Re: Freeipa + Godaddy certificate
by Rob Crittenden
Adrian HY wrote:
> Ho Rob, same problem;
>
> ipa-cacert-manage -n "Godaddy" -t CT,C,C install gd_bundle-g2-g1.crt -v
>
> ipa: DEBUG: Starting external process
> ipa: DEBUG: args=/usr/bin/certutil -d /tmp/tmpp31Uuq -N -f /tmp/tmp4TnBRN
> ipa: DEBUG: Process finished, return code=0
> ipa: DEBUG: stdout=
> ipa: DEBUG: stderr=
> ipa: DEBUG: Starting external process
> ipa: DEBUG: args=/usr/bin/certutil -d /tmp/tmpp31Uuq -A -n Godaddy -t C,,
> ipa: DEBUG: Process finished, return code=0
> ipa: DEBUG: stdout=
> ipa: DEBUG: stderr=
> ipa: DEBUG: Starting external process
> ipa: DEBUG: args=/usr/bin/certutil -d /tmp/tmpp31Uuq -A -n TEST.IPA.US
> <http://TEST.IPA.US> IPA CA -t CT,C,C
> ipa: DEBUG: Process finished, return code=0
> ipa: DEBUG: stdout=
> ipa: DEBUG: stderr=
> ipa.ipaserver.plugins.ldap2.ldap2: DEBUG: Destroyed connection
> context.ldap2_69179024
> ipa.ipaserver.install.ipa_cacert_manage.CACertManage: DEBUG: File
> "/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 171, in
> execute
> return_value = self.run()
> File
> "/usr/lib/python2.7/site-packages/ipaserver/install/ipa_cacert_manage.py",
> line 113, in run
> rc = self.install()
> File
> "/usr/lib/python2.7/site-packages/ipaserver/install/ipa_cacert_manage.py",
> line 356, in install
> "troubleshooting guide)" % e)
>
> ipa.ipaserver.install.ipa_cacert_manage.CACertManage: DEBUG: The
> ipa-cacert-manage command failed, exception: ScriptError: Not a valid CA
> certificate: (SEC_ERROR_UNKNOWN_ISSUER) Peer's Certificate issuer is not
> recognized. (visit http://www.freeipa.org/page/Troubleshooting for
> troubleshooting guide)
> ipa.ipaserver.install.ipa_cacert_manage.CACertManage: ERROR: Not a valid
> CA certificate: (SEC_ERROR_UNKNOWN_ISSUER) Peer's Certificate issuer is
> not recognized. (visit http://www.freeipa.org/page/Troubleshooting for
> troubleshooting guide)
> ipa.ipaserver.install.ipa_cacert_manage.CACertManage: ERROR: The
> ipa-cacert-manage command failed.
You may need to break the bundle into discrete files if there are
multiple certificates in it.
rob
>
>
> On 11 August 2017 at 11:47, Rob Crittenden <rcritten(a)redhat.com
> <mailto:rcritten@redhat.com>> wrote:
>
> Adrian HY via FreeIPA-users wrote:
> > Hi, I need to incorporate a godaddy certificate in freeipa.
> >
> > I have three files: 4dfc653ab0cf823d.crt, gd_bundle-g2-g1.crt and mykey.key.
> >
> > When I run the command * ipa-cacert-manage -n "Godaddy" -t CT,C,C
> > install cert.pem* the output is
> >
> > ipa.ipaserver.install.ipa_cacert_manage.CACertManage: DEBUG: The
> > ipa-cacert-manage command failed, exception: ScriptError: Not a valid CA
> > certificate: not a CA certificate (visit
> > http://www.freeipa.org/page/Troubleshooting
> <http://www.freeipa.org/page/Troubleshooting> for troubleshooting guide)
> > ipa.ipaserver.install.ipa_cacert_manage.CACertManage: ERROR: Not a valid
> > CA certificate: not a CA certificate
>
> So you mention three files you have and your command references none of
> them...
>
> You want to pass gd_bundle-g2-g1.crt.
>
> rob
>
>
6 years, 8 months
Unable to access web-ui after FreeIPA 4.4 to 4.5 upgrade.
by Troels Hansen
Hi, we just upgraded one of our FreeIPA 4.4 to FreeIPA 4.5 (running on RHEL) and wanted to put this here before creating a bug report with RedHat.
