Certificates renewing with the wrong Subject
by Roderick Johnstone
Hi
Our freeipa certificates need to be renewed due to passing their expiry
dates.
While some certificates have renewed ok, the ipaCert and
auditSigningCert are renewing but the new certificates have the wrong
Subject.
Environment is:
serverA (CRL, first, master) RHEL 7.3, ipa 4.4
serverB (replica) RHEL 7.3, ipa 4.4
serverC (replica) RHEL 7.4, ipa 4.5
Once there are renewed certificates with the wrong Subject present,
there are various problems with renewing the remaining certificates,
which I think might be related to the bad Subject:
1) When just ipaCert has the wrong subject no further renewals happen
2) When auditSigningCert has the wrong subject the ipa pki-tomcatd
service will not start and no further renewals happen.
I've been round the following loop many times on ServerA, our first master:
1) Restore good certificates from backup
2) Put the clock back to a time when certificates are all valid
3) Resubmit certificates for renewal
Each time the ipaCert renews it has the same wrong Subject. The wrong
Subject includes the host name of one of our ipa client systems.
Each time the auditSigningCert renews it has the same wrong Subject but
a different subject to the ipaCert. The wrong Subject in this case
includes the host name of a system which has never been an ipa client,
but might have been added and removed with ipa host-add and ipa host-del
for testing something, a while ago.
As far as I can see, the "cert_subject" is set correctly in the file
/var/lib/certmonger/<request id> until the point at which the
certificate is actually renewed.
I'd be very grateful for some pointers as to which configuration options
and logs to check through to resolve this problem on our production system.
If its of any relevance we did change which server is the first master
some time ago.
Thanks
Roderick Johnstone
5 years, 8 months
ipa-client-install - error - Failed to obtain host TGT: Major (851968)
by lejeczek
hi everyone
I'm trying a client, when I do:
$ ipa-client-install --no-ntp --force-join
Discovery was successful!
...
Also note that following ports are necessary for ipa-client
working properly after enrollment:
TCP: 464
UDP: 464, 123 (if NTP enabled)
Failed to obtain host TGT: Major (851968): Unspecified GSS
failure. Minor code may provide more information, Minor
(2529638936): Preauthentication failed
Installation failed. Rolling back changes.
-- end
At server's end(one single server in domain):
..
Jan 06 15:00:42 swir.priv.xx.xx.priv.xx.xx.x
krb5kdc[1560685](info): closing down fd 11
Jan 06 15:00:42 swir.priv.xx.xx.priv.xx.xx.x
krb5kdc[1560686](info): AS_REQ (8 etypes {18 17 20 19 16 23
25 26}) 10.5.6.17: NEEDED_PREAUTH:
host/dzien.priv.xx.xx.priv.xx.xx.x(a)PRIVATE.xx.xx.PRIVATE.xx.xx.x
for
krbtgt/PRIVATE.xx.xx.PRIVATE.xx.xx.x(a)PRIVATE.xx.xx.PRIVATE.xx.xx.x,
Additional pre-authentication required
Jan 06 15:00:42 swir.priv.xx.xx.priv.xx.xx.x
krb5kdc[1560686](info): closing down fd 11
Jan 06 15:00:42 swir.priv.xx.xx.priv.xx.xx.x
krb5kdc[1560686](info): preauth (encrypted_timestamp) verify
failure: Preauthentication failed
Jan 06 15:00:42 swir.priv.xx.xx.priv.xx.xx.x
krb5kdc[1560686](info): AS_REQ (8 etypes {18 17 20 19 16 23
25 26}) 10.5.6.17: PREAUTH_FAILED:
host/dzien.priv.xx.xx.priv.xx.xx.x(a)PRIVATE.xx.xx.PRIVATE.xx.xx.x
for
krbtgt/PRIVATE.xx.xx.PRIVATE.xx.xx.x(a)PRIVATE.xx.xx.PRIVATE.xx.xx.x,
Preauthentication failed
Jan 06 15:00:42 swir.priv.xx.xx.priv.xx.xx.x
krb5kdc[1560686](info): closing down fd 11
Jan 06 15:02:23 swir.priv.xx.xx.priv.xx.xx.x
krb5kdc[1560681](info): AS_REQ (8 etypes {18 17 20 19 16 23
25 26}) 10.5.6.17: NEEDED_PREAUTH:
admin(a)PRIVATE.xx.xx.PRIVATE.xx.xx.x for
krbtgt/PRIVATE.xx.xx.PRIVATE.xx.xx.x(a)PRIVATE.xx.xx.PRIVATE.xx.xx.x,
Additional pre-authentication required
