I need some clarification on this. I have my FreeIPA server in talking. NTP is working. However Some servers are getting ntp drift. If I go into /etc/ntp.conf I see that at the bottom FreeIPA adds server at the bottom of the file.
### Added by IPA Installer ###server 127.127.1.0 iburstfudge 127.127.1.0 stratum 10server 126.96.36.199 # added by /sbin/dhclient-scriptserver 188.8.131.52 # added by /sbin/dhclient-scriptserver 184.108.40.206 # added by /sbin/dhclient-scriptserver 220.127.116.11 # added by /sbin/dhclient-script[centos@freeipa03 ~]$
But under the public servers at the top should I leave the the centos public ntp servers? Should I add the FreeIPA servers?
Hi FreeIPA users,
As briefly mentioned in "[Freeipa-users] FreeIPA PKI with OpenVPN",
I'm looking into using FreeIPA and Dogtag to provide network certs for
Chromebooks (from reading so far it looks like I'll need to use SCEP or CMC
- the latter being preferred).
Has anyone achieved this, or can anyone offer any pointers to either the
server or client/extension side hurdles?
I came to the team new and don’t know the background, as to what all had been done, and recently we started getting one issue in DR environment:
Using IPA 3.0.0 in both PROD/DR
While trying to delete a host using IPA-UI or CLI, it is giving SSL error in DR(working in Prod):
cannot connect to 'https://hostname:443/ca/agent/ca/displayBySerial': (SSL_ERROR_BAD_CERT_ALERT) SSL peer cannot verify your certificate.
I set the debug mode and on making request: (ipa ping), I can see below error:
ipa: INFO: Connection to https:hostnmae/ipa/xml failed with (SSL_ERROR_RX_RECORD_TOO_LONG) SSL received a record that exceeded the maximum permissible length.
ipa: ERROR: cannot connect to Gettext('any of the configured servers', domain='ipa', localedir=None): https://hostname, https:hostname1/ipa/xml
On troubleshooting, came across this(https://www.freeipa.org/page/Troubleshooting#Authentication_Errors):
Ran below on DR:
Use getcert list -d /etc/httpd/alias -n ipaCert
Request ID '20170303094036':
OK, till here, it means certificate nick-named ipaCert is being managed by Certmonger
If it isn't in MONITORING, or it is and things still aren't working, compare the serial number of the certificate with that on other IPA masters:
# certutil -L -d /etc/httpd/alias -n ipaCert | grep Serial
certutil: Could not find cert: ipaCert
: PR_FILE_NOT_FOUND_ERROR: File not found
So, something is wrong here.
In PROD, it works fine:
[root@ProdHostName ~]# certutil -L -d /etc/httpd/alias -n ipaCert | grep Serial
Serial Number: 7 (0x7)
Further, investing the issue on DR:
[root@DRHostName ipacerts]# certutil -L -d /etc/httpd/alias
Certificate Nickname Trust Attributes
[root@ProdHostName ~]# certutil -L -d /etc/httpd/alias
Certificate Nickname Trust Attributes
FQDN IPA CA CT,C,C
I am not sure, but certificate - ‘ipaCert’ not being shown on using ‘certutil’ command seems to be an issue, need guidelines to understand, whether my investigation is on current line and if yes, how to resolve this.
Will be happy to provide the output of any command or log-file.
I'm having problems with HOTP with hardware tokens. They are Yubkey
Neos, but physical access to the server is not a viable solution.
I've configured keys and converted the hex to base 32. I've also
generated HOTP via FreeIPA from the GUI and the CLI and converted
those to hex and wrote those to the key. Both approaches have been
tested and the generated OTPs appear to be valid.
The issue is that when HOTP is enabled OTP does not appear to work.
I've tested via kinit with an armored request and no pre-auth prompt
for the OTP is presented. However, when tested with TOTP a prompt does
appear and works appropriately.
Perusing the list and web led me to a bug that was specific to expired
passwords, which is not what I'm dealing with (AFAIK). I'm wondering
if anyone else is seeing this issue - HOTP not working when TOTP does
++ Adding Team freeipa-users(a)lists.fedorahosted.org
Team Need help on the above concern.
On 28 March 2018 at 12:29, Michal Reznik <mreznik(a)redhat.com> wrote:
> Thanks for your interest in FreeIPA. I would like to point you to "
> freeipa-users(a)lists.fedorahosted.org" mailing list with regards of your
> question as my knowledge of AD domain is quite limited and so that also
> others can benefit from the info in the thread.
> On Tue, Mar 27, 2018 at 8:08 PM, Vaibhav Jain <vaibhavjain882(a)gmail.com>
>> Hey Michal,
>> Hope you are doing good. I am working with FreeIPA these days and I find
>> this software amazing. Currently I am struggling with one problem, How to
>> sync all the Windows AD users with password in FreeIPA deployed on a Centos
>> box in replication mode. I tried searching for this over internet but
>> didn't find any feasible solution for this. If you have any idea on this or
>> any document on this please share. That will be a great help for me. If you
>> know someone who can help me out with this please forward this mail to
>> him/her or add him in this mail chain.
>> Happy to have your contact. :D
>> Vaibhav Jain
>> +91-8930011448 <+91%2089300%2011448>
> Michal Reznik
> FreeIPA QE,
> Red Hat Brno <https://www.redhat.com>