how to avoid ntpd?
by Harald Dunkel
Hi folks,
some ipa servers in my environment are not permitted to change
the clock. If I use "systemctl mask ntpd" to avoid the "degraded"
returned by "systemctl status", then ipactl fails without the
ntpd service:
# ipactl restart
Stopping pki-tomcatd Service
Restarting Directory Service
Restarting krb5kdc Service
Restarting kadmin Service
Restarting httpd Service
Restarting ipa-custodia Service
Restarting pki-tomcatd Service
Restarting ipa-otpd Service
Starting ntpd Service
Failed to start ntpd Service
Shutting down
Hint: You can use --ignore-service-failure option for forced start in case that a non-critical service failed
Aborting ipactl
If I unmask ntpd, then systemctl status returns "degrarded" again,
but ipa is fine.
The option "--ignore-service-failures" ignores *all* service
failures. I wonder how I can tell freeipa to ignore ntpd and
rely upon sysvinit or systemd to start it, if necessary?
Every helpful comment is highly appreciated.
Harri
6 years, 3 months
ipa-server-install get error Configuration of CA failed
by michael_ly@sina.cn
Hi,
I was installing FreeIPA on REDHAT 6.7.
I used yum install ipa-server and then ipa-server-install.
But the ipa-server-install failed with below error, can anyone give some advice on why could be the root cause? Thanks ahead.
[3/21]: configuring certificate server instanceipa : CRITICAL failed to configure ca instance Command '/usr/bin/perl /usr/bin/pkisilent ConfigureCA -cs_hostname esgyn001.gynsh.cn -cs_port 9445 -client_certdb_dir /tmp/tmp-V62uAl -client_certdb_pwd XXXXXXXX -preop_pin HfDrsgIoH09wCuOeHspb -domain_name IPA -admin_user admin -admin_email root@localhost -admin_password XXXXXXXX -agent_name ipa-ca-agent -agent_key_size 2048 -agent_key_type rsa -agent_cert_subject CN=ipa-ca-agent,O=GYNSH.CN -ldap_host esgyn001.gynsh.cn -ldap_port 7389 -bind_dn cn=Directory Manager -bind_password XXXXXXXX -base_dn o=ipaca -db_name ipaca -key_size 2048 -key_type rsa -key_algorithm SHA256withRSA -save_p12 true -backup_pwd XXXXXXXX -subsystem_name pki-cad -token_name internal -ca_subsystem_cert_subject_name CN=CA Subsystem,O=GYNSH.CN -ca_subsystem_cert_subject_name CN=CA Subsystem,O=GYNSH.CN -ca_ocsp_cert_subject_name CN=OCSP Subsystem,O=GYNSH.CN -ca_server_cert_subject_name CN=esgyn001.gynsh.cn,O=GYNSH.CN -ca_audit_signing_cert_subject_name CN=CA Audit,O=GYNSH.CN -ca_sign_cert_subject_name CN=Certificate Authority,O=GYNSH.CN -external false -clone false' returned non-zero exit status 255Configuration of CA failed
2018-01-18T06:55:06Z CRITICAL failed to configure ca instance Command '/usr/bin/perl /usr/bin/pkisilent ConfigureCA -cs_hostname esgyn001.gynsh.cn -cs_port 9445 -client_certdb_dir /tmp/tmp-bQZ26x -client_certdb_pwd XXXXXXXX -preop_pin LyMFcx8VY5OuwdRqnBe8 -domain_name IPA -admin_user admin -admin_email root@localhost -admin_password XXXXXXXX -agent_name ipa-ca-agent -agent_key_size 2048 -agent_key_type rsa -agent_cert_subject CN=ipa-ca-agent,O=GYNSH.CN -ldap_host esgyn001.gynsh.cn -ldap_port 7389 -bind_dn cn=Directory Manager -bind_password XXXXXXXX -base_dn o=ipaca -db_name ipaca -key_size 2048 -key_type rsa -key_algorithm SHA256withRSA -save_p12 true -backup_pwd XXXXXXXX -subsystem_name pki-cad -token_name internal -ca_subsystem_cert_subject_name CN=CA Subsystem,O=GYNSH.CN -ca_subsystem_cert_subject_name CN=CA Subsystem,O=GYNSH.CN -ca_ocsp_cert_subject_name CN=OCSP Subsystem,O=GYNSH.CN -ca_server_cert_subject_name CN=esgyn001.gynsh.cn,O=GYNSH.CN -ca_audit_signing_cert_subject_name CN=CA Audit,O=GYNSH.CN -ca_sign_cert_subject_name CN=Certificate Authority,O=GYNSH.CN -external false -clone false' returned non-zero exit status 2552018-01-18T06:55:06Z INFO File "/usr/lib/python2.6/site-packages/ipaserver/install/installutils.py", line 614, in run_script return_value = main_function()
File "/usr/sbin/ipa-server-install", line 947, in main subject_base=options.subject)
File "/usr/lib/python2.6/site-packages/ipaserver/install/cainstance.py", line 626, in configure_instance self.start_creation(runtime=210)
File "/usr/lib/python2.6/site-packages/ipaserver/install/service.py", line 358, in start_creation method()
File "/usr/lib/python2.6/site-packages/ipaserver/install/cainstance.py", line 890, in __configure_instance raise RuntimeError('Configuration of CA failed')
2018-01-18T06:55:06Z INFO The ipa-server-install command failed, exception: RuntimeError: Configuration of CA failed
6 years, 3 months
freeipa-client joins keep failing : Cannot find KDC for realm
by Chris Moody
Hello all.
