replica install - certuil - script or log?
by lejeczek
hi everyone
when I see this in replica install log:
..
2018-01-11T12:46:31Z DEBUG args=/usr/bin/certutil -d
/etc/dirsrv/slapd-PRIVATE-xx.xx.PRIVATE-CAM-AC-UK/ -L -n
PRIVATE.xx.xx.PRIVATE.xx.xx.x IPA CA -a -f
/etc/dirsrv/slapd-PRIVATE-xx.xx.PRIVATE-CAM-AC-UK/pwdfile.txt
2018-01-11T12:46:31Z DEBUG Process finished, return code=255
2018-01-11T12:46:31Z DEBUG stdout=
2018-01-11T12:46:31Z DEBUG stderr=certutil: Could not find
cert: PRIVATE.xx.xx.PRIVATE.xx.xx.x IPA CA
: PR_FILE_NOT_FOUND_ERROR: File not found
..
Is that just the log or actual surrounding quotes are
missing in replica-install code?
For, when I manually in bash exec this on replica candidate:
$ certutil -d
/etc/dirsrv/slapd-PRIVATE-xx.xx.PRIVATE-CAM-AC-UK/ -L -n
"PRIVATE.xx.xx.PRIVATE.xx.xx.x IPA CA" -a -f
/etc/dirsrv/slapd-PRIVATE-xx.xx.PRIVATE-CAM-AC-UK/pwdfile.txt
-----BEGIN CERTIFICATE-----
MIID0DCCArigAwIBAgIBATANBgkqhkiG9w0BAQsFADBNMSswKQYDVQQKDCJQUklW
QVRFLkNDTlIuQ0VCLlBSSVZBVEUuQ0FNLkFDLlVLMR4wHAYDVQQDDBVDZXJ0aWZp
Y2F0ZSBBdXRob3JpdHkwHhcNMTgwMTExMTIxMjIxWhcNMzgwMTExMTIxMjIxWjBN
...
many thanks, L.
6 years, 2 months
corosycnc conflict with certmonger always`
by barrykfl@gmail.com
Already set a cluster of 2 nodes can work fine
but evey reboot corosync seem conflict with certmonger service and login
service
and cause ssh shell login slow. and idea.? other funct of freeipa / HA
actually is working fine.
It seem will fail login service and zabbix agent also for the corosync.
after that I diabale zabbix agent seem login service can work
but still certmanger is fail with corosync started,.
systemctl --failed
UNIT LOAD ACTIVE SUB DESCRIPTION
● certmonger.service loaded failed failed Certificate monitoring and PKI
enrollm
● zabbix_agentd.service loaded failed failed Zabbix Agent
[ [32m OK [0m] Stopped Login Service.
Starting Login Service...
Jan 10 14:32:32 central03 kernel: [97458.949608] off_oom_killer_ (2027):
/proc/970/oom_adj is deprecated, please use /proc/970/oom_score_adj instead.
[ [1;31mFAILED [0m] Failed to start Login Service.
Starting Command Scheduler...
[ [1;31mFAILED [0m] Failed to start Zabbix Agent.
See 'systemctl status zabbix_agentd.service' for details.
Error getting authority: Error initializing authority: Error calling
StartServiceByName for org.freedesktop.PolicyKit1:
GDBus.Error:org.freedesktop.DBus.Error.TimedOut: Activation of
org.freedesktop.PolicyKit1 timed out (g-dbus-error-quark, 20)
6 years, 2 months
Expired certificate problem
by Giulio Casella
Hi,
I've got a problem with certificate expiration. My setup is a CA-ful IPA
installation, ipa-server-4.5.0-22 on a CentOS 7 host.
I've been able to run ipa-cacert-manage renew, setting date in the past,
but server certs (dirsrv and httpd) are not updated.
Is there a way to force update?
Here's my output of "getcert list":
Number of certificates and requests being tracked: 9.
