April 2020 - FreeIPA-users - Fedora mailing-lists

[4.8.6] External CA installation failed with ldap.NO_SUCH_OBJECT: {'desc': 'No such object', 'matched': 'cn=cas,cn=ca, <baseDN>'}
by Luginbash Hiyajo 13 Apr '20

13 Apr '20

Hi all, I'm trying to setup a FreeIPA at home, and sign it with an external CA. The setup was fairly simple: CA Chain: depth=2 description=The mind of man can imagine nothing which has not really existed. - Edgar Allan Poe, CN = Finis Chaldea PKI Root G2, O = Finis Chaldea depth=1 description=The mind of man can imagine nothing which has not really existed. - Edgar Allan Poe, CN = Unseen University PKI Root, O = Unseen University Archchancelor's Office depth=0 CN = Unseen University PKI Octinity ,O =Unseen University, OU =Unseen University Archchancellor's Office The CA 2 and 1 are on another generated on HSM, if it does matter. Both have OCSP and CRL URI. CA 0 is the IPA's own CA. I have overridden some of the pki configuraitons as follow: ``` # CA OVERRIDES #/etc/ipa/override.ini [DEFAULT] ipa_key_algorithm=SHA256withEC ipa_key_size=nistp384 ipa_key_type=ecc ipa_signing_algorithm=SHA256withEC [CA] pki_ca_signing_key_size=nistp384 ``` /etc/hosts: 192.168.88.99 ipa.lug.sh ipa And hostname hat set to `ipa.lug.sh` already. The installation was done by following commands: ```bash $ export IPA_DOMAIN=lug.sh $ export IPA-COMMON_NAME="CN=Unseen University PKI Octinity,O=Unseen University,OU=Unseen University Archchancellor's Office" ``` ``` # Step ONE ipa-server-install -U \ -n $( awk 'BEGIN {print tolower(ENVIRON["IPA_DOMAIN"])}' ) \ -r $( awk 'BEGIN {print toupper(ENVIRON["IPA_DOMAIN"])}' ) \ -a `pass ipa/admin` \ -p `pass ipa/dm` \ --ca-subject="${IPA_COMMON_NAME}" \ --setup-dns \ --no-forwarders --auto-reverse --allow-zone-overlap \ --pki-config-override=/etc/ipa/override.ini \ --external-ca ``` ```Step TWO ipa-server-install -U \ -n $( awk 'BEGIN {print tolower(ENVIRON["IPA_DOMAIN"])}' ) \ -r $( awk 'BEGIN {print toupper(ENVIRON["IPA_DOMAIN"])}' ) \ -a `pass ipa/admin` \ -p `pass ipa/dm` \ --ca-subject="${IPA_COMMON_NAME}" \ --setup-dns \ --no-forwarders --auto-reverse --allow-zone-overlap \ --pki-config-override=/etc/ipa/override.ini \ --external-cert-file=/root/ipa.pem ``` The installer chocked at: [29/30]: adding 'ipa' CA entry ... The ipa-server-install command failed, exception: InvalidSyntax: ipaCaIssuerDN: value #0 invalid per syntax: Invalid syntax. ... Log file says: (See attached for complete log. Please don't mind my previous attempts, as they are also included.) ... ldap.NO_SUCH_OBJECT: {'desc': 'No such object', 'matched': 'cn=cas,cn=ca,dc=lug,dc=sh'} ... ipalib.errors.NotFound: no such entry ... ldap.INVALID_SYNTAX: {'desc': 'Invalid syntax', 'info': 'ipaCaIssuerDN: value #0 invalid per syntax\n'} I also tried once without O= in the IPA_CA DN, but ends up the same. Best Regards, - lug

1 0

Generating a session_key for API call
by Seth Malone 10 Apr '20

10 Apr '20

I am having trouble generating a session key to emulate the client call `ipa vault-retrieve testVault --shared`. I am currently using python and need to interact with the IPA vault. Is there a library I can import, or an example I can reference, that can walk me through generating a session key? I can issue the `ipa vault-retrieve testVault --shared` and harvest the session_key used in that call I am able to successfully get a response (No need to decode yet, just a test). I am unable to successfully generate a session_key, offer it to the IPA server, and get a successful response. OS: RHEL 7.7 FreeIPA, version: 4.6.5 API Version: 2.231

