October 2020 - FreeIPA-users - Fedora mailing-lists

permanent service account keys for kerberos NFS share
by Kevin Vasko 09 Oct '20

09 Oct '20

Hello, We have an application that does some data processing on our NFS server. Users typically just ssh into a box which then has a kerberos key generated for them, which allows them access the NFS share and run the script. We are wanting to set this up in a more automated fashion. Such as running the script in the background as a service. However, after a few days the kerberos keys become invalid killing access to the NFS share and the data. Is there a way to generate some account/keys that will have permanent access for service level stuff like this? -Kevin

3 3

slapd-IPA-MYDOMAIN-COM missing configuration.
by Albert Szostkiewicz 08 Oct '20

08 Oct '20

Hi! My dirsrv(a)IPA-MYDOMAIN-COM.service on IPA server fails to start due to missing configuration. How can I re-create one ? journalctl: ds_systemd_ask_password_acl[10117]: grep: /etc/dirsrv/slapd-IPA-MYDOMAIN-COM/dse.ldif: No such file or directory ns-slapd[10122]: INFO - dse_check_file - The config /etc/dirsrv/slapd-IPA-MYDOMAIN-COM/dse.ldif can not be accessed. Attempting restore ... (reason: 0) ns-slapd[10122]: INFO - dse_check_file - The backup /etc/dirsrv/slapd-IPA-MYDOMAIN-COM/dse.ldif.bak can not be accessed. Check it exists and permissions. ns-slapd[10122]: ERR - slapd_bootstrap_config - No valid configurations can be accessed! You must restore /etc/dirsrv/slapd-IPA-MYDOMAIN-COM/dse.ldif from ba> ns-slapd[10122]: EMERG - main - The configuration files in directory /etc/dirsrv/slapd-IPA-MYDOMAIN-COM could not be read or were not found. Please refer to> systemd[1]: dirsrv(a)IPA-MYDOMAIN-COM.service: Main process exited, code=exited, status=1/FAILURE systemd[1]: dirsrv(a)IPA-MYDOMAIN-COM.service: Failed with result 'exit-code'. systemd[1]: Failed to start 389 Directory Server IPA-MYDOMAIN-COM.. -- Subject: Unit dirsrv(a)IPA-MYDOMAIN-COM.service has failed $ ls /etc/dirsrv/ drwxr-xr-x 2 root root 82 Nov 13 2019 config -rw------- 1 dirsrv dirsrv 570 Sep 18 2019 ds.keytab drwxr-xr-x 2 root root 25 Nov 13 2019 schema drwxr-x--- 4 dirsrv dirsrv 4096 Oct 7 21:26 slapd-HOME-MYDOMAIN-COM drwxr-x--- 2 dirsrv dirsrv 37 Sep 18 2019 slapd-HOME-MYDOMAIN-COM.removed drwxr-x--- 2 dirsrv dirsrv 37 Feb 18 2019 slapd-IPA-MYDOMAIN-COM.removed There is one ".removed" - not sure why and if i can maybe re-use it ? Cheers!

3 5

Stop/Disable Apache on IdM servers
by Angus Clarke 08 Oct '20

08 Oct '20

Hello We have a single mesh of FreeIPA servers in several different locations, we capture logs (apache ErrorLog directive) to a log server in each of those locations. When auditors ask us questions we have to trawl log servers from all locations as our IdM administrators might have used any of the IdM servers to make changes. To limit that access to one site, I am considering stopping and disabling apache on all IdM servers at other sites and just wanted to check there are no unintended consequences in that action. I'm not looking for enforcement, merely a means of persuading the team to use the web interface or command line tools at one site. Thanks! Angus

