Add second hostname in FreeIPA CA
by Peter Tselios
Hello everyone,
I have 2 FreeIPA servers in AWS and a LB in front of them to serve the UI and the LDAP (just the gui and just the LDAP. For Kerberos, we use DNS discovery).
My problem is that I cannot use TLS with LDAP connections because the CA does not have the LB's name in SAN.
Is there any way to **add** in the CA certificate the additional hostname?
3 years, 6 months
dyndb-ldap - Default idnsAllowTransfer not using global option
by Bryan Mesich
Hello,
This is more of a bind-dyndb-ldap question, but documentation pointed me
here when asking questions. I'm using the RHEL7.6 supplied version of
Bind and bind-dyndb-ldap. Versions are:
bind-dyndb-ldap-11.1-4.el7
bind-9.9.4-72.el7
I'm also using an up-stream version of OpenLDAP (2.4.44). I'm having
trouble with the idnsAllowTransfer attribute. Specifically, a zone will
not default to the global "allow-transfer" option. Explicitly setting
idnsAllowTransfer attribute in the the zone fixes the problem, but the
documentation for idnsAllowTransfer states:
"If not set then zone inherits global allow-transfer from named.conf."
Not specifying idnsAllowQuery properly defaults to the global
allow-query list in named.conf. Not sure if its a bug, or just
out-of-date documentation. A point in the right direction would be
appreciated.
Cheers,
Bryan
--
Bryan Mesich
Sr. System Administrator
DIGI-KEY ELECTRONICS
701 Brooks Ave. South
Thief River Falls, MN 56701 USA
3 years, 6 months
Connecting an Cisco ISE Radius Server with FreeIPA
by Nikolaos Hatzepanagiotides
Dear Community,
first of all, thank you for that great developing!
Like the subject say, I try to connect a Radius Server which is on my Cisco ISE.
I want to use MsChapV2 for Authentication.
But I can't find a real manual on how to connect a radius server with freeIPA.
Just the FreeRadius manuals which I can't apply on my setup.
Do you have a manual on setting up freeipa to use the radius.
I already did a ipa-adtrust-install and added the Radius-Server (ISE) with FQDN with the command: ipa service-add 'radius/FQDN' and ipa service-add-host --hosts=FQDN radius/FQDN
and ipa role-add-member --hosts=FQDN
But i think this is not all i have to do in order to work with the radius server.
My Question is also: Do I have to create a keytab from my Radius-Server (ISE) and put it no ipa.
Something like in this guide shown?
http://ilcofon.net/index.php/2018/01/05/wifi-authenticate-with-radius-and...
ipa-getkeytab -p- 'radius/FQDN-RADIUS' -s FQDN-IPA -k /root/radius.keytab
(By the way: Sorry for my bad english, I hope you can read it.)
Thanks in advance!
Best Regards
Nikoalos Hatzepanagiotides
3 years, 6 months
FreeIPA with Radius Server (Cisco ISE)
by Nikolaos Hatzipanagiotidis
Dear Community,
thank you for joining the Community!
I am struggeling on connecting my FreeIPA with an Cisco ISE Radius Server.
I want to use MsChapV2 for Authentication.
But I can't find a real manual on how to connect a radius server with
freeIPA.
Just the FreeRadius manuals which I can't apply on my setup.
Do you have a manual on setting up freeipa to use the radius.
I already did a ipa-adtrust-install and added the Radius-Server (ISE) with
FQDN with the command: ipa service-add 'radius/FQDN' and ipa
service-add-host --hosts=FQDN radius/FQDN
and ipa role-add-member --hosts=FQDN
But i think this is not all i have to do in order to work with the radius
server.
My Question is also: Do I have to create a keytab from my Radius-Server
(ISE) and put it no ipa.
Something like in this guide shown?
http://ilcofon.net/index.php/2018/01/05/wifi-authenticate-with-radius-and...
*ipa-getkeytab -p- 'radius/FQDN-RADIUS' -s FQDN-IPA -k /root/radius.keytab *
(By the way: Sorry for my bad english, I hope you can read it.)
Thanks in advance!
Best Regards
Nikoalos Hatzepanagiotides
3 years, 6 months
Re: ipa-replica-install error migrating CentOS 6 to 7
by Florence Blanc-Renaud
On 12/5/18 3:12 PM, Marc Wiatrowski wrote:
> hello flo,
>
> I attached the log to only you... Wasn't sure if there was anything in
> there that wasn't ok to go to the whole list.
>
Hi Marc,
(adding the list in cc)
indeed the error happens in a code path that wasn't fixed. Could you
open a new pagure ticket (https://pagure.io/freeipa/new_issue)? Please
attach the end of the logs, after the line
[28/41]: setting up initial replication
(you can replace your domain name with XX).
thanks,
flo
> thanks for looking!
