Help to install a replica on Fedora 28
by ARNAL Laurent
Hello,
I try to install a replica on a fedora 28 server using the command
ipa-replica-install --principal admin --admin-password password --force-join
Command failed on step [26/41]: creating DS keytab with error :
===================================================
2018-12-26T11:00:02Z DEBUG Process finished, return code=9
2018-12-26T11:00:02Z DEBUG stdout=uid=0(root) gid=0(root) groupes=0(root),39(video)
2018-12-26T11:00:02Z DEBUG stderr=Impossible d'analyser le résultat : Insufficient access rights
Nouvelle tentative de récupération avec la méthode pre-4.0...
Impossible d'analyser le résultat : Insufficient access rights
Échec d'obtention du tableau de clés !
Échec à l'obtention du tableau de clés
2018-12-26T11:00:02Z DEBUG Traceback (most recent call last):
File "/usr/lib/python3.6/site-packages/ipaserver/install/service.py", line 605, in start_creation
run_step(full_msg, method)
File "/usr/lib/python3.6/site-packages/ipaserver/install/service.py", line 591, in run_step
method()
File "/usr/lib/python3.6/site-packages/ipaserver/install/dsinstance.py", line 1315, in request_service_keytab
super(DsInstance, self).request_service_keytab()
File "/usr/lib/python3.6/site-packages/ipaserver/install/service.py", line 782, in request_service_keytab
self.run_getkeytab(self.api.env.ldap_uri, self.keytab, self.principal)
File "/usr/lib/python3.6/site-packages/ipaserver/install/service.py", line 772, in run_getkeytab
ipautil.run(args, nolog=nolog)
File "/usr/lib/python3.6/site-packages/ipapython/ipautil.py", line 574, in run
p.returncode, arg_string, output_log, error_log
Error(Command ['/usr/sbin/ipa-getkeytab', '-k', '/etc/dirsrv/ds.keytab', '-p', 'ldap/kerclaei.mydomain.com(a)MYDOMAIN.COM', '-H', 'ldaps://stellai.mydomain.com'] returned non-zero exit status 9: "Impossible d'analyser le résultat\xa0: Insufficient access rights\n\nNouvelle tentative de récupération avec la méthode pre-4.0...\nImpossible d'analyser le résultat\xa0: Insufficient access rights\n\nÉchec d'obtention du tableau de clés\xa0!\nÉchec à l'obtention du tableau de clés\n")
2018-12-26T11:00:02Z DEBUG [error] CalledProcessError: CalledProcessError(Command ['/usr/sbin/ipa-getkeytab', '-k', '/etc/dirsrv/ds.keytab', '-p', 'ldap/kerclaei.mydomain.com(a)MYDOMAIN.COM', '-H', 'ldaps://stellai.mydomain.com'] returned non-zero exit status 9: "Impossible d'analyser le résultat\xa0: Insufficient access rights\n\nNouvelle tentative de récupération avec la méthode pre-4.0...\nImpossible d'analyser le résultat\xa0: Insufficient access rights\n\nÉchec d'obtention du tableau de clés\xa0!\nÉchec à l'obtention du tableau de clés\n")
2018-12-26T11:00:02Z DEBUG Destroyed connection context.ldap2_140109927205352
===================================================
If I try to launch the ipa-getkeytab command from shell, the command succed.
Can someone help me to solve this issue ?
The permissions on /etc/dirsrv directory look like this:
[root@kerclaei 2]# dir /etc/dirsrv -la
total 0
drwxrwxr-x 1 root dirsrv 124 26 déc. 12:30 .
drwxr-xr-x 1 root root 10828 26 déc. 12:27 ..
drwx------ 1 dirsrv dirsrv 188 7 févr. 2018 admin-serv
drwxr-xr-x 1 dirsrv dirsrv 104 23 déc. 13:07 config
drwxr-xr-x 1 dirsrv dirsrv 30 7 févr. 2018 dsgw
drwxr-xr-x 1 dirsrv dirsrv 22 24 août 23:12 schema
drwxrwx--- 1 dirsrv dirsrv 234 26 déc. 12:30 slapd-DOMAIN-COM
drwxrwx--- 1 dirsrv dirsrv 30 26 déc. 09:44 slapd-DOMAIN-COM.removed
Regards,
Laurent
3 years, 6 months
Freeipa replica server issue
by Azim Siddiqui
Hello,
Hope you are doing good.
Hello All,
We have a master freeipa server through which we created more two replica
freeipa servers. When we create a user in master server, the user was
automatically created into the two replica servers. Everything was working
fine, But now I am seeing this error for one of the replica server, when
running this command
ipa-replica-manage -v list local-host
last update status: -1 Incremental update has failed and requires
administrator actionLDAP error: Can't contact LDAP server
When i am checking the logs for /var/log/dirsrv/localhost, I can see this
:-
[24/Dec/2018:21:27:55 +0000] slapi_ldap_bind - Error: could not perform
interactive bind for id [] authentication mechanism [GSSAPI]: error -1
(Can't contact LDAP server)
[24/Dec/2018:21:32:20 +0000] slapi_ldap_bind - Error: could not send
startTLS request: error -1 (Can't contact LDAP server) errno 2 (No such
file or directory)
[24/Dec/2018:21:32:55 +0000] slapd_ldap_sasl_interactive_bind - Error:
could not perform interactive bind for id [] mech [GSSAPI]: LDAP error -1
(Can't contact LDAP server) ((null)) errno 107 (Transport endpoint is not
connected)
[24/Dec/2018:21:32:55 +0000] slapi_ldap_bind - Error: could not perform
interactive bind for id [] authentication mechanism [GSSAPI]: error -1
(Can't contact LDAP server)
Can you please tell me how to resolve this issue ?
