April 2020 - FreeIPA-users - Fedora mailing-lists

Sudo command not working
by Faraz Younus 21 Apr '20

21 Apr '20

Hi Team, I'm getting error when executing sudo su on client server what can be the issue sudo command is there [faraz.younus@england-web-dev ~]$ sudo su [sudo] password for faraz.younus: faraz.younus is not allowed to run sudo on england-web-dev. This incident will be reported.

3 3

replica install fails
by Alexandru David 21 Apr '20

21 Apr '20

Hi all I have two centos 8 servers. One is installed and configured as master and AD trust controller. The second one, I'm trying to configure it as a replica, but what ever I do, the replica server fails to start. Environment : OS - CentOS Linux release 8.1.1911 (Core) ipa-server: ipa-server-4.8.0-13.module_el8.1.0+265+e1e65be4.x86_64 Replica install is started with : #ipa-replica-install -v --principal admin -p XXXXX --domain ipamaster01.example.com --server ipamaster01.example.com --setup-ca --setup-adtrust The client install goes well, but the server stops at : Starting replication, please wait until this has completed. Update in progress, 15 seconds elapsed [ldap://ipamaster01.example.com:389] reports: Update failed! Status: [Error (-2) - LDAP error: Local error - no response received] On the ipareplica-install.log, last entries are: 2020-04-14T08:29:13Z DEBUG Created connection context.ldap2_139862275887680 2020-04-14T08:29:13Z DEBUG Fetching nsDS5ReplicaId from master [attempt 1/5] 2020-04-14T08:29:13Z DEBUG retrieving schema for SchemaCache url=ldap://ipamaster01.example.com:389 conn=<ldap.ldapobject.SimpleLDAPObject object at 0x7f34367c7080> 2020-04-14T08:29:13Z DEBUG Successfully updated nsDS5ReplicaId. 2020-04-14T08:29:13Z DEBUG Add or update replica config cn=replica,cn=dc\=ipamaster01\,dc\=example\,dc\=com,cn=mapping tree,cn=config 2020-04-14T08:29:13Z DEBUG Added replica config cn=replica,cn=dc\=ipamaster01\,dc\=example\,dc\=com,cn=mapping tree,cn=config 2020-04-14T08:29:13Z DEBUG Add or update replica config cn=replica,cn=dc\=ipamaster01\,dc\=example\,dc\=com,cn=mapping tree,cn=config 2020-04-14T08:29:13Z DEBUG No update to cn=replica,cn=dc\=ipamaster01\,dc\=example\,dc\=com,cn=mapping tree,cn=config necessary 2020-04-14T08:29:13Z DEBUG Waiting for replication (ldapi://%2Fvar%2Frun%2Fslapd-IPAMASTER01-EXAMPLE-COM.socket) cn=meToipamaster01.example.com,cn=replica,cn=dc\=ipamaster01\,dc\=example\,dc\=com,cn=mapping tree ,cn=config (objectclass=*) 2020-04-14T08:29:13Z DEBUG Entry found [LDAPEntry(ipapython.dn.DN('cn=meToipamaster01.example.com,cn=replica,cn=dc\=ipamaster01\,dc\=example\,dc\=com,cn=mapping tree,cn=config'), {'objectClass': [b'nsds5replicat ionagreement', b'top'], 'cn': [b'meToipamaster01.example.com'], 'nsDS5ReplicaHost': [b'ipamaster01.example.com'], 'nsDS5ReplicaPort': [b'389'], 'nsds5replicaTimeout': [b'120'], 'nsDS5ReplicaRoot': [b'dc=ipamaste r01,dc=example,dc=com'], 'description': [b'me to ipamaster01.example.com'], 'nsDS5ReplicatedAttributeList': [b'(objectclass=*) $ EXCLUDE memberof idnssoaserial entryusn krblastsuccessfulauth krblastfailedauth kr bloginfailedcount'], 'nsDS5ReplicaTransportInfo': [b'LDAP'], 'nsDS5ReplicaBindMethod': [b'SASL/GSSAPI'], 'nsds5ReplicaStripAttrs': [b'modifiersName modifyTimestamp internalModifiersName internalModifyTimestamp'] , 'nsDS5ReplicatedAttributeListTotal': [b'(objectclass=*) $ EXCLUDE entryusn krblastsuccessfulauth krblastfailedauth krbloginfailedcount'], 'nsds5replicareapactive': [b'0'], 'nsds5replicaLastUpdateStart': [b'197 00101000000Z'], 'nsds5replicaLastUpdateEnd': [b'19700101000000Z'], 'nsds5replicaChangesSentSinceStartup': [b''], 'nsds5replicaLastUpdateStatus': [b'Error (0) No replication sessions started since server startup' ], 'nsds5replicaLastUpdateStatusJSON': [b'{"state": "green", "ldap_rc": "0", "ldap_rc_text": "success", "repl_rc": "0", "repl_rc_text": "replica acquired", "date": "2020-04-14T08:29:13Z", "message": "Error (0) N o replication sessions started since server startup"}'], 'nsds5replicaUpdateInProgress': [b'FALSE'], 'nsds5replicaLastInitStart': [b'19700101000000Z'], 'nsds5replicaLastInitEnd': [b'19700101000000Z']})] 2020-04-14T08:29:29Z DEBUG Traceback (most recent call last): File "/usr/lib/python3.6/site-packages/ipaserver/install/service.py", line 603, in start_creation run_step(full_msg, method) File "/usr/lib/python3.6/site-packages/ipaserver/install/service.py", line 589, in run_step method() File "/usr/lib/python3.6/site-packages/ipaserver/install/dsinstance.py", line 427, in __setup_replica cacert=self.ca_file File "/usr/lib/python3.6/site-packages/ipaserver/install/replication.py", line 1860, in setup_promote_replication raise RuntimeError("Failed to start replication") RuntimeError: Failed to start replication I can query both ldap servers on the master and replica with : ldapsearch -h ldap://ipamaster01.example.com -p 389 -Y GSSAPI -b "" -s base -W ldapsearch -h ldap://ipareplica01.example.com -p 389 -Y GSSAPI -b "" -s base -W in this point, I'm really run out of options. Could someone tell me what I'm doing wrong? Cheers Alex