1 0

pki-tomcat wont start; LDAP auth failure
by Arjen Heidinga 08 Oct '20

08 Oct '20

Hello all! Since sime time my pki-tomcat deamon can't connect to the LDAP., ging me an error (below). The root-CA was expired in the meantime, I fixed it with some hack-n-slashwork. I am not sure what credentials (none, client cert?) are used to connect. Does anyone have pointers? Hope I have not snipped too much log. Thanks, Arjen Heidinga freeipa-server-common-4.8.9-2.fc32.noarch 2020-10-08 12:46:35 [main] FINEST: Getting internaldb.doCloning=true 2020-10-08 12:46:35 [main] FINE: LdapBoundConnFactory: doCloning: true 2020-10-08 12:46:35 [main] FINE: LdapBoundConnFactory: mininum: 3 2020-10-08 12:46:35 [main] FINE: LdapBoundConnFactory: maximum: 15 2020-10-08 12:46:35 [main] FINE: LdapBoundConnFactory: host: starkey.platypusnet.org 2020-10-08 12:46:35 [main] FINE: LdapBoundConnFactory: port: 636 2020-10-08 12:46:35 [main] FINE: LdapBoundConnFactory: secure: true 2020-10-08 12:46:35 [main] FINE: LdapBoundConnFactory: authentication: 2 2020-10-08 12:46:35 [main] FINE: LdapBoundConnFactory: makeConnection(true) 2020-10-08 12:46:35 [main] FINEST: Getting internaldb.ldapauth.clientCertNickname=subsystemCert cert-pki-ca 2020-10-08 12:46:35 [main] FINEST: Property tcp.keepAlive not found 2020-10-08 12:46:35 [main] FINEST: Getting tcp.keepAlive=true 2020-10-08 12:46:35 [main] FINE: TCP Keep-Alive: true 2020-10-08 12:46:35 [main] FINE: LdapBoundConnection: Connecting to starkey.platypusnet.org:636 with client cert auth 2020-10-08 12:46:35 [main] FINE: ldapconn/PKISocketFactory.makeSSLSocket: begins 2020-10-08 12:46:35 [main] FINE: SSLClientCertificateSelectionCB: Setting desired cert nickname to: subsystemCert cert-pki-ca 2020-10-08 12:46:35 [main] FINE: LdapJssSSLSocket: set client auth cert nickname subsystemCert cert-pki-ca 2020-10-08 12:46:35 [main] FINE: SSLClientCertificatSelectionCB: Entering! 2020-10-08 12:46:35 [main] FINE: Candidate cert: Server-Cert cert-pki-ca 2020-10-08 12:46:35 [main] FINE: Candidate cert: caSigningCert cert-pki-ca 2020-10-08 12:46:35 [main] FINE: SSLClientCertificateSelectionCB: returning: null 2020-10-08 12:46:35 [main] FINE: PKIClientSocketListener.handshakeCompleted: begins 2020-10-08 12:46:35 [main] FINE: Handshake completed: 2020-10-08 12:46:35 [main] FINE: - client: 192.168.124.201 2020-10-08 12:46:35 [main] FINE: - server: 192.168.124.201 2020-10-08 12:46:35 [main] FINE: - subject: SYSTEM 2020-10-08 12:46:35 [main] FINE: SignedAuditLogger: event CLIENT_ACCESS_SESSION_ESTABLISH 2020-10-08 12:46:35 [main] FINE: LogFile: event type not selected: CLIENT_ACCESS_SESSION_ESTABLISH 2020-10-08 12:46:35 [main] FINE: PKIClientSocketListener.handshakeCompleted: CS_CLIENT_ACCESS_SESSION_ESTABLISH_SUCCESS 2020-10-08 12:46:35 [main] FINE: PKIClientSocketListener.handshakeCompleted: clientIP=192.168.124.201 serverIP=192.168.124.201 serverPort=31746 2020-10-08 12:46:35 [main] FINE: SSL handshake happened 2020-10-08 12:46:35 [main] SEVERE: LdapBoundConnFactory: Unable to connect to LDAP server: Authentication failed netscape.ldap.LDAPException: Authentication failed (48) at netscape.ldap.LDAPSaslBind.checkForSASLBindCompletion(Unknown Source) at netscape.ldap.LDAPSaslBind.bind(Unknown Source) at netscape.ldap.LDAPSaslBind.bind(Unknown Source) at netscape.ldap.LDAPConnection.authenticate(Unknown Source) at netscape.ldap.LDAPConnection.authenticate(Unknown Source) at netscape.ldap.LDAPConnection.checkClientAuth(Unknown Source) at netscape.ldap.LDAPConnection.connect(Unknown Source) at netscape.ldap.LDAPConnection.connect(Unknown Source) at netscape.ldap.LDAPConnection.connect(Unknown Source) at com.netscape.cmscore.ldapconn.LdapBoundConnection.<init>(LdapBoundConnection.java:105) at com.netscape.cmscore.ldapconn.LdapBoundConnFactory.makeConnection(LdapBoundConnFactory.java:285) at com.netscape.cmscore.ldapconn.LdapBoundConnFactory.init(LdapBoundConnFactory.java:261)