Request ID '20170915095009':
status: MONITORING
stuck: no
key pair storage:
type=FILE,location='/var/kerberos/krb5kdc/kdc.key'
certificate: type=FILE,location='/var/kerberos/krb5kdc/kdc.crt'
CA: SelfSign
issuer:
CN=idc01.linux.unicloudidattica.local,O=LINUX.UNICLOUDIDATTICA.LOCAL
subject:
CN=idc01.linux.unicloudidattica.local,O=LINUX.UNICLOUDIDATTICA.LOCAL
expires: 2018-09-15 09:50:10 UTC
principal name:
krbtgt/LINUX.UNICLOUDIDATTICA.LOCAL(a)LINUX.UNICLOUDIDATTICA.LOCAL
certificate template/profile: KDCs_PKINIT_Certs
pre-save command:
post-save command: /usr/libexec/ipa/certmonger/renew_kdc_cert
track: yes
auto-renew: yes
Request ID '20171205091347':
status: MONITORING
stuck: no
key pair storage:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert
cert-pki-ca',token='NSS Certificate DB',pin set
certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert
cert-pki-ca',token='NSS Certificate DB'
CA: dogtag-ipa-ca-renew-agent
issuer: CN=Certificate Authority,O=LINUX.UNICLOUDIDATTICA.LOCAL
subject: CN=CA Audit,O=LINUX.UNICLOUDIDATTICA.LOCAL
expires: 2019-11-21 07:19:44 UTC
key usage: digitalSignature,nonRepudiation
pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert
"auditSigningCert cert-pki-ca"
track: yes
auto-renew: yes
Request ID '20171205091349':
status: MONITORING
stuck: no
key pair storage:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert
cert-pki-ca',token='NSS Certificate DB',pin set
certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert
cert-pki-ca',token='NSS Certificate DB'
CA: dogtag-ipa-ca-renew-agent
issuer: CN=Certificate Authority,O=LINUX.UNICLOUDIDATTICA.LOCAL
subject: CN=OCSP Subsystem,O=LINUX.UNICLOUDIDATTICA.LOCAL
expires: 2019-11-21 07:18:07 UTC
eku: id-kp-OCSPSigning
pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert
"ocspSigningCert cert-pki-ca"
track: yes
auto-renew: yes
Request ID '20171205091350':
status: MONITORING
stuck: no
key pair storage:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert
cert-pki-ca',token='NSS Certificate DB',pin set
certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert
cert-pki-ca',token='NSS Certificate DB'
CA: dogtag-ipa-ca-renew-agent
issuer: CN=Certificate Authority,O=LINUX.UNICLOUDIDATTICA.LOCAL
subject: CN=CA Subsystem,O=LINUX.UNICLOUDIDATTICA.LOCAL
expires: 2019-11-21 07:19:43 UTC
key usage:
digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
eku: id-kp-serverAuth,id-kp-clientAuth
pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert
"subsystemCert cert-pki-ca"
track: yes
auto-renew: yes
Request ID '20171205091351':
status: MONITORING
stuck: no
key pair storage:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert
cert-pki-ca',token='NSS Certificate DB',pin set
certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert
cert-pki-ca',token='NSS Certificate DB'
CA: dogtag-ipa-ca-renew-agent
issuer: CN=Certificate Authority,O=LINUX.UNICLOUDIDATTICA.LOCAL
subject: CN=Certificate Authority,O=LINUX.UNICLOUDIDATTICA.LOCAL
expires: 2038-01-08 00:16:58 UTC
key usage: digitalSignature,nonRepudiation,keyCertSign,cRLSign
pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert
"caSigningCert cert-pki-ca"
track: yes
auto-renew: yes
Request ID '20171205091352':
status: MONITORING
stuck: no
key pair storage: type=FILE,location='/var/lib/ipa/ra-agent.key'
certificate: type=FILE,location='/var/lib/ipa/ra-agent.pem'
CA: dogtag-ipa-ca-renew-agent
issuer: CN=Certificate Authority,O=LINUX.UNICLOUDIDATTICA.LOCAL
subject: CN=IPA RA,O=LINUX.UNICLOUDIDATTICA.LOCAL
expires: 2019-11-21 07:18:14 UTC
key usage:
digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
eku: id-kp-serverAuth,id-kp-clientAuth
pre-save command: /usr/libexec/ipa/certmonger/renew_ra_cert_pre
post-save command: /usr/libexec/ipa/certmonger/renew_ra_cert
track: yes
auto-renew: yes
Request ID '20171205091353':
status: MONITORING
stuck: no
key pair storage:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert
cert-pki-ca',token='NSS Certificate DB',pin set
certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert
cert-pki-ca',token='NSS Certificate DB'
CA: dogtag-ipa-ca-renew-agent
issuer: CN=Certificate Authority,O=LINUX.UNICLOUDIDATTICA.LOCAL
subject:
CN=idc01.linux.unicloudidattica.local,O=LINUX.UNICLOUDIDATTICA.LOCAL
expires: 2019-11-20 10:02:31 UTC
key usage:
digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
eku: id-kp-serverAuth,id-kp-clientAuth
pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert
"Server-Cert cert-pki-ca"
track: yes
auto-renew: yes
Request ID '20171205091357':
status: CA_UNREACHABLE
ca-error: Server at
https://idc01.linux.unicloudidattica.local/ipa/xml failed request, will
retry: -504 (libcurl failed to execute the HTTP POST transaction,
explaining: Peer's Certificate has expired.).
