March 2020 - FreeIPA-users - Fedora mailing-lists

External & Letsencrypt Certificate | Failed on IPA update.
by Faraz Younus 09 Mar '20

09 Mar '20

Hello , I'm getting failed when updating new certificate whether it is external & Letsencrypt. Previously I was installing successfully letsencrypt certificate 15 days ago. I'm following below github repo to setup freeipa. https://github.com/freeipa/ansible-freeipa/tree/master/roles root# ipa-server-certinstall -w -d ipa5.fixedandmobile.com.p12 Peer's certificate issuer is not trusted (certutil: certificate is invalid: Peer's Certificate issuer is not recognized. ). Please run ipa-cacert-manage install and ipa-certupdate to install the CA certificate. The ipa-server-certinstall command failed. root# ipa-certupdate -v ipapython.admintool: DEBUG: Not logging to a file ipalib.rpc: DEBUG: failed to find session_cookie in persistent storage for principal 'admin(a)FIXEDANDMOBILE.COM' ipalib.rpc: INFO: trying https://ipa5.fixedandmobile.com/ipa/json ipalib.rpc: DEBUG: New HTTP connection (ipa5.fixedandmobile.com) ipalib.rpc: DEBUG: received Set-Cookie (<type 'list'>)'['ipa_session=MagBearerToken=7%2feoIywViL2KTkXiG1w0hP0DdWEaK4pE75LdZtDKSRPqBDLuzEqJdY%2fUnrwLqOBnhZBTqjj8gdAGD%2fSWn%2bwq1xLTiDo7%2f8CRETD%2bW5AvHT1VNFFRZibPfE1JS2BVE09q%2bdQrPAV60PA4cth2Qcdsvfp0U2oLj1xML6eRsoXG00REURhaFp8cCaB9AuQVKLbO8Byf3Pie3qafgN1SJ04jzA%3d%3d;path=/ipa;httponly;secure;']' ipalib.rpc: DEBUG: storing cookie 'ipa_session=MagBearerToken=7%2feoIywViL2KTkXiG1w0hP0DdWEaK4pE75LdZtDKSRPqBDLuzEqJdY%2fUnrwLqOBnhZBTqjj8gdAGD%2fSWn%2bwq1xLTiDo7%2f8CRETD%2bW5AvHT1VNFFRZibPfE1JS2BVE09q%2bdQrPAV60PA4cth2Qcdsvfp0U2oLj1xML6eRsoXG00REURhaFp8cCaB9AuQVKLbO8Byf3Pie3qafgN1SJ04jzA%3d%3d;' for principal admin(a)FIXEDANDMOBILE.COM ipalib.backend: DEBUG: Created connection context.rpcclient_139889220220816 ipalib.rpc: INFO: [try 1]: Forwarding 'schema' to json server ' https://ipa5.fixedandmobile.com/ipa/json' ipalib.rpc: DEBUG: HTTP connection keep-alive (ipa5.fixedandmobile.com) ipalib.rpc: DEBUG: received Set-Cookie (<type 'list'>)'['ipa_session=MagBearerToken=7PkGtgj%2fPCAF7lH774apcgiEy8NWrTzE3mFkHYl0eLj3%2bujnT%2fQru5wDXVKPv5ky7TwRzS%2bVifAcvSv97FnucGLDC%2b17365XlJuuexo2K0IueTFg5oFAdOf6aCk%2bB%2bNC8Rjawej3u1gidQa8y285gLYBmD0rW44cdrHaulcW72pgD1ts1%2fC1uwRsolhCx30Iwfe0Qj9TGSjd0OvS0TfS0A%3d%3d;path=/ipa;httponly;secure;']' ipalib.rpc: DEBUG: storing cookie 'ipa_session=MagBearerToken=7PkGtgj%2fPCAF7lH774apcgiEy8NWrTzE3mFkHYl0eLj3%2bujnT%2fQru5wDXVKPv5ky7TwRzS%2bVifAcvSv97FnucGLDC%2b17365XlJuuexo2K0IueTFg5oFAdOf6aCk%2bB%2bNC8Rjawej3u1gidQa8y285gLYBmD0rW44cdrHaulcW72pgD1ts1%2fC1uwRsolhCx30Iwfe0Qj9TGSjd0OvS0TfS0A%3d%3d;' for principal admin(a)FIXEDANDMOBILE.COM ipalib.backend: DEBUG: Destroyed connection