Replication and SSL certs
by Mark Haney
I'm really new to FreeIPA, and this is probably a stupid question, but I
just setup a replica of the primary (not in production) IPA server we
have. However, the replica's SSL cert is untrusted, while the primary
IPA server's cert is fine. The docs I read said the SSL certs would be
carried over when building the replica GPG file and installing the
replica data.
Have I missed something in the replication setup process?
--
Mark Haney
Network Engineer at NeoNova
919-460-3330 option 1
mark.haney(a)neonova.net
www.neonova.net
6 years, 9 months
Re: Chrome 58 Doesn't Trust SSL Certificates Signed by FreeIPA
by Prasun Gera
Bumping this for help. I need to renew my replica's SSL certificate which
will expire in a month, but I can't find any instructions. It looks like
the replica's web-ui cert isn't tracked by the master or the replica. I'm
using a pretty stock installation with no external CAs or certs. So
ideally, all of this should have been handled automatically by ipa, but it
isn't. There have also been quite a few cert related posts of late which
makes me think if there are (were) some other issues with replica setup a
couple of years ago, which is when the certs were originally generated.
On Mon, May 1, 2017 at 5:39 AM, Prasun Gera <prasun.gera(a)gmail.com> wrote:
> Any ideas why the replica's certs are not being tracked ? That looks like
> an issue in itself. If they are not being tracked, the replica will fail
> once they expire. Is there any way to fix the replica ?
>
> On Sun, Apr 23, 2017 at 10:08 PM, Prasun Gera <prasun.gera(a)gmail.com>
> wrote:
>
>> I tried that, but the replica's "getcert list" doesn't seem to show any
>> results. "Number of certificates and requests being tracked: 0." Is that
>> expected ?
>>
>> On Sun, Apr 23, 2017 at 8:50 PM, Fraser Tweedale <ftweedal(a)redhat.com>
>> wrote:
>>
>>> On Sun, Apr 23, 2017 at 03:32:19AM -0400, Prasun Gera wrote:
>>> > Thank you. That worked for the master. How do I fix the replica's cert
>>> ?
>>> > This is on ipa-server-4.4.0-14.el7_3.7.x86_64 on RHEL7. I am not using
>>> > ipa's DNS at all. Did this happen because of that ?
>>> >
>>> This is not related to DNS.
>>>
>>> To fix the replica, log onto the host and perform the same steps
>>> with Certmonger there. The tracking Request ID will be different
>>> but otherwise the process is the same.
>>>
>>> Cheers,
>>> Fraser
>>>
>>> > On Thu, Apr 20, 2017 at 9:06 PM, Fraser Tweedale <ftweedal(a)redhat.com>
>>> > wrote:
>>> >
>>> > > On Thu, Apr 20, 2017 at 07:31:16PM -0400, Prasun Gera wrote:
>>> > > > I can confirm that I see this behaviour too. My ipa server install
>>> is a
>>> > > > pretty stock install with no 3rd party certificates.
>>> > > >
>>> > > > On Thu, Apr 20, 2017 at 5:46 PM, Simon Williams <
>>> > > > simon.williams(a)thehelpfulcat.com> wrote:
>>> > > >
>>> > > > > Yesterday, Chrome on both my Ubuntu and Windows machines updated
>>> to
>>> > > > > version 58.0.3029.81. It appears that this version of Chrome
>>> will not
>>> > > > > trust certificates based on Common Name. Looking at the Chrome
>>> > > > > documentation and borne out by one of the messages, from Chrome
>>> 58,
>>> > > > > the subjectAltName is required to identify the DNS name of the
>>> host
>>> > > that
>>> > > > > the certificate is issued for. I would be grateful if someone
>>> could
>>> > > point
>>> > > > > me in the direction of how to recreate my SSL certificates so
>>> that
>>> > > > > the subjectAltName is populated.
>>> > > > >
>>> > > > > Thanks in advance
>>> > > > >
>>> > > > > --
>>> > > > > Manage your subscription for the Freeipa-users mailing list:
>>> > > > > https://www.redhat.com/mailman/listinfo/freeipa-users
>>> > > > > Go to http://freeipa.org for more info on the project
>>> > > > >
>>> > > Which version of IPA are you using?
>>> > >
>>> > > The first thing you should do, which I think should be sufficient in
>>> > > most cases, is to tell certmonger to submit a new cert request for
>>> > > each affected certificate, instructing to include the relevant
>>> > > DNSName in the subjectAltName extension in the CSR.
>>> > >
>>> > > To list certmonger tracking requests and look for the HTTPS
>>> > > certificate. For example:
>>> > >
>>> > > $ getcert list
>>> > > Number of certificate and requests being tracked: 11
>>> > > ...
