September 2017 - FreeIPA-users - Fedora mailing-lists

Is it safe to upgrade to 7.4 ?
by Petros Triantafyllidis 22 Sep '17

22 Sep '17

Hi all, Having seen several messages in the list regarding problems that followed OS upgrades from 7.3 to 7.4 (i.e. rpm IPA 4.4 to 4.5), I would like to ask whether such an action is considered safe. Are there any specific steps to be taken in master-replica-client infrastucture in order to avoid possible pitfalls? Moreover, is there anything to be done as a precaution which would allow an immediate rollback? Thanks in advance, Petros

4 3

Announcing FreeIPA 4.6.1
by Tomas Krizek 22 Sep '17

22 Sep '17

The FreeIPA team would like to announce FreeIPA 4.6.1 release! It can be downloaded from http://www.freeipa.org/page/Downloads. Builds for Fedora 26 and 27 are available in the official @freeipa/freeipa-4-6 COPR repository [1]. == Highlights in 4.6.1 == === Known Issues === * PyPI packages are broken since 4.6.0 #7132 === Bug fixes === FreeIPA 4.6.1 is a stabilization release for the features delivered as a part of 4.6.0. There are more than 10 bug-fixes details of which can be seen in the list of resolved tickets below. == Upgrading == Upgrade instructions are available on Upgrade page. == Feedback == Please provide comments, bugs and other feedback via the freeipa-users mailing list (https://lists.fedoraproject.org/archives/list/freeipa-users@lists.fedorahos…) or #freeipa channel on Freenode. == Resolved tickets == * 7157 [tracker] pyasn1 fails to parse kerberos principal name * 7150 Ipa-server-install update dse.ldif with wrong SELinux context * 7143 "unknown command 'undefined'" error when changing user's password via the web UI * 7135 Server deployment still sets up Firefox extension, this is no longer necessary and broken on F27+ * 7129 ipa-server/replica-install fails with: "exception: BytesWarning: Comparison between bytes and string" when using '--dirsrv-config-file' parameter * 7119 kdc_proxy: kinit admin fails with "Cannot contact any KDC for realm 'IPA.TEST' while getting initial credentials" * 7115 ipa-pki-retrieve-key: failure results in crash report * 7081 [ipatests] - installutils.is_ipa_configured() - users other then root cannot check if IPA is configured * 7027 Use TLS for cert-find * 6874 pylint 1.7.1 fails * 6848 Test IPA with OpenSSL-base libcurl for Fedora 27 * 6566 [py3] session cookie not found with py3 * 5121 [py3] Remove unnecessary calls to dict.keys() == Detailed changelog since 4.6.0 == === Alexander Bokovoy (3) === * Make sure upgrade also checks for IPv6 stack * OTP import: support hash names with HMAC- prefix * dsinstance: Restore context after changing dse.ldif === Felipe Volpone (2) === * Changing idoverrideuser-* to treat objectClass case insensitively * Fixing how sssd.conf is updated when promoting a client to replica === Florence Blanc-Renaud (3) === * Fix ipa-server-upgrade with server cert tracking * Python3: Fix winsync replication agreement * Fix ipa config-mod --ca-renewal-master === Fraser Tweedale (2) === * ipa-pki-retrieve-key: ensure we do not crash * issue_server_cert: avoid application of str to bytes === Martin Basti (1) === * py3: set samba dependencies === Petr Vobornik (1) === * browser config: cleanup after removal of Firefox extension === Pavel Vomacka (3) === * WebUI: Fix calling undefined method during reset passwords * WebUI: remove unused parameter from get_whoami_command * Adds whoami DS plugin in case that plugin is missing === Rob Crittenden (2) === * Add exec to /var/lib/ipa/sysrestore for install status inquiries * Use TLS for the cert-find operation === Stanislav Laznicka (28) === * Don't write p11-kit EKU extension object if no EKU * pylint: fix missing module * travis: run the same tests in python2/3 * certmap testing: fix wrong cert construction * ldap2: don't use decode() on str instance * client: fix retrieving certs from HTTP * uninstall: remove deprecation warning * ldif: handle attribute names as strings * pkinit: fix sorting dictionaries * pkinit: don't fail when no pkinit servers found * travis: remove "fast" from "makecache fast" * Change Travis CI container to FreeIPA-owned * Change the requirements for pylint in wheel * rpcserver: don't call xmlserver.Command * secrets: disable relative-imports for custodia * pylint: disable __hash__ for some classes * install.util: disable no-value-for-parameter * pylint: make unsupported-assignment-operation check local * sudocmd: fix unsupported assignment * pylint: Iterate through dictionaries * parameters: convert Decimal.precision to int * dcerpc: disable unbalanced-tuple-unpacking * dcerpc: refactor assess_dcerpc_exception * pylint: fix no-member in schema plugin * csrgen: fix incorrect codec for pyasn BitString * pylint: fix not-context-manager false positives * Travis: archive logs of py3 jobs * travis: temporary workaround for Travis CI === Tomas Krizek (6) === * Become IPA 4.6.1 * Update contributors * Update translations * spec: bump python-pyasn1 to 0.3.2-2 * prci: use f26 template for master * VERSION: set back to git snapshot [1] - https://copr.fedorainfracloud.org/coprs/g/freeipa/freeipa-4-6/ -- Tomas Krizek PGP: 4A8B A48C 2AED 933B D495 C509 A1FB A5F7 EF8C 4869