2 1

Re: Minimal ipa configuration (inside docker)
by Seth A Malone 09 Apr '20

09 Apr '20

1 0

Domain controllers switch to LDAPS
by Ronald Wimmer 08 Apr '20

08 Apr '20

Hi, will Microsofts decision to let domain controllers talk LDAPS only in the near future affect IPA sowehow? Cheers, Ronald

3 9

ca replication for hosts with different dns domains
by askstack＠yahoo.com 08 Apr '20

08 Apr '20

Hi IDM domain: "fist.domain" Host name: host1.first.domain host2.second.domain I was able to run "ipa-client-install" on host2 and promoted it to a domain replica. After I verified domain replication was working, I tried to run ipa-ca-install. It failed on host2. Redhat support said host1 and host2 are on two different dns domains so replication is not supported. I am not sure that is the case since two hosts are in the same and onlyIDM domain replication group. Is redhat support correct? Thanks.

3 3

Migration (in place)
by Christian Reiss 07 Apr '20

07 Apr '20

Hey folks, Running a 3-node FreeIPA Installation. All is well, but I am now upgrading all VMs, including my three IPA Servers from Centos 7 to 8. As the Upgrade for Centos 7 to 8 is a complete reinstall I would need to, one at a time, upgrade an IPA server. The IP and FQDN would remain the same. - I read several documents out there and some say decommission one, reinstall and add it again. - Others go for replica-prepare and go from there. - What about simply backup up the data direcory and restore that? Maybe there is a recommended way? I tried doing this some months ago for a failed server, and I got an issue about replication agreement already existing which I only was able to resolve by reinstalling. The proposed "modify ldap" was way, way above me ;) Thank you all and stay healthy! -- with kind regards, mit freundlichen Gruessen, Christian Reiss

3 4

EL7 Upgrades
by Angus Clarke 07 Apr '20

07 Apr '20

Hello Our environment has grown and as additional IPA servers have been added, different versions have been deployed. I am looking to bring IPA servers up to the latest version for EL7 and wanted some guidance or reassurance. Here are my versions, they are all VMWare VMs: idm001 ipa-server-4.5.4-10.0.1.el7.x86_64 Red Hat Enterprise Linux Server release 7.4 (Maipo) * UPGRADED * idm002 ipa-server-4.5.0-22.0.1.el7_4.x86_64 Red Hat Enterprise Linux Server release 7.4 (Maipo) * CA MASTER * idm003 ipa-server-4.5.0-22.0.1.el7_4.x86_64 Red Hat Enterprise Linux Server release 7.4 (Maipo) idm004 ipa-server-4.5.0-22.0.1.el7_4.x86_64 Red Hat Enterprise Linux Server release 7.4 (Maipo) idm005 ipa-server-4.6.5-11.0.1.el7_7.4.x86_64 Red Hat Enterprise Linux Server release 7.7 (Maipo) idm006 ipa-server-4.6.5-11.0.1.el7_7.4.x86_64 Red Hat Enterprise Linux Server release 7.7 (Maipo) idm007 ipa-server-4.6.5-11.0.1.el7_7.3.x86_64 Red Hat Enterprise Linux Server release 7.7 (Maipo) idm008 ipa-server-4.6.5-11.0.1.el7_7.3.x86_64 Red Hat Enterprise Linux Server release 7.7 (Maipo) idm009 ipa-server-4.6.4-10.0.1.el7_6.6.x86_64 Red Hat Enterprise Linux Server release 7.6 (Maipo) idm010 ipa-server-4.6.4-10.0.1.el7_6.6.x86_64 Red Hat Enterprise Linux Server release 7.6 (Maipo) I have upgraded idm001 without issue, the path was: 1) take VMWare snapshot 2) ipactl stop 3) yum update (channel with latest EL versions) 4) reboot 5) after a day or so, remove VMWare snapshot and it now shows: idm001 ipa-server-4.6.5-11.0.1.el7_7.4.x86_64 Red Hat Enterprise Linux Server release 7.7 (Maipo) Post upgrade checks on idm001: I see network connections to port 88 and 389 I can obtain a kerberos ticket through kinit I can login through the web interface and issue ipa commands. I don't see anything particularly alarming in log files. I understand the distributed LDAP schema was already up-to-date due to the roll out of idm005-006 on EL7.7/ipa-server-4.6.5-11.0.1.el7_7.4. I'm particularly concerned about upgrading idm002, my CA server - perhaps I should upgrade through each EL iteration? Are VMWare snapshots a suitable roll back mechanism for IPA (and IPA CA master) server upgrades? I was reading Rob's reply to Christian Reiss regarding his upgrade path to EL8 (bookmarked for future reference,) I don't have the ipa-crlgen-manage command on my CA server (presumably due to older version) to check if it is the CRL generator - I assume it is though, although in any case I'm unsure of the relevance with this EL7 series of ipa-server. All my IPA servers have CA capability except for idm001 - I presume I deployed it incorrectly in the first place. I would like to add CA facility to it, perhaps this is for a different thread though ... Thank you for any feedback. Regards Angus