After upgrading we are unable to log into web-ui but everything else seems to be working OK.
WBR-UI gives us an: "Login failed due to an unknown reason"
I see this in the httpd error log:
[Mon Aug 07 15:27:55.404965 2017] [:error] [pid 1963] [remote 10.112.4.164:120] mod_wsgi (pid=1963): Exception occurred processing WSGI script '/usr/share/ipa/wsgi.py'.
[Mon Aug 07 15:27:55.405090 2017] [:error] [pid 1963] [remote 10.112.4.164:120] Traceback (most recent call last):
[Mon Aug 07 15:27:55.405155 2017] [:error] [pid 1963] [remote 10.112.4.164:120] File "/usr/share/ipa/wsgi.py", line 51, in application
[Mon Aug 07 15:27:55.405341 2017] [:error] [pid 1963] [remote 10.112.4.164:120] return api.Backend.wsgi_dispatch(environ, start_response)
[Mon Aug 07 15:27:55.405384 2017] [:error] [pid 1963] [remote 10.112.4.164:120] File "/usr/lib/python2.7/site-packages/ipaserver/rpcserver.py", line 262, in __call__
[Mon Aug 07 15:27:55.405985 2017] [:error] [pid 1963] [remote 10.112.4.164:120] return self.route(environ, start_response)
[Mon Aug 07 15:27:55.406040 2017] [:error] [pid 1963] [remote 10.112.4.164:120] File "/usr/lib/python2.7/site-packages/ipaserver/rpcserver.py", line 274, in route
[Mon Aug 07 15:27:55.406097 2017] [:error] [pid 1963] [remote 10.112.4.164:120] return app(environ, start_response)
[Mon Aug 07 15:27:55.406127 2017] [:error] [pid 1963] [remote 10.112.4.164:120] File "/usr/lib/python2.7/site-packages/ipaserver/rpcserver.py", line 929, in __call__
[Mon Aug 07 15:27:55.406153 2017] [:error] [pid 1963] [remote 10.112.4.164:120] self.kinit(user_principal, password, ipa_ccache_name)
[Mon Aug 07 15:27:55.406178 2017] [:error] [pid 1963] [remote 10.112.4.164:120] File "/usr/lib/python2.7/site-packages/ipaserver/rpcserver.py", line 965, in kinit
[Mon Aug 07 15:27:55.406200 2017] [:error] [pid 1963] [remote 10.112.4.164:120] pkinit_anchors=[paths.KDC_CERT, paths.KDC_CA_BUNDLE_PEM],
[Mon Aug 07 15:27:55.406218 2017] [:error] [pid 1963] [remote 10.112.4.164:120] File "/usr/lib/python2.7/site-packages/ipalib/install/kinit.py", line 125, in kinit_armor
[Mon Aug 07 15:27:55.406368 2017] [:error] [pid 1963] [remote 10.112.4.164:120] run(args, env=env, raiseonerr=True, capture_error=True)
[Mon Aug 07 15:27:55.406402 2017] [:error] [pid 1963] [remote 10.112.4.164:120] File "/usr/lib/python2.7/site-packages/ipapython/ipautil.py", line 511, in run
[Mon Aug 07 15:27:55.407040 2017] [:error] [pid 1963] [remote 10.112.4.164:120] raise CalledProcessError(p.returncode, arg_string, str(output))
[Mon Aug 07 15:27:55.407135 2017] [:error] [pid 1963] [remote 10.112.4.164:120] CalledProcessError: Command '/usr/bin/kinit -n -c /var/run/ipa/ccaches/armor_1963 -X X509_anchors=FILE:/var/kerberos/krb5kdc/kdc.crt -X X509_anchors=FILE:/var/lib/ipa-client/pki/kdc-ca-bundle.pem' returned non-zero exit status 1
Natually, first thing I tried was disabling SELinux, and reboot, but same result.
IPA is version: ipa-server-4.5.0-21.el7.x86_64
(replica being latest 4.4 on RHEL but not sure we dare updating this).
Problem seems much like this: https://bugzilla.redhat.com/show_bug.cgi?id=1452215
But Again, not entirely and that seemes SELinux related and things doesn't seems to be SELinux related here.
