March 2020 - FreeIPA-users - Fedora mailing-lists

setup_pr_read_pds - Not listening for new connections - too many fds open
by Lukasz Jaworski 17 Mar '20

17 Mar '20

Hi, I've upgraded freeipa 4.6.x environment on Fedora 27 to 4.8.4 on fedora 31. - remove old replica - install fedora 31 - connect as new replica... now: 389-ds-base-1.4.2.8-3.fc31.x86_64 freeipa-server-4.8.4-2.fc31.x86_64 after that, I have many errors: setup_pr_read_pds - Not listening for new connections - too many fds open It looks like fd limit 1024 I've checked: nsslapd-maxdescriptors: ldapsearch -xLLL -b "cn=config" -D 'cn=Directory Manager' -W cn=config nsslapd-maxdescriptors Enter LDAP Password: dn: cn=config nsslapd-maxdescriptors: 524288 /proc/limits: cat /proc/2164872/limits Limit Soft Limit Hard Limit Units Max cpu time unlimited unlimited seconds Max file size unlimited unlimited bytes Max data size unlimited unlimited bytes Max stack size 8388608 unlimited bytes Max core file size unlimited unlimited bytes Max resident set unlimited unlimited bytes Max processes 515206 515206 processes Max open files 524288 524288 files Max locked memory 65536 65536 bytes Max address space unlimited unlimited bytes Max file locks unlimited unlimited locks Max pending signals 515206 515206 signals Max msgqueue size 819200 819200 bytes Max nice priority 0 0 Max realtime priority 0 0 Max realtime timeout unlimited unlimited us dirsrv log: [17/Mar/2020:09:12:18.119324801 +0100] - INFO - main - Setting the maximum file descriptor limit to: 524288 find /proc/2164872/fd | wc -l 1037 It looks like 1024 is connection limit. Any idea what I've done wrong? Best regards, Ender - Lukasz Jaworski

2 3

Re: Expired Certificates, rolling back time didn't help
by Florence Blanc-Renaud 17 Mar '20