Thanks & Regards,
Azeem
3 years, 6 months
FreeIPA UID vs. Linux UID - what's the difference
by 74cmonty
Hi,
could you please explain the difference of FreeIPA UID vs. Linux UID?
When I create a user in FreeIPA the UID is this: 1227200001
But in any Linux the first user created has UID: 1000
Should I align UIDs in FreeIPA to the Linux UID?
If yes, does the same apply to GID?
Or should I keep the UID / GID created by FreeIPA?
If yes, how does this work when a client is registered with FreeIPA?
THX
3 years, 6 months
FreeIPA containerization status
by Jan Pazdziora
Hello,
in the past couple of week I've pushed multiple changes to the
https://github.com/freeipa/freeipa-container
repository, fixing and enabling Fedora 28 and Fedora 29 Dockerfiles,
adding Travis CI configuration where we currently test IPA master and
replica setups in images of Fedoras from 23 to rawhide and on CentOS 7:
https://travis-ci.org/freeipa/freeipa-container/branches
Testing on Travis' Ubuntus allowed me to reproduce and fix some issues
that people have observed on non-RHEL/CentOS/Fedora docker hosts. One
of the results is that docker run's --privileged or --cap-add
SYS_ADMIN options should not be needed anymore, making things more
confined and more secure. In fact, it's quite likely that running the
FreeIPA server containers as privileged will result in
https://github.com/freeipa/freeipa-container/issues/254
... so just don't do it.
Another focus of the effort was to make it possible to run the
containers as read-only (docker run --read-only), making all the
changes that are done during the initial ipa-server-install or during
runtime properly confined to the /data volume, or pointed to
discardable /tmp. While things pass in my local read-only tests, in
Travis CI the initial ipa-server-install phase runs fine but starting
the read-only container afterwars seems to hang:
https://travis-ci.org/adelton/freeipa-container/builds/459418370
Any help with investigating why this is happening would be
appreciated.
--
Jan Pazdziora
Senior Principal Software Engineer, Security Engineering, Red Hat
3 years, 6 months
Insufficient access: SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Ticket expired)
by lune voo
Hello !
I contact you because I have a random problem with my 3.0.0.47 FreeIPA
server.
Sometimes, suddenly, I cannot use anymore the REST API and I got the
following errors when I try things like ipa user-show <myuser> :
Insufficient access: SASL(-1): generic failure: GSSAPI Error: Unspecified
GSS failure. Minor code may provide more information (Ticket expired)]
traceback : <traceback object at 0x3b917a0>
The kinit works fine, klist also.
My ticket is valid until the day after so no problem from there.
The datetime is the same between the IPA server and the IPA client.
When I check the httpd logs on the IPA server, as long as this error lasts,
I don't see any logs at all.
For example, today, the problem occured at 12:06:39 and in the HTTPD error
logs :
[Wed Oct 31 12:05:23 2018] [error] ipa: INFO: aPrincipal@MYREALM:
user_show(u'anotherPincipal', rights=False, all=True, raw=False,
version=u'2.49', no_members=False): SUCCESS
[Wed Oct 31 12:07:23 2018] [error] ipa: INFO: aPrincipal@MYREALM:
user_find(u'PrincipalPattern_', sizelimit=1000, whoami=False, all=False,
raw=False, version=u'2.49', no_members=False, pkey_only=False): SUCCESS
There is nothing in the dirsrv error logs at this time and around this time.
Nothing neither in the PKI CA logs.