>>> > > Request ID '20170418012901':
>>> > > status: MONITORING
>>> > > stuck: no
>>> > > key pair storage: type=NSSDB,location='/etc/
>>> > > httpd/alias',nickname='Server-Cert',token='NSS Certificate
>>> > > DB',pinfile='/etc/httpd/alias/pwdfile.txt'
>>> > > certificate: type=NSSDB,location='/etc/
>>> > > httpd/alias',nickname='Server-Cert',token='NSS Certificate DB'
>>> > > CA: IPA
>>> > > issuer: CN=Certificate Authority,O=IPA.LOCAL 201703211317
>>> > > subject: CN=f25-2.ipa.local,O=IPA.LOCAL 201703211317
>>> > > expires: 2019-03-22 03:20:19 UTC
>>> > > dns: f25-2.ipa.local
>>> > > key usage: digitalSignature,nonRepudiatio
>>> n,keyEncipherment,
>>> > > dataEncipherment
>>> > > eku: id-kp-serverAuth,id-kp-clientAuth
>>> > > pre-save command:
>>> > > post-save command: /usr/libexec/ipa/certmonger/re
>>> start_httpd
>>> > > track: yes
>>> > > auto-renew: yes
>>> > > ...
>>> > >
>>> > > Using the Request ID of the HTTPS certificate, resubmit the request
>>> > > but use the ``-D <hostname>`` option to specify a DNSName to include
>>> > > in the SAN extension:
>>> > >
>>> > > $ getcert resubmit -i <Request ID> -D <hostname>
>>> > >
>>> > > ``-D <hostname>`` can be specified multiple times, if necessary.
>>> > >
>>> > > This should request a new certificate that will have the server DNS
>>> > > name in the SAN extension.
>>> > >
>>> > > HTH,
>>> > > Fraser
>>> > >
>>>
>>
>>
>
6 years, 9 months
autofs.service on NFS clients and servers
by Petros Triantafyllidis
Hi all,
I am very new to IPA and still a bit before going into production, so
apologies in advance.
The plan is to have a number of servers that each one shares a space via
kerberized nfs4 to the others, which makes all of them NFS clients and
servers at the same time. On my attempt to setup automount globally via
IdM and sssd, I realized that when a machine is configured as nfs
server, it needs autofs.service to be stopped in order to access it's
local shares mounted via fstab. If I use /etc/auto.master to mount the
local shares instead of fstab, then autofs.service may (actually must)
run and everything works properly but, doing so, I don't have the
advantage of one central configuration location any more.
The preferred scenario for each server would be to mount its local
shares via fstab and the remote shares via sssd automount. Am I missing
something?
Thanks in advance,
Petros
6 years, 9 months
dirsrv will not start, tried cp dse.ldif.startOK to dse.ldif but issue remains.
by email@ml.jacobdevans.com
IPA Users,
I'm not sure when the last time this service was running/working, any ideas are appreciated.
IPA Version: ipa-server-4.4.0-14.el7.centos.7.x86_64
ipa-server-upgrade
Upgrading IPA:
[1/8]: saving configuration
[2/8]: disabling listeners
[3/8]: enabling DS global lock
[4/8]: starting directory server
[error] CalledProcessError: Command '/bin/systemctl start dirsrv(a)IPA-EXAMPLE-COM.service' returned non-zero exit status 1
[cleanup]: stopping directory server
[cleanup]: restoring configuration
IPA server upgrade failed: Inspect /var/log/ipaupgrade.log and run command ipa-server-upgrade manually.
Unexpected error - see /var/log/ipaupgrade.log for details:
CalledProcessError: Command '/bin/systemctl start dirsrv(a)IPA-EXAMPLE-COM.service' returned non-zero exit status 1
The ipa-server-upgrade command failed. See /var/log/ipaupgrade.log for more information
#tail -n 100 /var/log/ipaupgrade.log
2017-07-14T16:03:53Z DEBUG stderr=Job for dirsrv(a)IPA-EXAMPLE-COM.service failed because a fatal signal was delivered to the control process. See "systemctl status dirsrv(a)IPA-EXAMPLE-COM.service" and "journalctl -xe" for details.