First want to thank everyone for all the hard work going into
continually making this platform a better and better offering.
I'm running into some challenges though in joining clients to a
relatively fresh install for a client. I have a pair of replicating IPA
nodes that are responding on all ports and services as expected. If I
make manual connections to the nodes from clients, I am able to talk
successfully via the various services (LDAP, KRB, DNS, NTP).
My trouble comes when trying to join clients to the IPA servers.
If I run the following:
=====
ipa-client-install -p admin --mkhomedir --hostname=`hostname` -d
=====
The client looks up all the name records correctly, prompts for the
admin credentials, then starts exchanging certs, making https calls, and
so on, but never completes successfully in joining the client. I keep
getting the dreaded "Client uninstall complete." whenever the
client-install completes.
Parsing through the /var/log/ipaclient-install.log, I see what I believe
to be the culprit component of the join process:
=====
...[output truncated]...
2018-01-15T21:55:24Z DEBUG Writing Kerberos configuration to /etc/krb5.conf:
2018-01-15T21:55:24Z DEBUG #File modified by ipa-client-install
includedir /var/lib/sss/pubconf/krb5.include.d/
[libdefaults]
default_realm = IPA.XYZ.COM
dns_lookup_realm = true
dns_lookup_kdc = true
rdns = false
ticket_lifetime = 24h
forwardable = true
udp_preference_limit = 0
default_ccache_name = KEYRING:persistent:%{uid}
[realms]
IPA.XYZ.COM = {
pkinit_anchors = FILE:/etc/ipa/ca.crt
}
[domain_realm]
.xyz.com = IPA.XYZ.COM
xyz.com = IPA.XYZ.COM
2018-01-15T21:55:24Z INFO Configured /etc/krb5.conf for IPA realm
IPA.XYZ.COM
2018-01-15T21:55:24Z DEBUG Starting external process
2018-01-15T21:55:24Z DEBUG args=keyctl search @s user
ipa_session_cookie:host/sfca-do-1.xyz.com@IPA.XYZ.COM
2018-01-15T21:55:24Z DEBUG Process finished, return code=1
2018-01-15T21:55:24Z DEBUG stdout=
2018-01-15T21:55:24Z DEBUG stderr=keyctl_search: Required key not available
2018-01-15T21:55:24Z DEBUG Starting external process
2018-01-15T21:55:24Z DEBUG args=/usr/bin/certutil -d /tmp/tmpoXIXYU -N
-f /tmp/tmpfNulOs
2018-01-15T21:55:24Z DEBUG Process finished, return code=0
2018-01-15T21:55:24Z DEBUG stdout=
2018-01-15T21:55:24Z DEBUG stderr=
2018-01-15T21:55:24Z DEBUG Starting external process
2018-01-15T21:55:24Z DEBUG args=/usr/bin/certutil -d /tmp/tmpoXIXYU -A
-n CA certificate 1 -t C,,
2018-01-15T21:55:24Z DEBUG Process finished, return code=0
2018-01-15T21:55:24Z DEBUG stdout=
2018-01-15T21:55:24Z DEBUG stderr=
2018-01-15T21:55:24Z DEBUG Starting external process
2018-01-15T21:55:24Z DEBUG args=/usr/bin/certutil -d /tmp/tmpoXIXYU -A
-n CA certificate 2 -t C,,
2018-01-15T21:55:24Z DEBUG Process finished, return code=0
2018-01-15T21:55:24Z DEBUG stdout=
2018-01-15T21:55:24Z DEBUG stderr=
2018-01-15T21:55:24Z DEBUG Starting external process
2018-01-15T21:55:24Z DEBUG args=/usr/bin/certutil -d /tmp/tmpoXIXYU -A
-n CA certificate 3 -t C,,
