January 2021 - FreeIPA-users - Fedora mailing-lists

ipa healthcheck issue
by Patterson, David 11 Jan '21

11 Jan '21

Hello, Running RHEL 7.9, ipa 4.6.8-5 and freeipa-healthcheck 0.3-2 backported for RHEL 7. Ipa healthcheck output [ { "source": "ipahealthcheck.ipa.certs", "kw": { "msg": "Unable to retrieve cert 'host/idm2.X.Y' from '/etc/pki/nssdb': Failed to get host/idm2.X.Y", "nickname": "host/idm2.X.Y", "dbdir": "/etc/pki/nssdb", "key": "20191122115414", "error": "Failed to get host/idm2.X.Y" }, "uuid": "64d9b118-e588-4dbb-99e1-6ef11e495ed5", "duration": "0.382404", "when": "20210107005140Z", "check": "IPACertfileExpirationCheck", "result": "ERROR" }, { "source": "ipahealthcheck.ipa.certs", "kw": { "msg": "Unknown certmonger id 20191122115414", "key": "20191122115414" }, "uuid": "1b4bba70-08e0-43dc-8984-657cc47fd339", "duration": "1.109733", "when": "20210107005142Z", "check": "IPACertTracking", "result": "WARNING" } ] How do I correct these issues? Thanks! David Patterson

2 1

web-interface from Master-Server not available, DNSSEC-Service down
by Kay Jeschonneck 11 Jan '21

11 Jan '21

Issue I can't use the web-interface from the master-server. I can open the website but i see only a white page. One the replica-server i can use the web-interface without a problem. Also i get an error from ipa-ods-exporter about "Public key with same ID already exists", this problem start after i remove the dnssec service and reinstall it on the master-server. Bevor i removed the dnssec-service i have remove over the replica-web-interface all dnssec-entries. Steps to Reproduce I can't because i don't know the cause. I think the problem start after a update but i don't know itexactly. Actual behavior web-interface is not available and dnssec issue Expected behavior web-interface is available and no dnssec errors Version/Release/Distribution $uname -r 4.18.0-240.1.1.el8_3.x86_64 $ rpm -q freeipa-server freeipa-client ipa-server ipa-client 389-ds-base pki-ca krb5-server package freeipa-server is not installed package freeipa-client is not installed ipa-server-4.8.7-13.module_el8.3.0+606+1e8766d7.x86_64 ipa-client-4.8.7-13.module_el8.3.0+606+1e8766d7.x86_64 389-ds-base-1.4.3.8-6.module_el8.3.0+604+ab7bf9cc.x86_64 pki-ca-10.9.4-1.module_el8.3.0+500+458aeb54.noarch krb5-server-1.18.2-5.el8.x86_64 Additional info: please let me know if any particular logs, etc you might need.

2 1

Sudo Default Environment
by Mark Potter 11 Jan '21

11 Jan '21

I am trying to create a default sudo environment that is applied to all users in addition to anything from other groups. This would include things like "secure_path" and a few env lines. However I cannot seem to get this to work. I understand that the highest number in "Sudo order" is processed first but regardless of ordering I cannot seem to apply a default along with other sudo groups. I would expect that if this default was numbered "1" and everything else was higher that it would apply the Sudo options what I'm seeing in practice is that the options aren't additive and if a higher numbered rule doesn't contain them that they are removed. Is this the expected behavior here? For example if I have: env_keep="COLORS DISPLAY HOSTNAME HISTSIZE INPUTRC KDEDIR LS_COLORS" In a sudo group called "Default" and that group is set for all users on all hosts with Commands and As whom all set to "Specified" with Sudo order of 1, then a group called "IT" with set for all users, all hosts, all commands, any user, any group with a Sudo order of 2 it appears that the Sudo options aren't applied and only what's set for "IT". If there is no inheritance I can work with that but I would be brilliant if I I have simply missed something simple and can configure a default set of options. -- *Mark Potter* Senior Linux Administrator