When I check the logs in cli.log, I find this kind of lines :
2018-10-31T12:06:39Z 1933 MainThread ipa.ipalib.rpc.xmlclient
INFO trying https://<IPA-MASTER>/ipa/xml
2018-10-31T12:06:39Z 1933 MainThread ipa.ipalib.rpc.xmlclient
INFO Forwarding 'user_show' to server u'https://<IPA-MASTER>/ipa/xml'
2018-10-31T12:06:39Z 1947 MainThread ipa.ipalib.rpc.xmlclient
INFO trying https://<IPA-MASTER>/ipa/xml
2018-10-31T12:06:39Z 1947 MainThread ipa.ipalib.rpc.xmlclient
INFO Forwarding 'user_show' to server u'https://<IPA-MASTER>/ipa/xml'
2018-10-31T12:06:40Z 1961 MainThread ipa.ipalib.rpc.xmlclient
INFO trying https://<IPA-MASTER>/ipa/xml
2018-10-31T12:06:40Z 1961 MainThread ipa.ipalib.rpc.xmlclient
INFO Forwarding 'user_show' to server u'https://<IPA-MASTER>/ipa/xml'
2018-10-31T12:06:40Z 1975 MainThread ipa.ipalib.rpc.xmlclient
INFO trying https://<IPA-MASTER>/ipa/xml
2018-10-31T12:06:40Z 1975 MainThread ipa.ipalib.rpc.xmlclient
INFO Forwarding 'user_show' to server u'https://<IPA-MASTER>/ipa/xml'
2018-10-31T12:07:27Z 2159 MainThread ipa INFO The ipactl
command was successful
2018-10-31T12:07:27Z 2160 MainThread ipa INFO The ipactl
command was successful
I cannot see anything special in the krb5kdc.log neither for this time. The
only line corresponding to the IP of the client are the followings :
Oct 31 12:06:24 <IPA-MASTER> krb5kdc[137188](info): AS_REQ (4 etypes {18 17
16 23}) <IP CLIENT>: NEEDED_PREAUTH: <MYUSER>@<MYREALM> for
krbtgt/<MYREALM>@<MYREALM>, Additional pre-authentication required
Oct 31 12:06:24 <IPA-MASTER> krb5kdc[137188](info): AS_REQ (4 etypes {18 17
16 23}) <IP CLIENT>: NEEDED_PREAUTH: <MYUSER>@<MYREALM> for
krbtgt/<MYREALM>@<MYREALM>, Additional pre-authentication required
Oct 31 12:06:24 <IPA-MASTER> krb5kdc[137188](info): closing down fd 10
Oct 31 12:06:24 <IPA-MASTER> krb5kdc[137188](info): closing down fd 10
Oct 31 12:06:24 <IPA-MASTER> krb5kdc[137181](info): AS_REQ (4 etypes {18 17
16 23}) <IP CLIENT>: ISSUE: authtime 1540983984, etypes {rep=18 tkt=18
ses=18}, <MYUSER>@<MYREALM> for krbtgt/<MYREALM>@<MYREALM>
Oct 31 12:06:24 <IPA-MASTER> krb5kdc[137181](info): AS_REQ (4 etypes {18 17
16 23}) <IP CLIENT>: ISSUE: authtime 1540983984, etypes {rep=18 tkt=18
ses=18}, <MYUSER>@<MYREALM> for krbtgt/<MYREALM>@<MYREALM>
Oct 31 12:06:24 <IPA-MASTER> krb5kdc[137181](info): closing down fd 10
Oct 31 12:06:24 <IPA-MASTER> krb5kdc[137181](info): closing down fd 10
We are multiple users connecting to the same server with SSH and using root.
But each one of us use a different KRB5CCNAME to take a kerberos ticket.
(we take different ticket, me for example I take an admin ticket, a
colleague takes another principal ticket).
I tried using the ipa user-show with the -d flag : ipa -d user-show
<myuser> and I compared the result between one which failed and one which
was successfull.
The difference came at this step :
When it failed :
ipa: DEBUG: approved_usage = SSL Server intended_usage = SSL Server
ipa: DEBUG: cert valid True for "CN=<IPA-MASTER>,O=<MYREALM>"
ipa: DEBUG: handshake complete, peer = <IP>:443
ipa: DEBUG: Protocol: TLS1.2
ipa: DEBUG: Cipher: TLS_RSA_WITH_AES_128_CBC_SHA
ipa: DEBUG: Caught fault 2100 from server
https://<IPA-MASTER>/ipa/session/xml: Insufficient access: SASL(-1):
generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may
provide more information (Ticket expired)
ipa: DEBUG: Destroyed connection context.xmlclient
ipa: ERROR: Insufficient access: SASL(-1): generic failure: GSSAPI
Error: Unspecified GSS failure. Minor code may provide more information
(Ticket expired)
When it succeeds :
ipa: DEBUG: approved_usage = SSL Server intended_usage = SSL Server
ipa: DEBUG: cert valid True for "CN=<IPA-MASTER>,O=<MYREALM>"
ipa: DEBUG: handshake complete, peer = <IP>:<PORT>
ipa: DEBUG: Protocol: TLS1.2
ipa: DEBUG: Cipher: TLS_RSA_WITH_AES_128_CBC_SHA
ipa: DEBUG: received Set-Cookie
'ipa_session=385454761d74afed915a24124ba5ef25; Domain=<IPA-MASTER>;
Path=/ipa; Expires=Wed, 31 Oct 2018 15:57:45 GMT; Secure; HttpOnly'
ipa: DEBUG: storing cookie 'ipa_session=385454761d74afed915a24124ba5ef25;
Domain=<IPA-MASTER>; Path=/ipa; Expires=Wed, 31 Oct 2018 15:57:45 GMT;
Secure; HttpOnly' for principal <myPrincipal>@<MYREALM>
ipa: DEBUG: args=keyctl search @s user
ipa_session_cookie:<myPrincipal>@<MYREALM>
ipa: DEBUG: stdout=485338998
ipa: DEBUG: stderr=
ipa: DEBUG: args=keyctl search @s user
ipa_session_cookie:<myPrincipal>@<MYREALM>
ipa: DEBUG: stdout=485338998
ipa: DEBUG: stderr=
ipa: DEBUG: args=keyctl pupdate 485338998
ipa: DEBUG: stdout=
ipa: DEBUG: stderr=
ipa: DEBUG: Destroyed connection context.xmlclient
So when it works, it sets a session cookie ?
Some information about FreeIPA and cookies :
https://vda.li/en/posts/2015/05/28/talking-to-freeipa-api-with-sessions/
May you help me please ?
As a note, I found a workaround for that. I need to destroy my ticket with
kdestroy and then to disconnect from the server.
