Do keytabs expire?
by Ronald Wimmer
Hi,
today I found out that some entries in a keytab file seemed to have expired:
Request ticket server HTTP/mwc.linux.mydomain.at(a)LINUX.MYDOMAIN.AT kvno
4 not found in keytab; keytab is likely out of date
Fetching the keytab again with ipa-getkeytab fixed the problem. But why
is this happening? Do keytab entries expire? I have not set any custom
password or ticket policies.
Regards,
Ronald
6 months
using freeipa with an AWS elastic load balancer
by ridha.zorgui@infor.com
I set up a FreeIPA master and replica behind an elastic load balancer in AWS cloud. FreeIPA Clients will be contacting the replica and the master sever through the load balancer so the dns name used when configurting the clients is the ELB CNAME. The problem is when retreiving ldap data and during the authentication, the SSL handshake fails as the certificate sent back from the master or replica has a hostname different than the one used in the sssd ( the ELB CNAME). so the connection is terminated. There is a workaround which is the use reqcert=allow but this bring a security issue with a MITM attack. another solution i found is the use SAN. I was able to add the ELB DNS as a SAN in freeipa servers certificate. i made sure it is there by downloading the certificate and checking that the elb san exist but when testing it the same problem remain. Please help.
5 years, 1 month
Renewal of External Third Party SSL Cert
by Alka Murali
Hello,
I am using the embedded CA For FreeIPA as well as external CA Signed by
Digicert. However, the certificate will be expiring next month.
After renewal, do I need to install the certificate again using the same
steps mentioned within the link
https://www.freeipa.org/page/Using_3rd_part_certificates_for_HTTP/LDAP
Similarly how will I be able to update the new certificate in my IPA
Clients too. Do I need to follow the steps below on all IPA Clients?
-----
certutil -A -d /etc/pki/nssdb -n 'IPA CA' -t CT,C,C -a -i ipa.crt
cp ipa.crt /etc/ipa/ca.crt
-------
Can you please brief up the exact procedure to follow for the third party
SSL cert renewal.
Thanks and Regards,
Alka Murali
6 years
Can't create new CA replica
by john.bowman@zayo.com
Since taking over our FreeIPA environment I've been unable to create a new CA replica. A bunch of failed attempts and upgrades over the last year and I keep running in to issues. After my latest attempt I noticed something that I had not seen before (likely a result of an recent upgrade) and I was wondering if this would cause a CA install to fail.
Our env:
3 x ipa-server-3.0.0-51.el6.x86_64
3 x ipa-server-4.4.0-14.el7_3.7.x86_64
2 of the 3.x IPA servers are currently acting as CAs and I've been trying to create a new 4.x CA replica in order to start removing the 3.x IPA servers. I've been able to do a simple test with vanilla CentOS 6.9 and 7.3 and it seems to work fine as far as I can tell but when I try it in our environment it fails. I noticed this error in one of the logs and something jumped out at me that I had never seen before:
[14/Jun/2017:06:49:44][http-bio-8443-exec-3]: === Finalization ===
[14/Jun/2017:06:49:44][http-bio-8443-exec-3]: Updating existing security domain
[14/Jun/2017:06:49:44][http-bio-8443-exec-3]: isSDHostDomainMaster(): Getting domain.xml from CA...
