Hello FreeIPA world,
First thanks for this great product, I was looking for an Active Directory 'clone' for the opensource world and I have successfully tested and deployed a FreeIPA infra, thanks to your great job guys !
Because I am also a Windows admin sys working from Windows platform, I wanted to keep PowerShell as my main shell and script platform. I have started to port the Python cli in a Powershell module.
For the Powershell user, my work is available at : https://github.com/MS-LUF/Manage-FreeIPA
Currently, the APIs already implemented in the v0.1 are :
More, to come soon.
On 10/19/18 6:49 AM, Z D via FreeIPA-users wrote:
> Hi there,
> This is el7.3 running ipa-server 4.4.0 release 12.0.1.el7.
> After reboot I couldn't start ipa service via systemctl, hence I run
> "ipactl start --ignore-service-failures" and this was kind of
> successful. I still have some discrepancies, and looking for
> troubleshooting ideas.
> 1. "systemctl status ipa.service" reads that service failed
> 2. "systemctl status pki-tomcatd.target" reads that PKI Tomcat Server
> is running.
The PKI service status can be found using "systemctl status
More details on the differences between targets and units can be found
in the man pages for systemd.unit(5) and systemd.target(5).
> # ipactl status
> Directory Service: RUNNING
> krb5kdc Service: RUNNING
> kadmin Service: RUNNING
> named Service: RUNNING
> ipa_memcached Service: RUNNING
> httpd Service: RUNNING
> ipa-custodia Service: RUNNING
> ntpd Service: RUNNING
> pki-tomcatd Service: STOPPED <---- !!
> ipa-otpd Service: RUNNING
> ipa-dnskeysyncd Service: RUNNING
> ipa: INFO: The ipactl command was successful
To troubleshoot, you can have a look at the output of
# systemctl status pki-tomcatd(a)pki-tomcat.service
and the logs in /var/log/pki/pki-tomcat/ca/debug.
I would start by checking if some certificates expired with getcert list
(check the status, should be MONITORING, and the expires: <date>).
> Well, why pki-tomcatd reads 'stopped' and how to make systemctl to
> recognize that ipa service is running, thanks in advance,
> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
> Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives: https://email@example.com...
Hello the list,
We just had a bit of fuss involved user logins. We're using sssd 1.16.1 on a
client and FreeIPA 4.5.4 (ok, it's really RHIdM)
We had a lot of users having issues logging and/or resetting their passwords
on a host with 2FA enabled, and it turns out when they're using an advanced
SSH client (e.g. MobaXterm) that also starts a SFTP session they can't login
and we see error like:
Sep 11 00:09:05 lander sshd: pam_sss(sshd:auth): received for user
testuser: 4 (System error)
Sep 11 00:09:06 lander sshd: error: PAM: Authentication failure for
testuser from remote.local
If the SFTP file browser is disabled, or it's protocol is set to use SCP
then logins progress normally.
In FreeIPA we've enabled 2FA on a per-host basis and the HBAC rule only
allows sshd services, so if these were the cause of the '4 (System error)'
failures then it'd be much better if the error reports were more meaningful.
Does anyone have any advice on setting up SFTP so that it works (and
ideally, doesn't need repeated entry of credentials).
I have these errors in the syslog of the primary, the syslog on the secondary is clean.
Oct 30 09:41:59 ef-idm01 ns-slapd: [30/Oct/2018:09:41:59.104092627 -0700] agmt="cn=masterAgreement1-ef-idm02.production.efilm.com-pki-tomcat" (ef-idm02:389) - Can't locate CSN 5afd9651000200600000 in the changelog (DB rc=-30988). If replication stops, the consumer may need to be reinitialized.
Oct 30 09:41:59 ef-idm01 ns-slapd: [30/Oct/2018:09:41:59.105088278 -0700] NSMMReplicationPlugin - changelog program - agmt="cn=masterAgreement1-ef-idm02.production.efilm.com-pki-tomcat" (ef-idm02:389): CSN 5afd9651000200600000 not found, we aren't as up to date, or we purged
Oct 30 09:41:59 ef-idm01 ns-slapd: [30/Oct/2018:09:41:59.105750108 -0700] NSMMReplicationPlugin - agmt="cn=masterAgreement1-ef-idm02.production.efilm.com-pki-tomcat" (ef-idm02:389): Data required to update replica has been purged from the changelog. The replica must be reinitialized.