Then when I connect back to the server, I take a kerberos ticket and I can
use the rest api.
This problem is really strange, thank you in advance for your help guys.
Lune
3 years, 6 months
FreeIPA/Dogtag - Slow host deletion due to certificate pagination
by Jared Ledvina
Hi folks,
I recently posted a thread to pki-users, https://www.redhat.com/archives/pki-users/2018-December/msg00003.html . Working with 'cipherboy' on IRC in #dogtag-pki, we narrowed the issue down to the searches that Dogtag performs against a VLV index/search. These are being paginated to 2,000 entries. I've since, opened up: https://bugzilla.redhat.com/show_bug.cgi?id=1658280 but, haven't been able to figure out a solution. I'm hoping that someone on this list might be able to troubleshoot further with me on this.
Has anyone looked at this before? So far, I'm unable to determine where the 2,000 paging size is getting set.
The linked bugzilla issue should have a bunch of necessary details but, I'm happy to provide any additional details that might help.
Thanks,
Jared
--
Jared Ledvina
jared(a)techsmix.net
3 years, 6 months
IPA managed autofs mount timeout
by William Muriithi
Evening,
I have done this before but for the life of me, I can't seem to find a way
to undo my previous change.
I am using autofs to mount home directories. The autofs maps are on IPA
server. A while back, I adjusted the mount idle timeout from the default 5
minutes to 2 hours.
I now want to undo the change, essentially bring down the timeout to 5
minutes. I can't however remember how I had increased it and google just
bring up how to adjust locally from /etc/sysconfig/autofs. I recall
vaguely I had done the change from IPA. Anyone who would have this info
without too much googling?
Regards,
William
3 years, 6 months
Versleuteld bericht
by Arjen Heidinga
All,
I am here again bothering with my seemingly borked installation. The
upgrade from 7.0 to 7.2 on fedora 28-29 finished (finaly), when I
spotted in my journal a stacktrace.
Digging into it, this appears to be the cause. all I find in the
internet are ancient (solved) bugs...
It appears that it has something to do with DNSSEC. Perhaps this is a
clue, I do not remember setting this up.
Kind Regards,
Arjen
[root@starkey ~]# /usr/libexec/ipa/ipa-dnskeysync-replica
ipalib.plugable: DEBUG importing all plugin modules in
ipaserver.plugins...
ipalib.plugable: DEBUG importing plugin module ipaserver.plugins.aci
ipalib.plugable: DEBUG importing plugin module
ipaserver.plugins.automember
ipalib.plugable: DEBUG importing plugin module
ipaserver.plugins.automount
ipalib.plugable: DEBUG importing plugin module ipaserver.plugins.baseldap
ipalib.plugable: DEBUG ipaserver.plugins.baseldap is not a valid
plugin module
ipalib.plugable: DEBUG importing plugin module ipaserver.plugins.baseuser
ipalib.plugable: DEBUG importing plugin module ipaserver.plugins.batch
ipalib.plugable: DEBUG importing plugin module ipaserver.plugins.ca
ipalib.plugable: DEBUG importing plugin module ipaserver.plugins.caacl
ipalib.plugable: DEBUG importing plugin module ipaserver.plugins.cert
ipalib.plugable: DEBUG importing plugin module ipaserver.plugins.certmap
ipalib.plugable: DEBUG importing plugin module
ipaserver.plugins.certprofile
ipalib.plugable: DEBUG importing plugin module ipaserver.plugins.config
ipalib.plugable: DEBUG importing plugin module
ipaserver.plugins.delegation
ipalib.plugable: DEBUG importing plugin module ipaserver.plugins.dns
ipalib.plugable: DEBUG importing plugin module
ipaserver.plugins.dnsserver
ipalib.plugable: DEBUG importing plugin module ipaserver.plugins.dogtag
ipalib.plugable: DEBUG importing plugin module
ipaserver.plugins.domainlevel
ipalib.plugable: DEBUG importing plugin module ipaserver.plugins.group
ipalib.plugable: DEBUG importing plugin module ipaserver.plugins.hbac
ipalib.plugable: DEBUG ipaserver.plugins.hbac is not a valid plugin
module
ipalib.plugable: DEBUG importing plugin module ipaserver.plugins.hbacrule
ipalib.plugable: DEBUG importing plugin module ipaserver.plugins.hbacsvc
ipalib.plugable: DEBUG importing plugin module
ipaserver.plugins.hbacsvcgroup
ipalib.plugable: DEBUG importing plugin module ipaserver.plugins.hbactest
ipalib.plugable: DEBUG importing plugin module ipaserver.plugins.host
ipalib.plugable: DEBUG importing plugin module
ipaserver.plugins.hostgroup
ipalib.plugable: DEBUG importing plugin module ipaserver.plugins.idrange
ipalib.plugable: DEBUG importing plugin module ipaserver.plugins.idviews
ipalib.plugable: DEBUG importing plugin module ipaserver.plugins.internal
ipalib.plugable: DEBUG importing plugin module ipaserver.plugins.join
ipalib.plugable: DEBUG importing plugin module