[14/Jun/2017:06:49:44][http-bio-8443-exec-3]: ConfigurationUtils: getting domain info
[14/Jun/2017:06:49:44][http-bio-8443-exec-3]: ConfigurationUtils: GET https://ipa-master.domain.tld:443/ca/admin/ca/getDomainXML
[14/Jun/2017:06:49:44][http-bio-8443-exec-3]: ConfigurationUtils: status: 0
[14/Jun/2017:06:49:44][http-bio-8443-exec-3]: ConfigurationUtils: domain info: <?xml version="1.0" encoding="UTF-8" standalone="no"?><DomainInfo><Name>IPA</Name><CAList><CA
><Host>ipa-master.domain.tld</Host><SecurePort>443</SecurePort><SecureAgentPort>443</SecureAgentPort><SecureAdminPort>443</SecureAdminPort><UnSecurePort>80</UnSecurePort><Sec
ureEEClientAuthPort>443</SecureEEClientAuthPort><DomainManager>TRUE</DomainManager><Clone>TRUE</Clone><SubsystemName>pki-cad</SubsystemName></CA><CA><Host>ipa-replica1.domain.tld
</Host><SecurePort>443</SecurePort><SecureAgentPort>443</SecureAgentPort><SecureAdminPort>443</SecureAdminPort><UnSecurePort>80</UnSecurePort><SecureEEClientAuthPort>443</S
ecureEEClientAuthPort><DomainManager>TRUE</DomainManager><Clone>TRUE</Clone><SubsystemName>pki-cad</SubsystemName></CA><CA><Host>ipa-replica2.domain.tld</Host><SecurePort>443</Se
curePort><SecureAgentPort>443</SecureAgentPort><SecureAdminPort>443</SecureAdminPort><UnSecurePort>80</UnSecurePort><SecureEEClientAuthPort>443</SecureEEClientAuthPort><Dom
ainManager>TRUE</DomainManager><Clone>TRUE</Clone><SubsystemName>pki-cad</SubsystemName></CA><SubsystemCount>3</SubsystemCount></CAList><OCSPList><SubsystemCount>0</Subsyst
emCount></OCSPList><KRAList><SubsystemCount>0</SubsystemCount></KRAList><RAList><SubsystemCount>0</SubsystemCount></RAList><TKSList><SubsystemCount>0</SubsystemCount></TKSL
ist><TPSList><SubsystemCount>0</SubsystemCount></TPSList></DomainInfo>
[14/Jun/2017:06:49:44][http-bio-8443-exec-3]: Cloning a domain master
[14/Jun/2017:06:49:44][http-bio-8443-exec-3]: Update security domain using admin interface
[14/Jun/2017:06:49:44][http-bio-8443-exec-3]: ConfigurationUtils: updateDomainXML start hostname=ipa-master.domain.tld port=443
[14/Jun/2017:06:49:44][http-bio-8443-exec-3]: ConfigurationUtils: POST https://ipa-master.domain.tld:443/ca/admin/ca/updateDomainXML
[14/Jun/2017:06:49:44][http-bio-8443-exec-3]: Unable to access admin interface: javax.ws.rs.NotFoundException: HTTP 404 Not Found
[14/Jun/2017:06:49:44][http-bio-8443-exec-3]: Update security domain using agent interface
[14/Jun/2017:06:49:44][http-bio-8443-exec-3]: ConfigurationUtils: updateDomainXML start hostname=ipa-master.domain.tld port=443
[14/Jun/2017:06:49:44][http-bio-8443-exec-3]: updateDomainXML() nickname=subsystemCert cert-pki-ca
[14/Jun/2017:06:49:44][http-bio-8443-exec-3]: ConfigurationUtils: POST https://ipa-master.domain.tld:443/ca/agent/ca/updateDomainXML
[14/Jun/2017:06:49:45][http-bio-8443-exec-3]: Server certificate:
[14/Jun/2017:06:49:45][http-bio-8443-exec-3]: - subject: CN=ipa-master.domain.tld,O=DOMAIN.US
[14/Jun/2017:06:49:45][http-bio-8443-exec-3]: - issuer: CN=Certificate Authority,O=DOMAIN.US
[14/Jun/2017:06:49:45][http-bio-8443-exec-3]: ConfigurationUtils: updateDomainXML: status=1
[14/Jun/2017:06:49:45][http-bio-8443-exec-3]: Unable to update security domain: 2
java.io.IOException: Unable to update security domain: 2
The ipa-master.domain.tld is one of the current RHEL 6.9 FreeIPA 3.x servers but the other two listed in that domainxml file one does not exist (it may have at some point been renamed) and the other server is not a CA replica but it is a replica.
Is it possible this bad info would cause a failure when trying to create a new CA replica? If so is it something I can try cleaning up?
Any info would be appreciated. Thanks!
6 years
sudo not working with hostgroups
by Michael Gusek
Hello,
we are using FreeIPA in the current version 4.5 under current CentOS 7.
In order to grant access we are using sudo rules in conjunction with
host groups. We have found that these rules do not work under Debian 8/9
and Ubuntu 16.04, but with Centos 6/7. Suggestions from the web require
a set nisdomainname (nisdomainname example.com), which does not work. In
fact, the nisdomainname is not set under CentOS 6, but under Centos 7 it
is. What settings under Debian/Ubuntu must be made for sudo rules to
work with hostgroups?