2017-07-14T16:03:53Z DEBUG Traceback (most recent call last):
File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 449, in start_creation
run_step(full_msg, method)
File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 439, in run_step
method()
File "/usr/lib/python2.7/site-packages/ipaserver/install/upgradeinstance.py", line 94, in __start
services.service(self.service_name).start(self.serverid, ldapi=True)
File "/usr/lib/python2.7/site-packages/ipaplatform/redhat/services.py", line 157, in start
instance_name, capture_output=capture_output, wait=wait)
File "/usr/lib/python2.7/site-packages/ipaplatform/base/services.py", line 285, in start
skip_output=not capture_output)
File "/usr/lib/python2.7/site-packages/ipapython/ipautil.py", line 494, in run
raise CalledProcessError(p.returncode, arg_string, str(output))
CalledProcessError: Command '/bin/systemctl start dirsrv(a)IPA-EXAMPLE-COM.service' returned non-zero exit status 1
2017-07-14T16:03:53Z DEBUG [error] CalledProcessError: Command '/bin/systemctl start dirsrv(a)IPA-EXAMPLE-COM.service' returned non-zero exit status 1
2017-07-14T16:03:53Z DEBUG [cleanup]: stopping directory server
2017-07-14T16:03:53Z DEBUG Starting external process
2017-07-14T16:03:53Z DEBUG args=/bin/systemctl stop dirsrv(a)IPA-EXAMPLE-COM.service
2017-07-14T16:03:53Z DEBUG Process finished, return code=0
2017-07-14T16:03:53Z DEBUG stdout=
2017-07-14T16:03:53Z DEBUG stderr=
2017-07-14T16:03:53Z DEBUG duration: 0 seconds
2017-07-14T16:03:53Z DEBUG [cleanup]: restoring configuration
2017-07-14T16:03:53Z DEBUG Loading StateFile from '/var/lib/ipa/sysrestore/sysrestore.state'
2017-07-14T16:03:53Z DEBUG Loading StateFile from '/var/lib/ipa/sysrestore/sysrestore.state'
2017-07-14T16:03:53Z DEBUG Saving StateFile to '/var/lib/ipa/sysrestore/sysrestore.state'
2017-07-14T16:03:53Z DEBUG Loading StateFile from '/var/lib/ipa/sysrestore/sysrestore.state'
2017-07-14T16:03:53Z DEBUG Loading StateFile from '/var/lib/ipa/sysrestore/sysrestore.state'
2017-07-14T16:03:53Z DEBUG Saving StateFile to '/var/lib/ipa/sysrestore/sysrestore.state'
2017-07-14T16:03:53Z DEBUG Loading StateFile from '/var/lib/ipa/sysrestore/sysrestore.state'
2017-07-14T16:03:53Z DEBUG duration: 0 seconds
2017-07-14T16:03:53Z ERROR IPA server upgrade failed: Inspect /var/log/ipaupgrade.log and run command ipa-server-upgrade manually.
2017-07-14T16:03:53Z DEBUG File "/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 171, in execute
return_value = self.run()
File "/usr/lib/python2.7/site-packages/ipaserver/install/ipa_server_upgrade.py", line 46, in run
server.upgrade()
File "/usr/lib/python2.7/site-packages/ipaserver/install/server/upgrade.py", line 1846, in upgrade
data_upgrade.create_instance()
File "/usr/lib/python2.7/site-packages/ipaserver/install/upgradeinstance.py", line 119, in create_instance
show_service_name=False)
File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 449, in start_creation
run_step(full_msg, method)
File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 439, in run_step
method()
File "/usr/lib/python2.7/site-packages/ipaserver/install/upgradeinstance.py", line 94, in __start
services.service(self.service_name).start(self.serverid, ldapi=True)
File "/usr/lib/python2.7/site-packages/ipaplatform/redhat/services.py", line 157, in start
instance_name, capture_output=capture_output, wait=wait)
File "/usr/lib/python2.7/site-packages/ipaplatform/base/services.py", line 285, in start
skip_output=not capture_output)
File "/usr/lib/python2.7/site-packages/ipapython/ipautil.py", line 494, in run
raise CalledProcessError(p.returncode, arg_string, str(output))
2017-07-14T16:03:53Z DEBUG The ipa-server-upgrade command failed, exception: CalledProcessError: Command '/bin/systemctl start dirsrv(a)IPA-EXAMPLE-COM.service' returned non-zero exit status 1
2017-07-14T16:03:53Z ERROR Unexpected error - see /var/log/ipaupgrade.log for details:
CalledProcessError: Command '/bin/systemctl start dirsrv(a)IPA-EXAMPLE-COM.service' returned non-zero exit status 1
2017-07-14T16:03:53Z ERROR The ipa-server-upgrade command failed. See /var/log/ipaupgrade.log for more information
Thank You,
-Jake
6 years, 9 months
IPA Servers will not start - dirsrv
by email@ml.jacobdevans.com
IPA-Users,
We relocated a rack recently across the states and are no longer able to start dirsrv389.
