Re: FreeIPA connection limits?
by Andrew Radygin
So are you telling, your ds-389 isn't responding to simple ldapsearch for
instance, even if there is no huge amount of logins to hosts? Just from
refreshing cache on host clients? But if you doesn't have sssd (that do
kernel-caching of privileges), therefore all your clients every time doing
ldapsearch or something like this against ds-389 (but I could be wrong).
Though I think ldap is really fast and could stand for thousands of
requests.
What access and errors logs of DS showing you?
2017-12-11 21:52 GMT+03:00 Aaron Hicks <aaron.hicks(a)nesi.org.nz>:
> Hi Andrew,
>
> I’m afraid it’s often happening during the initial population if the
> cache. Also these host are all LDAP only and caching with nscd, as they
> only need user and group name resolution. This was done to minimise changes
> to their software image as they’re stateless/diskless hosts.
>
> Get Outlook for iOS <https://aka.ms/o0ukef>
> ------------------------------
> *From:* Andrew Radygin <randrewg(a)gmail.com>
> *Sent:* Monday, December 11, 2017 7:54:45 PM
> *To:* FreeIPA users list
> *Cc:* Aaron Hicks
> *Subject:* Re: [Freeipa-users] FreeIPA connection limits?
>
> Does sssd caching of privileges is working?
> I mean, suppose if there is no reply from IPA-server, it should use local
> cache for existing users.
>
> 2017-12-11 0:08 GMT+03:00 Aaron Hicks via FreeIPA-users <
> freeipa-users(a)lists.fedorahosted.org>:
>
>> Hello the list,
>>
>>
>>
>> We’ve got a number (hundreds) of hosts inside a private network, these
>> all query the FreeIPA server for user and group information using NAT and a
>> gateway server.
>>
>>
>>
>> However we’re having issues with the LDAP queries timing out or becoming
>> unresponsive.
>>
>>
>>
>> Is there a limit on the number of concurrent connections from a single
>> host (e.g. the NAT gateway)?
>>
>>
>>
>> Is there a way of increasing the number of simultaneous connections to
>> FreeIPA/dirsrv?
>>
>>
>>
>> Regards,
>>
>>
>>
>> Aaron
>>
>> _______________________________________________
>> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>> To unsubscribe send an email to freeipa-users-leave(a)lists.fedo
>> rahosted.org
>>
>>
>
>
> --
> Best regards, Andrew.
>
--
Best regards, Andrew.
6 years, 4 months
Re: FreeIPA connection limits?
by Sumit Bose
On Mon, Dec 11, 2017 at 06:48:36PM +0000, Aaron Hicks wrote:
> No, our FreeIPA instance is stand alone, but we’ll be implementing replication soon.
Then it would be good to see the access logs of the directory server
during the time the directory server is unresponsive or slow. You can
find them at /var/log/dirsrv/slapd-YOUR-IPA-DOMAIN/access*
bye,
Sumit
>
> Get Outlook for iOS<https://aka.ms/o0ukef>
> ________________________________
> From: Sumit Bose via FreeIPA-users <freeipa-users(a)lists.fedorahosted.org>
> Sent: Monday, December 11, 2017 9:06:53 PM
> To: freeipa-users(a)lists.fedorahosted.org
> Cc: Sumit Bose
> Subject: [Freeipa-users] Re: FreeIPA connection limits?
>
> On Mon, Dec 11, 2017 at 10:08:50AM +1300, Aaron Hicks via FreeIPA-users wrote:
> > Hello the list,
> >
> >
> >
> > We've got a number (hundreds) of hosts inside a private network, these all
> > query the FreeIPA server for user and group information using NAT and a
> > gateway server.
> >
> >
> >
> > However we're having issues with the LDAP queries timing out or becoming
> > unresponsive.
> >
> >
> >
> > Is there a limit on the number of concurrent connections from a single host
> > (e.g. the NAT gateway)?
