As far as I can tell I have not enabled debugging but when I do a ipactl restart I see:
[root@sso-109:(NYM) etc]$ ipactl restart
Stopping pki-tomcatd Service
Restarting Directory Service
debugging enabled, suppressing output.
Restarting krb5kdc Service
Restarting kadmin Service
Restarting httpd Service
Restarting ipa-custodia Service
Restarting ntpd Service
Restarting pki-tomcatd Service
Restarting ipa-otpd Service
FreeIPA 4.5 on CentOS 7.4
I'm trying to make Apache to access a kerberized document root on CentOS
7 using gssproxy. So far without success. On the web server machine
(=NFS client) I configured a gss-proxy config file:
# cat /etc/gssproxy/99-nfs-client.conf
mechs = krb5
cred_store = keytab:/etc/krb5.keytab
cred_store = ccache:FILE:/var/lib/gssproxy/clients/krb5cc_%U
cred_store = client_keytab:/var/lib/gssproxy/clients/%U.keytab
cred_usage = initiate
allow_any_uid = yes
trusted = yes
euid = 0
In addition to this I set up a credentials cache
The Apache user is managed using FreeIPA and is a member of the exported
directory's group that shall be used as document root, hence it should
have access permissions to the directory and kinit for "apache" shows no
However, when I "su -s /bin/bash apache" and try to access the
NFS-mounted directory, I get permission denied (even with SELinux
Right now, I do not see how I can proceed and there's not much meat on
the Google-bone for this specific topic. Can someone here point me into
the right direction?
* Is the config outlined the correct way to achieve what I want to do?
* Is there a way to debug the issue I'm furrently facing?
I wanted to ask if there is any way to exclude only one sudo commands and
allow all the others.
For example, I want to exclude "passwd" command but allow all the others
without need to write each of the one by one.
Thank you in advance for your time
Earlier this week, users reported they could no longer ssh to freeipa
joined servers using their AD login. After some inverstigation, it was
discovered if krb5_validate was set to false in the sssd.conf, AD ssh login
would start working again.
One of our IPA server is showing these errors in /var/log/messages:
Feb 13 20:53:28 ipaserver ns-slapd: [13/Feb/2018:20:53:28.823685558 +0000]
- ERR - is_allowed_to_access_attr - [file ipa_pwd_extop.c, line 786]:
slapi_access_allowed does not allow READ to ipaProtectedOperation;read_keys!
Feb 13 20:53:28 ipaserver ns-slapd: [13/Feb/2018:20:53:28.826357278 +0000]
- ERR - ipapwd_getkeytab - [file ipa_pwd_extop.c, line 1646]: Not allowed
to retrieve keytab on [IPA$(a)DOMAIN.COM] as user [fqdn=
Feb 13 20:53:28 ipaserver sssd: Failed to parse result: Insufficient access
Feb 13 20:53:28 ipaserver sssd: Failed to get keytab
I could paste the the debug logs from sssd but I'm pretty sure that error
in /var/log/messages is the root cause preventing AD ssh login. I did some
research and couldn't find anything revelant.
Any ideas how to fix this ?
I'm having strange issues with removing one of my freeIPA masters, I
managed to mess up the deletion process and my system seems to be stuck in
a state of limbo, my current setup is 3 servers ( 1 has been
decommissioned) that all share the CA/Domain responsibilities. When i run
the command .
it produces 3 servers as active masters, when this is not true as i have
uninstalled ipa-server on one. Trying to delete it through that command has
given me no luck, even using *--force* and *--cleanup* does not work. the
same error output appears:
*oxygen.eggvfx.ie <http://oxygen.eggvfx.ie>: server not found*
I'm not very good with ldap tools but after running
*ldapsearch -x *
there is a reference to the oxygen server still sitting in there, it seems
that the dirty entry is still hanging around my system, i'm wondering if
there is any way to resolve this?
*defaultServerList: oxygen.eggvfx.ie <http://oxygen.eggvfx.ie>
nitrogen.eggvfx.ie <http://nitrogen.eggvfx.ie> lithium.eggvfx.ie
Looking at the topology graph in the web ui i can see that there are still
ties between one of my servers and oxygen. It will also not allow me to
delete the server ties ( error: *Server is unwilling to perform: Removal of
Segment disconnects topology.Deletion not allowed.)* nor will the ui allow
me to delete the IPA server (*oxygen.eggvfx.ie <http://oxygen.eggvfx.ie>:
server not found*)
Any help is greatly appreciated,
I'm sorry for a dumb question, but i cant find documentation on ldif file syntax, that can be used for unattended installation (with ldapmodify) like
ipa-server-install --dirsrv-config-file someparams.ldif.
Can someone point me to this doc or share the example of this file?
I know I have sent in multiple emails, but we are trying to deploy FreeIPA correctly. However I am getting asked to find out some other details.
Can FreeIPA survive w/o DNS? We would like to implement FreeIPA and still be able to use the SSH, sudo, selinux, LDAP & krb5.
We are moving to AWS and management is afraid that we will have to maintain multiple sets of DNS. And that if FreeIPA is the focal point for all servers and god for bid it crashes, there goes our whole environment. They would like to put the zone in R53 and have that handle ALL the records. If we do go through with not installing DNS w/ FreeIPA will we be shooting ourselves in the foot?
I know that FreeIPA relies heavily on DNS and I have seen multiple conversations regarding not to do this, but is this somewhere in the best practices?
I found this thread from 2015 but I don't think it applies anymore:Re: [Freeipa-users] Can freeIPA work without Kerberos and DNS
Re: [Freeipa-users] Can freeIPA work without Kerberos and DNS
The problem is that we have 30 domains that we want to use in R53 and he wants to bypass FreeIPA for doing DNS other than for auth and sudo and ldap. Could we put entries in the /etc/hosts file to point to the FreeIPA servers? I feel like this might work and might be more problematic down the line.
I am looking into migrating an existing deployment of LDAP with hundreds of users and hundreds of groups into a IPA solution with trust against AD. All users currently exists with the same names in AD but groups does not, one solution would be adding all those groups to AD with gidNumber set to only administer the users and groups in AD. External groups seems to be the solution, but that would require external groups created in the IPA, I would like to avoid that and have tested with groups only in AD with gidNumber set and it seems to work, I can at least see the group and SUDO rules works with the group.
So my question is, can you use groups in AD without referencing them in IPA and any please throw in any other suggestions for trying to have all data in active directory without having to change anything in the IPA when adding users or groups (or host/netgroups for that matter)
Sent from my iPad