context.rpcclient_139889220220816 ipalib.plugable: DEBUG: importing all plugin modules in ipaclient.remote_plugins.schema$79e69edd... ipalib.plugable: DEBUG: importing plugin module ipaclient.remote_plugins.schema$79e69edd.plugins ipalib.plugable: DEBUG: importing all plugin modules in ipaclient.plugins... ipalib.plugable: DEBUG: importing plugin module ipaclient.plugins.automember ipalib.plugable: DEBUG: importing plugin module ipaclient.plugins.automount ipalib.plugable: DEBUG: importing plugin module ipaclient.plugins.ca ipalib.plugable: DEBUG: importing plugin module ipaclient.plugins.cert ipalib.plugable: DEBUG: importing plugin module ipaclient.plugins.certmap ipalib.plugable: DEBUG: importing plugin module ipaclient.plugins.certprofile ipalib.plugable: DEBUG: importing plugin module ipaclient.plugins.csrgen ipalib.plugable: DEBUG: importing plugin module ipaclient.plugins.dns ipalib.plugable: DEBUG: importing plugin module ipaclient.plugins.hbacrule ipalib.plugable: DEBUG: importing plugin module ipaclient.plugins.hbactest ipalib.plugable: DEBUG: importing plugin module ipaclient.plugins.host ipalib.plugable: DEBUG: importing plugin module ipaclient.plugins.idrange ipalib.plugable: DEBUG: importing plugin module ipaclient.plugins.internal ipalib.plugable: DEBUG: importing plugin module ipaclient.plugins.location ipalib.plugable: DEBUG: importing plugin module ipaclient.plugins.migration ipalib.plugable: DEBUG: importing plugin module ipaclient.plugins.misc ipalib.plugable: DEBUG: importing plugin module ipaclient.plugins.otptoken ipalib.plugable: DEBUG: importing plugin module ipaclient.plugins.otptoken_yubikey ipalib.plugable: DEBUG: importing plugin module ipaclient.plugins.passwd ipalib.plugable: DEBUG: importing plugin module ipaclient.plugins.permission ipalib.plugable: DEBUG: importing plugin module ipaclient.plugins.rpcclient ipalib.plugable: DEBUG: importing plugin module ipaclient.plugins.server ipalib.plugable: DEBUG: importing plugin module ipaclient.plugins.service ipalib.plugable: DEBUG: importing plugin module ipaclient.plugins.sudorule ipalib.plugable: DEBUG: importing plugin module ipaclient.plugins.topology ipalib.plugable: DEBUG: importing plugin module ipaclient.plugins.trust ipalib.plugable: DEBUG: importing plugin module ipaclient.plugins.user ipalib.plugable: DEBUG: importing plugin module ipaclient.plugins.vault ipalib.rpc: DEBUG: found session_cookie in persistent storage for principal 'admin(a)FIXEDANDMOBILE.COM', cookie: 'ipa_session=MagBearerToken=7PkGtgj%2fPCAF7lH774apcgiEy8NWrTzE3mFkHYl0eLj3%2bujnT%2fQru5wDXVKPv5ky7TwRzS%2bVifAcvSv97FnucGLDC%2b17365XlJuuexo2K0IueTFg5oFAdOf6aCk%2bB%2bNC8Rjawej3u1gidQa8y285gLYBmD0rW44cdrHaulcW72pgD1ts1%2fC1uwRsolhCx30Iwfe0Qj9TGSjd0OvS0TfS0A%3d%3d' ipalib.rpc: DEBUG: setting session_cookie into context 'ipa_session=MagBearerToken=7PkGtgj%2fPCAF7lH774apcgiEy8NWrTzE3mFkHYl0eLj3%2bujnT%2fQru5wDXVKPv5ky7TwRzS%2bVifAcvSv97FnucGLDC%2b17365XlJuuexo2K0IueTFg5oFAdOf6aCk%2bB%2bNC8Rjawej3u1gidQa8y285gLYBmD0rW44cdrHaulcW72pgD1ts1%2fC1uwRsolhCx30Iwfe0Qj9TGSjd0OvS0TfS0A%3d%3d;' ipalib.rpc: INFO: trying https://ipa5.fixedandmobile.com/ipa/session/json ipalib.rpc: DEBUG: New HTTP connection (ipa5.fixedandmobile.com) ipalib.rpc: DEBUG: received Set-Cookie (<type 'list'>)'['ipa_session=MagBearerToken=7PkGtgj%2fPCAF7lH774apcgiEy8NWrTzE3mFkHYl0eLj3%2bujnT%2fQru5wDXVKPv5ky7TwRzS%2bVifAcvSv97FnucGLDC%2b17365XlJuuexo2K0IueTFg5oFAdOf6aCk%2bB%2bNC8Rjawej3u1gidQa8y285gLYBmD0rW44cdrHaulcW72pgD1ts1%2fC1uwRsolhCx30Iwfe0Qj9TGSjd0OvS0TfS0A%3d%3d;path=/ipa;httponly;secure;']' ipalib.rpc: DEBUG: storing cookie 'ipa_session=MagBearerToken=7PkGtgj%2fPCAF7lH774apcgiEy8NWrTzE3mFkHYl0eLj3%2bujnT%2fQru5wDXVKPv5ky7TwRzS%2bVifAcvSv97FnucGLDC%2b17365XlJuuexo2K0IueTFg5oFAdOf6aCk%2bB%2bNC8Rjawej3u1gidQa8y285gLYBmD0rW44cdrHaulcW72pgD1ts1%2fC1uwRsolhCx30Iwfe0Qj9TGSjd0OvS0TfS0A%3d%3d;' for principal admin(a)FIXEDANDMOBILE.COM ipalib.backend: DEBUG: Created connection context.rpcclient_139889190138192 ipalib.install.kinit: DEBUG: Initializing principal host/ ipa5.fixedandmobile.com(a)FIXEDANDMOBILE.COM using keytab /etc/krb5.keytab ipalib.install.kinit: DEBUG: using ccache /tmp/tmp-Rln5Jh/ccache ipapython.admintool: DEBUG: File "/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 178, in execute return_value = self.run() File "/usr/lib/python2.7/site-packages/ipaclient/install/ipa_certupdate.py", line 62, in run run_with_args(api) File "/usr/lib/python2.7/site-packages/ipaclient/install/ipa_certupdate.py", line 83, in run_with_args kinit_keytab(principal, paths.KRB5_KEYTAB, ccache_name) File "/usr/lib/python2.7/site-packages/ipalib/install/kinit.py", line 47, in kinit_keytab cred = gssapi.Credentials(name=name, store=store, usage='initiate') File "/usr/lib64/python2.7/site-packages/gssapi/creds.py", line 64, in __new__ store=store) File "/usr/lib64/python2.7/site-packages/gssapi/creds.py", line 148, in acquire usage) File "ext_cred_store.pyx", line 182, in gssapi.raw.ext_cred_store.acquire_cred_from (gssapi/raw/ext_cred_store.c:1732) ipapython.admintool: DEBUG: The ipa-certupdate command failed, exception: GSSError: Major (851968): Unspecified GSS failure. Minor code may provide more information, Minor (2529639107): No credentials cache found ipapython.admintool: ERROR: Major (851968): Unspecified GSS failure. Minor code may provide more information, Minor (2529639107): No credentials cache found ipapython.admintool: ERROR: The ipa-certupdate command failed.