Jan 06 15:02:23 swir.priv.xx.xx.priv.xx.xx.x
krb5kdc[1560681](info): closing down fd 11
Jan 06 15:02:23 swir.priv.xx.xx.priv.xx.xx.x
krb5kdc[1560686](info): AS_REQ (8 etypes {18 17 20 19 16 23
25 26}) 10.5.6.17: ISSUE: authtime 1515250943, etypes
{rep=18 tkt=18 ses=18}, admin(a)PRIVATE.xx.xx.PRIVATE.xx.xx.x
for
krbtgt/PRIVATE.xx.xx.PRIVATE.xx.xx.x(a)PRIVATE.xx.xx.PRIVATE.xx.xx.x
Jan 06 15:02:23 swir.priv.xx.xx.priv.xx.xx.x
krb5kdc[1560686](info): closing down fd 11
Jan 06 15:02:23 swir.priv.xx.xx.priv.xx.xx.x
krb5kdc[1560686](info): TGS_REQ (8 etypes {18 17 20 19 16 23
25 26}) 10.5.6.17: ISSUE: authtime 1515250943, etypes
{rep=18 tkt=18 ses=18}, admin(a)PRIVATE.xx.xx.PRIVATE.xx.xx.x
for
ldap/swir.priv.xx.xx.priv.xx.xx.x(a)PRIVATE.xx.xx.PRIVATE.xx.xx.x
Jan 06 15:02:23 swir.priv.xx.xx.priv.xx.xx.x
krb5kdc[1560686](info): closing down fd 11
Jan 06 15:02:23 swir.priv.xx.xx.priv.xx.xx.x
krb5kdc[1560686](info): TGS_REQ (8 etypes {18 17 20 19 16 23
25 26}) 10.5.6.17: ISSUE: authtime 1515250943, etypes
{rep=18 tkt=18 ses=18}, admin(a)PRIVATE.xx.xx.PRIVATE.xx.xx.x
for
HTTP/swir.priv.xx.xx.priv.xx.xx.x(a)PRIVATE.xx.xx.PRIVATE.xx.xx.x
-- end
But after many tries(randomly) suddenly it would succeed.
Client said to use --force-join.
VERSION: 4.5.0, API_VERSION: 2.228
What can a problem?
regards, L.
6 years
FreeIPA PKI with OpenVPN
by Mike Kelly
Hi,
I'm looking to use FreeIPA's PKI for OpenVPN... any pointers on the right
way to generate per-user certificates? (Looking to generate certs for
Android and Chrome OS, so I don't have an easy way to build a CSR on those
devices directly that I can find; I assume I want to just generate the cert
& key on the IPA server, copy it securely, then nuke the private key, and
place the public key somewhere for OpenVPN to find?
--
Mike Kelly
6 years
Auto create NFS home folders on IPA Server.
by TomK
Hey Guy's,
For newly added AD or IPA users, is there a way to automatically create
the user folders on the FreeIPA server under say /nfs/home/bill, for
example so that when the remote client logs in, it sees the NFS mounted
folder?
Instructions that I can find right now require precreating the folders.
Need them precreated via the FreeIPA master servers anytime someone
attempts to login on a client using their AD credentials. Is this
possible? Assume the NFS server will be local to the FreeIPA masters.
Found steps like the one below but step 5) still requires pre creation
of the folders.
https://www.redhat.com/archives/freeipa-users/2016-May/msg00380.html
https://serverfault.com/questions/705039/how-to-automate-directory-creati...
--
Cheers,
Tom K.
-------------------------------------------------------------------------------------
Living on earth is expensive, but it includes a free trip around the sun.
6 years, 1 month
Backup idea of disaster
by barrykfl@gmail.com
Hi all:
any one has better solution of freeipa backup ? assume all ldap db crash
,all ca fail, no backup of cert ...etc but need cleanly install one with
same hostname.
and we have /usr/sbin/ipa-backup ldif backup .
Can I use an old image but restore back ldif such backup?
or any better solution for clean install with this ldif copy.
6 years, 1 month
there must be a simple answer? Replication issues
by Kat
Ok, here I go again - this does not make sense. Looking at this
topology - but for a moment, ignore IPAP1, as that is the one I an
trying to add:
The problem is - IPAC1 is on the other side of a firewall from IPAP1,
and only IPAC is permitted to talk to it, but that should not be a problem.
When I add IPAP1 in as a replica, it gets as far as:
Continue? [no]: yes
Run connection check to master
Connection check OK
Configuring NTP daemon (ntpd)
[1/4]: stopping ntpd
[2/4]: writing configuration
[3/4]: configuring ntpd to start on boot
[4/4]: starting ntpd
Done configuring NTP daemon (ntpd).