17 Mar '20

On 3/16/20 11:44 PM, Bhavin Vaidya via FreeIPA-users wrote: > Hello, > > We had similar issue 2 yrs back, and resurface as it didn't auto-renew. > Went back in time to 2016-06-11 as well as 2020-02-20, restarted > "certmonger", didn't update. > Hi, you need to check first which server is your renewal master: $ kinit admin $ ipa config-show | grep renewal The output should display the name of the renewal master. This host is the first server that needs to be fixed. In the getcert list output that you provided, we can see that: - the PKI certificates shared between the servers expired on 2020-02-25 (auditSigningCert cert-pki-ca, ocspSigningCert cert-pki-ca, subsystemCert cert-ki-ca) - the CA cert is still valid - the RA cert expired on 2018-06-15 - the HTTP and LDAP server certs expired on 2020-03-07 You need to carefully pick the date you go back in time: at that given date, all the certs must be valid (not expired yet but *already valid*). From your output, the date needs to be before 2018-06-15 but after 2018-03-08 (=the validFrom date for the PKI certs). HTH, flo > FreeIPA Master:*CentOS 7.4.1708, FreeIPA Version: **4.5.0, > API_VERSION: 2.228* > > whileipactl start, it will not start pki-tomcat with > message,pki-tomcatd Service: STOPPED. > > Referring toRob's blog > <https://rcritten.wordpress.com/2017/09/20/peer-certificate-cannot-be-authen…> > > [root@srv01 ~]# curl --cacert /etc/ipa/ca.crt > -v[https://%60hostname%60:8443/ca/ww/ca/getCertChain]https://`hostname`:8443/ca/ww/ca/getCertChain > > * About to connect() to srv01.example.com port 8443 (#0) > > *Trying 192.168.10.146... > > * Connected to srv01.example.com (192.168.10.146) port 8443 (#0) > > * Initializing NSS with certpath: sql:/etc/pki/nssdb > > *CAfile: /etc/ipa/ca.crt > > CApath: none > > * Server certificate: > > *subject: CN=srv01.example.com,O=EXAMPLE.COM > > *start date: Dec 26 21:02:44 2016 GMT > > *expire date: Dec 16 21:02:44 2018 GMT > > *common name: srv01.example.com > > *issuer: CN=Certificate Authority,O=EXAMPLE.COM > > * NSS error -8172 (SEC_ERROR_UNTRUSTED_ISSUER) > > * Peer's certificate issuer has been marked as not trusted by the user. > > * Closing connection 0 > > curl: (60) Peer's certificate issuer has been marked as not trusted by > the user. > > More details here:http://curl.haxx.se/docs/sslcerts.html > > curl performs SSL certificate verification by default, using a "bundle" > > of Certificate Authority (CA) public keys (CA certs). If the > defaultbundle file isn't adequate, you can specify an alternate > fileusing the --cacert option. > > If this HTTPS server uses a certificate signed by a CA represented > inthe bundle, the certificate verification probably failed due to > aproblem with the certificate (it might be expired, or the name > mightnot match the domain name in the URL). > > If you'd like to turn off curl's verification of the certificate, > usethe -k (or --insecure) option. > > > While, CA cert check asper > <https://www.freeipa.org/page/V4/CA_certificate_renewal>, > > [root@srv01 ~]# getcert list -d /etc/pki/pki-tomcat/alias -n > 'caSigningCert cert-pki-ca' > > Number of certificates and requests being tracked: 8. > > Request ID '20180315021502': > > status: MONITORING > > stuck: no > > key pair storage: > type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert > cert-pki-ca',token='NSS Certificate DB',pin set > > certificate: > type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert > cert-pki-ca',token='NSS Certificate DB' > > CA: dogtag-ipa-ca-renew-agent > > issuer: CN=Certificate Authority,O=EXAMPLE.COM > > subject: CN=Certificate Authority,O=EXAMPLE.COM > > expires: 2038-03-07 03:47:46 UTC > > key usage: digitalSignature,nonRepudiation,keyCertSign,cRLSign > > pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad > > post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert > "caSigningCert cert-pki-ca" > > track: yes > > auto-renew: yes > > We also have few others certificates, which are not renewed. > > > [root@srv01 ~]# getcert list > > Number of certificates and requests being tracked: 8. > > Request ID '20180228053337': > > status: MONITORING > > stuck: no > > key pair storage: type=FILE,location='/var/kerberos/krb5kdc/kdc.key' > > certificate: type=FILE,location='/var/kerberos/krb5kdc/kdc.crt' > > CA: SelfSign > > issuer: CN=srv01.example.com,O=EXAMPLE.COM > > subject: CN=srv01.example.com,O=EXAMPLE.COM > > expires: 2021-01-11 21:56:57 UTC > > principal name:krbtgt/EXAMPLE.COM@EXAMPLE.COM > <mailto:krbtgt/EXAMPLE.COM@EXAMPLE.COM> > > certificate template/profile: KDCs_PKINIT_Certs > > pre-save command: > > post-save command: /usr/libexec/ipa/certmonger/renew_kdc_cert > > track: yes > > auto-renew: yes > > Request ID '20180315021457': > > status: MONITORING > > stuck: no > > key pair storage: > type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert > cert-pki-ca',token='NSS Certificate DB',pin set > > certificate: > type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert > cert-pki-ca',token='NSS Certificate DB' > > CA: dogtag-ipa-ca-renew-agent > > issuer: CN=Certificate Authority,O=EXAMPLE.COM > > subject: CN=CA Audit,O=EXAMPLE.COM > > expires: 2020-02-25 04:27:49 UTC > > key usage: digitalSignature,nonRepudiation > > pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad > > post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert > "auditSigningCert