> >
> >
> >
> > Is there a way of increasing the number of simultaneous connections to
> > FreeIPA/dirsrv?
>
> Are you using a trust to AD? In this case you might hit
> https://pagure.io/freeipa/issue/5464.
>
> bye,
> Sumit
>
> >
> >
> >
> > Regards,
> >
> >
> >
> > Aaron
> >
>
> > _______________________________________________
> > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> > To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
> _______________________________________________
> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
6 years, 4 months
FreeIPA connection limits?
by Aaron Hicks
Hello the list,
We've got a number (hundreds) of hosts inside a private network, these all
query the FreeIPA server for user and group information using NAT and a
gateway server.
However we're having issues with the LDAP queries timing out or becoming
unresponsive.
Is there a limit on the number of concurrent connections from a single host
(e.g. the NAT gateway)?
Is there a way of increasing the number of simultaneous connections to
FreeIPA/dirsrv?
Regards,
Aaron
6 years, 4 months
IPA 4.5 upgrade or clean install on CentOS/RHEL-7.4 has never worked for us (webUI fails) -- Latest guidance?
by Chris Dagdigian
Hi folks,
Stuck in a catch-22 where I can't update our existing 4.4.0 production
servers nor can we stand up new working sandbox servers running IPA-4.5
In all cases (upgrade and new install) we end up with a WebUI that is
not functional when deployed on RHEL 7.4 or CentOS 7.4
However I think now I have the actual error and there were hints from
the mailing list archive about the culprit maybe being httpd and keytab
related. Or at least it seems tightly tied to the security changes
implemented between IPA 4.4 and 4.5 releases.
Here is the setup from a fresh install on RHEL 7.4
- CLI installation works perfectly
- AD trust setup works perfectly
- All CLI tools and commands seem to work just fine
- No errors in standard locations
- "ipactl status" reports no issues
- SELINUX is disabled
- Using Chrome browser for access and testing
However the WebUI is totally unusable. The front page just displays an
error box that says:
HTTP Error 404
Cannot connect to the server, please check API accesibility
(certificate, API, proxy, etc.)
Reading the lists archives this weekend I found the links that point to
the security changes between 4.4 and 4.5 and I also found the helpful
advice to set "debug=true" in /etc/ipa/server.conf
After setting the debug=true values now I see a new message in the httpd
error logs:
[Sun Dec 10 03:13:08.976509 2017] [:error] [pid 7821] ipa: INFO: ***
PROCESS START ***
[Mon Dec 11 11:55:07.102172 2017] [auth_gssapi:error] [pid 7824] [client
172.29.XX.XX:57976] NO AUTH DATA Client did not send any authentication
headers, referer: https://usaeilidmp010.XXX.org/ipa/ui/
[Mon Dec 11 11:55:07.298810 2017] [auth_gssapi:error] [pid 7824] [client
172.29.XX.XX:57976] GSS ERROR In Negotiate Auth:
gss_accept_sec_context() failed: [An unsupported mechanism was requested
(Unknown error)], referer: https://usaeilidmp010.XXX.org/ipa/ui/
[root@usaeilidmp010 ec2-user]#
Those error messages have come up in past forum messages but the thread
replies always led me into a maze of other URls or generic instructions
to "regenerate the keytab for HTTPD server"
I'm pretty sure the above web error is exactly why the webUI is failing
however I can't find clear or concise instructions on how to fix or
debug further ...
Has anyone dealt with this already? I may need an idiot's guide to
resolving that particular gss error as I failed at doing so myself this
weekend :) I pretty much do not understand that error nor how to
address it, heh.
Thanks!
-Chris
6 years, 4 months
FreeIPA user sync to online services?
by Dagan McGregor
Hi all,
My work is taking another look at options to enable user management with a number of third party online services. Primarily to use with AWS, Github, and Datadog.
I have been looking at options such as the new AWS SSO product, OneLogin, Okta, etc
Is anyone using FreeIPA with one of these types of services?