Configuring directory server (dirsrv). Estimated time: 30 seconds
[1/40]: creating directory server instance
[2/40]: enabling ldapi
[3/40]: configure autobind for root
[4/40]: stopping directory server
[5/40]: updating configuration in dse.ldif
[6/40]: starting directory server
[7/40]: adding default schema
[8/40]: enabling memberof plugin
[9/40]: enabling winsync plugin
[10/40]: configuring replication version plugin
[11/40]: enabling IPA enrollment plugin
[12/40]: configuring uniqueness plugin
[13/40]: configuring uuid plugin
[14/40]: configuring modrdn plugin
[15/40]: configuring DNS plugin
[16/40]: enabling entryUSN plugin
[17/40]: configuring lockout plugin
[18/40]: configuring topology plugin
[19/40]: creating indices
[20/40]: enabling referential integrity plugin
[21/40]: configuring certmap.conf
[22/40]: configure new location for managed entries
[23/40]: configure dirsrv ccache
[24/40]: enabling SASL mapping fallback
[25/40]: restarting directory server
[26/40]: creating DS keytab
[27/40]: setting up initial replication
Starting replication, please wait until this has completed.
Update in progress, 3 seconds elapsed
Update succeeded
[28/40]: adding sasl mappings to the directory
[29/40]: updating schema
[30/40]: setting Auto Member configuration
[31/40]: enabling S4U2Proxy delegation
[32/40]: initializing group membership
[33/40]: adding master entry
[34/40]: initializing domain level
[35/40]: configuring Posix uid/gid generation
[36/40]: adding replication acis
[37/40]: activating sidgen plugin
[38/40]: activating extdom plugin
[39/40]: tuning directory server
[40/40]: configuring directory to start on boot
Done configuring directory server (dirsrv).
Configuring Kerberos KDC (krb5kdc)
[1/5]: configuring KDC
[2/5]: adding the password extension to the directory
[3/5]: creating anonymous principal
[4/5]: starting the KDC
[5/5]: configuring KDC to start on boot
Done configuring Kerberos KDC (krb5kdc).
Configuring kadmin
[1/2]: starting kadmin
[2/2]: configuring kadmin to start on boot
Done configuring kadmin.
Configuring directory server (dirsrv)
[1/3]: configuring TLS for DS instance
[2/3]: importing CA certificates from LDAP
[3/3]: restarting directory server
Done configuring directory server (dirsrv).
Configuring the web interface (httpd)
[1/22]: stopping httpd
[2/22]: setting mod_nss port to 443
[3/22]: setting mod_nss cipher suite
[4/22]: setting mod_nss protocol list to TLSv1.0 - TLSv1.2
[5/22]: setting mod_nss password file
[6/22]: enabling mod_nss renegotiate
[7/22]: disabling mod_nss OCSP
[8/22]: adding URL rewriting rules
[9/22]: configuring httpd
[10/22]: setting up httpd keytab
[11/22]: configuring Gssproxy
[12/22]: setting up ssl
[13/22]: configure certmonger for renewals
[14/22]: importing CA certificates from LDAP
[15/22]: publish CA cert
[16/22]: clean up any existing httpd ccaches
[17/22]: configuring SELinux for httpd
[18/22]: create KDC proxy config
[19/22]: enable KDC proxy
[20/22]: starting httpd
[21/22]: configuring httpd to start on boot
[22/22]: enabling oddjobd
Done configuring the web interface (httpd).
Configuring ipa-otpd
[1/2]: starting ipa-otpd
[2/2]: configuring ipa-otpd to start on boot
Done configuring ipa-otpd.
Configuring ipa-custodia
[1/4]: Generating ipa-custodia config file
[2/4]: Generating ipa-custodia keys
[3/4]: starting ipa-custodia
[4/4]: configuring ipa-custodia to start on boot
Done configuring ipa-custodia.
Your system may be partly configured.
Run /usr/sbin/ipa-server-install --uninstall to clean up.
ipa.ipapython.install.cli.install_tool(CompatServerReplicaInstall):
ERROR Timed out trying to obtain keys.
ipa.ipapython.install.cli.install_tool(CompatServerReplicaInstall):
ERROR The ipa-replica-install command failed. See
/var/log/ipareplica-install.log for more information
and the ipareplica-install.log shows:
2018-02-28T11:52:23Z INFO Waiting up to 300 seconds to see our keys
appear on host: ipac1
2018-02-28T11:54:30Z DEBUG Transient error getting keys: '{'desc':
"Can't contact LDAP server"}'
2018-02-28T11:58:47Z DEBUG The ipa-replica-install command failed,
exception: RuntimeError: Timed out trying to obtain keys.
2018-02-28T11:58:47Z ERROR Timed out trying to obtain keys.
