April 2020 - FreeIPA-users - Fedora mailing-lists

ipa-adtrust-install --unattended | did not quite work?
by lejeczek 28 Apr '20

28 Apr '20

hi everyone, I did something pretty vanilla: $ ipa-adtrust-install --unattended --admin-password=xxx Process showed first some warning about "unattended" but then this: Configuring CIFS [1/24]: validate server hostname [2/24]: stopping smbd [3/24]: creating samba domain object [4/24]: retrieve local idmap range [5/24]: creating samba config registry [6/24]: writing samba config file [7/24]: adding cifs Kerberos principal [8/24]: adding cifs and host Kerberos principals to the adtrust agents group [9/24]: check for cifs services defined on other replicas [10/24]: adding cifs principal to S4U2Proxy targets [11/24]: adding admin(group) SIDs [12/24]: adding RID bases [13/24]: updating Kerberos config 'dns_lookup_kdc' already set to 'true', nothing to do. [14/24]: activating CLDAP plugin [15/24]: activating sidgen task [16/24]: map BUILTIN\Guests to nobody group [17/24]: configuring smbd to start on boot [18/24]: adding special DNS service records [19/24]: restarting Directory Server to take MS PAC and LDAP plugins changes into account [20/24]: adding fallback group [21/24]: adding Default Trust View [22/24]: setting SELinux booleans [23/24]: starting CIFS services ipaserver.install.adtrustinstance: CRITICAL CIFS services failed to start [24/24]: restarting smbd Done configuring CIFS. Now, Samba would not start and I wonder what that might have to do with the above: tarting Samba SMB Daemon... [2020/02/14 11:21:34.801358, 0] ../../source3/passdb/pdb_interface.c:171(make_pdb_method_name) No builtin nor plugin backend for ipasam found smb.service: Main process exited, code=exited, status=1/FAILURE smb.service: Failed with result 'exit-code'. Failed to start Samba SMB Daemon. Or is is it unrelated? Hot to troubleshoot & fix it? I'm on Centos 8 with ipa-server-4.8.0-13.module_el8.1.0+265+e1e65be4.x86_64 many thanks, L.

2 4

Pausing replication or another approach to testing whilst limiting blast radius
by David Harvey 25 Apr '20

25 Apr '20

Dear list, I'd like to do a test run of a script that I use to sync our HR data with our freeipa infrastructure. Is it possible to pause replication, or essentially fence a server off, so that if I run the updated script against it, I can limit the changes to that target server until I've checked the changes look sound? Thanks as always, David

2 2

Ansible tasks for certprofiles and ca-acls
by pleusmann＠conet.de 24 Apr '20

24 Apr '20

Hi, I'd like to issue wildcard-certificates following this guide: https://www.freeipa.org/page/Howto/Wildcard_certificates Is there any way to manage certprofiles and ca-acls using ansible? Cheers, Philipp

3 2

User private groups
by Mary Georgiou 24 Apr '20

24 Apr '20

Hello, I'm a bit confused with the private user groups. If I set a user's A uidNumber to the gidNumber of another group B (not a private user one) then the user will have the same uidNumber with two groups' gidNumbers the group B and their own private group. How does this affect ldapsearch if I'd like to retrieve the group B and not the private group based on gid? Are there going to be other side effects? Also, from what I've understood the private user groups are used to manage rights, so I guess we cannot choose to delete them or at least chose to have them created as non POSIX, right? Thank you very much, Mary

2 2

Ipa-client-install ldaps
by Per Qvindesland 24 Apr '20

24 Apr '20

HI Is it possible to run ipa-client-install when the host only listens to ldaps (636)? We have a policy that all traffic must be sent encrypted hence using ldap (389) is not possible. Regards Per

1 0

Authentication taking too long
by Raul Dias 23 Apr '20

23 Apr '20

Hello, Authenticating a user is taking about 30s. This sounds like a dns timeout or something like this. How can I debug where the problem is? Thank you, -rsd

2 2

Samba integration ROLLBACK ?
by lejeczek 23 Apr '20

23 Apr '20

hi guys, I year or so ago it was _not_ possible to rollback Samba integration in official, orderly fashion. Would you know if it is still the case or maybe IPA evolution brought some tools for that? many thanks, L.

2 1

AD trust nested AD groups
by Natxo Asenjo 23 Apr '20

23 Apr '20

hi, we have a working one way trust between an AD forest and a RHEL 7 forest. In order to use AD nested groups, do we need to add an external IDM group for every nested group? -- Groeten, natxo

2 5

CSR in PRINTABLESTRING enc when docs says UTF8STRING is default
by Fredrik Arneving 23 Apr '20