cert-pki-ca" > > track: yes > > auto-renew: yes > > Request ID '20180315021500': > > status: MONITORING > > stuck: no > > key pair storage: > type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert > cert-pki-ca',token='NSS Certificate DB',pin set > > certificate: > type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert > cert-pki-ca',token='NSS Certificate DB' > > CA: dogtag-ipa-ca-renew-agent > > issuer: CN=Certificate Authority,O=EXAMPLE.COM > > subject: CN=OCSP Subsystem,O=EXAMPLE.COM > > expires: 2020-02-25 04:28:38 UTC > > eku: id-kp-OCSPSigning > > pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad > > post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert > "ocspSigningCert cert-pki-ca" > > track: yes > > auto-renew: yes > > Request ID '20180315021501': > > status: MONITORING > > stuck: no > > key pair storage: > type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert > cert-pki-ca',token='NSS Certificate DB',pin set > > certificate: > type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert > cert-pki-ca',token='NSS Certificate DB' > > CA: dogtag-ipa-ca-renew-agent > > issuer: CN=Certificate Authority,O=EXAMPLE.COM > > subject: CN=CA Subsystem,O=EXAMPLE.COM > > expires: 2020-02-25 04:31:47 UTC > > key usage: > digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment > > eku: id-kp-serverAuth,id-kp-clientAuth > > pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad > > post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert > "subsystemCert cert-pki-ca" > > track: yes > > auto-renew: yes > > Request ID '20180315021502': > > status: MONITORING > > stuck: no > > key pair storage: > type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert > cert-pki-ca',token='NSS Certificate DB',pin set > > certificate: > type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert > cert-pki-ca',token='NSS Certificate DB' > > CA: dogtag-ipa-ca-renew-agent > > issuer: CN=Certificate Authority,O=EXAMPLE.COM > > subject: CN=Certificate Authority,O=EXAMPLE.COM > > expires: 2038-03-07 03:47:46 UTC > > key usage: digitalSignature,nonRepudiation,keyCertSign,cRLSign > > pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad > > post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert > "caSigningCert cert-pki-ca" > > track: yes > > auto-renew: yes > > Request ID '20180315021503': > > status: CA_UNREACHABLE > > ca-error: Error 60 connecting > tohttps://srv01.example.com:8443/ca/agent/ca/profileReview: Peer > certificate cannot be authenticated with given CA certificates. > > stuck: no > > key pair storage: type=FILE,location='/var/lib/ipa/ra-agent.key' > > certificate: type=FILE,location='/var/lib/ipa/ra-agent.pem' > > CA: dogtag-ipa-ca-renew-agent > > issuer: CN=Certificate Authority,O=EXAMPLE.COM > > subject: CN=IPA RA,O=EXAMPLE.COM > > expires: 2018-06-15 23:15:23 UTC > > key usage: > digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment > > eku: id-kp-serverAuth,id-kp-clientAuth > > pre-save command: /usr/libexec/ipa/certmonger/renew_ra_cert_pre > > post-save command: /usr/libexec/ipa/certmonger/renew_ra_cert > > track: yes > > auto-renew: yes > > Request ID '20180315021505': > > status: CA_UNREACHABLE > > ca-error: Server athttps://srv01.example.com/ipa/xmlfailed request, > will retry: 4016 (RPC failed at server.Failed to authenticate to CA > REST API). > > stuck: no > > key pair storage: > type=NSSDB,location='/etc/dirsrv/slapd-EXAMPLE-COM',nickname='Server-Cert',token='NSS > Certificate DB',pinfile='/etc/dirsrv/slapd-EXAMPLE-COM/pwd > > file.txt' > > certificate: > type=NSSDB,location='/etc/dirsrv/slapd-EXAMPLE-COM',nickname='Server-Cert',token='NSS > Certificate DB' > > CA: IPA > > issuer: CN=Certificate Authority,O=EXAMPLE.COM > > subject: CN=srv01.example.com,O=EXAMPLE.COM > > expires: 2020-03-07 08:49:36 UTC > > principal name:ldap/srv01.example.com@EXAMPLE.COM > <mailto:ldap/srv01.example.com@EXAMPLE.COM> > > key usage: > digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment > > eku: id-kp-serverAuth,id-kp-clientAuth > > pre-save command: > > post-save command: /usr/libexec/ipa/certmonger/restart_dirsrv EXAMPLE-COM > > track: yes > > auto-renew: yes > > Request ID '20180315021510': > > status: CA_UNREACHABLE > > ca-error: Server athttps://srv01.example.com/ipa/xmlfailed request, > will retry: 4016 (RPC failed at server.Failed to authenticate to CA > REST API). > > stuck: no > > key pair storage: > type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS > Certificate DB',pinfile='/etc/httpd/alias/pwdfile.txt' > > certificate: > type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS > Certificate DB' > > CA: IPA > > issuer: CN=Certificate Authority,O=EXAMPLE.COM > > subject: CN=srv01.example.com,O=EXAMPLE.COM > > expires: 2020-03-07 08:49:51 UTC > > principal name:HTTP/srv01.example.com@EXAMPLE.COM > <mailto:HTTP/srv01.example.com@EXAMPLE.COM> > > key usage: > digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment > > eku: id-kp-serverAuth,id-kp-clientAuth > > pre-save command: > > post-save command: /usr/libexec/ipa/certmonger/restart_httpd > > track: yes > > auto-renew: yes > > > thank you for your help. > Bhavin > > > > _______________________________________________ > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org > To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org > Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost…