3 9

ipa: ERROR: CIFS server communication error: code "3221225506", message "{Access Denied} A process has requested access to an object but has not been granted those access rights." (both may be "None")
by Bernard Lheureux 20 Apr '20

20 Apr '20

Hi all, After a fresh install of FreeIPA 4.6.5-11.el7.centos.x86_64, fully updated from update repo on a CentOS7 x64 server, it appears that it is totally impossible to establish a trust with an AD running on local AD servers, we did it a few times ago with exactly the same distribution and had really no problem, we tried to completely reinstall the machine and the IPA wit always the same results, ipa: ERROR: CIFS server communication error: code "3221225506", message "{Access Denied} A process has requested access to an object but has not been granted those access rights." (both may be "None") Could someone point me to the direction to look for, because we are going nuts on this ? We found some tips in the /var/log/httpd/errors, but nothing seems to provide sufficient infos... [Wed Oct 02 12:54:57.868830 2019] [:error] [pid 2036] ipa: INFO: [jsonserver_session] admin(a)DOMAIN.INTRA: trust_add/1(u'domain.intra', trust_type=u'ad', realm_admin=u'admin', realm_passwd=u'********', bidirectional=True, version=u'2.231'): RemoteRetrieveError The IPA server and the AD servers are in the same VLan with no firewall between them samba version on the IPA server is the latest available: 4.9.1-6.el7.noarch Thanks for your help...

3 7

Bizarre behavior (SSO+MFA) asking for credentials on some servers, but with extra "specialness"
by Michael S. Moody 20 Apr '20