1 0

FreeIPA 4.6.8 released
by Alexander Bokovoy 03 Apr '20

03 Apr '20

1 0

configure encryption types on Free IPA UI
by Hernán Fernández 02 Apr '20

02 Apr '20

Hello, How can I configure the available encryption types on a FreeIPA?. I'm using the version 4.6.5 Thanks -- Hernán Fernández +56994752172

2 2

Update FreeIPA 4.8.6 on PI 4
by Dirk Streubel 02 Apr '20

02 Apr '20

Hello everybody, i am using a PI4 with Fedora 32 Beta and the latest Packages of IPA. Everything is working fine, but after an update this Afternoon my IPA Server would not start any more. I updated following packages: 389-ds-base-1.4.3.4-1.fc32.aarch64 and 389-ds-base-libs-1.4.3.4-1.fc32.aarch64 The following error message i get: [root@pifour ~]# systemctl status dirsrv(a)XXX.service ● dirsrv(a)XXX.service - 389 Directory Server XXX. Loaded: loaded (/usr/lib/systemd/system/dirsrv@.service; enabled; vendor preset: disabled) Drop-In: /usr/lib/systemd/system/dirsrv@.service.d └─custom.conf /etc/systemd/system/dirsrv(a)XXX.service.d └─ipa-env.conf Active: failed (Result: exit-code) since Thu 2020-04-02 21:50:43 CEST; 21min ago Process: 6894 ExecStartPre=/usr/libexec/dirsrv/ds_systemd_ask_password_acl /etc/dirsrv/slapd-XXX/dse.ldif (code=exited, status=0/SUCCESS) Process: 6899 ExecStart=/usr/sbin/ns-slapd -D /etc/dirsrv/slapd-XXX -i /run/dirsrv/slapd-XXX.pid (code=exited, status=1/FAILURE) Main PID: 6899 (code=exited, status=1/FAILURE) CPU: 433ms Apr 02 21:50:42 pifour.linux.schnell.er systemd[1]: Starting 389 Directory Server XXX.... Apr 02 21:50:43 pifour.linux.schnell.er ns-slapd[6899]: [02/Apr/2020:21:50:43.097278875 +0200] - ERR - dse_read_one_file - The entry cn=schema in file /etc/dirsrv/slapd-XXX/schema/15rfc2307bis.ldif (lineno: 1) is invalid, error code 20 (Type or value exists) - attribute type nisDomain: Does not match the OID "1.3.6.1.4.1.1.1.1.12". Another attribute type is already using the name or OID. Apr 02 21:50:43 pifour.linux.schnell.er ns-slapd[6899]: [02/Apr/2020:21:50:43.113521126 +0200] - ERR - setup_internal_backends - Please edit the file to correct the reported problems and then restart the server. Apr 02 21:50:43 pifour.linux.schnell.er systemd[1]: dirsrv(a)XXX.service: Main process exited, code=exited, status=1/FAILURE Apr 02 21:50:43 pifour.linux.schnell.er systemd[1]: dirsrv(a)XXX.service: Failed with result 'exit-code'. Apr 02 21:50:43 pifour.linux.schnell.er systemd[1]: Failed to start 389 Directory Server XXX.. [root@pifour ~]# Hope, somebody can help me, maybe a bug in the new packages? Regards Dirk

2 4

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users April 2020