stuck: no
key pair storage:
type=NSSDB,location='/etc/dirsrv/slapd-LINUX-UNICLOUDIDATTICA-LOCAL',nickname='Server-Cert',token='NSS
Certificate
DB',pinfile='/etc/dirsrv/slapd-LINUX-UNICLOUDIDATTICA-LOCAL/pwdfile.txt'
certificate:
type=NSSDB,location='/etc/dirsrv/slapd-LINUX-UNICLOUDIDATTICA-LOCAL',nickname='Server-Cert',token='NSS
Certificate DB'
CA: IPA
issuer: CN=Certificate Authority,O=LINUX.UNICLOUDIDATTICA.LOCAL
subject:
CN=idc01.linux.unicloudidattica.local,O=LINUX.UNICLOUDIDATTICA.LOCAL
expires: 2018-01-08 08:24:22 UTC
key usage:
digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
eku: id-kp-serverAuth,id-kp-clientAuth
pre-save command:
post-save command: /usr/libexec/ipa/certmonger/restart_dirsrv
LINUX-UNICLOUDIDATTICA-LOCAL
track: yes
auto-renew: yes
Request ID '20171205091409':
status: CA_UNREACHABLE
ca-error: Server at
https://idc01.linux.unicloudidattica.local/ipa/xml failed request, will
retry: -504 (libcurl failed to execute the HTTP POST transaction,
explaining: Peer's Certificate has expired.).
stuck: no
key pair storage:
type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS
Certificate DB',pinfile='/etc/httpd/alias/pwdfile.txt'
certificate:
type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS
Certificate DB'
CA: IPA
issuer: CN=Certificate Authority,O=LINUX.UNICLOUDIDATTICA.LOCAL
subject:
CN=idc01.linux.unicloudidattica.local,O=LINUX.UNICLOUDIDATTICA.LOCAL
expires: 2018-01-08 08:33:05 UTC
key usage:
digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
eku: id-kp-serverAuth,id-kp-clientAuth
pre-save command:
post-save command: /usr/libexec/ipa/certmonger/restart_httpd
track: yes
auto-renew: yes
Thanks in advance,
Giulio
6 years, 2 months
The ipa-replica-install command failed, exception: ValidationError: invalid 'dnszoneidnsname': only master zones can contain records
by Alex Corcoles
Hi,
I'm labbing a FreeIPA environment for personal use, and I'm getting that
while bringing up a replica.
I set up my first freeipa-server instance on a cheap VPS on a public IP,
intend on making it publicly accessible so I can always authenticate my
laptop even on wild public networks.
I'm adding the replica as a VM(1) on a Proxmox VE, on a private network
with VPN connectivity to the first public freeipa-server, but I'm getting:
2018-01-06T20:56:04Z DEBUG The ipa-replica-install command failed,
exception: ValidationError: invalid 'dnszoneidnsname': only master zones
can contain records
. I'm trying to create the replica with CA and DNS, and I had set up DNS
forwarding to the internal DNS on the Proxmox system with:
$ ipa dnsforwardzone-add h2.int.pdp7.net --forwarder=10.42.42.1
$ ipa dnsforwardzone-add --name-from-ip=10.42.42.0/24
--forwarder=10.42.42.1 --forward-policy=only
on the first server (I run dnsmasq on Proxmox VE, 10.42.42.0/24 -
h2.int.pdp7.net is the network it manages), and I guess that's messing with
the replica, but I'm not sure how to troubleshoot this.
Thoughts? Ideas?
Thanks,
Álex
(1) I can't seem to create a freeipa-replica on an LXC container. Is this
something that can be discussed here or should I take it to LXC?