> Marc
>
> On Wed, Dec 5, 2018 at 3:55 AM Florence Blanc-Renaud <flo(a)redhat.com
> <mailto:flo@redhat.com>> wrote:
>
> On 12/4/18 9:55 PM, Marc Wiatrowski via FreeIPA-users wrote:
> > I'm trying to migrate a CentOS 6 IPA setup to CentOS 7. Both
> are fully
> > updated CentOS 6.10 (ipa-server-3.0.0-51) and CentOS 7.6
> > (ipa-server-4.6.4-10)
> >
> > I've been following:
> >
> https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/...
> >
> > I ran copy-schema-to-ca.py on centos6 and created the replica
> info file
> > without any issues. But then:
> >
> > [root@centos7]$ ipa-replica-install
> > /var/lib/ipa/replica-info-centos7.gpg --setup-ca --ip-address
> > 192.168.1.1 --setup-dns --no-forwarders
> > Directory Manager (existing master) password:
> >
> > Run connection check to master
> > admin(a)DOMAIN.NET <mailto:admin@DOMAIN.NET>
> <mailto:admin@DOMAIN.NET <mailto:admin@DOMAIN.NET>> password:
> > Connection check OK
> > Adding [192.168.1.1 centos7.domain.net
> <http://centos7.domain.net> <http://centos7.domain.net>] to
> > your /etc/hosts file
> > Configuring NTP daemon (ntpd)
> > [1/4]: stopping ntpd
> > [2/4]: writing configuration
> > [3/4]: configuring ntpd to start on boot
> > [4/4]: starting ntpd
> > Done configuring NTP daemon (ntpd).
> > Configuring directory server (dirsrv). Estimated time: 30 seconds
> > [1/41]: creating directory server instance
> > [2/41]: enabling ldapi
> > ....
> > [27/41]: ignore time skew for initial replication
> > [28/41]: setting up initial replication
> > [error] DatabaseError: Server is unwilling to perform:
> modification
> > of attribute nsds5replicabinddngroupcheckinterval is not allowed in
> > replica entry
> > Your system may be partly configured.
> > Run /usr/sbin/ipa-server-install --uninstall to clean up.
> >
> > ipapython.admintool: ERROR Server is unwilling to perform:
> > modification of attribute nsds5replicabinddngroupcheckinterval is
> not
> > allowed in replica entry
> > ipapython.admintool: ERROR The ipa-replica-install command
> failed.
> > See /var/log/ipareplica-install.log for more information
> >
> > centos6:/var/log/dirsrv/slapd/errors:
> > [04/Dec/2018:14:58:13 -0500] NSMMReplicationPlugin -
> > replica_config_modify: modification of attribute
> > nsds5replicabinddngroupcheckinterval is not allowed in replica entry
> >
> > The ipareplica-install.log contains the same errors at the end.
> I have
> > googled and seen similar issues but the solutions span from fixed
> > already in a previous release to not having an answer in the
> thread. It
> > appears CentOS 6 shouldn't have this attribute and that should be
> ok?
> > but fails all the same.
> >
> > Any suggestions?
> Hi Marc,
>
> can you provide the full content of ipareplica-install.log? The exact
> stack trace will help me check if we forgot some places when fixing the
> issue.
>
> Thanks,
> flo
> > Thank you in advance,
> > Marc
> >
> > _______________________________________________
> > FreeIPA-users mailing list --
> freeipa-users(a)lists.fedorahosted.org
> <mailto:freeipa-users@lists.fedorahosted.org>
> > To unsubscribe send an email to
> freeipa-users-leave(a)lists.fedorahosted.org
> <mailto:freeipa-users-leave@lists.fedorahosted.org>
> > Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
> > List Guidelines:
> https://fedoraproject.org/wiki/Mailing_list_guidelines
> > List Archives:
> https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
> >
>
3 years, 6 months
Installation Replica reports error: Full PKINIT configuration did not succeed
by 74cmonty
Hi,
after completing master installation I started setup of replica.
This means I first enrolled the replica server as a client and then executed this command:
ipa-replica-install
The installation log reports this error:
Full PKINIT configuration did not succeed
The setup will only install bits essential to the server functionality
You can enable PKINIT after the setup completed using 'ipa-pkinit-manage'
Is this an error or normal behavior of replica installation?
Configuring certificate server (pki-tomcatd)
[1/2]: configure certmonger for renewals
[2/2]: Importing RA key
Done configuring certificate server (pki-tomcatd).
Configuring Kerberos KDC (krb5kdc)
[1/1]: installing X509 Certificate for PKINIT
Full PKINIT configuration did not succeed
The setup will only install bits essential to the server functionality
You can enable PKINIT after the setup completed using 'ipa-pkinit-manage'
Done configuring Kerberos KDC (krb5kdc).