2 1

IPA and JQuery 1.2 < 3.5.0 XSS
by Christopher Lamb 07 Oct '20

07 Oct '20

3 3

Replace Web UI Cert
by Chuck Musser 07 Oct '20

07 Oct '20

Hi, We operate our own certificate authority for our internal infrastructure and I'd like to replace the certificate that comes with the FreeIPA installation with one we've generated for this host. This is FreeIPA, version: 4.6.6, running on CentOS Linux release 7.8.2003 (Core). I looked around in the docs and couldn't see anything for this particular task. I did add a certificate to the FreeIPA host (under Identity->Host), but that doesn't seem to be the correct (or only) thing to do. In the certificates area, it appears, but has incomplete information and isn't marked VALID. What is the procedure for doing this? Thanks, Chuck

3 6

FreeIPA web UI Login issue.
by Randall Hodges 07 Oct '20

07 Oct '20

I just started working for a new company and they handed me this IPA replication server with an issue logging on to the web UI. I get errors when we try to login. I have been all over the web looking for answers. I have check the permission of all the certs and they are correct all have 0644 on them. I have done strace on the WSGI pids with no answers. I have no idea if this ever worked from the install since I just started working for the company last week and the guy who built it is no longer there. I have noticed that since it cannot authenticate it will not write to ccache in /var/run/ipa/ccaches. Everything works from the command line with no issue. I can also run kinit admin and put the password in with no issues. If I run a curl from command it works no issues. Just cant login in from the browser. I have restart ipa using ipactl restart. All the services are running just fine. However I noticed in the log file for the install there were errors. I don't know if this ever worked or not. This is replicating back to known working servers just fine. I was added and it shows up in the server. stderr=kinit: Client 'WELLKNOWN/ANONYMOUS@.example.us' not found in Kerberos database while getting initial credentials CalledProcessError: Command '/usr/bin/kinit -n -c /var/run/ipa/ccaches/armor_25969 -X X509_anchors=FILE:/var/kerberos/krb5kdc/kdc.crt -X X509_anchors=FILE:/var/lib/ipa-client/pki/kdc-ca-bundle.pem' returned non-zero exit status 1 [root@Server ccaches]# klist Ticket cache: KEYRING:persistent:0:0 Default principal: admin(a)example.us Valid starting Expires Service principal 10/06/2020 15:09:44 10/06/2020 20:56:18 HTTP/Server.US 10/05/2020 20:56:30 10/06/2020 20:56:18

2 6

UPPERCASE usernames
by Pieter Baele 07 Oct '20

07 Oct '20

Hi , Current IPA environment is using lowercase usernames. But we also have a LDAP environment in which usernames are in UPPERCASE. This is used for "some" krb tickets possibilities. Imagine we add users to the Default Trust View and adapt login to UPPERCASE. Can we expect some troubles or nuisances (think SSO, SSH, Kerberos...) I remember very good some installers don't like adding local users on installation with a login in uppercase. We can use other override(s), but maybe this is not feasible from a user management perspective. Especially regarding the normal typical POSIX way, which was also described in the username restrictions thread (10/2018) [1] https://paulgorman.org/technical/presentations/linux_username_conventions.p… Sincerely, Pieter