2018-01-15T21:55:24Z DEBUG Process finished, return code=0
2018-01-15T21:55:24Z DEBUG stdout=
2018-01-15T21:55:24Z DEBUG stderr=
2018-01-15T21:55:24Z DEBUG Starting external process
2018-01-15T21:55:24Z DEBUG args=/usr/bin/certutil -d /tmp/tmpoXIXYU -A
-n CA certificate 4 -t C,,
2018-01-15T21:55:24Z DEBUG Process finished, return code=0
2018-01-15T21:55:24Z DEBUG stdout=
2018-01-15T21:55:24Z DEBUG stderr=
2018-01-15T21:55:24Z DEBUG Starting external process
2018-01-15T21:55:24Z DEBUG args=/usr/bin/certutil -d /tmp/tmpoXIXYU -A
-n CA certificate 5 -t C,,
2018-01-15T21:55:24Z DEBUG Process finished, return code=0
2018-01-15T21:55:24Z DEBUG stdout=
2018-01-15T21:55:24Z DEBUG stderr=
2018-01-15T21:55:24Z DEBUG failed to find session_cookie in persistent
storage for principal 'host/sfca-do-1.xyz.com(a)IPA.XYZ.COM'
2018-01-15T21:55:24Z INFO trying https://sfca-do-4.ipa.xyz.com/ipa/json
2018-01-15T21:55:24Z DEBUG Created connection
context.rpcclient_140336485358096
2018-01-15T21:55:24Z DEBUG Try RPC connection
2018-01-15T21:55:24Z INFO Forwarding 'ping' to json server
'https://sfca-do-4.ipa.xyz.com/ipa/json'
2018-01-15T21:55:24Z DEBUG Destroyed connection
context.rpcclient_140336485358096
2018-01-15T21:55:24Z INFO Cannot connect to the server due to Kerberos
error: Major (851968): Unspecified GSS failure. Minor code may provide
more information, Minor (2529639066): Cannot find KDC for realm
"IPA.XYZ.COM". Trying with delegate=True
2018-01-15T21:55:24Z INFO trying https://sfca-do-4.ipa.xyz.com/ipa/json
2018-01-15T21:55:24Z DEBUG Created connection
context.rpcclient_140336485358096
2018-01-15T21:55:24Z DEBUG Try RPC connection
2018-01-15T21:55:24Z INFO Forwarding 'ping' to json server
'https://sfca-do-4.ipa.xyz.com/ipa/json'
2018-01-15T21:55:24Z WARNING Second connect with delegate=True also
failed: Major (851968): Unspecified GSS failure. Minor code may provide
more information, Minor (2529639066): Cannot find KDC for realm
"IPA.XYZ.COM"
2018-01-15T21:55:24Z ERROR Cannot connect to the IPA server RPC
interface: Major (851968): Unspecified GSS failure. Minor code may
provide more information, Minor (2529639066): Cannot find KDC for realm
"IPA.XYZ.COM"
2018-01-15T21:55:24Z ERROR Installation failed. Rolling back changes.
=====
But where I'm confused is in why I keep hitting this 'cannot find kdc'
error.
I have tried manually setting /etc/krb5.conf to the contents that get
generated & display during the verbose client-install process (as seen
above), that manually spell out the KDC details, and am able to run a
'kinit admin' just fine from the CLI on the client, so kerberos DOES
function from the client. It talks to the KDC beautifully and
authenticates just fine... so I'm not sure how the client-install
process is getting confused/lost when trying to find/contact the KDC.
Any hints or suggestions are greatly appreciated. I'm essentially stuck
on finishing roll-out of these IPA servers into production because of
this one component.