sudo ipactl start
Starting Directory Service
Failed to start Directory Service: Command '/bin/systemctl start dirsrv(a)IPA-EXAMPLE-COM.service' returned non-zero exit status 1
Thousands of log entries:
ns-slapd[15125]: [14/Jul/2017:09:09:11.167235367 -0400] valueset_value_syntax_cmp: slapi_attr_values2keys_sv failed for type attributetypes
ns-slapd[15125]: [14/Jul/2017:09:09:11.167240900 -0400] valueset_value_syntax_cmp: slapi_attr_values2keys_sv failed for type attributetypes
ns-slapd[15125]: [14/Jul/2017:09:09:11.167245957 -0400] valueset_value_syntax_cmp: slapi_attr_values2keys_sv failed for type attributetypes
ns-slapd[15125]: [14/Jul/2017:09:09:11.167250923 -0400] valueset_value_syntax_cmp: slapi_attr_values2keys_sv failed for type attributetypes
ns-slapd[15125]: [14/Jul/2017:09:09:11.167256433 -0400] valueset_value_syntax_cmp: slapi_attr_values2keys_sv failed for type attributetypes
ns-slapd[15125]: [14/Jul/2017:09:09:11.167261853 -0400] valueset_value_syntax_cmp: slapi_attr_values2keys_sv failed for type attributetypes
ns-slapd[15125]: [14/Jul/2017:09:09:11.167268487 -0400] valueset_value_syntax_cmp: slapi_attr_values2keys_sv failed for type attributetypes
These servers were offline for 2-3 weeks, do they have the same tombstone effect as windows ad controllers?
Any other information I can provide?
Thanks
-Jake
6 years, 9 months
Unable to login as user
by patrick.mchale@nzx.com
Hi,
I am getting an error logging into a FreeIPA server from a new FreeIPA client. I have reset the password for the user using "kinit admin" but still no joy. Is there another password that is needing to be set?.
Jul 14 13:53:41 ipa-client [sssd[krb5_child[2457]]]: Password has expired
Jul 14 13:53:41 ipa-client [sssd[krb5_child[2457]]]: Decrypt integrity check failed
Jul 14 13:54:40 ipa-client [sssd[krb5_child[2466]]]: Password has expired
Jul 14 13:54:40 ipa-client [sssd[krb5_child[2466]]]: Decrypt integrity check failed
Any advice would be appreciated.
Patrick
6 years, 9 months
Cannot get a second FreeIPA client authentication working.
by Patrick McHale
Hi,
I have had a success with installing the FreeIPA system but I needed to add
another client in order to reproduce the steps required for
building a client to authenticate with the server. I did the same steps as
before but I cannot get "another" client to authenticate with the server.
The new client shows up in the hosts lists, and this indicates it has been
enrolled.
Is there something else that needs to be run, on the new client in order
for the FreeIPA server to take charge of the new client machine
authentication. I know the server is running correctly, because the
original client works fine.
Would be grateful for some advice.
Patrick
6 years, 9 months
`ipa-getcert request` for a sub-CA?
by John Morris
Is it possible to use certmonger to request a cert from a FreeIPA
sub-CA? What is the `ipa-getcert request` command-line usage for that?
The certmonger man-pages seem to indicate the `ipa-getcert request -X
ISSUER` argument. However I've been unable to find usage examples, and
using neither the ipa sub-CA's name nor subject DN for ISSUER seem to work.
I haven't dug into the source yet, but the certmonger puppet module
readme [1] seems to indicate the plumbing is there for request `issuer`
and `issuerdn`.
Thanks for any tips.
John
[1]: https://forge.puppet.com/saltedsignal/certmonger
6 years, 9 months
Caching server for freeipa?
by Robert Söderlund
Hi all!
In my setup I have 2 FreeIPA servers, both are masters (using location
without greater success, but I think that issue is a problem in layer 8
(between keyboard and chair)). Now when I have used FreeIPA for a while
I'm comfortable to let my home network use the FreeIPA for different
kind of services. But I don't want to setup a full replica at home for a
number for reasons: 1. I only use low-energy devices for the "house
needs" (like raspberry pi and other low end machines) 2. I don't really
trust how the replication will work during different kind of outages
(when I tear down the network and rebuild it for test something new, or
when my ISP having unannounced maintenance for a couple of hours).
The main purpose for stretch the ldap directory to my home network is to
have a simple single sign-on (some services are just using ldap insted
of true kerberos) for my family from some web logins and wifi
authentication.
I don't expect the users to change the password when they connect to
services that are using the FreeIPA cache, so I don't thing I need a
read-write proxy.
Thanks in advanced
//Robert
6 years, 9 months
OpenLdap - Freeipa - overview of all Fields?
by Tobi Berninger
Hey,
I am pretty new to this whole OpenLdap / Freeipa Buisness.
Is there any overview of all fields that openldap offers?
can anyone recommend me an good introduction to this topic ?
thank you all
j.
6 years, 9 months