1 0

ipa-server-install failing at wait_for_open_ports
by Eric Scholwin 22 Sep '17

22 Sep '17

Foolishly, I blew up my entire 4.4 on Centos 7.4 environment and I'm trying to get 4.5 working on 7.4. I've been hitting the same exact problem while trying to install freeipa 4.5 on centos 7.4 from scratch and that's at step 6/45 "starting directory server". The following message is what I get hung up on during the installation and I'm at a complete loss as to what's going on. DEBUG wait_for_open_ports: localhost [389] timeout 300 I, like many others, had ipv6 disabled, but I've re-enabled it, and I'm still running into issues. This is what my ipaserver-install.log looks like, it fails at this samespot every single time: 2017-09-20T15:14:48Z DEBUG wait_for_open_ports: localhost [389] timeout 300 2017-09-20T15:19:49Z DEBUG Traceback (most recent call last): File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 504, in start_creation run_step(full_msg, method) File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 494, in run_step method() File "/usr/lib/python2.7/site-packages/ipaserver/install/dsinstance.py", line 651, in __start_instance self.start(self.serverid) File "/usr/lib/python2.7/site-packages/ipaserver/install/dsinstance.py", line 627, in start super(DsInstance, self).start(*args, **kwargs) File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 401, in start self.service.start(instance_name, capture_output=capture_output, wait=wait) File "/usr/lib/python2.7/site-packages/ipaplatform/redhat/services.py", line 157, in start instance_name, capture_output=capture_output, wait=wait) File "/usr/lib/python2.7/site-packages/ipaplatform/base/services.py", line 300, in start self.wait_for_open_ports(self.service_instance(instance_name)) File "/usr/lib/python2.7/site-packages/ipaplatform/base/services.py", line 270, in wait_for_open_ports self.api.env.startup_timeout) File "/usr/lib/python2.7/site-packages/ipapython/ipautil.py", line 1227, in wait_for_open_ports raise socket.timeout("Timeout exceeded") timeout: Timeout exceeded 2017-09-20T15:19:49Z DEBUG [error] timeout: Timeout exceeded 2017-09-20T15:19:49Z DEBUG File "/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 172, in execute return_value = self.run() File "/usr/lib/python2.7/site-packages/ipapython/install/cli.py", line 333, in run cfgr.run() File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 368, in run self.execute() File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 392, in execute for _nothing in self._executor(): File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 434, in __runner exc_handler(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 463, in _handle_execute_exception self._handle_exception(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 453, in _handle_exception six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 424, in __runner step() File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 421, in <lambda> step = lambda: next(self.__gen) File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from value = gen.send(prev_value) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 658, in _configure next(executor) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 434, in __runner exc_handler(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 463, in _handle_execute_exception self._handle_exception(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 521, in _handle_exception self.__parent._handle_exception(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 453, in _handle_exception six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 518, in _handle_exception super(ComponentBase, self)._handle_exception(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 453, in _handle_exception six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 424, in __runner step() File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 421, in <lambda> step = lambda: next(self.__gen) File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from value = gen.send(prev_value) File "/usr/lib/python2.7/site-packages/ipapython/install/common.py", line 63, in _install for _nothing in self._installer(self.parent): File "/usr/lib/python2.7/site-packages/ipaserver/install/server/__init__.py", line 578, in main master_install(self) File "/usr/lib/python2.7/site-packages/ipaserver/install/server/install.py", line 248, in decorated func(installer) File "/usr/lib/python2.7/site-packages/ipaserver/install/server/install.py", line 758, in install setup_pkinit=not options.no_pkinit) File "/usr/lib/python2.7/site-packages/ipaserver/install/dsinstance.py", line 344, in create_instance self.start_creation(runtime=30) File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 504, in start_creation run_step(full_msg, method) File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 494, in run_step method() File "/usr/lib/python2.7/site-packages/ipaserver/install/dsinstance.py", line 651, in __start_instance self.start(self.serverid) File "/usr/lib/python2.7/site-packages/ipaserver/install/dsinstance.py", line 627, in start super(DsInstance, self).start(*args, **kwargs) File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 401, in start self.service.start(instance_name, capture_output=capture_output, wait=wait) File "/usr/lib/python2.7/site-packages/ipaplatform/redhat/services.py", line 157, in start instance_name, capture_output=capture_output, wait=wait) File "/usr/lib/python2.7/site-packages/ipaplatform/base/services.py", line 300, in start self.wait_for_open_ports(self.service_instance(instance_name)) File "/usr/lib/python2.7/site-packages/ipaplatform/base/services.py", line 270, in wait_for_open_ports self.api.env.startup_timeout) File "/usr/lib/python2.7/site-packages/ipapython/ipautil.py", line 1227, in wait_for_open_ports raise socket.timeout("Timeout exceeded") 2017-09-20T15:19:49Z DEBUG The ipa-server-install command failed, exception: timeout: Timeout exceeded 2017-09-20T15:19:49Z ERROR Timeout exceeded 2017-09-20T15:19:49Z ERROR The ipa-server-install command failed. See /var/log/ipaserver-install.log for more information