2 1

Some users unable to log in to host
by Kristian Petersen 17 Mar '20

17 Mar '20

Hey all, I have a user that is trying to log into a host that is configured to have access restricted via an HBAC rule. This user is a member of one of the groups defined in the HBAC rule that should be granted access. When this user tries to SSH in to this host, they get 3 consecutive password prompts like "Password:" and then one like "username@domain's password:" and then they get a response of "Permission denied, please try again." I am not seeing any entries in the messages log or secure log for this user from these log in attempts. Anyone have any thoughts about why this is happening? -- Kristian Petersen System Administrator BYU Dept. of Chemistry and Biochemistry

2 1

Expired Certificates, rolling back time didn't help
by Bhavin Vaidya 16 Mar '20

16 Mar '20

Hello, We had similar issue 2 yrs back, and resurface as it didn't auto-renew. Went back in time to 2016-06-11 as well as 2020-02-20, restarted "certmonger", didn't update. FreeIPA Master: CentOS 7.4.1708, FreeIPA Version: 4.5.0, API_VERSION: 2.228 while ipactl start, it will not start pki-tomcat with message, pki-tomcatd Service: STOPPED. Referring to Rob's blog<https://rcritten.wordpress.com/2017/09/20/peer-certificate-cannot-be-authen…> [root@srv01 ~]# curl --cacert /etc/ipa/ca.crt -v [https://%60hostname%60:8443/ca/ww/ca/getCertChain]https://`hostname`:8443/ca/ww/ca/getCertChain * About to connect() to srv01.example.com port 8443 (#0) * Trying 192.168.10.146... * Connected to srv01.example.com (192.168.10.146) port 8443 (#0) * Initializing NSS with certpath: sql:/etc/pki/nssdb * CAfile: /etc/ipa/ca.crt CApath: none * Server certificate: * subject: CN=srv01.example.com,O=EXAMPLE.COM * start date: Dec 26 21:02:44 2016 GMT * expire date: Dec 16 21:02:44 2018 GMT * common name: srv01.example.com * issuer: CN=Certificate Authority,O=EXAMPLE.COM * NSS error -8172 (SEC_ERROR_UNTRUSTED_ISSUER) * Peer's certificate issuer has been marked as not trusted by the user. * Closing connection 0 curl: (60) Peer's certificate issuer has been marked as not trusted by the user. More details here: http://curl.haxx.se/docs/sslcerts.html curl performs SSL certificate verification by default, using a "bundle" of Certificate Authority (CA) public keys (CA certs). If the default bundle file isn't adequate, you can specify an alternate file using the --cacert option. If this HTTPS server uses a certificate signed by a CA represented in the bundle, the certificate verification probably failed due to a problem with the certificate (it might be expired, or the name might not match the domain name in the URL). If you'd like to turn off curl's verification of the certificate, use the -k (or --insecure) option. While, CA cert check as per<https://www.freeipa.org/page/V4/CA_certificate_renewal>, [root@srv01 ~]# getcert list -d /etc/pki/pki-tomcat/alias -n 'caSigningCert cert-pki-ca' Number of certificates and requests being tracked: 8. Request ID '20180315021502': status: MONITORING stuck: no key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert cert-pki-ca',token='NSS Certificate DB',pin set certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert cert-pki-ca',token='NSS Certificate DB' CA: dogtag-ipa-ca-renew-agent issuer: CN=Certificate Authority,O=EXAMPLE.COM subject: CN=Certificate Authority,O=EXAMPLE.COM expires: 2038-03-07 03:47:46 UTC key usage: digitalSignature,nonRepudiation,keyCertSign,cRLSign pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "caSigningCert cert-pki-ca" track: yes auto-renew: yes We also have few others certificates, which are not renewed. [root@srv01 ~]# getcert list Number of certificates and requests being tracked: 8. Request ID '20180228053337': status: MONITORING stuck: no key pair storage: type=FILE,location='/var/kerberos/krb5kdc/kdc.key' certificate: type=FILE,location='/var/kerberos/krb5kdc/kdc.crt' CA: SelfSign issuer: CN=srv01.example.com,O=EXAMPLE.COM subject: CN=srv01.example.com,O=EXAMPLE.COM expires: 2021-01-11 21:56:57 UTC principal name: krbtgt/EXAMPLE.COM(a)EXAMPLE.COM<mailto:krbtgt/EXAMPLE.COM@EXAMPLE.COM> certificate template/profile: KDCs_PKINIT_Certs pre-save command: post-save command: /usr/libexec/ipa/certmonger/renew_kdc_cert track: yes auto-renew: yes Request ID '20180315021457': status: MONITORING stuck: no key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert cert-pki-ca',token='NSS Certificate DB',pin set certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert cert-pki-ca',token='NSS Certificate DB' CA: dogtag-ipa-ca-renew-agent issuer: CN=Certificate Authority,O=EXAMPLE.COM subject: CN=CA Audit,O=EXAMPLE.COM expires: 2020-02-25 04:27:49 UTC key usage: digitalSignature,nonRepudiation pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "auditSigningCert cert-pki-ca" track: yes auto-renew: yes Request ID '20180315021500': status: MONITORING stuck: no key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert cert-pki-ca',token='NSS Certificate DB',pin set certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert cert-pki-ca',token='NSS Certificate DB' CA: dogtag-ipa-ca-renew-agent issuer: CN=Certificate Authority,O=EXAMPLE.COM subject: CN=OCSP Subsystem,O=EXAMPLE.COM expires: 2020-02-25 04:28:38 UTC eku: id-kp-OCSPSigning pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "ocspSigningCert cert-pki-ca" track: yes auto-renew: yes Request ID '20180315021501': status: MONITORING stuck: no key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert cert-pki-ca',token='NSS Certificate DB',pin set certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert cert-pki-ca',token='NSS Certificate DB' CA: dogtag-ipa-ca-renew-agent issuer: CN=Certificate Authority,O=EXAMPLE.COM subject: CN=CA Subsystem,O=EXAMPLE.COM expires: 2020-02-25 04:31:47 UTC key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment eku: id-kp-serverAuth,id-kp-clientAuth pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "subsystemCert cert-pki-ca" track: yes auto-renew: yes Request ID '20180315021502': status: MONITORING stuck: no key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert cert-pki-ca',token='NSS Certificate DB',pin set certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert cert-pki-ca',token='NSS Certificate DB' CA: dogtag-ipa-ca-renew-agent issuer: CN=Certificate Authority,O=EXAMPLE.COM subject: CN=Certificate Authority,O=EXAMPLE.COM expires: 2038-03-07 03:47:46 UTC key usage: digitalSignature,nonRepudiation,keyCertSign,cRLSign pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "caSigningCert cert-pki-ca" track: yes auto-renew: yes Request ID '20180315021503': status: CA_UNREACHABLE ca-error: Error 60 connecting to https://srv01.example.com:8443/ca/agent/ca/profileReview: Peer certificate cannot be authenticated with given CA certificates. stuck: no key pair storage: type=FILE,location='/var/lib/ipa/ra-agent.key' certificate: type=FILE,location='/var/lib/ipa/ra-agent.pem' CA: dogtag-ipa-ca-renew-agent issuer: CN=Certificate Authority,O=EXAMPLE.COM subject: CN=IPA RA,O=EXAMPLE.COM expires: 2018-06-15 23:15:23 UTC key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment eku: id-kp-serverAuth,id-kp-clientAuth pre-save command: /usr/libexec/ipa/certmonger/renew_ra_cert_pre post-save command: /usr/libexec/ipa/certmonger/renew_ra_cert track: yes auto-renew: yes Request ID '20180315021505': status: CA_UNREACHABLE ca-error: Server at https://srv01.example.com/ipa/xml failed request, will retry: 4016 (RPC failed at server. Failed to authenticate to CA REST API). stuck: no key pair storage: type=NSSDB,location='/etc/dirsrv/slapd-EXAMPLE-COM',nickname='Server-Cert',token='NSS Certificate DB',pinfile='/etc/dirsrv/slapd-EXAMPLE-COM/pwd file.txt' certificate: type=NSSDB,location='/etc/dirsrv/slapd-EXAMPLE-COM',nickname='Server-Cert',token='NSS Certificate DB' CA: IPA issuer: CN=Certificate Authority,O=EXAMPLE.COM subject: CN=srv01.example.com,O=EXAMPLE.COM expires: 2020-03-07 08:49:36 UTC principal name: ldap/srv01.example.com(a)EXAMPLE.COM<mailto:ldap/srv01.example.com@EXAMPLE.COM> key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment eku: id-kp-serverAuth,id-kp-clientAuth pre-save command: post-save command: /usr/libexec/ipa/certmonger/restart_dirsrv EXAMPLE-COM track: yes auto-renew: yes Request ID '20180315021510': status: CA_UNREACHABLE ca-error: Server at https://srv01.example.com/ipa/xml failed request, will retry: 4016 (RPC failed at server. Failed to authenticate to CA REST API). stuck: no key pair storage: type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS Certificate DB',pinfile='/etc/httpd/alias/pwdfile.txt' certificate: type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS Certificate DB' CA: IPA issuer: CN=Certificate Authority,O=EXAMPLE.COM subject: CN=srv01.example.com,O=EXAMPLE.COM expires: 2020-03-07 08:49:51 UTC principal name: HTTP/srv01.example.com(a)EXAMPLE.COM<mailto:HTTP/srv01.example.com@EXAMPLE.COM> key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment eku: id-kp-serverAuth,id-kp-clientAuth pre-save command: post-save command: /usr/libexec/ipa/certmonger/restart_httpd track: yes auto-renew: yes thank you for your help. Bhavin

