local group membership for freeipa user
by John Ratliff
I want my administrators to be part of the systemd-journal group so they
can run journalctl. How can I make a group part of a local system group
like this inside ipa so I don't have to add them to every group on every
system?
Thanks.
6 years, 1 month
Certificates not renewed till 2 hours before expiring
by Christof Schulze
Hi,
some certificates on our freeipa-cluster (3 servers) are have been not
renewed till now, 2 hours before expiring. Can this be a problem?
Some of the certificates, the ones expiring show "ca-error: Invalid
cookie: '' in the "getcert list" output, what makes me nervous.
We also have the problem when certmonger can not reach the CA
CA_UNREACHABLE after restarting a freeipa-server. But when we restart
the certmonger.server after everything being up again everything looks good.
Maybe you can give me some advice what to check and which logs you else
would need.
Thanks
Christof Schulze
--
Christof Schulze
Institute of Materials Simulation (WW8)
Department of Materials Science
Friedrich-Alexander-University Erlangen-Nürnberg
Dr.-Mack-Str. 77,
90762 Fürth, Germany
Tel: 0911/65078-65069
Email: christof.schulze(a)ww.uni-erlangen.de
6 years, 1 month
Problem in accessing Free IPA from vagrant instance
by rangar
Dear Team,
I have successfully installed Free IPA in centos image of vagrant
instance , where from dhcp of my firewall i got deticated ip for Free
IPA is 192.168.2.40 .When i try to access this port in the web url of my
host i do get the message as is unreachable where as i could do ping the
ip address from my host machine terminal as well as telnet it with
default port 22.
Where host ip is 192.168.2.17.
Kindly find the screenshot.
Regards,
Rangarajan.C.R
6 years, 1 month
Getting DP Request [Account #4]: Returning [Internal Error]: 3,5,Group lookup failed
by TomK
Hey All,
I'm wondering if anyone came across this error below. We have two RHEL
7.4 servers with SSSD 1.15.2: http-srv01 and http-srv02
Both connect to the same AD DC host below: addc-srv03.addom.com.
Verified krb5.conf and sssd.conf both are identical. We can login on
the http-srv01 and can list all groups for an AD account.
On http-srv02 we cannot login and any group listing from the CLI result
only in the user's local groups. No AD groups.
Logs give us the output below. Short of adding in the entire log which
I might not be able to do till the end of the week, what could we look
at to resolve this?
There's very little available online on this error. The RH solution
doesn't make sense since the first host connects and authenticates users
just fine so it's definitely GC enabled.
--
Cheers,
Tom K.
-------------------------------------------------------------------------------------
Living on earth is expensive, but it includes a free trip around the sun.
samba-libs-4.6.2-12.el7_4.x86_64
samba-client-libs-4.6.2-12.el7_4.x86_64
sssd-1.15.2-50.el7_4.6.x86_64
openldap-2.4.44-5.el7.x86_64
sssd-ldap-1.15.2-50.el7_4.6.x86_64
sssd-common-pac-1.15.2-50.el7_4.6.x86_64
samba-winbind-clients-4.6.2-12.el7_4.x86_64
samba-common-4.6.2-12.el7_4.noarch
sssd-client-1.15.2-50.el7_4.6.x86_64
sssd-proxy-1.15.2-50.el7_4.6.x86_64
samba-winbind-modules-4.6.2-12.el7_4.x86_64
python-sssdconfig-1.15.2-50.el7_4.6.noarch
sssd-ipa-1.15.2-50.el7_4.6.x86_64
samba-common-libs-4.6.2-12.el7_4.x86_64
sssd-krb5-common-1.15.2-50.el7_4.6.x86_64
samba-winbind-4.6.2-12.el7_4.x86_64
sssd-krb5-1.15.2-50.el7_4.6.x86_64
sssd-ad-1.15.2-50.el7_4.6.x86_64
sssd-common-1.15.2-50.el7_4.6.x86_64
samba-common-tools-4.6.2-12.el7_4.x86_64
(Tue Jan 30 19:00:01 2018) [sssd[be[ADDOM]]] [sbus_dispatch] (0x4000):
dbus conn: 0x55b2e22e8700
(Tue Jan 30 19:00:01 2018) [sssd[be[ADDOM]]] [sbus_dispatch] (0x4000):
Dispatching.
(Tue Jan 30 19:00:01 2018) [sssd[be[ADDOM]]] [sbus_message_handler]
(0x2000): Received SBUS method
org.freedesktop.sssd.dataprovider.getAccountInfo on path
/org/freedesktop/sssd/dataprovider
(Tue Jan 30 19:00:01 2018) [sssd[be[ADDOM]]] [sbus_get_sender_id_send]
(0x2000): Not a sysbus message, quit
(Tue Jan 30 19:00:01 2018) [sssd[be[ADDOM]]]
[dp_get_account_info_handler] (0x0200): Got request for
[0x2][BE_REQ_GROUP][name=unix-admin-group@addom]
(Tue Jan 30 19:00:01 2018) [sssd[be[ADDOM]]] [dp_attach_req] (0x0400):
DP Request [Account #4]: New request. Flags [0x0001].