Also, trying the kinit listed in the error log asks for password. I suspect that this should succeed?
/usr/bin/kinit -n -c /var/run/ipa/ccaches/armor_1982 -X X509_anchors=FILE:/var/kerberos/krb5kdc/kdc.crt -X X509_anchors=FILE:/var/lib/ipa-client/pki/kdc-ca-bundle.pem
Password for WELLKNOWN/ANONYMOUS@DOMAIN:
6 years, 8 months
logging
by Andrew Meyer
If I want to keep track of DNS changes in FreeIPA, is there a way to do this?
6 years, 8 months
Freeipa + Godaddy certificate
by Adrian HY
Hi, I need to incorporate a godaddy certificate in freeipa.
I have three files: 4dfc653ab0cf823d.crt, gd_bundle-g2-g1.crt and mykey.key.
When I run the command * ipa-cacert-manage -n "Godaddy" -t CT,C,C
install cert.pem* the output is
ipa.ipaserver.install.ipa_cacert_manage.CACertManage: DEBUG: The
ipa-cacert-manage command failed, exception: ScriptError: Not a valid CA
certificate: not a CA certificate (visit
http://www.freeipa.org/page/Troubleshooting for troubleshooting guide)
ipa.ipaserver.install.ipa_cacert_manage.CACertManage: ERROR: Not a valid CA
certificate: not a CA certificate
Regards.
6 years, 8 months
AUTO: Christoph Kaminski is out of the office (Rückkehr am 04.09.2017)
by Christoph Kaminski
Ich kehre zurück am 04.09.2017.
Hinweis: Dies ist eine automatische Antwort auf Ihre Nachricht
"[Freeipa-users] Re: Chromium complains about ipa's web server certificate"
gesendet am 11.08.2017 10:33:07.
Diese ist die einzige Benachrichtigung, die Sie empfangen werden, während
diese Person abwesend ist.
6 years, 8 months
Re: howto replace an externally signed CA
by Florence Blanc-Renaud
On 08/10/2017 04:47 PM, Harald Dunkel wrote:
> Hi folks,
>
> On Wed, 2 Aug 2017 16:24:00 +0200
> Florence Blanc-Renaud <flo(a)redhat.com> wrote:
>
>> Hi,
>>
>> You can follow the steps described here:
>> https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/...
>>
>> ipa-cacert-manage renew --external-ca will create a CSR file that can be
>> sent to the new certificate authority. You will then receive a new cert
>> for IPA + a new CA chain that will be used in ipa-cacert-manage renew
>> --external-cert-file.
>>
>> HTH,
>> Flo
>
> The renewal seems to have succeeded. I see both old and new
> certificate in /etc/pki/pki-tomcat/alias or /etc/ipa/nssdb .
> /etc/ipa/ca.crt contains the new root certificate as well.
>
> Problem: If I access the ipa admin web interface
>
> https://ipa1.example.com/
>
> then it still uses the old certificate chain. Question is:
> How can I tell freeipa to stop using the old certificate?
>
>
> Every helpful comment is highly appreciated
> Harri
>
Hi,
(I am putting the list back in copy of the mail thread)
The command 'ipa-cacert-manage renew' updates IPA CA certificate but
does not trigger a renewal of all the certificates that were delivered
by your previous IPA CA. Those certificates are still valid and can be
used by HTTPd for instance. This is why you still see the previous cert
chain when you connect to the web GUI.
When the certificates reach their expiration date, they will
automatically be renewed, i.e. replaced by new ones signed by the new
IPA CA. If you want to renew them in advance, you can use the tool
ipa-getcert resubmit.
Note that there are a few issues with SElinux in enforcing mode, so I
would advise to make a backup of your NSS databases before renewing the
certs (for instance the httpd cert is stored in /etc/httpd/alias).
Flo
6 years, 8 months
password reset privileges
by Tiemen Ruiten
Hello,
I setup an LDAP User Federation in Keycloak to our FreeIPA domain.
Unfortunately, the password reset functionality appears to only work when
the user Keycloak binds as is in the admins group. I tried both the User
Administrator and helpdesk roles, but always got this error:
Caused by: javax.naming.NoPermissionException: [LDAP: error code 50 -
Insufficient 'write' privilege to the 'userPassword' attribute of entry
'uid=xxxxx,cn=users,cn=accounts,dc=example,dc=com'
Is there a way to allow password resets without adding the keycloak bind
user to the admins group?