1 0

Expired Certificates, rolling back time didn't help
by Bhavin Vaidya 16 Mar '20

16 Mar '20

Hello, We had similar issue 2 yrs back, and resurface as it didn't auto-renew. Went back in time to 2016-06-11 as well as 2020-02-20, restarted "certmonger", didn't update. FreeIPA Master: CentOS 7.4.1708, FreeIPA Version: 4.5.0, API_VERSION: 2.228 while ipactl start, it will not start pki-tomcat with message, pki-tomcatd Service: STOPPED. Referring to Rob's blog<https://rcritten.wordpress.com/2017/09/20/peer-certificate-cannot-be-authen…> [root@srv01 ~]# curl --cacert /etc/ipa/ca.crt -v https://`hostname`:8443/ca/ww/ca/getCertChain<https://%60hostname%60:8443/ca/ww/ca/getCertChain> * About to connect() to srv01.example.com port 8443 (#0) * Trying 192.168.10.146... * Connected to srv01.example.com (192.168.10.146) port 8443 (#0) * Initializing NSS with certpath: sql:/etc/pki/nssdb * CAfile: /etc/ipa/ca.crt CApath: none * Server certificate: * subject: CN=srv01.example.com,O=EXAMPLE.COM * start date: Dec 26 21:02:44 2016 GMT * expire date: Dec 16 21:02:44 2018 GMT * common name: srv01.example.com * issuer: CN=Certificate Authority,O=EXAMPLE.COM * NSS error -8172 (SEC_ERROR_UNTRUSTED_ISSUER) * Peer's certificate issuer has been marked as not trusted by the user. * Closing connection 0 curl: (60) Peer's certificate issuer has been marked as not trusted by the user. More details here: http://curl.haxx.se/docs/sslcerts.html curl performs SSL certificate verification by default, using a "bundle" of Certificate Authority (CA) public keys (CA certs). If the default bundle file isn't adequate, you can specify an alternate file using the --cacert option. If this HTTPS server uses a certificate signed by a CA represented in the bundle, the certificate verification probably failed due to a problem with the certificate (it might be expired, or the name might not match the domain name in the URL). If you'd like to turn off curl's verification of the certificate, use the -k (or --insecure) option. While, CA cert check as per<https://www.freeipa.org/page/V4/CA_certificate_renewal>, [root@srv01 ~]# getcert list -d /etc/pki/pki-tomcat/alias -n 'caSigningCert cert-pki-ca' Number of certificates and requests being tracked: 8. Request ID '20180315021502': status: MONITORING stuck: no key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert cert-pki-ca',token='NSS Certificate DB',pin set certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert cert-pki-ca',token='NSS Certificate DB' CA: dogtag-ipa-ca-renew-agent issuer: CN=Certificate Authority,O=EXAMPLE.COM subject: CN=Certificate Authority,O=EXAMPLE.COM expires: 2038-03-07 03:47:46 UTC key usage: digitalSignature,nonRepudiation,keyCertSign,cRLSign pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "caSigningCert cert-pki-ca" track: yes auto-renew: yes We also have few others certificates, which are not renewed. [root@srv01 ~]# getcert list Number of certificates and requests being tracked: 8. Request ID '20180228053337': status: MONITORING stuck: no key pair storage: type=FILE,location='/var/kerberos/krb5kdc/kdc.key' certificate: type=FILE,location='/var/kerberos/krb5kdc/kdc.crt' CA: SelfSign issuer: CN=srv01.example.com,O=EXAMPLE.COM subject: CN=srv01.example.com,O=EXAMPLE.COM expires: 2021-01-11 21:56:57 UTC principal name: krbtgt/EXAMPLE.COM(a)EXAMPLE.COM<mailto:krbtgt/EXAMPLE.COM@EXAMPLE.COM> certificate template/profile: KDCs_PKINIT_Certs pre-save command: post-save command: /usr/libexec/ipa/certmonger/renew_kdc_cert track: yes auto-renew: yes Request ID '20180315021457': status: MONITORING stuck: no key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert cert-pki-ca',token='NSS Certificate DB',pin set certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert cert-pki-ca',token='NSS Certificate DB' CA: dogtag-ipa-ca-renew-agent issuer: CN=Certificate Authority,O=EXAMPLE.COM subject: CN=CA Audit,O=EXAMPLE.COM expires: 2020-02-25 04:27:49 UTC key usage: digitalSignature,nonRepudiation pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "auditSigningCert cert-pki-ca" track: yes auto-renew: yes Request ID '20180315021500': status: MONITORING stuck: no key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert cert-pki-ca',token='NSS Certificate DB',pin set certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert cert-pki-ca',token='NSS Certificate DB' CA: dogtag-ipa-ca-renew-agent issuer: CN=Certificate Authority,O=EXAMPLE.COM subject: CN=OCSP Subsystem,O=EXAMPLE.COM expires: 2020-02-25 04:28:38 UTC