3 3

Disabling 2FA on a single host
by Maciej Drobniuch 22 Sep '17

22 Sep '17

Hey Ipa list! Is there a way to disable 2FA for a particular host? I'm using PAM auth there for a webservice that does not have kerberos and it's annoying users to enter the 2FA every-time(so I want to make an exception) Thanks -- Best regards Maciej Drobniuch Network Security Engineer Collective-Sense,LLC

1 0

Sudo Rules out of sync?!
by email＠ml.jacobdevans.com 22 Sep '17

22 Sep '17

ipa users, I am running the https://github.com/peterpakos/ipa_check_consistency and seeing my rule counts are out of sync, is there a process to force these to replicate? It seems only sudo rules are out of sync at this time, new hosts replicating properly. ipa-server-install --version 4.4.0 cat /etc/redhat-release CentOS Linux release 7.3.1611 (Core) Thanks, - Jake

3 2

server setup in existing DNS zone
by Gordon Messmer 22 Sep '17

22 Sep '17

I'd like to set up a new FreeIPA instance with DNS, and I'd like to use a zone that already exists. My intention is to configure the ipa server, then delete the existing DNS zone and point NS records for that zone toward the ipa server. ipa-server-install fails when the domain given by --domain already exists. Can I instruct the setup process to skip that check? If not, then presumably the hostname of the ipa server must not be a member of the zone given by --domain? I'd prefer for its hostname to be a member of that zone, but the hostname must resolve during setup. That's not possible if the hostname is a child of the domain given by --domain, and that domain can't already exist.