2 2

Slow Logins on all clients
by Mark Potter 11 Jan '21

11 Jan '21

We are experiencing slow logins on all client machines. At present this is only two machines but have experienced the same issue with prior installations. We have migrated the entirety of our ancient OpenLDAP install to FreeIPA. Our environment is: 1 x IPA Server 3 x IPA Replicas All of these have the following specs: Memory: 16GiB CPU: 6 Cores Disk: 64GiB When a client has its cache cleared or it has expired, such as not being logged into overnight, we have seen quite a delay logging in, especially compared to our antiquated OpenLDAP install. In a test this morning the two clients took ~30 seconds for the first login of the day. Once this delay is seen it is not seen again for a while (I haven't timed it at this point). In the logs I see the following: 21k instance of: [sssd[be[example.com]]] [sdap_process_ghost_members] (0x0400): Adding ghost member for group [user286(a)example.com] 32k instances of: [sssd[be[example.com]]] [sdap_get_primary_name] (0x0400): Processing object user767 151 instances of (the only result for grepping the log for "fail") [sssd[be[example.com]]] [sdap_save_grpmem] (0x0400): Failed to get group sid 148 instances of (the only result for grepping the log for "warn"): [sssd[be[example.com]]] [sdap_get_generic_ext_send] (0x0400): WARNING: Disabling paging because scope is set to base. These cover multiple users and multiple groups. I can provide logs but a clean log and a single login at log level 6 generated a 7.2 MiB log file. It looks like it's doing some sort of enumeration but I don't know enough to know what exactly is going on. The load on the IPA server and replicas isn't remotely high at any point. We will end up with > 8k machines authenticating to this cluster so ~30 seconds to login to any given machine for jobs is a lot of lost time. ---sssd.conf--- [domain/dug.com] cache_credentials = True debug_level = 6 krb5_store_password_if_offline = True ipa_domain = example.com id_provider = ipa auth_provider = ipa access_provider = ipa ipa_hostname = client0001.example.com chpass_provider = ipa ipa_server = _srv_, ipa0001.example.com, ipa0002.example.com, ipa0003.example.com, ipa0004.example.com ldap_tls_cacert = /etc/ipa/ca.crt autofs_provider = ipa ipa_automount_location = local-map [sssd] services = nss, sudo, pam, autofs, ssh domains = example.com [nss] homedir_substring = /home [pam] [sudo] [autofs] [ssh] [pac] [ifp] [secrets] [session_recording] ---sssd.conf--- Any help would be appreciated! -- *Mark Potter* Senior Linux Administrator