--
___
{~._.~}
( Y )
()~*~() mail: alex at corcoles dot net
(_)-(_) http://alex.corcoles.net/
6 years, 2 months
files permission from apache's perspective
by lejeczek
hi
I see in httpd/error_log entries about access, like:
Wed Jan 10 13:32:30.726295 2018] [:error] [pid 606202] ipa:
INFO: [jsonserver_kerb] admin(a)PRIVATE.xx.xx.PRIVATE.xx.xx.x:
host_find/1(None, version=u'2.228'): SUCCESS
[Wed Jan 10 13:32:37.798793 2018] [:warn] [pid 624924]
[client 10.5.6.17:54012] failed to set perms (3140) on file
(/var/run/ipa/ccaches/admin(a)PRIVATE.xx.xx.PRIVATE.xx.xx.x)!,
referer: https://swir.priv.xx.xx.priv.xx.xx.x/ipa/xml
[Wed Jan 10 13:32:37.842082 2018] [:error] [pid 606201] ipa:
INFO: [jsonserver_session]
admin(a)PRIVATE.xx.xx.PRIVATE.xx.xx.x: dnszone_find/1(None,
version=u'2.228'): SUCCESS
[Wed Jan 10 13:32:45.967214 2018] [:warn] [pid 606204]
[client 10.5.6.17:54014] failed to set perms (3140) on file
(/var/run/ipa/ccaches/admin(a)PRIVATE.xx.xx.PRIVATE.xx.xx.x)!,
referer: https://swir.priv.xx.xx.priv.xx.xx.x/ipa/xml
[Wed Jan 10 13:32:46.009797 2018] [:error] [pid 606202] ipa:
INFO: [jsonserver_session]
admin(a)PRIVATE.xx.xx.PRIVATE.xx.xx.x:
dnsrecord_find/1(u'5.10.in-addr.arpa.', None,
version=u'2.228'): NotFound
[Wed Jan 10 13:32:48.474571 2018] [:warn] [pid 606203]
[client 10.5.6.17:54016] failed to set perms (3140) on file
(/var/run/ipa/ccaches/admin(a)PRIVATE.xx.xx.PRIVATE.xx.xx.x)!,
referer: https://swir.priv.xx.xx.priv.xx.xx.x/ipa/xml
[Wed Jan 10 13:32:48.528580 2018] [:error] [pid 606201] ipa:
INFO: [jsonserver_session]
admin(a)PRIVATE.xx.xx.PRIVATE.xx.xx.x:
dnsrecord_find/1(u'6.5.10.in-addr.arpa.', None,
version=u'2.228'): SUCCESS
[Wed Jan 10 13:36:39.475804 2018] [:warn] [pid 606208]
[client 10.5.6.17:54020] failed to set perms (3140) on file
(/var/run
Are above errors critical?
I've already changed:
chown .apache /var/lib/ipa-client/pki/*
chown .apache /etc/pki/ca-trust/source/ipa.p11-kit
Should these above be root only, as installer set them?
6 years, 2 months
Re: AD trust and SAMBA
by Николай Савельев
When I connected to samba shares from windows AD users I had errors in samba logs :
FAILED with error NT_STATUS_NO_LOGON_SERVERS
I found why.
I have separate DNS server, not in IPA.
There weren't this records:
kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs SRV 0 100 88 freeipa
_kerberos._tcp.dc._msdcs SRV 0 100 88 freeipa
_kerberos._udp.Default-First-Site-Name._sites.dc._msdcs SRV 0 100 88 freeipa
_kerberos._udp.dc._msdcs SRV 0 100 88 freeipa
_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs SRV 0 100 389 freeipa
_ldap._tcp.dc._msdcs SRV 0 100 389 freeipa
I added it in DNS and SAMBA works normaly.
--
С уважением, Николай.
6 years, 2 months
worst nightmare come true: ipa service doesn't start anymore
by Harald Dunkel
Hi folks,
Platform: Centos 7.4, ipa 4.5.0-21
The ipa service cannot be started anymore. Error message:
# systemctl status ipa
* ipa.service - Identity, Policy, Audit
Loaded: loaded (/usr/lib/systemd/system/ipa.service; enabled; vendor preset: disabled)
Active: failed (Result: exit-code) since Wed 2017-12-06 14:45:53 CET; 12min ago
Process: 307 ExecStart=/usr/sbin/ipactl start (code=exited, status=1/FAILURE)
Main PID: 307 (code=exited, status=1/FAILURE)
Dec 06 14:45:52 ipa1.aixigo.de ipactl[307]: Starting Directory Service
Dec 06 14:45:52 ipa1.aixigo.de ipactl[307]: Starting krb5kdc Service
Dec 06 14:45:52 ipa1.aixigo.de ipactl[307]: Starting kadmin Service
Dec 06 14:45:52 ipa1.aixigo.de ipactl[307]: Starting httpd Service
Dec 06 14:45:52 ipa1.aixigo.de ipactl[307]: Starting ipa-custodia Service
Dec 06 14:45:52 ipa1.aixigo.de ipactl[307]: Starting pki-tomcatd Service
Dec 06 14:45:53 ipa1.aixigo.de systemd[1]: ipa.service: main process exited, code=exited, status=1/FAILURE
Dec 06 14:45:53 ipa1.aixigo.de systemd[1]: Failed to start Identity, Policy, Audit.