Thanks,
-Chris
6 years, 3 months
CCacheError: did not receive Kerberos credentials
by Dimitris Zilaskos
Hello,
I have been asked to look into an ipa server running in CentOS 6. The
server was missbehaving for some time, with some certificates expiring back
in October. Also / was full. I have cleaned up some space, set the date
back before the certificates expired, restarted/rebooted but renewal of
certs fails:
[Wed Oct 25 00:00:21 2017] [info] Connection to child 0 established (server
portal.cloud.local, client 10.142.20.10)
[Wed Oct 25 00:00:21 2017] [debug] nss_engine_init.c(1948): SNI: Found
nickname Server-Cert for vhost: portal.cloud.local
[Wed Oct 25 00:00:21 2017] [debug] nss_engine_init.c(1970): SNI:
Successfully paired vhost portal.cloud.local with nickname: Server-Cert
[Wed Oct 25 00:00:21 2017] [debug] nss_engine_kernel.c(93): SNI request for
portal.cloud.local
[Wed Oct 25 00:00:21 2017] [info] Initial (No.1) HTTPS request received for
child 0 (server portal.cloud.local:443)
[Wed Oct 25 00:00:21 2017] [error] ipa: DEBUG: WSGI wsgi_dispatch.__call__:
[Wed Oct 25 00:00:21 2017] [error] ipa: DEBUG: WSGI xmlserver.__call__:
[Wed Oct 25 00:00:21 2017] [error] ipa: ERROR: 500 Internal Server Error:
xmlserver.__call__: KRB5CCNAME not defined in HTTP request environment
[Wed Oct 25 00:00:21 2017] [error] ipa: DEBUG: response: CCacheError: did
not receive Kerberos credentials
[Wed Oct 25 00:00:21 2017] [info] Connection to child 0 closed (server
portal.cloud.local:443, client 10.142.20.10)
I can do kinit admin without problems. Please any hints how can I resoleve
this?
Best regards,
Dimitrios
6 years, 3 months
Basic Certificate Creation Question
by Callum Guy
Hi All,
I'm planning to add a subdomain certificate for an internal web service
using FreeIPA CA however in my example I am applying the certificate to an
interim proxy server.
For example I want to sign a certificate for "web.domain.com" and serve it
on host "proxy.domain.com".
Based on what I have learnt from using FreeIPA so far I presume the correct
way to do this is via service principal: HTTP/proxy.domain.com(a)DOMAIN.COM
When I attempt to create the certificate from my CSR I get the following
error report:
"invalid 'csr': hostname in subject of request 'web.domain.com' does not
match name or aliases of principal 'HTTP/proxy.domain.com(a)DOMAIN.COM'"
Ii have tried adding aliases to the principal however I haven't been able
to make it work - a lack of understanding I think!
I am sure that I am just doing something wrong and it would be great if
someone could help explain what I should be doing.
Many thanks,
Callum
--
Callum Guy
Head of Information Security
X-on
--
*0333 332 0000 | www.x-on.co.uk <http://www.x-on.co.uk> | **
<https://www.linkedin.com/company/x-on> <https://www.facebook.com/XonTel>
<https://twitter.com/xonuk> *
X-on is a trading name of Storacall Technology Ltd a limited company
registered in England and Wales.
Registered Office : Avaland House, 110 London Road, Apsley, Hemel
Hempstead, Herts, HP3 9SD. Company Registration No. 2578478.
The information in this e-mail is confidential and for use by the
addressee(s) only. If you are not the intended recipient, please notify
X-on immediately on +44(0)333 332 0000 and delete the
message from your computer. If you are not a named addressee you must not
use, disclose, disseminate, distribute, copy, print or reply to this email. Views
or opinions expressed by an individual
within this email may not necessarily reflect the views of X-on or its
associated companies. Although X-on routinely screens for viruses,
addressees should scan this email and any attachments
for viruses. X-on makes no representation or warranty as to the absence of
viruses in this email or any attachments.
6 years, 3 months
FreeIPA NFS Automount with Kerberos troubleshooting help needed
by jcccb
I got an FreeIPA Server (F27) up and running on a proxmox host in a vm fine so far with an Centos client as an NFS-Server.
I setup a second ubuntu client (17.10) with indirect mounts for home an some storage folders.
The home automount points are working fine but the others i cant access... i guess i could have something to do with file permissions and maybe u can point me in the right direction.
folder on the server for
HOME=
[root@nfs_server~]# ls -la /home/
total 22
drwx------ 2 username username 6 Dec 26 01:01 username
drwxrwxrwt 2 root root 4 Jan 6 22:41 public
STORAGE=
[root@nfs server~]# ls -la /storage/
total 32
drw-r--r-- 6 root root 6 Dec 17 02:23 .
drwxr-xr-x 21 root root 26 Jan 7 03:56 ..
drw-r--r-- 4 root root 5 Dec 12 01:08 data
drw-r-Sr-- 7 1976250001 1976250004 17 Dec 21 18:29 downloads
drwxrwxrwt 10 root root 12 Oct 15 05:58 media
drw-r--r-- 2 root root 2 Nov 13 03:34 software
UBUNTUCLIENT=
username@client:/root$ ls -la /storage/
total 9
drwxr-xr-x 6 root root 0 Jan 7 20:29 .