1 0

Replica setup fails for Centos 8 Stream
by Uzor Ide 06 Oct '20

06 Oct '20

Hi All, I have a curious issue where ipa-replica-install fails or rather crashes just as it is about for complete. Both the master and the replica are Centos 8 Stream. I have also tested a replica on fedora 32 with the same result. Just after ipa-custodia setup is complete I get the following error ERROR CalledProcessError(Command ['/usr/bin/PKCS12Export', '-d', '/tmp/tmpdysxuo2a', '-p', '/tmp/tmpdysxuo2a/pwdfile.txt', '-w', '/tmp/tmpdysxuo2a/crtpwfile', '-o', '/tmp/tmpii01v5iyipa/cacert.p12'] returned non-zero exit status 134: '/usr/bin/PKCS12Export: line 94: 9156 Aborted (core dumped) ${JAVA} ${JAVA_OPTIONS} -cp "${PKI_LIB}/*" -Djava.util.logging.config.file=${PKI_LOGGING_CONFIG} com.netscape.cmstools.${COMMAND} "$@"\n') 2020-10-06T03:32:12Z ERROR The ipa-replica-install command failed. See /var/log/ipareplica-install.log for more information From replica-install-log, It appears that is trying to export some certificates 2020-10-06T03:32:09Z DEBUG Starting external process 2020-10-06T03:32:09Z DEBUG args=['/usr/bin/PKCS12Export', '-d', '/tmp/tmpdysxuo2a', '-p', '/tmp/tmpdysxuo2a/pwdfile.txt', '-w', '/tmp/tmpdysxuo2a/crtpwfile', '-o', '/tmp/tmpii01v5iyipa/cacert.p12'] 2020-10-06T03:32:12Z DEBUG Process finished, return code=134 2020-10-06T03:32:12Z DEBUG stdout=# # A fatal error has been detected by the Java Runtime Environment: # # SIGSEGV (0xb) at pc=0x00007f479d6ce313, pid=9156, tid=0x00007f479ed46700 # # JRE version: OpenJDK Runtime Environment (8.0_265-b01) (build 1.8.0_265-b01) # Java VM: OpenJDK 64-Bit Server VM (25.265-b01 mixed mode linux-amd64 compressed oops) # Problematic frame: # V [libjvm.so+0x818313] LinkResolver::runtime_resolve_virtual_method(CallInfo&, methodHandle, KlassHandle, Handle, KlassHandle, bool, Thread*)+0x83 # # Core dump written. Default location: /root/core or core.9156 # # An error report file with more information is saved as: # /root/hs_err_pid9156.log # # If you would like to submit a bug report, please visit: # http://bugreport.java.com/bugreport/crash.jsp # 2020-10-06T03:32:12Z DEBUG stderr=/usr/bin/PKCS12Export: line 94: 9156 Aborted (core dumped) ${JAVA} ${JAVA_OPTIONS} -cp "${PKI_LIB}/*" -Djava.util.logging.config.file=${PKI_LOGGING_CONFIG} com.netscape.cmstools.${COMMAND} "$@" 2020-10-06T03:32:12Z DEBUG File "/usr/lib/python3.6/site-packages/ipapython/admintool.py", line 179, in execute return_value = self.run() File "/usr/lib/python3.6/site-packages/ipapython/install/cli.py", line 340, in run return cfgr.run() File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 360, in run return self.execute() File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 386, in execute for rval in self._executor(): File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 431, in __runner exc_handler(exc_info) File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 460, in _handle_execute_exception self._handle_exception(exc_info) File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 450, in _handle_exception six.reraise(*exc_info) File "/usr/lib/python3.6/site-packages/six.py", line 693, in reraise raise value File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 421, in __runner step() File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 418, in <lambda> step = lambda: next(self.__gen) File "/usr/lib/python3.6/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from six.reraise(*exc_info) File "/usr/lib/python3.6/site-packages/six.py", line 693, in reraise raise value File "/usr/lib/python3.6/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from value = gen.send(prev_value) File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 655, in _configure next(executor) File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 431, in __runner exc_handler(exc_info) File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 460, in _handle_execute_exception self._handle_exception(exc_info) File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 518, in _handle_exception self.__parent._handle_exception(exc_info) File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 450, in _handle_exception six.reraise(*exc_info) File "/usr/lib/python3.6/site-packages/six.py", line 693, in reraise raise value File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 515, in _handle_exception super(ComponentBase, self)._handle_exception(exc_info) File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 450, in _handle_exception six.reraise(*exc_info) File "/usr/lib/python3.6/site-packages/six.py", line 693, in reraise raise value File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 421, in __runner step() File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 418, in <lambda> step = lambda: next(self.