Debian 8 Debian 9 Ubuntu 16.04 Centos 6 Centos 7
sssd-Version 1.15.0-3 1.15.0-3 1.15.0-3ubuntu2~ubuntu16.04.1~ppa1
sssd-1.15.3-1.el6.x86_64 sssd-1.15.2-50.el7_4.2.x86_64
sudo-Version 1.8.10p3-1+deb8u4 1.8.19p1-2.1 1.8.16-0ubuntu1.5
sudo-1.8.6p3-29.el6_9.x86_64 sudo-1.8.19p2-11.el7_4.x86_64
Regards,
Michael
--
________________________________________________
*Michael**Gusek*| System Administrator| Webtrekk GmbH |
*t*+49 30 755 415 302| *f *+49 30 755 415 100 | *w *www.webtrekk.com
<https://www.webtrekk.com/?wt_mc=signature.-.-.-.homepageURL>
Amtsgericht/Local Court Berlin, HRB 93435 B | Geschäftsführer/CEO
Christian Sauer und Wolf Lichtenstein
6 years
Find IPA user or computer account from windows
by Ronald Wimmer
Is it possible to find an IPA user or computer account from a windows
(AD) machine [trust between ipa and ad domain is set up]? If I try that,
all i get is a message that no object can be found.
Regards,
Ronald
6 years, 1 month
ERROR: CIFS server communication error: Memory allocation error (both may be "None") upon establishing trust
by Bart J
Hi all,
I have been trying to set up one-way trust for quite a while. I thought I have everything sorted out but when I tried to move from test environment to production, I received error below upon trying to set up trust with ipa trust add:
ipa trust-add --type=ad my.domain.com --admin adminaccount --password
ipa: ERROR: CIFS server communication error: code "-1073741801", message "Memory allocation error" (both may be "None")
Googling returned some results that suggested upgrading samba and freeipa versions. I did so and now I am using:
freeipa - 4.5.3-1.fc26
samba - 2:4.6.7-0.fc26
This however didn't change the result.
What can be important here is that my.domain.com is a child domain of domain.com in terms of AD (it is a separate domain controller).
Can you please advise how to fix it?
6 years, 1 month
Installation problems fro version 4.5.0 on centos 7
by Mathew Vandystadt
Hello,
I'm having problems with the installation of freeipa on a fresh centos 7 box. The installation always fails on [6/45]: starting directory server. I do see that the daemon is up and that its listening on localhost. My audit logs are ok and I get the same result with selinux in permissive mode. There seems to be a problem with the ldap daemon after the initial configuration.
Thanks
Installation logs:
017-09-25T21:38:16Z DEBUG [6/45]: starting directory server
2017-09-25T21:38:16Z DEBUG Starting external process
2017-09-25T21:38:16Z DEBUG args=/bin/systemctl start dirsrv(a)MYDOMAIN.service
2017-09-25T21:38:17Z DEBUG Process finished, return code=0
2017-09-25T21:38:17Z DEBUG stdout=
2017-09-25T21:38:17Z DEBUG stderr=
2017-09-25T21:38:17Z DEBUG Starting external process
2017-09-25T21:38:17Z DEBUG args=/bin/systemctl is-active dirsrv(a)MYDOMAIN.service
2017-09-25T21:38:17Z DEBUG Process finished, return code=0
2017-09-25T21:38:17Z DEBUG stdout=active
2017-09-25T21:38:17Z DEBUG stderr=
2017-09-25T21:38:17Z DEBUG wait_for_open_ports: localhost [389] timeout 300
2017-09-25T21:43:17Z DEBUG Traceback (most recent call last):
dirsrv access logs:
[25/Sep/2017:17:43:07.606371827 -0400] conn=291 fd=64 slot=64 connection from 127.0.0.1 to 127.0.0.1
[25/Sep/2017:17:43:07.606484146 -0400] conn=291 op=-1 fd=64 closed - B1
[25/Sep/2017:17:43:08.608386567 -0400] conn=292 fd=64 slot=64 connection from 127.0.0.1 to 127.0.0.1
[25/Sep/2017:17:43:08.608537683 -0400] conn=292 op=-1 fd=64 closed - B1
[25/Sep/2017:17:43:09.610325914 -0400] conn=293 fd=64 slot=64 connection from 127.0.0.1 to 127.0.0.1
[25/Sep/2017:17:43:09.610426954 -0400] conn=293 op=-1 fd=64 closed - B1
[25/Sep/2017:17:43:10.612250521 -0400] conn=294 fd=64 slot=64 connection from 127.0.0.1 to 127.0.0.1
[25/Sep/2017:17:43:10.612362078 -0400] conn=294 op=-1 fd=64 closed - B1
[25/Sep/2017:17:43:11.614026066 -0400] conn=295 fd=64 slot=64 connection from 127.0.0.1 to 127.0.0.1
[25/Sep/2017:17:43:11.614107541 -0400] conn=295 op=-1 fd=64 closed - B1
[25/Sep/2017:17:43:12.616101124 -0400] conn=296 fd=64 slot=64 connection from 127.0.0.1 to 127.0.0.1
[25/Sep/2017:17:43:12.616200037 -0400] conn=296 op=-1 fd=64 closed - B1
[25/Sep/2017:17:43:13.617882733 -0400] conn=297 fd=64 slot=64 connection from 127.0.0.1 to 127.0.0.1
[25/Sep/2017:17:43:13.617985060 -0400] conn=297 op=-1 fd=64 closed - B1
[25/Sep/2017:17:43:14.619732290 -0400] conn=298 fd=64 slot=64 connection from 127.0.0.1 to 127.0.0.1
[25/Sep/2017:17:43:14.619876088 -0400] conn=298 op=-1 fd=64 closed - B1
[25/Sep/2017:17:43:15.621493992 -0400] conn=299 fd=64 slot=64 connection from 127.0.0.1 to 127.0.0.1
[25/Sep/2017:17:43:15.621573126 -0400] conn=299 op=-1 fd=64 closed - B1
[25/Sep/2017:17:43:16.623358799 -0400] conn=300 fd=64 slot=64 connection from 127.0.0.1 to 127.0.0.1
[25/Sep/2017:17:43:16.623456716 -0400] conn=300 op=-1 fd=64 closed - B1
[25/Sep/2017:17:43:17.625111898 -0400] conn=301 fd=64 slot=64 connection from 127.0.0.1 to 127.0.0.1
[25/Sep/2017:17:43:17.625196358 -0400] conn=301 op=-1 fd=64 closed - B1
dirsrv error logs:
[25/Sep/2017:17:38:15.521393910 -0400] - INFO - slapd_daemon - slapd started. Listening on All Interfaces port 389 for LDAP requests
[25/Sep/2017:17:38:15.589204700 -0400] - INFO - postop_modify_config_dse - The change of nsslapd-ldapilisten will not take effect until the server is restarted
[25/Sep/2017:17:38:15.679382495 -0400] - INFO - op_thread_cleanup - slapd shutting down - signaling operation threads - op stack size 1 max work q size 1 max work q stack size 1
[25/Sep/2017:17:38:15.681271086 -0400] - INFO - slapd_daemon - slapd shutting down - waiting for 14 threads to terminate
[25/Sep/2017:17:38:15.682461202 -0400] - INFO - slapd_daemon - slapd shutting down - closing down internal subsystems and plugins
[25/Sep/2017:17:38:15.688537034 -0400] - INFO - dblayer_pre_close - Waiting for 4 database threads to stop
[25/Sep/2017:17:38:16.398165344 -0400] - INFO - dblayer_pre_close - All database threads now stopped
[25/Sep/2017:17:38:16.405905222 -0400] - INFO - ldbm_back_instance_set_destructor - Set of instances destroyed
[25/Sep/2017:17:38:16.408961140 -0400] - INFO - connection_post_shutdown_cleanup - slapd shutting down - freed 1 work q stack objects - freed 1 op stack objects
[25/Sep/2017:17:38:16.521431280 -0400] - INFO - main - slapd stopped.