20 Apr '20

Good evening, First, thank you, again, for FreeIPA. I know I say it every time I send a message to the list, but it's magic. We're running into an interesting situation where some of our hosts are requesting a first/second factor, even once authenticated. Essentially, we SSH into a bastion host using MFA (PW+TOTP at the moment). Once we're in, we're able to pretty reliably SSH to other hosts without issue. However, we've got a few hosts that prompt for "First Factor/Second Factor". We're able to authenticate against those hosts if we provide credentials, but if we logout and log back in, we have to do it again. Interestingly, there's a host we can SSH to (bastion01 to dev-server02) which we can then SSH to another (dev-server02 to dev-server01) and not be prompted for credentials, but if we attempt to authenticate against it directly from the bastion host, we get prompted (bastion01 to dev-server01). Similarly, we can hop onto other servers, no issues. I can SSH from a host to another and then try to SSH again back (a circle) and get prompted (bastion01 too dev-server02 to dev-server01 to bastion01) and it might work, or it might not, depending on the host in question. It's the most bizarre behavior I've ever seen with FreeIPA. Any guidance that you can provide is appreciated. Thanks in advance, Michael S. Moody

2 1

Re: Maybe use FreeIPA to manage user certificates for Apache/Nginx access?
by Joseph Flynn 17 Apr '20

17 Apr '20

Thank you Alexander.

1 0

Re: Maybe use FreeIPA to manage user certificates for Apache/Nginx access?
by Joseph Flynn 17 Apr '20

17 Apr '20

Thanks for the pointer Rob.

1 0

Maybe use FreeIPA to manage user certificates for Apache/Nginx access?
by Henery Hawk 17 Apr '20

17 Apr '20

I've tinkered with FreeIPA a while ago when I was investigating various ways to control WiFi access but have not been very active lately with it. I have a new topic that popped up where I need to create user certificates for access to a specific web site hosted behind an Nginx Reverse Proxy. I have manually created a (forgive my incorrect terms) ca cert and pointed nginx to it and then I created user certs for each user that needs to be granted access. This was done manually using openssh in the pilot phase. Would FreeIPA be able to do this at scale? I see some chatter about FreeIPA 4.x introducing user certs, but that chatter hasn't specifically covered how to get the master ca cert linked to nginx/apache. The noob question might be useful for someone doing similar research. I am not mission critical in this investigation, just trying to minimize my manual management of user certs. Thanks, Henery Hawk

3 2

Centos 6 FreeIPA Client install Error
by Faraz Younus 17 Apr '20

17 Apr '20

Hi Team, I'm trying to add client with hostname abc.example.com on freeip server( ipa1.idm.example.com) but on centos 7 it works fine. All ports are allowed and accessible from client side Can you please share what the exactly problem is and how it can be fixed ? TASK [Enroll host to FreeIPA] ************************************************************************************************************************** failed: [sherwin-centos6-test.example.com] (item=ipa1.idm.example.com) => {"ansible_loop_var": "item", "changed": false, "cmd": ["ipa-client-install", "-U", "-w", "8ekh0Y", "--mkhomedir", "--hostname", " sherwin-centos6-test.example.com", "--ntp-server", "169.254.169.123", "--domain", "idm.example.com", "--realm", "IDM.EXAMPLE.COM", "--server", " ipa1.idm.example.com"], "delta": "0:00:00.202857", "end": "2020-04-16 10:29:37.411081", "failed_when_result": true, "item": "ipa1.idm.example.com", "msg": "non-zero return code", "rc": 1, "start": "2020-04-16 10:29:37.208224", "stderr": "LDAP Error: Connect error: TLS error -8172:Peer's certificate issuer has been marked as not trusted by the user.\nLDAP Error: Connect error: TLS error -8172:Peer's certificate issuer has been marked as not trusted by the user.\nFailed to verify that ipa1.idm.example.com is an IPA Server.\nThis may mean that the remote server is not up or is not reachable due to network or firewall settings.\nPlease make sure the following ports are opened in the firewall settings:\n TCP: 80, 88, 389\n UDP: 88 (at least one of TCP/UDP ports 88 has to be open)\nAlso note that following ports are necessary for ipa-client working properly after enrollment:\n TCP: 464\n UDP: 464, 123 (if NTP enabled)\nInstallation failed. Rolling back changes.\nIPA client is not configured on this system.", "stderr_lines": ["LDAP Error: Connect error: TLS error -8172:Peer's certificate issuer has been marked as not trusted by the user.", "LDAP Error: Connect error: TLS error -8172:Peer's certificate issuer has been marked as not trusted by the user.", "Failed to verify that ipa1.idm.example.com is an IPA Server.", "This may mean that the remote server is not up or is not reachable due to network or firewall settings.", "Please make sure the following ports are opened in the firewall settings:", " TCP: 80, 88, 389", " UDP: 88 (at least one of TCP/UDP ports 88 has to be open)", "Also note that following ports are necessary for ipa-client working properly after enrollment:", " TCP: 464", " UDP: 464, 123 (if NTP enabled)", "Installation failed. Rolling back changes.", "IPA client is not configured on this system."], "stdout": "\u001b[?1034h", "stdout_lines": ["\u001b[?1034h"]}