2 1

LDAP from web application to AD via Freeipa does not, should this work?
by joost albers 09 Mar '20

09 Mar '20

I am not sure if what I am expecting is supposed to work the way i envision it. We have freeipa 4.6.5 and MS ad 2016. All works well for system logins , ad users can ssh to hosts enrolled to freeipa/ we also have a few web ui;s zabbix, custom app, that currently authenticate Freeipa users using ldap only. I was under the impression that Freeipa could determine the user is not an ipa user but an ad user based on the supplied domain and them perform the authentication against the AD. For this i would then need to change the bind and base dn on the respective applications. the question is. in an ipa-ad trust relationship, can we still use the basic ldap authentication for both internal (ipa) and external (ad) users? What base, bind DN do we need to set to enable this? i.e. we now have "cn=users,cn=accounts,dc=EXAMPLE,dc=EXAMPLE,dc=COM" do we need to change this to (i saw this in the ipa ldap logs a lot) "cn=Default Trust View,cn=views,cn=accounts,dc=EXAMPLE,dc=EXAMPLE,dc=COM" Kind regards

2 1

Re: Ubuntu client: Kerberos works, authenticationdoes not
by Alexander Bokovoy 07 Mar '20

07 Mar '20

Do not drop the mailing list, please. On la, 07 maalis 2020, Nick DeMarco wrote: >root@drupal:~# getent passwd ndemarco So, SSSD does not see the user. >root@drupal:~# sssctl domain-status pchem.pro >Unable to get online status [3]: Communication error >org.freedesktop.systemd1.NoSuchUnit: Unit sssd-ifp.service not found. >Unable to get online status > >I haven’t looked up what might be wrong yet. Install sssd-dbus package (or similar in your OS). In general, please follow https://docs.pagure.org/SSSD.sssd/users/troubleshooting.html -- / Alexander Bokovoy Sr. Principal Software Engineer Security / Identity Management Engineering Red Hat Limited, Finland

1 0

Re: Ubuntu client: Kerberos works, authentication does not
by Kevin Vasko 07 Mar '20

07 Mar '20

Does the user have access to the machine? -Kevin > On Mar 7, 2020, at 11:33 AM, Nicholas DeMarco via FreeIPA-users <freeipa-users(a)lists.fedorahosted.org> wrote: >

2 3

Re: freeIPA in a complex multi-subnet, multi-domain, multi-identity provider lab environment
by Angus Clarke 06 Mar '20

