASAL UYARI: Bu elektronik posta işbu linki kullanarak ulaşabileceğiniz Koşul ve Şartlar dokümanına tabidir. <http://havelsan.com.tr/tr/news/e-posta-yasal-uyari> LEGAL NOTICE: This e-mail is subject to the Terms and Conditions document which can be accessed with this link. <http://havelsan.com.tr/tr/news/e-posta-yasal-uyari> [http://www.havelsan.com.tr/Library/images/mail/email.jpg] Lütfen gerekmedikçe bu sayfa ve eklerini yazdırmayınız / Please consider the environment before printing this email ________________________________ From: Nazan CENGİZ Sent: Wednesday, September 25, 2019 11:27:45 AM To: freeipa-users(a)lists.fedorahosted.org Subject: Hi all, Shall we create a Slack band? IRC is banned in our company. Would you mind?

2 1

Re: log dispatching for IPA servers
by Nazan CENGİZ 24 Sep '19

24 Sep '19

Hi all, I wanted monitoring and centrilazed logging.For example ELK (elasticsearch,logstash,kibana) Stack.But I don't know config on FreeIPA server and client?Is there an auxiliary resource? https://github.com/mzamora9913/Collecting-Syslogs-from-FreeIPA-and-clients-… But I don't understanding. Could you please do yuou have a research or tutorial for FreeIPA centralized logging? Best Regards. [cid:image26938a.PNG@6241ef69.4c95962c]<http://www.havelsan.com.tr> [cid:imageeb5f50.JPG@bab4e531.4294e394] Nazan CENGİZ AR-GE MÜHENDİSİ Mustafa Kemal Mahallesi 2120 Cad. No:39 06510 Çankaya Ankara TÜRKİYE [cid:imageedbd3d.PNG@12352f47.48ba5869] +90 312 219 57 87 [cid:imagecff0c2.PNG@69e71500.4fa4bdd2] +90 312 219 57 97 [cid:image713a9c.JPG@cd67836a.4da60895] YASAL UYARI: Bu elektronik posta işbu linki kullanarak ulaşabileceğiniz Koşul ve Şartlar dokümanına tabidir. <http://havelsan.com.tr/tr/news/e-posta-yasal-uyari> LEGAL NOTICE: This e-mail is subject to the Terms and Conditions document which can be accessed with this link. <http://havelsan.com.tr/tr/news/e-posta-yasal-uyari> [http://www.havelsan.com.tr/Library/images/mail/email.jpg] Lütfen gerekmedikçe bu sayfa ve eklerini yazdırmayınız / Please consider the environment before printing this email ________________________________ From: Nazan CENGİZ Sent: Tuesday, September 24, 2019 1:08:15 PM To: Angus Clarke; freeipa-users(a)lists.fedorahosted.org Cc: Fraser Tweedale Subject: Re: [Freeipa-users] Re: log dispatching for IPA servers I wanted logging a IPA server and many IPA client.I also want to keep logging and monitoring at the interface. ________________________________ From: Angus Clarke <post(a)angusclarke.com> Sent: Tuesday, September 24, 2019 12:47:46 PM To: Nazan CENGİZ; freeipa-users(a)lists.fedorahosted.org Cc: Fraser Tweedale Subject: [Freeipa-users] Re: log dispatching for IPA servers Hi If you just want an audit trail of the FreeIPA server(s) API, then apache's ErrorLog directive catches all that. Regards Angus ________________________________ From: Fraser Tweedale via FreeIPA-users <freeipa-users(a)lists.fedorahosted.org> Sent: 24 September 2019 11:08 To: Nazan CENGİZ <nazancengiz(a)havelsan.com.tr>; freeipa-users(a)lists.fedorahosted.org <freeipa-users(a)lists.fedorahosted.org> Cc: Fraser Tweedale <ftweedal(a)redhat.com> Subject: [Freeipa-users] Re: log dispatching for IPA servers Hi Nazan, I'm not sure what are the best practices for log dispatching on IPA servers, or what is suitable for your customer's environment and requirement. I assume the customer is running RHEL and therefore wants the solution to only use supported components. Adding freeipa-users@ for a wider audience. Cheers, Fraser On Tue, Sep 24, 2019 at 07:50:14AM +0000, Nazan CENGİZ wrote: > Hi Fraser, > > > I working 5G project in Turkey. Redhat supported me for Openstack 13. > > > We install FreeIPA. We wanted log monitoring on FreeIPA server and clients.I think it should Kibana,Elasticsearch and fluentd. > > > I see https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fsysadmin.…p;reserved=0. > > > But I don't know installing on FreeIPA server and clients.Where is installed fluentd on IPA server and clients? > > > I following https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.co… but It not answer the questions. > > > Could you please help me? > > > Best Regards, > > > Nazan. > > > [cid:image556c62.PNG@8bf41986.459c739a]<https://eur01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.havels…> [cid:imageb02311.JPG@73a7601e.418b1956] > Nazan CENGİZ > AR-GE MÜHENDİSİ > Mustafa Kemal Mahallesi 2120 Cad. No:39 06510 Çankaya Ankara TÜRKİYE > [cid:imagea8935c.PNG@9a2bfb11.4c8dd354] +90 312 219 57 87 [cid:image2cbf6d.PNG@6b6c6178.42ba3343] +90 312 219 57 97 > > > [cid:image67d26a.JPG@1a093bf4.45953fd9] > YASAL UYARI: Bu elektronik posta işbu linki kullanarak ulaşabileceğiniz Koşul ve Şartlar dokümanına tabidir. <https://eur01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fhavelsan.c…> > LEGAL NOTICE: This e-mail is subject to the Terms and Conditions document which can be accessed with this link. <https://eur01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fhavelsan.c…> > > [https://eur01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.havels…] Lütfen gerekmedikçe bu sayfa ve eklerini yazdırmayınız / Please consider the environment before printing this email > > _______________________________________________ FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org Fedora Code of Conduct: https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdocs.fedo… List Guidelines: https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Ffedorapro… List Archives: https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.fed…

1 0

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users September 2019