Applying LDAP updates
Upgrading IPA:. Estimated time: 1 minute 30 seconds
[1/10]: stopping directory server
[2/10]: saving configuration
[3/10]: disabling listeners
[4/10]: enabling DS global lock
[5/10]: disabling Schema Compat
[6/10]: starting directory server
[7/10]: upgrading server
[8/10]: stopping directory server
[9/10]: restoring configuration
[10/10]: starting directory server
Done.
Finalize replication settings
Restarting the KDC
3 years, 6 months
Samba integration
by Николай Савельев
Hello.
I try to set up samba with freeipa.
I use this article https://www.freeipa.org/page/Howto/Integrating_a_Samba_File_Server_With_IPA
But I have strange error:
дек 10 13:48:58 nfs.fs.lan smbd[14242]: [2018/12/10 13:48:58.758419, 0] ../source3/auth/auth_util.c:1372(make_new_session_info_guest)
дек 10 13:48:58 nfs.fs.lan smbd[14242]: create_local_token failed: NT_STATUS_NO_MEMORY
дек 10 13:48:58 nfs.fs.lan smbd[14242]: [2018/12/10 13:48:58.758577, 0] ../source3/smbd/server.c:1993(main)
дек 10 13:48:58 nfs.fs.lan smbd[14242]: ERROR: failed to setup guest info.
дек 10 13:48:58 nfs.fs.lan systemd[1]: smb.service: main process exited, code=exited, status=255/n/a
дек 10 13:48:58 nfs.fs.lan systemd[1]: Failed to start Samba SMB Daemon.
What does it mean?
--
С уважением, Николай.
3 years, 6 months
How to prevent non-admin users of FreeIPA from reading the list of users in the web interface?
by cdknight
When a user signs in to FreeIPA, I do not want them to be able to view the list of users in my LDAP server under the "Active users" link. I still want them to be able to administer self-service, so they can reset their password, add OTP tokens, etc. How would I go about doing this? The users will only be able to access the web interface, so it doesn't matter whether they can access it from other sources.
3 years, 6 months
client ldap issue
by Jaroslav Shejbal
Hi everyone,
I am pretty new to freeipa and i like it a lot but I have one problem which I cannot solve I am using ipa-server (freeipa-server) on ubuntu 18.10 and ipa-clients debian 9, so I am not using ipa-client package only nscd & sssd and configuration. All clients are successfully enrolled provided with keytab file. Some clients works fine and it looks like this (in /var/log/auth.log):
Nov 26 17:54:02 ipa krb5kdc[1345]: AS_REQ (8 etypes {18 17 20 19 16 23 25 26}) AA.BB.CC.DD: NEEDED_PREAUTH: host/some-working-host.domain.com(a)DOMAIN.COM for krbtgt/DOMAIN.COM(a)DOMAIN.COM, Additional pre-authentication required
Nov 26 17:54:02 ipa krb5kdc[1345]: AS_REQ (8 etypes {18 17 20 19 16 23 25 26}) AA.BB.CC.DD: ISSUE: authtime 1543254842, etypes {rep=18 tkt=18 ses=18}, host/some-working-host.domain.com(a)DOMAIN.COM for krbtgt/DOMAIN.COM(a)DOMAIN.COM
Nov 26 17:54:02 ipa krb5kdc[1345]: TGS_REQ (8 etypes {18 17 20 19 16 23 25 26}) AA.BB.CC.DD: ISSUE: authtime 1543254842, etypes {rep=18 tkt=18 ses=18}, host/some-working-host.domain.com(a)DOMAIN.COM for ldap/ipa.domain.com(a)DOMAIN.COM
and some are not provided with the ldap line:
Nov 26 18:12:51 ipa krb5kdc[1345]: AS_REQ (8 etypes {18 17 20 19 16 23 25 26}) AA.BB.CC.DD: NEEDED_PREAUTH: host/some-not-working-host.domain.com(a)DOMAIN.COM for krbtgt/DOMAIN.COM(a)DOMAIN.COM, Additional pre-authentication required
Nov 26 18:12:51 ipa krb5kdc[1345]: AS_REQ (8 etypes {18 17 20 19 16 23 25 26}) AA.BB.CC.DD: ISSUE: authtime 1543255971, etypes {rep=18 tkt=18 ses=18}, host/some-not-working-host.domain.com(a)DOMAIN.COM for krbtgt/DOMAIN.COM(a)DOMAIN.COM
(lines with "closing down fd 12" was omitted, also hostnames IPs and domains was replaced)
I've checked DNS settings, time difference and various logs but with no success. I've also try to remove rm -f /var/lib/sss/db/* and reinstall client packages.
Do you have any idea where and what should I look for regarding this issue?
3 years, 6 months