06 Mar '20

Or indeed chose any of your existing DNS domains for the IPA servers, I suspect changing the domain at a later time might be troublesome, so maybe pick one that has some assured longevity to it! Regards Angus ________________________________ From: Angus Clarke via FreeIPA-users <freeipa-users(a)lists.fedorahosted.org> Sent: Friday, March 6, 2020 9:49:20 PM To: FreeIPA users list <freeipa-users(a)lists.fedorahosted.org> Cc: Todd Grayson <tgrayson(a)cloudera.com>; Angus Clarke <post(a)angusclarke.com> Subject: [Freeipa-users] Re: freeIPA in a complex multi-subnet, multi-domain, multi-identity provider lab environment Hello As far as I'm aware, Kerberos requires DNS A records for clients and servers. Could you not just setup freeIPA using its internal DNS using a new domain just to add the ipa servers to, and then have forwarding between the different DNS systems? Clients can be under any DNS domain you like, as long as they resolve. Regards Angus ________________________________ From: Todd Grayson via FreeIPA-users <freeipa-users(a)lists.fedorahosted.org> Sent: Friday, March 6, 2020 4:50:25 PM To: freeipa-users(a)lists.fedorahosted.org <freeipa-users(a)lists.fedorahosted.org> Cc: Todd Grayson <tgrayson(a)cloudera.com> Subject: [Freeipa-users] freeIPA in a complex multi-subnet, multi-domain, multi-identity provider lab environment Hello, Reading what I can find, it seems that its almost impossible to use freeIPA clients and expect to not have to configure DNS SRV or TEXT records to resolve the freeIPA for eveything, which is a shock... is appears to be no simple way to just have krb5.conf's that fall back on non DNS related resolution of KDC [realm] and [domain_realm] based resolution and mapping.... is that correct? Or am I missing some discussion on how to force a ipaclient setup to handle this kind of "krb5.conf" mapping instead of depending on DNS? I'm tasked with trying to bring IPA into what is a long standing lab environment that spans multiple cloud providers, multiple data centers, and collections of ad-hoc environments that we need to develop, train, and test within. Naturally this is spanning about 10 or so unique BIND dns domains. There are 6 separate active directory domains as well representing the range of domain functional levels from 2008 - 2016 that handle their own DNS. The environment historically includes a mix of MIT kerberos and Active directory domains,as well as ad-hoc MIT realms that are set up for exercising various cross realm trust scenarios from Java, Python and other application stacks. I'm hoping to end up with a few discreete freeIPA domains as a centralized static service that can be shared, rather than make everyone setup ad-hoc IPA instances, but its looking like my approach is NOT going to work and we are going to have to cookbook adhoc IPA setups that will be in conflict with each other within the subnets they pop up in. Am I mssing something as far as non DNS aware freeIPA integration? Or is the design really locked down as much as it seems to where everything must be coordinated at the network DNS level to get these lab systems (small clusters) scattered across these lab environments to be able to register as ipa clients? Any pointers to blogs, threads etc that speak to this would be greatly appreciated... _______________________________________________ FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org Fedora Code of Conduct: https://nam03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdocs.fedo…<https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdocs.fedo…> List Guidelines: https://nam03.safelinks.protection.outlook.com/?url=https%3A%2F%2Ffedorapro…<https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Ffedorapro…> List Archives: https://nam03.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.fed…<https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.fed…>

1 0

freeIPA in a complex multi-subnet, multi-domain, multi-identity provider lab environment
by Todd Grayson 06 Mar '20

06 Mar '20

Hello, Reading what I can find, it seems that its almost impossible to use freeIPA clients and expect to not have to configure DNS SRV or TEXT records to resolve the freeIPA for eveything, which is a shock... is appears to be no simple way to just have krb5.conf's that fall back on non DNS related resolution of KDC [realm] and [domain_realm] based resolution and mapping.... is that correct? Or am I missing some discussion on how to force a ipaclient setup to handle this kind of "krb5.conf" mapping instead of depending on DNS? I'm tasked with trying to bring IPA into what is a long standing lab environment that spans multiple cloud providers, multiple data centers, and collections of ad-hoc environments that we need to develop, train, and test within. Naturally this is spanning about 10 or so unique BIND dns domains. There are 6 separate active directory domains as well representing the range of domain functional levels from 2008 - 2016 that handle their own DNS. The environment historically includes a mix of MIT kerberos and Active directory domains,as well as ad-hoc MIT realms that are set up for exercising various cross realm trust scenarios from Java, Python and other application stacks. I'm hoping to end up with a few discreete freeIPA domains as a centralized static service that can be shared, rather than make everyone setup ad-hoc IPA instances, but its looking like my approach is NOT going to work and we are going to have to cookbook adhoc IPA setups that will be in conflict with each other within the subnets they pop up in. Am I mssing something as far as non DNS aware freeIPA integration? Or is the design really locked down as much as it seems to where everything must be coordinated at the network DNS level to get these lab systems (small clusters) scattered across these lab environments to be able to register as ipa clients? Any pointers to blogs, threads etc that speak to this would be greatly appreciated...