Is there any safe recommended method for configuring an external facing read-only replica/user account to connect to online services?
We can look at installing another on-premise app to handle the integration if required, but I am hoping we can connect FreeIPA to one of these services directly.
Any help would be appreciated.
Cheers,
Dagan McGregor
6 years, 4 months
Replication & Boot Errors
by Callum Guy
Hi All,
I have been carrying out some routine maintenance on our IPA installation
and following a reboot I am seeing a number of errors in the 389 logs.
I am struggling to understand whether any of these errors and warnings are
anything I should be concerned about and how might go about retifying the
situation.
The server works as a replica pair and I haven't noticed any obvious
problems as both instances appears to be working fine. The only symptom of
a potential issue is that during reboot of either node the authentications
slow down dramatically taking around a minute to login to the system even
if it is the slave node being rebooted. Again I am not clear if this is
expected.
Any pointers would be greatly appreciated - the content of the error log
(dirsrv/slapd-MYDOMAIN-NET/errors) is shown below. I've highlighted in red
all the parts that concern me.
Thanks,
Callum
*[11/Dec/2017:10:54:45.845493685 +0000] - WARN - Security Initialization -
SSL alert: Sending pin request to SVRCore. You may need to run
systemd-tty-ask-password-agent to provide the password.*
[11/Dec/2017:10:54:45.860198563 +0000] - INFO - Security Initialization -
SSL info: Enabling default cipher set.
[11/Dec/2017:10:54:45.860608642 +0000] - INFO - Security Initialization -
SSL info: Configured NSS Ciphers
[11/Dec/2017:10:54:45.860924167 +0000] - INFO - Security Initialization -
SSL info: TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384: enabled
[11/Dec/2017:10:54:45.861315831 +0000] - INFO - Security Initialization -
SSL info: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA: enabled
[11/Dec/2017:10:54:45.861553800 +0000] - INFO - Security Initialization -
SSL info: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256: enabled
[11/Dec/2017:10:54:45.861794809 +0000] - INFO - Security Initialization -
SSL info: TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256: enabled
[11/Dec/2017:10:54:45.861975495 +0000] - INFO - Security Initialization -
SSL info: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA: enabled
[11/Dec/2017:10:54:45.862167830 +0000] - INFO - Security Initialization -
SSL info: TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384: enabled
[11/Dec/2017:10:54:45.862330320 +0000] - INFO - Security Initialization -
SSL info: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA: enabled
[11/Dec/2017:10:54:45.862505120 +0000] - INFO - Security Initialization -
SSL info: TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256: enabled
[11/Dec/2017:10:54:45.862671264 +0000] - INFO - Security Initialization -
