Host vs. service certificates
by Rob Foehl
Are there any practical differences between IPA-issued certificates for
hosts and services (ipa-getcert -K service/hostname for the latter), if
they're only being used to identify the host in a non-Kerberos-aware TLS
context?
I'd like to omit the service management if it's not useful in this case.
-Rob
5 years, 3 months
yubikey csr not working
by Natxo Asenjo
hi,
I am testing smartcard authentication with a yubikey neo like described in
https://frasertweedale.github.io/blog-redhat/posts/2016-08-12-yubikey-sc-...
I successfully generated a key using the yubico-piv-tool, and with that a
csr.
yubico-piv-tool -a verify-pin -a request-certificate -s 9e -S "/CN=user50/"
Enter PIN:
Successfully verified PIN.
-----BEGIN CERTIFICATE REQUEST-----
MIICVjCCAT4CAQAwETEPMA0GA1UEAwwGdXNlcjUwMIIBIjANBgkqhkiG9w0BAQEF
AAOCAQ8AMIIBCgKCAQEAkWjUxl0qInlYB4TiZ7GkJkgBdomTTzk5GfK76ZizbsGV
4xyPmUgf+7eEO3GEvkGiBPJxk0NVJuamuEJTIXtn7h7Wgz6ghCE0uCCupjAJqa57
Hdm3h3GvofwWuE442YIRHvXydaSkrCAGsL/M3g4tVi7Xn+jTaWrzKsAeqJxQVRPD
h4R9bN4BIzXL+62qGI9jriM8dJEWCrGFzg6viCujRlybkhQhiLxCGvS8lO3HQ7tF
lDRZN6Ey/nvFxIC1MtGZgrN3nj/Z37nIBWF4s20CcJau8mfalJQEFjqLkjMh7X8K
hWKrSdNj43nBTlO0So3qezs4roLkZFSN1hQnCG/pCQIDAQABoAAwDQYJKoZIhvcN
AQELBQADggEBAH22PLW7Tuc6y5VxIpnaqdsborbp+Twr/kPoDnibJPjV8JBYqC4G
iQCHDJn+uuJSpiBxTUtYX45CscOiwD8kiDoYIH/DCXUqPAhRudsBpJWDn9TKeFC5
b0PrwuN5cDo+yKYZW590eLL8/xdjtb9p/M3AU5tSJTbG3dCA5Rp4MdgE97pOYkPg
3kUHR19YjH/GnZHeuv8Af+WIJVMvDVGKF+MvJEImSjg/ZQUV6hzBI+oAWr9Hj21q
KABjiO5AhMyo+uC6WXajkltzUP30cbBlNl0Z34Dw452Ym5uILWAF+ZmlT0sp0Mg4
lwNPSwst5mhUtQL7AmNHYHg7cAAgXx9Xql0=
-----END CERTIFICATE REQUEST-----
Successfully generated a certificate request.
With this csr I try generating a certificate but it fails:
$ ipa cert-request user50.csr --principal user50 --raw
ipa: ERROR: Request failed with status 500: Non-2xx response from CA REST
API: 500. Invalid Request
In the pki logs I only see this error.
192.168.5.10 - ipara [08/Nov/2018:22:37:12 +0100] "GET
/ca/rest/authorities/edb13864-3c75-4c7d-b5b8-dd4322789437/cert HTTP/1.1"
200 920
192.168.5.10 - ipara [08/Nov/2018:22:37:12 +0100] "GET
/ca/rest/account/logout HTTP/1.1" 204 -
192.168.5.10 - - [08/Nov/2018:22:37:13 +0100] "POST
/ca/rest/certrequests?issuer-id=edb13864-3c75-4c7d-b5b8-dd4322789437
HTTP/1.1" 500 123
Any ideas as to what is going wrong?
Thanks!
--
Groeten,
natxo
5 years, 3 months
What is the best way to check that host has joined domain from host itself?
by d.iskandarov@gmail.com
Hello,
I'm interested if there is good way to check that host has joined IPA domain and is in good state, i.e. at least users are fetched from DC.
Real story:
I'm registering my nodes with configuration management system (puppet). Host is auto-registering with IPA domain.
But also before node is registered with domain I'm creating localhost users.
When I change anything in "users declaration manifest" which triggers host update and calling usermod, deploy is failing with such error:
> Execution of '/usr/sbin/usermod -p !! john' returned 6: usermod: user 'john' does not exist in /etc/passwd
Because obviously during that second run host has already joined domain and system gets user info from LDAP and not /etc/passwd.
I'm creating "flag" file /root/.ipa-registered which prevents further ipa-client installation and registration steps.