3 2

Different home folder in different hosts
by Isidro González 06 Mar '20

06 Mar '20

Hi, I am trying to have different homedir paths for a user depending on whether he is on his desktop (/home/user) or on a computer from a pool (/nfs/user). This is not ideal but I want to be sure the user can log in his desktop if the NFS server is down and this will solve some issues with using snap packages for applications we need. I tried a solution with id views following the info in https://blog.delouw.ch/2015/04/06/migrating-legacy-servers-to-freeipa-authe… but no success. My configuration is: # ipa idoverrideuser-show myuser_desktop myuser Anchor to override: myuser Description: myuser home change User login: myuser Home directory: /home/myuser # ipa idview-show --show-hosts myuser_desktop ID View Name: myuser_desktop Description: MyUser Desktop User object overrides: myuser Hosts the view applies to: myuserdesktop.somewhere.com And if I log into myuserdesktop.somewhere.com and check # getent passwd myuser myuser:*:6037:6000:Someone Surname:/nfs/myuser:/bin/bash where I expected the home dir to be /home/myuser. Am I missing something?

2 1

ipa-server-upgrade fails: bus, object_path and dbus_interface must not be None
by David Carter 05 Mar '20

05 Mar '20

Freeipa was running fine, then I guess it tried to update and now I have an unusable system and it's impacting other systems. I've seen this error in a few online postings but no fix that I can apply. When I run it manually: [root@kdc1 log]# ipa-server-upgrade Upgrading IPA:. Estimated time: 1 minute 30 seconds [1/11]: stopping directory server [2/11]: saving configuration [3/11]: disabling listeners [4/11]: enabling DS global lock [5/11]: disabling Schema Compat [6/11]: starting directory server [7/11]: updating schema [8/11]: upgrading server [9/11]: stopping directory server [10/11]: restoring configuration [11/11]: starting directory server Done. Update complete Upgrading IPA services Upgrading the configuration of the IPA services [Verifying that root certificate is published] [Migrate CRL publish directory] CRL tree already moved [Verifying that CA proxy configuration is correct] [Verifying that KDC configuration is using ipa-kdb backend] [Fix DS schema file syntax] Syntax already fixed [Removing RA cert from DS NSS database] RA cert already removed [Enable sidgen and extdom plugins by default] [Updating HTTPD service IPA configuration] [Updating HTTPD service IPA WSGI configuration] Nothing to do for configure_httpd_wsgi_conf [Updating mod_nss protocol versions] Protocol versions already updated [Updating mod_nss cipher suite] [Updating mod_nss enabling OCSP] [Fixing trust flags in /etc/httpd/alias] Trust flags already processed [Moving HTTPD service keytab to gssproxy] [Removing self-signed CA] [Removing Dogtag 9 CA] [Checking for deprecated KDC configuration files] [Checking for deprecated backups of Samba configuration files] [Add missing CA DNS records] IPA CA DNS records already processed [Removing deprecated DNS configuration options] DNS is not configured [Ensuring minimal number of connections] DNS is not configured [Updating GSSAPI configuration in DNS] DNS is not configured [Updating pid-file configuration in DNS] DNS is not configured DNS is not configured DNS is not configured DNS is not configured DNS is not configured DNS is not configured DNS is not configured DNS is not configured [Upgrading CA schema] CA schema update complete (no changes) [Verifying that CA audit signing cert has 2 year validity] [Update certmonger certificate renewal configuration] Failed to get request: bus, object_path and dbus_interface must not be None. IPA server upgrade failed: Inspect /var/log/ipaupgrade.log and run command ipa-server-upgrade manually. bus, object_path and dbus_interface must not be None. The ipa-server-upgrade command failed. See /var/log/ipaupgrade.log for more information The tail of the log file (it is very long): 2020-03-03T03:51:44Z DEBUG stderr= 2020-03-03T03:51:44Z DEBUG Loading Index file from '/var/lib/ipa/sysrestore/sysrestore.index' 2020-03-03T03:51:44Z DEBUG Starting external process 2020-03-03T03:51:44Z DEBUG args=/usr/bin/certutil -d dbm:/etc/pki/pki-tomcat/alias -L -f /etc/pki/pki-tomcat/alias/pwdfile.txt 2020-03-03T03:51:44Z DEBUG Process finished, return code=0 2020-03-03T03:51:44Z DEBUG stdout= Certificate Nickname Trust Attributes SSL,S/MIME,JAR/XPI caSigningCert cert-pki-ca CTu,Cu,Cu auditSigningCert cert-pki-ca u,u,Pu Server-Cert cert-pki-ca u,u,u ocspSigningCert cert-pki-ca u,u,u subsystemCert cert-pki-ca u,u,u 2020-03-03T03:51:44Z DEBUG stderr= 2020-03-03T03:51:44Z ERROR Failed to get request: bus, object_path and dbus_interface must not be None. 2020-03-03T03:51:44Z ERROR IPA server upgrade failed: Inspect /var/log/ipaupgrade.log and run command ipa-server-upgrade manually. 2020-03-03T03:51:44Z DEBUG File "/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 178, in execute return_value = self.run() File "/usr/lib/python2.7/site-packages/ipaserver/install/ipa_server_upgrade.py", line 56, in run raise admintool.ScriptError(str(e)) 2020-03-03T03:51:44Z DEBUG The ipa-server-upgrade command failed, exception: ScriptError: bus, object_path and dbus_interface must not be None. 2020-03-03T03:51:44Z ERROR bus, object_path and dbus_interface must not be None. 2020-03-03T03:51:44Z ERROR The ipa-server-upgrade command failed. See /var/log/ipaupgrade.log for more information I can run the certutil command separately, so it doesn't seem to be that. I have no idea what the issue is, where to look, or how I can fix this. Suggestions? OS: CentOS 7 IPA version: VERSION: 4.6.5, API_VERSION: 2.231