SSL info: TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256: enabled
[11/Dec/2017:10:54:45.862887543 +0000] - INFO - Security Initialization -
SSL info: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA: enabled
[11/Dec/2017:10:54:45.863101461 +0000] - INFO - Security Initialization -
SSL info: TLS_DHE_RSA_WITH_AES_256_GCM_SHA384: enabled
[11/Dec/2017:10:54:45.863338463 +0000] - INFO - Security Initialization -
SSL info: TLS_DHE_RSA_WITH_AES_256_CBC_SHA: enabled
[11/Dec/2017:10:54:45.863544421 +0000] - INFO - Security Initialization -
SSL info: TLS_DHE_DSS_WITH_AES_256_CBC_SHA: enabled
[11/Dec/2017:10:54:45.863791975 +0000] - INFO - Security Initialization -
SSL info: TLS_DHE_RSA_WITH_AES_256_CBC_SHA256: enabled
[11/Dec/2017:10:54:45.864025763 +0000] - INFO - Security Initialization -
SSL info: TLS_DHE_RSA_WITH_AES_128_GCM_SHA256: enabled
[11/Dec/2017:10:54:45.864224082 +0000] - INFO - Security Initialization -
SSL info: TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256: enabled
[11/Dec/2017:10:54:45.864439879 +0000] - INFO - Security Initialization -
SSL info: TLS_DHE_RSA_WITH_AES_128_CBC_SHA: enabled
[11/Dec/2017:10:54:45.864648577 +0000] - INFO - Security Initialization -
SSL info: TLS_DHE_DSS_WITH_AES_128_CBC_SHA: enabled
[11/Dec/2017:10:54:45.864878026 +0000] - INFO - Security Initialization -
SSL info: TLS_DHE_RSA_WITH_AES_128_CBC_SHA256: enabled
[11/Dec/2017:10:54:45.865089112 +0000] - INFO - Security Initialization -
SSL info: TLS_RSA_WITH_AES_256_GCM_SHA384: enabled
[11/Dec/2017:10:54:45.865325308 +0000] - INFO - Security Initialization -
SSL info: TLS_RSA_WITH_AES_256_CBC_SHA: enabled
[11/Dec/2017:10:54:45.865519848 +0000] - INFO - Security Initialization -
SSL info: TLS_RSA_WITH_AES_256_CBC_SHA256: enabled
[11/Dec/2017:10:54:45.865726729 +0000] - INFO - Security Initialization -
SSL info: TLS_RSA_WITH_AES_128_GCM_SHA256: enabled
[11/Dec/2017:10:54:45.866530550 +0000] - INFO - Security Initialization -
SSL info: TLS_RSA_WITH_AES_128_CBC_SHA: enabled
[11/Dec/2017:10:54:45.866759925 +0000] - INFO - Security Initialization -
SSL info: TLS_RSA_WITH_AES_128_CBC_SHA256: enabled
[11/Dec/2017:10:54:45.867094660 +0000] - INFO - Security Initialization -
SSL info: TLS_AES_128_GCM_SHA256: enabled
[11/Dec/2017:10:54:45.867324109 +0000] - INFO - Security Initialization -
SSL info: TLS_CHACHA20_POLY1305_SHA256: enabled
[11/Dec/2017:10:54:45.867541305 +0000] - INFO - Security Initialization -
SSL info: TLS_AES_256_GCM_SHA384: enabled
[11/Dec/2017:10:54:45.882208253 +0000] - INFO - Security Initialization -
slapd_ssl_init2 - Configured SSL version range: min: TLS1.2, max: TLS1.2
[11/Dec/2017:10:54:45.883120151 +0000] - INFO - main - 389-Directory/1.3.6.1
B2017.334.195 starting up
[11/Dec/2017:10:54:45.906595731 +0000] - INFO -
ldbm_instance_config_cachememsize_set - force a minimal value 512000
[11/Dec/2017:10:54:45.930996951 +0000] - WARN - default_mr_indexer_create -
Plugin [caseIgnoreIA5Match] does not handle caseExactIA5Match
[11/Dec/2017:10:54:45.936518595 +0000] - INFO -