ipaserver.plugins.krbtpolicy
ipalib.plugable: DEBUG importing plugin module ipaserver.plugins.ldap2
ipalib.plugable: DEBUG importing plugin module ipaserver.plugins.location
ipalib.plugable: DEBUG importing plugin module
ipaserver.plugins.migration
ipalib.plugable: DEBUG importing plugin module ipaserver.plugins.misc
ipalib.plugable: DEBUG importing plugin module ipaserver.plugins.netgroup
ipalib.plugable: DEBUG importing plugin module ipaserver.plugins.otp
ipalib.plugable: DEBUG ipaserver.plugins.otp is not a valid plugin module
ipalib.plugable: DEBUG importing plugin module
ipaserver.plugins.otpconfig
ipalib.plugable: DEBUG importing plugin module ipaserver.plugins.otptoken
ipalib.plugable: DEBUG importing plugin module ipaserver.plugins.passwd
ipalib.plugable: DEBUG importing plugin module
ipaserver.plugins.permission
ipalib.plugable: DEBUG importing plugin module ipaserver.plugins.ping
ipalib.plugable: DEBUG importing plugin module ipaserver.plugins.pkinit
ipalib.plugable: DEBUG importing plugin module
ipaserver.plugins.privilege
ipalib.plugable: DEBUG importing plugin module ipaserver.plugins.pwpolicy
ipalib.plugable: DEBUG importing plugin module ipaserver.plugins.rabase
ipalib.plugable: DEBUG ipaserver.plugins.rabase is not a valid plugin
module
ipalib.plugable: DEBUG importing plugin module
ipaserver.plugins.radiusproxy
ipalib.plugable: DEBUG importing plugin module
ipaserver.plugins.realmdomains
ipalib.plugable: DEBUG importing plugin module ipaserver.plugins.role
ipalib.plugable: DEBUG importing plugin module ipaserver.plugins.schema
ipalib.plugable: DEBUG importing plugin module
ipaserver.plugins.selfservice
ipalib.plugable: DEBUG importing plugin module
ipaserver.plugins.selinuxusermap
ipalib.plugable: DEBUG importing plugin module ipaserver.plugins.server
ipalib.plugable: DEBUG importing plugin module
ipaserver.plugins.serverrole
ipalib.plugable: DEBUG importing plugin module
ipaserver.plugins.serverroles
ipalib.plugable: DEBUG importing plugin module ipaserver.plugins.service
ipalib.plugable: DEBUG importing plugin module
ipaserver.plugins.servicedelegation
ipalib.plugable: DEBUG importing plugin module ipaserver.plugins.session
ipalib.plugable: DEBUG importing plugin module
ipaserver.plugins.stageuser
ipalib.plugable: DEBUG importing plugin module ipaserver.plugins.sudo
ipalib.plugable: DEBUG ipaserver.plugins.sudo is not a valid plugin
module
ipalib.plugable: DEBUG importing plugin module ipaserver.plugins.sudocmd
ipalib.plugable: DEBUG importing plugin module
ipaserver.plugins.sudocmdgroup
ipalib.plugable: DEBUG importing plugin module ipaserver.plugins.sudorule
ipalib.plugable: DEBUG importing plugin module ipaserver.plugins.topology
ipalib.plugable: DEBUG importing plugin module ipaserver.plugins.trust
ipalib.plugable: DEBUG importing plugin module ipaserver.plugins.user
ipalib.plugable: DEBUG importing plugin module ipaserver.plugins.vault
ipalib.plugable: DEBUG importing plugin module ipaserver.plugins.virtual
ipalib.plugable: DEBUG ipaserver.plugins.virtual is not a valid
plugin module
ipalib.plugable: DEBUG importing plugin module ipaserver.plugins.whoami
ipalib.plugable: DEBUG importing plugin module
ipaserver.plugins.xmlserver
ipa-dnskeysync-replica: DEBUG Kerberos principal:
ipa-dnskeysyncd/starkey.platypusnet.org
ipalib.install.kinit: DEBUG Initializing principal
ipa-dnskeysyncd/starkey.platypusnet.org using keytab
/etc/ipa/dnssec/ipa-dnskeysyncd.keytab
ipalib.install.kinit: DEBUG using ccache
/tmp/ipa-dnskeysync-replica.ccache
ipalib.install.kinit: DEBUG Attempt 1/5: success
ipa-dnskeysync-replica: DEBUG Got TGT
ipa-dnskeysync-replica: DEBUG Connecting to LDAP
ipa-dnskeysync-replica: DEBUG Connected
Traceback (most recent call last):
File "/usr/libexec/ipa/ipa-dnskeysync-replica", line 179, in <module>
open(paths.DNSSEC_SOFTHSM_PIN).read())
File "/usr/lib/python3.7/site-packages/ipaserver/dnssec/localhsm.py",
line 104, in __init__
self.p11 = _ipap11helper.P11_Helper(label, pin, library)
File "/usr/lib/python3.7/site-packages/ipaserver/p11helper.py", line
866, in __init__
raise Error("No slot for label {} found".format(self.token_label))
ipaserver.p11helper.Error: No slot for label ipaDNSSEC found
Exception ignored in: <function LocalHSM.__del__ at 0x7fd0d6b77158>
Traceback (most recent call last):
File "/usr/lib/python3.7/site-packages/ipaserver/dnssec/localhsm.py",
line 107, in __del__
self.p11.finalize()
AttributeError: 'LocalHSM' object has no attribute 'p11'
3 years, 6 months
Trouble with pki-tomcat
by Arjen Heidinga
Dear all,
I fear somehow my freeipa server is broken. Perhaps it is time to create
a new one, however that would be very time-consuming.