2 7

Having issues/confusion about setting up a forwarding zone
by mike clagett 05 Mar '20

05 Mar '20

hi all, Here is my scenario. I will just use .mike as my TLD example here: TLD domain - .mike Primary FreeIPA server that is serving as my master DNS - freeipa.mike Within this setup, I want to set up a dns zone called dev.mike, with its own DNS server called freeipa0.dev.mike to manage all dns in the dev.mike zone, while leaving freeipa.mike to manage the rest production dns. In my client machine (Mac OS X) - when I try to nslookup a domain in the dev.mike zone, I get a non-authoritative answer from the freeipa.mike server. Results of forwardzone-show for my freeipa.mike: ipa dnsforwardzone-show dev.mike. Zone name: dev.mike. Active zone: TRUE Zone forwarders: 10.x.x.x. (this IP is the correct IP address of the freeipa0.dev.mike server) Forward policy: first The issue I am having is sometimes my dev.mike domains just won't resolve, and I have to manually add the dev.mike dns server to my network settings and remove all the other DNS settings to get to VM's in my dev.mike zone. Can anybody assist me with some troubleshooting to figure out why why dns forwarding isn't working 100% reliably?

2 1

Dogtag certificate profiles
by Nicholas DeMarco 05 Mar '20

05 Mar '20

Hello, I'm quite new to PKI concepts. My question is difficult for me but will be simple for many who read this. I've posted these questions on ServerFault. https://serverfault.com/questions/1005588/what-freeipa-certificate-profile-… https://serverfault.com/questions/1005564/freeipa-refuses-to-sign-a-vmware-… I've been reading Fraser's article User certificates and custom profiles with FreeIPA 4.2 <https://frasertweedale.github.io/blog-redhat/posts/2015-08-06-freeipa-custo… >. He answers most questions, but raises these for me: 1. Dogtag has many custom Certificate Profiles <https://github.com/dogtagpki/pki/tree/master/base/ca/shared/profiles/ca>. They're in FreeIPA (at /usr/share/pki/ca/profiles/ca). They don't seem to be directly importable into FreeIPA. Where can I start learning about the differences between Dogtag and FreeIPA certificate profiles? 2. If a 'how to' guide on applying particular certificate profiles exists, where would I find such a guide? (RFC5280 is not digestable!). Sincerely, Nick

2 4

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users March 2020