ldbm_instance_config_cachememsize_set - force a minimal value 512000
[11/Dec/2017:10:54:45.964436646 +0000] - INFO -
ldbm_instance_config_cachememsize_set - force a minimal value 512000
[11/Dec/2017:10:54:45.991766644 +0000] - NOTICE - ldbm_back_start - found
65758072k physical memory
[11/Dec/2017:10:54:45.992114756 +0000] - NOTICE - ldbm_back_start - found
64274224k available
[11/Dec/2017:10:54:45.992292511 +0000] - NOTICE - ldbm_back_start - cache
autosizing: db cache: 524288k
[11/Dec/2017:10:54:45.992457300 +0000] - NOTICE - ldbm_back_start - cache
autosizing: userRoot entry cache (3 total): 2031616k
[11/Dec/2017:10:54:46.034980655 +0000] - NOTICE - ldbm_back_start - cache
autosizing: ipaca entry cache (3 total): 2031616k
[11/Dec/2017:10:54:46.061542601 +0000] - NOTICE - ldbm_back_start - cache
autosizing: changelog entry cache (3 total): 2031616k
[11/Dec/2017:10:54:46.089160984 +0000] - NOTICE - ldbm_back_start - total
cache size: 6809452544 B;
*[11/Dec/2017:10:54:46.649231467 +0000] - ERR - schema-compat-plugin -
scheduled schema-compat-plugin tree scan in about 5 seconds after the
server startup!*
*[11/Dec/2017:10:54:46.683853691 +0000] - ERR - NSACLPlugin - acl_parse -
The ACL target cn=groups,cn=compat,dc=mydomain,dc=net does not exist*
*[11/Dec/2017:10:54:46.684455331 +0000] - ERR - NSACLPlugin - acl_parse -
The ACL target cn=computers,cn=compat,dc=mydomain,dc=net does not exist*
*[11/Dec/2017:10:54:46.684843652 +0000] - ERR - NSACLPlugin - acl_parse -
The ACL target cn=ng,cn=compat,dc=mydomain,dc=net does not exist*
*[11/Dec/2017:10:54:46.685517004 +0000] - ERR - NSACLPlugin - acl_parse -
The ACL target ou=sudoers,dc=mydomain,dc=net does not exist*
*[11/Dec/2017:10:54:46.685862356 +0000] - ERR - NSACLPlugin - acl_parse -
The ACL target cn=users,cn=compat,dc=mydomain,dc=net does not exist*
*[11/Dec/2017:10:54:46.686187616 +0000] - ERR - NSACLPlugin - acl_parse -
The ACL target cn=vaults,cn=kra,dc=mydomain,dc=net does not exist*
*[11/Dec/2017:10:54:46.686501554 +0000] - ERR - NSACLPlugin - acl_parse -
The ACL target cn=vaults,cn=kra,dc=mydomain,dc=net does not exist*
*[11/Dec/2017:10:54:46.686847159 +0000] - ERR - NSACLPlugin - acl_parse -
The ACL target cn=vaults,cn=kra,dc=mydomain,dc=net does not exist*
*[11/Dec/2017:10:54:46.687297649 +0000] - ERR - NSACLPlugin - acl_parse -
The ACL target cn=vaults,cn=kra,dc=mydomain,dc=net does not exist*
*[11/Dec/2017:10:54:46.687692409 +0000] - ERR - NSACLPlugin - acl_parse -
The ACL target cn=vaults,cn=kra,dc=mydomain,dc=net does not exist*
*[11/Dec/2017:10:54:46.688148374 +0000] - ERR - NSACLPlugin - acl_parse -
The ACL target cn=vaults,cn=kra,dc=mydomain,dc=net does not exist*
*[11/Dec/2017:10:54:46.688610518 +0000] - ERR - NSACLPlugin - acl_parse -
The ACL target cn=vaults,cn=kra,dc=mydomain,dc=net does not exist*
*[11/Dec/2017:10:54:46.689053107 +0000] - ERR - NSACLPlugin - acl_parse -
The ACL target cn=vaults,cn=kra,dc=mydomain,dc=net does not exist*
*[11/Dec/2017:10:54:46.689563126 +0000] - ERR - NSACLPlugin - acl_parse -