[25/Sep/2017:17:38:16.783464475 -0400] - INFO - main - 389-Directory/1.3.6.1 B2017.249.1616 starting up
[25/Sep/2017:17:38:16.795854380 -0400] - INFO - ldbm_instance_config_cachememsize_set - force a minimal value 512000
[25/Sep/2017:17:38:16.805586585 -0400] - NOTICE - ldbm_back_start - found 3882072k physical memory
[25/Sep/2017:17:38:16.807181104 -0400] - NOTICE - ldbm_back_start - found 866472k available
[25/Sep/2017:17:38:16.808666579 -0400] - NOTICE - ldbm_back_start - cache autosizing: db cache: 155282k
[25/Sep/2017:17:38:16.809929384 -0400] - NOTICE - ldbm_back_start - cache autosizing: userRoot entry cache (1 total): 262144k
[25/Sep/2017:17:38:16.814989583 -0400] - NOTICE - ldbm_back_start - total cache size: 412420406 B;
[25/Sep/2017:17:38:16.817344364 -0400] - NOTICE - dblayer_start - Resizing max db lock count: 10000 -> 50000
[25/Sep/2017:17:38:17.011113138 -0400] - INFO - slapd_daemon - slapd started. Listening on All Interfaces port 389 for LDAP requests
[25/Sep/2017:17:38:17.022249715 -0400] - INFO - slapd_daemon - Listening on /var/run/MYDOMAIN.socket for LDAPI requests
6 years, 1 month
IPA Server Upgrade Error
by Alka Murali
Hello,
Currently my server is running on IPA Server Version 4.4. I have tried to
upgrade the Version to 4.5 using the ipa-server-upgrade command and got
ended with the following error:
--------
2017-09-26T02:27:32Z DEBUG stderr=
2017-09-26T02:27:50Z DEBUG Loading Index file from
'/var/lib/ipa/sysrestore/sysrestore.index'
2017-09-26T02:27:53Z DEBUG Starting external process
2017-09-26T02:27:53Z DEBUG args=/usr/bin/certutil -d
/etc/dirsrv/slapd-LGA-NET-SG -L -n Server-Cert -a -f
/etc/dirsrv/slapd-LGA-NET-SG/pwdfile.txt
2017-09-26T02:27:56Z DEBUG Process finished, return code=255
2017-09-26T02:27:56Z DEBUG stdout=
2017-09-26T02:27:56Z DEBUG stderr=certutil: Could not find cert: Server-Cert
: PR_FILE_NOT_FOUND_ERROR: File not found
2017-09-26T02:27:56Z ERROR IPA server upgrade failed: Inspect
/var/log/ipaupgrade.log and run command ipa-server-upgrade manually.
2017-09-26T02:27:56Z DEBUG File
"/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 172, in
execute
return_value = self.run()
File
"/usr/lib/python2.7/site-packages/ipaserver/install/ipa_server_upgrade.py",
line 46, in run
server.upgrade()
File
"/usr/lib/python2.7/site-packages/ipaserver/install/server/upgrade.py",
line 1913, in upgrade
upgrade_configuration()
File
"/usr/lib/python2.7/site-packages/ipaserver/install/server/upgrade.py",
line 1788, in upgrade_configuration
certificate_renewal_update(ca, ds, http),
File
"/usr/lib/python2.7/site-packages/ipaserver/install/server/upgrade.py",
line 1018, in certificate_renewal_update
ds.start_tracking_certificates(serverid)
File "/usr/lib/python2.7/site-packages/ipaserver/install/dsinstance.py",
line 1046, in start_tracking_certificates
'restart_dirsrv %s' % serverid)
File "/usr/lib/python2.7/site-packages/ipaserver/install/certs.py", line
362, in track_server_cert
cert_obj = x509.load_certificate(cert)
File "/usr/lib/python2.7/site-packages/ipalib/x509.py", line 119, in
load_certificate
return cryptography.x509.load_der_x509_certificate(data,
default_backend())
File "/usr/lib64/python2.7/site-packages/cryptography/x509/base.py", line
47, in load_der_x509_certificate
return backend.load_der_x509_certificate(data)
File
"/usr/lib64/python2.7/site-packages/cryptography/hazmat/backends/multibackend.py",
line 350, in load_der_x509_certificate
return b.load_der_x509_certificate(data)
File
"/usr/lib64/python2.7/site-packages/cryptography/hazmat/backends/openssl/backend.py",
line 1185, in load_der_x509_certificate
raise ValueError("Unable to load certificate")
2017-09-26T02:27:56Z DEBUG The ipa-server-upgrade command failed,
exception: ValueError: Unable to load certificate
2017-09-26T02:27:56Z ERROR Unexpected error - see /var/log/ipaupgrade.log
for details:
ValueError: Unable to load certificate
2017-09-26T02:27:56Z ERROR The ipa-server-upgrade command failed. See
/var/log/ipaupgrade.log for more information
-------
I am using a third party signed certificate along with my IPA-CA. Is it an
issue with my current CA. I can see that while fetching for the
certificate, the name given to be "Server-cert" instead of the exact CA
name.
--
Regards,
Alka Murali
6 years, 2 months