eku: id-kp-OCSPSigning pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "ocspSigningCert cert-pki-ca" track: yes auto-renew: yes Request ID '20180315021501': status: MONITORING stuck: no key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert cert-pki-ca',token='NSS Certificate DB',pin set certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert cert-pki-ca',token='NSS Certificate DB' CA: dogtag-ipa-ca-renew-agent issuer: CN=Certificate Authority,O=EXAMPLE.COM subject: CN=CA Subsystem,O=EXAMPLE.COM expires: 2020-02-25 04:31:47 UTC key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment eku: id-kp-serverAuth,id-kp-clientAuth pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "subsystemCert cert-pki-ca" track: yes auto-renew: yes Request ID '20180315021502': status: MONITORING stuck: no key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert cert-pki-ca',token='NSS Certificate DB',pin set certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert cert-pki-ca',token='NSS Certificate DB' CA: dogtag-ipa-ca-renew-agent issuer: CN=Certificate Authority,O=EXAMPLE.COM subject: CN=Certificate Authority,O=EXAMPLE.COM expires: 2038-03-07 03:47:46 UTC key usage: digitalSignature,nonRepudiation,keyCertSign,cRLSign pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "caSigningCert cert-pki-ca" track: yes auto-renew: yes Request ID '20180315021503': status: CA_UNREACHABLE ca-error: Error 60 connecting to https://srv01.example.com:8443/ca/agent/ca/profileReview: Peer certificate cannot be authenticated with given CA certificates. stuck: no key pair storage: type=FILE,location='/var/lib/ipa/ra-agent.key' certificate: type=FILE,location='/var/lib/ipa/ra-agent.pem' CA: dogtag-ipa-ca-renew-agent issuer: CN=Certificate Authority,O=EXAMPLE.COM subject: CN=IPA RA,O=EXAMPLE.COM expires: 2018-06-15 23:15:23 UTC key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment eku: id-kp-serverAuth,id-kp-clientAuth pre-save command: /usr/libexec/ipa/certmonger/renew_ra_cert_pre post-save command: /usr/libexec/ipa/certmonger/renew_ra_cert track: yes auto-renew: yes Request ID '20180315021505': status: CA_UNREACHABLE ca-error: Server at https://srv01.example.com/ipa/xml failed request, will retry: 4016 (RPC failed at server. Failed to authenticate to CA REST API). stuck: no key pair storage: type=NSSDB,location='/etc/dirsrv/slapd-EXAMPLE-COM',nickname='Server-Cert',token='NSS Certificate DB',pinfile='/etc/dirsrv/slapd-EXAMPLE-COM/pwd file.txt' certificate: type=NSSDB,location='/etc/dirsrv/slapd-EXAMPLE-COM',nickname='Server-Cert',token='NSS Certificate DB' CA: IPA issuer: CN=Certificate Authority,O=EXAMPLE.COM subject: CN=srv01.example.com,O=EXAMPLE.COM expires: 2020-03-07 08:49:36 UTC principal name: ldap/srv01.example.com(a)EXAMPLE.COM<mailto:ldap/srv01.example.com@EXAMPLE.COM> key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment eku: id-kp-serverAuth,id-kp-clientAuth pre-save command: post-save command: /usr/libexec/ipa/certmonger/restart_dirsrv EXAMPLE-COM track: yes auto-renew: yes Request ID '20180315021510': status: CA_UNREACHABLE ca-error: Server at https://srv01.example.com/ipa/xml failed request, will retry: 4016 (RPC failed at server. Failed to authenticate to CA REST API). stuck: no key pair storage: type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS Certificate DB',pinfile='/etc/httpd/alias/pwdfile.txt' certificate: type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS Certificate DB' CA: IPA issuer: CN=Certificate Authority,O=EXAMPLE.COM subject: CN=srv01.example.com,O=EXAMPLE.COM expires: 2020-03-07 08:49:51 UTC principal name: HTTP/srv01.example.com(a)EXAMPLE.COM<mailto:HTTP/srv01.example.com@EXAMPLE.COM> key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment eku: id-kp-serverAuth,id-kp-clientAuth pre-save command: post-save command: /usr/libexec/ipa/certmonger/restart_httpd track: yes auto-renew: yes thank you for your help. Bhavin

1 0

sudo commands doesn't work
by Elham Sadat Azarian 16 Mar '20

16 Mar '20

Hi i define a sudo rule with this feauture based on https://github.com/freeipa/freeipa-workshop/blob/master/8-sudorule.rst instruction: rule name: sysadmin-sudo Enabled: TRUE Host category: all command category: all RunAs User Category: all RunAs Group category: all then i define a user "sysadmin" and add "sysadmin-sudo" rule to this user. when i connect with this user and run a command with sudo(ex, sudo systemctl stop rsyslog) it shows: sudo: PAM account management error: Permission denied whats wrong?!