Yesterday everything broke, after FreeIPA was upgraded. It is worth
mentioning that I had certificate issues recently. My root-CA, and
httpd-cert expired.
When I start the tomcat-pki daemon, I get presented the stacktrace
below. Note to mention, the pcscd lines are everytime exactly there when
trying to start.
I'd appreciate it if someone has a clue.
Kind Regards,
Arjen Heidinga
Dec 14 15:31:44 starkey.platypusnet.org systemd[1]: Starting PKI Tomcat
Server pki-tomcat...
-- Subject: Unit pki-tomcatd(a)pki-tomcat.service has begun start-up
-- Defined-By: systemd
-- Support: https://lists.freedesktop.org/mailman/listinfo/systemd-devel
--
-- Unit pki-tomcatd(a)pki-tomcat.service has begun starting up.
Dec 14 15:31:45 starkey.platypusnet.org pki-server[22909]:
----------------------------
Dec 14 15:31:45 starkey.platypusnet.org pki-server[22909]: pki-tomcat
instance migrated
Dec 14 15:31:45 starkey.platypusnet.org pki-server[22909]:
----------------------------
Dec 14 15:31:46 starkey.platypusnet.org pkidaemon[22936]:
-----------------------
Dec 14 15:31:46 starkey.platypusnet.org pkidaemon[22936]: Banner is not
installed
Dec 14 15:31:46 starkey.platypusnet.org pkidaemon[22936]:
-----------------------
Dec 14 15:31:46 starkey.platypusnet.org pkidaemon[22936]:
----------------------
Dec 14 15:31:46 starkey.platypusnet.org pkidaemon[22936]: Enabled all
subsystems
Dec 14 15:31:46 starkey.platypusnet.org pkidaemon[22936]:
----------------------
Dec 14 15:31:46 starkey.platypusnet.org systemd[1]: Started PKI Tomcat
Server pki-tomcat.
-- Subject: Unit pki-tomcatd(a)pki-tomcat.service has finished start-up
-- Defined-By: systemd
-- Support: https://lists.freedesktop.org/mailman/listinfo/systemd-devel
--
-- Unit pki-tomcatd(a)pki-tomcat.service has finished starting up.
--
-- The start-up result is done.
Dec 14 15:31:46 starkey.platypusnet.org audit[1]: SERVICE_START pid=1
uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0
msg='unit=pki-tomcatd@pki-tomcat comm="systemd"
exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
Dec 14 15:31:46 starkey.platypusnet.org server[23062]: Java virtual
machine used: /usr/lib/jvm/jre-1.8.0-openjdk/bin/java
Dec 14 15:31:46 starkey.platypusnet.org server[23062]: classpath used:
/usr/share/tomcat/bin/bootstrap.jar:/usr/share/tomcat/bin/tomcat-juli.jar:/usr/lib/java/commons-daemon.jar
Dec 14 15:31:46 starkey.platypusnet.org server[23062]: main class used:
org.apache.catalina.startup.Bootstrap
Dec 14 15:31:46 starkey.platypusnet.org server[23062]: flags used:
-DRESTEASY_LIB=/usr/share/java/resteasy
-Djava.library.path=/usr/lib64/nuxwdog-jni
Dec 14 15:31:46 starkey.platypusnet.org server[23062]: options used:
-Dcatalina.base=/var/lib/pki/pki-tomcat
-Dcatalina.home=/usr/share/tomcat -Djava.endorsed.dirs=
-Djava.io.tmpdir=/var/lib/pki/pki-tomcat/temp
-Djava.util.logging.config.file=/var/lib/pki/pki-tomcat/conf/logging.properties
-Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager
-Djava.security.manager
-Djava.security.policy==/var/lib/pki/pki-tomcat/conf/catalina.policy
Dec 14 15:31:46 starkey.platypusnet.org server[23062]: arguments used: start
Dec 14 15:31:48 starkey.platypusnet.org pcscd[18754]: 99999999
auth.c:137:IsClientAuthorized() Process 23062 (user: 985) is NOT
authorized for action: access_pcsc
Dec 14 15:31:48 starkey.platypusnet.org pcscd[18754]: 00000420
winscard_svc.c:335:ContextThread() Rejected unauthorized PC/SC client
Dec 14 15:31:48 starkey.platypusnet.org pcscd[18754]: 00029452
auth.c:137:IsClientAuthorized() Process 23062 (user: 985) is NOT
authorized for action: access_pcsc
Dec 14 15:31:48 starkey.platypusnet.org pcscd[18754]: 00000250
winscard_svc.c:335:ContextThread() Rejected unauthorized PC/SC client
Dec 14 15:31:54 starkey.platypusnet.org server[23062]: SEVERE: Unable to
create CMS engine: com.netscape.cmscore.apps.CMSEngine
Dec 14 15:31:54 starkey.platypusnet.org server[23062]:
java.lang.InstantiationException: com.netscape.cmscore.apps.CMSEngine
Dec 14 15:31:54 starkey.platypusnet.org server[23062]: at
java.lang.Class.newInstance(Class.java:427)
Dec 14 15:31:54 starkey.platypusnet.org server[23062]: at
com.netscape.cms.servlet.base.CMSStartServlet.init(CMSStartServlet.java:138)
Dec 14 15:31:54 starkey.platypusnet.org server[23062]: at
javax.servlet.GenericServlet.init(GenericServlet.java:158)
Dec 14 15:31:54 starkey.platypusnet.org server[23062]: at
sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
Dec 14 15:31:54 starkey.platypusnet.org server[23062]: at
sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
Dec 14 15:31:54 starkey.platypusnet.org server[23062]: at
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
Dec 14 15:31:54 starkey.platypusnet.org server[23062]: at
java.lang.reflect.Method.invoke(Method.java:498)
Dec 14 15:31:54 starkey.platypusnet.org server[23062]: at
org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:282)
Dec 14 15:31:54 starkey.platypusnet.org server[23062]: at
org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:279)
Dec 14 15:31:54 starkey.platypusnet.org server[23062]: at
java.security.AccessController.doPrivileged(Native Method)
Dec 14 15:31:54 starkey.platypusnet.org server[23062]: at
javax.security.auth.Subject.doAsPrivileged(Subject.java:549)
Dec 14 15:31:54 starkey.platypusnet.org server[23062]: at
org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:314)
Dec 14 15:31:54 starkey.platypusnet.org server[23062]: at
org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:170)
Dec 14 15:31:54 starkey.platypusnet.org server[23062]: at
org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:123)
Dec 14 15:31:54 starkey.platypusnet.org server[23062]: at
org.apache.catalina.core.StandardWrapper.initServlet(StandardWrapper.java:1132)
Dec 14 15:31:54 starkey.platypusnet.org server[23062]: at
org.apache.catalina.core.StandardWrapper.loadServlet(StandardWrapper.java:1091)
Dec 14 15:31:54 starkey.platypusnet.org server[23062]: at
org.apache.catalina.core.StandardWrapper.load(StandardWrapper.java:983)
Dec 14 15:31:54 starkey.platypusnet.org server[23062]: at
org.apache.catalina.core.StandardContext.loadOnStartup(StandardContext.java:4978)
Dec 14 15:31:54 starkey.platypusnet.org server[23062]: at
org.apache.catalina.core.StandardContext.startInternal(StandardContext.java:5290)
Dec 14 15:31:54 starkey.platypusnet.org server[23062]: at
org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:150)
Dec 14 15:31:54 starkey.platypusnet.org server[23062]: at
org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.java:754)
Dec 14 15:31:54 starkey.platypusnet.org server[23062]: at
org.apache.catalina.core.ContainerBase.access$000(ContainerBase.java:129)
Dec 14 15:31:54 starkey.platypusnet.org server[23062]: at
org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(ContainerBase.java:150)
Dec 14 15:31:54 starkey.platypusnet.org server[23062]: at
org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(ContainerBase.java:140)
Dec 14 15:31:54 starkey.platypusnet.org server[23062]: at
java.security.AccessController.doPrivileged(Native Method)
Dec 14 15:31:54 starkey.platypusnet.org server[23062]: at
org.apache.catalina.core.ContainerBase.addChild(ContainerBase.java:728)
Dec 14 15:31:54 starkey.platypusnet.org server[23062]: at
org.apache.catalina.core.StandardHost.addChild(StandardHost.java:734)
Dec 14 15:31:54 starkey.platypusnet.org server[23062]: at
org.apache.catalina.startup.HostConfig.deployDescriptor(HostConfig.java:629)
Dec 14 15:31:54 starkey.platypusnet.org server[23062]: at
org.apache.catalina.startup.HostConfig$DeployDescriptor.run(HostConfig.java:1839)
Dec 14 15:31:54 starkey.platypusnet.org server[23062]: at
java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)
Dec 14 15:31:54 starkey.platypusnet.org server[23062]: at
java.util.concurrent.FutureTask.run(FutureTask.java:266)
Dec 14 15:31:54 starkey.platypusnet.org server[23062]: at
java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
Dec 14 15:31:54 starkey.platypusnet.org server[23062]: at
java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
Dec 14 15:31:54 starkey.platypusnet.org server[23062]: at
java.lang.Thread.run(Thread.java:748)
Dec 14 15:31:54 starkey.platypusnet.org server[23062]: Caused by:
java.lang.NoSuchMethodException:
com.netscape.cmscore.apps.CMSEngine.<init>()
Dec 14 15:31:54 starkey.platypusnet.org server[23062]: at
java.lang.Class.getConstructor0(Class.java:3082)
Dec 14 15:31:54 starkey.platypusnet.org server[23062]: at
java.lang.Class.newInstance(Class.java:412)
Dec 14 15:31:54 starkey.platypusnet.org server[23062]: ... 33 more
Dec 14 15:31:59 starkey.platypusnet.org kernel: FINAL_REJECT: IN=ens6
OUT= MAC=33:33:00:00:00:01:10:be:f5:b2:f9:00:86:dd
SRC=2a00:0f60:0000:0001:0000:0000:0001:0059
DST=ff02:0000:0000:0000:0000:0000:0000:0001 LEN=377 TC=0 HOPLIMIT=255