I initiated a resync, but the errors continue to pile up on the primary.
grant@ef-idm02:~[20181030-9:36][#115]$ ipa-replica-manage force-sync --from ef-idm01.production.efilm.com
Directory Manager password: ********
ipa: INFO: Setting agreement cn=meToef-idm02.production.efilm.com,cn=replica,cn=dc\=production\,dc\=efilm\,dc\=com,cn=mapping tree,cn=config schedule to 2358-2359 0 to force synch
ipa: INFO: Deleting schedule 2358-2359 0 from agreement cn=meToef-idm02.production.efilm.com,cn=replica,cn=dc\=production\,dc\=efilm\,dc\=com,cn=mapping tree,cn=config
This e-mail and any attachments are intended only for use by the addressee(s) named herein and may contain confidential information. If you are not the intended recipient of this e-mail, you are hereby notified any dissemination, distribution or copying of this email and any attachments is strictly prohibited. If you receive this email in error, please immediately notify the sender by return email and permanently delete the original, any copy and any printout thereof. The integrity and security of e-mail cannot be guaranteed.
We have FreeIPA running on Ubuntu 16.04 since about two years
now. For the last few day we see these messages in the log
Oct 22 17:32:14 ipasrv certmonger: 2018-10-22 17:32:14  Error 77 connecting to https://ipasrv.mydomain:8443/ca/agent/ca/profileReview: Problem with the SSL CA cert (path? access rights?).
Oct 22 17:32:20 ipasrv dogtag-ipa-ca-renew-agent-submit: Forwarding request to dogtag-ipa-renew-agent
Oct 22 17:32:20 ipasrv dogtag-ipa-ca-renew-agent-submit: dogtag-ipa-renew-agent returned 3
Where should I start looking to recover from this?
I am looking at using FreeIPA without CA, using external signed certificates, reading the documentations it looks possible using —dirsrv-certfile, —http-cert-file and —point-certfile. Should I just create a CSR for the hostname by by hand and get it signed? Also is there any good reason for having different certs for http, ldap and pkinit? Can I just use one certificate for all services and for all servers and replicas using Subject Alternative Names?
I have configured DNS forwarders in each of my FreeIPA servers. However I want to be able to go back and verify they are there. I can't remember how to get that information. I am running CentOS 7 latest with FreeIPA version 4.5.0. I want to say there is an LDAP command I found.
This is not for global forwarders.
As part of a larger IPA "health" checker and driven largely by necessity
I have the beginning of a certificate checking tool available at
It works for me in IPA 4.5.4, IPA 4.6.0 and IPA master (basically 4.7+
There is not much of a user-friendly interface to it. There are only two
options, debug and verbose, which increase the amount of debug output
(and it is immense).
The UI is limited because I expect it to be rolled up into some larger
tool at some point and don't want to have to throw away a ton of
It needs to be run on an IPA master and checks the things I thought of
to check. I've only done limited testing on mostly brand new installs so
I'd appreciate feedback. Don't freak out of it spits out errors as it
could just be bugs on my part :-)
It is read-only so it shouldn't blow up anything.
So if you want to run it against your system and send me the any output
I can try to figure out if it is my tool that is the issue or your
system (it is supposed to help pro-actively diagnose issues after all).
To use just clone it from git (or download ipa-checkcerts.py from the repo)
Run it as root:
# kinit admin
# python ipa-checkcerts.py
IPA version 4.5.4-10.el7_5.3
Check CA status
Check NSS trust
Checking certificates in CS.cfg
Comparing certificates to requests in LDAP
Checking RA certificate
Checking host keytab
Checking renewal master
End-to-end cert API test
Checking permissions and ownership
All checks passed