Dec 06 14:45:53 ipa1.aixigo.de systemd[1]: Unit ipa.service entered failed state.
Dec 06 14:45:53 ipa1.aixigo.de systemd[1]: ipa.service failed.
Apparently pki-tomcatd is to blame. See the attached logfiles.
Every helpful comment is highly appreciated.
Harri
6 years, 2 months
sudo fails as the Kerberos realm from an alternate UPN suffix
by Marin BERNARD
Hi,
We're using FreeIPA 4.5.0 on CentOS 7.4.
We've set up a two-way trust between our 2 FreeIPA servers and our AD domain (forest an domain levels both on 2012 R2). So far, everything works as expected, and we're able to perform SSO to both FreeIPA instances with AD accounts.
In our AD domain, the UPN suffix of most accounts is different from the DNS name of the domain, thus also from the its Kerberos realm. We use a custom UPN suffix (@pep06.fr) to match user names to email addresses. Such configuration is pretty common in AD environments.
After I set up the AD trust, I added our custom UPN (@pep06.fr) to the list of alternate UPN suffices in the Trusts section of the FreeIPA Web UI. I thought this was enough to make FreeIPA aware of our custom UPN suffix, and to have all Kerberos requests for @pep06.fr directed to the KDC of the AD domain.
I was wrong: while Kerberos delegation for SSO is working fine, we're unable to log in with explicit AD credentials. System logs report that sssd fails to find a KDC for the 'PEP06.FR' Kerberos realm which, indeed, does not exist, as it is constructed from our alternate UPN suffix:
```
[sssd[krb5_child[3810]]][3810]: Cannot find KDC for realm "PEP06.FR"
```
This limitation also prevents us from using IPA sudo rules involving AD users: since sssd is unable to derive the name of the real Kerberos realm, it fails to find a KDC to query, and rule evaluations always fail. This happens no matter if sudo is run from a SSO-authenticated session.
Is this a known limitation of FreeIPA or a configuration issue on my side? If this is a limitation, should I expect it to be adressed any soon?
Many thanks,
Marin BERNARD
Administrateur systèmes
Pupilles de l'Enseignement Public 06
35 boulevard de la Madeleine - 06000 Nice
6 years, 2 months
Cluster fail with certmenger fail
by barrykfl@gmail.com
Hi All:
I did on centos 7 with replication of servers no problem but after install
cluster
I try reboot , it cause cermonger service faul and login serveice fail ,
when I ssh to this A serverit take half minutes or FTP always time out.
After that I have to stop cluster in B server and try stop in A also
,,,then the service is fine again , It seem that I cannot start cluster
service at A.
yum -y install corosync pacemaker pcs
boot error:
Starting Login Service...
[ [1;31mFAILED [0m] Failed to start Login Service.
[root@(LIVEA)~]$ systemctl --failed
UNIT LOAD ACTIVE SUB DESCRIPTION
● certmonger.service loaded failed failed Certificate monitoring and PKI
enrollm
● ypbind.service loaded failed failed NIS/YP (Network Information
Service) C
Error getting authority: Error initializing authority: Error calling
StartServiceByName for org.freedesktop.PolicyKit1:
GDBus.Error:org.freedesktop.DBus.Error.TimedOut: Activation of
org.freedesktop.PolicyKit1 timed out (g-dbus-error-quark, 20)
Seem every reboot I have to stop the cluster first ..then boot fine then
manual start cluster. ANY idea ?
6 years, 2 months
should ipa-server-install fail to auto create reverse zone?
by lejeczek
hi eveyone
I'm running an installation inside a lxc container and I was
expecting installer to create reverse zone.
$ ipa-server-install -p ${myPass} -a ${myPass} --setup-dns
--auto-reverse --no-forwarders
but..
...
BIND DNS server will be configured to serve IPA domain with:
Forwarders: No forwarders
Forward policy: only
Reverse zone(s): No reverse zone
IP is: 10.5.10.37 netmask 255.255.255.240
VERSION: 4.5.0, API_VERSION: 2.228
Should this just work?
many thanks, L.
6 years, 2 months