2018-02-28T11:58:47Z ERROR The ipa-replica-install command failed. See
/var/log/ipareplica-install.log for more information
and yet:
# ipactl status
Directory Service: RUNNING
krb5kdc Service: RUNNING
kadmin Service: RUNNING
httpd Service: RUNNING
ipa-custodia Service: RUNNING
ntpd Service: RUNNING
ipa-otpd Service: RUNNING
ipa: INFO: The ipactl command was successful
AND if I add a user on the far end server - ipac1 - it shows up
immediately on ipap1.
But, if I try to restart IPAP1 -
# ipactl restart
Upgrade required: please run ipa-server-upgrade command
Aborting ipactl
[root@ipap1 ~]# ipactl status
Directory Service: RUNNING
krb5kdc Service: RUNNING
kadmin Service: RUNNING
httpd Service: RUNNING
ipa-custodia Service: RUNNING
ntpd Service: RUNNING
ipa-otpd Service: RUNNING
ipa: INFO: The ipactl command was successful
So I know something is wrong and I can't leave it this way, but I just
don't see what is going on here - can SOMEONE point me in the right
direction, please? I don't understand why it won't just rely on IPAP
which is the server it is connected to.
thank you,
Kat
6 years, 1 month
seeking advice, especially from universities....
by Amos
Apologies if this post is slightly off-topic, but I'd really like to pick
some brains....
Currently, we have two, main LDAP directory environments: AD and a cluster
of Solaris LDAP servers. The accounts are unified, and are managed via
Microsoft Identity Manager (with a connector for updating Solaris LDAP.)
We have hundreds of *nix hosts across campus, increasingly RHEL 7.{3,4},
but also Centos, and some Solaris 10, 11. These *nix boxes get naming
services from the Solaris LDAP servers. We have a handful of home
directory servers across campus. The Microsoft Identity Manager has rules
in it to define the LDAP:homeDirectory and AD:unixHomeDirectory fields
based on the person's department, etc. DNS/DHCP/IPAM is managed by an
Infoblox grid.
We are tasked with unifying our LDAP directory infrastructure, and
phasing-out the Solaris LDAP servers. I've been studying the documentation
for RedHat-IdM/FreeIPA, with the intention of setting up RH-IdM to have a
trust relationship with AD, with AD being primary for all account data. It
seems pretty clear to me that we have to populate the POSIX attributes into
AD (already doing), then replicate those values to the global catalog (not
done yet.) There's some reluctance to a) continue populating the POSIX
attributes into AD, and b) replicating those values to the global catalog.
The Windows team is concerned about attribute bloat, which I understand.
So, I was hoping to learn the following (feel free to reply directly to me):
1. How many folks have faced such a transition, and what was your approach?
2. I see RH-IdM can import data from our Sun/Solaris LDAP servers. If
we're planning on setting up a (one-way) trust with the AD servers, is
there any point in importing the Sun/Solaris LDAP data?
3. So that the UID/GID do not change across campus, do you recommend
populating the POSIX attributes in AD, and promoting those values to the
global catalog, then configure RH-IdM to use those POSIX values from AD?
(Though, perhaps we don't need AD:UIDNumber and AD:GIDNumber if we import
our current data from Sun/Solaris LDAP, then let IPA generate those values
going forward?)
4. Since legacy clients (including our Solaris 10 and Solaris 11 systems)
will not support HBAC, are there any recommendations on how to restrict
access to such systems? (I wrote a PAM module many years ago to achieve
that, but currently it relies on custom attributes in our Sun LDAP, and I
see that custom objectclasses/attributes will not be allowed to be loaded
into RH-IdM, so have to come up with something different.)
5. How successful was your migration to this new topology?
6. Did you learn anything during the transition that would lead you to do
it differently?
Thanks in advance!
Amos
6 years, 1 month
Large DNS zone
by Sigbjorn Lie
Hi list,
I have recently imported a DNS zone into IPA, having just over 14 000 records in the DNS zone. When trying to list the records in the webui, there an error message is displayed "Search result has been truncated: Configured administrative server limit exceeded”. I expected this with such a large DNS zone, and the "Search time limit” and "Search size limit” set to default.
What I didn’t expect, was when trying to search for a subset of records, the same erors are displayed. The same error appear in both the webui and the CLI using “ipa dnsrecord-find”. Some records show, other records doesn’t show.
When I know the exact name of the record, I may display it using “ipa dnsrecord-show” without any timeout errors.
I have tried increasing the time limit to 20 seconds and the size limit to 20 000 using "ipa config-mod", which I know is well excessive, however I still receive the same error message.
I do find the record using ldapsearch and searching for "idnsName=dnsreco*”, so ldap itself it working when searching for a dns record using a wildcard, however the IPA framework does not seem to work.
Is there any setting I may tweak beside the "Search time limit” and "Search size limit” to make the IPA framework successfully find the DNS records?
BIND + dyndb-ldap is working just fine. All DNS records is served from the large DNS zone.
Regards.
Siggi
6 years, 1 month