drwxr-xr-x 23 root root 23 Jan 7 20:29 ..
dr-xr-xr-x 2 root root 0 Jan 7 20:29 data
dr-xr-xr-x 2 root root 0 Jan 7 20:29 downloads
dr-xr-xr-x 2 root root 0 Jan 7 20:29 media
dr-xr-xr-x 2 root root 0 Jan 7 20:29 software
username@client:/root$ ls -la /home/ipa/
total 1
drwxr-xr-x 3 root root 0 Jan 7 20:29 .
drwxr-xr-x 3 root root 3 Dec 26 03:06 ..
dr-xr-xr-x 2 root root 0 Jan 7 20:29 public
if i wanna access for example the the downloads folder i get an:
username@leech:/root$ ls /storage/downloads/
ls: cannot access '/storage/downloads/': No such file or directory
actually right now it even seems that i can only access the public folder and get the same "noch such file or directory error" if i try to access user home folder "username".
i remember that this worked before somehow.
suspected the proxmox lxc container messing probably something up with the uids or guids? i disabled the unpriviliged containers anyways for bugfixing.
Any Help would be much apprecciated i will provide any needed additonal logs.
6 years, 3 months
HBAC Lookups by host rather than user/group
by Louis Abel
Hello.
I was curious if there is something built in to FreeIPA (4.5.0 on CentOS) as a whole or if someone has created scripts or the like that perform access rights lookups without doing the typical hbac rule lookups which requires user -> host -> service (as far as I know), where those things are required to actually perform the access granted/denied test. Basically, what I'm trying to figure out is there a way to pick a host for example, and get a list of who can access the system on a specific service (or any service for that matter).
The reason I ask is I'm trying to figure out how to properly perform "audits" at my place of work, ie for PCI and SOX. And as far as I can tell, there's no easy way to do this when we have for example, two HBAC policies that allow all hosts (so there's no "member" attributes on the directory objects, just hostCategory all) and then majority of the policies are using groups rather than specific individuals, so I'd have to get a list of all of the users, including the ones that are in AD across the trust.
If there isn't something like this built in, has someone done something like this before? I'd like to try to avoid rolling my own solution if possible, but if I had to roll my own solution, I could use some advisement or hints on something like this.
6 years, 3 months
Get user ssh key instead of fingerprint.
by Maciej Drobniuch
Hi all.
Is there any way to get the user's ssh key (not fingerprint) via console?
Maybe LDAP?
Or only via a https request ?
Thanks
--
Best regards
Maciej Drobniuch
Network Security Engineer
Collective-Sense,LLC
6 years, 3 months
ubuntu smbclient error connecting to fedora freeipa + samba server
by Crashbunny
Hi,
On a xenial desktop I have installed freeipa-client, and it seems to be working OK.
I'm still learning freeipa and related technologies like kerberos.
I can for example run the command "id freeipauser1" and see the uid uid=1098200003
I can kinit and authenticate, I can run klist and see the ticket
If I run smbclient -k -L 192.168.1.1 I get
SPNEGO: Could not find a suitable mechtype in NEG_TOKEN_INIT
session setup failed: NT_STATUS_NO_MEMORY
There's a few hits in search engines with those errors, but nothing I found
helped me fix the problem.
If I run smbclient -L 192.168.1.1 it asks me for my password and it works OK.
If I run smbcliebt -k -L localhost on the samba server it works OK
How do I debug this please?
6 years, 3 months
Corosync or user multi environment seem conflict with ipa
by barrykfl@gmail.com
Hi:
I have the corosyc peacemaker cluster working fine on basic function.
BUt tried to reboot one node the HA work ...but after reboot .
It "sometimes" make certmonger.service fail? 10 times may 6 times fail but
reboot several times it work again.
I discovered that the most case happen together is that session-1.scope
or session-2.scope not load at that time.
Any idea ? is it dependency issue ? I already tried many combination .
e.g. start certmonger.service before coroysnc / dbus.service same happening.
Normal:
session-1.scope
loaded active running Session 1 of user root
alsa-state.service
loaded active running Manage Sound Card State (restore and
store)
atd.service
loaded active running Job spooling tools
certmonger.service
loaded active running Certificate monitoring and PKI en
coroysnc.service
Running
Fail:
alsa-state.service
loaded active running Manage Sound Card State (restore and
store)
atd.service
loaded active running Job spooling tools
certmonger.service
Failed Certificate monitoring and PKI en
coroysnc.service
Running
6 years, 3 months