1 1

Solaris client proxyDN logins not working
by Louis Abel 21 Sep '17

21 Sep '17

Configuring a Solaris 11.3 system as a FreeIPA client. I've read various articles, mail list archives, and pages found on google trying to figure out how to properly make this work. So far, I've only gotten the ability to do su - user(a)domain.tld and check getent passwd/group. This successfully works. The things that do not work are ssh and console logins. This is what I've tried so far: Setting authenticationMethod to 'simple:tls' -> My service account never seems to work and the log says: "libsldap: Status: 53 Mesg: openConnection: simple bind failed - DSA is unwilling to perform" -> "libsldap: Status: 49 Mesg: openConnection: simple bind failed - Invalid credentials" - This isn't the case as I've tried the credentials multiple times using ldapsearch commands with success. My credentials for my users are correct since I can login to a CentOS 6 and CentOS 7 client perfectly fine. These are the steps I took: -> Create host in IPA -> ipa-getkeytab and transferred it to the client -> Created nss database with CA certificate and placed it in /var/ldap with proper permissions -> Configured /etc/krb5/krb5.conf -> Configured nsswitch.conf to be files ldap -> Configured /etc/pam.d/* files accordingly -> Used ldapclient init on the client Here is my kinit and ldap tests. # kinit admin Password for admin(a)IPA.EXAMPLE.COM: kinit: no ktkt_warnd warning possible # klist Ticket cache: FILE:/tmp/krb5cc_0 Default principal: admin(a)IPA.EXAMPLE.COM Valid starting Expires Service principal 09/13/17 16:22:29 09/14/17 16:22:29 krbtgt/IPA.EXAMPLE.COM(a)IPA.EXAMPLE.COM renew until 09/20/17 16:22:29 # ldaplist -l passwd louis.abel dn: uid=louis.abel,cn=users,cn=compat,dc=ipa,dc=example,dc=com cn: Louis Abel objectClass: posixAccount objectClass: top gidNumber: 1006800013 gecos: Louis Abel uidNumber: 25439 loginShell: /bin/bash homeDirectory: /home/louis.abel uid: louis.abel(a)ad.example.com uid: louis.abel # ldaplist -l passwd louis.abel2 dn: uid=louis.abel2,cn=users,cn=compat,dc=ipa,dc=example,dc=com cn: Louis Abel objectClass: posixAccount objectClass: top gidNumber: 1006800001 gecos: Louis Abel uidNumber: 1006800001 loginShell: /bin/bash homeDirectory: /home/louis.abel2 uid: louis.abel2(a)ipa.example.com uid: louis.abel2 dn: uid=louis.abel2,cn=users,cn=compat,dc=ipa,dc=example,dc=com cn: Louis Abel objectClass: posixAccount objectClass: ipaOverrideTarget objectClass: top gidNumber: 1006800001 gecos: Louis Abel uidNumber: 1006800001 ipaAnchorUUID: :IPA:ipa.example.com:8babb9a8-5aaf-11e7-9769-00505690319e loginShell: /bin/bash homeDirectory: /home/louis.abel2 uid: louis.abel2 My pam configuration files: /etc/pam.d/other auth definitive pam_user_policy.so.1 auth sufficient pam_krb5.so.1 auth requisite pam_authtok_get.so.1 auth required pam_dhkeys.so.1 auth binding pam_unix_auth.so.1 server_policy auth required pam_unix_cred.so.1 auth sufficient pam_krb5.so.1 account requisite pam_roles.so.1 account definitive pam_user_policy.so.1 account binding pam_unix_account.so.1 server_policy account required pam_unix_account.so.1 account required pam_krb5.so.1 account required pam_tsol_account.so.1 session definitive pam_user_policy.so.1 session required pam_unix_session.so.1 password definitive pam_user_policy.so.1 password include pam_authtok_common password sufficient pam_krb5.so.1 password required pam_authtok_store.so.1 server_policy /etc/pam.d/login auth requisite pam_authtok_get.so.1 auth required pam_dhkeys.so.1 auth required pam_unix_cred.so.1 auth sufficient pam_krb5.so.1 try_first_pass auth required pam_unix_auth.so.1 use_first_pass auth required pam_dial_auth.so.1 # ldapclient list NS_LDAP_FILE_VERSION= 2.0 NS_LDAP_BINDDN= uid=solaris,cn=sysaccounts,cn=etc,dc=ipa,dc=example,dc=com NS_LDAP_BINDPASSWD= removed NS_LDAP_SERVERS= pentl01.ipa.example.com, pentl02.ipa.example.com, pentl03.ipa.example.com, sentl01.ipa.example.com, sentl02.ipa.example.com, sentl03.ipa.example.com NS_LDAP_SEARCH_BASEDN= dc=ipa,dc=example,dc=com NS_LDAP_AUTH= tls:simple NS_LDAP_SEARCH_REF= TRUE NS_LDAP_SEARCH_TIME= 15 NS_LDAP_CACHETTL= 6000 NS_LDAP_PROFILE= default solaris_authssl NS_LDAP_SERVICE_SEARCH_DESC= group:cn=groups,cn=compat,dc=ipa,dc=example,dc=com NS_LDAP_SERVICE_SEARCH_DESC= passwd:cn=users,cn=compat,dc=ipa,dc=example,dc=com NS_LDAP_SERVICE_SEARCH_DESC= netgroup:cn=ng,cn=compat,dc=ipa,dc=example,dc=com NS_LDAP_SERVICE_SEARCH_DESC= ethers:cn=computers,cn=accounts,dc=ipa,dc=example,dc=com NS_LDAP_SERVICE_SEARCH_DESC= sudoers:ou=sudoers,dc=ipa,dc=example,dc=com NS_LDAP_BIND_TIME= 5 NS_LDAP_OBJECTCLASSMAP= shadow:shadowAccount=posixAccount NS_LDAP_OBJECTCLASSMAP= passwd:posixAccount=posixaccount NS_LDAP_OBJECTCLASSMAP= group:posixGroup=posixgroup nsswitch changes: passwd: files ldap [NOTFOUND=return] group: files ldap [NOTFOUND=return] This is what I looked at: https://www.redhat.com/archives/freeipa-users/2013-January/msg00021.html https://www.redhat.com/archives/freeipa-users/2015-January/msg00017.html http://etcfstab.com/oraclelinux/solaris_n_freeipa.html https://mkosek.fedorapeople.org/publican_site/en-US/FreeIPA/3.3/html/FreeIP… Anyone have better experience or any documentation that could help?