23 Apr '20

Hi, I've tried to setup my freeIPA server on a freshly installed CentOS8 as a sub_CA of my existing PKI with private root-CA. My signing-CA has a match policy for (C)ountry and (O)rganizationName. When trying to sign the CSR generated from freeIPA with command below it fails on a string encryption mismatch. The string encryption on my organizationName, as well as my server DN is in PRINTABLESTRING encoding but my openssl generated signing cert needs it to be UTF8STRING. I was under the impression UTF8STRING is default for freeIPA CSR's. What do I miss and how can I force it to be UTF8STRING? CSR was generated with command: ipa-server-install -r MYREALM.AS.UPPERCASE.DNSDOMAIN \ --external-ca \ --ca-subject CN=ipa-server-fqdn,C=SE,O=MyOrganizationName \ --ca-base C=SE,O=MyOrganizationName Installation is successful and I'm supposed to sign the CSR and finalize ipa-install with second step. However, the signing fails because MyOranizationName != MyOrganizationName due to different encodings. When looking at the CSR with "openssl req -noout -text -in ipa.csr" everything looks OK but when using "openssl asn1parse -in ipa.csr" it shows the mismatch of the organizationName PRINTABLESTRING compared to my successfully signed CSR's UTF8STRING. Any ideas? kernel version: 4.18.0-147.5.1.el8_1.x86_64 ipa-server: ipa-server-4.8.0-13.module_el8.1.0+265+e1e65be4.x86_64 openssl: openssl-1.1.1c-2.el8.x86_64 Regards, /Fredrik

4 7

Re: EL7 Upgrades
by Rob Crittenden 21 Apr '20

21 Apr '20

Angus Clarke via FreeIPA-users wrote: > Hello > > Our environment has grown and as additional IPA servers have been added, > different versions have been deployed. I am looking to bring IPA servers > up to the latest version for EL7 and wanted some guidance or reassurance. > > Here are my versions, they are all VMWare VMs: > > idm001 ipa-server-4.5.4-10.0.1.el7.x86_64 Red Hat Enterprise Linux > Server release 7.4 (Maipo) * UPGRADED * > idm002 ipa-server-4.5.0-22.0.1.el7_4.x86_64 Red Hat Enterprise Linux > Server release 7.4 (Maipo) * CA MASTER * > idm003 ipa-server-4.5.0-22.0.1.el7_4.x86_64 Red Hat Enterprise Linux > Server release 7.4 (Maipo) > idm004 ipa-server-4.5.0-22.0.1.el7_4.x86_64 Red Hat Enterprise Linux > Server release 7.4 (Maipo) > idm005 ipa-server-4.6.5-11.0.1.el7_7.4.x86_64 Red Hat Enterprise Linux > Server release 7.7 (Maipo) > idm006 ipa-server-4.6.5-11.0.1.el7_7.4.x86_64 Red Hat Enterprise Linux > Server release 7.7 (Maipo) > idm007 ipa-server-4.6.5-11.0.1.el7_7.3.x86_64 Red Hat Enterprise Linux > Server release 7.7 (Maipo) > idm008 ipa-server-4.6.5-11.0.1.el7_7.3.x86_64 Red Hat Enterprise Linux > Server release 7.7 (Maipo) > idm009 ipa-server-4.6.4-10.0.1.el7_6.6.x86_64 Red Hat Enterprise Linux > Server release 7.6 (Maipo) > idm010 ipa-server-4.6.4-10.0.1.el7_6.6.x86_64 Red Hat Enterprise Linux > Server release 7.6 (Maipo) > > I have upgraded idm001 without issue, the path was: > > 1) take VMWare snapshot > 2) ipactl stop > 3) yum update (channel with latest EL versions) > 4) reboot > 5) after a day or so, remove VMWare snapshot > > and it now shows: > > idm001 ipa-server-4.6.5-11.0.1.el7_7.4.x86_64Red Hat Enterprise Linux > Server release 7.7 (Maipo) > > Post upgrade checks on idm001: > > I see network connections to port 88 and 389 > I can obtain a kerberos ticket through kinit > I can login through the web interface and issue ipa commands. > I don't see anything particularly alarming in log files. > > I understand the distributed LDAP schema was already up-to-date due to > the roll out of idm005-006 on EL7.7/ipa-server-4.6.5-11.0.1.el7_7.4. > > I'm particularly concerned about upgrading idm002, my CA server - > perhaps I should upgrade through each EL iteration? Are VMWare snapshots > a suitable roll back mechanism for IPA (and IPA CA master) server upgrades? Yes and yes, especially given your already mixed versions. Given you have other CAs in your network there is nothing too special about idm002 other than it has the additional role as CA renewal master. > I was reading Rob's reply to Christian Reiss regarding his upgrade path > to EL8 (bookmarked for future reference,) I don't have the > ipa-crlgen-manage command on my CA server (presumably due to older > version) to check if it is the CRL generator - I assume it is though, > although in any case I'm unsure of the relevance with this EL7 series of > ipa-server. There are instructions at https://www.freeipa.org/page/Howto/Promote_CA_to_Renewal_and_CRL_Master which can tell you which one is doing it. If you aren't using CRLs at all then this is probably not super important but you want to avoid having 2 or more masters generating one since there is a race condition where separate CA's could generate different, but otherwise valid, CRLs. > All my IPA servers have CA capability except for idm001 - I presume I > deployed it incorrectly in the first place. I would like to add CA > facility to it, perhaps this is for a different thread though ... ipa-ca-install should do it but yeah, I'd probably focus on getting the other masters up to 7.7 or 7.8 before trying to add on the CA. You don't necessarily need a CA on every master. You want to avoid single point of failure but you don't need it everywhere. rob

2 1

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users April 2020