--
Tiemen Ruiten
Systems Engineer
R&D Media
6 years, 8 months
FreeIPA AD Trust. Clarifying Doubts before I proceed
by Sameer Gurung
Hi All,
I have a network consisting of both windows and linux clients running
windows server 2008 (active directory) and centos 7 (freeipa). Obviously,
the windows clients authenticate against the *AD DC* *(domain windows.foo)* and
the linux clients against *FreeIPA (Domain linux.bar)* . This setup is
working fine. However I now want to setup cross domain trust between the
two domains and had few doubts which I wanted to clear before I proceed.
I have gone through the steps of setting up this trust but I am not clear
about the following questions:
1. Am I right in thinking that I will have to add forwarders to the two
domains in the respective dns servers?
2. Which DNS do I set in my linux clients? Do they still resolve against
the free IPA dns or the AD Dns?
3. Also what will usernames will people use to login to the linux machines?
Do they need to specify only the username or the full
*username(a)windows.foo? *
4. What about the existing freeipa users? and what if there are same
usernames in freeipa and AD DC
Any help will be much appreciated.
with regards,
*-----------------------------------------------------------------------Sameer
Kr.
Gurung-----------------------------------------------------------------------*
--
This message contains confidential information and is intended only for the
individual named. If you are not the named addressee you should not
disseminate, distribute or copy this e-mail. Please notify the sender
immediately by e-mail if you have received this e-mail by mistake and
delete this e-mail from your system. E-mail transmission cannot be
guaranteed to be secure or error-free as information could be intercepted,
corrupted, lost, destroyed, arrive late or incomplete, or contain viruses.
The sender therefore does not accept liability for any errors or omissions
in the contents of this message, which arise as a result of e-mail
transmission. If verification is required please request a hard-copy
version.
Saint Mary's College, Shillong, Meghalaya, India-793003,
smcs.ac.in
6 years, 8 months
IPA <-> Samba AD trust issue
by Yuri Moens
Hi
I'm currently trying to setup a trust between IPA and Samba AD but I keep
running into some issues.
IPA is running on CentOS 7
VERSION: 4.4.0, API_VERSION: 2.213
ipa01.cloud.ymo.lab, Netbios CLOUD, domain cloud.ymo.lab
Samba is running on CentOS7
Version 4.6.6
dc01.win.ymo.lab, Netbios WIN, domain win.ymo.lab
Both are fresh installs. Samba is running Bind DLZ as DNS backend. DNS
forwarding is working correctly.
[root@ipa01 ~]# dig +short srv _ldap._tcp.{cloud,win}.ymo.lab
0 100 389 ipa01.cloud.ymo.lab.
0 100 389 dc01.win.ymo.lab.
[root@ipa01 ~]# dig +short {cloud,win}.ymo.lab
10.0.0.195
10.0.0.196
[root@dc01 bin]# dig +short srv _ldap._tcp.{cloud,win}.ymo.lab
0 100 389 ipa01.cloud.ymo.lab.
0 100 389 dc01.win.ymo.lab.
[root@dc01 bin]# dig +short {cloud,win}.ymo.lab
10.0.0.195
10.0.0.196
I'm currently stuck on adding the trust:
[root@ipa01 ~]# ipa trust-add --type=ad win.ymo.lab --admin Administrator
--password --two-way=true
Active Directory domain administrator's password:
ipa: ERROR: CIFS server communication error: code "1315", message
"WERR_INVALID_ACCOUNT_NAME" (both may be "None")
I've attached the /var/log/httpd/error_log on the IPA side and the output
of Samba running with debug level 7.
Does anyone know how I can get past this?
Thanks
Yuri
6 years, 8 months
expired certificates - pki-tomcat not running
by Michael Gusek
Hello,
we run in a problem with expired certificates:
> getcert list (sample show only one expired certificate)
...