The ACL target cn=vaults,cn=kra,dc=mydomain,dc=net does not exist*
*[11/Dec/2017:10:54:46.689956461 +0000] - ERR - NSACLPlugin - acl_parse -
The ACL target cn=vaults,cn=kra,dc=mydomain,dc=net does not exist*
*[11/Dec/2017:10:54:46.690253805 +0000] - ERR - NSACLPlugin - acl_parse -
The ACL target cn=vaults,cn=kra,dc=mydomain,dc=net does not exist*
*[11/Dec/2017:10:54:46.700212505 +0000] - ERR - NSACLPlugin - acl_parse -
The ACL target cn=ad,cn=etc,dc=mydomain,dc=net does not exist*
*[11/Dec/2017:10:54:46.703349114 +0000] - ERR - NSACLPlugin - acl_parse -
The ACL target cn=casigningcert
cert-pki-ca,cn=ca_renewal,cn=ipa,cn=etc,dc=mydomain,dc=net does not exist*
*[11/Dec/2017:10:54:46.703741088 +0000] - ERR - NSACLPlugin - acl_parse -
The ACL target cn=casigningcert
cert-pki-ca,cn=ca_renewal,cn=ipa,cn=etc,dc=mydomain,dc=net does not exist*
*[11/Dec/2017:10:54:46.856737703 +0000] - ERR - NSACLPlugin - acl_parse -
The ACL target cn=automember rebuild membership,cn=tasks,cn=config does not
exist*
*[11/Dec/2017:10:54:46.864338548 +0000] - ERR - cos-plugin - cos_dn_defs_cb
- Skipping CoS Definition cn=Password
Policy,cn=accounts,dc=mydomain,dc=net--no CoS Templates found, which should
be added before the CoS Definition.*
*[11/Dec/2017:10:54:46.940988881 +0000] - ERR - set_krb5_creds - Could not
get initial credentials for principal [ldap/ipa1.mydomain.net(a)mydomain.NET]
in keytab [FILE:/etc/dirsrv/ds.keytab]: -1765328228 (Cannot contact any KDC
for requested realm)*
*[11/Dec/2017:10:54:46.943069140 +0000] - ERR - slapi_ldap_bind - Error:
could not bind id [cn=Replication Manager
cloneAgreement1-ipa2.mydomain.net-pki-tomcat,ou=csusers,cn=config]
authentication mechanism [SIMPLE]: error 32 (No such object)*
*[11/Dec/2017:10:54:46.944217190 +0000] - ERR - NSMMReplicationPlugin -
bind_and_check_pwp -
agmt="cn=masterAgreement1-ipa2.mydomain.net-pki-tomcat" (ipa2:389) -
Replication bind with SIMPLE auth failed: LDAP error 32 (No such object) ()*
[11/Dec/2017:10:54:46.963313439 +0000] - ERR - schema-compat-plugin -
schema-compat-plugin tree scan will start in about 5 seconds!
[11/Dec/2017:10:54:46.975375127 +0000] - INFO - slapd_daemon - slapd
started. Listening on All Interfaces port 389 for LDAP requests
[11/Dec/2017:10:54:46.975614879 +0000] - INFO - slapd_daemon - Listening on
All Interfaces port 636 for LDAPS requests
[11/Dec/2017:10:54:46.975772722 +0000] - INFO - slapd_daemon - Listening on
/var/run/slapd-mydomain-NET.socket for LDAPI requests
[11/Dec/2017:10:54:49.992127949 +0000] - ERR - slapi_ldap_bind - Error:
could not bind id [cn=Replication Manager
cloneAgreement1-ipa2.mydomain.net-pki-tomcat,ou=csusers,cn=config]
authentication mechanism [SIMPLE]: error 32 (No such object)
[11/Dec/2017:10:54:52.001683823 +0000] - ERR - schema-compat-plugin -
warning: no entries set up under cn=computers, cn=compat,dc=mydomain,dc=net
[11/Dec/2017:10:54:52.001931063 +0000] - ERR - schema-compat-plugin -
Finished plugin initialization.