2 1

Encryption LVM for Freeipa
by dmitriys 16 Mar '20

16 Mar '20

Hi! I want create Encryption LVM and install Freeipa. In what directory freeipa save all sensetive data ?

2 1

FreeIPA with certificates from external CA and KDC
by Peter Tselios 16 Mar '20

16 Mar '20

Hello, I have a small project to install a FreeIPA cluster on CentOS 7.7. We have our own CA and they provided me already with a private key and a certificate file for the servers. My problem is that I cannot make ipa-server to install The command I use is: ================================== ipa-server-install --realm "EXAMPLE.COM" -p 'mypassword' -a 'mypassword' \ --hostname="freeipam.example.com" -n example.com --ip-address="10.1.8.24" \ --dirsrv-cert-file=/etc/pki/tls/private/freeipam.example.com.pem \ --dirsrv-cert-file=/etc/pki/tls/certs/freeipam.example.com.crt \ --dirsrv-pin='' \ --http-cert-file=/etc/pki/tls/certs/freeipam.example.com.crt \ --http-cert-file=/etc/pki/tls/private/freeipam.example.com.pem \ --http-pin='' \ --pkinit-cert-file=/etc/pki/tls/certs/freeipam.example.com.crt \ --pkinit-cert-file=/etc/pki/tls/private/freeipam.example.com.pem \ --pkinit-pin='' \ --ca-cert-file=/etc/pki/ca-trust/source/anchors/Subordinate-CA.pem \ --ca-cert-file=/etc/pki/ca-trust/source/anchors/External-CA.pem \ --mkhomedir -N --no-host-dns --unattended ================================== The problem is that I get this error: ----------- The KDC certificate in /etc/pki/tls/certs/freeipam.example.com.crt, /etc/pki/tls/private/freeipam.example.com.pem is not valid: invalid for a KDC ----------- Then I read this: https://web.mit.edu/kerberos/krb5-1.12/doc/admin/pkinit.html and it was clear that I cannot use my certificates for the KDC in FreeIPA. So, now the question is a bit different. When I tried the above command without the pkinit certs lines, I got this error: ----------- ipa-server-install: error: --dirsrv-cert-file, --http-cert-file, and --pkinit-cert-file or --no-pkinit are required if any key file options are used. ----------- This is in contrast with tthis document: https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/ht… where it's clear that I **CAN** specify just the LDAP and HTTP certificates!!!! How can I use my certificates for HTTP and LDAP but ask IPA to use it's self-signed certificates for KDC?

5 9

automount failed FreeIPA, Version: 4.6.5
by Markus Roth 15 Mar '20

15 Mar '20

I configured an automount location in my freeipa: #>automount -m autofs dump map information =========================== global options: none configured Mount point: /- source(s): 100000000|lookup_read_map: lookup(sss): getautomntent_r: No such file or directory failed to read map Mount point: /Share source(s): instance type(s): sss map: auto.public public | -fstype=nfs4,rw.sec=krb5,soft,rsize=8192,rsize=8192 nfs.example.com:/ The /etc/exports on my nfs server looks as follows: /export/data *(rw,fsid=0,sec=krb5:krb5i:krb5p) When I mount the nfs share with the root user on the client: kinit <user> mount -vvv -t nfs4 -o sec=krb5 idefix.example.com:/ /Share The root user can access the files mounted on the /Share directory But the <user> itself get the message: "access denied" automount the share on the directory failed. Nothing is mounted. Any hints to solve this will be appreciated!

1 0

sudo commands doesn't work
by Elham Sadat Azarian 15 Mar '20

15 Mar '20

Hi i define a sudo rule with this feauture based on https://github.com/freeipa/freeipa-workshop/blob/master/8-sudorule.rst instruction: rule name: sysadmin-sudo Enabled: TRUE Host category: all command category: all RunAs User Category: all RunAs Group category: all then i define a user "sysadmin" and add "sysadmin-sudo" rule to this user. when i connect with this user and run a command with sudo(ex, sudo systemctl stop rsyslog) it shows: sudo: PAM account management error: Permission denied whats wrong?!

1 0

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users March 2020