__gen) File "/usr/lib/python3.6/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from six.reraise(*exc_info) File "/usr/lib/python3.6/site-packages/six.py", line 693, in reraise raise value File "/usr/lib/python3.6/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from value = gen.send(prev_value) File "/usr/lib/python3.6/site-packages/ipapython/install/common.py", line 65, in _install for unused in self._installer(self.parent): File "/usr/lib/python3.6/site-packages/ipaserver/install/server/__init__.py", line 602, in main replica_install(self) File "/usr/lib/python3.6/site-packages/ipaserver/install/server/replicainstall.py", line 402, in decorated func(installer) File "/usr/lib/python3.6/site-packages/ipaserver/install/server/replicainstall.py", line 1318, in install ca.install(False, config, options, custodia=custodia) File "/usr/lib/python3.6/site-packages/ipaserver/install/ca.py", line 270, in install install_step_0(standalone, replica_config, options, custodia=custodia) File "/usr/lib/python3.6/site-packages/ipaserver/install/ca.py", line 308, in install_step_0 replica_config.dirman_password) File "/usr/lib/python3.6/site-packages/ipaserver/install/custodiainstance.py", line 305, in get_ca_keys self._get_keys(cacerts_file, cacerts_pwd, data) File "/usr/lib/python3.6/site-packages/ipaserver/install/custodiainstance.py", line 295, in _get_keys '-o', cacerts_file File "/usr/lib/python3.6/site-packages/ipapython/ipautil.py", line 598, in run p.returncode, arg_string, output_log, error_log 2020-10-06T03:32:12Z DEBUG The ipa-replica-install command failed, exception: CalledProcessError: CalledProcessError(Command ['/usr/bin/PKCS12Export', '-d', '/tmp/tmpdysxuo2a', '-p', '/tmp/tmpdysxuo2a/pwdfile.txt', '-w', '/tmp/tmpdysxuo2a/crtpwfile', '-o', '/tmp/tmpii01v5iyipa/cacert.p12'] returned non-zero exit status 134: '/usr/bin/PKCS12Export: line 94: 9156 Aborted (core dumped) ${JAVA} ${JAVA_OPTIONS} -cp "${PKI_LIB}/*" -Djava.util.logging.config.file=${PKI_LOGGING_CONFIG} com.netscape.cmstools.${COMMAND} "$@"\n') It also core dumps Master/Replica IPA Packages ================= ipa-healthcheck-core-0.4-6.module_el8.3.0+482+9e103aab.noarch ipa-server-trust-ad-4.8.7-12.module_el8.3.0+511+8a502f20.x86_64 libipa_hbac-2.3.0-9.el8.x86_64 python3-ipalib-4.8.7-12.module_el8.3.0+511+8a502f20.noarch python3-ipaserver-4.8.7-12.module_el8.3.0+511+8a502f20.noarch ipa-client-common-4.8.7-12.module_el8.3.0+511+8a502f20.noarch ipa-selinux-4.8.7-12.module_el8.3.0+511+8a502f20.noarch ipa-client-4.8.7-12.module_el8.3.0+511+8a502f20.x86_64 ipa-server-dns-4.8.7-12.module_el8.3.0+511+8a502f20.noarch ipa-common-4.8.7-12.module_el8.3.0+511+8a502f20.noarch ipa-server-common-4.8.7-12.module_el8.3.0+511+8a502f20.noarch python3-ipaclient-4.8.7-12.module_el8.3.0+511+8a502f20.noarch ipa-server-4.8.7-12.module_el8.3.0+511+8a502f20.x86_64 python3-libipa_hbac-2.3.0-9.el8.x86_64.

2 4

Re: ipa migrate-ds not updating group memberships
by Rob Crittenden 06 Oct '20

06 Oct '20

Alfred Victor wrote: > Hi Rob, > > Thanks for confirming. Is there any way to simply accomplish a sync, or > will we need to achieve this by adding/removing groups using ipa > commands based on an ldapsearch? There is no IPA tool to do a sync like this. If you add/remove groups in IPA to achieve it you run the risk of losing changes some IPA admin has made. What is it you're syncing from? rob > > Paul > > On Tue, Oct 6, 2020 at 12:42 PM Rob Crittenden <rcritten(a)redhat.com > <mailto:rcritten@redhat.com>> wrote: > > Alfred Victor via FreeIPA-users wrote: > > Hi FreeIPA, > > > > Maybe I've misunderstood how migrate-ds should work, worth mentioning > > the source directory is RFC2307 - if ipa migrate-ds migrates a user, > > then later that user is added more groups and the same migrate-ds > > command is run again, should it not add the user into the > corresponding > > groups on IPA which did not have its memberUid prior? > > It isn't a sync tool. If an entry already exists then it is considered > migrated and skipped. > > rob >

2 1

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users October 2020