*[11/Dec/2017:10:54:56.518870614 +0000] - ERR - slapi_ldap_bind - Error:
could not bind id [cn=Replication Manager
cloneAgreement1-ipa2.mydomain.net-pki-tomcat,ou=csusers,cn=config]
authentication mechanism [SIMPLE]: error 32 (No such object)*
[11/Dec/2017:10:55:08.126286757 +0000] - ERR - slapi_ldap_bind - Error:
could not bind id [cn=Replication Manager
cloneAgreement1-ipa2.mydomain.net-pki-tomcat,ou=csusers,cn=config]
authentication mechanism [SIMPLE]: error 32 (No such object)
[11/Dec/2017:10:55:31.564224049 +0000] - ERR - slapi_ldap_bind - Error:
could not bind id [cn=Replication Manager
cloneAgreement1-ipa2.mydomain.net-pki-tomcat,ou=csusers,cn=config]
authentication mechanism [SIMPLE]: error 32 (No such object)
[11/Dec/2017:10:56:19.947049662 +0000] - ERR - slapi_ldap_bind - Error:
could not bind id [cn=Replication Manager
cloneAgreement1-ipa2.mydomain.net-pki-tomcat,ou=csusers,cn=config]
authentication mechanism [SIMPLE]: error 32 (No such object)
[11/Dec/2017:10:57:55.276619160 +0000] - ERR - slapi_ldap_bind - Error:
could not bind id [cn=Replication Manager
cloneAgreement1-ipa2.mydomain.net-pki-tomcat,ou=csusers,cn=config]
authentication mechanism [SIMPLE]: error 32 (No such object)
[11/Dec/2017:11:01:08.288705049 +0000] - ERR - slapi_ldap_bind - Error:
could not bind id [cn=Replication Manager
cloneAgreement1-ipa2.mydomain.net-pki-tomcat,ou=csusers,cn=config]
authentication mechanism [SIMPLE]: error 32 (No such object)
[11/Dec/2017:11:06:08.333891976 +0000] - ERR - slapi_ldap_bind - Error:
could not bind id [cn=Replication Manager
cloneAgreement1-ipa2.mydomain.net-pki-tomcat,ou=csusers,cn=config]
authentication mechanism [SIMPLE]: error 32 (No such object)
[11/Dec/2017:11:11:08.066222421 +0000] - ERR - slapi_ldap_bind - Error:
could not bind id [cn=Replication Manager
cloneAgreement1-ipa2.mydomain.net-pki-tomcat,ou=csusers,cn=config]
authentication mechanism [SIMPLE]: error 32 (No such object)
--
Callum Guy
Head of Information Security
X-on
--
*0333 332 0000 | www.x-on.co.uk <http://www.x-on.co.uk> | **
<https://www.linkedin.com/company/x-on> <https://www.facebook.com/XonTel>
<https://twitter.com/xonuk> *
X-on is a trading name of Storacall Technology Ltd a limited company
registered in England and Wales.
Registered Office : Avaland House, 110 London Road, Apsley, Hemel
Hempstead, Herts, HP3 9SD. Company Registration No. 2578478.
The information in this e-mail is confidential and for use by the
addressee(s) only. If you are not the intended recipient, please notify
X-on immediately on +44(0)333 332 0000 and delete the
message from your computer. If you are not a named addressee you must not
use, disclose, disseminate, distribute, copy, print or reply to this email. Views
or opinions expressed by an individual
within this email may not necessarily reflect the views of X-on or its
associated companies. Although X-on routinely screens for viruses,
addressees should scan this email and any attachments
for viruses. X-on makes no representation or warranty as to the absence of
viruses in this email or any attachments.
6 years, 4 months
IPa and automount
by Miguel Angel Coa M.
Hello,
I'm configure automount/nfs in my IPA server but a have a question for
change the remote mount point. For example, now the when user login
automount "mount" the home under /home/XXXX , but i need change this
directory, for example /home/remote/XXXX
Example:
[.................]
su - foo
df -h
ipa.example.local:/autohome/foo 8.0G 6.2G 1.9G 77% /home/foo
[.................]
But i need
[.................]
su - foo
df -h
ipa.example.local:/autohome/foo 8.0G 6.2G 1.9G 77% /home/remote/foo
[.................]
My setting are:
ipa automountlocation-add ipauserhome
ipa automountmap-add ipauserhome auto.home
ipa automountkey-add ipauserhome auto.home --key="*" --info="-fstype=nfs
ipa.example.local:/autohome/&"
ipa automountlocation-tofiles ipauserhome
Thanks
Saludos.
---
Miguel Coa M.