1 1

expired lets encrypt certificates - how to fix/reinstall
by Sinh Lam 11 Jan '21

11 Jan '21

So I have this problem where the certificates have expired. I created a new one but however when trying to apply the new certs using ipa-server-certinstall, http works but when trying to get it to apply to ldap it fails with a "peer's certificate issuer is not recognized". looking at the logs it looks like the PKI-TOMCAT instances keeps failing, which then following it, the CA is not running, and continuing to follow the trail the certmonger service is failing to start as well with a variety of errors. so my path now is a) keep trying to recover or b) do a reinstall. if I choose option b, will any data (ldap or otherwise) be completely wiped? I'm more interested in preserving the DNS and user/group data more than anything. running IPA 4.8.7-12 on CentOS 8. getcert list output : Request ID '20200412103127': status: MONITORING stuck: no key pair storage: type=FILE,location='/var/kerberos/krb5kdc/kdc.key' certificate: type=FILE,location='/var/kerberos/krb5kdc/kdc.crt' CA: IPA issuer: CN=Certificate Authority,O=XXXX.NET -- Request ID '20210102080335': status: MONITORING stuck: no key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert cert-pki-ca',token='NSS Certificate DB',pin set certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert cert-pki-ca',token='NSS Certificate DB' CA: dogtag-ipa-ca-renew-agent issuer: CN=Certificate Authority,O=XXXX.NET -- Request ID '20210102080336': status: CA_UNREACHABLE ca-error: Error 7 connecting to http://ipa.xxxx.net:8080/ca/ee/ca/profileSubmit: Couldn't connect to server. stuck: no key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert cert-pki-ca',token='NSS Certificate DB',pin set certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert cert-pki-ca',token='NSS Certificate DB' CA: dogtag-ipa-ca-renew-agent -- Request ID '20210102080337': status: MONITORING stuck: no key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert cert-pki-ca',token='NSS Certificate DB',pin set certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert cert-pki-ca',token='NSS Certificate DB' CA: dogtag-ipa-ca-renew-agent issuer: CN=Certificate Authority,O=XXXX.NET -- Request ID '20210102080338': status: CA_UNREACHABLE ca-error: Error 7 connecting to http://ipa.xxxx.net:8080/ca/ee/ca/profileSubmit: Couldn't connect to server. stuck: no key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert cert-pki-ca',token='NSS Certificate DB',pin set certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert cert-pki-ca',token='NSS Certificate DB' CA: dogtag-ipa-ca-renew-agent -- Request ID '20210102080339': status: MONITORING stuck: no key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert cert-pki-ca',token='NSS Certificate DB',pin set certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert cert-pki-ca',token='NSS Certificate DB' CA: dogtag-ipa-ca-renew-agent issuer: CN=Certificate Authority,O=XXXX.NET -- Request ID '20210102080340': status: MONITORING stuck: no key pair storage: type=FILE,location='/var/lib/ipa/ra-agent.key' certificate: type=FILE,location='/var/lib/ipa/ra-agent.pem' CA: dogtag-ipa-ca-renew-agent issuer: CN=Certificate Authority,O=XXXX.NET -- Request ID '20210104092449': status: CA_UNCONFIGURED ca-error: Unable to determine principal name for signing request. stuck: yes key pair storage: type=NSSDB,location='/etc/dirsrv/slapd-XXXX-NET',nickname='Server-Cert',token='NSS Certificate DB',pinfile='/etc/dirsrv/slapd-XXXX-NET/pwdfile.txt' certificate: type=NSSDB,location='/etc/dirsrv/slapd-XXXX-NET',nickname='Server-Cert' CA: IPA -- Request ID '20210104093724': status: MONITORING stuck: no key pair storage: type=FILE,location='/etc/letsencrypt/live/ipa.xxxx.net/privkey.pem' certificate: type=FILE,location='/etc/letsencrypt/live/ipa.xxxx.net/fullchain.pem' CA: IPA issuer: CN=R3,O=Let's Encrypt,C=US (domain info edited out) I can provide whatever log/output needed to help me get past this problem. thanks.

2 1

Performance impact of trustdomain-disable
by Ronald Wimmer 08 Jan '21

08 Jan '21

Some colleagues are complaining about long login times when using SSH to log in. Today I was reading about trustomain-delete in case of trusts to a forest root where only some domains are relevant. In our use case we have a trust to a AD forest root domain that includes two other domains. Lets name them mydomain.at (AD forest root domain - IPA has trust to this one) domainone.mydomain.at domaintwo.mydomain.at Only domainone.mydomain.at holds users we want to use. Would SSH login performance increase dramatically if I disabled all domains I do not need (mydomain.at and domaintwo.mydomain.at)? Cheers, Ronald

1 0

Running ipa commands through Ansible
by Dominik Vogt 08 Jan '21

08 Jan '21

We have to set up the ipa-server with Ansible scripts, but there isn't a module for everything. For example, this command needs to be executed. - name: ... shell: ipa config-mod --ipaselinuxusermaporder="..." However, that doesn't work (using either the "root" or ipa "admin" accounts) because the Kerberos ticket granting ticket is missing. Hard coding user and password in a plain script or on the command line is bad. I've really no idea how to solve this. P.S.: The existing ipa modules for Ansible seem to do their work over the http interface. Ciao Dominik ^_^ ^_^ -- Dominik Vogt

