My cluster has been successfully working for over a year with version 4.2
I have replica of two ipa nodes and winsync
Tried to upgrade (ipa-server-upgrade) and replica seems to be ruined after it.
I can't even check its status
[root@idm0 ~]# ipa-replica-manage list --verbose
Traceback (most recent call last):
File "/usr/sbin/ipa-replica-manage", line 1615, in <module>
File "/usr/sbin/ipa-replica-manage", line 1548, in main
File "/usr/sbin/ipa-replica-manage", line 197, in list_replicas
config_string = ent.single_value['ipaConfigString']
File "/usr/lib/python2.7/site-packages/ipapython/ipaldap.py", line 564, in __getitem__
value = self._entry[name]
File "/usr/lib/python2.7/site-packages/ipapython/ipaldap.py", line 442, in __getitem__
File "/usr/lib/python2.7/site-packages/ipapython/ipaldap.py", line 409, in _get_nice
name = self._get_attr_name(name)
File "/usr/lib/python2.7/site-packages/ipapython/ipaldap.py", line 405, in _get_attr_name
name = self._names[name]
File "/usr/lib/python2.7/site-packages/ipapython/ipautil.py", line 583, in __getitem__
return super(CIDict, self).__getitem__(key.lower())
Unexpected error: u'ipaconfigstring'
Please any advises how to restore replication and winsync after upgrade, this is quite critical.
any recommendations how to best update the compat tree after changes of AD user attributes?
We use IPA 4.5 with AD trust. After modification of a AD user attribute, e.g. loginShell, the compat tree doesn't get updated automatically and so the unix/linux can't enjoy his new shell.
Accourding to Red Hat's knowledge base article https://access.redhat.com/solutions/1503713 the only way is to restart dirsrv ...
Maybe there's a better way to achieve this.
Thanks in advance!
Mit freundlichen Grüßen
BITMARCK Beratung GmbH
Firmensitz: Putzbrunner Straße 93, 81739 München
Geschäftsführer: Christian Niklaus
Registergericht: Amtsgericht München HRB 130163
Die Information in dieser E-Mail ist vertraulich und ausschließlich für
den/die benannten Adressaten bestimmt. Ein Zugriff auf diese E-Mail
durch andere Personen als den/die benannten Adressaten ist nicht
gestattet. Sollten Sie nicht der benannte Adressat sein, löschen Sie bitte
Simple question ..Is this command enough to disjoin from an existing IPA
Want to test some servers.. joined a master ....is .ipa-client-install
can remove all config from my master server ???
I was wondering if someone could help me out, is it possible to have a
user administer only one host/server. Meaning they would log on to
freeipa gui and be able to change a password or lock and account for one
host only. In our case our sftp server where someone else wants to
administer it, when i am not around, like add a user and so on.
Is this possible?
one of my IPA masters (master.example.com, IPA 4.5) runs a Dokuwiki and a
DAViCal instance besides IPA. DNS is external (not managed by IPA) and I
asked the DNS admin to create CNAMEs wiki.example.com and cal.example.com
that point to master.example.com).
That works, but my users get browser warnings "SSL_ERROR_BAD_CERT_DOMAIN"
upon first connect via the CNAMEs and have to allow exceptions.
Therefore, I force-created dummy hosts in IPA and let them be managed by
$ ipa host-add wiki.example.com --force
$ ipa service-add HTTP/wiki.example.com --force
$ ipa service-add-host HTTP/wiki.example.com --host master.example.com
If i would revoke the certificate for HTTP/master.example.com now (didn't
dare yet), will a new certificate be created that contains
wiki.example.com as X509v3 Subject Alternative Name? It probably isn't
that easy, right?
Mit freundlichen Gruessen/With best regards,
I am running on the latest Centos 7 with a system that has been working
for quite some time. The only thing that I think has changed has been
keeping the system up to date with yum.
DNS forwarding no longer works. On the DNS Global Configuration page I
have a Global forwarders IP listed as forward only but it does not work.
Running ipa dnsconfig-show on my workstation returns nothing. However,
running on the IPA server returns something.
I manually added a specific forward zone for a specific domain and that
Hello the list,
As a workaround for another issue we have with using two-factor
authentication, we're using pam_krb5 to change expired passwords, so in
/etc/pam.d/password-auth-ac whe have changed the password section to be:
password requisite pam_pwquality.so try_first_pass local_users_only
password sufficient pam_unix.so sha512 shadow try_first_pass
#password sufficient pam_sss.so use_authtok
password sufficient pam_krb5.so chpw_prompt=true use_authok
This puts the user through a password reset process without the second
factor interfering, but at the end they get shell. This is without the
Is there a parameter this so that the connection is disconnected instead, or
the connection attempt is restarted?
I've also tried changing the pam control 'sufficient' from:
[success=done new_authtok_reqd=done default=ignore]
I am using the embedded CA For FreeIPA as well as external CA Signed by
Digicert. However, the certificate will be expiring next month.
After renewal, do I need to install the certificate again using the same
steps mentioned within the link
Similarly how will I be able to update the new certificate in my IPA
Clients too. Do I need to follow the steps below on all IPA Clients?
certutil -A -d /etc/pki/nssdb -n 'IPA CA' -t CT,C,C -a -i ipa.crt
cp ipa.crt /etc/ipa/ca.crt
Can you please brief up the exact procedure to follow for the third party
SSL cert renewal.
Thanks and Regards,
Hello FreeIpa community!
I'm a bit confused about JKS "/etc/pki/java/cacerts".
Am I right, that default password for this JKS is "changeit"?
Can I change this password? If yes, shoud it be the same on all hosts connected to FreeIpa?
Will it be problem later for FreeIpa? Should I somehow tell FreeIpa this password?
Also what is the best practice to tell java to trust FreeIpa CA?
I’m managing the network for my hackerspace, and we’re moving to FreeIPA (from plain LDAP) to manage internal and external services.
We have some services that are hosted on public, external machines (wiki, etc.) that members would authenticate to via Ipsilon OAuth2 that are under the main domain (e.g. wiki.example.org), and some internally hosted services that are under a subdomain (e.g. netbox.hq.example.org).
My plan is to have a IPA replica on the ”outside” with Ipsilon for external auth, and a couple of local replicas (one of which is the ca master). The outside replica would be connected via VPN to the internal network, to avoid opening lots of ports to the outside world.
I’m having some difficulties choosing the proper Kerberos domain, and in general putting together the ”external” world (example.org domain) and the ”internal” one (hq.example.com domain) because the DNS server on the main domain is under CloudFlare.
Would getting a new domain just for FreeIPA be advisable?
Aljaž Srebrnič a.k.a g5pw
My public key: https://g5pw.me/key
Key fingerprint = 2109 8131 60CA 01AF 75EC 01BF E140 E1EE A54E E677