3 4

How to set up kerberized web service with access control?
by Dominik Vogt 16 Apr '20

16 Apr '20

Hi folks, on RHEL8.0, we've set up a small cluster with a FreeIPA server and two clients, one running a browser (Firefox) and the other running a web server (tomcat). (IdM is still configured with the defaults.) Now, what is the proper way to tackle fine grained access control to the web service? We want to do something like the IdM server GUI, i.e. some users are authorized to use all the functions of the GUI, others are restricted to editing or viewing a limited set of pages, and others are locked out. So far I've looked into host based authentication, but that doen't seem to solve the task at hand. All access control should be done through Kerberos tickets. A pointer to related documentation would also help. Ciao Dominik ^_^ ^_^ -- Dominik Vogt

4 4

Brand new server install fails - [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate
by Chris Moody 15 Apr '20

15 Apr '20

Trying to stand up a brand new IPA Server install on a brand new VM. I am lightly obfuscating some strings out of respect for the client so their domain-name will say 'DOMAIN' in my email. ========== ~# cat /etc/lsb-release DISTRIB_ID=Ubuntu DISTRIB_RELEASE=19.10 DISTRIB_CODENAME=eoan DISTRIB_DESCRIPTION="Ubuntu 19.10" ========== ~# ipa --version VERSION: 4.8.1, API_VERSION: 2.233 ========== Having built a number of IPA Servers for various entities in the past, I've already got the requisite setup/prep stuff configured. - DNS Resolution in functioning forward/reverse - /etc/hosts is set correctly to point to the public IPv4 and IPv6 interface IPs. - hostname is set to fqdn. - time is current and sync'd before any IPA commands are run Issuing the following command to kick off the ipa-server-install process: ========== ipa-server-install --allow-zone-overlap -v -d --setup-dns --mkhomedir --auto-reverse -p XXXXX -a YYYYY --forwarder=2604:ZZZ::AAA -n ipa.DOMAIN.com -r IPA.DOMAIN.COM --hostname=`hostname` --ntp-pool=pool.ntp.org ========== The server install process proceeds and succeeds up to the point: ========== [6/7]: creating replica keys [7/7]: configuring ipa-dnskeysyncd to start on boot Starting external process ===== Which is kicking off: ===== 2020-04-15T20:15:46Z DEBUG args=['/usr/sbin/ipa-client-install', '--on-master', '--unattended', '--domain', 'ipa.DOMAIN.com', '--server', 'sfca-do-ipa-1.ipa.DOMAIN.com', '--realm', 'IPA.DOMAIN.COM', '--hostname', 'sfca-do-ipa-1.ipa.DOMAIN.com', '--no-ntp', '--mkhomedir'] ===== The client setup portion fails every single time with the following error: ===== 2020-04-15T20:15:48Z ERROR cannot connect to 'https://sfca-do-ipa-1.ipa.DOMAIN.com/ipa/json': [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1076) ===== I've done some searching to see how other people have dealt with python throwing the CERTIFICATE_VERIFY_FAILED error, but nothing seems to make any difference in telling the ipa-client-install to respect the locally issued IPA Certs that are read during the setup process. Since some threads mention it helping, I've ensured the python-certifi package is installed and up to date. I've tried toggling between the version of python being used [the system default of python2.7 or python3.7]. Even though it should not make any difference, since the client is reading an IPA generated cert and complaining, but I've also rebuilt the /etc/ssl/certs store since some threads have mentioned this error having some relations [update-ca-certificates -f -v]. Any thoughts on how to get past the ipa-client-install section failing on this? This server setup is -so- close to being complete. Cheers, -Chris

1 0

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users April 2020