FLOWLBL=0 PROTO=UDP SPT=62976 DPT=62976 LEN=337
Dec 14 15:32:04 starkey.platypusnet.org server[23062]: WARNING:
Exception processing realm [com.netscape.cms.tomcat.ProxyRealm@13f78b53]
background process
Dec 14 15:32:04 starkey.platypusnet.org server[23062]:
javax.ws.rs.ServiceUnavailableException: Subsystem unavailable
Dec 14 15:32:04 starkey.platypusnet.org server[23062]: at
com.netscape.cms.tomcat.ProxyRealm.backgroundProcess(ProxyRealm.java:142)
Dec 14 15:32:04 starkey.platypusnet.org server[23062]: at
org.apache.catalina.core.ContainerBase.backgroundProcess(ContainerBase.java:1152)
Dec 14 15:32:04 starkey.platypusnet.org server[23062]: at
org.apache.catalina.core.StandardContext.backgroundProcess(StandardContext.java:5648)
Dec 14 15:32:04 starkey.platypusnet.org server[23062]: at
org.apache.catalina.core.ContainerBase$ContainerBackgroundProcessor.processChildren(ContainerBase.java:1390)
Dec 14 15:32:04 starkey.platypusnet.org server[23062]: at
org.apache.catalina.core.ContainerBase$ContainerBackgroundProcessor.processChildren(ContainerBase.java:1394)
Dec 14 15:32:04 starkey.platypusnet.org server[23062]: at
org.apache.catalina.core.ContainerBase$ContainerBackgroundProcessor.run(ContainerBase.java:1362)
Dec 14 15:32:04 starkey.platypusnet.org server[23062]: at
java.lang.Thread.run(Thread.java:748)
Dec 14 15:32:09 starkey.platypusnet.org
[sssd[ldap_child[23172]]][23172]: Failed to initialize credentials using
keytab [MEMORY:/etc/krb5.keytab]: Cannot contact any KDC for realm
'PLATYPUSNET.ORG'. Unable to create GSSAPI-encrypted LDAP connection.
Dec 14 15:32:09 starkey.platypusnet.org
[sssd[ldap_child[23173]]][23173]: Failed to initialize credentials using
keytab [MEMORY:/etc/krb5.keytab]: Cannot contact any KDC for realm
'PLATYPUSNET.ORG'. Unable to create GSSAPI-encrypted LDAP connection.
Dec 14 15:32:14 starkey.platypusnet.org server[23062]: WARNING:
Exception processing realm [com.netscape.cms.tomcat.ProxyRealm@13f78b53]
background process
Dec 14 15:32:14 starkey.platypusnet.org server[23062]:
javax.ws.rs.ServiceUnavailableException: Subsystem unavailable
Dec 14 15:32:14 starkey.platypusnet.org server[23062]: at
com.netscape.cms.tomcat.ProxyRealm.backgroundProcess(ProxyRealm.java:142)
Dec 14 15:32:14 starkey.platypusnet.org server[23062]: at
org.apache.catalina.core.ContainerBase.backgroundProcess(ContainerBase.java:1152)
Dec 14 15:32:14 starkey.platypusnet.org server[23062]: at
org.apache.catalina.core.StandardContext.backgroundProcess(StandardContext.java:5648)
Dec 14 15:32:14 starkey.platypusnet.org server[23062]: at
org.apache.catalina.core.ContainerBase$ContainerBackgroundProcessor.processChildren(ContainerBase.java:1390)
Dec 14 15:32:14 starkey.platypusnet.org server[23062]: at
org.apache.catalina.core.ContainerBase$ContainerBackgroundProcessor.processChildren(ContainerBase.java:1394)
Dec 14 15:32:14 starkey.platypusnet.org server[23062]: at
org.apache.catalina.core.ContainerBase$ContainerBackgroundProcessor.run(ContainerBase.java:1362)
Dec 14 15:32:14 starkey.platypusnet.org server[23062]: at
java.lang.Thread.run(Thread.java:748)
Dec 14 15:32:24 starkey.platypusnet.org server[23062]: WARNING:
Exception processing realm [com.netscape.cms.tomcat.ProxyRealm@13f78b53]
background process
Dec 14 15:32:24 starkey.platypusnet.org server[23062]:
javax.ws.rs.ServiceUnavailableException: Subsystem unavailable
Dec 14 15:32:24 starkey.platypusnet.org server[23062]: at
com.netscape.cms.tomcat.ProxyRealm.backgroundProcess(ProxyRealm.java:142)
Dec 14 15:32:24 starkey.platypusnet.org server[23062]: at
org.apache.catalina.core.ContainerBase.backgroundProcess(ContainerBase.java:1152)
Dec 14 15:32:24 starkey.platypusnet.org server[23062]: at
org.apache.catalina.core.StandardContext.backgroundProcess(StandardContext.java:5648)
Dec 14 15:32:24 starkey.platypusnet.org server[23062]: at
org.apache.catalina.core.ContainerBase$ContainerBackgroundProcessor.processChildren(ContainerBase.java:1390)
Dec 14 15:32:24 starkey.platypusnet.org server[23062]: at
org.apache.catalina.core.ContainerBase$ContainerBackgroundProcessor.processChildren(ContainerBase.java:1394)
Dec 14 15:32:24 starkey.platypusnet.org server[23062]: at
org.apache.catalina.core.ContainerBase$ContainerBackgroundProcessor.run(ContainerBase.java:1362)
Dec 14 15:32:24 starkey.platypusnet.org server[23062]: at
java.lang.Thread.run(Thread.java:748)
3 years, 6 months