6 years, 4 months
FreeIPA: DNS , reverse zone and CIDR
by Thorsten Johannsen
Hello list :-)
I'm currently working with some VM's in order to replicate a setup at
work for which we want to use freeIPA.
Though I'm familiar with Linux in general, I'm a complete "newbie" as
far as freeIPA is concerned.
Currently I have the following VM's running CentOS 7 in the network
128.0.208.0/21 <- I assume the netmask is the problem!
Server IPA1: fully configured with IPA: 128.0.209.91/21
Server IPA2: cloned from IPA1 when IPA software was installed but not
configured: 128.0.209.191/21
Server A-CM: not yet IPA configured, shall be an IPA client 128.0.211.10/21
Server B-CM: not yet IPA configured, shall be an IPA client 128.0.211.110/21
So I used the following article as reference:
https://blog.christophersmart.com/articles/freeipa-how-to-fedora/
First thing I noticed was that there is no reverse zone automatically
configured:
------------------------------------------------------------------------------
BIND DNS server will be configured to serve IPA domain with:
[...]
Reverse zone(s): No reverse zone
------------------------------------------------------------------------------
After following the article until the first IPA server was set up, I
noticed that the reverse lookup does not work:
-----------------------------------------------------------------------------
host 128.0.209.91
Host 91.209.0.128.in-addr.arpa. not found: 3(NXDOMAIN)
-----------------------------------------------------------------------------
I logged into the WebUI and tried to create the DNS reverse zone with
CIDR notation "128.0.208.0/21". The zone that was created was
"0.128.in-addr.arpa." Which seems implausible since only 128.0.208.1 -
128.0.215.254 are managed by this DNS server.
Then I stumbled about this (german) page: [
https://translate.google.de/translate?sl=de&tl=en&js=y&prev=_t&hl=de&ie=U...
]
which stated:
"By the way, the delegation of networks larger
than|/24|is quite simple.If, for example, you want to delegate
a|/22|network, then you
simply delegate the 4/24 networks that make up the|/22|network."
After removing the "0.128.in-addr.arpa." entry I tried to create the
reverse zone for "128.0.208.0/24" up to "128.0.215.0/24" but freeIPA
claimed that those would already exist.
Basically I hope that someone could help me out with the following
questions:
-----------------------------------------------------------------------------
1) What is the proper way to create a DNS zone (including reverse zone)
for the 128.0.208.0/21 network?
2) How do I list the present zones in order to verify if
"128.0.208.0/24" up to "128.0.215.0/24" really do exist? (They are not
listed in the WebUI)
3) Within the reverse zone "0.128.in-addr.arpa." i needed to create a
PTR entry "91.209" for my server to have "host 128.0.209.91" perform the
reverse lookup. Is that the way it is supposed to be?
4) Any good pointer about setting / combining this (freeIPA DNS) with
DHCP? (I haven't googled for this, I must admit. Just though of this
while I was typing. So feel free to ignore question no. 4 if this is a
"dumb" question and there a obvious results on google :-)
PS: I studied https://tools.ietf.org/html/rfc2317 but cannot figure out
how to apply this in my scenario.
Thanks to everybody for their time reading and answering!
Cheers,
Thorsten
6 years, 4 months
Maintenance mode
by Lachlan Musicman
Stupid question, but to stop anyone from logging in anywhere - for instance
during a maintenance period - is there an easy maintenance mode in IPA?
Or is the best method to disable all HBAC rules?
cheers
L.
------
"The antidote to apocalypticism is *apocalyptic civics*. Apocalyptic civics
is the insistence that we cannot ignore the truth, nor should we panic
about it. It is a shared consciousness that our institutions have failed
and our ecosystem is collapsing, yet we are still here — and we are
creative agents who can shape our destinies. Apocalyptic civics is the
conviction that the only way out is through, and the only way through is
together. "
*Greg Bloom* @greggish
https://twitter.com/greggish/status/873177525903609857
6 years, 4 months