Obviously ipa-client install quite a few packages on the OS which I can check for existence and skip run as well.
I'm interested if there is more programmatic way to test that node is functional in domain, maybe some ipa related tool exists on host which i can execute and get status. Which will allow me to judge if I should touch users on localhost.
Thanks in advance
Denis
5 years, 3 months
pki-tomcatd not starting / wrong internal password
by Christopher Young
So, I did alot of reading after noticing that one of my IPA servers
was not starting correctly. I was working from the guide here:
https://floblanc.wordpress.com/2017/09/11/troubleshooting-freeipa-pki-tom...
(Honestly, THANK YOU to the people contributing to that guide because
it really has been helpful)
I didn't get very far down the guide before testing my NSSDB password
and noticing that it does NOT appear to work. I have no idea how that
may have happened or when but this obviously puts me in a weird spot
with this particular server.
[root@XXXX-prod-ipaXX ca]# cat
/var/lib/pki/pki-tomcat/conf/password.conf | grep internal
internal=<numericstuffs>
I tried using the password there to open the /etc/pki/pki-tomcat/alias
NSS DB with no success. Though, I think my problem is something else.
I get the following error:
----
[root@XXXXX-prod-ipaXX alias]# certutil -K -d
/etc/pki/pki-tomcat/alias -n -r /tmp/pwdfile.txt
certutil: Checking token "NSS Certificate DB" in slot "NSS User
Private Key and Certificate Services"
Enter Password or Pin for "NSS Certificate DB":
certutil: problem listing keys: SEC_ERROR_UNRECOGNIZED_OID:
Unrecognized Object Identifier.
----
I'm just getting into this, but I feel like MAYBE this is part of my
problem. If anyone has any ideas here, I'd be grateful for the help!
ADDED NOTE:
I actually notice that I have this same issue on BOTH IPA servers
which makes me ever more nervous about the situation.
----
[root@XXXXX-prod-ipaXx ~]# sudo certutil -K -d
/etc/pki/pki-tomcat/alias -f /tmp/pwdfile.txt -n 'subsystemCert
cert-pki-ca'
certutil: Checking token "NSS Certificate DB" in slot "NSS User
Private Key and Certificate Services"
certutil: problem listing keys: SEC_ERROR_UNRECOGNIZED_OID:
Unrecognized Object Identifier.
----
Any thoughts? Many thanks in advance!
-- Chris
5 years, 3 months
Help me set up FreeIPA in an internal network that will eventually be moved to the outside world
by Ramesh Balaji
I have a domain already. I just want to test it inside my internal network, and I do not have virtual machines or CentOS servers at my disposal. I have tried to get the server to resolve either ipa.example.com or ipa.mydomain.com . First, my Ubuntu server is having issues installing freeipa-server because the package's postinstall script returns an error status (1 to be precise). If I try to set up freeipa after that package install fails with ipa-server-install --allow-zone-mismatch. It works until the 24th step of the 28th step (don't have the full logs; the first step of this part is something to do with CA certificates) at which point it says
ipapython.admintool: ERROR cannot connect to 'https://ipa.mydomain.com:8443/ca/rest/account/login': [Errno 111] Connection refused.
I can actually wget this URL from the same server once the installer quits, I just get a 401 error (which is probably due to a lack of credentials that FreeIPA would provide when it requests this). I cannot and will not be opening this server to the outside world when I first configure it for security reasons. How can I first set up this server on my LAN, and actually figure out how to use FreeIPA before I open it up to the world?
Did I write this in the wrong place? Let me know and I will move it. Thanks in advance.
5 years, 3 months
Re: Jenkins integration?
by Peter Oliver
On Sat, 11 Feb 2017, Alexander Bokovoy wrote:
> On la, 11 helmi 2017, Michael Ströder wrote:
>
> > Jenkins' LDAP integration is pretty good and flexible. I made it work with various LDAP
> > servers in customer projects. I did not have do that with FreeIPA yet but I'd be very
> > surprised if it doesn't work.
> >
> > (Personally I'd avoid going through PAM.)
>
> Any specific reason for not using pam_sss? Remember, with SSSD involved
> you get also authentication for trusted users from Active Directory
> realms. You don't get that with generic LDAP way. Also, you'd be more
> efficient in terms of utilising LDAP connections.
Having come across this old thread whilst setting this up myself, it turns out that one possible reason would be that Jenkins’ LDAP plugin provides the user’s display name and email address to Jenkins, whereas its PAM plugin does not.
I’m sure that the PAM plugin could be improved to provide the display name straightforwardly enough, but providing the email address would presumably require a new plugin that fetched the additional details over D-Bus.
--
Peter Oliver
5 years, 3 months