(Tue Jan 30 19:00:01 2018) [sssd[be[ADDOM]]] [dp_attach_req] (0x0400):
Number of active DP request: 1
(Tue Jan 30 19:00:01 2018) [sssd[be[ADDOM]]] [sss_domain_get_state]
(0x1000): Domain ADDOM is Active
(Tue Jan 30 19:00:01 2018) [sssd[be[ADDOM]]] [sss_domain_get_state]
(0x1000): Domain ADDOM is Active
(Tue Jan 30 19:00:01 2018) [sssd[be[ADDOM]]] [sdap_id_op_connect_step]
(0x4000): beginning to connect
(Tue Jan 30 19:00:01 2018) [sssd[be[ADDOM]]] [fo_resolve_service_send]
(0x0100): Trying to resolve service 'AD_GC'
(Tue Jan 30 19:00:01 2018) [sssd[be[ADDOM]]] [get_server_status]
(0x1000): Status of server 'addc-srv03.addom.com' is 'working'
(Tue Jan 30 19:00:01 2018) [sssd[be[ADDOM]]] [get_port_status] (0x1000):
Port status of port 0 for server 'addc-srv03.addom.com' is 'not working'
(Tue Jan 30 19:00:01 2018) [sssd[be[ADDOM]]] [get_port_status] (0x0080):
SSSD is unable to complete the full connection request, this internal
status does not necessarily indicate network port issues.
(Tue Jan 30 19:00:01 2018) [sssd[be[ADDOM]]] [fo_resolve_service_send]
(0x0020): No available servers for service 'AD_GC'
(Tue Jan 30 19:00:01 2018) [sssd[be[ADDOM]]] [be_resolve_server_done]
(0x1000): Server resolution failed: [5]: Input/output error
(Tue Jan 30 19:00:01 2018) [sssd[be[ADDOM]]] [sdap_id_op_connect_done]
(0x0400): Failed to connect to server, but ignore mark offline is enabled.
(Tue Jan 30 19:00:01 2018) [sssd[be[ADDOM]]] [sdap_id_op_connect_done]
(0x4000): notify error to op #1: 5 [Input/output error]
(Tue Jan 30 19:00:01 2018) [sssd[be[ADDOM]]] [dp_req_done] (0x0400): DP
Request [Account #4]: Request handler finished [0]: Success
(Tue Jan 30 19:00:01 2018) [sssd[be[ADDOM]]] [_dp_req_recv] (0x0400): DP
Request [Account #4]: Receiving request data.
(Tue Jan 30 19:00:01 2018) [sssd[be[ADDOM]]] [dp_req_reply_list_success]
(0x0400): DP Request [Account #4]: Finished. Success.
(Tue Jan 30 19:00:01 2018) [sssd[be[ADDOM]]] [dp_req_reply_std]
(0x1000): DP Request [Account #4]: Returning [Internal Error]: 3,5,Group
lookup failed
(Tue Jan 30 19:00:01 2018) [sssd[be[ADDOM]]] [dp_table_value_destructor]
(0x0400): Removing [0:1:0x0001:2::ADDOM:name=unix-admin-group@addom]
from reply
6 years, 1 month
How to recover from "split brain"
by Rob Brown
I have 4 IPA servers, all masters, that were previously configured in a
"full mesh" replication.
2 in "prod", 2 in "preprod".
While trying to fix a replication issue, I accidentally did a:
ipa-replica-manage del
on one of the prod servers for BOTH preprod servers.
Now, the prod servers don't "see" either of the preprod servers, so I
effectively created a "split-brain" between the 2 environments. Preprod
still "knows about" the prod ipa servers, but I can't figure out how to
re-establish the replication agreements.
I was about to just blow away the preprod servers and rebuild them (which i
did before on one of them) but noticed one of them has the "KRA" role, and
it is the only one in the domain that has it.
I don't know what that does, or what the effects would be if it went away.
I'm guessing bad.
I have tried "ipa topologysegment-reinitialize domain" on the segments that
preprod still has, but those segments did not show up in prod.
ipa topologysuffix-verify domain says "in order" everywhere.
At this point I am completely lost on how to proceed.
What details can I provide for any help anyone is willing to provide?
6 years, 1 month
Host certificates association across IPA servers
by David Harvey
Dear ipa-users,
I've recently observed a pattern where adding a host certificate to a host
only shows the association in the GUI for the server which issues the cert.
I'm running FreeIPA 4.4.4.
I request a certificate from the host(s) in question with something like:
ipa-getcert request -f /path -k /path -r
All IPA servers show the cert as being issued and valid on the certificates
page.
Visiting the "https://myserver/ipa/ui/#/e/host/details/hostame.fqdn shows a
host certificate from the machine that issued the cert
Visiting the same host page from other ipa servers does not show the host
cert associated.
Users and hosts continue to synchronise, as do other cert details!
I can manually associate the host to cert on other servers using the "add"
button in the Host certifcate section of the host page, but this feels
wrong.
Any ideas on how to troubleshoot this? It feels like the CAs don't quite
get which one is in charge, and could be a result of me tearing down the
original ubuntu based ones to replace with fedora, or a mistake I have made
whilst doing so.
Any advice appreciated,
David
6 years, 1 month
running log show late
by barrykfl@gmail.com
Hi:
Any one find that the log of systemctl | grep running show late in putty?
dirsrv(a)ABC-COM.service
loaded active running 389 Directory Server ABC.COM.
systemctl | grep running < after reboot type this not show 389 sever need
wait half - 1 min and retype then show .
Regards
Barry
6 years, 1 month