5 11

Re: Remove unused external ca certs
by Rob Crittenden 07 Jan '21

07 Jan '21

Dungan, Scott A. via FreeIPA-users wrote: > Happy new year, everyone. > > Â > > We have an unused letsencrypt CA cert and associated the DSTRootCAX3 > cert installed on version 4.8.7. Due to firewall issues, we moved to a > paid commercial cert (Comodo) for the https service. My question is, how > can we remove the two unused CA certs? If we do so, is it necessary to > update the clients with ipa-certupdate, or will the removal be transparent? > > Â > > ~]# ipa-cacert-manage list > > xxx.xxx.xxx.edu IPA CA > > DSTRootCAX3 > > letsencryptx3 > > CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater > Manchester,C=GB > > CN=USERTrust RSA Certification Authority,O=The USERTRUST > Network,L=Jersey City,ST=New Jersey,C=US > > CN=InCommon RSA Server CA,OU=InCommon,O=Internet2,L=Ann Arbor,ST=MI,C=US > > The ipa-cacert-manage command was successful From ipa-cacert-manage(1): SYNOPSIS ... ipa-cacert-manage delete [options] NICKNAME ipa-certupdate will need to be run on all enrolled machines. rob

2 1

Remove unused external ca certs
by Dungan, Scott A. 07 Jan '21

07 Jan '21

Happy new year, everyone. We have an unused letsencrypt CA cert and associated the DSTRootCAX3 cert installed on version 4.8.7. Due to firewall issues, we moved to a paid commercial cert (Comodo) for the https service. My question is, how can we remove the two unused CA certs? If we do so, is it necessary to update the clients with ipa-certupdate, or will the removal be transparent? ~]# ipa-cacert-manage list xxx.xxx.xxx.edu IPA CA DSTRootCAX3 letsencryptx3 CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US CN=InCommon RSA Server CA,OU=InCommon,O=Internet2,L=Ann Arbor,ST=MI,C=US The ipa-cacert-manage command was successful -Scott

1 0

Installation problem - Request timed out on Step [12/30] during pki-tomcatd configuration
by Chris Clemson 07 Jan '21

07 Jan '21

Hello everyone, I am trying to install FreeIPA on a new CentOS VM, and have got stuck. OS is "CentOS Linux release 7.9.2009", "minimal" installation, and latest updates installed as of today. Nothing else is configured on it. I issued ipa-server-install, (responded "no" to setting up DNS as that is running on another server) and it has got to the pki-tomcatd configuration part. At step 12/30, it says "requesting RA certificate from CA", and then [error] RuntimeError: request timed out ipapython.admintool: ERROR request timed out ipapython.admintool: ERROR The ipa-server-install command failed. See /var/log/ipaserver-install.log for more information. It has now been sitting there for over an hour and the shell prompt has not returned. in /var/log/ipaserver-install.log i get the message "DEBUG certmonger request is in state dbus.String(u'SUBMITTING', variant_level=1)" repeated for around 6 minutes, and then the following is printed: 2021-01-05T23:14:25Z DEBUG certmonger request is in state dbus.String(u'PRE_SAVE_CERT', variant_level=1) 2021-01-05T23:14:42Z DEBUG Traceback (most recent call last): File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 567, in start_creation run_step(full_msg, method) File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 557, in run_step method() File "/usr/lib/python2.7/site-packages/ipaserver/install/cainstance.py", line 943, in __request_ra_certificate resubmit_timeout=api.env.replication_wait_timeout File "/usr/lib/python2.7/site-packages/ipalib/install/certmonger.py", line 332, in request_and_wait_for_cert state = wait_for_request(req_id, api.env.replication_wait_timeout) File "/usr/lib/python2.7/site-packages/ipalib/install/certmonger.py", line 709, in wait_for_request raise RuntimeError("request timed out") RuntimeError: request timed out Somebody here: https://www.linuxquestions.org/questions/linux-server-73/slowness-after-ins… mentioned DNS problems, but nslookup seems to be resolving things fine. Any idea what I can do to fix the issue? Thanks, Chris

2 4

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users January 2021