4 12

kdc.crt absent after upgrade from 4.4 to 4.5 (Scientific linux 7)
by Niels Walet 21 Sep '17

21 Sep '17

My kdc.crt has disappeared after a large number of problems with amn upgrade from 7.3 to 7.4 on my SL7 box (roughly equivalent to Centos). It is a vanilla installation with self-signed cerificates. I am aware of the permission errors in 4.5.0, but what I really need to know is what command to execute to regenerate this file--I can fix the permissions issue afterwards. I really would like to be able to login to the web interface agiain. Niels

2 1

Unable to add AD group to new install
by Bobby Jones 20 Sep '17

20 Sep '17

Hi: I am trying to finish my integration of FreeIPA with Active Directory, but when I try to add my group information it fails. # ipa group-add-member ad_admins_external --external 'AD/Domain Admins' member group: AD\Domain Admins: trusted domain object not found As far as I can tell, I have established a trust relationship between my IPA realm (ipa.mydomain.com) and my AD domain (ad.mydomain.com) If I run netdom query /d:AD.MYDOMAIN.COM TRUST I get: <- ipa.mydomain.com Direct I am assuming that the direction (<-) indicates that ipa trusts AD. From the other side, everything looks ok to me: # ipa trustdomain-find AD.MYDOMAIN.COM Domain name: AD.MYDOMAIN.COM Domain NetBIOS name: AD Domain Security Identifier: S-1-5-21-3800000002-3276000039-3459556696 Domain enabled: True ---------------------------- Number of entries returned 1 ---------------------------- In troubleshooting this, I ran: # KRB5_TRACE=/dev/stderr kvno -S cifs ad.mydomain.com The last two lines were: [16487] 1505918874.707116: TGS request result: -1765328377/Server cifs/ ad.mydomain.com(a)IPA.MYDOMAIN.COM not found in Kerberos database kvno: Server cifs/ad.mydomain.com(a)IPA.MYDOMAIN.COM not found in Kerberos database while getting credentials for cifs/ad.mydomain.com(a)IPA.MYDOMAIN.COM This led me to try the following (based on a tutorial I found), but with no success: # ipa service-add cifs/ad.mydomain.com(a)IPA.MYDOMAIN.COM --force ipa: ERROR: The host 'ad.mydomain.com' does not exist to add a service to. I am running CentOS 7 with ipa 4.5; all AD servers are running server 2016. If anyone has any pointers which could help with this, I'd appreciate it. Thanks! Bob

2 1

Can't log on using password when /tmp is full
by Marius Bjørnstad 20 Sep '17

20 Sep '17

Hi, When /tmp is full, it is impossible to authenticate with Kerberos. Login with password over SSH and sudo don't work. Login with ssh key works fine. Here is the output in the system log when I try to log on via SSH with password auth (this is on RHEL 6): Sep 18 16:56:59 vali sshd[35157]: Set /proc/self/oom_score_adj to 0 Sep 18 16:56:59 vali sshd[35157]: Connection from 192.168.1.48 port 49917 Sep 18 16:57:02 vali [sssd[krb5_child[35165]]]: Credentials cache I/O operation failed XXX Sep 18 16:57:02 vali [sssd[krb5_child[35165]]]: Credentials cache I/O operation failed XXX Sep 18 16:57:04 vali sshd[35157]: Failed password for paalmbj from 192.168.1.48 port 49917 ssh2 Sep 18 16:57:07 vali sshd[35158]: Connection closed by 192.168.1.48 From SSH I get: Permission denied, please try again. The problem seems to be that Kerberos can't store its credentials cache. Is this normal, and is there a way around it? Sure, ideally I should limit the space usable by each user, but that doesn't help when a given user needs to log in and fix their tmp usage. Thanks, Marius

6 9

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users September 2017