Request ID '20170202144747':
status: MONITORING
stuck: no
key pair storage:
type=NSSDB,location='/etc/httpd/alias',nickname='ipaCert',token='NSS
Certificate DB',pinfile='/etc/httpd/alias/pwdfile.txt'
certificate:
type=NSSDB,location='/etc/httpd/alias',nickname='ipaCert',token='NSS
Certificate DB'
CA: dogtag-ipa-ca-renew-agent
issuer: CN=Certificate Authority,O=NBG.WEBTREKK.COM
subject: CN=IPA RA,O=NBG.WEBTREKK.COM
expires: 2017-07-30 13:37:02 UTC
key usage:
digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
eku: id-kp-serverAuth,id-kp-clientAuth
pre-save command: /usr/libexec/ipa/certmonger/renew_ra_cert_pre
post-save command: /usr/libexec/ipa/certmonger/renew_ra_cert
track: yes
auto-renew: yes
...
Request ID '20170202144746':
status: MONITORING
stuck: no
key pair storage:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert
cert-pki-ca',token='NSS Certificate DB',pin set
certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert
cert-pki-ca',token='NSS Certificate DB'
CA: dogtag-ipa-ca-renew-agent
issuer: CN=Certificate Authority,O=NBG.WEBTREKK.COM
subject: CN=Certificate Authority,O=NBG.WEBTREKK.COM
expires: 2035-08-10 13:36:23 UTC
key usage: digitalSignature,nonRepudiation,keyCertSign,cRLSign
pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert
"caSigningCert cert-pki-ca"
track: yes
auto-renew: yes
...
We follow instruction to renew certificates found on this mailing list:
* set system time before expired
* set dogtag to use simple binds instead of TLS to connect to LDAP
* ipactl start --ignore-service-failures
* systemctl restart pki-tomcatd@pki-tomcat
* systemctl restart certmonger
* resubmit one of expired certificate: ipa-getcert resubmit -i
20170202144747
Jul 29 13:27:05 ipa-prod-01.<domain>
dogtag-ipa-ca-renew-agent-submit[10651]: Forwarding request to
dogtag-ipa-renew-agent
Jul 29 13:27:05 ipa-prod-01.<domain>
dogtag-ipa-renew-agent-submit[10661]: GET http://ipa-prod-01.<domain>:8080/
ca/ee/ca/profileSubmit?profileId=caServerCert&serial_num=7&renewal=true&xml=true
Jul 29 13:27:05 ipa-prod-01.<domain>
dogtag-ipa-renew-agent-submit[10661]: <html><head><title>Apache
Tomcat/7.0.69 -
or report</title><style><!--H1
{font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:22px;}
H2 {fo
nt-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:16px;}
H3 {font-family:Tahoma,Arial,sans-serif;
color:white;background-color:#525D76;font-size:14px;} BODY
{font-family:Tahoma,Arial,sans-serif;color:black;background-color:whi
te;} B
{font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;}
P {font-family:Tahoma,Arial,sans-serif;backgr│
ound:white;color:black;font-size:12px;}A {color : black;}A.name {color :
black;}HR {color : #525D76;}--></style> </head><body><h
1>HTTP Status 404 - /ca/ee/ca/profileSubmit</h1><HR size="1"
noshade="noshade"><p><b>type</b> Status report</p><p><b>message</b>
<u>/ca/ee/ca/profileSubmit</u></p><p><b>description</b> <u>The
requested resource is not available.</u></p><HR size="1" noshade
="noshade"><h3>Apache
Tomcat/7.0.69</h3></body></html>
Jul 29 13:27:05 ipa-prod-01.<domain>
dogtag-ipa-ca-renew-agent-submit[10651]: dogtag-ipa-renew-agent returned 2
In certmonger logs, we can see that the request is forwarded to
dogtag-ipa-renew-agent, but agent returned with return code 2, which
seemed to be "request rejected". So at this point I have no glue to
solve this problem. Any help is desired.
> ipa
--version
VERSION: 4.4.0, API_VERSION: 2.213
Many thanks
Michael
--
________________________________________________
*Michael**Gusek*| System Administrator| Webtrekk GmbH |
*t*+49 30 755 415 302| *f *+49 30 755 415 100 | *w *www.webtrekk.com
<https://www.webtrekk.com/?wt_mc=signature.-.-.-.homepageURL>
Amtsgericht/Local Court Berlin, HRB 93435 B | Geschäftsführer/CEO
Christian Sauer
6 years, 8 months